net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18
  19 #include <linux/kmod.h>
  20 #include <linux/module.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/netfilter/x_tables.h>
  23 #include <linux/netfilter_bridge/ebtables.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/mutex.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  37                                          ": out of memory: "format, ## args)
  38 /* #define MEMPRINT(format, args...) */
  39
  40
  41
  42 /*
  43  * Each cpu has its own set of counters, so there is no need for write_lock in
  44  * the softirq
  45  * For reading or updating the counters, the user context needs to
  46  * get a write_lock
  47  */
  48
  49 /* The size of each set of counters is altered to get cache alignment */
  50 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  51 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  52 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  53    COUNTER_OFFSET(n) * cpu))
  54
  55
  56
  57 static DEFINE_MUTEX(ebt_mutex);
  58
  59 static struct xt_target ebt_standard_target = {
  60         .name       = "standard",
  61         .revision   = 0,
  62         .family     = NFPROTO_BRIDGE,
  63         .targetsize = sizeof(int),
  64 };
  65
  66 static inline int
  67 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  68                struct xt_target_param *par)
  69 {
  70         par->target   = w->u.watcher;
  71         par->targinfo = w->data;
  72         w->u.watcher->target(skb, par);
  73         /* watchers don't give a verdict */
  74         return 0;
  75 }
  76
  77 static inline int ebt_do_match (struct ebt_entry_match *m,
  78    const struct sk_buff *skb, struct xt_match_param *par)
  79 {
  80         par->match     = m->u.match;
  81         par->matchinfo = m->data;
  82         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
  83 }
  84
  85 static inline int
  86 ebt_dev_check(const char *entry, const struct net_device *device)
  87 {
  88         int i = 0;
  89         const char *devname;
  90
  91         if (*entry == '\0')
  92                 return 0;
  93         if (!device)
  94                 return 1;
  95         devname = device->name;
  96         /* 1 is the wildcard token */
  97         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
  98                 i++;
  99         return (devname[i] != entry[i] && entry[i] != 1);
 100 }
 101
 102 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 103 /* process standard matches */
 104 static inline int
 105 ebt_basic_match(const struct ebt_entry *e, const struct ethhdr *h,
 106                 const struct net_device *in, const struct net_device *out)
 107 {
 108         int verdict, i;
 109
 110         if (e->bitmask & EBT_802_3) {
 111                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 112                         return 1;
 113         } else if (!(e->bitmask & EBT_NOPROTO) &&
 114            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 115                 return 1;
 116
 117         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 118                 return 1;
 119         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 120                 return 1;
 121         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 122            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 123                 return 1;
 124         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 125            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 126                 return 1;
 127
 128         if (e->bitmask & EBT_SOURCEMAC) {
 129                 verdict = 0;
 130                 for (i = 0; i < 6; i++)
 131                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 132                            e->sourcemsk[i];
 133                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 134                         return 1;
 135         }
 136         if (e->bitmask & EBT_DESTMAC) {
 137                 verdict = 0;
 138                 for (i = 0; i < 6; i++)
 139                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 140                            e->destmsk[i];
 141                 if (FWINV2(verdict != 0, EBT_IDEST) )
 142                         return 1;
 143         }
 144         return 0;
 145 }
 146
 147 static inline __pure
 148 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 149 {
 150         return (void *)entry + entry->next_offset;
 151 }
 152
 153 /* Do some firewalling */
 154 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 155    const struct net_device *in, const struct net_device *out,
 156    struct ebt_table *table)
 157 {
 158         int i, nentries;
 159         struct ebt_entry *point;
 160         struct ebt_counter *counter_base, *cb_base;
 161         const struct ebt_entry_target *t;
 162         int verdict, sp = 0;
 163         struct ebt_chainstack *cs;
 164         struct ebt_entries *chaininfo;
 165         const char *base;
 166         const struct ebt_table_info *private;
 167         bool hotdrop = false;
 168         struct xt_match_param mtpar;
 169         struct xt_target_param tgpar;
 170
 171         mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
 172         mtpar.in      = tgpar.in  = in;
 173         mtpar.out     = tgpar.out = out;
 174         mtpar.hotdrop = &hotdrop;
 175         mtpar.hooknum = tgpar.hooknum = hook;
 176
 177         read_lock_bh(&table->lock);
 178         private = table->private;
 179         cb_base = COUNTER_BASE(private->counters, private->nentries,
 180            smp_processor_id());
 181         if (private->chainstack)
 182                 cs = private->chainstack[smp_processor_id()];
 183         else
 184                 cs = NULL;
 185         chaininfo = private->hook_entry[hook];
 186         nentries = private->hook_entry[hook]->nentries;
 187         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 188         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 189         /* base for chain jumps */
 190         base = private->entries;
 191         i = 0;
 192         while (i < nentries) {
 193                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 194                         goto letscontinue;
 195
 196                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
 197                         goto letscontinue;
 198                 if (hotdrop) {
 199                         read_unlock_bh(&table->lock);
 200                         return NF_DROP;
 201                 }
 202
 203                 /* increase counter */
 204                 (*(counter_base + i)).pcnt++;
 205                 (*(counter_base + i)).bcnt += skb->len;
 206
 207                 /* these should only watch: not modify, nor tell us
 208                    what to do with the packet */
 209                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
 210
 211                 t = (struct ebt_entry_target *)
 212                    (((char *)point) + point->target_offset);
 213                 /* standard target */
 214                 if (!t->u.target->target)
 215                         verdict = ((struct ebt_standard_target *)t)->verdict;
 216                 else {
 217                         tgpar.target   = t->u.target;
 218                         tgpar.targinfo = t->data;
 219                         verdict = t->u.target->target(skb, &tgpar);
 220                 }
 221                 if (verdict == EBT_ACCEPT) {
 222                         read_unlock_bh(&table->lock);
 223                         return NF_ACCEPT;
 224                 }
 225                 if (verdict == EBT_DROP) {
 226                         read_unlock_bh(&table->lock);
 227                         return NF_DROP;
 228                 }
 229                 if (verdict == EBT_RETURN) {
 230 letsreturn:
 231 #ifdef CONFIG_NETFILTER_DEBUG
 232                         if (sp == 0) {
 233                                 BUGPRINT("RETURN on base chain");
 234                                 /* act like this is EBT_CONTINUE */
 235                                 goto letscontinue;
 236                         }
 237 #endif
 238                         sp--;
 239                         /* put all the local variables right */
 240                         i = cs[sp].n;
 241                         chaininfo = cs[sp].chaininfo;
 242                         nentries = chaininfo->nentries;
 243                         point = cs[sp].e;
 244                         counter_base = cb_base +
 245                            chaininfo->counter_offset;
 246                         continue;
 247                 }
 248                 if (verdict == EBT_CONTINUE)
 249                         goto letscontinue;
 250 #ifdef CONFIG_NETFILTER_DEBUG
 251                 if (verdict < 0) {
 252                         BUGPRINT("bogus standard verdict\n");
 253                         read_unlock_bh(&table->lock);
 254                         return NF_DROP;
 255                 }
 256 #endif
 257                 /* jump to a udc */
 258                 cs[sp].n = i + 1;
 259                 cs[sp].chaininfo = chaininfo;
 260                 cs[sp].e = ebt_next_entry(point);
 261                 i = 0;
 262                 chaininfo = (struct ebt_entries *) (base + verdict);
 263 #ifdef CONFIG_NETFILTER_DEBUG
 264                 if (chaininfo->distinguisher) {
 265                         BUGPRINT("jump to non-chain\n");
 266                         read_unlock_bh(&table->lock);
 267                         return NF_DROP;
 268                 }
 269 #endif
 270                 nentries = chaininfo->nentries;
 271                 point = (struct ebt_entry *)chaininfo->data;
 272                 counter_base = cb_base + chaininfo->counter_offset;
 273                 sp++;
 274                 continue;
 275 letscontinue:
 276                 point = ebt_next_entry(point);
 277                 i++;
 278         }
 279
 280         /* I actually like this :) */
 281         if (chaininfo->policy == EBT_RETURN)
 282                 goto letsreturn;
 283         if (chaininfo->policy == EBT_ACCEPT) {
 284                 read_unlock_bh(&table->lock);
 285                 return NF_ACCEPT;
 286         }
 287         read_unlock_bh(&table->lock);
 288         return NF_DROP;
 289 }
 290
 291 /* If it succeeds, returns element and locks mutex */
 292 static inline void *
 293 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 294    struct mutex *mutex)
 295 {
 296         struct {
 297                 struct list_head list;
 298                 char name[EBT_FUNCTION_MAXNAMELEN];
 299         } *e;
 300
 301         *error = mutex_lock_interruptible(mutex);
 302         if (*error != 0)
 303                 return NULL;
 304
 305         list_for_each_entry(e, head, list) {
 306                 if (strcmp(e->name, name) == 0)
 307                         return e;
 308         }
 309         *error = -ENOENT;
 310         mutex_unlock(mutex);
 311         return NULL;
 312 }
 313
 314 static void *
 315 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 316    int *error, struct mutex *mutex)
 317 {
 318         return try_then_request_module(
 319                         find_inlist_lock_noload(head, name, error, mutex),
 320                         "%s%s", prefix, name);
 321 }
 322
 323 static inline struct ebt_table *
 324 find_table_lock(struct net *net, const char *name, int *error,
 325                 struct mutex *mutex)
 326 {
 327         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 328                                 "ebtable_", error, mutex);
 329 }
 330
 331 static inline int
 332 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 333                 unsigned int *cnt)
 334 {
 335         const struct ebt_entry *e = par->entryinfo;
 336         struct xt_match *match;
 337         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 338         int ret;
 339
 340         if (left < sizeof(struct ebt_entry_match) ||
 341             left - sizeof(struct ebt_entry_match) < m->match_size)
 342                 return -EINVAL;
 343
 344         match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
 345                 m->u.name, 0), "ebt_%s", m->u.name);
 346         if (IS_ERR(match))
 347                 return PTR_ERR(match);
 348         if (match == NULL)
 349                 return -ENOENT;
 350         m->u.match = match;
 351
 352         par->match     = match;
 353         par->matchinfo = m->data;
 354         ret = xt_check_match(par, m->match_size,
 355               e->ethproto, e->invflags & EBT_IPROTO);
 356         if (ret < 0) {
 357                 module_put(match->me);
 358                 return ret;
 359         }
 360
 361         (*cnt)++;
 362         return 0;
 363 }
 364
 365 static inline int
 366 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 367                   unsigned int *cnt)
 368 {
 369         const struct ebt_entry *e = par->entryinfo;
 370         struct xt_target *watcher;
 371         size_t left = ((char *)e + e->target_offset) - (char *)w;
 372         int ret;
 373
 374         if (left < sizeof(struct ebt_entry_watcher) ||
 375            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 376                 return -EINVAL;
 377
 378         watcher = try_then_request_module(
 379                   xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
 380                   "ebt_%s", w->u.name);
 381         if (IS_ERR(watcher))
 382                 return PTR_ERR(watcher);
 383         if (watcher == NULL)
 384                 return -ENOENT;
 385         w->u.watcher = watcher;
 386
 387         par->target   = watcher;
 388         par->targinfo = w->data;
 389         ret = xt_check_target(par, w->watcher_size,
 390               e->ethproto, e->invflags & EBT_IPROTO);
 391         if (ret < 0) {
 392                 module_put(watcher->me);
 393                 return ret;
 394         }
 395
 396         (*cnt)++;
 397         return 0;
 398 }
 399
 400 static int ebt_verify_pointers(const struct ebt_replace *repl,
 401                                struct ebt_table_info *newinfo)
 402 {
 403         unsigned int limit = repl->entries_size;
 404         unsigned int valid_hooks = repl->valid_hooks;
 405         unsigned int offset = 0;
 406         int i;
 407
 408         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 409                 newinfo->hook_entry[i] = NULL;
 410
 411         newinfo->entries_size = repl->entries_size;
 412         newinfo->nentries = repl->nentries;
 413
 414         while (offset < limit) {
 415                 size_t left = limit - offset;
 416                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 417
 418                 if (left < sizeof(unsigned int))
 419                         break;
 420
 421                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 422                         if ((valid_hooks & (1 << i)) == 0)
 423                                 continue;
 424                         if ((char __user *)repl->hook_entry[i] ==
 425                              repl->entries + offset)
 426                                 break;
 427                 }
 428
 429                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 430                         if (e->bitmask != 0) {
 431                                 /* we make userspace set this right,
 432                                    so there is no misunderstanding */
 433                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 434                                          "in distinguisher\n");
 435                                 return -EINVAL;
 436                         }
 437                         if (i != NF_BR_NUMHOOKS)
 438                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 439                         if (left < sizeof(struct ebt_entries))
 440                                 break;
 441                         offset += sizeof(struct ebt_entries);
 442                 } else {
 443                         if (left < sizeof(struct ebt_entry))
 444                                 break;
 445                         if (left < e->next_offset)
 446                                 break;
 447                         offset += e->next_offset;
 448                 }
 449         }
 450         if (offset != limit) {
 451                 BUGPRINT("entries_size too small\n");
 452                 return -EINVAL;
 453         }
 454
 455         /* check if all valid hooks have a chain */
 456         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 457                 if (!newinfo->hook_entry[i] &&
 458                    (valid_hooks & (1 << i))) {
 459                         BUGPRINT("Valid hook without chain\n");
 460                         return -EINVAL;
 461                 }
 462         }
 463         return 0;
 464 }
 465
 466 /*
 467  * this one is very careful, as it is the first function
 468  * to parse the userspace data
 469  */
 470 static inline int
 471 ebt_check_entry_size_and_hooks(const struct ebt_entry *e,
 472    const struct ebt_table_info *newinfo,
 473    unsigned int *n, unsigned int *cnt,
 474    unsigned int *totalcnt, unsigned int *udc_cnt)
 475 {
 476         int i;
 477
 478         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 479                 if ((void *)e == (void *)newinfo->hook_entry[i])
 480                         break;
 481         }
 482         /* beginning of a new chain
 483            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 484         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 485                 /* this checks if the previous chain has as many entries
 486                    as it said it has */
 487                 if (*n != *cnt) {
 488                         BUGPRINT("nentries does not equal the nr of entries "
 489                                  "in the chain\n");
 490                         return -EINVAL;
 491                 }
 492                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 493                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 494                         /* only RETURN from udc */
 495                         if (i != NF_BR_NUMHOOKS ||
 496                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 497                                 BUGPRINT("bad policy\n");
 498                                 return -EINVAL;
 499                         }
 500                 }
 501                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 502                         (*udc_cnt)++;
 503                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 504                         BUGPRINT("counter_offset != totalcnt");
 505                         return -EINVAL;
 506                 }
 507                 *n = ((struct ebt_entries *)e)->nentries;
 508                 *cnt = 0;
 509                 return 0;
 510         }
 511         /* a plain old entry, heh */
 512         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 513            e->watchers_offset > e->target_offset ||
 514            e->target_offset >= e->next_offset) {
 515                 BUGPRINT("entry offsets not in right order\n");
 516                 return -EINVAL;
 517         }
 518         /* this is not checked anywhere else */
 519         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 520                 BUGPRINT("target size too small\n");
 521                 return -EINVAL;
 522         }
 523         (*cnt)++;
 524         (*totalcnt)++;
 525         return 0;
 526 }
 527
 528 struct ebt_cl_stack
 529 {
 530         struct ebt_chainstack cs;
 531         int from;
 532         unsigned int hookmask;
 533 };
 534
 535 /*
 536  * we need these positions to check that the jumps to a different part of the
 537  * entries is a jump to the beginning of a new chain.
 538  */
 539 static inline int
 540 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 541    unsigned int *n, struct ebt_cl_stack *udc)
 542 {
 543         int i;
 544
 545         /* we're only interested in chain starts */
 546         if (e->bitmask)
 547                 return 0;
 548         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 549                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 550                         break;
 551         }
 552         /* only care about udc */
 553         if (i != NF_BR_NUMHOOKS)
 554                 return 0;
 555
 556         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 557         /* these initialisations are depended on later in check_chainloops() */
 558         udc[*n].cs.n = 0;
 559         udc[*n].hookmask = 0;
 560
 561         (*n)++;
 562         return 0;
 563 }
 564
 565 static inline int
 566 ebt_cleanup_match(struct ebt_entry_match *m, struct net *net, unsigned int *i)
 567 {
 568         struct xt_mtdtor_param par;
 569
 570         if (i && (*i)-- == 0)
 571                 return 1;
 572
 573         par.net       = net;
 574         par.match     = m->u.match;
 575         par.matchinfo = m->data;
 576         par.family    = NFPROTO_BRIDGE;
 577         if (par.match->destroy != NULL)
 578                 par.match->destroy(&par);
 579         module_put(par.match->me);
 580         return 0;
 581 }
 582
 583 static inline int
 584 ebt_cleanup_watcher(struct ebt_entry_watcher *w, struct net *net, unsigned int *i)
 585 {
 586         struct xt_tgdtor_param par;
 587
 588         if (i && (*i)-- == 0)
 589                 return 1;
 590
 591         par.net      = net;
 592         par.target   = w->u.watcher;
 593         par.targinfo = w->data;
 594         par.family   = NFPROTO_BRIDGE;
 595         if (par.target->destroy != NULL)
 596                 par.target->destroy(&par);
 597         module_put(par.target->me);
 598         return 0;
 599 }
 600
 601 static inline int
 602 ebt_cleanup_entry(struct ebt_entry *e, struct net *net, unsigned int *cnt)
 603 {
 604         struct xt_tgdtor_param par;
 605         struct ebt_entry_target *t;
 606
 607         if (e->bitmask == 0)
 608                 return 0;
 609         /* we're done */
 610         if (cnt && (*cnt)-- == 0)
 611                 return 1;
 612         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, NULL);
 613         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, NULL);
 614         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 615
 616         par.net      = net;
 617         par.target   = t->u.target;
 618         par.targinfo = t->data;
 619         par.family   = NFPROTO_BRIDGE;
 620         if (par.target->destroy != NULL)
 621                 par.target->destroy(&par);
 622         module_put(par.target->me);
 623         return 0;
 624 }
 625
 626 static inline int
 627 ebt_check_entry(struct ebt_entry *e, struct net *net,
 628    const struct ebt_table_info *newinfo,
 629    const char *name, unsigned int *cnt,
 630    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 631 {
 632         struct ebt_entry_target *t;
 633         struct xt_target *target;
 634         unsigned int i, j, hook = 0, hookmask = 0;
 635         size_t gap;
 636         int ret;
 637         struct xt_mtchk_param mtpar;
 638         struct xt_tgchk_param tgpar;
 639
 640         /* don't mess with the struct ebt_entries */
 641         if (e->bitmask == 0)
 642                 return 0;
 643
 644         if (e->bitmask & ~EBT_F_MASK) {
 645                 BUGPRINT("Unknown flag for bitmask\n");
 646                 return -EINVAL;
 647         }
 648         if (e->invflags & ~EBT_INV_MASK) {
 649                 BUGPRINT("Unknown flag for inv bitmask\n");
 650                 return -EINVAL;
 651         }
 652         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 653                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 654                 return -EINVAL;
 655         }
 656         /* what hook do we belong to? */
 657         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 658                 if (!newinfo->hook_entry[i])
 659                         continue;
 660                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 661                         hook = i;
 662                 else
 663                         break;
 664         }
 665         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 666            a base chain */
 667         if (i < NF_BR_NUMHOOKS)
 668                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 669         else {
 670                 for (i = 0; i < udc_cnt; i++)
 671                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 672                                 break;
 673                 if (i == 0)
 674                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 675                 else
 676                         hookmask = cl_s[i - 1].hookmask;
 677         }
 678         i = 0;
 679
 680         mtpar.net       = tgpar.net       = net;
 681         mtpar.table     = tgpar.table     = name;
 682         mtpar.entryinfo = tgpar.entryinfo = e;
 683         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 684         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 685         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 686         if (ret != 0)
 687                 goto cleanup_matches;
 688         j = 0;
 689         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 690         if (ret != 0)
 691                 goto cleanup_watchers;
 692         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 693         gap = e->next_offset - e->target_offset;
 694
 695         target = try_then_request_module(
 696                  xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
 697                  "ebt_%s", t->u.name);
 698         if (IS_ERR(target)) {
 699                 ret = PTR_ERR(target);
 700                 goto cleanup_watchers;
 701         } else if (target == NULL) {
 702                 ret = -ENOENT;
 703                 goto cleanup_watchers;
 704         }
 705
 706         t->u.target = target;
 707         if (t->u.target == &ebt_standard_target) {
 708                 if (gap < sizeof(struct ebt_standard_target)) {
 709                         BUGPRINT("Standard target size too big\n");
 710                         ret = -EFAULT;
 711                         goto cleanup_watchers;
 712                 }
 713                 if (((struct ebt_standard_target *)t)->verdict <
 714                    -NUM_STANDARD_TARGETS) {
 715                         BUGPRINT("Invalid standard target\n");
 716                         ret = -EFAULT;
 717                         goto cleanup_watchers;
 718                 }
 719         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 720                 module_put(t->u.target->me);
 721                 ret = -EFAULT;
 722                 goto cleanup_watchers;
 723         }
 724
 725         tgpar.target   = target;
 726         tgpar.targinfo = t->data;
 727         ret = xt_check_target(&tgpar, t->target_size,
 728               e->ethproto, e->invflags & EBT_IPROTO);
 729         if (ret < 0) {
 730                 module_put(target->me);
 731                 goto cleanup_watchers;
 732         }
 733         (*cnt)++;
 734         return 0;
 735 cleanup_watchers:
 736         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, net, &j);
 737 cleanup_matches:
 738         EBT_MATCH_ITERATE(e, ebt_cleanup_match, net, &i);
 739         return ret;
 740 }
 741
 742 /*
 743  * checks for loops and sets the hook mask for udc
 744  * the hook mask for udc tells us from which base chains the udc can be
 745  * accessed. This mask is a parameter to the check() functions of the extensions
 746  */
 747 static int check_chainloops(const struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 748    unsigned int udc_cnt, unsigned int hooknr, char *base)
 749 {
 750         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 751         const struct ebt_entry *e = (struct ebt_entry *)chain->data;
 752         const struct ebt_entry_target *t;
 753
 754         while (pos < nentries || chain_nr != -1) {
 755                 /* end of udc, go back one 'recursion' step */
 756                 if (pos == nentries) {
 757                         /* put back values of the time when this chain was called */
 758                         e = cl_s[chain_nr].cs.e;
 759                         if (cl_s[chain_nr].from != -1)
 760                                 nentries =
 761                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 762                         else
 763                                 nentries = chain->nentries;
 764                         pos = cl_s[chain_nr].cs.n;
 765                         /* make sure we won't see a loop that isn't one */
 766                         cl_s[chain_nr].cs.n = 0;
 767                         chain_nr = cl_s[chain_nr].from;
 768                         if (pos == nentries)
 769                                 continue;
 770                 }
 771                 t = (struct ebt_entry_target *)
 772                    (((char *)e) + e->target_offset);
 773                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 774                         goto letscontinue;
 775                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 776                    e->next_offset) {
 777                         BUGPRINT("Standard target size too big\n");
 778                         return -1;
 779                 }
 780                 verdict = ((struct ebt_standard_target *)t)->verdict;
 781                 if (verdict >= 0) { /* jump to another chain */
 782                         struct ebt_entries *hlp2 =
 783                            (struct ebt_entries *)(base + verdict);
 784                         for (i = 0; i < udc_cnt; i++)
 785                                 if (hlp2 == cl_s[i].cs.chaininfo)
 786                                         break;
 787                         /* bad destination or loop */
 788                         if (i == udc_cnt) {
 789                                 BUGPRINT("bad destination\n");
 790                                 return -1;
 791                         }
 792                         if (cl_s[i].cs.n) {
 793                                 BUGPRINT("loop\n");
 794                                 return -1;
 795                         }
 796                         if (cl_s[i].hookmask & (1 << hooknr))
 797                                 goto letscontinue;
 798                         /* this can't be 0, so the loop test is correct */
 799                         cl_s[i].cs.n = pos + 1;
 800                         pos = 0;
 801                         cl_s[i].cs.e = ebt_next_entry(e);
 802                         e = (struct ebt_entry *)(hlp2->data);
 803                         nentries = hlp2->nentries;
 804                         cl_s[i].from = chain_nr;
 805                         chain_nr = i;
 806                         /* this udc is accessible from the base chain for hooknr */
 807                         cl_s[i].hookmask |= (1 << hooknr);
 808                         continue;
 809                 }
 810 letscontinue:
 811                 e = ebt_next_entry(e);
 812                 pos++;
 813         }
 814         return 0;
 815 }
 816
 817 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 818 static int translate_table(struct net *net, const char *name,
 819                            struct ebt_table_info *newinfo)
 820 {
 821         unsigned int i, j, k, udc_cnt;
 822         int ret;
 823         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 824
 825         i = 0;
 826         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 827                 i++;
 828         if (i == NF_BR_NUMHOOKS) {
 829                 BUGPRINT("No valid hooks specified\n");
 830                 return -EINVAL;
 831         }
 832         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 833                 BUGPRINT("Chains don't start at beginning\n");
 834                 return -EINVAL;
 835         }
 836         /* make sure chains are ordered after each other in same order
 837            as their corresponding hooks */
 838         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 839                 if (!newinfo->hook_entry[j])
 840                         continue;
 841                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 842                         BUGPRINT("Hook order must be followed\n");
 843                         return -EINVAL;
 844                 }
 845                 i = j;
 846         }
 847
 848         /* do some early checkings and initialize some things */
 849         i = 0; /* holds the expected nr. of entries for the chain */
 850         j = 0; /* holds the up to now counted entries for the chain */
 851         k = 0; /* holds the total nr. of entries, should equal
 852                   newinfo->nentries afterwards */
 853         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 854         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 855            ebt_check_entry_size_and_hooks, newinfo,
 856            &i, &j, &k, &udc_cnt);
 857
 858         if (ret != 0)
 859                 return ret;
 860
 861         if (i != j) {
 862                 BUGPRINT("nentries does not equal the nr of entries in the "
 863                          "(last) chain\n");
 864                 return -EINVAL;
 865         }
 866         if (k != newinfo->nentries) {
 867                 BUGPRINT("Total nentries is wrong\n");
 868                 return -EINVAL;
 869         }
 870
 871         /* get the location of the udc, put them in an array
 872            while we're at it, allocate the chainstack */
 873         if (udc_cnt) {
 874                 /* this will get free'd in do_replace()/ebt_register_table()
 875                    if an error occurs */
 876                 newinfo->chainstack =
 877                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 878                 if (!newinfo->chainstack)
 879                         return -ENOMEM;
 880                 for_each_possible_cpu(i) {
 881                         newinfo->chainstack[i] =
 882                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 883                         if (!newinfo->chainstack[i]) {
 884                                 while (i)
 885                                         vfree(newinfo->chainstack[--i]);
 886                                 vfree(newinfo->chainstack);
 887                                 newinfo->chainstack = NULL;
 888                                 return -ENOMEM;
 889                         }
 890                 }
 891
 892                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 893                 if (!cl_s)
 894                         return -ENOMEM;
 895                 i = 0; /* the i'th udc */
 896                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 897                    ebt_get_udc_positions, newinfo, &i, cl_s);
 898                 /* sanity check */
 899                 if (i != udc_cnt) {
 900                         BUGPRINT("i != udc_cnt\n");
 901                         vfree(cl_s);
 902                         return -EFAULT;
 903                 }
 904         }
 905
 906         /* Check for loops */
 907         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 908                 if (newinfo->hook_entry[i])
 909                         if (check_chainloops(newinfo->hook_entry[i],
 910                            cl_s, udc_cnt, i, newinfo->entries)) {
 911                                 vfree(cl_s);
 912                                 return -EINVAL;
 913                         }
 914
 915         /* we now know the following (along with E=mc²):
 916            - the nr of entries in each chain is right
 917            - the size of the allocated space is right
 918            - all valid hooks have a corresponding chain
 919            - there are no loops
 920            - wrong data can still be on the level of a single entry
 921            - could be there are jumps to places that are not the
 922              beginning of a chain. This can only occur in chains that
 923              are not accessible from any base chains, so we don't care. */
 924
 925         /* used to know what we need to clean up if something goes wrong */
 926         i = 0;
 927         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 928            ebt_check_entry, net, newinfo, name, &i, cl_s, udc_cnt);
 929         if (ret != 0) {
 930                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 931                                   ebt_cleanup_entry, net, &i);
 932         }
 933         vfree(cl_s);
 934         return ret;
 935 }
 936
 937 /* called under write_lock */
 938 static void get_counters(const struct ebt_counter *oldcounters,
 939    struct ebt_counter *counters, unsigned int nentries)
 940 {
 941         int i, cpu;
 942         struct ebt_counter *counter_base;
 943
 944         /* counters of cpu 0 */
 945         memcpy(counters, oldcounters,
 946                sizeof(struct ebt_counter) * nentries);
 947
 948         /* add other counters to those of cpu 0 */
 949         for_each_possible_cpu(cpu) {
 950                 if (cpu == 0)
 951                         continue;
 952                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 953                 for (i = 0; i < nentries; i++) {
 954                         counters[i].pcnt += counter_base[i].pcnt;
 955                         counters[i].bcnt += counter_base[i].bcnt;
 956                 }
 957         }
 958 }
 959
 960 /* replace the table */
 961 static int do_replace(struct net *net, const void __user *user,
 962                       unsigned int len)
 963 {
 964         int ret, i, countersize;
 965         struct ebt_table_info *newinfo;
 966         struct ebt_replace tmp;
 967         struct ebt_table *t;
 968         struct ebt_counter *counterstmp = NULL;
 969         /* used to be able to unlock earlier */
 970         struct ebt_table_info *table;
 971
 972         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 973                 return -EFAULT;
 974
 975         if (len != sizeof(tmp) + tmp.entries_size) {
 976                 BUGPRINT("Wrong len argument\n");
 977                 return -EINVAL;
 978         }
 979
 980         if (tmp.entries_size == 0) {
 981                 BUGPRINT("Entries_size never zero\n");
 982                 return -EINVAL;
 983         }
 984         /* overflow check */
 985         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 986                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 987                 return -ENOMEM;
 988         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 989                 return -ENOMEM;
 990
 991         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
 992         newinfo = vmalloc(sizeof(*newinfo) + countersize);
 993         if (!newinfo)
 994                 return -ENOMEM;
 995
 996         if (countersize)
 997                 memset(newinfo->counters, 0, countersize);
 998
 999         newinfo->entries = vmalloc(tmp.entries_size);
1000         if (!newinfo->entries) {
1001                 ret = -ENOMEM;
1002                 goto free_newinfo;
1003         }
1004         if (copy_from_user(
1005            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
1006                 BUGPRINT("Couldn't copy entries from userspace\n");
1007                 ret = -EFAULT;
1008                 goto free_entries;
1009         }
1010
1011         /* the user wants counters back
1012            the check on the size is done later, when we have the lock */
1013         if (tmp.num_counters) {
1014                 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
1015                 if (!counterstmp) {
1016                         ret = -ENOMEM;
1017                         goto free_entries;
1018                 }
1019         }
1020         else
1021                 counterstmp = NULL;
1022
1023         /* this can get initialized by translate_table() */
1024         newinfo->chainstack = NULL;
1025         ret = ebt_verify_pointers(&tmp, newinfo);
1026         if (ret != 0)
1027                 goto free_counterstmp;
1028
1029         ret = translate_table(net, tmp.name, newinfo);
1030
1031         if (ret != 0)
1032                 goto free_counterstmp;
1033
1034         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1035         if (!t) {
1036                 ret = -ENOENT;
1037                 goto free_iterate;
1038         }
1039
1040         /* the table doesn't like it */
1041         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1042                 goto free_unlock;
1043
1044         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1045                 BUGPRINT("Wrong nr. of counters requested\n");
1046                 ret = -EINVAL;
1047                 goto free_unlock;
1048         }
1049
1050         /* we have the mutex lock, so no danger in reading this pointer */
1051         table = t->private;
1052         /* make sure the table can only be rmmod'ed if it contains no rules */
1053         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1054                 ret = -ENOENT;
1055                 goto free_unlock;
1056         } else if (table->nentries && !newinfo->nentries)
1057                 module_put(t->me);
1058         /* we need an atomic snapshot of the counters */
1059         write_lock_bh(&t->lock);
1060         if (tmp.num_counters)
1061                 get_counters(t->private->counters, counterstmp,
1062                    t->private->nentries);
1063
1064         t->private = newinfo;
1065         write_unlock_bh(&t->lock);
1066         mutex_unlock(&ebt_mutex);
1067         /* so, a user can change the chains while having messed up her counter
1068            allocation. Only reason why this is done is because this way the lock
1069            is held only once, while this doesn't bring the kernel into a
1070            dangerous state. */
1071         if (tmp.num_counters &&
1072            copy_to_user(tmp.counters, counterstmp,
1073            tmp.num_counters * sizeof(struct ebt_counter))) {
1074                 BUGPRINT("Couldn't copy counters to userspace\n");
1075                 ret = -EFAULT;
1076         }
1077         else
1078                 ret = 0;
1079
1080         /* decrease module count and free resources */
1081         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1082                           ebt_cleanup_entry, net, NULL);
1083
1084         vfree(table->entries);
1085         if (table->chainstack) {
1086                 for_each_possible_cpu(i)
1087                         vfree(table->chainstack[i]);
1088                 vfree(table->chainstack);
1089         }
1090         vfree(table);
1091
1092         vfree(counterstmp);
1093         return ret;
1094
1095 free_unlock:
1096         mutex_unlock(&ebt_mutex);
1097 free_iterate:
1098         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1099                           ebt_cleanup_entry, net, NULL);
1100 free_counterstmp:
1101         vfree(counterstmp);
1102         /* can be initialized in translate_table() */
1103         if (newinfo->chainstack) {
1104                 for_each_possible_cpu(i)
1105                         vfree(newinfo->chainstack[i]);
1106                 vfree(newinfo->chainstack);
1107         }
1108 free_entries:
1109         vfree(newinfo->entries);
1110 free_newinfo:
1111         vfree(newinfo);
1112         return ret;
1113 }
1114
1115 struct ebt_table *
1116 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1117 {
1118         struct ebt_table_info *newinfo;
1119         struct ebt_table *t, *table;
1120         struct ebt_replace_kernel *repl;
1121         int ret, i, countersize;
1122         void *p;
1123
1124         if (input_table == NULL || (repl = input_table->table) == NULL ||
1125             repl->entries == 0 || repl->entries_size == 0 ||
1126             repl->counters != NULL || input_table->private != NULL) {
1127                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1128                 return ERR_PTR(-EINVAL);
1129         }
1130
1131         /* Don't add one table to multiple lists. */
1132         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1133         if (!table) {
1134                 ret = -ENOMEM;
1135                 goto out;
1136         }
1137
1138         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1139         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1140         ret = -ENOMEM;
1141         if (!newinfo)
1142                 goto free_table;
1143
1144         p = vmalloc(repl->entries_size);
1145         if (!p)
1146                 goto free_newinfo;
1147
1148         memcpy(p, repl->entries, repl->entries_size);
1149         newinfo->entries = p;
1150
1151         newinfo->entries_size = repl->entries_size;
1152         newinfo->nentries = repl->nentries;
1153
1154         if (countersize)
1155                 memset(newinfo->counters, 0, countersize);
1156
1157         /* fill in newinfo and parse the entries */
1158         newinfo->chainstack = NULL;
1159         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1160                 if ((repl->valid_hooks & (1 << i)) == 0)
1161                         newinfo->hook_entry[i] = NULL;
1162                 else
1163                         newinfo->hook_entry[i] = p +
1164                                 ((char *)repl->hook_entry[i] - repl->entries);
1165         }
1166         ret = translate_table(net, repl->name, newinfo);
1167         if (ret != 0) {
1168                 BUGPRINT("Translate_table failed\n");
1169                 goto free_chainstack;
1170         }
1171
1172         if (table->check && table->check(newinfo, table->valid_hooks)) {
1173                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1174                 return ERR_PTR(-EINVAL);
1175         }
1176
1177         table->private = newinfo;
1178         rwlock_init(&table->lock);
1179         ret = mutex_lock_interruptible(&ebt_mutex);
1180         if (ret != 0)
1181                 goto free_chainstack;
1182
1183         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1184                 if (strcmp(t->name, table->name) == 0) {
1185                         ret = -EEXIST;
1186                         BUGPRINT("Table name already exists\n");
1187                         goto free_unlock;
1188                 }
1189         }
1190
1191         /* Hold a reference count if the chains aren't empty */
1192         if (newinfo->nentries && !try_module_get(table->me)) {
1193                 ret = -ENOENT;
1194                 goto free_unlock;
1195         }
1196         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1197         mutex_unlock(&ebt_mutex);
1198         return table;
1199 free_unlock:
1200         mutex_unlock(&ebt_mutex);
1201 free_chainstack:
1202         if (newinfo->chainstack) {
1203                 for_each_possible_cpu(i)
1204                         vfree(newinfo->chainstack[i]);
1205                 vfree(newinfo->chainstack);
1206         }
1207         vfree(newinfo->entries);
1208 free_newinfo:
1209         vfree(newinfo);
1210 free_table:
1211         kfree(table);
1212 out:
1213         return ERR_PTR(ret);
1214 }
1215
1216 void ebt_unregister_table(struct net *net, struct ebt_table *table)
1217 {
1218         int i;
1219
1220         if (!table) {
1221                 BUGPRINT("Request to unregister NULL table!!!\n");
1222                 return;
1223         }
1224         mutex_lock(&ebt_mutex);
1225         list_del(&table->list);
1226         mutex_unlock(&ebt_mutex);
1227         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1228                           ebt_cleanup_entry, net, NULL);
1229         if (table->private->nentries)
1230                 module_put(table->me);
1231         vfree(table->private->entries);
1232         if (table->private->chainstack) {
1233                 for_each_possible_cpu(i)
1234                         vfree(table->private->chainstack[i]);
1235                 vfree(table->private->chainstack);
1236         }
1237         vfree(table->private);
1238         kfree(table);
1239 }
1240
1241 /* userspace just supplied us with counters */
1242 static int update_counters(struct net *net, const void __user *user,
1243                            unsigned int len)
1244 {
1245         int i, ret;
1246         struct ebt_counter *tmp;
1247         struct ebt_replace hlp;
1248         struct ebt_table *t;
1249
1250         if (copy_from_user(&hlp, user, sizeof(hlp)))
1251                 return -EFAULT;
1252
1253         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1254                 return -EINVAL;
1255         if (hlp.num_counters == 0)
1256                 return -EINVAL;
1257
1258         if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1259                 MEMPRINT("Update_counters && nomemory\n");
1260                 return -ENOMEM;
1261         }
1262
1263         t = find_table_lock(net, hlp.name, &ret, &ebt_mutex);
1264         if (!t)
1265                 goto free_tmp;
1266
1267         if (hlp.num_counters != t->private->nentries) {
1268                 BUGPRINT("Wrong nr of counters\n");
1269                 ret = -EINVAL;
1270                 goto unlock_mutex;
1271         }
1272
1273         if ( copy_from_user(tmp, hlp.counters,
1274            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1275                 BUGPRINT("Updata_counters && !cfu\n");
1276                 ret = -EFAULT;
1277                 goto unlock_mutex;
1278         }
1279
1280         /* we want an atomic add of the counters */
1281         write_lock_bh(&t->lock);
1282
1283         /* we add to the counters of the first cpu */
1284         for (i = 0; i < hlp.num_counters; i++) {
1285                 t->private->counters[i].pcnt += tmp[i].pcnt;
1286                 t->private->counters[i].bcnt += tmp[i].bcnt;
1287         }
1288
1289         write_unlock_bh(&t->lock);
1290         ret = 0;
1291 unlock_mutex:
1292         mutex_unlock(&ebt_mutex);
1293 free_tmp:
1294         vfree(tmp);
1295         return ret;
1296 }
1297
1298 static inline int ebt_make_matchname(const struct ebt_entry_match *m,
1299     const char *base, char __user *ubase)
1300 {
1301         char __user *hlp = ubase + ((char *)m - base);
1302         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1303                 return -EFAULT;
1304         return 0;
1305 }
1306
1307 static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
1308     const char *base, char __user *ubase)
1309 {
1310         char __user *hlp = ubase + ((char *)w - base);
1311         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1312                 return -EFAULT;
1313         return 0;
1314 }
1315
1316 static inline int
1317 ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
1318 {
1319         int ret;
1320         char __user *hlp;
1321         const struct ebt_entry_target *t;
1322
1323         if (e->bitmask == 0)
1324                 return 0;
1325
1326         hlp = ubase + (((char *)e + e->target_offset) - base);
1327         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1328
1329         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1330         if (ret != 0)
1331                 return ret;
1332         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1333         if (ret != 0)
1334                 return ret;
1335         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1336                 return -EFAULT;
1337         return 0;
1338 }
1339
1340 /* called with ebt_mutex locked */
1341 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1342     const int *len, int cmd)
1343 {
1344         struct ebt_replace tmp;
1345         struct ebt_counter *counterstmp;
1346         const struct ebt_counter *oldcounters;
1347         unsigned int entries_size, nentries;
1348         char *entries;
1349
1350         if (cmd == EBT_SO_GET_ENTRIES) {
1351                 entries_size = t->private->entries_size;
1352                 nentries = t->private->nentries;
1353                 entries = t->private->entries;
1354                 oldcounters = t->private->counters;
1355         } else {
1356                 entries_size = t->table->entries_size;
1357                 nentries = t->table->nentries;
1358                 entries = t->table->entries;
1359                 oldcounters = t->table->counters;
1360         }
1361
1362         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1363                 BUGPRINT("Cfu didn't work\n");
1364                 return -EFAULT;
1365         }
1366
1367         if (*len != sizeof(struct ebt_replace) + entries_size +
1368            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1369                 BUGPRINT("Wrong size\n");
1370                 return -EINVAL;
1371         }
1372
1373         if (tmp.nentries != nentries) {
1374                 BUGPRINT("Nentries wrong\n");
1375                 return -EINVAL;
1376         }
1377
1378         if (tmp.entries_size != entries_size) {
1379                 BUGPRINT("Wrong size\n");
1380                 return -EINVAL;
1381         }
1382
1383         /* userspace might not need the counters */
1384         if (tmp.num_counters) {
1385                 if (tmp.num_counters != nentries) {
1386                         BUGPRINT("Num_counters wrong\n");
1387                         return -EINVAL;
1388                 }
1389                 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1390                 if (!counterstmp) {
1391                         MEMPRINT("Couldn't copy counters, out of memory\n");
1392                         return -ENOMEM;
1393                 }
1394                 write_lock_bh(&t->lock);
1395                 get_counters(oldcounters, counterstmp, nentries);
1396                 write_unlock_bh(&t->lock);
1397
1398                 if (copy_to_user(tmp.counters, counterstmp,
1399                    nentries * sizeof(struct ebt_counter))) {
1400                         BUGPRINT("Couldn't copy counters to userspace\n");
1401                         vfree(counterstmp);
1402                         return -EFAULT;
1403                 }
1404                 vfree(counterstmp);
1405         }
1406
1407         if (copy_to_user(tmp.entries, entries, entries_size)) {
1408                 BUGPRINT("Couldn't copy entries to userspace\n");
1409                 return -EFAULT;
1410         }
1411         /* set the match/watcher/target names right */
1412         return EBT_ENTRY_ITERATE(entries, entries_size,
1413            ebt_make_names, entries, tmp.entries);
1414 }
1415
1416 static int do_ebt_set_ctl(struct sock *sk,
1417         int cmd, void __user *user, unsigned int len)
1418 {
1419         int ret;
1420
1421         if (!capable(CAP_NET_ADMIN))
1422                 return -EPERM;
1423
1424         switch(cmd) {
1425         case EBT_SO_SET_ENTRIES:
1426                 ret = do_replace(sock_net(sk), user, len);
1427                 break;
1428         case EBT_SO_SET_COUNTERS:
1429                 ret = update_counters(sock_net(sk), user, len);
1430                 break;
1431         default:
1432                 ret = -EINVAL;
1433   }
1434         return ret;
1435 }
1436
1437 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1438 {
1439         int ret;
1440         struct ebt_replace tmp;
1441         struct ebt_table *t;
1442
1443         if (!capable(CAP_NET_ADMIN))
1444                 return -EPERM;
1445
1446         if (copy_from_user(&tmp, user, sizeof(tmp)))
1447                 return -EFAULT;
1448
1449         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1450         if (!t)
1451                 return ret;
1452
1453         switch(cmd) {
1454         case EBT_SO_GET_INFO:
1455         case EBT_SO_GET_INIT_INFO:
1456                 if (*len != sizeof(struct ebt_replace)){
1457                         ret = -EINVAL;
1458                         mutex_unlock(&ebt_mutex);
1459                         break;
1460                 }
1461                 if (cmd == EBT_SO_GET_INFO) {
1462                         tmp.nentries = t->private->nentries;
1463                         tmp.entries_size = t->private->entries_size;
1464                         tmp.valid_hooks = t->valid_hooks;
1465                 } else {
1466                         tmp.nentries = t->table->nentries;
1467                         tmp.entries_size = t->table->entries_size;
1468                         tmp.valid_hooks = t->table->valid_hooks;
1469                 }
1470                 mutex_unlock(&ebt_mutex);
1471                 if (copy_to_user(user, &tmp, *len) != 0){
1472                         BUGPRINT("c2u Didn't work\n");
1473                         ret = -EFAULT;
1474                         break;
1475                 }
1476                 ret = 0;
1477                 break;
1478
1479         case EBT_SO_GET_ENTRIES:
1480         case EBT_SO_GET_INIT_ENTRIES:
1481                 ret = copy_everything_to_user(t, user, len, cmd);
1482                 mutex_unlock(&ebt_mutex);
1483                 break;
1484
1485         default:
1486                 mutex_unlock(&ebt_mutex);
1487                 ret = -EINVAL;
1488         }
1489
1490         return ret;
1491 }
1492
1493 static struct nf_sockopt_ops ebt_sockopts =
1494 {
1495         .pf             = PF_INET,
1496         .set_optmin     = EBT_BASE_CTL,
1497         .set_optmax     = EBT_SO_SET_MAX + 1,
1498         .set            = do_ebt_set_ctl,
1499         .get_optmin     = EBT_BASE_CTL,
1500         .get_optmax     = EBT_SO_GET_MAX + 1,
1501         .get            = do_ebt_get_ctl,
1502         .owner          = THIS_MODULE,
1503 };
1504
1505 static int __init ebtables_init(void)
1506 {
1507         int ret;
1508
1509         ret = xt_register_target(&ebt_standard_target);
1510         if (ret < 0)
1511                 return ret;
1512         ret = nf_register_sockopt(&ebt_sockopts);
1513         if (ret < 0) {
1514                 xt_unregister_target(&ebt_standard_target);
1515                 return ret;
1516         }
1517
1518         printk(KERN_INFO "Ebtables v2.0 registered\n");
1519         return 0;
1520 }
1521
1522 static void __exit ebtables_fini(void)
1523 {
1524         nf_unregister_sockopt(&ebt_sockopts);
1525         xt_unregister_target(&ebt_standard_target);
1526         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
1527 }
1528
1529 EXPORT_SYMBOL(ebt_register_table);
1530 EXPORT_SYMBOL(ebt_unregister_table);
1531 EXPORT_SYMBOL(ebt_do_table);
1532 module_init(ebtables_init);
1533 module_exit(ebtables_fini);
1534 MODULE_LICENSE("GPL");