net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18 /* used for print_string */
  19 #include <linux/sched.h>
  20 #include <linux/tty.h>
  21
  22 #include <linux/kmod.h>
  23 #include <linux/module.h>
  24 #include <linux/vmalloc.h>
  25 #include <linux/netfilter_bridge/ebtables.h>
  26 #include <linux/spinlock.h>
  27 #include <asm/uaccess.h>
  28 #include <linux/smp.h>
  29 #include <linux/cpumask.h>
  30 #include <net/sock.h>
  31 /* needed for logical [in,out]-dev filtering */
  32 #include "../br_private.h"
  33
  34 /* list_named_find */
  35 #define ASSERT_READ_LOCK(x)
  36 #define ASSERT_WRITE_LOCK(x)
  37 #include <linux/netfilter_ipv4/listhelp.h>
  38 #include <linux/mutex.h>
  39
  40 #if 0
  41 /* use this for remote debugging
  42  * Copyright (C) 1998 by Ori Pomerantz
  43  * Print the string to the appropriate tty, the one
  44  * the current task uses
  45  */
  46 static void print_string(char *str)
  47 {
  48         struct tty_struct *my_tty;
  49
  50         /* The tty for the current task */
  51         my_tty = current->signal->tty;
  52         if (my_tty != NULL) {
  53                 my_tty->driver->write(my_tty, 0, str, strlen(str));
  54                 my_tty->driver->write(my_tty, 0, "\015\012", 2);
  55         }
  56 }
  57
  58 #define BUGPRINT(args) print_string(args);
  59 #else
  60 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  61                                          "report to author: "format, ## args)
  62 /* #define BUGPRINT(format, args...) */
  63 #endif
  64 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  65                                          ": out of memory: "format, ## args)
  66 /* #define MEMPRINT(format, args...) */
  67
  68
  69
  70 /*
  71  * Each cpu has its own set of counters, so there is no need for write_lock in
  72  * the softirq
  73  * For reading or updating the counters, the user context needs to
  74  * get a write_lock
  75  */
  76
  77 /* The size of each set of counters is altered to get cache alignment */
  78 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  79 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  80 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  81    COUNTER_OFFSET(n) * cpu))
  82
  83
  84
  85 static DEFINE_MUTEX(ebt_mutex);
  86 static LIST_HEAD(ebt_tables);
  87 static LIST_HEAD(ebt_targets);
  88 static LIST_HEAD(ebt_matches);
  89 static LIST_HEAD(ebt_watchers);
  90
  91 static struct ebt_target ebt_standard_target =
  92 { {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
  93
  94 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
  95    const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
  96    const struct net_device *out)
  97 {
  98         w->u.watcher->watcher(skb, hooknr, in, out, w->data,
  99            w->watcher_size);
 100         /* watchers don't give a verdict */
 101         return 0;
 102 }
 103
 104 static inline int ebt_do_match (struct ebt_entry_match *m,
 105    const struct sk_buff *skb, const struct net_device *in,
 106    const struct net_device *out)
 107 {
 108         return m->u.match->match(skb, in, out, m->data,
 109            m->match_size);
 110 }
 111
 112 static inline int ebt_dev_check(char *entry, const struct net_device *device)
 113 {
 114         int i = 0;
 115         char *devname = device->name;
 116
 117         if (*entry == '\0')
 118                 return 0;
 119         if (!device)
 120                 return 1;
 121         /* 1 is the wildcard token */
 122         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
 123                 i++;
 124         return (devname[i] != entry[i] && entry[i] != 1);
 125 }
 126
 127 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 128 /* process standard matches */
 129 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 130    const struct net_device *in, const struct net_device *out)
 131 {
 132         int verdict, i;
 133
 134         if (e->bitmask & EBT_802_3) {
 135                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 136                         return 1;
 137         } else if (!(e->bitmask & EBT_NOPROTO) &&
 138            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 139                 return 1;
 140
 141         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 142                 return 1;
 143         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 144                 return 1;
 145         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 146            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 147                 return 1;
 148         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 149            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 150                 return 1;
 151
 152         if (e->bitmask & EBT_SOURCEMAC) {
 153                 verdict = 0;
 154                 for (i = 0; i < 6; i++)
 155                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 156                            e->sourcemsk[i];
 157                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 158                         return 1;
 159         }
 160         if (e->bitmask & EBT_DESTMAC) {
 161                 verdict = 0;
 162                 for (i = 0; i < 6; i++)
 163                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 164                            e->destmsk[i];
 165                 if (FWINV2(verdict != 0, EBT_IDEST) )
 166                         return 1;
 167         }
 168         return 0;
 169 }
 170
 171 /* Do some firewalling */
 172 unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
 173    const struct net_device *in, const struct net_device *out,
 174    struct ebt_table *table)
 175 {
 176         int i, nentries;
 177         struct ebt_entry *point;
 178         struct ebt_counter *counter_base, *cb_base;
 179         struct ebt_entry_target *t;
 180         int verdict, sp = 0;
 181         struct ebt_chainstack *cs;
 182         struct ebt_entries *chaininfo;
 183         char *base;
 184         struct ebt_table_info *private;
 185
 186         read_lock_bh(&table->lock);
 187         private = table->private;
 188         cb_base = COUNTER_BASE(private->counters, private->nentries,
 189            smp_processor_id());
 190         if (private->chainstack)
 191                 cs = private->chainstack[smp_processor_id()];
 192         else
 193                 cs = NULL;
 194         chaininfo = private->hook_entry[hook];
 195         nentries = private->hook_entry[hook]->nentries;
 196         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 197         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 198         /* base for chain jumps */
 199         base = private->entries;
 200         i = 0;
 201         while (i < nentries) {
 202                 if (ebt_basic_match(point, eth_hdr(*pskb), in, out))
 203                         goto letscontinue;
 204
 205                 if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
 206                         goto letscontinue;
 207
 208                 /* increase counter */
 209                 (*(counter_base + i)).pcnt++;
 210                 (*(counter_base + i)).bcnt+=(**pskb).len;
 211
 212                 /* these should only watch: not modify, nor tell us
 213                    what to do with the packet */
 214                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
 215                    out);
 216
 217                 t = (struct ebt_entry_target *)
 218                    (((char *)point) + point->target_offset);
 219                 /* standard target */
 220                 if (!t->u.target->target)
 221                         verdict = ((struct ebt_standard_target *)t)->verdict;
 222                 else
 223                         verdict = t->u.target->target(pskb, hook,
 224                            in, out, t->data, t->target_size);
 225                 if (verdict == EBT_ACCEPT) {
 226                         read_unlock_bh(&table->lock);
 227                         return NF_ACCEPT;
 228                 }
 229                 if (verdict == EBT_DROP) {
 230                         read_unlock_bh(&table->lock);
 231                         return NF_DROP;
 232                 }
 233                 if (verdict == EBT_RETURN) {
 234 letsreturn:
 235 #ifdef CONFIG_NETFILTER_DEBUG
 236                         if (sp == 0) {
 237                                 BUGPRINT("RETURN on base chain");
 238                                 /* act like this is EBT_CONTINUE */
 239                                 goto letscontinue;
 240                         }
 241 #endif
 242                         sp--;
 243                         /* put all the local variables right */
 244                         i = cs[sp].n;
 245                         chaininfo = cs[sp].chaininfo;
 246                         nentries = chaininfo->nentries;
 247                         point = cs[sp].e;
 248                         counter_base = cb_base +
 249                            chaininfo->counter_offset;
 250                         continue;
 251                 }
 252                 if (verdict == EBT_CONTINUE)
 253                         goto letscontinue;
 254 #ifdef CONFIG_NETFILTER_DEBUG
 255                 if (verdict < 0) {
 256                         BUGPRINT("bogus standard verdict\n");
 257                         read_unlock_bh(&table->lock);
 258                         return NF_DROP;
 259                 }
 260 #endif
 261                 /* jump to a udc */
 262                 cs[sp].n = i + 1;
 263                 cs[sp].chaininfo = chaininfo;
 264                 cs[sp].e = (struct ebt_entry *)
 265                    (((char *)point) + point->next_offset);
 266                 i = 0;
 267                 chaininfo = (struct ebt_entries *) (base + verdict);
 268 #ifdef CONFIG_NETFILTER_DEBUG
 269                 if (chaininfo->distinguisher) {
 270                         BUGPRINT("jump to non-chain\n");
 271                         read_unlock_bh(&table->lock);
 272                         return NF_DROP;
 273                 }
 274 #endif
 275                 nentries = chaininfo->nentries;
 276                 point = (struct ebt_entry *)chaininfo->data;
 277                 counter_base = cb_base + chaininfo->counter_offset;
 278                 sp++;
 279                 continue;
 280 letscontinue:
 281                 point = (struct ebt_entry *)
 282                    (((char *)point) + point->next_offset);
 283                 i++;
 284         }
 285
 286         /* I actually like this :) */
 287         if (chaininfo->policy == EBT_RETURN)
 288                 goto letsreturn;
 289         if (chaininfo->policy == EBT_ACCEPT) {
 290                 read_unlock_bh(&table->lock);
 291                 return NF_ACCEPT;
 292         }
 293         read_unlock_bh(&table->lock);
 294         return NF_DROP;
 295 }
 296
 297 /* If it succeeds, returns element and locks mutex */
 298 static inline void *
 299 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 300    struct mutex *mutex)
 301 {
 302         void *ret;
 303
 304         *error = mutex_lock_interruptible(mutex);
 305         if (*error != 0)
 306                 return NULL;
 307
 308         ret = list_named_find(head, name);
 309         if (!ret) {
 310                 *error = -ENOENT;
 311                 mutex_unlock(mutex);
 312         }
 313         return ret;
 314 }
 315
 316 #ifndef CONFIG_KMOD
 317 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
 318 #else
 319 static void *
 320 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 321    int *error, struct mutex *mutex)
 322 {
 323         void *ret;
 324
 325         ret = find_inlist_lock_noload(head, name, error, mutex);
 326         if (!ret) {
 327                 request_module("%s%s", prefix, name);
 328                 ret = find_inlist_lock_noload(head, name, error, mutex);
 329         }
 330         return ret;
 331 }
 332 #endif
 333
 334 static inline struct ebt_table *
 335 find_table_lock(const char *name, int *error, struct mutex *mutex)
 336 {
 337         return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
 338 }
 339
 340 static inline struct ebt_match *
 341 find_match_lock(const char *name, int *error, struct mutex *mutex)
 342 {
 343         return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
 344 }
 345
 346 static inline struct ebt_watcher *
 347 find_watcher_lock(const char *name, int *error, struct mutex *mutex)
 348 {
 349         return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
 350 }
 351
 352 static inline struct ebt_target *
 353 find_target_lock(const char *name, int *error, struct mutex *mutex)
 354 {
 355         return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
 356 }
 357
 358 static inline int
 359 ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
 360    const char *name, unsigned int hookmask, unsigned int *cnt)
 361 {
 362         struct ebt_match *match;
 363         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 364         int ret;
 365
 366         if (left < sizeof(struct ebt_entry_match) ||
 367             left - sizeof(struct ebt_entry_match) < m->match_size)
 368                 return -EINVAL;
 369         match = find_match_lock(m->u.name, &ret, &ebt_mutex);
 370         if (!match)
 371                 return ret;
 372         m->u.match = match;
 373         if (!try_module_get(match->me)) {
 374                 mutex_unlock(&ebt_mutex);
 375                 return -ENOENT;
 376         }
 377         mutex_unlock(&ebt_mutex);
 378         if (match->check &&
 379            match->check(name, hookmask, e, m->data, m->match_size) != 0) {
 380                 BUGPRINT("match->check failed\n");
 381                 module_put(match->me);
 382                 return -EINVAL;
 383         }
 384         (*cnt)++;
 385         return 0;
 386 }
 387
 388 static inline int
 389 ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
 390    const char *name, unsigned int hookmask, unsigned int *cnt)
 391 {
 392         struct ebt_watcher *watcher;
 393         size_t left = ((char *)e + e->target_offset) - (char *)w;
 394         int ret;
 395
 396         if (left < sizeof(struct ebt_entry_watcher) ||
 397            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 398                 return -EINVAL;
 399         watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
 400         if (!watcher)
 401                 return ret;
 402         w->u.watcher = watcher;
 403         if (!try_module_get(watcher->me)) {
 404                 mutex_unlock(&ebt_mutex);
 405                 return -ENOENT;
 406         }
 407         mutex_unlock(&ebt_mutex);
 408         if (watcher->check &&
 409            watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
 410                 BUGPRINT("watcher->check failed\n");
 411                 module_put(watcher->me);
 412                 return -EINVAL;
 413         }
 414         (*cnt)++;
 415         return 0;
 416 }
 417
 418 /*
 419  * this one is very careful, as it is the first function
 420  * to parse the userspace data
 421  */
 422 static inline int
 423 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 424    struct ebt_table_info *newinfo, char *base, char *limit,
 425    struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
 426    unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
 427 {
 428         unsigned int offset = (char *)e - newinfo->entries;
 429         size_t left = (limit - base) - offset;
 430         int i;
 431
 432         if (left < sizeof(unsigned int))
 433                 goto Esmall;
 434
 435         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 436                 if ((valid_hooks & (1 << i)) == 0)
 437                         continue;
 438                 if ((char *)hook_entries[i] == base + offset)
 439                         break;
 440         }
 441         /* beginning of a new chain
 442            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 443         if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 444                 if (e->bitmask != 0) {
 445                         /* we make userspace set this right,
 446                            so there is no misunderstanding */
 447                         BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 448                                  "in distinguisher\n");
 449                         return -EINVAL;
 450                 }
 451                 /* this checks if the previous chain has as many entries
 452                    as it said it has */
 453                 if (*n != *cnt) {
 454                         BUGPRINT("nentries does not equal the nr of entries "
 455                                  "in the chain\n");
 456                         return -EINVAL;
 457                 }
 458                 /* before we look at the struct, be sure it is not too big */
 459                 if (left < sizeof(struct ebt_entries))
 460                         goto Esmall;
 461                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 462                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 463                         /* only RETURN from udc */
 464                         if (i != NF_BR_NUMHOOKS ||
 465                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 466                                 BUGPRINT("bad policy\n");
 467                                 return -EINVAL;
 468                         }
 469                 }
 470                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 471                         (*udc_cnt)++;
 472                 else
 473                         newinfo->hook_entry[i] = (struct ebt_entries *)e;
 474                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 475                         BUGPRINT("counter_offset != totalcnt");
 476                         return -EINVAL;
 477                 }
 478                 *n = ((struct ebt_entries *)e)->nentries;
 479                 *cnt = 0;
 480                 return 0;
 481         }
 482         /* a plain old entry, heh */
 483         if (left < sizeof(struct ebt_entry))
 484                 goto Esmall;
 485         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 486            e->watchers_offset > e->target_offset ||
 487            e->target_offset >= e->next_offset) {
 488                 BUGPRINT("entry offsets not in right order\n");
 489                 return -EINVAL;
 490         }
 491         /* this is not checked anywhere else */
 492         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 493                 BUGPRINT("target size too small\n");
 494                 return -EINVAL;
 495         }
 496         if (left < e->next_offset)
 497                 goto Esmall;
 498
 499         (*cnt)++;
 500         (*totalcnt)++;
 501         return 0;
 502
 503 Esmall:
 504         BUGPRINT("entries_size too small\n");
 505         return -EINVAL;
 506 }
 507
 508 struct ebt_cl_stack
 509 {
 510         struct ebt_chainstack cs;
 511         int from;
 512         unsigned int hookmask;
 513 };
 514
 515 /*
 516  * we need these positions to check that the jumps to a different part of the
 517  * entries is a jump to the beginning of a new chain.
 518  */
 519 static inline int
 520 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 521    struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
 522    struct ebt_cl_stack *udc)
 523 {
 524         int i;
 525
 526         /* we're only interested in chain starts */
 527         if (e->bitmask)
 528                 return 0;
 529         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 530                 if ((valid_hooks & (1 << i)) == 0)
 531                         continue;
 532                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 533                         break;
 534         }
 535         /* only care about udc */
 536         if (i != NF_BR_NUMHOOKS)
 537                 return 0;
 538
 539         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 540         /* these initialisations are depended on later in check_chainloops() */
 541         udc[*n].cs.n = 0;
 542         udc[*n].hookmask = 0;
 543
 544         (*n)++;
 545         return 0;
 546 }
 547
 548 static inline int
 549 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 550 {
 551         if (i && (*i)-- == 0)
 552                 return 1;
 553         if (m->u.match->destroy)
 554                 m->u.match->destroy(m->data, m->match_size);
 555         module_put(m->u.match->me);
 556
 557         return 0;
 558 }
 559
 560 static inline int
 561 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 562 {
 563         if (i && (*i)-- == 0)
 564                 return 1;
 565         if (w->u.watcher->destroy)
 566                 w->u.watcher->destroy(w->data, w->watcher_size);
 567         module_put(w->u.watcher->me);
 568
 569         return 0;
 570 }
 571
 572 static inline int
 573 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 574 {
 575         struct ebt_entry_target *t;
 576
 577         if (e->bitmask == 0)
 578                 return 0;
 579         /* we're done */
 580         if (cnt && (*cnt)-- == 0)
 581                 return 1;
 582         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 583         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 584         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 585         if (t->u.target->destroy)
 586                 t->u.target->destroy(t->data, t->target_size);
 587         module_put(t->u.target->me);
 588
 589         return 0;
 590 }
 591
 592 static inline int
 593 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 594    const char *name, unsigned int *cnt, unsigned int valid_hooks,
 595    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 596 {
 597         struct ebt_entry_target *t;
 598         struct ebt_target *target;
 599         unsigned int i, j, hook = 0, hookmask = 0;
 600         size_t gap = e->next_offset - e->target_offset;
 601         int ret;
 602
 603         /* don't mess with the struct ebt_entries */
 604         if (e->bitmask == 0)
 605                 return 0;
 606
 607         if (e->bitmask & ~EBT_F_MASK) {
 608                 BUGPRINT("Unknown flag for bitmask\n");
 609                 return -EINVAL;
 610         }
 611         if (e->invflags & ~EBT_INV_MASK) {
 612                 BUGPRINT("Unknown flag for inv bitmask\n");
 613                 return -EINVAL;
 614         }
 615         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 616                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 617                 return -EINVAL;
 618         }
 619         /* what hook do we belong to? */
 620         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 621                 if ((valid_hooks & (1 << i)) == 0)
 622                         continue;
 623                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 624                         hook = i;
 625                 else
 626                         break;
 627         }
 628         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 629            a base chain */
 630         if (i < NF_BR_NUMHOOKS)
 631                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 632         else {
 633                 for (i = 0; i < udc_cnt; i++)
 634                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 635                                 break;
 636                 if (i == 0)
 637                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 638                 else
 639                         hookmask = cl_s[i - 1].hookmask;
 640         }
 641         i = 0;
 642         ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
 643         if (ret != 0)
 644                 goto cleanup_matches;
 645         j = 0;
 646         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
 647         if (ret != 0)
 648                 goto cleanup_watchers;
 649         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 650         target = find_target_lock(t->u.name, &ret, &ebt_mutex);
 651         if (!target)
 652                 goto cleanup_watchers;
 653         if (!try_module_get(target->me)) {
 654                 mutex_unlock(&ebt_mutex);
 655                 ret = -ENOENT;
 656                 goto cleanup_watchers;
 657         }
 658         mutex_unlock(&ebt_mutex);
 659
 660         t->u.target = target;
 661         if (t->u.target == &ebt_standard_target) {
 662                 if (gap < sizeof(struct ebt_standard_target)) {
 663                         BUGPRINT("Standard target size too big\n");
 664                         ret = -EFAULT;
 665                         goto cleanup_watchers;
 666                 }
 667                 if (((struct ebt_standard_target *)t)->verdict <
 668                    -NUM_STANDARD_TARGETS) {
 669                         BUGPRINT("Invalid standard target\n");
 670                         ret = -EFAULT;
 671                         goto cleanup_watchers;
 672                 }
 673         } else if (t->target_size > gap - sizeof(struct ebt_entry_target) ||
 674            (t->u.target->check &&
 675            t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
 676                 module_put(t->u.target->me);
 677                 ret = -EFAULT;
 678                 goto cleanup_watchers;
 679         }
 680         (*cnt)++;
 681         return 0;
 682 cleanup_watchers:
 683         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 684 cleanup_matches:
 685         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 686         return ret;
 687 }
 688
 689 /*
 690  * checks for loops and sets the hook mask for udc
 691  * the hook mask for udc tells us from which base chains the udc can be
 692  * accessed. This mask is a parameter to the check() functions of the extensions
 693  */
 694 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 695    unsigned int udc_cnt, unsigned int hooknr, char *base)
 696 {
 697         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 698         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 699         struct ebt_entry_target *t;
 700
 701         while (pos < nentries || chain_nr != -1) {
 702                 /* end of udc, go back one 'recursion' step */
 703                 if (pos == nentries) {
 704                         /* put back values of the time when this chain was called */
 705                         e = cl_s[chain_nr].cs.e;
 706                         if (cl_s[chain_nr].from != -1)
 707                                 nentries =
 708                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 709                         else
 710                                 nentries = chain->nentries;
 711                         pos = cl_s[chain_nr].cs.n;
 712                         /* make sure we won't see a loop that isn't one */
 713                         cl_s[chain_nr].cs.n = 0;
 714                         chain_nr = cl_s[chain_nr].from;
 715                         if (pos == nentries)
 716                                 continue;
 717                 }
 718                 t = (struct ebt_entry_target *)
 719                    (((char *)e) + e->target_offset);
 720                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 721                         goto letscontinue;
 722                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 723                    e->next_offset) {
 724                         BUGPRINT("Standard target size too big\n");
 725                         return -1;
 726                 }
 727                 verdict = ((struct ebt_standard_target *)t)->verdict;
 728                 if (verdict >= 0) { /* jump to another chain */
 729                         struct ebt_entries *hlp2 =
 730                            (struct ebt_entries *)(base + verdict);
 731                         for (i = 0; i < udc_cnt; i++)
 732                                 if (hlp2 == cl_s[i].cs.chaininfo)
 733                                         break;
 734                         /* bad destination or loop */
 735                         if (i == udc_cnt) {
 736                                 BUGPRINT("bad destination\n");
 737                                 return -1;
 738                         }
 739                         if (cl_s[i].cs.n) {
 740                                 BUGPRINT("loop\n");
 741                                 return -1;
 742                         }
 743                         if (cl_s[i].hookmask & (1 << hooknr))
 744                                 goto letscontinue;
 745                         /* this can't be 0, so the loop test is correct */
 746                         cl_s[i].cs.n = pos + 1;
 747                         pos = 0;
 748                         cl_s[i].cs.e = ((void *)e + e->next_offset);
 749                         e = (struct ebt_entry *)(hlp2->data);
 750                         nentries = hlp2->nentries;
 751                         cl_s[i].from = chain_nr;
 752                         chain_nr = i;
 753                         /* this udc is accessible from the base chain for hooknr */
 754                         cl_s[i].hookmask |= (1 << hooknr);
 755                         continue;
 756                 }
 757 letscontinue:
 758                 e = (void *)e + e->next_offset;
 759                 pos++;
 760         }
 761         return 0;
 762 }
 763
 764 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 765 static int translate_table(struct ebt_replace *repl,
 766    struct ebt_table_info *newinfo)
 767 {
 768         unsigned int i, j, k, udc_cnt;
 769         int ret;
 770         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 771
 772         i = 0;
 773         while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
 774                 i++;
 775         if (i == NF_BR_NUMHOOKS) {
 776                 BUGPRINT("No valid hooks specified\n");
 777                 return -EINVAL;
 778         }
 779         if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
 780                 BUGPRINT("Chains don't start at beginning\n");
 781                 return -EINVAL;
 782         }
 783         /* make sure chains are ordered after each other in same order
 784            as their corresponding hooks */
 785         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 786                 if (!(repl->valid_hooks & (1 << j)))
 787                         continue;
 788                 if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
 789                         BUGPRINT("Hook order must be followed\n");
 790                         return -EINVAL;
 791                 }
 792                 i = j;
 793         }
 794
 795         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 796                 newinfo->hook_entry[i] = NULL;
 797
 798         newinfo->entries_size = repl->entries_size;
 799         newinfo->nentries = repl->nentries;
 800
 801         /* do some early checkings and initialize some things */
 802         i = 0; /* holds the expected nr. of entries for the chain */
 803         j = 0; /* holds the up to now counted entries for the chain */
 804         k = 0; /* holds the total nr. of entries, should equal
 805                   newinfo->nentries afterwards */
 806         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 807         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 808            ebt_check_entry_size_and_hooks, newinfo, repl->entries,
 809            repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
 810            &udc_cnt, repl->valid_hooks);
 811
 812         if (ret != 0)
 813                 return ret;
 814
 815         if (i != j) {
 816                 BUGPRINT("nentries does not equal the nr of entries in the "
 817                          "(last) chain\n");
 818                 return -EINVAL;
 819         }
 820         if (k != newinfo->nentries) {
 821                 BUGPRINT("Total nentries is wrong\n");
 822                 return -EINVAL;
 823         }
 824
 825         /* check if all valid hooks have a chain */
 826         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 827                 if (newinfo->hook_entry[i] == NULL &&
 828                    (repl->valid_hooks & (1 << i))) {
 829                         BUGPRINT("Valid hook without chain\n");
 830                         return -EINVAL;
 831                 }
 832         }
 833
 834         /* get the location of the udc, put them in an array
 835            while we're at it, allocate the chainstack */
 836         if (udc_cnt) {
 837                 /* this will get free'd in do_replace()/ebt_register_table()
 838                    if an error occurs */
 839                 newinfo->chainstack =
 840                         vmalloc((highest_possible_processor_id()+1)
 841                                         * sizeof(*(newinfo->chainstack)));
 842                 if (!newinfo->chainstack)
 843                         return -ENOMEM;
 844                 for_each_possible_cpu(i) {
 845                         newinfo->chainstack[i] =
 846                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 847                         if (!newinfo->chainstack[i]) {
 848                                 while (i)
 849                                         vfree(newinfo->chainstack[--i]);
 850                                 vfree(newinfo->chainstack);
 851                                 newinfo->chainstack = NULL;
 852                                 return -ENOMEM;
 853                         }
 854                 }
 855
 856                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 857                 if (!cl_s)
 858                         return -ENOMEM;
 859                 i = 0; /* the i'th udc */
 860                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 861                    ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
 862                    repl->valid_hooks, cl_s);
 863                 /* sanity check */
 864                 if (i != udc_cnt) {
 865                         BUGPRINT("i != udc_cnt\n");
 866                         vfree(cl_s);
 867                         return -EFAULT;
 868                 }
 869         }
 870
 871         /* Check for loops */
 872         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 873                 if (repl->valid_hooks & (1 << i))
 874                         if (check_chainloops(newinfo->hook_entry[i],
 875                            cl_s, udc_cnt, i, newinfo->entries)) {
 876                                 vfree(cl_s);
 877                                 return -EINVAL;
 878                         }
 879
 880         /* we now know the following (along with E=mc²):
 881            - the nr of entries in each chain is right
 882            - the size of the allocated space is right
 883            - all valid hooks have a corresponding chain
 884            - there are no loops
 885            - wrong data can still be on the level of a single entry
 886            - could be there are jumps to places that are not the
 887              beginning of a chain. This can only occur in chains that
 888              are not accessible from any base chains, so we don't care. */
 889
 890         /* used to know what we need to clean up if something goes wrong */
 891         i = 0;
 892         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 893            ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
 894            cl_s, udc_cnt);
 895         if (ret != 0) {
 896                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 897                    ebt_cleanup_entry, &i);
 898         }
 899         vfree(cl_s);
 900         return ret;
 901 }
 902
 903 /* called under write_lock */
 904 static void get_counters(struct ebt_counter *oldcounters,
 905    struct ebt_counter *counters, unsigned int nentries)
 906 {
 907         int i, cpu;
 908         struct ebt_counter *counter_base;
 909
 910         /* counters of cpu 0 */
 911         memcpy(counters, oldcounters,
 912                sizeof(struct ebt_counter) * nentries);
 913
 914         /* add other counters to those of cpu 0 */
 915         for_each_possible_cpu(cpu) {
 916                 if (cpu == 0)
 917                         continue;
 918                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 919                 for (i = 0; i < nentries; i++) {
 920                         counters[i].pcnt += counter_base[i].pcnt;
 921                         counters[i].bcnt += counter_base[i].bcnt;
 922                 }
 923         }
 924 }
 925
 926 /* replace the table */
 927 static int do_replace(void __user *user, unsigned int len)
 928 {
 929         int ret, i, countersize;
 930         struct ebt_table_info *newinfo;
 931         struct ebt_replace tmp;
 932         struct ebt_table *t;
 933         struct ebt_counter *counterstmp = NULL;
 934         /* used to be able to unlock earlier */
 935         struct ebt_table_info *table;
 936
 937         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 938                 return -EFAULT;
 939
 940         if (len != sizeof(tmp) + tmp.entries_size) {
 941                 BUGPRINT("Wrong len argument\n");
 942                 return -EINVAL;
 943         }
 944
 945         if (tmp.entries_size == 0) {
 946                 BUGPRINT("Entries_size never zero\n");
 947                 return -EINVAL;
 948         }
 949         /* overflow check */
 950         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 951                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 952                 return -ENOMEM;
 953         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 954                 return -ENOMEM;
 955
 956         countersize = COUNTER_OFFSET(tmp.nentries) *
 957                                         (highest_possible_processor_id()+1);
 958         newinfo = vmalloc(sizeof(*newinfo) + countersize);
 959         if (!newinfo)
 960                 return -ENOMEM;
 961
 962         if (countersize)
 963                 memset(newinfo->counters, 0, countersize);
 964
 965         newinfo->entries = vmalloc(tmp.entries_size);
 966         if (!newinfo->entries) {
 967                 ret = -ENOMEM;
 968                 goto free_newinfo;
 969         }
 970         if (copy_from_user(
 971            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 972                 BUGPRINT("Couldn't copy entries from userspace\n");
 973                 ret = -EFAULT;
 974                 goto free_entries;
 975         }
 976
 977         /* the user wants counters back
 978            the check on the size is done later, when we have the lock */
 979         if (tmp.num_counters) {
 980                 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
 981                 if (!counterstmp) {
 982                         ret = -ENOMEM;
 983                         goto free_entries;
 984                 }
 985         }
 986         else
 987                 counterstmp = NULL;
 988
 989         /* this can get initialized by translate_table() */
 990         newinfo->chainstack = NULL;
 991         ret = translate_table(&tmp, newinfo);
 992
 993         if (ret != 0)
 994                 goto free_counterstmp;
 995
 996         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
 997         if (!t) {
 998                 ret = -ENOENT;
 999                 goto free_iterate;
1000         }
1001
1002         /* the table doesn't like it */
1003         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1004                 goto free_unlock;
1005
1006         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1007                 BUGPRINT("Wrong nr. of counters requested\n");
1008                 ret = -EINVAL;
1009                 goto free_unlock;
1010         }
1011
1012         /* we have the mutex lock, so no danger in reading this pointer */
1013         table = t->private;
1014         /* make sure the table can only be rmmod'ed if it contains no rules */
1015         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1016                 ret = -ENOENT;
1017                 goto free_unlock;
1018         } else if (table->nentries && !newinfo->nentries)
1019                 module_put(t->me);
1020         /* we need an atomic snapshot of the counters */
1021         write_lock_bh(&t->lock);
1022         if (tmp.num_counters)
1023                 get_counters(t->private->counters, counterstmp,
1024                    t->private->nentries);
1025
1026         t->private = newinfo;
1027         write_unlock_bh(&t->lock);
1028         mutex_unlock(&ebt_mutex);
1029         /* so, a user can change the chains while having messed up her counter
1030            allocation. Only reason why this is done is because this way the lock
1031            is held only once, while this doesn't bring the kernel into a
1032            dangerous state. */
1033         if (tmp.num_counters &&
1034            copy_to_user(tmp.counters, counterstmp,
1035            tmp.num_counters * sizeof(struct ebt_counter))) {
1036                 BUGPRINT("Couldn't copy counters to userspace\n");
1037                 ret = -EFAULT;
1038         }
1039         else
1040                 ret = 0;
1041
1042         /* decrease module count and free resources */
1043         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1044            ebt_cleanup_entry, NULL);
1045
1046         vfree(table->entries);
1047         if (table->chainstack) {
1048                 for_each_possible_cpu(i)
1049                         vfree(table->chainstack[i]);
1050                 vfree(table->chainstack);
1051         }
1052         vfree(table);
1053
1054         vfree(counterstmp);
1055         return ret;
1056
1057 free_unlock:
1058         mutex_unlock(&ebt_mutex);
1059 free_iterate:
1060         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1061            ebt_cleanup_entry, NULL);
1062 free_counterstmp:
1063         vfree(counterstmp);
1064         /* can be initialized in translate_table() */
1065         if (newinfo->chainstack) {
1066                 for_each_possible_cpu(i)
1067                         vfree(newinfo->chainstack[i]);
1068                 vfree(newinfo->chainstack);
1069         }
1070 free_entries:
1071         vfree(newinfo->entries);
1072 free_newinfo:
1073         vfree(newinfo);
1074         return ret;
1075 }
1076
1077 int ebt_register_target(struct ebt_target *target)
1078 {
1079         int ret;
1080
1081         ret = mutex_lock_interruptible(&ebt_mutex);
1082         if (ret != 0)
1083                 return ret;
1084         if (!list_named_insert(&ebt_targets, target)) {
1085                 mutex_unlock(&ebt_mutex);
1086                 return -EEXIST;
1087         }
1088         mutex_unlock(&ebt_mutex);
1089
1090         return 0;
1091 }
1092
1093 void ebt_unregister_target(struct ebt_target *target)
1094 {
1095         mutex_lock(&ebt_mutex);
1096         LIST_DELETE(&ebt_targets, target);
1097         mutex_unlock(&ebt_mutex);
1098 }
1099
1100 int ebt_register_match(struct ebt_match *match)
1101 {
1102         int ret;
1103
1104         ret = mutex_lock_interruptible(&ebt_mutex);
1105         if (ret != 0)
1106                 return ret;
1107         if (!list_named_insert(&ebt_matches, match)) {
1108                 mutex_unlock(&ebt_mutex);
1109                 return -EEXIST;
1110         }
1111         mutex_unlock(&ebt_mutex);
1112
1113         return 0;
1114 }
1115
1116 void ebt_unregister_match(struct ebt_match *match)
1117 {
1118         mutex_lock(&ebt_mutex);
1119         LIST_DELETE(&ebt_matches, match);
1120         mutex_unlock(&ebt_mutex);
1121 }
1122
1123 int ebt_register_watcher(struct ebt_watcher *watcher)
1124 {
1125         int ret;
1126
1127         ret = mutex_lock_interruptible(&ebt_mutex);
1128         if (ret != 0)
1129                 return ret;
1130         if (!list_named_insert(&ebt_watchers, watcher)) {
1131                 mutex_unlock(&ebt_mutex);
1132                 return -EEXIST;
1133         }
1134         mutex_unlock(&ebt_mutex);
1135
1136         return 0;
1137 }
1138
1139 void ebt_unregister_watcher(struct ebt_watcher *watcher)
1140 {
1141         mutex_lock(&ebt_mutex);
1142         LIST_DELETE(&ebt_watchers, watcher);
1143         mutex_unlock(&ebt_mutex);
1144 }
1145
1146 int ebt_register_table(struct ebt_table *table)
1147 {
1148         struct ebt_table_info *newinfo;
1149         int ret, i, countersize;
1150
1151         if (!table || !table->table ||!table->table->entries ||
1152             table->table->entries_size == 0 ||
1153             table->table->counters || table->private) {
1154                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1155                 return -EINVAL;
1156         }
1157
1158         countersize = COUNTER_OFFSET(table->table->nentries) *
1159                                         (highest_possible_processor_id()+1);
1160         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1161         ret = -ENOMEM;
1162         if (!newinfo)
1163                 return -ENOMEM;
1164
1165         newinfo->entries = vmalloc(table->table->entries_size);
1166         if (!(newinfo->entries))
1167                 goto free_newinfo;
1168
1169         memcpy(newinfo->entries, table->table->entries,
1170            table->table->entries_size);
1171
1172         if (countersize)
1173                 memset(newinfo->counters, 0, countersize);
1174
1175         /* fill in newinfo and parse the entries */
1176         newinfo->chainstack = NULL;
1177         ret = translate_table(table->table, newinfo);
1178         if (ret != 0) {
1179                 BUGPRINT("Translate_table failed\n");
1180                 goto free_chainstack;
1181         }
1182
1183         if (table->check && table->check(newinfo, table->valid_hooks)) {
1184                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1185                 return -EINVAL;
1186         }
1187
1188         table->private = newinfo;
1189         rwlock_init(&table->lock);
1190         ret = mutex_lock_interruptible(&ebt_mutex);
1191         if (ret != 0)
1192                 goto free_chainstack;
1193
1194         if (list_named_find(&ebt_tables, table->name)) {
1195                 ret = -EEXIST;
1196                 BUGPRINT("Table name already exists\n");
1197                 goto free_unlock;
1198         }
1199
1200         /* Hold a reference count if the chains aren't empty */
1201         if (newinfo->nentries && !try_module_get(table->me)) {
1202                 ret = -ENOENT;
1203                 goto free_unlock;
1204         }
1205         list_prepend(&ebt_tables, table);
1206         mutex_unlock(&ebt_mutex);
1207         return 0;
1208 free_unlock:
1209         mutex_unlock(&ebt_mutex);
1210 free_chainstack:
1211         if (newinfo->chainstack) {
1212                 for_each_possible_cpu(i)
1213                         vfree(newinfo->chainstack[i]);
1214                 vfree(newinfo->chainstack);
1215         }
1216         vfree(newinfo->entries);
1217 free_newinfo:
1218         vfree(newinfo);
1219         return ret;
1220 }
1221
1222 void ebt_unregister_table(struct ebt_table *table)
1223 {
1224         int i;
1225
1226         if (!table) {
1227                 BUGPRINT("Request to unregister NULL table!!!\n");
1228                 return;
1229         }
1230         mutex_lock(&ebt_mutex);
1231         LIST_DELETE(&ebt_tables, table);
1232         mutex_unlock(&ebt_mutex);
1233         vfree(table->private->entries);
1234         if (table->private->chainstack) {
1235                 for_each_possible_cpu(i)
1236                         vfree(table->private->chainstack[i]);
1237                 vfree(table->private->chainstack);
1238         }
1239         vfree(table->private);
1240 }
1241
1242 /* userspace just supplied us with counters */
1243 static int update_counters(void __user *user, unsigned int len)
1244 {
1245         int i, ret;
1246         struct ebt_counter *tmp;
1247         struct ebt_replace hlp;
1248         struct ebt_table *t;
1249
1250         if (copy_from_user(&hlp, user, sizeof(hlp)))
1251                 return -EFAULT;
1252
1253         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1254                 return -EINVAL;
1255         if (hlp.num_counters == 0)
1256                 return -EINVAL;
1257
1258         if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1259                 MEMPRINT("Update_counters && nomemory\n");
1260                 return -ENOMEM;
1261         }
1262
1263         t = find_table_lock(hlp.name, &ret, &ebt_mutex);
1264         if (!t)
1265                 goto free_tmp;
1266
1267         if (hlp.num_counters != t->private->nentries) {
1268                 BUGPRINT("Wrong nr of counters\n");
1269                 ret = -EINVAL;
1270                 goto unlock_mutex;
1271         }
1272
1273         if ( copy_from_user(tmp, hlp.counters,
1274            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1275                 BUGPRINT("Updata_counters && !cfu\n");
1276                 ret = -EFAULT;
1277                 goto unlock_mutex;
1278         }
1279
1280         /* we want an atomic add of the counters */
1281         write_lock_bh(&t->lock);
1282
1283         /* we add to the counters of the first cpu */
1284         for (i = 0; i < hlp.num_counters; i++) {
1285                 t->private->counters[i].pcnt += tmp[i].pcnt;
1286                 t->private->counters[i].bcnt += tmp[i].bcnt;
1287         }
1288
1289         write_unlock_bh(&t->lock);
1290         ret = 0;
1291 unlock_mutex:
1292         mutex_unlock(&ebt_mutex);
1293 free_tmp:
1294         vfree(tmp);
1295         return ret;
1296 }
1297
1298 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1299    char *base, char *ubase)
1300 {
1301         char *hlp = ubase - base + (char *)m;
1302         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1303                 return -EFAULT;
1304         return 0;
1305 }
1306
1307 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1308    char *base, char *ubase)
1309 {
1310         char *hlp = ubase - base + (char *)w;
1311         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1312                 return -EFAULT;
1313         return 0;
1314 }
1315
1316 static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
1317 {
1318         int ret;
1319         char *hlp;
1320         struct ebt_entry_target *t;
1321
1322         if (e->bitmask == 0)
1323                 return 0;
1324
1325         hlp = ubase - base + (char *)e + e->target_offset;
1326         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1327
1328         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1329         if (ret != 0)
1330                 return ret;
1331         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1332         if (ret != 0)
1333                 return ret;
1334         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1335                 return -EFAULT;
1336         return 0;
1337 }
1338
1339 /* called with ebt_mutex locked */
1340 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1341    int *len, int cmd)
1342 {
1343         struct ebt_replace tmp;
1344         struct ebt_counter *counterstmp, *oldcounters;
1345         unsigned int entries_size, nentries;
1346         char *entries;
1347
1348         if (cmd == EBT_SO_GET_ENTRIES) {
1349                 entries_size = t->private->entries_size;
1350                 nentries = t->private->nentries;
1351                 entries = t->private->entries;
1352                 oldcounters = t->private->counters;
1353         } else {
1354                 entries_size = t->table->entries_size;
1355                 nentries = t->table->nentries;
1356                 entries = t->table->entries;
1357                 oldcounters = t->table->counters;
1358         }
1359
1360         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1361                 BUGPRINT("Cfu didn't work\n");
1362                 return -EFAULT;
1363         }
1364
1365         if (*len != sizeof(struct ebt_replace) + entries_size +
1366            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1367                 BUGPRINT("Wrong size\n");
1368                 return -EINVAL;
1369         }
1370
1371         if (tmp.nentries != nentries) {
1372                 BUGPRINT("Nentries wrong\n");
1373                 return -EINVAL;
1374         }
1375
1376         if (tmp.entries_size != entries_size) {
1377                 BUGPRINT("Wrong size\n");
1378                 return -EINVAL;
1379         }
1380
1381         /* userspace might not need the counters */
1382         if (tmp.num_counters) {
1383                 if (tmp.num_counters != nentries) {
1384                         BUGPRINT("Num_counters wrong\n");
1385                         return -EINVAL;
1386                 }
1387                 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1388                 if (!counterstmp) {
1389                         MEMPRINT("Couldn't copy counters, out of memory\n");
1390                         return -ENOMEM;
1391                 }
1392                 write_lock_bh(&t->lock);
1393                 get_counters(oldcounters, counterstmp, nentries);
1394                 write_unlock_bh(&t->lock);
1395
1396                 if (copy_to_user(tmp.counters, counterstmp,
1397                    nentries * sizeof(struct ebt_counter))) {
1398                         BUGPRINT("Couldn't copy counters to userspace\n");
1399                         vfree(counterstmp);
1400                         return -EFAULT;
1401                 }
1402                 vfree(counterstmp);
1403         }
1404
1405         if (copy_to_user(tmp.entries, entries, entries_size)) {
1406                 BUGPRINT("Couldn't copy entries to userspace\n");
1407                 return -EFAULT;
1408         }
1409         /* set the match/watcher/target names right */
1410         return EBT_ENTRY_ITERATE(entries, entries_size,
1411            ebt_make_names, entries, tmp.entries);
1412 }
1413
1414 static int do_ebt_set_ctl(struct sock *sk,
1415         int cmd, void __user *user, unsigned int len)
1416 {
1417         int ret;
1418
1419         switch(cmd) {
1420         case EBT_SO_SET_ENTRIES:
1421                 ret = do_replace(user, len);
1422                 break;
1423         case EBT_SO_SET_COUNTERS:
1424                 ret = update_counters(user, len);
1425                 break;
1426         default:
1427                 ret = -EINVAL;
1428   }
1429         return ret;
1430 }
1431
1432 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1433 {
1434         int ret;
1435         struct ebt_replace tmp;
1436         struct ebt_table *t;
1437
1438         if (copy_from_user(&tmp, user, sizeof(tmp)))
1439                 return -EFAULT;
1440
1441         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1442         if (!t)
1443                 return ret;
1444
1445         switch(cmd) {
1446         case EBT_SO_GET_INFO:
1447         case EBT_SO_GET_INIT_INFO:
1448                 if (*len != sizeof(struct ebt_replace)){
1449                         ret = -EINVAL;
1450                         mutex_unlock(&ebt_mutex);
1451                         break;
1452                 }
1453                 if (cmd == EBT_SO_GET_INFO) {
1454                         tmp.nentries = t->private->nentries;
1455                         tmp.entries_size = t->private->entries_size;
1456                         tmp.valid_hooks = t->valid_hooks;
1457                 } else {
1458                         tmp.nentries = t->table->nentries;
1459                         tmp.entries_size = t->table->entries_size;
1460                         tmp.valid_hooks = t->table->valid_hooks;
1461                 }
1462                 mutex_unlock(&ebt_mutex);
1463                 if (copy_to_user(user, &tmp, *len) != 0){
1464                         BUGPRINT("c2u Didn't work\n");
1465                         ret = -EFAULT;
1466                         break;
1467                 }
1468                 ret = 0;
1469                 break;
1470
1471         case EBT_SO_GET_ENTRIES:
1472         case EBT_SO_GET_INIT_ENTRIES:
1473                 ret = copy_everything_to_user(t, user, len, cmd);
1474                 mutex_unlock(&ebt_mutex);
1475                 break;
1476
1477         default:
1478                 mutex_unlock(&ebt_mutex);
1479                 ret = -EINVAL;
1480         }
1481
1482         return ret;
1483 }
1484
1485 static struct nf_sockopt_ops ebt_sockopts =
1486 {
1487         .pf             = PF_INET,
1488         .set_optmin     = EBT_BASE_CTL,
1489         .set_optmax     = EBT_SO_SET_MAX + 1,
1490         .set            = do_ebt_set_ctl,
1491         .get_optmin     = EBT_BASE_CTL,
1492         .get_optmax     = EBT_SO_GET_MAX + 1,
1493         .get            = do_ebt_get_ctl,
1494 };
1495
1496 static int __init ebtables_init(void)
1497 {
1498         int ret;
1499
1500         mutex_lock(&ebt_mutex);
1501         list_named_insert(&ebt_targets, &ebt_standard_target);
1502         mutex_unlock(&ebt_mutex);
1503         if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
1504                 return ret;
1505
1506         printk(KERN_NOTICE "Ebtables v2.0 registered\n");
1507         return 0;
1508 }
1509
1510 static void __exit ebtables_fini(void)
1511 {
1512         nf_unregister_sockopt(&ebt_sockopts);
1513         printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
1514 }
1515
1516 EXPORT_SYMBOL(ebt_register_table);
1517 EXPORT_SYMBOL(ebt_unregister_table);
1518 EXPORT_SYMBOL(ebt_register_match);
1519 EXPORT_SYMBOL(ebt_unregister_match);
1520 EXPORT_SYMBOL(ebt_register_watcher);
1521 EXPORT_SYMBOL(ebt_unregister_watcher);
1522 EXPORT_SYMBOL(ebt_register_target);
1523 EXPORT_SYMBOL(ebt_unregister_target);
1524 EXPORT_SYMBOL(ebt_do_table);
1525 module_init(ebtables_init);
1526 module_exit(ebtables_fini);
1527 MODULE_LICENSE("GPL");