net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18
  19 #include <linux/kmod.h>
  20 #include <linux/module.h>
  21 #include <linux/vmalloc.h>
  22 #include <linux/netfilter/x_tables.h>
  23 #include <linux/netfilter_bridge/ebtables.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/mutex.h>
  26 #include <asm/uaccess.h>
  27 #include <linux/smp.h>
  28 #include <linux/cpumask.h>
  29 #include <net/sock.h>
  30 /* needed for logical [in,out]-dev filtering */
  31 #include "../br_private.h"
  32
  33 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  34                                          "report to author: "format, ## args)
  35 /* #define BUGPRINT(format, args...) */
  36 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  37                                          ": out of memory: "format, ## args)
  38 /* #define MEMPRINT(format, args...) */
  39
  40
  41
  42 /*
  43  * Each cpu has its own set of counters, so there is no need for write_lock in
  44  * the softirq
  45  * For reading or updating the counters, the user context needs to
  46  * get a write_lock
  47  */
  48
  49 /* The size of each set of counters is altered to get cache alignment */
  50 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  51 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  52 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  53    COUNTER_OFFSET(n) * cpu))
  54
  55
  56
  57 static DEFINE_MUTEX(ebt_mutex);
  58
  59 static struct xt_target ebt_standard_target = {
  60         .name       = "standard",
  61         .revision   = 0,
  62         .family     = NFPROTO_BRIDGE,
  63         .targetsize = sizeof(int),
  64 };
  65
  66 static inline int
  67 ebt_do_watcher(const struct ebt_entry_watcher *w, struct sk_buff *skb,
  68                struct xt_target_param *par)
  69 {
  70         par->target   = w->u.watcher;
  71         par->targinfo = w->data;
  72         w->u.watcher->target(skb, par);
  73         /* watchers don't give a verdict */
  74         return 0;
  75 }
  76
  77 static inline int ebt_do_match (struct ebt_entry_match *m,
  78    const struct sk_buff *skb, struct xt_match_param *par)
  79 {
  80         par->match     = m->u.match;
  81         par->matchinfo = m->data;
  82         return m->u.match->match(skb, par) ? EBT_MATCH : EBT_NOMATCH;
  83 }
  84
  85 static inline int ebt_dev_check(char *entry, const struct net_device *device)
  86 {
  87         int i = 0;
  88         const char *devname;
  89
  90         if (*entry == '\0')
  91                 return 0;
  92         if (!device)
  93                 return 1;
  94         devname = device->name;
  95         /* 1 is the wildcard token */
  96         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
  97                 i++;
  98         return (devname[i] != entry[i] && entry[i] != 1);
  99 }
 100
 101 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 102 /* process standard matches */
 103 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 104    const struct net_device *in, const struct net_device *out)
 105 {
 106         int verdict, i;
 107
 108         if (e->bitmask & EBT_802_3) {
 109                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 110                         return 1;
 111         } else if (!(e->bitmask & EBT_NOPROTO) &&
 112            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 113                 return 1;
 114
 115         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 116                 return 1;
 117         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 118                 return 1;
 119         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 120            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 121                 return 1;
 122         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 123            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 124                 return 1;
 125
 126         if (e->bitmask & EBT_SOURCEMAC) {
 127                 verdict = 0;
 128                 for (i = 0; i < 6; i++)
 129                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 130                            e->sourcemsk[i];
 131                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 132                         return 1;
 133         }
 134         if (e->bitmask & EBT_DESTMAC) {
 135                 verdict = 0;
 136                 for (i = 0; i < 6; i++)
 137                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 138                            e->destmsk[i];
 139                 if (FWINV2(verdict != 0, EBT_IDEST) )
 140                         return 1;
 141         }
 142         return 0;
 143 }
 144
 145 static inline __pure
 146 struct ebt_entry *ebt_next_entry(const struct ebt_entry *entry)
 147 {
 148         return (void *)entry + entry->next_offset;
 149 }
 150
 151 /* Do some firewalling */
 152 unsigned int ebt_do_table (unsigned int hook, struct sk_buff *skb,
 153    const struct net_device *in, const struct net_device *out,
 154    struct ebt_table *table)
 155 {
 156         int i, nentries;
 157         struct ebt_entry *point;
 158         struct ebt_counter *counter_base, *cb_base;
 159         struct ebt_entry_target *t;
 160         int verdict, sp = 0;
 161         struct ebt_chainstack *cs;
 162         struct ebt_entries *chaininfo;
 163         char *base;
 164         struct ebt_table_info *private;
 165         bool hotdrop = false;
 166         struct xt_match_param mtpar;
 167         struct xt_target_param tgpar;
 168
 169         mtpar.family  = tgpar.family = NFPROTO_BRIDGE;
 170         mtpar.in      = tgpar.in  = in;
 171         mtpar.out     = tgpar.out = out;
 172         mtpar.hotdrop = &hotdrop;
 173         mtpar.hooknum = tgpar.hooknum = hook;
 174
 175         read_lock_bh(&table->lock);
 176         private = table->private;
 177         cb_base = COUNTER_BASE(private->counters, private->nentries,
 178            smp_processor_id());
 179         if (private->chainstack)
 180                 cs = private->chainstack[smp_processor_id()];
 181         else
 182                 cs = NULL;
 183         chaininfo = private->hook_entry[hook];
 184         nentries = private->hook_entry[hook]->nentries;
 185         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 186         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 187         /* base for chain jumps */
 188         base = private->entries;
 189         i = 0;
 190         while (i < nentries) {
 191                 if (ebt_basic_match(point, eth_hdr(skb), in, out))
 192                         goto letscontinue;
 193
 194                 if (EBT_MATCH_ITERATE(point, ebt_do_match, skb, &mtpar) != 0)
 195                         goto letscontinue;
 196                 if (hotdrop) {
 197                         read_unlock_bh(&table->lock);
 198                         return NF_DROP;
 199                 }
 200
 201                 /* increase counter */
 202                 (*(counter_base + i)).pcnt++;
 203                 (*(counter_base + i)).bcnt += skb->len;
 204
 205                 /* these should only watch: not modify, nor tell us
 206                    what to do with the packet */
 207                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, skb, &tgpar);
 208
 209                 t = (struct ebt_entry_target *)
 210                    (((char *)point) + point->target_offset);
 211                 /* standard target */
 212                 if (!t->u.target->target)
 213                         verdict = ((struct ebt_standard_target *)t)->verdict;
 214                 else {
 215                         tgpar.target   = t->u.target;
 216                         tgpar.targinfo = t->data;
 217                         verdict = t->u.target->target(skb, &tgpar);
 218                 }
 219                 if (verdict == EBT_ACCEPT) {
 220                         read_unlock_bh(&table->lock);
 221                         return NF_ACCEPT;
 222                 }
 223                 if (verdict == EBT_DROP) {
 224                         read_unlock_bh(&table->lock);
 225                         return NF_DROP;
 226                 }
 227                 if (verdict == EBT_RETURN) {
 228 letsreturn:
 229 #ifdef CONFIG_NETFILTER_DEBUG
 230                         if (sp == 0) {
 231                                 BUGPRINT("RETURN on base chain");
 232                                 /* act like this is EBT_CONTINUE */
 233                                 goto letscontinue;
 234                         }
 235 #endif
 236                         sp--;
 237                         /* put all the local variables right */
 238                         i = cs[sp].n;
 239                         chaininfo = cs[sp].chaininfo;
 240                         nentries = chaininfo->nentries;
 241                         point = cs[sp].e;
 242                         counter_base = cb_base +
 243                            chaininfo->counter_offset;
 244                         continue;
 245                 }
 246                 if (verdict == EBT_CONTINUE)
 247                         goto letscontinue;
 248 #ifdef CONFIG_NETFILTER_DEBUG
 249                 if (verdict < 0) {
 250                         BUGPRINT("bogus standard verdict\n");
 251                         read_unlock_bh(&table->lock);
 252                         return NF_DROP;
 253                 }
 254 #endif
 255                 /* jump to a udc */
 256                 cs[sp].n = i + 1;
 257                 cs[sp].chaininfo = chaininfo;
 258                 cs[sp].e = ebt_next_entry(point);
 259                 i = 0;
 260                 chaininfo = (struct ebt_entries *) (base + verdict);
 261 #ifdef CONFIG_NETFILTER_DEBUG
 262                 if (chaininfo->distinguisher) {
 263                         BUGPRINT("jump to non-chain\n");
 264                         read_unlock_bh(&table->lock);
 265                         return NF_DROP;
 266                 }
 267 #endif
 268                 nentries = chaininfo->nentries;
 269                 point = (struct ebt_entry *)chaininfo->data;
 270                 counter_base = cb_base + chaininfo->counter_offset;
 271                 sp++;
 272                 continue;
 273 letscontinue:
 274                 point = ebt_next_entry(point);
 275                 i++;
 276         }
 277
 278         /* I actually like this :) */
 279         if (chaininfo->policy == EBT_RETURN)
 280                 goto letsreturn;
 281         if (chaininfo->policy == EBT_ACCEPT) {
 282                 read_unlock_bh(&table->lock);
 283                 return NF_ACCEPT;
 284         }
 285         read_unlock_bh(&table->lock);
 286         return NF_DROP;
 287 }
 288
 289 /* If it succeeds, returns element and locks mutex */
 290 static inline void *
 291 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 292    struct mutex *mutex)
 293 {
 294         struct {
 295                 struct list_head list;
 296                 char name[EBT_FUNCTION_MAXNAMELEN];
 297         } *e;
 298
 299         *error = mutex_lock_interruptible(mutex);
 300         if (*error != 0)
 301                 return NULL;
 302
 303         list_for_each_entry(e, head, list) {
 304                 if (strcmp(e->name, name) == 0)
 305                         return e;
 306         }
 307         *error = -ENOENT;
 308         mutex_unlock(mutex);
 309         return NULL;
 310 }
 311
 312 static void *
 313 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 314    int *error, struct mutex *mutex)
 315 {
 316         return try_then_request_module(
 317                         find_inlist_lock_noload(head, name, error, mutex),
 318                         "%s%s", prefix, name);
 319 }
 320
 321 static inline struct ebt_table *
 322 find_table_lock(struct net *net, const char *name, int *error,
 323                 struct mutex *mutex)
 324 {
 325         return find_inlist_lock(&net->xt.tables[NFPROTO_BRIDGE], name,
 326                                 "ebtable_", error, mutex);
 327 }
 328
 329 static inline int
 330 ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 331                 unsigned int *cnt)
 332 {
 333         const struct ebt_entry *e = par->entryinfo;
 334         struct xt_match *match;
 335         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 336         int ret;
 337
 338         if (left < sizeof(struct ebt_entry_match) ||
 339             left - sizeof(struct ebt_entry_match) < m->match_size)
 340                 return -EINVAL;
 341
 342         match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
 343                 m->u.name, 0), "ebt_%s", m->u.name);
 344         if (IS_ERR(match))
 345                 return PTR_ERR(match);
 346         if (match == NULL)
 347                 return -ENOENT;
 348         m->u.match = match;
 349
 350         par->match     = match;
 351         par->matchinfo = m->data;
 352         ret = xt_check_match(par, m->match_size,
 353               e->ethproto, e->invflags & EBT_IPROTO);
 354         if (ret < 0) {
 355                 module_put(match->me);
 356                 return ret;
 357         }
 358
 359         (*cnt)++;
 360         return 0;
 361 }
 362
 363 static inline int
 364 ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par,
 365                   unsigned int *cnt)
 366 {
 367         const struct ebt_entry *e = par->entryinfo;
 368         struct xt_target *watcher;
 369         size_t left = ((char *)e + e->target_offset) - (char *)w;
 370         int ret;
 371
 372         if (left < sizeof(struct ebt_entry_watcher) ||
 373            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 374                 return -EINVAL;
 375
 376         watcher = try_then_request_module(
 377                   xt_find_target(NFPROTO_BRIDGE, w->u.name, 0),
 378                   "ebt_%s", w->u.name);
 379         if (IS_ERR(watcher))
 380                 return PTR_ERR(watcher);
 381         if (watcher == NULL)
 382                 return -ENOENT;
 383         w->u.watcher = watcher;
 384
 385         par->target   = watcher;
 386         par->targinfo = w->data;
 387         ret = xt_check_target(par, w->watcher_size,
 388               e->ethproto, e->invflags & EBT_IPROTO);
 389         if (ret < 0) {
 390                 module_put(watcher->me);
 391                 return ret;
 392         }
 393
 394         (*cnt)++;
 395         return 0;
 396 }
 397
 398 static int ebt_verify_pointers(struct ebt_replace *repl,
 399                                struct ebt_table_info *newinfo)
 400 {
 401         unsigned int limit = repl->entries_size;
 402         unsigned int valid_hooks = repl->valid_hooks;
 403         unsigned int offset = 0;
 404         int i;
 405
 406         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 407                 newinfo->hook_entry[i] = NULL;
 408
 409         newinfo->entries_size = repl->entries_size;
 410         newinfo->nentries = repl->nentries;
 411
 412         while (offset < limit) {
 413                 size_t left = limit - offset;
 414                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 415
 416                 if (left < sizeof(unsigned int))
 417                         break;
 418
 419                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 420                         if ((valid_hooks & (1 << i)) == 0)
 421                                 continue;
 422                         if ((char __user *)repl->hook_entry[i] ==
 423                              repl->entries + offset)
 424                                 break;
 425                 }
 426
 427                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 428                         if (e->bitmask != 0) {
 429                                 /* we make userspace set this right,
 430                                    so there is no misunderstanding */
 431                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 432                                          "in distinguisher\n");
 433                                 return -EINVAL;
 434                         }
 435                         if (i != NF_BR_NUMHOOKS)
 436                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 437                         if (left < sizeof(struct ebt_entries))
 438                                 break;
 439                         offset += sizeof(struct ebt_entries);
 440                 } else {
 441                         if (left < sizeof(struct ebt_entry))
 442                                 break;
 443                         if (left < e->next_offset)
 444                                 break;
 445                         offset += e->next_offset;
 446                 }
 447         }
 448         if (offset != limit) {
 449                 BUGPRINT("entries_size too small\n");
 450                 return -EINVAL;
 451         }
 452
 453         /* check if all valid hooks have a chain */
 454         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 455                 if (!newinfo->hook_entry[i] &&
 456                    (valid_hooks & (1 << i))) {
 457                         BUGPRINT("Valid hook without chain\n");
 458                         return -EINVAL;
 459                 }
 460         }
 461         return 0;
 462 }
 463
 464 /*
 465  * this one is very careful, as it is the first function
 466  * to parse the userspace data
 467  */
 468 static inline int
 469 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 470    struct ebt_table_info *newinfo,
 471    unsigned int *n, unsigned int *cnt,
 472    unsigned int *totalcnt, unsigned int *udc_cnt)
 473 {
 474         int i;
 475
 476         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 477                 if ((void *)e == (void *)newinfo->hook_entry[i])
 478                         break;
 479         }
 480         /* beginning of a new chain
 481            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 482         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 483                 /* this checks if the previous chain has as many entries
 484                    as it said it has */
 485                 if (*n != *cnt) {
 486                         BUGPRINT("nentries does not equal the nr of entries "
 487                                  "in the chain\n");
 488                         return -EINVAL;
 489                 }
 490                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 491                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 492                         /* only RETURN from udc */
 493                         if (i != NF_BR_NUMHOOKS ||
 494                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 495                                 BUGPRINT("bad policy\n");
 496                                 return -EINVAL;
 497                         }
 498                 }
 499                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 500                         (*udc_cnt)++;
 501                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 502                         BUGPRINT("counter_offset != totalcnt");
 503                         return -EINVAL;
 504                 }
 505                 *n = ((struct ebt_entries *)e)->nentries;
 506                 *cnt = 0;
 507                 return 0;
 508         }
 509         /* a plain old entry, heh */
 510         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 511            e->watchers_offset > e->target_offset ||
 512            e->target_offset >= e->next_offset) {
 513                 BUGPRINT("entry offsets not in right order\n");
 514                 return -EINVAL;
 515         }
 516         /* this is not checked anywhere else */
 517         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 518                 BUGPRINT("target size too small\n");
 519                 return -EINVAL;
 520         }
 521         (*cnt)++;
 522         (*totalcnt)++;
 523         return 0;
 524 }
 525
 526 struct ebt_cl_stack
 527 {
 528         struct ebt_chainstack cs;
 529         int from;
 530         unsigned int hookmask;
 531 };
 532
 533 /*
 534  * we need these positions to check that the jumps to a different part of the
 535  * entries is a jump to the beginning of a new chain.
 536  */
 537 static inline int
 538 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 539    unsigned int *n, struct ebt_cl_stack *udc)
 540 {
 541         int i;
 542
 543         /* we're only interested in chain starts */
 544         if (e->bitmask)
 545                 return 0;
 546         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 547                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 548                         break;
 549         }
 550         /* only care about udc */
 551         if (i != NF_BR_NUMHOOKS)
 552                 return 0;
 553
 554         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 555         /* these initialisations are depended on later in check_chainloops() */
 556         udc[*n].cs.n = 0;
 557         udc[*n].hookmask = 0;
 558
 559         (*n)++;
 560         return 0;
 561 }
 562
 563 static inline int
 564 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 565 {
 566         struct xt_mtdtor_param par;
 567
 568         if (i && (*i)-- == 0)
 569                 return 1;
 570
 571         par.match     = m->u.match;
 572         par.matchinfo = m->data;
 573         par.family    = NFPROTO_BRIDGE;
 574         if (par.match->destroy != NULL)
 575                 par.match->destroy(&par);
 576         module_put(par.match->me);
 577         return 0;
 578 }
 579
 580 static inline int
 581 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 582 {
 583         struct xt_tgdtor_param par;
 584
 585         if (i && (*i)-- == 0)
 586                 return 1;
 587
 588         par.target   = w->u.watcher;
 589         par.targinfo = w->data;
 590         par.family   = NFPROTO_BRIDGE;
 591         if (par.target->destroy != NULL)
 592                 par.target->destroy(&par);
 593         module_put(par.target->me);
 594         return 0;
 595 }
 596
 597 static inline int
 598 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 599 {
 600         struct xt_tgdtor_param par;
 601         struct ebt_entry_target *t;
 602
 603         if (e->bitmask == 0)
 604                 return 0;
 605         /* we're done */
 606         if (cnt && (*cnt)-- == 0)
 607                 return 1;
 608         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 609         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 610         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 611
 612         par.target   = t->u.target;
 613         par.targinfo = t->data;
 614         par.family   = NFPROTO_BRIDGE;
 615         if (par.target->destroy != NULL)
 616                 par.target->destroy(&par);
 617         module_put(par.target->me);
 618         return 0;
 619 }
 620
 621 static inline int
 622 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 623    const char *name, unsigned int *cnt,
 624    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 625 {
 626         struct ebt_entry_target *t;
 627         struct xt_target *target;
 628         unsigned int i, j, hook = 0, hookmask = 0;
 629         size_t gap;
 630         int ret;
 631         struct xt_mtchk_param mtpar;
 632         struct xt_tgchk_param tgpar;
 633
 634         /* don't mess with the struct ebt_entries */
 635         if (e->bitmask == 0)
 636                 return 0;
 637
 638         if (e->bitmask & ~EBT_F_MASK) {
 639                 BUGPRINT("Unknown flag for bitmask\n");
 640                 return -EINVAL;
 641         }
 642         if (e->invflags & ~EBT_INV_MASK) {
 643                 BUGPRINT("Unknown flag for inv bitmask\n");
 644                 return -EINVAL;
 645         }
 646         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 647                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 648                 return -EINVAL;
 649         }
 650         /* what hook do we belong to? */
 651         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 652                 if (!newinfo->hook_entry[i])
 653                         continue;
 654                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 655                         hook = i;
 656                 else
 657                         break;
 658         }
 659         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 660            a base chain */
 661         if (i < NF_BR_NUMHOOKS)
 662                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 663         else {
 664                 for (i = 0; i < udc_cnt; i++)
 665                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 666                                 break;
 667                 if (i == 0)
 668                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 669                 else
 670                         hookmask = cl_s[i - 1].hookmask;
 671         }
 672         i = 0;
 673
 674         mtpar.table     = tgpar.table     = name;
 675         mtpar.entryinfo = tgpar.entryinfo = e;
 676         mtpar.hook_mask = tgpar.hook_mask = hookmask;
 677         mtpar.family    = tgpar.family    = NFPROTO_BRIDGE;
 678         ret = EBT_MATCH_ITERATE(e, ebt_check_match, &mtpar, &i);
 679         if (ret != 0)
 680                 goto cleanup_matches;
 681         j = 0;
 682         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, &tgpar, &j);
 683         if (ret != 0)
 684                 goto cleanup_watchers;
 685         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 686         gap = e->next_offset - e->target_offset;
 687
 688         target = try_then_request_module(
 689                  xt_find_target(NFPROTO_BRIDGE, t->u.name, 0),
 690                  "ebt_%s", t->u.name);
 691         if (IS_ERR(target)) {
 692                 ret = PTR_ERR(target);
 693                 goto cleanup_watchers;
 694         } else if (target == NULL) {
 695                 ret = -ENOENT;
 696                 goto cleanup_watchers;
 697         }
 698
 699         t->u.target = target;
 700         if (t->u.target == &ebt_standard_target) {
 701                 if (gap < sizeof(struct ebt_standard_target)) {
 702                         BUGPRINT("Standard target size too big\n");
 703                         ret = -EFAULT;
 704                         goto cleanup_watchers;
 705                 }
 706                 if (((struct ebt_standard_target *)t)->verdict <
 707                    -NUM_STANDARD_TARGETS) {
 708                         BUGPRINT("Invalid standard target\n");
 709                         ret = -EFAULT;
 710                         goto cleanup_watchers;
 711                 }
 712         } else if (t->target_size > gap - sizeof(struct ebt_entry_target)) {
 713                 module_put(t->u.target->me);
 714                 ret = -EFAULT;
 715                 goto cleanup_watchers;
 716         }
 717
 718         tgpar.target   = target;
 719         tgpar.targinfo = t->data;
 720         ret = xt_check_target(&tgpar, t->target_size,
 721               e->ethproto, e->invflags & EBT_IPROTO);
 722         if (ret < 0) {
 723                 module_put(target->me);
 724                 goto cleanup_watchers;
 725         }
 726         (*cnt)++;
 727         return 0;
 728 cleanup_watchers:
 729         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 730 cleanup_matches:
 731         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 732         return ret;
 733 }
 734
 735 /*
 736  * checks for loops and sets the hook mask for udc
 737  * the hook mask for udc tells us from which base chains the udc can be
 738  * accessed. This mask is a parameter to the check() functions of the extensions
 739  */
 740 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 741    unsigned int udc_cnt, unsigned int hooknr, char *base)
 742 {
 743         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 744         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 745         struct ebt_entry_target *t;
 746
 747         while (pos < nentries || chain_nr != -1) {
 748                 /* end of udc, go back one 'recursion' step */
 749                 if (pos == nentries) {
 750                         /* put back values of the time when this chain was called */
 751                         e = cl_s[chain_nr].cs.e;
 752                         if (cl_s[chain_nr].from != -1)
 753                                 nentries =
 754                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 755                         else
 756                                 nentries = chain->nentries;
 757                         pos = cl_s[chain_nr].cs.n;
 758                         /* make sure we won't see a loop that isn't one */
 759                         cl_s[chain_nr].cs.n = 0;
 760                         chain_nr = cl_s[chain_nr].from;
 761                         if (pos == nentries)
 762                                 continue;
 763                 }
 764                 t = (struct ebt_entry_target *)
 765                    (((char *)e) + e->target_offset);
 766                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 767                         goto letscontinue;
 768                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 769                    e->next_offset) {
 770                         BUGPRINT("Standard target size too big\n");
 771                         return -1;
 772                 }
 773                 verdict = ((struct ebt_standard_target *)t)->verdict;
 774                 if (verdict >= 0) { /* jump to another chain */
 775                         struct ebt_entries *hlp2 =
 776                            (struct ebt_entries *)(base + verdict);
 777                         for (i = 0; i < udc_cnt; i++)
 778                                 if (hlp2 == cl_s[i].cs.chaininfo)
 779                                         break;
 780                         /* bad destination or loop */
 781                         if (i == udc_cnt) {
 782                                 BUGPRINT("bad destination\n");
 783                                 return -1;
 784                         }
 785                         if (cl_s[i].cs.n) {
 786                                 BUGPRINT("loop\n");
 787                                 return -1;
 788                         }
 789                         if (cl_s[i].hookmask & (1 << hooknr))
 790                                 goto letscontinue;
 791                         /* this can't be 0, so the loop test is correct */
 792                         cl_s[i].cs.n = pos + 1;
 793                         pos = 0;
 794                         cl_s[i].cs.e = ebt_next_entry(e);
 795                         e = (struct ebt_entry *)(hlp2->data);
 796                         nentries = hlp2->nentries;
 797                         cl_s[i].from = chain_nr;
 798                         chain_nr = i;
 799                         /* this udc is accessible from the base chain for hooknr */
 800                         cl_s[i].hookmask |= (1 << hooknr);
 801                         continue;
 802                 }
 803 letscontinue:
 804                 e = ebt_next_entry(e);
 805                 pos++;
 806         }
 807         return 0;
 808 }
 809
 810 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 811 static int translate_table(char *name, struct ebt_table_info *newinfo)
 812 {
 813         unsigned int i, j, k, udc_cnt;
 814         int ret;
 815         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 816
 817         i = 0;
 818         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 819                 i++;
 820         if (i == NF_BR_NUMHOOKS) {
 821                 BUGPRINT("No valid hooks specified\n");
 822                 return -EINVAL;
 823         }
 824         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 825                 BUGPRINT("Chains don't start at beginning\n");
 826                 return -EINVAL;
 827         }
 828         /* make sure chains are ordered after each other in same order
 829            as their corresponding hooks */
 830         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 831                 if (!newinfo->hook_entry[j])
 832                         continue;
 833                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 834                         BUGPRINT("Hook order must be followed\n");
 835                         return -EINVAL;
 836                 }
 837                 i = j;
 838         }
 839
 840         /* do some early checkings and initialize some things */
 841         i = 0; /* holds the expected nr. of entries for the chain */
 842         j = 0; /* holds the up to now counted entries for the chain */
 843         k = 0; /* holds the total nr. of entries, should equal
 844                   newinfo->nentries afterwards */
 845         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 846         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 847            ebt_check_entry_size_and_hooks, newinfo,
 848            &i, &j, &k, &udc_cnt);
 849
 850         if (ret != 0)
 851                 return ret;
 852
 853         if (i != j) {
 854                 BUGPRINT("nentries does not equal the nr of entries in the "
 855                          "(last) chain\n");
 856                 return -EINVAL;
 857         }
 858         if (k != newinfo->nentries) {
 859                 BUGPRINT("Total nentries is wrong\n");
 860                 return -EINVAL;
 861         }
 862
 863         /* get the location of the udc, put them in an array
 864            while we're at it, allocate the chainstack */
 865         if (udc_cnt) {
 866                 /* this will get free'd in do_replace()/ebt_register_table()
 867                    if an error occurs */
 868                 newinfo->chainstack =
 869                         vmalloc(nr_cpu_ids * sizeof(*(newinfo->chainstack)));
 870                 if (!newinfo->chainstack)
 871                         return -ENOMEM;
 872                 for_each_possible_cpu(i) {
 873                         newinfo->chainstack[i] =
 874                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 875                         if (!newinfo->chainstack[i]) {
 876                                 while (i)
 877                                         vfree(newinfo->chainstack[--i]);
 878                                 vfree(newinfo->chainstack);
 879                                 newinfo->chainstack = NULL;
 880                                 return -ENOMEM;
 881                         }
 882                 }
 883
 884                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 885                 if (!cl_s)
 886                         return -ENOMEM;
 887                 i = 0; /* the i'th udc */
 888                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 889                    ebt_get_udc_positions, newinfo, &i, cl_s);
 890                 /* sanity check */
 891                 if (i != udc_cnt) {
 892                         BUGPRINT("i != udc_cnt\n");
 893                         vfree(cl_s);
 894                         return -EFAULT;
 895                 }
 896         }
 897
 898         /* Check for loops */
 899         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 900                 if (newinfo->hook_entry[i])
 901                         if (check_chainloops(newinfo->hook_entry[i],
 902                            cl_s, udc_cnt, i, newinfo->entries)) {
 903                                 vfree(cl_s);
 904                                 return -EINVAL;
 905                         }
 906
 907         /* we now know the following (along with E=mc²):
 908            - the nr of entries in each chain is right
 909            - the size of the allocated space is right
 910            - all valid hooks have a corresponding chain
 911            - there are no loops
 912            - wrong data can still be on the level of a single entry
 913            - could be there are jumps to places that are not the
 914              beginning of a chain. This can only occur in chains that
 915              are not accessible from any base chains, so we don't care. */
 916
 917         /* used to know what we need to clean up if something goes wrong */
 918         i = 0;
 919         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 920            ebt_check_entry, newinfo, name, &i, cl_s, udc_cnt);
 921         if (ret != 0) {
 922                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 923                    ebt_cleanup_entry, &i);
 924         }
 925         vfree(cl_s);
 926         return ret;
 927 }
 928
 929 /* called under write_lock */
 930 static void get_counters(struct ebt_counter *oldcounters,
 931    struct ebt_counter *counters, unsigned int nentries)
 932 {
 933         int i, cpu;
 934         struct ebt_counter *counter_base;
 935
 936         /* counters of cpu 0 */
 937         memcpy(counters, oldcounters,
 938                sizeof(struct ebt_counter) * nentries);
 939
 940         /* add other counters to those of cpu 0 */
 941         for_each_possible_cpu(cpu) {
 942                 if (cpu == 0)
 943                         continue;
 944                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 945                 for (i = 0; i < nentries; i++) {
 946                         counters[i].pcnt += counter_base[i].pcnt;
 947                         counters[i].bcnt += counter_base[i].bcnt;
 948                 }
 949         }
 950 }
 951
 952 /* replace the table */
 953 static int do_replace(struct net *net, void __user *user, unsigned int len)
 954 {
 955         int ret, i, countersize;
 956         struct ebt_table_info *newinfo;
 957         struct ebt_replace tmp;
 958         struct ebt_table *t;
 959         struct ebt_counter *counterstmp = NULL;
 960         /* used to be able to unlock earlier */
 961         struct ebt_table_info *table;
 962
 963         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 964                 return -EFAULT;
 965
 966         if (len != sizeof(tmp) + tmp.entries_size) {
 967                 BUGPRINT("Wrong len argument\n");
 968                 return -EINVAL;
 969         }
 970
 971         if (tmp.entries_size == 0) {
 972                 BUGPRINT("Entries_size never zero\n");
 973                 return -EINVAL;
 974         }
 975         /* overflow check */
 976         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 977                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 978                 return -ENOMEM;
 979         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 980                 return -ENOMEM;
 981
 982         tmp.name[sizeof(tmp.name) - 1] = 0;
 983
 984         countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
 985         newinfo = vmalloc(sizeof(*newinfo) + countersize);
 986         if (!newinfo)
 987                 return -ENOMEM;
 988
 989         if (countersize)
 990                 memset(newinfo->counters, 0, countersize);
 991
 992         newinfo->entries = vmalloc(tmp.entries_size);
 993         if (!newinfo->entries) {
 994                 ret = -ENOMEM;
 995                 goto free_newinfo;
 996         }
 997         if (copy_from_user(
 998            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 999                 BUGPRINT("Couldn't copy entries from userspace\n");
1000                 ret = -EFAULT;
1001                 goto free_entries;
1002         }
1003
1004         /* the user wants counters back
1005            the check on the size is done later, when we have the lock */
1006         if (tmp.num_counters) {
1007                 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
1008                 if (!counterstmp) {
1009                         ret = -ENOMEM;
1010                         goto free_entries;
1011                 }
1012         }
1013         else
1014                 counterstmp = NULL;
1015
1016         /* this can get initialized by translate_table() */
1017         newinfo->chainstack = NULL;
1018         ret = ebt_verify_pointers(&tmp, newinfo);
1019         if (ret != 0)
1020                 goto free_counterstmp;
1021
1022         ret = translate_table(tmp.name, newinfo);
1023
1024         if (ret != 0)
1025                 goto free_counterstmp;
1026
1027         t = find_table_lock(net, tmp.name, &ret, &ebt_mutex);
1028         if (!t) {
1029                 ret = -ENOENT;
1030                 goto free_iterate;
1031         }
1032
1033         /* the table doesn't like it */
1034         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1035                 goto free_unlock;
1036
1037         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1038                 BUGPRINT("Wrong nr. of counters requested\n");
1039                 ret = -EINVAL;
1040                 goto free_unlock;
1041         }
1042
1043         /* we have the mutex lock, so no danger in reading this pointer */
1044         table = t->private;
1045         /* make sure the table can only be rmmod'ed if it contains no rules */
1046         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1047                 ret = -ENOENT;
1048                 goto free_unlock;
1049         } else if (table->nentries && !newinfo->nentries)
1050                 module_put(t->me);
1051         /* we need an atomic snapshot of the counters */
1052         write_lock_bh(&t->lock);
1053         if (tmp.num_counters)
1054                 get_counters(t->private->counters, counterstmp,
1055                    t->private->nentries);
1056
1057         t->private = newinfo;
1058         write_unlock_bh(&t->lock);
1059         mutex_unlock(&ebt_mutex);
1060         /* so, a user can change the chains while having messed up her counter
1061            allocation. Only reason why this is done is because this way the lock
1062            is held only once, while this doesn't bring the kernel into a
1063            dangerous state. */
1064         if (tmp.num_counters &&
1065            copy_to_user(tmp.counters, counterstmp,
1066            tmp.num_counters * sizeof(struct ebt_counter))) {
1067                 BUGPRINT("Couldn't copy counters to userspace\n");
1068                 ret = -EFAULT;
1069         }
1070         else
1071                 ret = 0;
1072
1073         /* decrease module count and free resources */
1074         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1075            ebt_cleanup_entry, NULL);
1076
1077         vfree(table->entries);
1078         if (table->chainstack) {
1079                 for_each_possible_cpu(i)
1080                         vfree(table->chainstack[i]);
1081                 vfree(table->chainstack);
1082         }
1083         vfree(table);
1084
1085         vfree(counterstmp);
1086         return ret;
1087
1088 free_unlock:
1089         mutex_unlock(&ebt_mutex);
1090 free_iterate:
1091         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1092            ebt_cleanup_entry, NULL);
1093 free_counterstmp:
1094         vfree(counterstmp);
1095         /* can be initialized in translate_table() */
1096         if (newinfo->chainstack) {
1097                 for_each_possible_cpu(i)
1098                         vfree(newinfo->chainstack[i]);
1099                 vfree(newinfo->chainstack);
1100         }
1101 free_entries:
1102         vfree(newinfo->entries);
1103 free_newinfo:
1104         vfree(newinfo);
1105         return ret;
1106 }
1107
1108 struct ebt_table *
1109 ebt_register_table(struct net *net, const struct ebt_table *input_table)
1110 {
1111         struct ebt_table_info *newinfo;
1112         struct ebt_table *t, *table;
1113         struct ebt_replace_kernel *repl;
1114         int ret, i, countersize;
1115         void *p;
1116
1117         if (input_table == NULL || (repl = input_table->table) == NULL ||
1118             repl->entries == 0 || repl->entries_size == 0 ||
1119             repl->counters != NULL || input_table->private != NULL) {
1120                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1121                 return ERR_PTR(-EINVAL);
1122         }
1123
1124         /* Don't add one table to multiple lists. */
1125         table = kmemdup(input_table, sizeof(struct ebt_table), GFP_KERNEL);
1126         if (!table) {
1127                 ret = -ENOMEM;
1128                 goto out;
1129         }
1130
1131         countersize = COUNTER_OFFSET(repl->nentries) * nr_cpu_ids;
1132         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1133         ret = -ENOMEM;
1134         if (!newinfo)
1135                 goto free_table;
1136
1137         p = vmalloc(repl->entries_size);
1138         if (!p)
1139                 goto free_newinfo;
1140
1141         memcpy(p, repl->entries, repl->entries_size);
1142         newinfo->entries = p;
1143
1144         newinfo->entries_size = repl->entries_size;
1145         newinfo->nentries = repl->nentries;
1146
1147         if (countersize)
1148                 memset(newinfo->counters, 0, countersize);
1149
1150         /* fill in newinfo and parse the entries */
1151         newinfo->chainstack = NULL;
1152         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
1153                 if ((repl->valid_hooks & (1 << i)) == 0)
1154                         newinfo->hook_entry[i] = NULL;
1155                 else
1156                         newinfo->hook_entry[i] = p +
1157                                 ((char *)repl->hook_entry[i] - repl->entries);
1158         }
1159         ret = translate_table(repl->name, newinfo);
1160         if (ret != 0) {
1161                 BUGPRINT("Translate_table failed\n");
1162                 goto free_chainstack;
1163         }
1164
1165         if (table->check && table->check(newinfo, table->valid_hooks)) {
1166                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1167                 return ERR_PTR(-EINVAL);
1168         }
1169
1170         table->private = newinfo;
1171         rwlock_init(&table->lock);
1172         ret = mutex_lock_interruptible(&ebt_mutex);
1173         if (ret != 0)
1174                 goto free_chainstack;
1175
1176         list_for_each_entry(t, &net->xt.tables[NFPROTO_BRIDGE], list) {
1177                 if (strcmp(t->name, table->name) == 0) {
1178                         ret = -EEXIST;
1179                         BUGPRINT("Table name already exists\n");
1180                         goto free_unlock;
1181                 }
1182         }
1183
1184         /* Hold a reference count if the chains aren't empty */
1185         if (newinfo->nentries && !try_module_get(table->me)) {
1186                 ret = -ENOENT;
1187                 goto free_unlock;
1188         }
1189         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1190         mutex_unlock(&ebt_mutex);
1191         return table;
1192 free_unlock:
1193         mutex_unlock(&ebt_mutex);
1194 free_chainstack:
1195         if (newinfo->chainstack) {
1196                 for_each_possible_cpu(i)
1197                         vfree(newinfo->chainstack[i]);
1198                 vfree(newinfo->chainstack);
1199         }
1200         vfree(newinfo->entries);
1201 free_newinfo:
1202         vfree(newinfo);
1203 free_table:
1204         kfree(table);
1205 out:
1206         return ERR_PTR(ret);
1207 }
1208
1209 void ebt_unregister_table(struct ebt_table *table)
1210 {
1211         int i;
1212
1213         if (!table) {
1214                 BUGPRINT("Request to unregister NULL table!!!\n");
1215                 return;
1216         }
1217         mutex_lock(&ebt_mutex);
1218         list_del(&table->list);
1219         mutex_unlock(&ebt_mutex);
1220         EBT_ENTRY_ITERATE(table->private->entries, table->private->entries_size,
1221                           ebt_cleanup_entry, NULL);
1222         if (table->private->nentries)
1223                 module_put(table->me);
1224         vfree(table->private->entries);
1225         if (table->private->chainstack) {
1226                 for_each_possible_cpu(i)
1227                         vfree(table->private->chainstack[i]);
1228                 vfree(table->private->chainstack);
1229         }
1230         vfree(table->private);
1231         kfree(table);
1232 }
1233
1234 /* userspace just supplied us with counters */
1235 static int update_counters(struct net *net, void __user *user, unsigned int len)
1236 {
1237         int i, ret;
1238         struct ebt_counter *tmp;
1239         struct ebt_replace hlp;
1240         struct ebt_table *t;
1241
1242         if (copy_from_user(&hlp, user, sizeof(hlp)))
1243                 return -EFAULT;
1244
1245         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1246                 return -EINVAL;
1247         if (hlp.num_counters == 0)
1248                 return -EINVAL;
1249
1250         if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1251                 MEMPRINT("Update_counters && nomemory\n");
1252                 return -ENOMEM;
1253         }
1254
1255         t = find_table_lock(net, hlp.name, &ret, &ebt_mutex);
1256         if (!t)
1257                 goto free_tmp;
1258
1259         if (hlp.num_counters != t->private->nentries) {
1260                 BUGPRINT("Wrong nr of counters\n");
1261                 ret = -EINVAL;
1262                 goto unlock_mutex;
1263         }
1264
1265         if ( copy_from_user(tmp, hlp.counters,
1266            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1267                 BUGPRINT("Updata_counters && !cfu\n");
1268                 ret = -EFAULT;
1269                 goto unlock_mutex;
1270         }
1271
1272         /* we want an atomic add of the counters */
1273         write_lock_bh(&t->lock);
1274
1275         /* we add to the counters of the first cpu */
1276         for (i = 0; i < hlp.num_counters; i++) {
1277                 t->private->counters[i].pcnt += tmp[i].pcnt;
1278                 t->private->counters[i].bcnt += tmp[i].bcnt;
1279         }
1280
1281         write_unlock_bh(&t->lock);
1282         ret = 0;
1283 unlock_mutex:
1284         mutex_unlock(&ebt_mutex);
1285 free_tmp:
1286         vfree(tmp);
1287         return ret;
1288 }
1289
1290 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1291    char *base, char __user *ubase)
1292 {
1293         char __user *hlp = ubase + ((char *)m - base);
1294         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1295                 return -EFAULT;
1296         return 0;
1297 }
1298
1299 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1300    char *base, char __user *ubase)
1301 {
1302         char __user *hlp = ubase + ((char *)w - base);
1303         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1304                 return -EFAULT;
1305         return 0;
1306 }
1307
1308 static inline int ebt_make_names(struct ebt_entry *e, char *base, char __user *ubase)
1309 {
1310         int ret;
1311         char __user *hlp;
1312         struct ebt_entry_target *t;
1313
1314         if (e->bitmask == 0)
1315                 return 0;
1316
1317         hlp = ubase + (((char *)e + e->target_offset) - base);
1318         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1319
1320         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1321         if (ret != 0)
1322                 return ret;
1323         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1324         if (ret != 0)
1325                 return ret;
1326         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1327                 return -EFAULT;
1328         return 0;
1329 }
1330
1331 /* called with ebt_mutex locked */
1332 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1333    int *len, int cmd)
1334 {
1335         struct ebt_replace tmp;
1336         struct ebt_counter *counterstmp, *oldcounters;
1337         unsigned int entries_size, nentries;
1338         char *entries;
1339
1340         if (cmd == EBT_SO_GET_ENTRIES) {
1341                 entries_size = t->private->entries_size;
1342                 nentries = t->private->nentries;
1343                 entries = t->private->entries;
1344                 oldcounters = t->private->counters;
1345         } else {
1346                 entries_size = t->table->entries_size;
1347                 nentries = t->table->nentries;
1348                 entries = t->table->entries;
1349                 oldcounters = t->table->counters;
1350         }
1351
1352         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1353                 BUGPRINT("Cfu didn't work\n");
1354                 return -EFAULT;
1355         }
1356
1357         if (*len != sizeof(struct ebt_replace) + entries_size +
1358            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1359                 BUGPRINT("Wrong size\n");
1360                 return -EINVAL;
1361         }
1362
1363         if (tmp.nentries != nentries) {
1364                 BUGPRINT("Nentries wrong\n");
1365                 return -EINVAL;
1366         }
1367
1368         if (tmp.entries_size != entries_size) {
1369                 BUGPRINT("Wrong size\n");
1370                 return -EINVAL;
1371         }
1372
1373         /* userspace might not need the counters */
1374         if (tmp.num_counters) {
1375                 if (tmp.num_counters != nentries) {
1376                         BUGPRINT("Num_counters wrong\n");
1377                         return -EINVAL;
1378                 }
1379                 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1380                 if (!counterstmp) {
1381                         MEMPRINT("Couldn't copy counters, out of memory\n");
1382                         return -ENOMEM;
1383                 }
1384                 write_lock_bh(&t->lock);
1385                 get_counters(oldcounters, counterstmp, nentries);
1386                 write_unlock_bh(&t->lock);
1387
1388                 if (copy_to_user(tmp.counters, counterstmp,
1389                    nentries * sizeof(struct ebt_counter))) {
1390                         BUGPRINT("Couldn't copy counters to userspace\n");
1391                         vfree(counterstmp);
1392                         return -EFAULT;
1393                 }
1394                 vfree(counterstmp);
1395         }
1396
1397         if (copy_to_user(tmp.entries, entries, entries_size)) {
1398                 BUGPRINT("Couldn't copy entries to userspace\n");
1399                 return -EFAULT;
1400         }
1401         /* set the match/watcher/target names right */
1402         return EBT_ENTRY_ITERATE(entries, entries_size,
1403            ebt_make_names, entries, tmp.entries);
1404 }
1405
1406 static int do_ebt_set_ctl(struct sock *sk,
1407         int cmd, void __user *user, unsigned int len)
1408 {
1409         int ret;
1410
1411         if (!capable(CAP_NET_ADMIN))
1412                 return -EPERM;
1413
1414         switch(cmd) {
1415         case EBT_SO_SET_ENTRIES:
1416                 ret = do_replace(sock_net(sk), user, len);
1417                 break;
1418         case EBT_SO_SET_COUNTERS:
1419                 ret = update_counters(sock_net(sk), user, len);
1420                 break;
1421         default:
1422                 ret = -EINVAL;
1423   }
1424         return ret;
1425 }
1426
1427 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1428 {
1429         int ret;
1430         struct ebt_replace tmp;
1431         struct ebt_table *t;
1432
1433         if (!capable(CAP_NET_ADMIN))
1434                 return -EPERM;
1435
1436         if (copy_from_user(&tmp, user, sizeof(tmp)))
1437                 return -EFAULT;
1438
1439         t = find_table_lock(sock_net(sk), tmp.name, &ret, &ebt_mutex);
1440         if (!t)
1441                 return ret;
1442
1443         switch(cmd) {
1444         case EBT_SO_GET_INFO:
1445         case EBT_SO_GET_INIT_INFO:
1446                 if (*len != sizeof(struct ebt_replace)){
1447                         ret = -EINVAL;
1448                         mutex_unlock(&ebt_mutex);
1449                         break;
1450                 }
1451                 if (cmd == EBT_SO_GET_INFO) {
1452                         tmp.nentries = t->private->nentries;
1453                         tmp.entries_size = t->private->entries_size;
1454                         tmp.valid_hooks = t->valid_hooks;
1455                 } else {
1456                         tmp.nentries = t->table->nentries;
1457                         tmp.entries_size = t->table->entries_size;
1458                         tmp.valid_hooks = t->table->valid_hooks;
1459                 }
1460                 mutex_unlock(&ebt_mutex);
1461                 if (copy_to_user(user, &tmp, *len) != 0){
1462                         BUGPRINT("c2u Didn't work\n");
1463                         ret = -EFAULT;
1464                         break;
1465                 }
1466                 ret = 0;
1467                 break;
1468
1469         case EBT_SO_GET_ENTRIES:
1470         case EBT_SO_GET_INIT_ENTRIES:
1471                 ret = copy_everything_to_user(t, user, len, cmd);
1472                 mutex_unlock(&ebt_mutex);
1473                 break;
1474
1475         default:
1476                 mutex_unlock(&ebt_mutex);
1477                 ret = -EINVAL;
1478         }
1479
1480         return ret;
1481 }
1482
1483 static struct nf_sockopt_ops ebt_sockopts =
1484 {
1485         .pf             = PF_INET,
1486         .set_optmin     = EBT_BASE_CTL,
1487         .set_optmax     = EBT_SO_SET_MAX + 1,
1488         .set            = do_ebt_set_ctl,
1489         .get_optmin     = EBT_BASE_CTL,
1490         .get_optmax     = EBT_SO_GET_MAX + 1,
1491         .get            = do_ebt_get_ctl,
1492         .owner          = THIS_MODULE,
1493 };
1494
1495 static int __init ebtables_init(void)
1496 {
1497         int ret;
1498
1499         ret = xt_register_target(&ebt_standard_target);
1500         if (ret < 0)
1501                 return ret;
1502         ret = nf_register_sockopt(&ebt_sockopts);
1503         if (ret < 0) {
1504                 xt_unregister_target(&ebt_standard_target);
1505                 return ret;
1506         }
1507
1508         printk(KERN_INFO "Ebtables v2.0 registered\n");
1509         return 0;
1510 }
1511
1512 static void __exit ebtables_fini(void)
1513 {
1514         nf_unregister_sockopt(&ebt_sockopts);
1515         xt_unregister_target(&ebt_standard_target);
1516         printk(KERN_INFO "Ebtables v2.0 unregistered\n");
1517 }
1518
1519 EXPORT_SYMBOL(ebt_register_table);
1520 EXPORT_SYMBOL(ebt_unregister_table);
1521 EXPORT_SYMBOL(ebt_do_table);
1522 module_init(ebtables_init);
1523 module_exit(ebtables_fini);
1524 MODULE_LICENSE("GPL");