obsolete-buildroot/sources/openwrt/kernel/patches/140-ebtables-brnf-5.patch

   1 --- linux-2.4.21/net/bridge/br_private.h        Mon Feb 25 20:38:14 2002
   2 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_private.h     Fri Aug  8 01:09:06 2003
   3 @@ -144,8 +144,10 @@ extern void br_fdb_insert(struct net_bri
   4  /* br_forward.c */
   5  extern void br_deliver(struct net_bridge_port *to,
   6                 struct sk_buff *skb);
   7 +extern int br_dev_queue_push_xmit(struct sk_buff *skb);
   8  extern void br_forward(struct net_bridge_port *to,
   9                 struct sk_buff *skb);
  10 +extern int br_forward_finish(struct sk_buff *skb);
  11  extern void br_flood_deliver(struct net_bridge *br,
  12                       struct sk_buff *skb,
  13                       int clone);
  14 @@ -166,7 +168,8 @@ extern void br_get_port_ifindices(struct
  15                            int *ifindices);
  16
  17  /* br_input.c */
  18 -extern void br_handle_frame(struct sk_buff *skb);
  19 +extern int br_handle_frame_finish(struct sk_buff *skb);
  20 +extern int br_handle_frame(struct sk_buff *skb);
  21
  22  /* br_ioctl.c */
  23  extern void br_call_ioctl_atomic(void (*fn)(void));
  24 @@ -176,6 +179,10 @@ extern int br_ioctl(struct net_bridge *b
  25              unsigned long arg1,
  26              unsigned long arg2);
  27  extern int br_ioctl_deviceless_stub(unsigned long arg);
  28 +
  29 +/* br_netfilter.c */
  30 +extern int br_netfilter_init(void);
  31 +extern void br_netfilter_fini(void);
  32
  33  /* br_stp.c */
  34  extern int br_is_root_bridge(struct net_bridge *br);
  35 --- linux-2.4.21/include/linux/if_bridge.h      Thu Nov 22 20:47:12 2001
  36 +++ linux-2.4.21-ebt-brnf-3/include/linux/if_bridge.h   Fri Aug  8 01:09:06 2003
  37 @@ -102,7 +102,8 @@ struct net_bridge;
  38  struct net_bridge_port;
  39
  40  extern int (*br_ioctl_hook)(unsigned long arg);
  41 -extern void (*br_handle_frame_hook)(struct sk_buff *skb);
  42 +extern int (*br_handle_frame_hook)(struct sk_buff *skb);
  43 +extern int (*br_should_route_hook)(struct sk_buff **pskb);
  44
  45  #endif
  46
  47 --- linux-2.4.21/net/core/dev.c Fri Jun 13 16:51:39 2003
  48 +++ linux-2.4.21-ebt-brnf-3/net/core/dev.c      Fri Aug  8 01:10:03 2003
  49 @@ -1424,7 +1424,7 @@ static void net_tx_action(struct softirq
  50
  51
  52  #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
  53 -void (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
  54 +int (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
  55  #endif
  56
  57  static __inline__ int handle_bridge(struct sk_buff *skb,
  58 @@ -1441,7 +1441,6 @@ static __inline__ int handle_bridge(stru
  59                 }
  60         }
  61
  62 -       br_handle_frame_hook(skb);
  63         return ret;
  64  }
  65
  66 @@ -1497,11 +1496,16 @@ int netif_receive_skb(struct sk_buff *sk
  67         if (skb->dev->divert && skb->dev->divert->divert)
  68                 ret = handle_diverter(skb);
  69  #endif /* CONFIG_NET_DIVERT */
  70 -
  71 +
  72  #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
  73         if (skb->dev->br_port != NULL &&
  74 -           br_handle_frame_hook != NULL) {
  75 -               return handle_bridge(skb, pt_prev);
  76 +        br_handle_frame_hook != NULL) {
  77 +               int ret;
  78 +
  79 +               ret = handle_bridge(skb, pt_prev);
  80 +               if (br_handle_frame_hook(skb) == 0)
  81 +                       return ret;
  82 +               pt_prev = NULL;
  83         }
  84  #endif
  85
  86 @@ -1897,7 +1901,7 @@ static int dev_proc_stats(char *buffer,
  87   *     are adjusted, %RTM_NEWLINK is sent to the routing socket and the
  88   *     function returns zero.
  89   */
  90 -
  91 +
  92  int netdev_set_master(struct net_device *slave, struct net_device *master)
  93  {
  94         struct net_device *old = slave->master;
  95 --- linux-2.4.21/net/bridge/br_input.c  Sat Aug  3 02:39:46 2002
  96 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_input.c       Fri Aug  8 01:09:06 2003
  97 @@ -24,6 +24,9 @@ unsigned char bridge_ula[6] = { 0x01, 0x
  98
  99  static int br_pass_frame_up_finish(struct sk_buff *skb)
 100  {
 101 +#ifdef CONFIG_NETFILTER_DEBUG
 102 +       skb->nf_debug = 0;
 103 +#endif
 104         netif_rx(skb);
 105
 106         return 0;
 107 @@ -46,7 +49,7 @@ static void br_pass_frame_up(struct net_
 108                         br_pass_frame_up_finish);
 109  }
 110
 111 -static int br_handle_frame_finish(struct sk_buff *skb)
 112 +int br_handle_frame_finish(struct sk_buff *skb)
 113  {
 114         struct net_bridge *br;
 115         unsigned char *dest;
 116 @@ -112,7 +115,7 @@ err_nolock:
 117         return 0;
 118  }
 119
 120 -void br_handle_frame(struct sk_buff *skb)
 121 +int br_handle_frame(struct sk_buff *skb)
 122  {
 123         struct net_bridge *br;
 124         unsigned char *dest;
 125 @@ -146,25 +149,35 @@ void br_handle_frame(struct sk_buff *skb
 126                 goto handle_special_frame;
 127
 128         if (p->state == BR_STATE_FORWARDING) {
 129 +
 130 +               if (br_should_route_hook && br_should_route_hook(&skb)) {
 131 +                       read_unlock(&br->lock);
 132 +                       return -1;
 133 +               }
 134 +
 135 +               if (!memcmp(p->br->dev.dev_addr, dest, ETH_ALEN))
 136 +                       skb->pkt_type = PACKET_HOST;
 137 +
 138                 NF_HOOK(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
 139                         br_handle_frame_finish);
 140                 read_unlock(&br->lock);
 141 -               return;
 142 +               return 0;
 143         }
 144
 145  err:
 146         read_unlock(&br->lock);
 147  err_nolock:
 148         kfree_skb(skb);
 149 -       return;
 150 +       return 0;
 151
 152  handle_special_frame:
 153         if (!dest[5]) {
 154                 br_stp_handle_bpdu(skb);
 155                 read_unlock(&br->lock);
 156 -               return;
 157 +               return 0;
 158         }
 159
 160         read_unlock(&br->lock);
 161         kfree_skb(skb);
 162 +       return 0;
 163  }
 164 --- linux-2.4.21/net/bridge/br_forward.c        Sat Aug  3 02:39:46 2002
 165 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_forward.c     Fri Aug  8 01:09:06 2003
 166 @@ -30,18 +30,22 @@ static inline int should_deliver(struct
 167         return 1;
 168  }
 169
 170 -static int __dev_queue_push_xmit(struct sk_buff *skb)
 171 +int br_dev_queue_push_xmit(struct sk_buff *skb)
 172  {
 173 +#ifdef CONFIG_NETFILTER
 174 +       if (skb->nf_bridge)
 175 +               memcpy(skb->data - 16, skb->nf_bridge->hh, 16);
 176 +#endif
 177         skb_push(skb, ETH_HLEN);
 178         dev_queue_xmit(skb);
 179
 180         return 0;
 181  }
 182
 183 -static int __br_forward_finish(struct sk_buff *skb)
 184 +int br_forward_finish(struct sk_buff *skb)
 185  {
 186         NF_HOOK(PF_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
 187 -                       __dev_queue_push_xmit);
 188 +                       br_dev_queue_push_xmit);
 189
 190         return 0;
 191  }
 192 @@ -49,8 +53,11 @@ static int __br_forward_finish(struct sk
 193  static void __br_deliver(struct net_bridge_port *to, struct sk_buff *skb)
 194  {
 195         skb->dev = to->dev;
 196 +#ifdef CONFIG_NETFILTER_DEBUG
 197 +       skb->nf_debug = 0;
 198 +#endif
 199         NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 200 -                       __br_forward_finish);
 201 +                       br_forward_finish);
 202  }
 203
 204  static void __br_forward(struct net_bridge_port *to, struct sk_buff *skb)
 205 @@ -61,7 +68,7 @@ static void __br_forward(struct net_brid
 206         skb->dev = to->dev;
 207
 208         NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
 209 -                       __br_forward_finish);
 210 +                       br_forward_finish);
 211  }
 212
 213  /* called under bridge lock */
 214 --- linux-2.4.21/net/bridge/br.c        Fri Nov 29 00:53:15 2002
 215 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br.c     Fri Aug  8 01:09:06 2003
 216 @@ -29,6 +29,8 @@
 217  #include "../atm/lec.h"
 218  #endif
 219
 220 +int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
 221 +
 222  void br_dec_use_count()
 223  {
 224         MOD_DEC_USE_COUNT;
 225 @@ -43,6 +45,10 @@ static int __init br_init(void)
 226  {
 227         printk(KERN_INFO "NET4: Ethernet Bridge 008 for NET4.0\n");
 228
 229 +#ifdef CONFIG_NETFILTER
 230 +       if (br_netfilter_init())
 231 +               return 1;
 232 +#endif
 233         br_handle_frame_hook = br_handle_frame;
 234         br_ioctl_hook = br_ioctl_deviceless_stub;
 235  #if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
 236 @@ -61,6 +67,9 @@ static void __br_clear_ioctl_hook(void)
 237
 238  static void __exit br_deinit(void)
 239  {
 240 +#ifdef CONFIG_NETFILTER
 241 +       br_netfilter_fini();
 242 +#endif
 243         unregister_netdevice_notifier(&br_device_notifier);
 244         br_call_ioctl_atomic(__br_clear_ioctl_hook);
 245
 246 @@ -74,7 +83,7 @@ static void __exit br_deinit(void)
 247  #endif
 248  }
 249
 250 -EXPORT_NO_SYMBOLS;
 251 +EXPORT_SYMBOL(br_should_route_hook);
 252
 253  module_init(br_init)
 254  module_exit(br_deinit)
 255 --- linux-2.4.21/net/bridge/Makefile    Fri Dec 29 23:07:24 2000
 256 +++ linux-2.4.21-ebt-brnf-3/net/bridge/Makefile Fri Aug  8 01:09:06 2003
 257 @@ -7,10 +7,17 @@
 258  #
 259  # Note 2! The CFLAGS definition is now in the main makefile...
 260
 261 +export-objs := br.o
 262 +
 263  O_TARGET       := bridge.o
 264  obj-y          := br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
 265                         br_ioctl.o br_notify.o br_stp.o br_stp_bpdu.o \
 266                         br_stp_if.o br_stp_timer.o
 267 +
 268 +ifeq ($(CONFIG_NETFILTER),y)
 269 +obj-y          += br_netfilter.o
 270 +endif
 271 +
 272  obj-m          := $(O_TARGET)
 273
 274  include $(TOPDIR)/Rules.make
 275 --- linux-2.4.21/include/linux/netfilter_bridge.h       Tue Jun 12 04:15:27 2001
 276 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge.h    Fri Aug  8 01:09:06 2003
 277 @@ -1,11 +1,14 @@
 278  #ifndef __LINUX_BRIDGE_NETFILTER_H
 279  #define __LINUX_BRIDGE_NETFILTER_H
 280
 281 -/* bridge-specific defines for netfilter.
 282 +/* bridge-specific defines for netfilter.
 283   */
 284
 285  #include <linux/config.h>
 286  #include <linux/netfilter.h>
 287 +#if defined(__KERNEL__) && defined(CONFIG_NETFILTER)
 288 +#include <asm/atomic.h>
 289 +#endif
 290
 291  /* Bridge Hooks */
 292  /* After promisc drops, checksum checks. */
 293 @@ -18,7 +21,49 @@
 294  #define NF_BR_LOCAL_OUT                3
 295  /* Packets about to hit the wire. */
 296  #define NF_BR_POST_ROUTING     4
 297 -#define NF_BR_NUMHOOKS         5
 298 +/* Not really a hook, but used for the ebtables broute table */
 299 +#define NF_BR_BROUTING         5
 300 +#define NF_BR_NUMHOOKS         6
 301
 302 +#ifdef __KERNEL__
 303
 304 +#define BRNF_PKT_TYPE                  0x01
 305 +#define BRNF_BRIDGED_DNAT              0x02
 306 +#define BRNF_DONT_TAKE_PARENT          0x04
 307 +#define BRNF_BRIDGED                   0x08
 308 +
 309 +enum nf_br_hook_priorities {
 310 +       NF_BR_PRI_FIRST = INT_MIN,
 311 +       NF_BR_PRI_NAT_DST_BRIDGED = -300,
 312 +       NF_BR_PRI_FILTER_BRIDGED = -200,
 313 +       NF_BR_PRI_BRNF = 0,
 314 +       NF_BR_PRI_NAT_DST_OTHER = 100,
 315 +       NF_BR_PRI_FILTER_OTHER = 200,
 316 +       NF_BR_PRI_NAT_SRC = 300,
 317 +       NF_BR_PRI_LAST = INT_MAX,
 318 +};
 319 +
 320 +#ifdef CONFIG_NETFILTER
 321 +static inline
 322 +struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
 323 +{
 324 +       struct nf_bridge_info **nf_bridge = &(skb->nf_bridge);
 325 +
 326 +       if ((*nf_bridge = kmalloc(sizeof(**nf_bridge), GFP_ATOMIC)) != NULL) {
 327 +               atomic_set(&(*nf_bridge)->use, 1);
 328 +               (*nf_bridge)->mask = 0;
 329 +               (*nf_bridge)->physindev = (*nf_bridge)->physoutdev = NULL;
 330 +       }
 331 +
 332 +       return *nf_bridge;
 333 +}
 334 +
 335 +struct bridge_skb_cb {
 336 +       union {
 337 +               __u32 ipv4;
 338 +       } daddr;
 339 +};
 340 +#endif /* CONFIG_NETFILTER */
 341 +
 342 +#endif /* __KERNEL__ */
 343  #endif
 344 --- linux-2.4.21/net/Makefile   Sat Aug  3 02:39:46 2002
 345 +++ linux-2.4.21-ebt-brnf-3/net/Makefile        Fri Aug  8 01:09:06 2003
 346 @@ -7,7 +7,8 @@
 347
 348  O_TARGET :=    network.o
 349
 350 -mod-subdirs := ipv4/netfilter ipv6/netfilter ipx irda bluetooth atm netlink sched core
 351 +mod-subdirs := ipv4/netfilter ipv6/netfilter bridge/netfilter ipx irda \
 352 +       bluetooth atm netlink sched core
 353  export-objs := netsyms.o
 354
 355  subdir-y :=    core ethernet
 356 @@ -23,6 +24,12 @@ subdir-$(CONFIG_IPV6)                += ipv6
 357  ifneq ($(CONFIG_IPV6),n)
 358  ifneq ($(CONFIG_IPV6),)
 359  subdir-$(CONFIG_NETFILTER)     += ipv6/netfilter
 360 +endif
 361 +endif
 362 +
 363 +ifneq ($(CONFIG_BRIDGE),n)
 364 +ifneq ($(CONFIG_BRIDGE),)
 365 +subdir-$(CONFIG_BRIDGE)                += bridge/netfilter
 366  endif
 367  endif
 368
 369 --- linux-2.4.21/net/Config.in  Sat Aug  3 02:39:46 2002
 370 +++ linux-2.4.21-ebt-brnf-3/net/Config.in       Fri Aug  8 01:09:06 2003
 371 @@ -65,6 +65,9 @@ if [ "$CONFIG_DECNET" != "n" ]; then
 372     source net/decnet/Config.in
 373  fi
 374  dep_tristate '802.1d Ethernet Bridging' CONFIG_BRIDGE $CONFIG_INET
 375 +if [ "$CONFIG_BRIDGE" != "n" -a "$CONFIG_NETFILTER" != "n" ]; then
 376 +   source net/bridge/netfilter/Config.in
 377 +fi
 378  if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 379     tristate 'CCITT X.25 Packet Layer (EXPERIMENTAL)' CONFIG_X25
 380     tristate 'LAPB Data Link Driver (EXPERIMENTAL)' CONFIG_LAPB
 381 --- /dev/null   Thu Aug 24 11:00:32 2000
 382 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/Makefile       Fri Aug  8 01:09:06 2003
 383 @@ -0,0 +1,30 @@
 384 +#
 385 +# Makefile for the netfilter modules on top of bridging.
 386 +#
 387 +# Note! Dependencies are done automagically by 'make dep', which also
 388 +# removes any old dependencies. DON'T put your own dependencies here
 389 +# unless it's something special (ie not a .c file).
 390 +#
 391 +# Note 2! The CFLAGS definition is now in the main makefile...
 392 +
 393 +O_TARGET       := netfilter.o
 394 +
 395 +export-objs := ebtables.o
 396 +
 397 +obj-$(CONFIG_BRIDGE_NF_EBTABLES) += ebtables.o
 398 +obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebtable_filter.o
 399 +obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
 400 +obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
 401 +obj-$(CONFIG_BRIDGE_EBT_IPF) += ebt_ip.o
 402 +obj-$(CONFIG_BRIDGE_EBT_ARPF) += ebt_arp.o
 403 +obj-$(CONFIG_BRIDGE_EBT_VLANF) += ebt_vlan.o
 404 +obj-$(CONFIG_BRIDGE_EBT_MARKF) += ebt_mark_m.o
 405 +obj-$(CONFIG_BRIDGE_EBT_802_3) += ebt_802_3.o
 406 +obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_pkttype.o
 407 +obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_stp.o
 408 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
 409 +obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 410 +obj-$(CONFIG_BRIDGE_EBT_DNAT) += ebt_dnat.o
 411 +obj-$(CONFIG_BRIDGE_EBT_REDIRECT) += ebt_redirect.o
 412 +obj-$(CONFIG_BRIDGE_EBT_MARK_T) += ebt_mark.o
 413 +include $(TOPDIR)/Rules.make
 414 --- /dev/null   Thu Aug 24 11:00:32 2000
 415 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/Config.in      Fri Aug  8 01:09:06 2003
 416 @@ -0,0 +1,19 @@
 417 +#
 418 +# Bridge netfilter configuration
 419 +#
 420 +dep_tristate '  Bridge: ebtables' CONFIG_BRIDGE_NF_EBTABLES $CONFIG_BRIDGE
 421 +dep_tristate '    ebt: filter table support' CONFIG_BRIDGE_EBT_T_FILTER $CONFIG_BRIDGE_NF_EBTABLES
 422 +dep_tristate '    ebt: nat table support' CONFIG_BRIDGE_EBT_T_NAT $CONFIG_BRIDGE_NF_EBTABLES
 423 +dep_tristate '    ebt: broute table support' CONFIG_BRIDGE_EBT_BROUTE $CONFIG_BRIDGE_NF_EBTABLES
 424 +dep_tristate '    ebt: log support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
 425 +dep_tristate '    ebt: IP filter support' CONFIG_BRIDGE_EBT_IPF $CONFIG_BRIDGE_NF_EBTABLES
 426 +dep_tristate '    ebt: ARP filter support' CONFIG_BRIDGE_EBT_ARPF $CONFIG_BRIDGE_NF_EBTABLES
 427 +dep_tristate '    ebt: 802.1Q VLAN filter support' CONFIG_BRIDGE_EBT_VLANF $CONFIG_BRIDGE_NF_EBTABLES
 428 +dep_tristate '    ebt: 802.3 filter support' CONFIG_BRIDGE_EBT_802_3 $CONFIG_BRIDGE_NF_EBTABLES
 429 +dep_tristate '    ebt: packet type filter support' CONFIG_BRIDGE_EBT_PKTTYPE $CONFIG_BRIDGE_NF_EBTABLES
 430 +dep_tristate '    ebt: STP filter support' CONFIG_BRIDGE_EBT_STP $CONFIG_BRIDGE_NF_EBTABLES
 431 +dep_tristate '    ebt: mark filter support' CONFIG_BRIDGE_EBT_MARKF $CONFIG_BRIDGE_NF_EBTABLES
 432 +dep_tristate '    ebt: snat target support' CONFIG_BRIDGE_EBT_SNAT $CONFIG_BRIDGE_NF_EBTABLES
 433 +dep_tristate '    ebt: dnat target support' CONFIG_BRIDGE_EBT_DNAT $CONFIG_BRIDGE_NF_EBTABLES
 434 +dep_tristate '    ebt: redirect target support' CONFIG_BRIDGE_EBT_REDIRECT $CONFIG_BRIDGE_NF_EBTABLES
 435 +dep_tristate '    ebt: mark target support' CONFIG_BRIDGE_EBT_MARK_T $CONFIG_BRIDGE_NF_EBTABLES
 436 --- /dev/null   Thu Aug 24 11:00:32 2000
 437 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtable_filter.c       Fri Aug  8 01:09:06 2003
 438 @@ -0,0 +1,90 @@
 439 +/*
 440 + *  ebtable_filter
 441 + *
 442 + *     Authors:
 443 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 444 + *
 445 + *  April, 2002
 446 + *
 447 + */
 448 +
 449 +#include <linux/netfilter_bridge/ebtables.h>
 450 +#include <linux/module.h>
 451 +
 452 +#define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
 453 +   (1 << NF_BR_LOCAL_OUT))
 454 +
 455 +static struct ebt_entries initial_chains[] =
 456 +{
 457 +  {0, "INPUT", 0, EBT_ACCEPT, 0},
 458 +  {0, "FORWARD", 0, EBT_ACCEPT, 0},
 459 +  {0, "OUTPUT", 0, EBT_ACCEPT, 0}
 460 +};
 461 +
 462 +static struct ebt_replace initial_table =
 463 +{
 464 +  "filter", FILTER_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
 465 +  { [NF_BR_LOCAL_IN]&initial_chains[0], [NF_BR_FORWARD]&initial_chains[1],
 466 +    [NF_BR_LOCAL_OUT]&initial_chains[2] }, 0, NULL, (char *)initial_chains
 467 +};
 468 +
 469 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 470 +{
 471 +       if (valid_hooks & ~FILTER_VALID_HOOKS)
 472 +               return -EINVAL;
 473 +       return 0;
 474 +}
 475 +
 476 +static struct ebt_table frame_filter =
 477 +{
 478 +  {NULL, NULL}, "filter", &initial_table, FILTER_VALID_HOOKS,
 479 +  RW_LOCK_UNLOCKED, check, NULL
 480 +};
 481 +
 482 +static unsigned int
 483 +ebt_hook (unsigned int hook, struct sk_buff **pskb, const struct net_device *in,
 484 +   const struct net_device *out, int (*okfn)(struct sk_buff *))
 485 +{
 486 +       return ebt_do_table(hook, pskb, in, out, &frame_filter);
 487 +}
 488 +
 489 +static struct nf_hook_ops ebt_ops_filter[] = {
 490 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_IN,
 491 +          NF_BR_PRI_FILTER_BRIDGED},
 492 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_FORWARD,
 493 +          NF_BR_PRI_FILTER_BRIDGED},
 494 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_OUT,
 495 +          NF_BR_PRI_FILTER_OTHER}
 496 +};
 497 +
 498 +static int __init init(void)
 499 +{
 500 +       int i, j, ret;
 501 +
 502 +       ret = ebt_register_table(&frame_filter);
 503 +       if (ret < 0)
 504 +               return ret;
 505 +       for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
 506 +               if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
 507 +                       goto cleanup;
 508 +       return ret;
 509 +cleanup:
 510 +       for (j = 0; j < i; j++)
 511 +               nf_unregister_hook(&ebt_ops_filter[j]);
 512 +       ebt_unregister_table(&frame_filter);
 513 +       return ret;
 514 +}
 515 +
 516 +static void __exit fini(void)
 517 +{
 518 +       int i;
 519 +
 520 +       for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
 521 +               nf_unregister_hook(&ebt_ops_filter[i]);
 522 +       ebt_unregister_table(&frame_filter);
 523 +}
 524 +
 525 +module_init(init);
 526 +module_exit(fini);
 527 +EXPORT_NO_SYMBOLS;
 528 +MODULE_LICENSE("GPL");
 529 --- /dev/null   Thu Aug 24 11:00:32 2000
 530 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtable_nat.c  Fri Aug  8 01:09:06 2003
 531 @@ -0,0 +1,96 @@
 532 +/*
 533 + *  ebtable_nat
 534 + *
 535 + *     Authors:
 536 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 537 + *
 538 + *  April, 2002
 539 + *
 540 + */
 541 +
 542 +#include <linux/netfilter_bridge/ebtables.h>
 543 +#include <linux/module.h>
 544 +#define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
 545 +   (1 << NF_BR_POST_ROUTING))
 546 +
 547 +static struct ebt_entries initial_chains[] =
 548 +{
 549 +  {0, "PREROUTING", 0, EBT_ACCEPT, 0},
 550 +  {0, "OUTPUT", 0, EBT_ACCEPT, 0},
 551 +  {0, "POSTROUTING", 0, EBT_ACCEPT, 0}
 552 +};
 553 +
 554 +static struct ebt_replace initial_table =
 555 +{
 556 +  "nat", NAT_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
 557 +  { [NF_BR_PRE_ROUTING]&initial_chains[0], [NF_BR_LOCAL_OUT]&initial_chains[1],
 558 +    [NF_BR_POST_ROUTING]&initial_chains[2] }, 0, NULL, (char *)initial_chains
 559 +};
 560 +
 561 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 562 +{
 563 +       if (valid_hooks & ~NAT_VALID_HOOKS)
 564 +               return -EINVAL;
 565 +       return 0;
 566 +}
 567 +
 568 +static struct ebt_table frame_nat =
 569 +{
 570 +  {NULL, NULL}, "nat", &initial_table, NAT_VALID_HOOKS,
 571 +  RW_LOCK_UNLOCKED, check, NULL
 572 +};
 573 +
 574 +static unsigned int
 575 +ebt_nat_dst(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
 576 +   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 577 +{
 578 +       return ebt_do_table(hook, pskb, in, out, &frame_nat);
 579 +}
 580 +
 581 +static unsigned int
 582 +ebt_nat_src(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
 583 +   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 584 +{
 585 +       return ebt_do_table(hook, pskb, in, out, &frame_nat);
 586 +}
 587 +
 588 +static struct nf_hook_ops ebt_ops_nat[] = {
 589 +       { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_LOCAL_OUT,
 590 +          NF_BR_PRI_NAT_DST_OTHER},
 591 +       { { NULL, NULL }, ebt_nat_src, PF_BRIDGE, NF_BR_POST_ROUTING,
 592 +          NF_BR_PRI_NAT_SRC},
 593 +       { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_PRE_ROUTING,
 594 +          NF_BR_PRI_NAT_DST_BRIDGED},
 595 +};
 596 +
 597 +static int __init init(void)
 598 +{
 599 +       int i, ret, j;
 600 +
 601 +       ret = ebt_register_table(&frame_nat);
 602 +       if (ret < 0)
 603 +               return ret;
 604 +       for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
 605 +               if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
 606 +                       goto cleanup;
 607 +       return ret;
 608 +cleanup:
 609 +       for (j = 0; j < i; j++)
 610 +               nf_unregister_hook(&ebt_ops_nat[j]);
 611 +       ebt_unregister_table(&frame_nat);
 612 +       return ret;
 613 +}
 614 +
 615 +static void __exit fini(void)
 616 +{
 617 +       int i;
 618 +
 619 +       for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
 620 +               nf_unregister_hook(&ebt_ops_nat[i]);
 621 +       ebt_unregister_table(&frame_nat);
 622 +}
 623 +
 624 +module_init(init);
 625 +module_exit(fini);
 626 +EXPORT_NO_SYMBOLS;
 627 +MODULE_LICENSE("GPL");
 628 --- /dev/null   Thu Aug 24 11:00:32 2000
 629 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtable_broute.c       Fri Aug  8 01:09:06 2003
 630 @@ -0,0 +1,79 @@
 631 +/*
 632 + *  ebtable_broute
 633 + *
 634 + *     Authors:
 635 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 636 + *
 637 + *  April, 2002
 638 + *
 639 + *  This table lets you choose between routing and bridging for frames
 640 + *  entering on a bridge enslaved nic. This table is traversed before any
 641 + *  other ebtables table. See net/bridge/br_input.c.
 642 + */
 643 +
 644 +#include <linux/netfilter_bridge/ebtables.h>
 645 +#include <linux/module.h>
 646 +#include <linux/if_bridge.h>
 647 +#include <linux/brlock.h>
 648 +
 649 +// EBT_ACCEPT means the frame will be bridged
 650 +// EBT_DROP means the frame will be routed
 651 +static struct ebt_entries initial_chain =
 652 +  {0, "BROUTING", 0, EBT_ACCEPT, 0};
 653 +
 654 +static struct ebt_replace initial_table =
 655 +{
 656 +  "broute", 1 << NF_BR_BROUTING, 0, sizeof(struct ebt_entries),
 657 +  { [NF_BR_BROUTING]&initial_chain}, 0, NULL, (char *)&initial_chain
 658 +};
 659 +
 660 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 661 +{
 662 +       if (valid_hooks & ~(1 << NF_BR_BROUTING))
 663 +               return -EINVAL;
 664 +       return 0;
 665 +}
 666 +
 667 +static struct ebt_table broute_table =
 668 +{
 669 +  {NULL, NULL}, "broute", &initial_table, 1 << NF_BR_BROUTING,
 670 +  RW_LOCK_UNLOCKED, check, NULL
 671 +};
 672 +
 673 +static int ebt_broute(struct sk_buff **pskb)
 674 +{
 675 +       int ret;
 676 +
 677 +       ret = ebt_do_table(NF_BR_BROUTING, pskb, (*pskb)->dev, NULL,
 678 +          &broute_table);
 679 +       if (ret == NF_DROP)
 680 +               return 1; // route it
 681 +       return 0; // bridge it
 682 +}
 683 +
 684 +static int __init init(void)
 685 +{
 686 +       int ret;
 687 +
 688 +       ret = ebt_register_table(&broute_table);
 689 +       if (ret < 0)
 690 +               return ret;
 691 +       br_write_lock_bh(BR_NETPROTO_LOCK);
 692 +       // see br_input.c
 693 +       br_should_route_hook = ebt_broute;
 694 +       br_write_unlock_bh(BR_NETPROTO_LOCK);
 695 +       return ret;
 696 +}
 697 +
 698 +static void __exit fini(void)
 699 +{
 700 +       br_write_lock_bh(BR_NETPROTO_LOCK);
 701 +       br_should_route_hook = NULL;
 702 +       br_write_unlock_bh(BR_NETPROTO_LOCK);
 703 +       ebt_unregister_table(&broute_table);
 704 +}
 705 +
 706 +module_init(init);
 707 +module_exit(fini);
 708 +EXPORT_NO_SYMBOLS;
 709 +MODULE_LICENSE("GPL");
 710 --- /dev/null   Thu Aug 24 11:00:32 2000
 711 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_802_3.c    Fri Aug  8 01:09:06 2003
 712 @@ -0,0 +1,74 @@
 713 +/*
 714 + * 802_3
 715 + *
 716 + * Author:
 717 + * Chris Vitale csv@bluetail.com
 718 + *
 719 + * May 2003
 720 + *
 721 + */
 722 +
 723 +#include <linux/netfilter_bridge/ebtables.h>
 724 +#include <linux/netfilter_bridge/ebt_802_3.h>
 725 +#include <linux/module.h>
 726 +
 727 +static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
 728 +   const struct net_device *out, const void *data, unsigned int datalen)
 729 +{
 730 +       struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
 731 +       struct ebt_802_3_hdr *hdr = (struct ebt_802_3_hdr *)skb->mac.ethernet;
 732 +       uint16_t type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
 733 +
 734 +       if (info->bitmask & EBT_802_3_SAP) {
 735 +               if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP))
 736 +                               return EBT_NOMATCH;
 737 +               if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
 738 +                               return EBT_NOMATCH;
 739 +       }
 740 +
 741 +       if (info->bitmask & EBT_802_3_TYPE) {
 742 +               if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
 743 +                       return EBT_NOMATCH;
 744 +               if (FWINV(info->type != type, EBT_802_3_TYPE))
 745 +                       return EBT_NOMATCH;
 746 +       }
 747 +
 748 +       return EBT_MATCH;
 749 +}
 750 +
 751 +static struct ebt_match filter_802_3;
 752 +static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
 753 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 754 +{
 755 +       struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
 756 +
 757 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_802_3_info)))
 758 +               return -EINVAL;
 759 +       if (info->bitmask & ~EBT_802_3_MASK || info->invflags & ~EBT_802_3_MASK)
 760 +               return -EINVAL;
 761 +
 762 +       return 0;
 763 +}
 764 +
 765 +static struct ebt_match filter_802_3 =
 766 +{
 767 +       .name           = EBT_802_3_MATCH,
 768 +       .match          = ebt_filter_802_3,
 769 +       .check          = ebt_802_3_check,
 770 +       .me             = THIS_MODULE,
 771 +};
 772 +
 773 +static int __init init(void)
 774 +{
 775 +       return ebt_register_match(&filter_802_3);
 776 +}
 777 +
 778 +static void __exit fini(void)
 779 +{
 780 +       ebt_unregister_match(&filter_802_3);
 781 +}
 782 +
 783 +module_init(init);
 784 +module_exit(fini);
 785 +EXPORT_NO_SYMBOLS;
 786 +MODULE_LICENSE("GPL");
 787 --- /dev/null   Thu Aug 24 11:00:32 2000
 788 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_mark.c     Fri Aug  8 01:09:06 2003
 789 @@ -0,0 +1,66 @@
 790 +/*
 791 + *  ebt_mark
 792 + *
 793 + *     Authors:
 794 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 795 + *
 796 + *  July, 2002
 797 + *
 798 + */
 799 +
 800 +// The mark target can be used in any chain
 801 +// I believe adding a mangle table just for marking is total overkill
 802 +// Marking a frame doesn't really change anything in the frame anyway
 803 +
 804 +#include <linux/netfilter_bridge/ebtables.h>
 805 +#include <linux/netfilter_bridge/ebt_mark_t.h>
 806 +#include <linux/module.h>
 807 +
 808 +static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
 809 +   const struct net_device *in, const struct net_device *out,
 810 +   const void *data, unsigned int datalen)
 811 +{
 812 +       struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
 813 +
 814 +       if ((*pskb)->nfmark != info->mark) {
 815 +               (*pskb)->nfmark = info->mark;
 816 +               (*pskb)->nfcache |= NFC_ALTERED;
 817 +       }
 818 +       return info->target;
 819 +}
 820 +
 821 +static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
 822 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 823 +{
 824 +       struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
 825 +
 826 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
 827 +               return -EINVAL;
 828 +       if (BASE_CHAIN && info->target == EBT_RETURN)
 829 +               return -EINVAL;
 830 +       CLEAR_BASE_CHAIN_BIT;
 831 +       if (INVALID_TARGET)
 832 +               return -EINVAL;
 833 +       return 0;
 834 +}
 835 +
 836 +static struct ebt_target mark_target =
 837 +{
 838 +       {NULL, NULL}, EBT_MARK_TARGET, ebt_target_mark,
 839 +       ebt_target_mark_check, NULL, THIS_MODULE
 840 +};
 841 +
 842 +static int __init init(void)
 843 +{
 844 +       return ebt_register_target(&mark_target);
 845 +}
 846 +
 847 +static void __exit fini(void)
 848 +{
 849 +       ebt_unregister_target(&mark_target);
 850 +}
 851 +
 852 +module_init(init);
 853 +module_exit(fini);
 854 +EXPORT_NO_SYMBOLS;
 855 +MODULE_LICENSE("GPL");
 856 --- /dev/null   Thu Aug 24 11:00:32 2000
 857 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_mark_m.c   Fri Aug  8 01:09:06 2003
 858 @@ -0,0 +1,61 @@
 859 +/*
 860 + *  ebt_mark_m
 861 + *
 862 + *     Authors:
 863 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 864 + *
 865 + *  July, 2002
 866 + *
 867 + */
 868 +
 869 +#include <linux/netfilter_bridge/ebtables.h>
 870 +#include <linux/netfilter_bridge/ebt_mark_m.h>
 871 +#include <linux/module.h>
 872 +
 873 +static int ebt_filter_mark(const struct sk_buff *skb,
 874 +   const struct net_device *in, const struct net_device *out, const void *data,
 875 +   unsigned int datalen)
 876 +{
 877 +       struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
 878 +
 879 +       if (info->bitmask & EBT_MARK_OR)
 880 +               return !(!!(skb->nfmark & info->mask) ^ info->invert);
 881 +       return !(((skb->nfmark & info->mask) == info->mark) ^ info->invert);
 882 +}
 883 +
 884 +static int ebt_mark_check(const char *tablename, unsigned int hookmask,
 885 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 886 +{
 887 +        struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
 888 +
 889 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
 890 +               return -EINVAL;
 891 +       if (info->bitmask & ~EBT_MARK_MASK)
 892 +               return -EINVAL;
 893 +       if ((info->bitmask & EBT_MARK_OR) && (info->bitmask & EBT_MARK_AND))
 894 +               return -EINVAL;
 895 +       if (!info->bitmask)
 896 +               return -EINVAL;
 897 +       return 0;
 898 +}
 899 +
 900 +static struct ebt_match filter_mark =
 901 +{
 902 +       {NULL, NULL}, EBT_MARK_MATCH, ebt_filter_mark, ebt_mark_check, NULL,
 903 +       THIS_MODULE
 904 +};
 905 +
 906 +static int __init init(void)
 907 +{
 908 +       return ebt_register_match(&filter_mark);
 909 +}
 910 +
 911 +static void __exit fini(void)
 912 +{
 913 +       ebt_unregister_match(&filter_mark);
 914 +}
 915 +
 916 +module_init(init);
 917 +module_exit(fini);
 918 +EXPORT_NO_SYMBOLS;
 919 +MODULE_LICENSE("GPL");
 920 --- /dev/null   Thu Aug 24 11:00:32 2000
 921 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_pkttype.c  Fri Aug  8 01:09:06 2003
 922 @@ -0,0 +1,60 @@
 923 +/*
 924 + *  ebt_pkttype
 925 + *
 926 + *     Authors:
 927 + *     Bart De Schuymer <bdschuym@pandora.be>
 928 + *
 929 + *  April, 2003
 930 + *
 931 + */
 932 +
 933 +#include <linux/netfilter_bridge/ebtables.h>
 934 +#include <linux/netfilter_bridge/ebt_pkttype.h>
 935 +#include <linux/module.h>
 936 +
 937 +static int ebt_filter_pkttype(const struct sk_buff *skb,
 938 +   const struct net_device *in,
 939 +   const struct net_device *out,
 940 +   const void *data,
 941 +   unsigned int datalen)
 942 +{
 943 +       struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
 944 +
 945 +       return (skb->pkt_type != info->pkt_type) ^ info->invert;
 946 +}
 947 +
 948 +static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
 949 +   const struct ebt_entry *e, void *data, unsigned int datalen)
 950 +{
 951 +       struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
 952 +
 953 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
 954 +               return -EINVAL;
 955 +       if (info->invert != 0 && info->invert != 1)
 956 +               return -EINVAL;
 957 +       /* Allow any pkt_type value */
 958 +       return 0;
 959 +}
 960 +
 961 +static struct ebt_match filter_pkttype =
 962 +{
 963 +       .name           = EBT_PKTTYPE_MATCH,
 964 +       .match          = ebt_filter_pkttype,
 965 +       .check          = ebt_pkttype_check,
 966 +       .me             = THIS_MODULE,
 967 +};
 968 +
 969 +static int __init init(void)
 970 +{
 971 +       return ebt_register_match(&filter_pkttype);
 972 +}
 973 +
 974 +static void __exit fini(void)
 975 +{
 976 +       ebt_unregister_match(&filter_pkttype);
 977 +}
 978 +
 979 +module_init(init);
 980 +module_exit(fini);
 981 +EXPORT_NO_SYMBOLS;
 982 +MODULE_LICENSE("GPL");
 983 --- /dev/null   Thu Aug 24 11:00:32 2000
 984 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_stp.c      Fri Aug  8 01:09:06 2003
 985 @@ -0,0 +1,191 @@
 986 +/*
 987 + *  ebt_stp
 988 + *
 989 + *     Authors:
 990 + *     Bart De Schuymer <bdschuym@pandora.be>
 991 + *     Stephen Hemminger <shemminger@osdl.org>
 992 + *
 993 + *  June, 2003
 994 + */
 995 +
 996 +#include <linux/netfilter_bridge/ebtables.h>
 997 +#include <linux/netfilter_bridge/ebt_stp.h>
 998 +#include <linux/module.h>
 999 +
1000 +#define BPDU_TYPE_CONFIG 0
1001 +#define BPDU_TYPE_TCN 0x80
1002 +
1003 +struct stp_header {
1004 +       uint8_t dsap;
1005 +       uint8_t ssap;
1006 +       uint8_t ctrl;
1007 +       uint8_t pid;
1008 +       uint8_t vers;
1009 +       uint8_t type;
1010 +};
1011 +
1012 +struct stp_config_pdu {
1013 +       uint8_t flags;
1014 +       uint8_t root[8];
1015 +       uint8_t root_cost[4];
1016 +       uint8_t sender[8];
1017 +       uint8_t port[2];
1018 +       uint8_t msg_age[2];
1019 +       uint8_t max_age[2];
1020 +       uint8_t hello_time[2];
1021 +       uint8_t forward_delay[2];
1022 +};
1023 +
1024 +#define NR16(p) (p[0] << 8 | p[1])
1025 +#define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
1026 +
1027 +static int ebt_filter_config(struct ebt_stp_info *info,
1028 +   struct stp_config_pdu *stpc)
1029 +{
1030 +       struct ebt_stp_config_info *c;
1031 +       uint16_t v16;
1032 +       uint32_t v32;
1033 +       int verdict, i;
1034 +
1035 +       c = &info->config;
1036 +       if ((info->bitmask & EBT_STP_FLAGS) &&
1037 +           FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
1038 +               return EBT_NOMATCH;
1039 +       if (info->bitmask & EBT_STP_ROOTPRIO) {
1040 +               v16 = NR16(stpc->root);
1041 +               if (FWINV(v16 < c->root_priol ||
1042 +                   v16 > c->root_priou, EBT_STP_ROOTPRIO))
1043 +                       return EBT_NOMATCH;
1044 +       }
1045 +       if (info->bitmask & EBT_STP_ROOTADDR) {
1046 +               verdict = 0;
1047 +               for (i = 0; i < 6; i++)
1048 +                       verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
1049 +                                  c->root_addrmsk[i];
1050 +               if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
1051 +                       return EBT_NOMATCH;
1052 +       }
1053 +       if (info->bitmask & EBT_STP_ROOTCOST) {
1054 +               v32 = NR32(stpc->root_cost);
1055 +               if (FWINV(v32 < c->root_costl ||
1056 +                   v32 > c->root_costu, EBT_STP_ROOTCOST))
1057 +                       return EBT_NOMATCH;
1058 +       }
1059 +       if (info->bitmask & EBT_STP_SENDERPRIO) {
1060 +               v16 = NR16(stpc->sender);
1061 +               if (FWINV(v16 < c->sender_priol ||
1062 +                   v16 > c->sender_priou, EBT_STP_SENDERPRIO))
1063 +                       return EBT_NOMATCH;
1064 +       }
1065 +       if (info->bitmask & EBT_STP_SENDERADDR) {
1066 +               verdict = 0;
1067 +               for (i = 0; i < 6; i++)
1068 +                       verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
1069 +                                  c->sender_addrmsk[i];
1070 +               if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
1071 +                       return EBT_NOMATCH;
1072 +       }
1073 +       if (info->bitmask & EBT_STP_PORT) {
1074 +               v16 = NR16(stpc->port);
1075 +               if (FWINV(v16 < c->portl ||
1076 +                   v16 > c->portu, EBT_STP_PORT))
1077 +                       return EBT_NOMATCH;
1078 +       }
1079 +       if (info->bitmask & EBT_STP_MSGAGE) {
1080 +               v16 = NR16(stpc->msg_age);
1081 +               if (FWINV(v16 < c->msg_agel ||
1082 +                   v16 > c->msg_ageu, EBT_STP_MSGAGE))
1083 +                       return EBT_NOMATCH;
1084 +       }
1085 +       if (info->bitmask & EBT_STP_MAXAGE) {
1086 +               v16 = NR16(stpc->max_age);
1087 +               if (FWINV(v16 < c->max_agel ||
1088 +                   v16 > c->max_ageu, EBT_STP_MAXAGE))
1089 +                       return EBT_NOMATCH;
1090 +       }
1091 +       if (info->bitmask & EBT_STP_HELLOTIME) {
1092 +               v16 = NR16(stpc->hello_time);
1093 +               if (FWINV(v16 < c->hello_timel ||
1094 +                   v16 > c->hello_timeu, EBT_STP_HELLOTIME))
1095 +                       return EBT_NOMATCH;
1096 +       }
1097 +       if (info->bitmask & EBT_STP_FWDD) {
1098 +               v16 = NR16(stpc->forward_delay);
1099 +               if (FWINV(v16 < c->forward_delayl ||
1100 +                   v16 > c->forward_delayu, EBT_STP_FWDD))
1101 +                       return EBT_NOMATCH;
1102 +       }
1103 +       return EBT_MATCH;
1104 +}
1105 +
1106 +static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
1107 +   const struct net_device *out, const void *data, unsigned int datalen)
1108 +{
1109 +       struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1110 +       struct stp_header stph;
1111 +       uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
1112 +       if (skb_copy_bits(skb, 0, &stph, sizeof(stph)))
1113 +               return EBT_NOMATCH;
1114 +
1115 +       /* The stp code only considers these */
1116 +       if (memcmp(&stph, header, sizeof(header)))
1117 +               return EBT_NOMATCH;
1118 +
1119 +       if (info->bitmask & EBT_STP_TYPE
1120 +           && FWINV(info->type != stph.type, EBT_STP_TYPE))
1121 +               return EBT_NOMATCH;
1122 +
1123 +       if (stph.type == BPDU_TYPE_CONFIG &&
1124 +           info->bitmask & EBT_STP_CONFIG_MASK) {
1125 +               struct stp_config_pdu stpc;
1126 +
1127 +               if (skb_copy_bits(skb, sizeof(stph), &stpc, sizeof(stpc)))
1128 +                   return EBT_NOMATCH;
1129 +               return ebt_filter_config(info, &stpc);
1130 +       }
1131 +       return EBT_MATCH;
1132 +}
1133 +
1134 +static int ebt_stp_check(const char *tablename, unsigned int hookmask,
1135 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1136 +{
1137 +       struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1138 +       int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
1139 +       uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
1140 +       uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1141 +
1142 +       if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
1143 +           !(info->bitmask & EBT_STP_MASK))
1144 +               return -EINVAL;
1145 +       if (datalen != len)
1146 +               return -EINVAL;
1147 +       /* Make sure the match only receives stp frames */
1148 +       if (memcmp(e->destmac, bridge_ula, ETH_ALEN) ||
1149 +           memcmp(e->destmsk, msk, ETH_ALEN) || !(e->bitmask & EBT_DESTMAC))
1150 +               return -EINVAL;
1151 +
1152 +       return 0;
1153 +}
1154 +
1155 +static struct ebt_match filter_stp =
1156 +{
1157 +       .name           = EBT_STP_MATCH,
1158 +       .match          = ebt_filter_stp,
1159 +       .check          = ebt_stp_check,
1160 +       .me             = THIS_MODULE,
1161 +};
1162 +
1163 +static int __init init(void)
1164 +{
1165 +       return ebt_register_match(&filter_stp);
1166 +}
1167 +
1168 +static void __exit fini(void)
1169 +{
1170 +       ebt_unregister_match(&filter_stp);
1171 +}
1172 +
1173 +module_init(init);
1174 +module_exit(fini);
1175 +EXPORT_NO_SYMBOLS;
1176 +MODULE_LICENSE("GPL");
1177 --- /dev/null   Thu Aug 24 11:00:32 2000
1178 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_redirect.c Fri Aug  8 01:09:06 2003
1179 @@ -0,0 +1,71 @@
1180 +/*
1181 + *  ebt_redirect
1182 + *
1183 + *     Authors:
1184 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1185 + *
1186 + *  April, 2002
1187 + *
1188 + */
1189 +
1190 +#include <linux/netfilter_bridge/ebtables.h>
1191 +#include <linux/netfilter_bridge/ebt_redirect.h>
1192 +#include <linux/module.h>
1193 +#include <net/sock.h>
1194 +#include "../br_private.h"
1195 +
1196 +static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
1197 +   const struct net_device *in, const struct net_device *out,
1198 +   const void *data, unsigned int datalen)
1199 +{
1200 +       struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1201 +
1202 +       if (hooknr != NF_BR_BROUTING)
1203 +               memcpy((**pskb).mac.ethernet->h_dest,
1204 +                  in->br_port->br->dev.dev_addr, ETH_ALEN);
1205 +       else {
1206 +               memcpy((**pskb).mac.ethernet->h_dest,
1207 +                  in->dev_addr, ETH_ALEN);
1208 +               (*pskb)->pkt_type = PACKET_HOST;
1209 +       }
1210 +       return info->target;
1211 +}
1212 +
1213 +static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
1214 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1215 +{
1216 +       struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1217 +
1218 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
1219 +               return -EINVAL;
1220 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1221 +               return -EINVAL;
1222 +       CLEAR_BASE_CHAIN_BIT;
1223 +       if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
1224 +            (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
1225 +               return -EINVAL;
1226 +       if (INVALID_TARGET)
1227 +               return -EINVAL;
1228 +       return 0;
1229 +}
1230 +
1231 +static struct ebt_target redirect_target =
1232 +{
1233 +       {NULL, NULL}, EBT_REDIRECT_TARGET, ebt_target_redirect,
1234 +       ebt_target_redirect_check, NULL, THIS_MODULE
1235 +};
1236 +
1237 +static int __init init(void)
1238 +{
1239 +       return ebt_register_target(&redirect_target);
1240 +}
1241 +
1242 +static void __exit fini(void)
1243 +{
1244 +       ebt_unregister_target(&redirect_target);
1245 +}
1246 +
1247 +module_init(init);
1248 +module_exit(fini);
1249 +EXPORT_NO_SYMBOLS;
1250 +MODULE_LICENSE("GPL");
1251 --- /dev/null   Thu Aug 24 11:00:32 2000
1252 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_arp.c      Fri Aug  8 01:09:06 2003
1253 @@ -0,0 +1,149 @@
1254 +/*
1255 + *  ebt_arp
1256 + *
1257 + *     Authors:
1258 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1259 + *     Tim Gardner <timg@tpi.com>
1260 + *
1261 + *  April, 2002
1262 + *
1263 + */
1264 +
1265 +#include <linux/netfilter_bridge/ebtables.h>
1266 +#include <linux/netfilter_bridge/ebt_arp.h>
1267 +#include <linux/if_arp.h>
1268 +#include <linux/if_ether.h>
1269 +#include <linux/module.h>
1270 +
1271 +static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
1272 +   const struct net_device *out, const void *data, unsigned int datalen)
1273 +{
1274 +       struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1275 +
1276 +       if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
1277 +          ((*skb).nh.arph)->ar_op, EBT_ARP_OPCODE))
1278 +               return EBT_NOMATCH;
1279 +       if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
1280 +          ((*skb).nh.arph)->ar_hrd, EBT_ARP_HTYPE))
1281 +               return EBT_NOMATCH;
1282 +       if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
1283 +          ((*skb).nh.arph)->ar_pro, EBT_ARP_PTYPE))
1284 +               return EBT_NOMATCH;
1285 +
1286 +       if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP))
1287 +       {
1288 +               uint32_t arp_len = sizeof(struct arphdr) +
1289 +                  (2 * (((*skb).nh.arph)->ar_hln)) +
1290 +                  (2 * (((*skb).nh.arph)->ar_pln));
1291 +               uint32_t dst;
1292 +               uint32_t src;
1293 +
1294 +               // Make sure the packet is long enough.
1295 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1296 +                       return EBT_NOMATCH;
1297 +               // IPv4 addresses are always 4 bytes.
1298 +               if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
1299 +                       return EBT_NOMATCH;
1300 +
1301 +               if (info->bitmask & EBT_ARP_SRC_IP) {
1302 +                       memcpy(&src, ((*skb).nh.raw) + sizeof(struct arphdr) +
1303 +                          ((*skb).nh.arph)->ar_hln, sizeof(uint32_t));
1304 +                       if (FWINV(info->saddr != (src & info->smsk),
1305 +                          EBT_ARP_SRC_IP))
1306 +                               return EBT_NOMATCH;
1307 +               }
1308 +
1309 +               if (info->bitmask & EBT_ARP_DST_IP) {
1310 +                       memcpy(&dst, ((*skb).nh.raw)+sizeof(struct arphdr) +
1311 +                          (2*(((*skb).nh.arph)->ar_hln)) +
1312 +                          (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
1313 +                       if (FWINV(info->daddr != (dst & info->dmsk),
1314 +                          EBT_ARP_DST_IP))
1315 +                               return EBT_NOMATCH;
1316 +               }
1317 +       }
1318 +
1319 +       if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC))
1320 +       {
1321 +               uint32_t arp_len = sizeof(struct arphdr) +
1322 +                  (2 * (((*skb).nh.arph)->ar_hln)) +
1323 +                  (2 * (((*skb).nh.arph)->ar_pln));
1324 +               unsigned char dst[ETH_ALEN];
1325 +               unsigned char src[ETH_ALEN];
1326 +
1327 +               // Make sure the packet is long enough.
1328 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1329 +                       return EBT_NOMATCH;
1330 +               // MAC addresses are 6 bytes.
1331 +               if (((*skb).nh.arph)->ar_hln != ETH_ALEN)
1332 +                       return EBT_NOMATCH;
1333 +               if (info->bitmask & EBT_ARP_SRC_MAC) {
1334 +                       uint8_t verdict, i;
1335 +
1336 +                       memcpy(&src, ((*skb).nh.raw) +
1337 +                                       sizeof(struct arphdr),
1338 +                                       ETH_ALEN);
1339 +                       verdict = 0;
1340 +                       for (i = 0; i < 6; i++)
1341 +                               verdict |= (src[i] ^ info->smaddr[i]) &
1342 +                                      info->smmsk[i];
1343 +                       if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
1344 +                               return EBT_NOMATCH;
1345 +               }
1346 +
1347 +               if (info->bitmask & EBT_ARP_DST_MAC) {
1348 +                       uint8_t verdict, i;
1349 +
1350 +                       memcpy(&dst, ((*skb).nh.raw) +
1351 +                                       sizeof(struct arphdr) +
1352 +                                       (((*skb).nh.arph)->ar_hln) +
1353 +                                       (((*skb).nh.arph)->ar_pln),
1354 +                                       ETH_ALEN);
1355 +                       verdict = 0;
1356 +                       for (i = 0; i < 6; i++)
1357 +                               verdict |= (dst[i] ^ info->dmaddr[i]) &
1358 +                                       info->dmmsk[i];
1359 +                       if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
1360 +                               return EBT_NOMATCH;
1361 +               }
1362 +       }
1363 +
1364 +       return EBT_MATCH;
1365 +}
1366 +
1367 +static int ebt_arp_check(const char *tablename, unsigned int hookmask,
1368 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1369 +{
1370 +       struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1371 +
1372 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
1373 +               return -EINVAL;
1374 +       if ((e->ethproto != __constant_htons(ETH_P_ARP) &&
1375 +          e->ethproto != __constant_htons(ETH_P_RARP)) ||
1376 +          e->invflags & EBT_IPROTO)
1377 +               return -EINVAL;
1378 +       if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
1379 +               return -EINVAL;
1380 +       return 0;
1381 +}
1382 +
1383 +static struct ebt_match filter_arp =
1384 +{
1385 +       {NULL, NULL}, EBT_ARP_MATCH, ebt_filter_arp, ebt_arp_check, NULL,
1386 +       THIS_MODULE
1387 +};
1388 +
1389 +static int __init init(void)
1390 +{
1391 +       return ebt_register_match(&filter_arp);
1392 +}
1393 +
1394 +static void __exit fini(void)
1395 +{
1396 +       ebt_unregister_match(&filter_arp);
1397 +}
1398 +
1399 +module_init(init);
1400 +module_exit(fini);
1401 +EXPORT_NO_SYMBOLS;
1402 +MODULE_LICENSE("GPL");
1403 --- /dev/null   Thu Aug 24 11:00:32 2000
1404 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_ip.c       Fri Aug  8 01:09:06 2003
1405 @@ -0,0 +1,121 @@
1406 +/*
1407 + *  ebt_ip
1408 + *
1409 + *     Authors:
1410 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1411 + *
1412 + *  April, 2002
1413 + *
1414 + *  Changes:
1415 + *    added ip-sport and ip-dport
1416 + *    Innominate Security Technologies AG <mhopf@innominate.com>
1417 + *    September, 2002
1418 + */
1419 +
1420 +#include <linux/netfilter_bridge/ebtables.h>
1421 +#include <linux/netfilter_bridge/ebt_ip.h>
1422 +#include <linux/ip.h>
1423 +#include <linux/in.h>
1424 +#include <linux/module.h>
1425 +
1426 +struct tcpudphdr {
1427 +       uint16_t src;
1428 +       uint16_t dst;
1429 +};
1430 +
1431 +union h_u {
1432 +       unsigned char *raw;
1433 +       struct tcpudphdr *tuh;
1434 +};
1435 +
1436 +static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
1437 +   const struct net_device *out, const void *data,
1438 +   unsigned int datalen)
1439 +{
1440 +       struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1441 +
1442 +       if (info->bitmask & EBT_IP_TOS &&
1443 +          FWINV(info->tos != ((*skb).nh.iph)->tos, EBT_IP_TOS))
1444 +               return EBT_NOMATCH;
1445 +       if (info->bitmask & EBT_IP_PROTO) {
1446 +               if (FWINV(info->protocol != ((*skb).nh.iph)->protocol,
1447 +                         EBT_IP_PROTO))
1448 +                       return EBT_NOMATCH;
1449 +               if ( info->protocol == IPPROTO_TCP ||
1450 +                    info->protocol == IPPROTO_UDP )
1451 +               {
1452 +                       union h_u h;
1453 +                       h.raw = skb->data + skb->nh.iph->ihl*4;
1454 +                       if (info->bitmask & EBT_IP_DPORT) {
1455 +                               uint16_t port = ntohs(h.tuh->dst);
1456 +                               if (FWINV(port < info->dport[0] ||
1457 +                                         port > info->dport[1],
1458 +                                         EBT_IP_DPORT))
1459 +                               return EBT_NOMATCH;
1460 +                       }
1461 +                       if (info->bitmask & EBT_IP_SPORT) {
1462 +                               uint16_t port = ntohs(h.tuh->src);
1463 +                               if (FWINV(port < info->sport[0] ||
1464 +                                         port > info->sport[1],
1465 +                                         EBT_IP_SPORT))
1466 +                               return EBT_NOMATCH;
1467 +                       }
1468 +               }
1469 +       }
1470 +       if (info->bitmask & EBT_IP_SOURCE &&
1471 +          FWINV((((*skb).nh.iph)->saddr & info->smsk) !=
1472 +          info->saddr, EBT_IP_SOURCE))
1473 +               return EBT_NOMATCH;
1474 +       if ((info->bitmask & EBT_IP_DEST) &&
1475 +          FWINV((((*skb).nh.iph)->daddr & info->dmsk) !=
1476 +          info->daddr, EBT_IP_DEST))
1477 +               return EBT_NOMATCH;
1478 +       return EBT_MATCH;
1479 +}
1480 +
1481 +static int ebt_ip_check(const char *tablename, unsigned int hookmask,
1482 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1483 +{
1484 +       struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1485 +
1486 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
1487 +               return -EINVAL;
1488 +       if (e->ethproto != __constant_htons(ETH_P_IP) ||
1489 +          e->invflags & EBT_IPROTO)
1490 +               return -EINVAL;
1491 +       if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
1492 +               return -EINVAL;
1493 +       if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
1494 +               if (!info->bitmask & EBT_IPROTO)
1495 +                       return -EINVAL;
1496 +               if (info->protocol != IPPROTO_TCP &&
1497 +                   info->protocol != IPPROTO_UDP)
1498 +                        return -EINVAL;
1499 +       }
1500 +       if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
1501 +               return -EINVAL;
1502 +       if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
1503 +               return -EINVAL;
1504 +       return 0;
1505 +}
1506 +
1507 +static struct ebt_match filter_ip =
1508 +{
1509 +       {NULL, NULL}, EBT_IP_MATCH, ebt_filter_ip, ebt_ip_check, NULL,
1510 +       THIS_MODULE
1511 +};
1512 +
1513 +static int __init init(void)
1514 +{
1515 +       return ebt_register_match(&filter_ip);
1516 +}
1517 +
1518 +static void __exit fini(void)
1519 +{
1520 +       ebt_unregister_match(&filter_ip);
1521 +}
1522 +
1523 +module_init(init);
1524 +module_exit(fini);
1525 +EXPORT_NO_SYMBOLS;
1526 +MODULE_LICENSE("GPL");
1527 --- /dev/null   Thu Aug 24 11:00:32 2000
1528 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_vlan.c     Fri Aug  8 01:09:06 2003
1529 @@ -0,0 +1,259 @@
1530 +/*
1531 + * Description: EBTables 802.1Q match extension kernelspace module.
1532 + * Authors: Nick Fedchik <nick@fedchik.org.ua>
1533 + *          Bart De Schuymer <bart.de.schuymer@pandora.be>
1534 + *
1535 + * This program is free software; you can redistribute it and/or modify
1536 + * it under the terms of the GNU General Public License as published by
1537 + * the Free Software Foundation; either version 2 of the License, or
1538 + * (at your option) any later version.
1539 + *
1540 + * This program is distributed in the hope that it will be useful,
1541 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
1542 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
1543 + * GNU General Public License for more details.
1544 + *
1545 + * You should have received a copy of the GNU General Public License
1546 + * along with this program; if not, write to the Free Software
1547 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
1548 + */
1549 +
1550 +#include <linux/if_ether.h>
1551 +#include <linux/if_vlan.h>
1552 +#include <linux/module.h>
1553 +#include <linux/netfilter_bridge/ebtables.h>
1554 +#include <linux/netfilter_bridge/ebt_vlan.h>
1555 +
1556 +static unsigned char debug;
1557 +#define MODULE_VERSION "0.6"
1558 +
1559 +MODULE_PARM(debug, "0-1b");
1560 +MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
1561 +MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
1562 +MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
1563 +                  MODULE_VERSION);
1564 +MODULE_LICENSE("GPL");
1565 +
1566 +
1567 +#define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
1568 +#define INV_FLAG(_inv_flag_) (info->invflags & _inv_flag_) ? "!" : ""
1569 +#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
1570 +#define SET_BITMASK(_BIT_MASK_) info->bitmask |= _BIT_MASK_
1571 +#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return 1;
1572 +
1573 +/*
1574 + * Function description: ebt_filter_vlan() is main engine for
1575 + * checking passed 802.1Q frame according to
1576 + * the passed extension parameters (in the *data buffer)
1577 + * ebt_filter_vlan() is called after successfull check the rule params
1578 + * by ebt_check_vlan() function.
1579 + * Parameters:
1580 + * const struct sk_buff *skb - pointer to passed ethernet frame buffer
1581 + * const void *data - pointer to passed extension parameters
1582 + * unsigned int datalen - length of passed *data buffer
1583 + * const struct net_device *in  -
1584 + * const struct net_device *out -
1585 + * const struct ebt_counter *c -
1586 + * Returned values:
1587 + * 0 - ok (all rule params matched)
1588 + * 1 - miss (rule params not acceptable to the parsed frame)
1589 + */
1590 +static int
1591 +ebt_filter_vlan(const struct sk_buff *skb,
1592 +               const struct net_device *in,
1593 +               const struct net_device *out,
1594 +               const void *data, unsigned int datalen)
1595 +{
1596 +       struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;     /* userspace data */
1597 +       struct vlan_ethhdr *frame = (struct vlan_ethhdr *) skb->mac.raw;        /* Passed tagged frame */
1598 +
1599 +       unsigned short TCI;     /* Whole TCI, given from parsed frame */
1600 +       unsigned short id;      /* VLAN ID, given from frame TCI */
1601 +       unsigned char prio;     /* user_priority, given from frame TCI */
1602 +       unsigned short encap;   /* VLAN encapsulated Type/Length field, given from orig frame */
1603 +
1604 +       /*
1605 +        * Tag Control Information (TCI) consists of the following elements:
1606 +        * - User_priority. The user_priority field is three bits in length,
1607 +        * interpreted as a binary number.
1608 +        * - Canonical Format Indicator (CFI). The Canonical Format Indicator
1609 +        * (CFI) is a single bit flag value. Currently ignored.
1610 +        * - VLAN Identifier (VID). The VID is encoded as
1611 +        * an unsigned binary number.
1612 +        */
1613 +       TCI = ntohs(frame->h_vlan_TCI);
1614 +       id = TCI & VLAN_VID_MASK;
1615 +       prio = (TCI >> 13) & 0x7;
1616 +       encap = frame->h_vlan_encapsulated_proto;
1617 +
1618 +       /*
1619 +        * Checking VLAN Identifier (VID)
1620 +        */
1621 +       if (GET_BITMASK(EBT_VLAN_ID)) { /* Is VLAN ID parsed? */
1622 +               EXIT_ON_MISMATCH(id, EBT_VLAN_ID);
1623 +       }
1624 +       /*
1625 +        * Checking user_priority
1626 +        */
1627 +       if (GET_BITMASK(EBT_VLAN_PRIO)) {       /* Is VLAN user_priority parsed? */
1628 +               EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO);
1629 +       }
1630 +       /*
1631 +        * Checking Encapsulated Proto (Length/Type) field
1632 +        */
1633 +       if (GET_BITMASK(EBT_VLAN_ENCAP)) {      /* Is VLAN Encap parsed? */
1634 +               EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
1635 +       }
1636 +       /*
1637 +        * All possible extension parameters was parsed.
1638 +        * If rule never returned by missmatch, then all ok.
1639 +        */
1640 +       return 0;
1641 +}
1642 +
1643 +/*
1644 + * Function description: ebt_vlan_check() is called when userspace
1645 + * delivers the table entry to the kernel,
1646 + * and to check that userspace doesn't give a bad table.
1647 + * Parameters:
1648 + * const char *tablename - table name string
1649 + * unsigned int hooknr - hook number
1650 + * const struct ebt_entry *e - ebtables entry basic set
1651 + * const void *data - pointer to passed extension parameters
1652 + * unsigned int datalen - length of passed *data buffer
1653 + * Returned values:
1654 + * 0 - ok (all delivered rule params are correct)
1655 + * 1 - miss (rule params is out of range, invalid, incompatible, etc.)
1656 + */
1657 +static int
1658 +ebt_check_vlan(const char *tablename,
1659 +              unsigned int hooknr,
1660 +              const struct ebt_entry *e, void *data, unsigned int datalen)
1661 +{
1662 +       struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
1663 +
1664 +       /*
1665 +        * Parameters buffer overflow check
1666 +        */
1667 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
1668 +               DEBUG_MSG
1669 +                   ("passed size %d is not eq to ebt_vlan_info (%d)\n",
1670 +                    datalen, sizeof(struct ebt_vlan_info));
1671 +               return -EINVAL;
1672 +       }
1673 +
1674 +       /*
1675 +        * Is it 802.1Q frame checked?
1676 +        */
1677 +       if (e->ethproto != __constant_htons(ETH_P_8021Q)) {
1678 +               DEBUG_MSG
1679 +                   ("passed entry proto %2.4X is not 802.1Q (8100)\n",
1680 +                    (unsigned short) ntohs(e->ethproto));
1681 +               return -EINVAL;
1682 +       }
1683 +
1684 +       /*
1685 +        * Check for bitmask range
1686 +        * True if even one bit is out of mask
1687 +        */
1688 +       if (info->bitmask & ~EBT_VLAN_MASK) {
1689 +               DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
1690 +                         info->bitmask, EBT_VLAN_MASK);
1691 +               return -EINVAL;
1692 +       }
1693 +
1694 +       /*
1695 +        * Check for inversion flags range
1696 +        */
1697 +       if (info->invflags & ~EBT_VLAN_MASK) {
1698 +               DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
1699 +                         info->invflags, EBT_VLAN_MASK);
1700 +               return -EINVAL;
1701 +       }
1702 +
1703 +       /*
1704 +        * Reserved VLAN ID (VID) values
1705 +        * -----------------------------
1706 +        * 0 - The null VLAN ID.
1707 +        * 1 - The default Port VID (PVID)
1708 +        * 0x0FFF - Reserved for implementation use.
1709 +        * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096.
1710 +        */
1711 +       if (GET_BITMASK(EBT_VLAN_ID)) { /* when vlan-id param was spec-ed */
1712 +               if (!!info->id) {       /* if id!=0 => check vid range */
1713 +                       if (info->id > VLAN_GROUP_ARRAY_LEN) {
1714 +                               DEBUG_MSG
1715 +                                   ("id %d is out of range (1-4096)\n",
1716 +                                    info->id);
1717 +                               return -EINVAL;
1718 +                       }
1719 +                       /*
1720 +                        * Note: This is valid VLAN-tagged frame point.
1721 +                        * Any value of user_priority are acceptable,
1722 +                        * but should be ignored according to 802.1Q Std.
1723 +                        * So we just drop the prio flag.
1724 +                        */
1725 +                       info->bitmask &= ~EBT_VLAN_PRIO;
1726 +               }
1727 +               /*
1728 +                * Else, id=0 (null VLAN ID)  => user_priority range (any?)
1729 +                */
1730 +       }
1731 +
1732 +       if (GET_BITMASK(EBT_VLAN_PRIO)) {
1733 +               if ((unsigned char) info->prio > 7) {
1734 +                       DEBUG_MSG
1735 +                           ("prio %d is out of range (0-7)\n",
1736 +                            info->prio);
1737 +                       return -EINVAL;
1738 +               }
1739 +       }
1740 +       /*
1741 +        * Check for encapsulated proto range - it is possible to be
1742 +        * any value for u_short range.
1743 +        * if_ether.h:  ETH_ZLEN        60   -  Min. octets in frame sans FCS
1744 +        */
1745 +       if (GET_BITMASK(EBT_VLAN_ENCAP)) {
1746 +               if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) {
1747 +                       DEBUG_MSG
1748 +                           ("encap frame length %d is less than minimal\n",
1749 +                            ntohs(info->encap));
1750 +                       return -EINVAL;
1751 +               }
1752 +       }
1753 +
1754 +       return 0;
1755 +}
1756 +
1757 +static struct ebt_match filter_vlan = {
1758 +       {NULL, NULL},
1759 +       EBT_VLAN_MATCH,
1760 +       ebt_filter_vlan,
1761 +       ebt_check_vlan,
1762 +       NULL,
1763 +       THIS_MODULE
1764 +};
1765 +
1766 +/*
1767 + * Module initialization function.
1768 + */
1769 +static int __init init(void)
1770 +{
1771 +       DEBUG_MSG("ebtables 802.1Q extension module v"
1772 +                 MODULE_VERSION "\n");
1773 +       DEBUG_MSG("module debug=%d\n", !!debug);
1774 +       return ebt_register_match(&filter_vlan);
1775 +}
1776 +
1777 +/*
1778 + * Module "finalization" function
1779 + */
1780 +static void __exit fini(void)
1781 +{
1782 +       ebt_unregister_match(&filter_vlan);
1783 +}
1784 +
1785 +module_init(init);
1786 +module_exit(fini);
1787 +
1788 +EXPORT_NO_SYMBOLS;
1789 --- /dev/null   Thu Aug 24 11:00:32 2000
1790 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_log.c      Fri Aug  8 01:09:06 2003
1791 @@ -0,0 +1,152 @@
1792 +/*
1793 + *  ebt_log
1794 + *
1795 + *     Authors:
1796 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1797 + *
1798 + *  April, 2002
1799 + *
1800 + */
1801 +
1802 +#include <linux/netfilter_bridge/ebtables.h>
1803 +#include <linux/netfilter_bridge/ebt_log.h>
1804 +#include <linux/module.h>
1805 +#include <linux/ip.h>
1806 +#include <linux/in.h>
1807 +#include <linux/if_arp.h>
1808 +#include <linux/spinlock.h>
1809 +
1810 +static spinlock_t ebt_log_lock = SPIN_LOCK_UNLOCKED;
1811 +
1812 +static int ebt_log_check(const char *tablename, unsigned int hookmask,
1813 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1814 +{
1815 +       struct ebt_log_info *info = (struct ebt_log_info *)data;
1816 +
1817 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
1818 +               return -EINVAL;
1819 +       if (info->bitmask & ~EBT_LOG_MASK)
1820 +               return -EINVAL;
1821 +       if (info->loglevel >= 8)
1822 +               return -EINVAL;
1823 +       info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
1824 +       return 0;
1825 +}
1826 +
1827 +struct tcpudphdr
1828 +{
1829 +       uint16_t src;
1830 +       uint16_t dst;
1831 +};
1832 +
1833 +struct arppayload
1834 +{
1835 +       unsigned char mac_src[ETH_ALEN];
1836 +       unsigned char ip_src[4];
1837 +       unsigned char mac_dst[ETH_ALEN];
1838 +       unsigned char ip_dst[4];
1839 +};
1840 +
1841 +static void print_MAC(unsigned char *p)
1842 +{
1843 +       int i;
1844 +
1845 +       for (i = 0; i < ETH_ALEN; i++, p++)
1846 +               printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
1847 +}
1848 +
1849 +#define myNIPQUAD(a) a[0], a[1], a[2], a[3]
1850 +static void ebt_log(const struct sk_buff *skb, const struct net_device *in,
1851 +   const struct net_device *out, const void *data, unsigned int datalen)
1852 +{
1853 +       struct ebt_log_info *info = (struct ebt_log_info *)data;
1854 +       char level_string[4] = "< >";
1855 +       level_string[1] = '0' + info->loglevel;
1856 +
1857 +       spin_lock_bh(&ebt_log_lock);
1858 +       printk(level_string);
1859 +       printk("%s IN=%s OUT=%s ", info->prefix, in ? in->name : "",
1860 +          out ? out->name : "");
1861 +
1862 +       printk("MAC source = ");
1863 +       print_MAC((skb->mac.ethernet)->h_source);
1864 +       printk("MAC dest = ");
1865 +       print_MAC((skb->mac.ethernet)->h_dest);
1866 +
1867 +       printk("proto = 0x%04x", ntohs(((*skb).mac.ethernet)->h_proto));
1868 +
1869 +       if ((info->bitmask & EBT_LOG_IP) && skb->mac.ethernet->h_proto ==
1870 +          htons(ETH_P_IP)){
1871 +               struct iphdr *iph = skb->nh.iph;
1872 +               printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
1873 +                  NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
1874 +               printk(" IP tos=0x%02X, IP proto=%d", iph->tos, iph->protocol);
1875 +               if (iph->protocol == IPPROTO_TCP ||
1876 +                   iph->protocol == IPPROTO_UDP) {
1877 +                       struct tcpudphdr *ports = (struct tcpudphdr *)(skb->data + iph->ihl*4);
1878 +
1879 +                       if (skb->data + iph->ihl*4 > skb->tail) {
1880 +                               printk(" INCOMPLETE TCP/UDP header");
1881 +                               goto out;
1882 +                       }
1883 +                       printk(" SPT=%u DPT=%u", ntohs(ports->src),
1884 +                          ntohs(ports->dst));
1885 +               }
1886 +               goto out;
1887 +       }
1888 +
1889 +       if ((info->bitmask & EBT_LOG_ARP) &&
1890 +           ((skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) ||
1891 +           (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_RARP)))) {
1892 +               struct arphdr * arph = skb->nh.arph;
1893 +               printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
1894 +                  ntohs(arph->ar_hrd), ntohs(arph->ar_pro),
1895 +                  ntohs(arph->ar_op));
1896 +               /* If it's for Ethernet and the lengths are OK,
1897 +                * then log the ARP payload */
1898 +               if (arph->ar_hrd == __constant_htons(1) &&
1899 +                   arph->ar_hln == ETH_ALEN &&
1900 +                   arph->ar_pln == sizeof(uint32_t)) {
1901 +                       struct arppayload *arpp = (struct arppayload *)(skb->data + sizeof(*arph));
1902 +
1903 +                       if (skb->data + sizeof(*arph) > skb->tail) {
1904 +                               printk(" INCOMPLETE ARP header");
1905 +                               goto out;
1906 +                       }
1907 +
1908 +                       printk(" ARP MAC SRC=");
1909 +                       print_MAC(arpp->mac_src);
1910 +                       printk(" ARP IP SRC=%u.%u.%u.%u",
1911 +                              myNIPQUAD(arpp->ip_src));
1912 +                       printk(" ARP MAC DST=");
1913 +                       print_MAC(arpp->mac_dst);
1914 +                       printk(" ARP IP DST=%u.%u.%u.%u",
1915 +                              myNIPQUAD(arpp->ip_dst));
1916 +               }
1917 +
1918 +       }
1919 +out:
1920 +       printk("\n");
1921 +       spin_unlock_bh(&ebt_log_lock);
1922 +}
1923 +
1924 +static struct ebt_watcher log =
1925 +{
1926 +       {NULL, NULL}, EBT_LOG_WATCHER, ebt_log, ebt_log_check, NULL,
1927 +       THIS_MODULE
1928 +};
1929 +
1930 +static int __init init(void)
1931 +{
1932 +       return ebt_register_watcher(&log);
1933 +}
1934 +
1935 +static void __exit fini(void)
1936 +{
1937 +       ebt_unregister_watcher(&log);
1938 +}
1939 +
1940 +module_init(init);
1941 +module_exit(fini);
1942 +EXPORT_NO_SYMBOLS;
1943 +MODULE_LICENSE("GPL");
1944 --- /dev/null   Thu Aug 24 11:00:32 2000
1945 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_snat.c     Fri Aug  8 01:09:06 2003
1946 @@ -0,0 +1,64 @@
1947 +/*
1948 + *  ebt_snat
1949 + *
1950 + *     Authors:
1951 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1952 + *
1953 + *  June, 2002
1954 + *
1955 + */
1956 +
1957 +#include <linux/netfilter_bridge/ebtables.h>
1958 +#include <linux/netfilter_bridge/ebt_nat.h>
1959 +#include <linux/module.h>
1960 +
1961 +static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
1962 +   const struct net_device *in, const struct net_device *out,
1963 +   const void *data, unsigned int datalen)
1964 +{
1965 +       struct ebt_nat_info *info = (struct ebt_nat_info *) data;
1966 +
1967 +       memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
1968 +          ETH_ALEN * sizeof(unsigned char));
1969 +       return info->target;
1970 +}
1971 +
1972 +static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
1973 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1974 +{
1975 +       struct ebt_nat_info *info = (struct ebt_nat_info *) data;
1976 +
1977 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
1978 +               return -EINVAL;
1979 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1980 +               return -EINVAL;
1981 +       CLEAR_BASE_CHAIN_BIT;
1982 +       if (strcmp(tablename, "nat"))
1983 +               return -EINVAL;
1984 +       if (hookmask & ~(1 << NF_BR_POST_ROUTING))
1985 +               return -EINVAL;
1986 +       if (INVALID_TARGET)
1987 +               return -EINVAL;
1988 +       return 0;
1989 +}
1990 +
1991 +static struct ebt_target snat =
1992 +{
1993 +       {NULL, NULL}, EBT_SNAT_TARGET, ebt_target_snat, ebt_target_snat_check,
1994 +       NULL, THIS_MODULE
1995 +};
1996 +
1997 +static int __init init(void)
1998 +{
1999 +       return ebt_register_target(&snat);
2000 +}
2001 +
2002 +static void __exit fini(void)
2003 +{
2004 +       ebt_unregister_target(&snat);
2005 +}
2006 +
2007 +module_init(init);
2008 +module_exit(fini);
2009 +EXPORT_NO_SYMBOLS;
2010 +MODULE_LICENSE("GPL");
2011 --- /dev/null   Thu Aug 24 11:00:32 2000
2012 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_dnat.c     Fri Aug  8 01:09:06 2003
2013 @@ -0,0 +1,65 @@
2014 +/*
2015 + *  ebt_dnat
2016 + *
2017 + *     Authors:
2018 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
2019 + *
2020 + *  June, 2002
2021 + *
2022 + */
2023 +
2024 +#include <linux/netfilter_bridge/ebtables.h>
2025 +#include <linux/netfilter_bridge/ebt_nat.h>
2026 +#include <linux/module.h>
2027 +#include <net/sock.h>
2028 +
2029 +static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
2030 +   const struct net_device *in, const struct net_device *out,
2031 +   const void *data, unsigned int datalen)
2032 +{
2033 +       struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2034 +
2035 +       memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
2036 +          ETH_ALEN * sizeof(unsigned char));
2037 +       return info->target;
2038 +}
2039 +
2040 +static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
2041 +   const struct ebt_entry *e, void *data, unsigned int datalen)
2042 +{
2043 +       struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2044 +
2045 +       if (BASE_CHAIN && info->target == EBT_RETURN)
2046 +               return -EINVAL;
2047 +       CLEAR_BASE_CHAIN_BIT;
2048 +       if ( (strcmp(tablename, "nat") ||
2049 +          (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
2050 +          (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
2051 +               return -EINVAL;
2052 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
2053 +               return -EINVAL;
2054 +       if (INVALID_TARGET)
2055 +               return -EINVAL;
2056 +       return 0;
2057 +}
2058 +
2059 +static struct ebt_target dnat =
2060 +{
2061 +       {NULL, NULL}, EBT_DNAT_TARGET, ebt_target_dnat, ebt_target_dnat_check,
2062 +       NULL, THIS_MODULE
2063 +};
2064 +
2065 +static int __init init(void)
2066 +{
2067 +       return ebt_register_target(&dnat);
2068 +}
2069 +
2070 +static void __exit fini(void)
2071 +{
2072 +       ebt_unregister_target(&dnat);
2073 +}
2074 +
2075 +module_init(init);
2076 +module_exit(fini);
2077 +EXPORT_NO_SYMBOLS;
2078 +MODULE_LICENSE("GPL");
2079 --- /dev/null   Thu Aug 24 11:00:32 2000
2080 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtables.c     Fri Aug  8 01:09:06 2003
2081 @@ -0,0 +1,1490 @@
2082 +/*
2083 + *  ebtables
2084 + *
2085 + *  Author:
2086 + *  Bart De Schuymer           <bart.de.schuymer@pandora.be>
2087 + *
2088 + *  ebtables.c,v 2.0, July, 2002
2089 + *
2090 + *  This code is stongly inspired on the iptables code which is
2091 + *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
2092 + *
2093 + *  This program is free software; you can redistribute it and/or
2094 + *  modify it under the terms of the GNU General Public License
2095 + *  as published by the Free Software Foundation; either version
2096 + *  2 of the License, or (at your option) any later version.
2097 + */
2098 +
2099 +// used for print_string
2100 +#include <linux/sched.h>
2101 +#include <linux/tty.h>
2102 +
2103 +#include <linux/kmod.h>
2104 +#include <linux/module.h>
2105 +#include <linux/vmalloc.h>
2106 +#include <linux/netfilter_bridge/ebtables.h>
2107 +#include <linux/spinlock.h>
2108 +#include <asm/uaccess.h>
2109 +#include <linux/smp.h>
2110 +#include <net/sock.h>
2111 +// needed for logical [in,out]-dev filtering
2112 +#include "../br_private.h"
2113 +
2114 +// list_named_find
2115 +#define ASSERT_READ_LOCK(x)
2116 +#define ASSERT_WRITE_LOCK(x)
2117 +#include <linux/netfilter_ipv4/listhelp.h>
2118 +
2119 +#if 0 // use this for remote debugging
2120 +// Copyright (C) 1998 by Ori Pomerantz
2121 +// Print the string to the appropriate tty, the one
2122 +// the current task uses
2123 +static void print_string(char *str)
2124 +{
2125 +       struct tty_struct *my_tty;
2126 +
2127 +       /* The tty for the current task */
2128 +       my_tty = current->tty;
2129 +       if (my_tty != NULL) {
2130 +               (*(my_tty->driver).write)(my_tty, 0, str, strlen(str));
2131 +               (*(my_tty->driver).write)(my_tty, 0, "\015\012", 2);
2132 +       }
2133 +}
2134 +
2135 +#define BUGPRINT(args) print_string(args);
2136 +#else
2137 +#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
2138 +                                         "report to author: "format, ## args)
2139 +// #define BUGPRINT(format, args...)
2140 +#endif
2141 +#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
2142 +                                         ": out of memory: "format, ## args)
2143 +// #define MEMPRINT(format, args...)
2144 +
2145 +
2146 +
2147 +// Each cpu has its own set of counters, so there is no need for write_lock in
2148 +// the softirq
2149 +// For reading or updating the counters, the user context needs to
2150 +// get a write_lock
2151 +
2152 +// The size of each set of counters is altered to get cache alignment
2153 +#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
2154 +#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
2155 +#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
2156 +   COUNTER_OFFSET(n) * cpu))
2157 +
2158 +
2159 +
2160 +static DECLARE_MUTEX(ebt_mutex);
2161 +static LIST_HEAD(ebt_tables);
2162 +static LIST_HEAD(ebt_targets);
2163 +static LIST_HEAD(ebt_matches);
2164 +static LIST_HEAD(ebt_watchers);
2165 +
2166 +static struct ebt_target ebt_standard_target =
2167 +{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
2168 +
2169 +static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
2170 +   const struct sk_buff *skb, const struct net_device *in,
2171 +   const struct net_device *out)
2172 +{
2173 +       w->u.watcher->watcher(skb, in, out, w->data,
2174 +          w->watcher_size);
2175 +       // watchers don't give a verdict
2176 +       return 0;
2177 +}
2178 +
2179 +static inline int ebt_do_match (struct ebt_entry_match *m,
2180 +   const struct sk_buff *skb, const struct net_device *in,
2181 +   const struct net_device *out)
2182 +{
2183 +       return m->u.match->match(skb, in, out, m->data,
2184 +          m->match_size);
2185 +}
2186 +
2187 +static inline int ebt_dev_check(char *entry, const struct net_device *device)
2188 +{
2189 +       if (*entry == '\0')
2190 +               return 0;
2191 +       if (!device)
2192 +               return 1;
2193 +       return !!strcmp(entry, device->name);
2194 +}
2195 +
2196 +#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
2197 +// process standard matches
2198 +static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
2199 +   const struct net_device *in, const struct net_device *out)
2200 +{
2201 +       int verdict, i;
2202 +
2203 +       if (e->bitmask & EBT_802_3) {
2204 +               if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
2205 +                       return 1;
2206 +       } else if (!(e->bitmask & EBT_NOPROTO) &&
2207 +          FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
2208 +               return 1;
2209 +
2210 +       if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
2211 +               return 1;
2212 +       if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
2213 +               return 1;
2214 +       if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
2215 +          e->logical_in, &in->br_port->br->dev), EBT_ILOGICALIN))
2216 +               return 1;
2217 +       if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
2218 +          e->logical_out, &out->br_port->br->dev), EBT_ILOGICALOUT))
2219 +               return 1;
2220 +
2221 +       if (e->bitmask & EBT_SOURCEMAC) {
2222 +               verdict = 0;
2223 +               for (i = 0; i < 6; i++)
2224 +                       verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
2225 +                          e->sourcemsk[i];
2226 +               if (FWINV2(verdict != 0, EBT_ISOURCE) )
2227 +                       return 1;
2228 +       }
2229 +       if (e->bitmask & EBT_DESTMAC) {
2230 +               verdict = 0;
2231 +               for (i = 0; i < 6; i++)
2232 +                       verdict |= (h->h_dest[i] ^ e->destmac[i]) &
2233 +                          e->destmsk[i];
2234 +               if (FWINV2(verdict != 0, EBT_IDEST) )
2235 +                       return 1;
2236 +       }
2237 +       return 0;
2238 +}
2239 +
2240 +// Do some firewalling
2241 +unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
2242 +   const struct net_device *in, const struct net_device *out,
2243 +   struct ebt_table *table)
2244 +{
2245 +       int i, nentries;
2246 +       struct ebt_entry *point;
2247 +       struct ebt_counter *counter_base, *cb_base;
2248 +       struct ebt_entry_target *t;
2249 +       int verdict, sp = 0;
2250 +       struct ebt_chainstack *cs;
2251 +       struct ebt_entries *chaininfo;
2252 +       char *base;
2253 +       struct ebt_table_info *private = table->private;
2254 +
2255 +       read_lock_bh(&table->lock);
2256 +       cb_base = COUNTER_BASE(private->counters, private->nentries,
2257 +          cpu_number_map(smp_processor_id()));
2258 +       if (private->chainstack)
2259 +               cs = private->chainstack[cpu_number_map(smp_processor_id())];
2260 +       else
2261 +               cs = NULL;
2262 +       chaininfo = private->hook_entry[hook];
2263 +       nentries = private->hook_entry[hook]->nentries;
2264 +       point = (struct ebt_entry *)(private->hook_entry[hook]->data);
2265 +       counter_base = cb_base + private->hook_entry[hook]->counter_offset;
2266 +       // base for chain jumps
2267 +       base = private->entries;
2268 +       i = 0;
2269 +       while (i < nentries) {
2270 +               if (ebt_basic_match(point, (**pskb).mac.ethernet, in, out))
2271 +                       goto letscontinue;
2272 +
2273 +               if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
2274 +                       goto letscontinue;
2275 +
2276 +               // increase counter
2277 +               (*(counter_base + i)).pcnt++;
2278 +               (*(counter_base + i)).bcnt+=(**pskb).len;
2279 +
2280 +               // these should only watch: not modify, nor tell us
2281 +               // what to do with the packet
2282 +               EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, in,
2283 +                  out);
2284 +
2285 +               t = (struct ebt_entry_target *)
2286 +                  (((char *)point) + point->target_offset);
2287 +               // standard target
2288 +               if (!t->u.target->target)
2289 +                       verdict = ((struct ebt_standard_target *)t)->verdict;
2290 +               else
2291 +                       verdict = t->u.target->target(pskb, hook,
2292 +                          in, out, t->data, t->target_size);
2293 +               if (verdict == EBT_ACCEPT) {
2294 +                       read_unlock_bh(&table->lock);
2295 +                       return NF_ACCEPT;
2296 +               }
2297 +               if (verdict == EBT_DROP) {
2298 +                       read_unlock_bh(&table->lock);
2299 +                       return NF_DROP;
2300 +               }
2301 +               if (verdict == EBT_RETURN) {
2302 +letsreturn:
2303 +#ifdef CONFIG_NETFILTER_DEBUG
2304 +                       if (sp == 0) {
2305 +                               BUGPRINT("RETURN on base chain");
2306 +                               // act like this is EBT_CONTINUE
2307 +                               goto letscontinue;
2308 +                       }
2309 +#endif
2310 +                       sp--;
2311 +                       // put all the local variables right
2312 +                       i = cs[sp].n;
2313 +                       chaininfo = cs[sp].chaininfo;
2314 +                       nentries = chaininfo->nentries;
2315 +                       point = cs[sp].e;
2316 +                       counter_base = cb_base +
2317 +                          chaininfo->counter_offset;
2318 +                       continue;
2319 +               }
2320 +               if (verdict == EBT_CONTINUE)
2321 +                       goto letscontinue;
2322 +#ifdef CONFIG_NETFILTER_DEBUG
2323 +               if (verdict < 0) {
2324 +                       BUGPRINT("bogus standard verdict\n");
2325 +                       read_unlock_bh(&table->lock);
2326 +                       return NF_DROP;
2327 +               }
2328 +#endif
2329 +               // jump to a udc
2330 +               cs[sp].n = i + 1;
2331 +               cs[sp].chaininfo = chaininfo;
2332 +               cs[sp].e = (struct ebt_entry *)
2333 +                  (((char *)point) + point->next_offset);
2334 +               i = 0;
2335 +               chaininfo = (struct ebt_entries *) (base + verdict);
2336 +#ifdef CONFIG_NETFILTER_DEBUG
2337 +               if (chaininfo->distinguisher) {
2338 +                       BUGPRINT("jump to non-chain\n");
2339 +                       read_unlock_bh(&table->lock);
2340 +                       return NF_DROP;
2341 +               }
2342 +#endif
2343 +               nentries = chaininfo->nentries;
2344 +               point = (struct ebt_entry *)chaininfo->data;
2345 +               counter_base = cb_base + chaininfo->counter_offset;
2346 +               sp++;
2347 +               continue;
2348 +letscontinue:
2349 +               point = (struct ebt_entry *)
2350 +                  (((char *)point) + point->next_offset);
2351 +               i++;
2352 +       }
2353 +
2354 +       // I actually like this :)
2355 +       if (chaininfo->policy == EBT_RETURN)
2356 +               goto letsreturn;
2357 +       if (chaininfo->policy == EBT_ACCEPT) {
2358 +               read_unlock_bh(&table->lock);
2359 +               return NF_ACCEPT;
2360 +       }
2361 +       read_unlock_bh(&table->lock);
2362 +       return NF_DROP;
2363 +}
2364 +
2365 +// If it succeeds, returns element and locks mutex
2366 +static inline void *
2367 +find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
2368 +   struct semaphore *mutex)
2369 +{
2370 +       void *ret;
2371 +
2372 +       *error = down_interruptible(mutex);
2373 +       if (*error != 0)
2374 +               return NULL;
2375 +
2376 +       ret = list_named_find(head, name);
2377 +       if (!ret) {
2378 +               *error = -ENOENT;
2379 +               up(mutex);
2380 +       }
2381 +       return ret;
2382 +}
2383 +
2384 +#ifndef CONFIG_KMOD
2385 +#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
2386 +#else
2387 +static void *
2388 +find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
2389 +   int *error, struct semaphore *mutex)
2390 +{
2391 +       void *ret;
2392 +
2393 +       ret = find_inlist_lock_noload(head, name, error, mutex);
2394 +       if (!ret) {
2395 +               char modulename[EBT_FUNCTION_MAXNAMELEN + strlen(prefix) + 1];
2396 +               strcpy(modulename, prefix);
2397 +               strcat(modulename, name);
2398 +               request_module(modulename);
2399 +               ret = find_inlist_lock_noload(head, name, error, mutex);
2400 +       }
2401 +       return ret;
2402 +}
2403 +#endif
2404 +
2405 +static inline struct ebt_table *
2406 +find_table_lock(const char *name, int *error, struct semaphore *mutex)
2407 +{
2408 +       return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
2409 +}
2410 +
2411 +static inline struct ebt_match *
2412 +find_match_lock(const char *name, int *error, struct semaphore *mutex)
2413 +{
2414 +       return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
2415 +}
2416 +
2417 +static inline struct ebt_watcher *
2418 +find_watcher_lock(const char *name, int *error, struct semaphore *mutex)
2419 +{
2420 +       return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
2421 +}
2422 +
2423 +static inline struct ebt_target *
2424 +find_target_lock(const char *name, int *error, struct semaphore *mutex)
2425 +{
2426 +       return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
2427 +}
2428 +
2429 +static inline int
2430 +ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
2431 +   const char *name, unsigned int hookmask, unsigned int *cnt)
2432 +{
2433 +       struct ebt_match *match;
2434 +       int ret;
2435 +
2436 +       if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
2437 +          ((char *)e) + e->watchers_offset)
2438 +               return -EINVAL;
2439 +       match = find_match_lock(m->u.name, &ret, &ebt_mutex);
2440 +       if (!match)
2441 +               return ret;
2442 +       m->u.match = match;
2443 +       if (match->me)
2444 +               __MOD_INC_USE_COUNT(match->me);
2445 +       up(&ebt_mutex);
2446 +       if (match->check &&
2447 +          match->check(name, hookmask, e, m->data, m->match_size) != 0) {
2448 +               BUGPRINT("match->check failed\n");
2449 +               if (match->me)
2450 +                       __MOD_DEC_USE_COUNT(match->me);
2451 +               return -EINVAL;
2452 +       }
2453 +       (*cnt)++;
2454 +       return 0;
2455 +}
2456 +
2457 +static inline int
2458 +ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
2459 +   const char *name, unsigned int hookmask, unsigned int *cnt)
2460 +{
2461 +       struct ebt_watcher *watcher;
2462 +       int ret;
2463 +
2464 +       if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
2465 +          ((char *)e) + e->target_offset)
2466 +               return -EINVAL;
2467 +       watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
2468 +       if (!watcher)
2469 +               return ret;
2470 +       w->u.watcher = watcher;
2471 +       if (watcher->me)
2472 +               __MOD_INC_USE_COUNT(watcher->me);
2473 +       up(&ebt_mutex);
2474 +       if (watcher->check &&
2475 +          watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
2476 +               BUGPRINT("watcher->check failed\n");
2477 +               if (watcher->me)
2478 +                       __MOD_DEC_USE_COUNT(watcher->me);
2479 +               return -EINVAL;
2480 +       }
2481 +       (*cnt)++;
2482 +       return 0;
2483 +}
2484 +
2485 +// this one is very careful, as it is the first function
2486 +// to parse the userspace data
2487 +static inline int
2488 +ebt_check_entry_size_and_hooks(struct ebt_entry *e,
2489 +   struct ebt_table_info *newinfo, char *base, char *limit,
2490 +   struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
2491 +   unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
2492 +{
2493 +       int i;
2494 +
2495 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2496 +               if ((valid_hooks & (1 << i)) == 0)
2497 +                       continue;
2498 +               if ( (char *)hook_entries[i] - base ==
2499 +                  (char *)e - newinfo->entries)
2500 +                       break;
2501 +       }
2502 +       // beginning of a new chain
2503 +       // if i == NF_BR_NUMHOOKS it must be a user defined chain
2504 +       if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
2505 +               if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
2506 +                       // we make userspace set this right,
2507 +                       // so there is no misunderstanding
2508 +                       BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
2509 +                                "in distinguisher\n");
2510 +                       return -EINVAL;
2511 +               }
2512 +               // this checks if the previous chain has as many entries
2513 +               // as it said it has
2514 +               if (*n != *cnt) {
2515 +                       BUGPRINT("nentries does not equal the nr of entries "
2516 +                                "in the chain\n");
2517 +                       return -EINVAL;
2518 +               }
2519 +               // before we look at the struct, be sure it is not too big
2520 +               if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
2521 +                  > limit) {
2522 +                       BUGPRINT("entries_size too small\n");
2523 +                       return -EINVAL;
2524 +               }
2525 +               if (((struct ebt_entries *)e)->policy != EBT_DROP &&
2526 +                  ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
2527 +                       // only RETURN from udc
2528 +                       if (i != NF_BR_NUMHOOKS ||
2529 +                          ((struct ebt_entries *)e)->policy != EBT_RETURN) {
2530 +                               BUGPRINT("bad policy\n");
2531 +                               return -EINVAL;
2532 +                       }
2533 +               }
2534 +               if (i == NF_BR_NUMHOOKS) // it's a user defined chain
2535 +                       (*udc_cnt)++;
2536 +               else
2537 +                       newinfo->hook_entry[i] = (struct ebt_entries *)e;
2538 +               if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
2539 +                       BUGPRINT("counter_offset != totalcnt");
2540 +                       return -EINVAL;
2541 +               }
2542 +               *n = ((struct ebt_entries *)e)->nentries;
2543 +               *cnt = 0;
2544 +               return 0;
2545 +       }
2546 +       // a plain old entry, heh
2547 +       if (sizeof(struct ebt_entry) > e->watchers_offset ||
2548 +          e->watchers_offset > e->target_offset ||
2549 +          e->target_offset >= e->next_offset) {
2550 +               BUGPRINT("entry offsets not in right order\n");
2551 +               return -EINVAL;
2552 +       }
2553 +       // this is not checked anywhere else
2554 +       if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
2555 +               BUGPRINT("target size too small\n");
2556 +               return -EINVAL;
2557 +       }
2558 +
2559 +       (*cnt)++;
2560 +       (*totalcnt)++;
2561 +       return 0;
2562 +}
2563 +
2564 +struct ebt_cl_stack
2565 +{
2566 +       struct ebt_chainstack cs;
2567 +       int from;
2568 +       unsigned int hookmask;
2569 +};
2570 +
2571 +// we need these positions to check that the jumps to a different part of the
2572 +// entries is a jump to the beginning of a new chain.
2573 +static inline int
2574 +ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
2575 +   struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
2576 +   struct ebt_cl_stack *udc)
2577 +{
2578 +       int i;
2579 +
2580 +       // we're only interested in chain starts
2581 +       if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
2582 +               return 0;
2583 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2584 +               if ((valid_hooks & (1 << i)) == 0)
2585 +                       continue;
2586 +               if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
2587 +                       break;
2588 +       }
2589 +       // only care about udc
2590 +       if (i != NF_BR_NUMHOOKS)
2591 +               return 0;
2592 +
2593 +       udc[*n].cs.chaininfo = (struct ebt_entries *)e;
2594 +       // these initialisations are depended on later in check_chainloops()
2595 +       udc[*n].cs.n = 0;
2596 +       udc[*n].hookmask = 0;
2597 +
2598 +       (*n)++;
2599 +       return 0;
2600 +}
2601 +
2602 +static inline int
2603 +ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
2604 +{
2605 +       if (i && (*i)-- == 0)
2606 +               return 1;
2607 +       if (m->u.match->destroy)
2608 +               m->u.match->destroy(m->data, m->match_size);
2609 +       if (m->u.match->me)
2610 +               __MOD_DEC_USE_COUNT(m->u.match->me);
2611 +
2612 +       return 0;
2613 +}
2614 +
2615 +static inline int
2616 +ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
2617 +{
2618 +       if (i && (*i)-- == 0)
2619 +               return 1;
2620 +       if (w->u.watcher->destroy)
2621 +               w->u.watcher->destroy(w->data, w->watcher_size);
2622 +       if (w->u.watcher->me)
2623 +               __MOD_DEC_USE_COUNT(w->u.watcher->me);
2624 +
2625 +       return 0;
2626 +}
2627 +
2628 +static inline int
2629 +ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
2630 +{
2631 +       struct ebt_entry_target *t;
2632 +
2633 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2634 +               return 0;
2635 +       // we're done
2636 +       if (cnt && (*cnt)-- == 0)
2637 +               return 1;
2638 +       EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
2639 +       EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
2640 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2641 +       if (t->u.target->destroy)
2642 +               t->u.target->destroy(t->data, t->target_size);
2643 +       if (t->u.target->me)
2644 +               __MOD_DEC_USE_COUNT(t->u.target->me);
2645 +
2646 +       return 0;
2647 +}
2648 +
2649 +static inline int
2650 +ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
2651 +   const char *name, unsigned int *cnt, unsigned int valid_hooks,
2652 +   struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
2653 +{
2654 +       struct ebt_entry_target *t;
2655 +       struct ebt_target *target;
2656 +       unsigned int i, j, hook = 0, hookmask = 0;
2657 +       int ret;
2658 +
2659 +       // Don't mess with the struct ebt_entries
2660 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2661 +               return 0;
2662 +
2663 +       if (e->bitmask & ~EBT_F_MASK) {
2664 +               BUGPRINT("Unknown flag for bitmask\n");
2665 +               return -EINVAL;
2666 +       }
2667 +       if (e->invflags & ~EBT_INV_MASK) {
2668 +               BUGPRINT("Unknown flag for inv bitmask\n");
2669 +               return -EINVAL;
2670 +       }
2671 +       if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
2672 +               BUGPRINT("NOPROTO & 802_3 not allowed\n");
2673 +               return -EINVAL;
2674 +       }
2675 +       // what hook do we belong to?
2676 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2677 +               if ((valid_hooks & (1 << i)) == 0)
2678 +                       continue;
2679 +               if ((char *)newinfo->hook_entry[i] < (char *)e)
2680 +                       hook = i;
2681 +               else
2682 +                       break;
2683 +       }
2684 +       // (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
2685 +       // a base chain
2686 +       if (i < NF_BR_NUMHOOKS)
2687 +               hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
2688 +       else {
2689 +               for (i = 0; i < udc_cnt; i++)
2690 +                       if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
2691 +                               break;
2692 +               if (i == 0)
2693 +                       hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
2694 +               else
2695 +                       hookmask = cl_s[i - 1].hookmask;
2696 +       }
2697 +       i = 0;
2698 +       ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
2699 +       if (ret != 0)
2700 +               goto cleanup_matches;
2701 +       j = 0;
2702 +       ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
2703 +       if (ret != 0)
2704 +               goto cleanup_watchers;
2705 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2706 +       target = find_target_lock(t->u.name, &ret, &ebt_mutex);
2707 +       if (!target)
2708 +               goto cleanup_watchers;
2709 +       if (target->me)
2710 +               __MOD_INC_USE_COUNT(target->me);
2711 +       up(&ebt_mutex);
2712 +
2713 +       t->u.target = target;
2714 +       if (t->u.target == &ebt_standard_target) {
2715 +               if (e->target_offset + sizeof(struct ebt_standard_target) >
2716 +                  e->next_offset) {
2717 +                       BUGPRINT("Standard target size too big\n");
2718 +                       ret = -EFAULT;
2719 +                       goto cleanup_watchers;
2720 +               }
2721 +               if (((struct ebt_standard_target *)t)->verdict <
2722 +                  -NUM_STANDARD_TARGETS) {
2723 +                       BUGPRINT("Invalid standard target\n");
2724 +                       ret = -EFAULT;
2725 +                       goto cleanup_watchers;
2726 +               }
2727 +       } else if ((e->target_offset + t->target_size +
2728 +          sizeof(struct ebt_entry_target) > e->next_offset) ||
2729 +          (t->u.target->check &&
2730 +          t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
2731 +               if (t->u.target->me)
2732 +                       __MOD_DEC_USE_COUNT(t->u.target->me);
2733 +               ret = -EFAULT;
2734 +               goto cleanup_watchers;
2735 +       }
2736 +       (*cnt)++;
2737 +       return 0;
2738 +cleanup_watchers:
2739 +       EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
2740 +cleanup_matches:
2741 +       EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
2742 +       return ret;
2743 +}
2744 +
2745 +// checks for loops and sets the hook mask for udc
2746 +// the hook mask for udc tells us from which base chains the udc can be
2747 +// accessed. This mask is a parameter to the check() functions of the extensions
2748 +static int check_chainloops(struct ebt_entries *chain,
2749 +   struct ebt_cl_stack *cl_s, unsigned int udc_cnt,
2750 +   unsigned int hooknr, char *base)
2751 +{
2752 +       int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
2753 +       struct ebt_entry *e = (struct ebt_entry *)chain->data;
2754 +       struct ebt_entry_target *t;
2755 +
2756 +       while (pos < nentries || chain_nr != -1) {
2757 +               // end of udc, go back one 'recursion' step
2758 +               if (pos == nentries) {
2759 +                       // put back values of the time when this chain was called
2760 +                       e = cl_s[chain_nr].cs.e;
2761 +                       if (cl_s[chain_nr].from != -1)
2762 +                               nentries =
2763 +                               cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
2764 +                       else
2765 +                               nentries = chain->nentries;
2766 +                       pos = cl_s[chain_nr].cs.n;
2767 +                       // make sure we won't see a loop that isn't one
2768 +                       cl_s[chain_nr].cs.n = 0;
2769 +                       chain_nr = cl_s[chain_nr].from;
2770 +                       if (pos == nentries)
2771 +                               continue;
2772 +               }
2773 +               t = (struct ebt_entry_target *)
2774 +                  (((char *)e) + e->target_offset);
2775 +               if (strcmp(t->u.name, EBT_STANDARD_TARGET))
2776 +                       goto letscontinue;
2777 +               if (e->target_offset + sizeof(struct ebt_standard_target) >
2778 +                  e->next_offset) {
2779 +                       BUGPRINT("Standard target size too big\n");
2780 +                       return -1;
2781 +               }
2782 +               verdict = ((struct ebt_standard_target *)t)->verdict;
2783 +               if (verdict >= 0) { // jump to another chain
2784 +                       struct ebt_entries *hlp2 =
2785 +                          (struct ebt_entries *)(base + verdict);
2786 +                       for (i = 0; i < udc_cnt; i++)
2787 +                               if (hlp2 == cl_s[i].cs.chaininfo)
2788 +                                       break;
2789 +                       // bad destination or loop
2790 +                       if (i == udc_cnt) {
2791 +                               BUGPRINT("bad destination\n");
2792 +                               return -1;
2793 +                       }
2794 +                       if (cl_s[i].cs.n) {
2795 +                               BUGPRINT("loop\n");
2796 +                               return -1;
2797 +                       }
2798 +                       // this can't be 0, so the above test is correct
2799 +                       cl_s[i].cs.n = pos + 1;
2800 +                       pos = 0;
2801 +                       cl_s[i].cs.e = ((void *)e + e->next_offset);
2802 +                       e = (struct ebt_entry *)(hlp2->data);
2803 +                       nentries = hlp2->nentries;
2804 +                       cl_s[i].from = chain_nr;
2805 +                       chain_nr = i;
2806 +                       // this udc is accessible from the base chain for hooknr
2807 +                       cl_s[i].hookmask |= (1 << hooknr);
2808 +                       continue;
2809 +               }
2810 +letscontinue:
2811 +               e = (void *)e + e->next_offset;
2812 +               pos++;
2813 +       }
2814 +       return 0;
2815 +}
2816 +
2817 +// do the parsing of the table/chains/entries/matches/watchers/targets, heh
2818 +static int translate_table(struct ebt_replace *repl,
2819 +   struct ebt_table_info *newinfo)
2820 +{
2821 +       unsigned int i, j, k, udc_cnt;
2822 +       int ret;
2823 +       struct ebt_cl_stack *cl_s = NULL; // used in the checking for chain loops
2824 +
2825 +       i = 0;
2826 +       while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
2827 +               i++;
2828 +       if (i == NF_BR_NUMHOOKS) {
2829 +               BUGPRINT("No valid hooks specified\n");
2830 +               return -EINVAL;
2831 +       }
2832 +       if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
2833 +               BUGPRINT("Chains don't start at beginning\n");
2834 +               return -EINVAL;
2835 +       }
2836 +       // make sure chains are ordered after each other in same order
2837 +       // as their corresponding hooks
2838 +       for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
2839 +               if (!(repl->valid_hooks & (1 << j)))
2840 +                       continue;
2841 +               if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
2842 +                       BUGPRINT("Hook order must be followed\n");
2843 +                       return -EINVAL;
2844 +               }
2845 +               i = j;
2846 +       }
2847 +
2848 +       for (i = 0; i < NF_BR_NUMHOOKS; i++)
2849 +               newinfo->hook_entry[i] = NULL;
2850 +
2851 +       newinfo->entries_size = repl->entries_size;
2852 +       newinfo->nentries = repl->nentries;
2853 +
2854 +       // do some early checkings and initialize some things
2855 +       i = 0; // holds the expected nr. of entries for the chain
2856 +       j = 0; // holds the up to now counted entries for the chain
2857 +       k = 0; // holds the total nr. of entries, should equal
2858 +              // newinfo->nentries afterwards
2859 +       udc_cnt = 0; // will hold the nr. of user defined chains (udc)
2860 +       ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2861 +          ebt_check_entry_size_and_hooks, newinfo, repl->entries,
2862 +          repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
2863 +          &udc_cnt, repl->valid_hooks);
2864 +
2865 +       if (ret != 0)
2866 +               return ret;
2867 +
2868 +       if (i != j) {
2869 +               BUGPRINT("nentries does not equal the nr of entries in the "
2870 +                        "(last) chain\n");
2871 +               return -EINVAL;
2872 +       }
2873 +       if (k != newinfo->nentries) {
2874 +               BUGPRINT("Total nentries is wrong\n");
2875 +               return -EINVAL;
2876 +       }
2877 +
2878 +       // check if all valid hooks have a chain
2879 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2880 +               if (newinfo->hook_entry[i] == NULL &&
2881 +                  (repl->valid_hooks & (1 << i))) {
2882 +                       BUGPRINT("Valid hook without chain\n");
2883 +                       return -EINVAL;
2884 +               }
2885 +       }
2886 +
2887 +       // Get the location of the udc, put them in an array
2888 +       // While we're at it, allocate the chainstack
2889 +       if (udc_cnt) {
2890 +               // this will get free'd in do_replace()/ebt_register_table()
2891 +               // if an error occurs
2892 +               newinfo->chainstack = (struct ebt_chainstack **)
2893 +                  vmalloc(smp_num_cpus * sizeof(struct ebt_chainstack));
2894 +               if (!newinfo->chainstack)
2895 +                       return -ENOMEM;
2896 +               for (i = 0; i < smp_num_cpus; i++) {
2897 +                       newinfo->chainstack[i] =
2898 +                          vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
2899 +                       if (!newinfo->chainstack[i]) {
2900 +                               while (i)
2901 +                                       vfree(newinfo->chainstack[--i]);
2902 +                               vfree(newinfo->chainstack);
2903 +                               newinfo->chainstack = NULL;
2904 +                               return -ENOMEM;
2905 +                       }
2906 +               }
2907 +
2908 +               cl_s = (struct ebt_cl_stack *)
2909 +                  vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
2910 +               if (!cl_s)
2911 +                       return -ENOMEM;
2912 +               i = 0; // the i'th udc
2913 +               EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2914 +                  ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
2915 +                  repl->valid_hooks, cl_s);
2916 +               // sanity check
2917 +               if (i != udc_cnt) {
2918 +                       BUGPRINT("i != udc_cnt\n");
2919 +                       vfree(cl_s);
2920 +                       return -EFAULT;
2921 +               }
2922 +       }
2923 +
2924 +       // Check for loops
2925 +       for (i = 0; i < NF_BR_NUMHOOKS; i++)
2926 +               if (repl->valid_hooks & (1 << i))
2927 +                       if (check_chainloops(newinfo->hook_entry[i],
2928 +                          cl_s, udc_cnt, i, newinfo->entries)) {
2929 +                               if (cl_s)
2930 +                                       vfree(cl_s);
2931 +                               return -EINVAL;
2932 +                       }
2933 +
2934 +       // we now know the following (along with E=mc²):
2935 +       // - the nr of entries in each chain is right
2936 +       // - the size of the allocated space is right
2937 +       // - all valid hooks have a corresponding chain
2938 +       // - there are no loops
2939 +       // - wrong data can still be on the level of a single entry
2940 +       // - could be there are jumps to places that are not the
2941 +       //   beginning of a chain. This can only occur in chains that
2942 +       //   are not accessible from any base chains, so we don't care.
2943 +
2944 +       // used to know what we need to clean up if something goes wrong
2945 +       i = 0;
2946 +       ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2947 +          ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
2948 +          cl_s, udc_cnt);
2949 +       if (ret != 0) {
2950 +               EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2951 +                  ebt_cleanup_entry, &i);
2952 +       }
2953 +       if (cl_s)
2954 +               vfree(cl_s);
2955 +       return ret;
2956 +}
2957 +
2958 +// called under write_lock
2959 +static void get_counters(struct ebt_counter *oldcounters,
2960 +   struct ebt_counter *counters, unsigned int nentries)
2961 +{
2962 +       int i, cpu;
2963 +       struct ebt_counter *counter_base;
2964 +
2965 +       // counters of cpu 0
2966 +       memcpy(counters, oldcounters,
2967 +          sizeof(struct ebt_counter) * nentries);
2968 +       // add other counters to those of cpu 0
2969 +       for (cpu = 1; cpu < smp_num_cpus; cpu++) {
2970 +               counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
2971 +               for (i = 0; i < nentries; i++) {
2972 +                       counters[i].pcnt += counter_base[i].pcnt;
2973 +                       counters[i].bcnt += counter_base[i].bcnt;
2974 +               }
2975 +       }
2976 +}
2977 +
2978 +// replace the table
2979 +static int do_replace(void *user, unsigned int len)
2980 +{
2981 +       int ret, i, countersize;
2982 +       struct ebt_table_info *newinfo;
2983 +       struct ebt_replace tmp;
2984 +       struct ebt_table *t;
2985 +       struct ebt_counter *counterstmp = NULL;
2986 +       // used to be able to unlock earlier
2987 +       struct ebt_table_info *table;
2988 +
2989 +       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
2990 +               return -EFAULT;
2991 +
2992 +       if (len != sizeof(tmp) + tmp.entries_size) {
2993 +               BUGPRINT("Wrong len argument\n");
2994 +               return -EINVAL;
2995 +       }
2996 +
2997 +       if (tmp.entries_size == 0) {
2998 +               BUGPRINT("Entries_size never zero\n");
2999 +               return -EINVAL;
3000 +       }
3001 +       countersize = COUNTER_OFFSET(tmp.nentries) * smp_num_cpus;
3002 +       newinfo = (struct ebt_table_info *)
3003 +          vmalloc(sizeof(struct ebt_table_info) + countersize);
3004 +       if (!newinfo)
3005 +               return -ENOMEM;
3006 +
3007 +       if (countersize)
3008 +               memset(newinfo->counters, 0, countersize);
3009 +
3010 +       newinfo->entries = (char *)vmalloc(tmp.entries_size);
3011 +       if (!newinfo->entries) {
3012 +               ret = -ENOMEM;
3013 +               goto free_newinfo;
3014 +       }
3015 +       if (copy_from_user(
3016 +          newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
3017 +               BUGPRINT("Couldn't copy entries from userspace\n");
3018 +               ret = -EFAULT;
3019 +               goto free_entries;
3020 +       }
3021 +
3022 +       // the user wants counters back
3023 +       // the check on the size is done later, when we have the lock
3024 +       if (tmp.num_counters) {
3025 +               counterstmp = (struct ebt_counter *)
3026 +                  vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
3027 +               if (!counterstmp) {
3028 +                       ret = -ENOMEM;
3029 +                       goto free_entries;
3030 +               }
3031 +       }
3032 +       else
3033 +               counterstmp = NULL;
3034 +
3035 +       // this can get initialized by translate_table()
3036 +       newinfo->chainstack = NULL;
3037 +       ret = translate_table(&tmp, newinfo);
3038 +
3039 +       if (ret != 0)
3040 +               goto free_counterstmp;
3041 +
3042 +       t = find_table_lock(tmp.name, &ret, &ebt_mutex);
3043 +       if (!t)
3044 +               goto free_iterate;
3045 +
3046 +       // the table doesn't like it
3047 +       if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
3048 +               goto free_unlock;
3049 +
3050 +       if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
3051 +               BUGPRINT("Wrong nr. of counters requested\n");
3052 +               ret = -EINVAL;
3053 +               goto free_unlock;
3054 +       }
3055 +
3056 +       // we have the mutex lock, so no danger in reading this pointer
3057 +       table = t->private;
3058 +       // we need an atomic snapshot of the counters
3059 +       write_lock_bh(&t->lock);
3060 +       if (tmp.num_counters)
3061 +               get_counters(t->private->counters, counterstmp,
3062 +                  t->private->nentries);
3063 +
3064 +       t->private = newinfo;
3065 +       write_unlock_bh(&t->lock);
3066 +       up(&ebt_mutex);
3067 +       // So, a user can change the chains while having messed up her counter
3068 +       // allocation. Only reason why this is done is because this way the lock
3069 +       // is held only once, while this doesn't bring the kernel into a
3070 +       // dangerous state.
3071 +       if (tmp.num_counters &&
3072 +          copy_to_user(tmp.counters, counterstmp,
3073 +          tmp.num_counters * sizeof(struct ebt_counter))) {
3074 +               BUGPRINT("Couldn't copy counters to userspace\n");
3075 +               ret = -EFAULT;
3076 +       }
3077 +       else
3078 +               ret = 0;
3079 +
3080 +       // decrease module count and free resources
3081 +       EBT_ENTRY_ITERATE(table->entries, table->entries_size,
3082 +          ebt_cleanup_entry, NULL);
3083 +
3084 +       vfree(table->entries);
3085 +       if (table->chainstack) {
3086 +               for (i = 0; i < smp_num_cpus; i++)
3087 +                       vfree(table->chainstack[i]);
3088 +               vfree(table->chainstack);
3089 +       }
3090 +       vfree(table);
3091 +
3092 +       if (counterstmp)
3093 +               vfree(counterstmp);
3094 +       return ret;
3095 +
3096 +free_unlock:
3097 +       up(&ebt_mutex);
3098 +free_iterate:
3099 +       EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3100 +          ebt_cleanup_entry, NULL);
3101 +free_counterstmp:
3102 +       if (counterstmp)
3103 +               vfree(counterstmp);
3104 +       // can be initialized in translate_table()
3105 +       if (newinfo->chainstack) {
3106 +               for (i = 0; i < smp_num_cpus; i++)
3107 +                       vfree(newinfo->chainstack[i]);
3108 +               vfree(newinfo->chainstack);
3109 +       }
3110 +free_entries:
3111 +       if (newinfo->entries)
3112 +               vfree(newinfo->entries);
3113 +free_newinfo:
3114 +       if (newinfo)
3115 +               vfree(newinfo);
3116 +       return ret;
3117 +}
3118 +
3119 +int ebt_register_target(struct ebt_target *target)
3120 +{
3121 +       int ret;
3122 +
3123 +       ret = down_interruptible(&ebt_mutex);
3124 +       if (ret != 0)
3125 +               return ret;
3126 +       if (!list_named_insert(&ebt_targets, target)) {
3127 +               up(&ebt_mutex);
3128 +               return -EEXIST;
3129 +       }
3130 +       up(&ebt_mutex);
3131 +       MOD_INC_USE_COUNT;
3132 +
3133 +       return 0;
3134 +}
3135 +
3136 +void ebt_unregister_target(struct ebt_target *target)
3137 +{
3138 +       down(&ebt_mutex);
3139 +       LIST_DELETE(&ebt_targets, target);
3140 +       up(&ebt_mutex);
3141 +       MOD_DEC_USE_COUNT;
3142 +}
3143 +
3144 +int ebt_register_match(struct ebt_match *match)
3145 +{
3146 +       int ret;
3147 +
3148 +       ret = down_interruptible(&ebt_mutex);
3149 +       if (ret != 0)
3150 +               return ret;
3151 +       if (!list_named_insert(&ebt_matches, match)) {
3152 +               up(&ebt_mutex);
3153 +               return -EEXIST;
3154 +       }
3155 +       up(&ebt_mutex);
3156 +       MOD_INC_USE_COUNT;
3157 +
3158 +       return 0;
3159 +}
3160 +
3161 +void ebt_unregister_match(struct ebt_match *match)
3162 +{
3163 +       down(&ebt_mutex);
3164 +       LIST_DELETE(&ebt_matches, match);
3165 +       up(&ebt_mutex);
3166 +       MOD_DEC_USE_COUNT;
3167 +}
3168 +
3169 +int ebt_register_watcher(struct ebt_watcher *watcher)
3170 +{
3171 +       int ret;
3172 +
3173 +       ret = down_interruptible(&ebt_mutex);
3174 +       if (ret != 0)
3175 +               return ret;
3176 +       if (!list_named_insert(&ebt_watchers, watcher)) {
3177 +               up(&ebt_mutex);
3178 +               return -EEXIST;
3179 +       }
3180 +       up(&ebt_mutex);
3181 +       MOD_INC_USE_COUNT;
3182 +
3183 +       return 0;
3184 +}
3185 +
3186 +void ebt_unregister_watcher(struct ebt_watcher *watcher)
3187 +{
3188 +       down(&ebt_mutex);
3189 +       LIST_DELETE(&ebt_watchers, watcher);
3190 +       up(&ebt_mutex);
3191 +       MOD_DEC_USE_COUNT;
3192 +}
3193 +
3194 +int ebt_register_table(struct ebt_table *table)
3195 +{
3196 +       struct ebt_table_info *newinfo;
3197 +       int ret, i, countersize;
3198 +
3199 +       if (!table || !table->table ||!table->table->entries ||
3200 +           table->table->entries_size == 0 ||
3201 +           table->table->counters || table->private) {
3202 +               BUGPRINT("Bad table data for ebt_register_table!!!\n");
3203 +               return -EINVAL;
3204 +       }
3205 +
3206 +       countersize = COUNTER_OFFSET(table->table->nentries) * smp_num_cpus;
3207 +       newinfo = (struct ebt_table_info *)
3208 +          vmalloc(sizeof(struct ebt_table_info) + countersize);
3209 +       ret = -ENOMEM;
3210 +       if (!newinfo)
3211 +               return -ENOMEM;
3212 +
3213 +       newinfo->entries = (char *)vmalloc(table->table->entries_size);
3214 +       if (!(newinfo->entries))
3215 +               goto free_newinfo;
3216 +
3217 +       memcpy(newinfo->entries, table->table->entries,
3218 +          table->table->entries_size);
3219 +
3220 +       if (countersize)
3221 +               memset(newinfo->counters, 0, countersize);
3222 +
3223 +       // fill in newinfo and parse the entries
3224 +       newinfo->chainstack = NULL;
3225 +       ret = translate_table(table->table, newinfo);
3226 +       if (ret != 0) {
3227 +               BUGPRINT("Translate_table failed\n");
3228 +               goto free_chainstack;
3229 +       }
3230 +
3231 +       if (table->check && table->check(newinfo, table->valid_hooks)) {
3232 +               BUGPRINT("The table doesn't like its own initial data, lol\n");
3233 +               return -EINVAL;
3234 +       }
3235 +
3236 +       table->private = newinfo;
3237 +       table->lock = RW_LOCK_UNLOCKED;
3238 +       ret = down_interruptible(&ebt_mutex);
3239 +       if (ret != 0)
3240 +               goto free_chainstack;
3241 +
3242 +       if (list_named_find(&ebt_tables, table->name)) {
3243 +               ret = -EEXIST;
3244 +               BUGPRINT("Table name already exists\n");
3245 +               goto free_unlock;
3246 +       }
3247 +
3248 +       list_prepend(&ebt_tables, table);
3249 +       up(&ebt_mutex);
3250 +       MOD_INC_USE_COUNT;
3251 +       return 0;
3252 +free_unlock:
3253 +       up(&ebt_mutex);
3254 +free_chainstack:
3255 +       if (newinfo->chainstack) {
3256 +               for (i = 0; i < smp_num_cpus; i++)
3257 +                       vfree(newinfo->chainstack[i]);
3258 +               vfree(newinfo->chainstack);
3259 +       }
3260 +       vfree(newinfo->entries);
3261 +free_newinfo:
3262 +       vfree(newinfo);
3263 +       return ret;
3264 +}
3265 +
3266 +void ebt_unregister_table(struct ebt_table *table)
3267 +{
3268 +       int i;
3269 +
3270 +       if (!table) {
3271 +               BUGPRINT("Request to unregister NULL table!!!\n");
3272 +               return;
3273 +       }
3274 +       down(&ebt_mutex);
3275 +       LIST_DELETE(&ebt_tables, table);
3276 +       up(&ebt_mutex);
3277 +       EBT_ENTRY_ITERATE(table->private->entries,
3278 +          table->private->entries_size, ebt_cleanup_entry, NULL);
3279 +       if (table->private->entries)
3280 +               vfree(table->private->entries);
3281 +       if (table->private->chainstack) {
3282 +               for (i = 0; i < smp_num_cpus; i++)
3283 +                       vfree(table->private->chainstack[i]);
3284 +               vfree(table->private->chainstack);
3285 +       }
3286 +       vfree(table->private);
3287 +       MOD_DEC_USE_COUNT;
3288 +}
3289 +
3290 +// userspace just supplied us with counters
3291 +static int update_counters(void *user, unsigned int len)
3292 +{
3293 +       int i, ret;
3294 +       struct ebt_counter *tmp;
3295 +       struct ebt_replace hlp;
3296 +       struct ebt_table *t;
3297 +
3298 +       if (copy_from_user(&hlp, user, sizeof(hlp)))
3299 +               return -EFAULT;
3300 +
3301 +       if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
3302 +               return -EINVAL;
3303 +       if (hlp.num_counters == 0)
3304 +               return -EINVAL;
3305 +
3306 +       if ( !(tmp = (struct ebt_counter *)
3307 +          vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
3308 +               MEMPRINT("Update_counters && nomemory\n");
3309 +               return -ENOMEM;
3310 +       }
3311 +
3312 +       t = find_table_lock(hlp.name, &ret, &ebt_mutex);
3313 +       if (!t)
3314 +               goto free_tmp;
3315 +
3316 +       if (hlp.num_counters != t->private->nentries) {
3317 +               BUGPRINT("Wrong nr of counters\n");
3318 +               ret = -EINVAL;
3319 +               goto unlock_mutex;
3320 +       }
3321 +
3322 +       if ( copy_from_user(tmp, hlp.counters,
3323 +          hlp.num_counters * sizeof(struct ebt_counter)) ) {
3324 +               BUGPRINT("Updata_counters && !cfu\n");
3325 +               ret = -EFAULT;
3326 +               goto unlock_mutex;
3327 +       }
3328 +
3329 +       // we want an atomic add of the counters
3330 +       write_lock_bh(&t->lock);
3331 +
3332 +       // we add to the counters of the first cpu
3333 +       for (i = 0; i < hlp.num_counters; i++) {
3334 +               t->private->counters[i].pcnt += tmp[i].pcnt;
3335 +               t->private->counters[i].bcnt += tmp[i].bcnt;
3336 +       }
3337 +
3338 +       write_unlock_bh(&t->lock);
3339 +       ret = 0;
3340 +unlock_mutex:
3341 +       up(&ebt_mutex);
3342 +free_tmp:
3343 +       vfree(tmp);
3344 +       return ret;
3345 +}
3346 +
3347 +static inline int ebt_make_matchname(struct ebt_entry_match *m,
3348 +   char *base, char *ubase)
3349 +{
3350 +       char *hlp = ubase - base + (char *)m;
3351 +       if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
3352 +               return -EFAULT;
3353 +       return 0;
3354 +}
3355 +
3356 +static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
3357 +   char *base, char *ubase)
3358 +{
3359 +       char *hlp = ubase - base + (char *)w;
3360 +       if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
3361 +               return -EFAULT;
3362 +       return 0;
3363 +}
3364 +
3365 +static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
3366 +{
3367 +       int ret;
3368 +       char *hlp;
3369 +       struct ebt_entry_target *t;
3370 +
3371 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
3372 +               return 0;
3373 +
3374 +       hlp = ubase - base + (char *)e + e->target_offset;
3375 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
3376 +
3377 +       ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
3378 +       if (ret != 0)
3379 +               return ret;
3380 +       ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
3381 +       if (ret != 0)
3382 +               return ret;
3383 +       if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
3384 +               return -EFAULT;
3385 +       return 0;
3386 +}
3387 +
3388 +// called with ebt_mutex down
3389 +static int copy_everything_to_user(struct ebt_table *t, void *user,
3390 +   int *len, int cmd)
3391 +{
3392 +       struct ebt_replace tmp;
3393 +       struct ebt_counter *counterstmp, *oldcounters;
3394 +       unsigned int entries_size, nentries;
3395 +       char *entries;
3396 +
3397 +       if (cmd == EBT_SO_GET_ENTRIES) {
3398 +               entries_size = t->private->entries_size;
3399 +               nentries = t->private->nentries;
3400 +               entries = t->private->entries;
3401 +               oldcounters = t->private->counters;
3402 +       } else {
3403 +               entries_size = t->table->entries_size;
3404 +               nentries = t->table->nentries;
3405 +               entries = t->table->entries;
3406 +               oldcounters = t->table->counters;
3407 +       }
3408 +
3409 +       if (copy_from_user(&tmp, user, sizeof(tmp))) {
3410 +               BUGPRINT("Cfu didn't work\n");
3411 +               return -EFAULT;
3412 +       }
3413 +
3414 +       if (*len != sizeof(struct ebt_replace) + entries_size +
3415 +          (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
3416 +               BUGPRINT("Wrong size\n");
3417 +               return -EINVAL;
3418 +       }
3419 +
3420 +       if (tmp.nentries != nentries) {
3421 +               BUGPRINT("Nentries wrong\n");
3422 +               return -EINVAL;
3423 +       }
3424 +
3425 +       if (tmp.entries_size != entries_size) {
3426 +               BUGPRINT("Wrong size\n");
3427 +               return -EINVAL;
3428 +       }
3429 +
3430 +       // userspace might not need the counters
3431 +       if (tmp.num_counters) {
3432 +               if (tmp.num_counters != nentries) {
3433 +                       BUGPRINT("Num_counters wrong\n");
3434 +                       return -EINVAL;
3435 +               }
3436 +               counterstmp = (struct ebt_counter *)
3437 +                  vmalloc(nentries * sizeof(struct ebt_counter));
3438 +               if (!counterstmp) {
3439 +                       MEMPRINT("Couldn't copy counters, out of memory\n");
3440 +                       return -ENOMEM;
3441 +               }
3442 +               write_lock_bh(&t->lock);
3443 +               get_counters(oldcounters, counterstmp, nentries);
3444 +               write_unlock_bh(&t->lock);
3445 +
3446 +               if (copy_to_user(tmp.counters, counterstmp,
3447 +                  nentries * sizeof(struct ebt_counter))) {
3448 +                       BUGPRINT("Couldn't copy counters to userspace\n");
3449 +                       vfree(counterstmp);
3450 +                       return -EFAULT;
3451 +               }
3452 +               vfree(counterstmp);
3453 +       }
3454 +
3455 +       if (copy_to_user(tmp.entries, entries, entries_size)) {
3456 +               BUGPRINT("Couldn't copy entries to userspace\n");
3457 +               return -EFAULT;
3458 +       }
3459 +       // set the match/watcher/target names right
3460 +       return EBT_ENTRY_ITERATE(entries, entries_size,
3461 +          ebt_make_names, entries, tmp.entries);
3462 +}
3463 +
3464 +static int do_ebt_set_ctl(struct sock *sk,
3465 +       int cmd, void *user, unsigned int len)
3466 +{
3467 +       int ret;
3468 +
3469 +       switch(cmd) {
3470 +       case EBT_SO_SET_ENTRIES:
3471 +               ret = do_replace(user, len);
3472 +               break;
3473 +       case EBT_SO_SET_COUNTERS:
3474 +               ret = update_counters(user, len);
3475 +               break;
3476 +       default:
3477 +               ret = -EINVAL;
3478 +  }
3479 +       return ret;
3480 +}
3481 +
3482 +static int do_ebt_get_ctl(struct sock *sk, int cmd, void *user, int *len)
3483 +{
3484 +       int ret;
3485 +       struct ebt_replace tmp;
3486 +       struct ebt_table *t;
3487 +
3488 +       if (copy_from_user(&tmp, user, sizeof(tmp)))
3489 +               return -EFAULT;
3490 +
3491 +       t = find_table_lock(tmp.name, &ret, &ebt_mutex);
3492 +       if (!t)
3493 +               return ret;
3494 +
3495 +       switch(cmd) {
3496 +       case EBT_SO_GET_INFO:
3497 +       case EBT_SO_GET_INIT_INFO:
3498 +               if (*len != sizeof(struct ebt_replace)){
3499 +                       ret = -EINVAL;
3500 +                       up(&ebt_mutex);
3501 +                       break;
3502 +               }
3503 +               if (cmd == EBT_SO_GET_INFO) {
3504 +                       tmp.nentries = t->private->nentries;
3505 +                       tmp.entries_size = t->private->entries_size;
3506 +                       tmp.valid_hooks = t->valid_hooks;
3507 +               } else {
3508 +                       tmp.nentries = t->table->nentries;
3509 +                       tmp.entries_size = t->table->entries_size;
3510 +                       tmp.valid_hooks = t->table->valid_hooks;
3511 +               }
3512 +               up(&ebt_mutex);
3513 +               if (copy_to_user(user, &tmp, *len) != 0){
3514 +                       BUGPRINT("c2u Didn't work\n");
3515 +                       ret = -EFAULT;
3516 +                       break;
3517 +               }
3518 +               ret = 0;
3519 +               break;
3520 +
3521 +       case EBT_SO_GET_ENTRIES:
3522 +       case EBT_SO_GET_INIT_ENTRIES:
3523 +               ret = copy_everything_to_user(t, user, len, cmd);
3524 +               up(&ebt_mutex);
3525 +               break;
3526 +
3527 +       default:
3528 +               up(&ebt_mutex);
3529 +               ret = -EINVAL;
3530 +       }
3531 +
3532 +       return ret;
3533 +}
3534 +
3535 +static struct nf_sockopt_ops ebt_sockopts =
3536 +{ { NULL, NULL }, PF_INET, EBT_BASE_CTL, EBT_SO_SET_MAX + 1, do_ebt_set_ctl,
3537 +    EBT_BASE_CTL, EBT_SO_GET_MAX + 1, do_ebt_get_ctl, 0, NULL
3538 +};
3539 +
3540 +static int __init init(void)
3541 +{
3542 +       int ret;
3543 +
3544 +       down(&ebt_mutex);
3545 +       list_named_insert(&ebt_targets, &ebt_standard_target);
3546 +       up(&ebt_mutex);
3547 +       if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
3548 +               return ret;
3549 +
3550 +       printk(KERN_NOTICE "Ebtables v2.0 registered\n");
3551 +       return 0;
3552 +}
3553 +
3554 +static void __exit fini(void)
3555 +{
3556 +       nf_unregister_sockopt(&ebt_sockopts);
3557 +       printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
3558 +}
3559 +
3560 +EXPORT_SYMBOL(ebt_register_table);
3561 +EXPORT_SYMBOL(ebt_unregister_table);
3562 +EXPORT_SYMBOL(ebt_register_match);
3563 +EXPORT_SYMBOL(ebt_unregister_match);
3564 +EXPORT_SYMBOL(ebt_register_watcher);
3565 +EXPORT_SYMBOL(ebt_unregister_watcher);
3566 +EXPORT_SYMBOL(ebt_register_target);
3567 +EXPORT_SYMBOL(ebt_unregister_target);
3568 +EXPORT_SYMBOL(ebt_do_table);
3569 +module_init(init);
3570 +module_exit(fini);
3571 +MODULE_LICENSE("GPL");
3572 --- /dev/null   Thu Aug 24 11:00:32 2000
3573 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebtables.h   Fri Aug  8 01:09:06 2003
3574 @@ -0,0 +1,361 @@
3575 +/*
3576 + *  ebtables
3577 + *
3578 + *     Authors:
3579 + *     Bart De Schuymer                <bart.de.schuymer@pandora.be>
3580 + *
3581 + *  ebtables.c,v 2.0, September, 2002
3582 + *
3583 + *  This code is stongly inspired on the iptables code which is
3584 + *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
3585 + */
3586 +
3587 +#ifndef __LINUX_BRIDGE_EFF_H
3588 +#define __LINUX_BRIDGE_EFF_H
3589 +#include <linux/if.h>
3590 +#include <linux/netfilter_bridge.h>
3591 +#include <linux/if_ether.h>
3592 +
3593 +#define EBT_TABLE_MAXNAMELEN 32
3594 +#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
3595 +#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
3596 +
3597 +// verdicts >0 are "branches"
3598 +#define EBT_ACCEPT   -1
3599 +#define EBT_DROP     -2
3600 +#define EBT_CONTINUE -3
3601 +#define EBT_RETURN   -4
3602 +#define NUM_STANDARD_TARGETS   4
3603 +
3604 +struct ebt_replace
3605 +{
3606 +       char name[EBT_TABLE_MAXNAMELEN];
3607 +       unsigned int valid_hooks;
3608 +       // nr of rules in the table
3609 +       unsigned int nentries;
3610 +       // total size of the entries
3611 +       unsigned int entries_size;
3612 +       // start of the chains
3613 +       struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
3614 +       // nr of counters userspace expects back
3615 +       unsigned int num_counters;
3616 +       // where the kernel will put the old counters
3617 +       struct ebt_counter *counters;
3618 +       char *entries;
3619 +};
3620 +
3621 +struct ebt_counter
3622 +{
3623 +       uint64_t pcnt;
3624 +       uint64_t bcnt;
3625 +};
3626 +
3627 +struct ebt_entries {
3628 +       // this field is always set to zero
3629 +       // See EBT_ENTRY_OR_ENTRIES.
3630 +       // Must be same size as ebt_entry.bitmask
3631 +       unsigned int distinguisher;
3632 +       // the chain name
3633 +       char name[EBT_CHAIN_MAXNAMELEN];
3634 +       // counter offset for this chain
3635 +       unsigned int counter_offset;
3636 +       // one standard (accept, drop, return) per hook
3637 +       int policy;
3638 +       // nr. of entries
3639 +       unsigned int nentries;
3640 +       // entry list
3641 +       char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3642 +};
3643 +
3644 +// used for the bitmask of struct ebt_entry
3645 +
3646 +// This is a hack to make a difference between an ebt_entry struct and an
3647 +// ebt_entries struct when traversing the entries from start to end.
3648 +// Using this simplifies the code alot, while still being able to use
3649 +// ebt_entries.
3650 +// Contrary, iptables doesn't use something like ebt_entries and therefore uses
3651 +// different techniques for naming the policy and such. So, iptables doesn't
3652 +// need a hack like this.
3653 +#define EBT_ENTRY_OR_ENTRIES 0x01
3654 +// these are the normal masks
3655 +#define EBT_NOPROTO 0x02
3656 +#define EBT_802_3 0x04
3657 +#define EBT_SOURCEMAC 0x08
3658 +#define EBT_DESTMAC 0x10
3659 +#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
3660 +   | EBT_ENTRY_OR_ENTRIES)
3661 +
3662 +#define EBT_IPROTO 0x01
3663 +#define EBT_IIN 0x02
3664 +#define EBT_IOUT 0x04
3665 +#define EBT_ISOURCE 0x8
3666 +#define EBT_IDEST 0x10
3667 +#define EBT_ILOGICALIN 0x20
3668 +#define EBT_ILOGICALOUT 0x40
3669 +#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
3670 +   | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
3671 +
3672 +struct ebt_entry_match
3673 +{
3674 +       union {
3675 +               char name[EBT_FUNCTION_MAXNAMELEN];
3676 +               struct ebt_match *match;
3677 +       } u;
3678 +       // size of data
3679 +       unsigned int match_size;
3680 +       unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3681 +};
3682 +
3683 +struct ebt_entry_watcher
3684 +{
3685 +       union {
3686 +               char name[EBT_FUNCTION_MAXNAMELEN];
3687 +               struct ebt_watcher *watcher;
3688 +       } u;
3689 +       // size of data
3690 +       unsigned int watcher_size;
3691 +       unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3692 +};
3693 +
3694 +struct ebt_entry_target
3695 +{
3696 +       union {
3697 +               char name[EBT_FUNCTION_MAXNAMELEN];
3698 +               struct ebt_target *target;
3699 +       } u;
3700 +       // size of data
3701 +       unsigned int target_size;
3702 +       unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3703 +};
3704 +
3705 +#define EBT_STANDARD_TARGET "standard"
3706 +struct ebt_standard_target
3707 +{
3708 +       struct ebt_entry_target target;
3709 +       int verdict;
3710 +};
3711 +
3712 +// one entry
3713 +struct ebt_entry {
3714 +       // this needs to be the first field
3715 +       unsigned int bitmask;
3716 +       unsigned int invflags;
3717 +       uint16_t ethproto;
3718 +       // the physical in-dev
3719 +       char in[IFNAMSIZ];
3720 +       // the logical in-dev
3721 +       char logical_in[IFNAMSIZ];
3722 +       // the physical out-dev
3723 +       char out[IFNAMSIZ];
3724 +       // the logical out-dev
3725 +       char logical_out[IFNAMSIZ];
3726 +       unsigned char sourcemac[ETH_ALEN];
3727 +       unsigned char sourcemsk[ETH_ALEN];
3728 +       unsigned char destmac[ETH_ALEN];
3729 +       unsigned char destmsk[ETH_ALEN];
3730 +       // sizeof ebt_entry + matches
3731 +       unsigned int watchers_offset;
3732 +       // sizeof ebt_entry + matches + watchers
3733 +       unsigned int target_offset;
3734 +       // sizeof ebt_entry + matches + watchers + target
3735 +       unsigned int next_offset;
3736 +       unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3737 +};
3738 +
3739 +// [gs]etsockopt numbers
3740 +#define EBT_BASE_CTL            128
3741 +
3742 +#define EBT_SO_SET_ENTRIES      (EBT_BASE_CTL)
3743 +#define EBT_SO_SET_COUNTERS     (EBT_SO_SET_ENTRIES+1)
3744 +#define EBT_SO_SET_MAX          (EBT_SO_SET_COUNTERS+1)
3745 +
3746 +#define EBT_SO_GET_INFO         (EBT_BASE_CTL)
3747 +#define EBT_SO_GET_ENTRIES      (EBT_SO_GET_INFO+1)
3748 +#define EBT_SO_GET_INIT_INFO    (EBT_SO_GET_ENTRIES+1)
3749 +#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
3750 +#define EBT_SO_GET_MAX          (EBT_SO_GET_INIT_ENTRIES+1)
3751 +
3752 +#ifdef __KERNEL__
3753 +
3754 +// return values for match() functions
3755 +#define EBT_MATCH 0
3756 +#define EBT_NOMATCH 1
3757 +
3758 +struct ebt_match
3759 +{
3760 +       struct list_head list;
3761 +       const char name[EBT_FUNCTION_MAXNAMELEN];
3762 +       // 0 == it matches
3763 +       int (*match)(const struct sk_buff *skb, const struct net_device *in,
3764 +          const struct net_device *out, const void *matchdata,
3765 +          unsigned int datalen);
3766 +       // 0 == let it in
3767 +       int (*check)(const char *tablename, unsigned int hookmask,
3768 +          const struct ebt_entry *e, void *matchdata, unsigned int datalen);
3769 +       void (*destroy)(void *matchdata, unsigned int datalen);
3770 +       struct module *me;
3771 +};
3772 +
3773 +struct ebt_watcher
3774 +{
3775 +       struct list_head list;
3776 +       const char name[EBT_FUNCTION_MAXNAMELEN];
3777 +       void (*watcher)(const struct sk_buff *skb, const struct net_device *in,
3778 +          const struct net_device *out, const void *watcherdata,
3779 +          unsigned int datalen);
3780 +       // 0 == let it in
3781 +       int (*check)(const char *tablename, unsigned int hookmask,
3782 +          const struct ebt_entry *e, void *watcherdata, unsigned int datalen);
3783 +       void (*destroy)(void *watcherdata, unsigned int datalen);
3784 +       struct module *me;
3785 +};
3786 +
3787 +struct ebt_target
3788 +{
3789 +       struct list_head list;
3790 +       const char name[EBT_FUNCTION_MAXNAMELEN];
3791 +       // returns one of the standard verdicts
3792 +       int (*target)(struct sk_buff **pskb, unsigned int hooknr,
3793 +          const struct net_device *in, const struct net_device *out,
3794 +          const void *targetdata, unsigned int datalen);
3795 +       // 0 == let it in
3796 +       int (*check)(const char *tablename, unsigned int hookmask,
3797 +          const struct ebt_entry *e, void *targetdata, unsigned int datalen);
3798 +       void (*destroy)(void *targetdata, unsigned int datalen);
3799 +       struct module *me;
3800 +};
3801 +
3802 +// used for jumping from and into user defined chains (udc)
3803 +struct ebt_chainstack
3804 +{
3805 +       struct ebt_entries *chaininfo; // pointer to chain data
3806 +       struct ebt_entry *e; // pointer to entry data
3807 +       unsigned int n; // n'th entry
3808 +};
3809 +
3810 +struct ebt_table_info
3811 +{
3812 +       // total size of the entries
3813 +       unsigned int entries_size;
3814 +       unsigned int nentries;
3815 +       // pointers to the start of the chains
3816 +       struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
3817 +       // room to maintain the stack used for jumping from and into udc
3818 +       struct ebt_chainstack **chainstack;
3819 +       char *entries;
3820 +       struct ebt_counter counters[0] ____cacheline_aligned;
3821 +};
3822 +
3823 +struct ebt_table
3824 +{
3825 +       struct list_head list;
3826 +       char name[EBT_TABLE_MAXNAMELEN];
3827 +       struct ebt_replace *table;
3828 +       unsigned int valid_hooks;
3829 +       rwlock_t lock;
3830 +       // e.g. could be the table explicitly only allows certain
3831 +       // matches, targets, ... 0 == let it in
3832 +       int (*check)(const struct ebt_table_info *info,
3833 +          unsigned int valid_hooks);
3834 +       // the data used by the kernel
3835 +       struct ebt_table_info *private;
3836 +};
3837 +
3838 +#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
3839 +                    ~(__alignof__(struct ebt_replace)-1))
3840 +extern int ebt_register_table(struct ebt_table *table);
3841 +extern void ebt_unregister_table(struct ebt_table *table);
3842 +extern int ebt_register_match(struct ebt_match *match);
3843 +extern void ebt_unregister_match(struct ebt_match *match);
3844 +extern int ebt_register_watcher(struct ebt_watcher *watcher);
3845 +extern void ebt_unregister_watcher(struct ebt_watcher *watcher);
3846 +extern int ebt_register_target(struct ebt_target *target);
3847 +extern void ebt_unregister_target(struct ebt_target *target);
3848 +extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff **pskb,
3849 +   const struct net_device *in, const struct net_device *out,
3850 +   struct ebt_table *table);
3851 +
3852 +   // Used in the kernel match() functions
3853 +#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
3854 +// True if the hook mask denotes that the rule is in a base chain,
3855 +// used in the check() functions
3856 +#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
3857 +// Clear the bit in the hook mask that tells if the rule is on a base chain
3858 +#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
3859 +// True if the target is not a standard target
3860 +#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
3861 +
3862 +#endif /* __KERNEL__ */
3863 +
3864 +// blatently stolen from ip_tables.h
3865 +// fn returns 0 to continue iteration
3866 +#define EBT_MATCH_ITERATE(e, fn, args...)                   \
3867 +({                                                          \
3868 +       unsigned int __i;                                   \
3869 +       int __ret = 0;                                      \
3870 +       struct ebt_entry_match *__match;                    \
3871 +                                                           \
3872 +       for (__i = sizeof(struct ebt_entry);                \
3873 +            __i < (e)->watchers_offset;                    \
3874 +            __i += __match->match_size +                   \
3875 +            sizeof(struct ebt_entry_match)) {              \
3876 +               __match = (void *)(e) + __i;                \
3877 +                                                           \
3878 +               __ret = fn(__match , ## args);              \
3879 +               if (__ret != 0)                             \
3880 +                       break;                              \
3881 +       }                                                   \
3882 +       if (__ret == 0) {                                   \
3883 +               if (__i != (e)->watchers_offset)            \
3884 +                       __ret = -EINVAL;                    \
3885 +       }                                                   \
3886 +       __ret;                                              \
3887 +})
3888 +
3889 +#define EBT_WATCHER_ITERATE(e, fn, args...)                 \
3890 +({                                                          \
3891 +       unsigned int __i;                                   \
3892 +       int __ret = 0;                                      \
3893 +       struct ebt_entry_watcher *__watcher;                \
3894 +                                                           \
3895 +       for (__i = e->watchers_offset;                      \
3896 +            __i < (e)->target_offset;                      \
3897 +            __i += __watcher->watcher_size +               \
3898 +            sizeof(struct ebt_entry_watcher)) {            \
3899 +               __watcher = (void *)(e) + __i;              \
3900 +                                                           \
3901 +               __ret = fn(__watcher , ## args);            \
3902 +               if (__ret != 0)                             \
3903 +                       break;                              \
3904 +       }                                                   \
3905 +       if (__ret == 0) {                                   \
3906 +               if (__i != (e)->target_offset)              \
3907 +                       __ret = -EINVAL;                    \
3908 +       }                                                   \
3909 +       __ret;                                              \
3910 +})
3911 +
3912 +#define EBT_ENTRY_ITERATE(entries, size, fn, args...)       \
3913 +({                                                          \
3914 +       unsigned int __i;                                   \
3915 +       int __ret = 0;                                      \
3916 +       struct ebt_entry *__entry;                          \
3917 +                                                           \
3918 +       for (__i = 0; __i < (size);) {                      \
3919 +               __entry = (void *)(entries) + __i;          \
3920 +               __ret = fn(__entry , ## args);              \
3921 +               if (__ret != 0)                             \
3922 +                       break;                              \
3923 +               if (__entry->bitmask != 0)                  \
3924 +                       __i += __entry->next_offset;        \
3925 +               else                                        \
3926 +                       __i += sizeof(struct ebt_entries);  \
3927 +       }                                                   \
3928 +       if (__ret == 0) {                                   \
3929 +               if (__i != (size))                          \
3930 +                       __ret = -EINVAL;                    \
3931 +       }                                                   \
3932 +       __ret;                                              \
3933 +})
3934 +
3935 +#endif
3936 --- /dev/null   Thu Aug 24 11:00:32 2000
3937 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_802_3.h  Fri Aug  8 01:09:06 2003
3938 @@ -0,0 +1,60 @@
3939 +#ifndef __LINUX_BRIDGE_EBT_802_3_H
3940 +#define __LINUX_BRIDGE_EBT_802_3_H
3941 +
3942 +#define EBT_802_3_SAP 0x01
3943 +#define EBT_802_3_TYPE 0x02
3944 +
3945 +#define EBT_802_3_MATCH "802_3"
3946 +
3947 +/*
3948 + * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
3949 + * to discover what kind of packet we're carrying.
3950 + */
3951 +#define CHECK_TYPE 0xaa
3952 +
3953 +/*
3954 + * Control field may be one or two bytes.  If the first byte has
3955 + * the value 0x03 then the entire length is one byte, otherwise it is two.
3956 + * One byte controls are used in Unnumbered Information frames.
3957 + * Two byte controls are used in Numbered Information frames.
3958 + */
3959 +#define IS_UI 0x03
3960 +
3961 +#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
3962 +
3963 +/* ui has one byte ctrl, ni has two */
3964 +struct hdr_ui {
3965 +       uint8_t dsap;
3966 +       uint8_t ssap;
3967 +       uint8_t ctrl;
3968 +       uint8_t orig[3];
3969 +       uint16_t type;
3970 +};
3971 +
3972 +struct hdr_ni {
3973 +       uint8_t dsap;
3974 +       uint8_t ssap;
3975 +       uint16_t ctrl;
3976 +       uint8_t  orig[3];
3977 +       uint16_t type;
3978 +};
3979 +
3980 +struct ebt_802_3_hdr {
3981 +       uint8_t  daddr[6];
3982 +       uint8_t  saddr[6];
3983 +       uint16_t len;
3984 +       union {
3985 +               struct hdr_ui ui;
3986 +               struct hdr_ni ni;
3987 +       } llc;
3988 +};
3989 +
3990 +struct ebt_802_3_info
3991 +{
3992 +       uint8_t  sap;
3993 +       uint16_t type;
3994 +       uint8_t  bitmask;
3995 +       uint8_t  invflags;
3996 +};
3997 +
3998 +#endif
3999 --- /dev/null   Thu Aug 24 11:00:32 2000
4000 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_arp.h    Fri Aug  8 01:09:06 2003
4001 @@ -0,0 +1,32 @@
4002 +#ifndef __LINUX_BRIDGE_EBT_ARP_H
4003 +#define __LINUX_BRIDGE_EBT_ARP_H
4004 +
4005 +#define EBT_ARP_OPCODE 0x01
4006 +#define EBT_ARP_HTYPE 0x02
4007 +#define EBT_ARP_PTYPE 0x04
4008 +#define EBT_ARP_SRC_IP 0x08
4009 +#define EBT_ARP_DST_IP 0x10
4010 +#define EBT_ARP_SRC_MAC 0x20
4011 +#define EBT_ARP_DST_MAC 0x40
4012 +#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
4013 +   EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)
4014 +#define EBT_ARP_MATCH "arp"
4015 +
4016 +struct ebt_arp_info
4017 +{
4018 +       uint16_t htype;
4019 +       uint16_t ptype;
4020 +       uint16_t opcode;
4021 +       uint32_t saddr;
4022 +       uint32_t smsk;
4023 +       uint32_t daddr;
4024 +       uint32_t dmsk;
4025 +       unsigned char smaddr[ETH_ALEN];
4026 +       unsigned char smmsk[ETH_ALEN];
4027 +       unsigned char dmaddr[ETH_ALEN];
4028 +       unsigned char dmmsk[ETH_ALEN];
4029 +       uint8_t  bitmask;
4030 +       uint8_t  invflags;
4031 +};
4032 +
4033 +#endif
4034 --- /dev/null   Thu Aug 24 11:00:32 2000
4035 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_ip.h     Fri Aug  8 01:09:06 2003
4036 @@ -0,0 +1,43 @@
4037 +/*
4038 + *  ebt_ip
4039 + *
4040 + *     Authors:
4041 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
4042 + *
4043 + *  April, 2002
4044 + *
4045 + *  Changes:
4046 + *    added ip-sport and ip-dport
4047 + *    Innominate Security Technologies AG <mhopf@innominate.com>
4048 + *    September, 2002
4049 + */
4050 +
4051 +#ifndef __LINUX_BRIDGE_EBT_IP_H
4052 +#define __LINUX_BRIDGE_EBT_IP_H
4053 +
4054 +#define EBT_IP_SOURCE 0x01
4055 +#define EBT_IP_DEST 0x02
4056 +#define EBT_IP_TOS 0x04
4057 +#define EBT_IP_PROTO 0x08
4058 +#define EBT_IP_SPORT 0x10
4059 +#define EBT_IP_DPORT 0x20
4060 +#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
4061 + EBT_IP_SPORT | EBT_IP_DPORT )
4062 +#define EBT_IP_MATCH "ip"
4063 +
4064 +// the same values are used for the invflags
4065 +struct ebt_ip_info
4066 +{
4067 +       uint32_t saddr;
4068 +       uint32_t daddr;
4069 +       uint32_t smsk;
4070 +       uint32_t dmsk;
4071 +       uint8_t  tos;
4072 +       uint8_t  protocol;
4073 +       uint8_t  bitmask;
4074 +       uint8_t  invflags;
4075 +       uint16_t sport[2];
4076 +       uint16_t dport[2];
4077 +};
4078 +
4079 +#endif
4080 --- /dev/null   Thu Aug 24 11:00:32 2000
4081 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_pkttype.h        Fri Aug  8 01:09:06 2003
4082 @@ -0,0 +1,11 @@
4083 +#ifndef __LINUX_BRIDGE_EBT_PKTTYPE_H
4084 +#define __LINUX_BRIDGE_EBT_PKTTYPE_H
4085 +
4086 +struct ebt_pkttype_info
4087 +{
4088 +       uint8_t pkt_type;
4089 +       uint8_t invert;
4090 +};
4091 +#define EBT_PKTTYPE_MATCH "pkttype"
4092 +
4093 +#endif
4094 --- /dev/null   Thu Aug 24 11:00:32 2000
4095 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_stp.h    Fri Aug  8 01:09:06 2003
4096 @@ -0,0 +1,46 @@
4097 +#ifndef __LINUX_BRIDGE_EBT_STP_H
4098 +#define __LINUX_BRIDGE_EBT_STP_H
4099 +
4100 +#define EBT_STP_TYPE           0x0001
4101 +
4102 +#define EBT_STP_FLAGS          0x0002
4103 +#define EBT_STP_ROOTPRIO       0x0004
4104 +#define EBT_STP_ROOTADDR       0x0008
4105 +#define EBT_STP_ROOTCOST       0x0010
4106 +#define EBT_STP_SENDERPRIO     0x0020
4107 +#define EBT_STP_SENDERADDR     0x0040
4108 +#define EBT_STP_PORT           0x0080
4109 +#define EBT_STP_MSGAGE         0x0100
4110 +#define EBT_STP_MAXAGE         0x0200
4111 +#define EBT_STP_HELLOTIME      0x0400
4112 +#define EBT_STP_FWDD           0x0800
4113 +
4114 +#define EBT_STP_MASK           0x0fff
4115 +#define EBT_STP_CONFIG_MASK    0x0ffe
4116 +
4117 +#define EBT_STP_MATCH "stp"
4118 +
4119 +struct ebt_stp_config_info
4120 +{
4121 +       uint8_t flags;
4122 +       uint16_t root_priol, root_priou;
4123 +       char root_addr[6], root_addrmsk[6];
4124 +       uint32_t root_costl, root_costu;
4125 +       uint16_t sender_priol, sender_priou;
4126 +       char sender_addr[6], sender_addrmsk[6];
4127 +       uint16_t portl, portu;
4128 +       uint16_t msg_agel, msg_ageu;
4129 +       uint16_t max_agel, max_ageu;
4130 +       uint16_t hello_timel, hello_timeu;
4131 +       uint16_t forward_delayl, forward_delayu;
4132 +};
4133 +
4134 +struct ebt_stp_info
4135 +{
4136 +       uint8_t type;
4137 +       struct ebt_stp_config_info config;
4138 +       uint16_t bitmask;
4139 +       uint16_t invflags;
4140 +};
4141 +
4142 +#endif
4143 --- /dev/null   Thu Aug 24 11:00:32 2000
4144 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_vlan.h   Fri Aug  8 01:09:06 2003
4145 @@ -0,0 +1,20 @@
4146 +#ifndef __LINUX_BRIDGE_EBT_VLAN_H
4147 +#define __LINUX_BRIDGE_EBT_VLAN_H
4148 +
4149 +#define EBT_VLAN_ID    0x01
4150 +#define EBT_VLAN_PRIO  0x02
4151 +#define EBT_VLAN_ENCAP 0x04
4152 +#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
4153 +#define EBT_VLAN_MATCH "vlan"
4154 +
4155 +struct ebt_vlan_info {
4156 +       uint16_t id;            /* VLAN ID {1-4095} */
4157 +       uint8_t prio;           /* VLAN User Priority {0-7} */
4158 +       uint16_t encap;         /* VLAN Encapsulated frame code {0-65535} */
4159 +       uint8_t bitmask;                /* Args bitmask bit 1=1 - ID arg,
4160 +                                  bit 2=1 User-Priority arg, bit 3=1 encap*/
4161 +       uint8_t invflags;               /* Inverse bitmask  bit 1=1 - inversed ID arg,
4162 +                                  bit 2=1 - inversed Pirority arg */
4163 +};
4164 +
4165 +#endif
4166 --- /dev/null   Thu Aug 24 11:00:32 2000
4167 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_log.h    Fri Aug  8 01:09:06 2003
4168 @@ -0,0 +1,17 @@
4169 +#ifndef __LINUX_BRIDGE_EBT_LOG_H
4170 +#define __LINUX_BRIDGE_EBT_LOG_H
4171 +
4172 +#define EBT_LOG_IP 0x01 // if the frame is made by ip, log the ip information
4173 +#define EBT_LOG_ARP 0x02
4174 +#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
4175 +#define EBT_LOG_PREFIX_SIZE 30
4176 +#define EBT_LOG_WATCHER "log"
4177 +
4178 +struct ebt_log_info
4179 +{
4180 +       uint8_t loglevel;
4181 +       uint8_t prefix[EBT_LOG_PREFIX_SIZE];
4182 +       uint32_t bitmask;
4183 +};
4184 +
4185 +#endif
4186 --- /dev/null   Thu Aug 24 11:00:32 2000
4187 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_nat.h    Fri Aug  8 01:09:06 2003
4188 @@ -0,0 +1,13 @@
4189 +#ifndef __LINUX_BRIDGE_EBT_NAT_H
4190 +#define __LINUX_BRIDGE_EBT_NAT_H
4191 +
4192 +struct ebt_nat_info
4193 +{
4194 +       unsigned char mac[ETH_ALEN];
4195 +       // EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN
4196 +       int target;
4197 +};
4198 +#define EBT_SNAT_TARGET "snat"
4199 +#define EBT_DNAT_TARGET "dnat"
4200 +
4201 +#endif
4202 --- /dev/null   Thu Aug 24 11:00:32 2000
4203 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_redirect.h       Fri Aug  8 01:09:06 2003
4204 @@ -0,0 +1,11 @@
4205 +#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
4206 +#define __LINUX_BRIDGE_EBT_REDIRECT_H
4207 +
4208 +struct ebt_redirect_info
4209 +{
4210 +       // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
4211 +       int target;
4212 +};
4213 +#define EBT_REDIRECT_TARGET "redirect"
4214 +
4215 +#endif
4216 --- /dev/null   Thu Aug 24 11:00:32 2000
4217 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_mark_m.h Fri Aug  8 01:09:06 2003
4218 @@ -0,0 +1,15 @@
4219 +#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
4220 +#define __LINUX_BRIDGE_EBT_MARK_M_H
4221 +
4222 +#define EBT_MARK_AND 0x01
4223 +#define EBT_MARK_OR 0x02
4224 +#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
4225 +struct ebt_mark_m_info
4226 +{
4227 +       unsigned long mark, mask;
4228 +       uint8_t invert;
4229 +       uint8_t bitmask;
4230 +};
4231 +#define EBT_MARK_MATCH "mark_m"
4232 +
4233 +#endif
4234 --- /dev/null   Thu Aug 24 11:00:32 2000
4235 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_mark_t.h Fri Aug  8 01:09:06 2003
4236 @@ -0,0 +1,12 @@
4237 +#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
4238 +#define __LINUX_BRIDGE_EBT_MARK_T_H
4239 +
4240 +struct ebt_mark_t_info
4241 +{
4242 +       unsigned long mark;
4243 +       // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
4244 +       int target;
4245 +};
4246 +#define EBT_MARK_TARGET "mark"
4247 +
4248 +#endif
4249 --- linux-2.4.21/include/linux/netfilter.h      Thu Nov 22 20:47:48 2001
4250 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter.h   Fri Aug  8 01:09:06 2003
4251 @@ -117,28 +117,34 @@ extern struct list_head nf_hooks[NPROTO]
4252  /* This is gross, but inline doesn't cut it for avoiding the function
4253     call in fast path: gcc doesn't inline (needs value tracking?). --RR */
4254  #ifdef CONFIG_NETFILTER_DEBUG
4255 -#define NF_HOOK nf_hook_slow
4256 +#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)                    \
4257 +nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn), INT_MIN)
4258 +#define NF_HOOK_THRESH nf_hook_slow
4259  #else
4260  #define NF_HOOK(pf, hook, skb, indev, outdev, okfn)                    \
4261  (list_empty(&nf_hooks[(pf)][(hook)])                                   \
4262   ? (okfn)(skb)                                                         \
4263 - : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn)))
4264 + : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn), INT_MIN))
4265 +#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)     \
4266 +(list_empty(&nf_hooks[(pf)][(hook)])                                   \
4267 + ? (okfn)(skb)                                                         \
4268 + : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn), (thresh)))
4269  #endif
4270
4271  int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
4272                  struct net_device *indev, struct net_device *outdev,
4273 -                int (*okfn)(struct sk_buff *));
4274 +                int (*okfn)(struct sk_buff *), int thresh);
4275
4276  /* Call setsockopt() */
4277 -int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
4278 +int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
4279                   int len);
4280  int nf_getsockopt(struct sock *sk, int pf, int optval, char *opt,
4281                   int *len);
4282
4283  /* Packet queuing */
4284 -typedef int (*nf_queue_outfn_t)(struct sk_buff *skb,
4285 +typedef int (*nf_queue_outfn_t)(struct sk_buff *skb,
4286                                  struct nf_info *info, void *data);
4287 -extern int nf_register_queue_handler(int pf,
4288 +extern int nf_register_queue_handler(int pf,
4289                                       nf_queue_outfn_t outfn, void *data);
4290  extern int nf_unregister_queue_handler(int pf);
4291  extern void nf_reinject(struct sk_buff *skb,
4292 --- linux-2.4.21/include/linux/netfilter_ipv4.h Mon Feb 25 20:38:13 2002
4293 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_ipv4.h      Fri Aug  8 01:09:06 2003
4294 @@ -52,8 +52,10 @@
4295  enum nf_ip_hook_priorities {
4296         NF_IP_PRI_FIRST = INT_MIN,
4297         NF_IP_PRI_CONNTRACK = -200,
4298 +       NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
4299         NF_IP_PRI_MANGLE = -150,
4300         NF_IP_PRI_NAT_DST = -100,
4301 +       NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
4302         NF_IP_PRI_FILTER = 0,
4303         NF_IP_PRI_NAT_SRC = 100,
4304         NF_IP_PRI_LAST = INT_MAX,
4305 --- linux-2.4.21/include/linux/skbuff.h Fri Jun 13 16:51:39 2003
4306 +++ linux-2.4.21-ebt-brnf-3/include/linux/skbuff.h      Fri Aug  8 01:09:06 2003
4307 @@ -92,6 +92,17 @@ struct nf_conntrack {
4308  struct nf_ct_info {
4309         struct nf_conntrack *master;
4310  };
4311 +
4312 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4313 +struct nf_bridge_info {
4314 +       atomic_t use;
4315 +       struct net_device *physindev;
4316 +       struct net_device *physoutdev;
4317 +       unsigned int mask;
4318 +       unsigned long hh[16 / sizeof(unsigned long)];
4319 +};
4320 +#endif
4321 +
4322  #endif
4323
4324  struct sk_buff_head {
4325 @@ -204,6 +215,9 @@ struct sk_buff {
4326  #ifdef CONFIG_NETFILTER_DEBUG
4327          unsigned int nf_debug;
4328  #endif
4329 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4330 +       struct nf_bridge_info   *nf_bridge;     /* Saved data about a bridged frame - see br_netfilter.c */
4331 +#endif
4332  #endif /*CONFIG_NETFILTER*/
4333
4334  #if defined(CONFIG_HIPPI)
4335 @@ -278,7 +292,7 @@ static inline struct sk_buff *skb_get(st
4336   * If users==1, we are the only owner and are can avoid redundant
4337   * atomic change.
4338   */
4339 -
4340 +
4341  /**
4342   *     kfree_skb - free an sk_buff
4343   *     @skb: buffer to free
4344 @@ -286,7 +300,7 @@ static inline struct sk_buff *skb_get(st
4345   *     Drop a reference to the buffer and free it if the usage count has
4346   *     hit zero.
4347   */
4348 -
4349 +
4350  static inline void kfree_skb(struct sk_buff *skb)
4351  {
4352         if (atomic_read(&skb->users) == 1 || atomic_dec_and_test(&skb->users))
4353 @@ -1165,6 +1179,20 @@ nf_conntrack_get(struct nf_ct_info *nfct
4354         if (nfct)
4355                 atomic_inc(&nfct->master->use);
4356  }
4357 +
4358 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4359 +static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
4360 +{
4361 +       if (nf_bridge && atomic_dec_and_test(&nf_bridge->use))
4362 +               kfree(nf_bridge);
4363 +}
4364 +static inline void nf_bridge_get(struct nf_bridge_info *nf_bridge)
4365 +{
4366 +       if (nf_bridge)
4367 +               atomic_inc(&nf_bridge->use);
4368 +}
4369 +#endif
4370 +
4371  #endif
4372
4373  #endif /* __KERNEL__ */
4374 --- linux-2.4.21/net/core/netfilter.c   Sat Aug  3 02:39:46 2002
4375 +++ linux-2.4.21-ebt-brnf-3/net/core/netfilter.c        Fri Aug  8 01:09:06 2003
4376 @@ -1,4 +1,4 @@
4377 -/* netfilter.c: look after the filters for various protocols.
4378 +/* netfilter.c: look after the filters for various protocols.
4379   * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
4380   *
4381   * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
4382 @@ -342,10 +342,15 @@ static unsigned int nf_iterate(struct li
4383                                const struct net_device *indev,
4384                                const struct net_device *outdev,
4385                                struct list_head **i,
4386 -                              int (*okfn)(struct sk_buff *))
4387 +                              int (*okfn)(struct sk_buff *),
4388 +                              int hook_thresh)
4389  {
4390         for (*i = (*i)->next; *i != head; *i = (*i)->next) {
4391                 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
4392 +
4393 +               if (hook_thresh > elem->priority)
4394 +                       continue;
4395 +
4396                 switch (elem->hook(hook, skb, indev, outdev, okfn)) {
4397                 case NF_QUEUE:
4398                         return NF_QUEUE;
4399 @@ -365,7 +370,7 @@ static unsigned int nf_iterate(struct li
4400                         break;
4401
4402                 default:
4403 -                       NFDEBUG("Evil return from %p(%u).\n",
4404 +                       NFDEBUG("Evil return from %p(%u).\n",
4405                                 elem->hook, hook);
4406  #endif
4407                 }
4408 @@ -374,7 +379,7 @@ static unsigned int nf_iterate(struct li
4409  }
4410
4411  int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)
4412 -{
4413 +{
4414         int ret;
4415
4416         br_write_lock_bh(BR_NETPROTO_LOCK);
4417 @@ -400,12 +405,12 @@ int nf_unregister_queue_handler(int pf)
4418         return 0;
4419  }
4420
4421 -/*
4422 - * Any packet that leaves via this function must come back
4423 +/*
4424 + * Any packet that leaves via this function must come back
4425   * through nf_reinject().
4426   */
4427 -static void nf_queue(struct sk_buff *skb,
4428 -                    struct list_head *elem,
4429 +static void nf_queue(struct sk_buff *skb,
4430 +                    struct list_head *elem,
4431                      int pf, unsigned int hook,
4432                      struct net_device *indev,
4433                      struct net_device *outdev,
4434 @@ -413,6 +418,10 @@ static void nf_queue(struct sk_buff *skb
4435  {
4436         int status;
4437         struct nf_info *info;
4438 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4439 +       struct net_device *physindev = NULL;
4440 +       struct net_device *physoutdev = NULL;
4441 +#endif
4442
4443         if (!queue_handler[pf].outfn) {
4444                 kfree_skb(skb);
4445 @@ -428,18 +437,31 @@ static void nf_queue(struct sk_buff *skb
4446                 return;
4447         }
4448
4449 -       *info = (struct nf_info) {
4450 +       *info = (struct nf_info) {
4451                 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
4452
4453         /* Bump dev refs so they don't vanish while packet is out */
4454         if (indev) dev_hold(indev);
4455         if (outdev) dev_hold(outdev);
4456
4457 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4458 +       if (skb->nf_bridge) {
4459 +               physindev = skb->nf_bridge->physindev;
4460 +               if (physindev) dev_hold(physindev);
4461 +               physoutdev = skb->nf_bridge->physoutdev;
4462 +               if (physoutdev) dev_hold(physoutdev);
4463 +       }
4464 +#endif
4465 +
4466         status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data);
4467         if (status < 0) {
4468                 /* James M doesn't say fuck enough. */
4469                 if (indev) dev_put(indev);
4470                 if (outdev) dev_put(outdev);
4471 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4472 +               if (physindev) dev_put(physindev);
4473 +               if (physoutdev) dev_put(physoutdev);
4474 +#endif
4475                 kfree(info);
4476                 kfree_skb(skb);
4477                 return;
4478 @@ -449,7 +471,8 @@ static void nf_queue(struct sk_buff *skb
4479  int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
4480                  struct net_device *indev,
4481                  struct net_device *outdev,
4482 -                int (*okfn)(struct sk_buff *))
4483 +                int (*okfn)(struct sk_buff *),
4484 +                int hook_thresh)
4485  {
4486         struct list_head *elem;
4487         unsigned int verdict;
4488 @@ -481,7 +504,7 @@ int nf_hook_slow(int pf, unsigned int ho
4489
4490         elem = &nf_hooks[pf][hook];
4491         verdict = nf_iterate(&nf_hooks[pf][hook], &skb, hook, indev,
4492 -                            outdev, &elem, okfn);
4493 +                            outdev, &elem, okfn, hook_thresh);
4494         if (verdict == NF_QUEUE) {
4495                 NFDEBUG("nf_hook: Verdict = QUEUE.\n");
4496                 nf_queue(skb, elem, pf, hook, indev, outdev, okfn);
4497 @@ -510,6 +533,14 @@ void nf_reinject(struct sk_buff *skb, st
4498
4499         /* We don't have BR_NETPROTO_LOCK here */
4500         br_read_lock_bh(BR_NETPROTO_LOCK);
4501 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4502 +       if (skb->nf_bridge) {
4503 +               if (skb->nf_bridge->physindev)
4504 +                       dev_put(skb->nf_bridge->physindev);
4505 +               if (skb->nf_bridge->physoutdev)
4506 +                       dev_put(skb->nf_bridge->physoutdev);
4507 +       }
4508 +#endif
4509         for (i = nf_hooks[info->pf][info->hook].next; i != elem; i = i->next) {
4510                 if (i == &nf_hooks[info->pf][info->hook]) {
4511                         /* The module which sent it to userspace is gone. */
4512 @@ -528,9 +559,9 @@ void nf_reinject(struct sk_buff *skb, st
4513
4514         if (verdict == NF_ACCEPT) {
4515                 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
4516 -                                    &skb, info->hook,
4517 +                                    &skb, info->hook,
4518                                      info->indev, info->outdev, &elem,
4519 -                                    info->okfn);
4520 +                                    info->okfn, INT_MIN);
4521         }
4522
4523         switch (verdict) {
4524 @@ -539,20 +570,19 @@ void nf_reinject(struct sk_buff *skb, st
4525                 break;
4526
4527         case NF_QUEUE:
4528 -               nf_queue(skb, elem, info->pf, info->hook,
4529 +               nf_queue(skb, elem, info->pf, info->hook,
4530                          info->indev, info->outdev, info->okfn);
4531                 break;
4532 -
4533 -       case NF_DROP:
4534 -               kfree_skb(skb);
4535 -               break;
4536         }
4537         br_read_unlock_bh(BR_NETPROTO_LOCK);
4538
4539         /* Release those devices we held, or Alexey will kill me. */
4540         if (info->indev) dev_put(info->indev);
4541         if (info->outdev) dev_put(info->outdev);
4542 -
4543 +
4544 +       if (verdict == NF_DROP)
4545 +               kfree_skb(skb);
4546 +
4547         kfree(info);
4548         return;
4549  }
4550 --- linux-2.4.21/net/core/skbuff.c      Fri Jun 13 16:51:39 2003
4551 +++ linux-2.4.21-ebt-brnf-3/net/core/skbuff.c   Fri Aug  8 01:09:06 2003
4552 @@ -245,6 +245,9 @@ static inline void skb_headerinit(void *
4553  #ifdef CONFIG_NETFILTER_DEBUG
4554         skb->nf_debug = 0;
4555  #endif
4556 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4557 +       skb->nf_bridge    = NULL;
4558 +#endif
4559  #endif
4560  #ifdef CONFIG_NET_SCHED
4561         skb->tc_index = 0;
4562 @@ -325,6 +328,9 @@ void __kfree_skb(struct sk_buff *skb)
4563         }
4564  #ifdef CONFIG_NETFILTER
4565         nf_conntrack_put(skb->nfct);
4566 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4567 +       nf_bridge_put(skb->nf_bridge);
4568 +#endif
4569  #endif
4570         skb_headerinit(skb, NULL, 0);  /* clean state */
4571         kfree_skbmem(skb);
4572 @@ -391,6 +397,9 @@ struct sk_buff *skb_clone(struct sk_buff
4573  #ifdef CONFIG_NETFILTER_DEBUG
4574         C(nf_debug);
4575  #endif
4576 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4577 +       C(nf_bridge);
4578 +#endif
4579  #endif /*CONFIG_NETFILTER*/
4580  #if defined(CONFIG_HIPPI)
4581         C(private);
4582 @@ -403,6 +412,9 @@ struct sk_buff *skb_clone(struct sk_buff
4583         skb->cloned = 1;
4584  #ifdef CONFIG_NETFILTER
4585         nf_conntrack_get(skb->nfct);
4586 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4587 +       nf_bridge_get(skb->nf_bridge);
4588 +#endif
4589  #endif
4590         return n;
4591  }
4592 @@ -436,6 +448,10 @@ static void copy_skb_header(struct sk_bu
4593         nf_conntrack_get(new->nfct);
4594  #ifdef CONFIG_NETFILTER_DEBUG
4595         new->nf_debug=old->nf_debug;
4596 +#endif
4597 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4598 +       new->nf_bridge=old->nf_bridge;
4599 +       nf_bridge_get(new->nf_bridge);
4600  #endif
4601  #endif
4602  #ifdef CONFIG_NET_SCHED
4603 --- linux-2.4.21/net/ipv4/netfilter/ip_tables.c Fri Jun 13 16:51:39 2003
4604 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/ip_tables.c      Fri Aug  8 01:09:06 2003
4605 @@ -121,12 +121,19 @@ static LIST_HEAD(ipt_tables);
4606  static inline int
4607  ip_packet_match(const struct iphdr *ip,
4608                 const char *indev,
4609 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4610 +               const char *physindev,
4611 +#endif
4612                 const char *outdev,
4613 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4614 +               const char *physoutdev,
4615 +#endif
4616                 const struct ipt_ip *ipinfo,
4617                 int isfrag)
4618  {
4619         size_t i;
4620         unsigned long ret;
4621 +       unsigned long ret2 = 1;
4622
4623  #define FWINV(bool,invflg) ((bool) ^ !!(ipinfo->invflags & invflg))
4624
4625 @@ -156,7 +163,15 @@ ip_packet_match(const struct iphdr *ip,
4626                         & ((const unsigned long *)ipinfo->iniface_mask)[i];
4627         }
4628
4629 -       if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
4630 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4631 +       for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
4632 +               ret2 |= (((const unsigned long *)physindev)[i]
4633 +                       ^ ((const unsigned long *)ipinfo->iniface)[i])
4634 +                       & ((const unsigned long *)ipinfo->iniface_mask)[i];
4635 +       }
4636 +#endif
4637 +
4638 +       if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_IN)) {
4639                 dprintf("VIA in mismatch (%s vs %s).%s\n",
4640                         indev, ipinfo->iniface,
4641                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
4642 @@ -169,7 +184,15 @@ ip_packet_match(const struct iphdr *ip,
4643                         & ((const unsigned long *)ipinfo->outiface_mask)[i];
4644         }
4645
4646 -       if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
4647 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4648 +       for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
4649 +               ret2 |= (((const unsigned long *)physoutdev)[i]
4650 +                       ^ ((const unsigned long *)ipinfo->outiface)[i])
4651 +                       & ((const unsigned long *)ipinfo->outiface_mask)[i];
4652 +       }
4653 +#endif
4654 +
4655 +       if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_OUT)) {
4656                 dprintf("VIA out mismatch (%s vs %s).%s\n",
4657                         outdev, ipinfo->outiface,
4658                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
4659 @@ -268,6 +291,9 @@ ipt_do_table(struct sk_buff **pskb,
4660         /* Initializing verdict to NF_DROP keeps gcc happy. */
4661         unsigned int verdict = NF_DROP;
4662         const char *indev, *outdev;
4663 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4664 +       const char *physindev, *physoutdev;
4665 +#endif
4666         void *table_base;
4667         struct ipt_entry *e, *back;
4668
4669 @@ -277,6 +303,13 @@ ipt_do_table(struct sk_buff **pskb,
4670         datalen = (*pskb)->len - ip->ihl * 4;
4671         indev = in ? in->name : nulldevname;
4672         outdev = out ? out->name : nulldevname;
4673 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4674 +       physindev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physindev) ?
4675 +               (*pskb)->nf_bridge->physindev->name : nulldevname;
4676 +       physoutdev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physoutdev) ?
4677 +               (*pskb)->nf_bridge->physoutdev->name : nulldevname;
4678 +#endif
4679 +
4680         /* We handle fragments by dealing with the first fragment as
4681          * if it was a normal packet.  All other fragments are treated
4682          * normally, except that they will NEVER match rules that ask
4683 @@ -312,7 +345,15 @@ ipt_do_table(struct sk_buff **pskb,
4684                 IP_NF_ASSERT(e);
4685                 IP_NF_ASSERT(back);
4686                 (*pskb)->nfcache |= e->nfcache;
4687 -               if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
4688 +               if (ip_packet_match(ip, indev,
4689 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4690 +                   physindev,
4691 +#endif
4692 +                   outdev,
4693 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4694 +                   physoutdev,
4695 +#endif
4696 +                   &e->ip, offset)) {
4697                         struct ipt_entry_target *t;
4698
4699                         if (IPT_MATCH_ITERATE(e, do_match,
4700 --- linux-2.4.21/net/ipv4/ip_output.c   Fri Nov 29 00:53:15 2002
4701 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/ip_output.c        Fri Aug  8 01:09:06 2003
4702 @@ -879,6 +879,10 @@ int ip_fragment(struct sk_buff *skb, int
4703                 /* Connection association is same as pre-frag packet */
4704                 skb2->nfct = skb->nfct;
4705                 nf_conntrack_get(skb2->nfct);
4706 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4707 +               skb2->nf_bridge = skb->nf_bridge;
4708 +               nf_bridge_get(skb2->nf_bridge);
4709 +#endif
4710  #ifdef CONFIG_NETFILTER_DEBUG
4711                 skb2->nf_debug = skb->nf_debug;
4712  #endif
4713 --- linux-2.4.21/net/ipv4/netfilter/ipt_LOG.c   Mon Feb 25 20:38:14 2002
4714 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/ipt_LOG.c        Fri Aug  8 01:09:06 2003
4715 @@ -289,6 +289,18 @@ ipt_log_target(struct sk_buff **pskb,
4716                loginfo->prefix,
4717                in ? in->name : "",
4718                out ? out->name : "");
4719 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4720 +       if ((*pskb)->nf_bridge) {
4721 +               struct net_device *physindev = (*pskb)->nf_bridge->physindev;
4722 +               struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
4723 +
4724 +               if (physindev && in != physindev)
4725 +                       printk("PHYSIN=%s ", physindev->name);
4726 +               if (physoutdev && out != physoutdev)
4727 +                       printk("PHYSOUT=%s ", physoutdev->name);
4728 +       }
4729 +#endif
4730 +
4731         if (in && !out) {
4732                 /* MAC logging for input chain only. */
4733                 printk("MAC=");
4734 --- linux-2.4.21/net/ipv4/netfilter/Makefile    Fri Jun 13 16:51:39 2003
4735 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/Makefile Fri Aug  8 01:09:06 2003
4736 @@ -84,6 +84,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i
4737  obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
4738  obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
4739
4740 +obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
4741 +
4742  # targets
4743  obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
4744  obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o
4745 --- linux-2.4.21/net/ipv4/netfilter/Config.in   Fri Jun 13 16:51:39 2003
4746 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/Config.in        Fri Aug  8 01:09:06 2003
4747 @@ -43,6 +43,9 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
4748      dep_tristate '  Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
4749      dep_tristate '  Owner match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_OWNER $CONFIG_IP_NF_IPTABLES
4750    fi
4751 +  if [ "$CONFIG_BRIDGE" != "n" ]; then
4752 +    dep_tristate '  Physdev match support' CONFIG_IP_NF_MATCH_PHYSDEV
4753 +  fi
4754  # The targets
4755    dep_tristate '  Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
4756    if [ "$CONFIG_IP_NF_FILTER" != "n" ]; then
4757 --- /dev/null   Thu Aug 24 11:00:32 2000
4758 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_netfilter.c   Fri Aug  8 01:09:06 2003
4759 @@ -0,0 +1,636 @@
4760 +/*
4761 + *     Handle firewalling
4762 + *     Linux ethernet bridge
4763 + *
4764 + *     Authors:
4765 + *     Lennert Buytenhek               <buytenh@gnu.org>
4766 + *     Bart De Schuymer                <bdschuym@pandora.be>
4767 + *
4768 + *     This program is free software; you can redistribute it and/or
4769 + *     modify it under the terms of the GNU General Public License
4770 + *     as published by the Free Software Foundation; either version
4771 + *     2 of the License, or (at your option) any later version.
4772 + *
4773 + *     Lennert dedicates this file to Kerstin Wurdinger.
4774 + */
4775 +
4776 +#include <linux/module.h>
4777 +#include <linux/kernel.h>
4778 +#include <linux/ip.h>
4779 +#include <linux/netdevice.h>
4780 +#include <linux/skbuff.h>
4781 +#include <linux/if_ether.h>
4782 +#include <linux/netfilter_bridge.h>
4783 +#include <linux/netfilter_ipv4.h>
4784 +#include <linux/in_route.h>
4785 +#include <net/ip.h>
4786 +#include <asm/uaccess.h>
4787 +#include <asm/checksum.h>
4788 +#include "br_private.h"
4789 +
4790 +
4791 +#define skb_origaddr(skb)       (((struct bridge_skb_cb *) \
4792 +                                (skb->cb))->daddr.ipv4)
4793 +#define store_orig_dstaddr(skb)         (skb_origaddr(skb) = (skb)->nh.iph->daddr)
4794 +#define dnat_took_place(skb)    (skb_origaddr(skb) != (skb)->nh.iph->daddr)
4795 +#define clear_cb(skb)           (memset(&skb_origaddr(skb), 0, \
4796 +                                sizeof(struct bridge_skb_cb)))
4797 +
4798 +#define has_bridge_parent(device)      ((device)->br_port != NULL)
4799 +#define bridge_parent(device)          (&((device)->br_port->br->dev))
4800 +
4801 +/* We need these fake structures to make netfilter happy --
4802 + * lots of places assume that skb->dst != NULL, which isn't
4803 + * all that unreasonable.
4804 + *
4805 + * Currently, we fill in the PMTU entry because netfilter
4806 + * refragmentation needs it, and the rt_flags entry because
4807 + * ipt_REJECT needs it.  Future netfilter modules might
4808 + * require us to fill additional fields.
4809 + */
4810 +static struct net_device __fake_net_device = {
4811 +       .hard_header_len        = ETH_HLEN
4812 +};
4813 +
4814 +static struct rtable __fake_rtable = {
4815 +       u: {
4816 +               dst: {
4817 +                       __refcnt:               ATOMIC_INIT(1),
4818 +                       dev:                    &__fake_net_device,
4819 +                       pmtu:                   1500
4820 +               }
4821 +       },
4822 +
4823 +       rt_flags:       0
4824 +};
4825 +
4826 +
4827 +/* PF_BRIDGE/PRE_ROUTING *********************************************/
4828 +static void __br_dnat_complain(void)
4829 +{
4830 +       static unsigned long last_complaint = 0;
4831 +
4832 +       if (jiffies - last_complaint >= 5 * HZ) {
4833 +               printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
4834 +                       "forwarding to be enabled\n");
4835 +               last_complaint = jiffies;
4836 +       }
4837 +}
4838 +
4839 +
4840 +/* This requires some explaining. If DNAT has taken place,
4841 + * we will need to fix up the destination Ethernet address,
4842 + * and this is a tricky process.
4843 + *
4844 + * There are two cases to consider:
4845 + * 1. The packet was DNAT'ed to a device in the same bridge
4846 + *    port group as it was received on. We can still bridge
4847 + *    the packet.
4848 + * 2. The packet was DNAT'ed to a different device, either
4849 + *    a non-bridged device or another bridge port group.
4850 + *    The packet will need to be routed.
4851 + *
4852 + * The correct way of distinguishing between these two cases is to
4853 + * call ip_route_input() and to look at skb->dst->dev, which is
4854 + * changed to the destination device if ip_route_input() succeeds.
4855 + *
4856 + * Let us first consider the case that ip_route_input() succeeds:
4857 + *
4858 + * If skb->dst->dev equals the logical bridge device the packet
4859 + * came in on, we can consider this bridging. We then call
4860 + * skb->dst->output() which will make the packet enter br_nf_local_out()
4861 + * not much later. In that function it is assured that the iptables
4862 + * FORWARD chain is traversed for the packet.
4863 + *
4864 + * Otherwise, the packet is considered to be routed and we just
4865 + * change the destination MAC address so that the packet will
4866 + * later be passed up to the IP stack to be routed.
4867 + *
4868 + * Let us now consider the case that ip_route_input() fails:
4869 + *
4870 + * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
4871 + * will fail, while __ip_route_output_key() will return success. The source
4872 + * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
4873 + * thinks we're handling a locally generated packet and won't care
4874 + * if IP forwarding is allowed. We send a warning message to the users's
4875 + * log telling her to put IP forwarding on.
4876 + *
4877 + * ip_route_input() will also fail if there is no route available.
4878 + * In that case we just drop the packet.
4879 + *
4880 + * --Lennert, 20020411
4881 + * --Bart, 20020416 (updated)
4882 + * --Bart, 20021007 (updated)
4883 + */
4884 +
4885 +static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
4886 +{
4887 +#ifdef CONFIG_NETFILTER_DEBUG
4888 +       skb->nf_debug |= (1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_FORWARD);
4889 +#endif
4890 +
4891 +       if (skb->pkt_type == PACKET_OTHERHOST) {
4892 +               skb->pkt_type = PACKET_HOST;
4893 +               skb->nf_bridge->mask |= BRNF_PKT_TYPE;
4894 +       }
4895 +
4896 +       skb->dev = bridge_parent(skb->dev);
4897 +       skb->dst->output(skb);
4898 +       return 0;
4899 +}
4900 +
4901 +static int br_nf_pre_routing_finish(struct sk_buff *skb)
4902 +{
4903 +       struct net_device *dev = skb->dev;
4904 +       struct iphdr *iph = skb->nh.iph;
4905 +       struct nf_bridge_info *nf_bridge = skb->nf_bridge;
4906 +
4907 +#ifdef CONFIG_NETFILTER_DEBUG
4908 +       skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
4909 +#endif
4910 +
4911 +       if (nf_bridge->mask & BRNF_PKT_TYPE) {
4912 +               skb->pkt_type = PACKET_OTHERHOST;
4913 +               nf_bridge->mask ^= BRNF_PKT_TYPE;
4914 +       }
4915 +
4916 +       if (dnat_took_place(skb)) {
4917 +               if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
4918 +                   dev)) {
4919 +                       struct rtable *rt;
4920 +
4921 +                       if (!ip_route_output(&rt, iph->daddr, 0, iph->tos, 0)) {
4922 +                               /* Bridged-and-DNAT'ed traffic doesn't
4923 +                                * require ip_forwarding.
4924 +                                */
4925 +                               if (((struct dst_entry *)rt)->dev == dev) {
4926 +                                       skb->dst = (struct dst_entry *)rt;
4927 +                                       goto bridged_dnat;
4928 +                               }
4929 +                               __br_dnat_complain();
4930 +                               dst_release((struct dst_entry *)rt);
4931 +                       }
4932 +                       kfree_skb(skb);
4933 +                       return 0;
4934 +               } else {
4935 +                       if (skb->dst->dev == dev) {
4936 +bridged_dnat:
4937 +                               /* Tell br_nf_local_out this is a
4938 +                                * bridged frame
4939 +                                */
4940 +                               nf_bridge->mask |= BRNF_BRIDGED_DNAT;
4941 +                               skb->dev = nf_bridge->physindev;
4942 +                               clear_cb(skb);
4943 +                               NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
4944 +                                              skb, skb->dev, NULL,
4945 +                                              br_nf_pre_routing_finish_bridge,
4946 +                                              1);
4947 +                               return 0;
4948 +                       }
4949 +                       memcpy(skb->mac.ethernet->h_dest, dev->dev_addr,
4950 +                              ETH_ALEN);
4951 +               }
4952 +       } else {
4953 +               skb->dst = (struct dst_entry *)&__fake_rtable;
4954 +               dst_hold(skb->dst);
4955 +       }
4956 +
4957 +       clear_cb(skb);
4958 +       skb->dev = nf_bridge->physindev;
4959 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
4960 +                      br_handle_frame_finish, 1);
4961 +
4962 +       return 0;
4963 +}
4964 +
4965 +/* Replicate the checks that IPv4 does on packet reception.
4966 + * Set skb->dev to the bridge device (i.e. parent of the
4967 + * receiving device) to make netfilter happy, the REDIRECT
4968 + * target in particular.  Save the original destination IP
4969 + * address to be able to detect DNAT afterwards.
4970 + */
4971 +static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
4972 +   const struct net_device *in, const struct net_device *out,
4973 +   int (*okfn)(struct sk_buff *))
4974 +{
4975 +       struct iphdr *iph;
4976 +       __u32 len;
4977 +       struct sk_buff *skb;
4978 +       struct nf_bridge_info *nf_bridge;
4979 +
4980 +       if ((*pskb)->protocol != __constant_htons(ETH_P_IP))
4981 +               return NF_ACCEPT;
4982 +
4983 +       if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
4984 +               goto out;
4985 +
4986 +       if (!pskb_may_pull(skb, sizeof(struct iphdr)))
4987 +               goto inhdr_error;
4988 +
4989 +       iph = skb->nh.iph;
4990 +       if (iph->ihl < 5 || iph->version != 4)
4991 +               goto inhdr_error;
4992 +
4993 +       if (!pskb_may_pull(skb, 4*iph->ihl))
4994 +               goto inhdr_error;
4995 +
4996 +       iph = skb->nh.iph;
4997 +       if (ip_fast_csum((__u8 *)iph, iph->ihl) != 0)
4998 +               goto inhdr_error;
4999 +
5000 +       len = ntohs(iph->tot_len);
5001 +       if (skb->len < len || len < 4*iph->ihl)
5002 +               goto inhdr_error;
5003 +
5004 +       if (skb->len > len) {
5005 +               __pskb_trim(skb, len);
5006 +               if (skb->ip_summed == CHECKSUM_HW)
5007 +                       skb->ip_summed = CHECKSUM_NONE;
5008 +       }
5009 +
5010 +#ifdef CONFIG_NETFILTER_DEBUG
5011 +       skb->nf_debug ^= (1 << NF_IP_PRE_ROUTING);
5012 +#endif
5013 +       if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
5014 +               return NF_DROP;
5015 +
5016 +       if (skb->pkt_type == PACKET_OTHERHOST) {
5017 +               skb->pkt_type = PACKET_HOST;
5018 +               nf_bridge->mask |= BRNF_PKT_TYPE;
5019 +       }
5020 +
5021 +       nf_bridge->physindev = skb->dev;
5022 +       skb->dev = bridge_parent(skb->dev);
5023 +       store_orig_dstaddr(skb);
5024 +
5025 +       NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
5026 +               br_nf_pre_routing_finish);
5027 +
5028 +       return NF_STOLEN;
5029 +
5030 +inhdr_error:
5031 +//     IP_INC_STATS_BH(IpInHdrErrors);
5032 +out:
5033 +       return NF_DROP;
5034 +}
5035 +
5036 +
5037 +/* PF_BRIDGE/LOCAL_IN ************************************************/
5038 +/* The packet is locally destined, which requires a real
5039 + * dst_entry, so detach the fake one.  On the way up, the
5040 + * packet would pass through PRE_ROUTING again (which already
5041 + * took place when the packet entered the bridge), but we
5042 + * register an IPv4 PRE_ROUTING 'sabotage' hook that will
5043 + * prevent this from happening.
5044 + */
5045 +static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
5046 +   const struct net_device *in, const struct net_device *out,
5047 +   int (*okfn)(struct sk_buff *))
5048 +{
5049 +       struct sk_buff *skb = *pskb;
5050 +
5051 +       if (skb->protocol != __constant_htons(ETH_P_IP))
5052 +               return NF_ACCEPT;
5053 +
5054 +       if (skb->dst == (struct dst_entry *)&__fake_rtable) {
5055 +               dst_release(skb->dst);
5056 +               skb->dst = NULL;
5057 +       }
5058 +
5059 +       return NF_ACCEPT;
5060 +}
5061 +
5062 +
5063 +/* PF_BRIDGE/FORWARD *************************************************/
5064 +static int br_nf_forward_finish(struct sk_buff *skb)
5065 +{
5066 +       struct nf_bridge_info *nf_bridge = skb->nf_bridge;
5067 +
5068 +#ifdef CONFIG_NETFILTER_DEBUG
5069 +       skb->nf_debug ^= (1 << NF_BR_FORWARD);
5070 +#endif
5071 +
5072 +       if (nf_bridge->mask & BRNF_PKT_TYPE) {
5073 +               skb->pkt_type = PACKET_OTHERHOST;
5074 +               nf_bridge->mask ^= BRNF_PKT_TYPE;
5075 +       }
5076 +
5077 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, nf_bridge->physindev,
5078 +                       skb->dev, br_forward_finish, 1);
5079 +
5080 +       return 0;
5081 +}
5082 +
5083 +/* This is the 'purely bridged' case.  We pass the packet to
5084 + * netfilter with indev and outdev set to the bridge device,
5085 + * but we are still able to filter on the 'real' indev/outdev
5086 + * because of the ipt_physdev.c module.
5087 + */
5088 +static unsigned int br_nf_forward(unsigned int hook, struct sk_buff **pskb,
5089 +   const struct net_device *in, const struct net_device *out,
5090 +   int (*okfn)(struct sk_buff *))
5091 +{
5092 +       struct sk_buff *skb = *pskb;
5093 +       struct nf_bridge_info *nf_bridge;
5094 +
5095 +       if (skb->protocol != __constant_htons(ETH_P_IP))
5096 +               return NF_ACCEPT;
5097 +
5098 +#ifdef CONFIG_NETFILTER_DEBUG
5099 +       skb->nf_debug ^= (1 << NF_BR_FORWARD);
5100 +#endif
5101 +
5102 +       nf_bridge = skb->nf_bridge;
5103 +       if (skb->pkt_type == PACKET_OTHERHOST) {
5104 +               skb->pkt_type = PACKET_HOST;
5105 +               nf_bridge->mask |= BRNF_PKT_TYPE;
5106 +       }
5107 +
5108 +       nf_bridge->mask |= BRNF_BRIDGED; /* The physdev module checks on this */
5109 +       nf_bridge->physoutdev = skb->dev;
5110 +
5111 +       NF_HOOK(PF_INET, NF_IP_FORWARD, skb, bridge_parent(nf_bridge->physindev),
5112 +                       bridge_parent(skb->dev), br_nf_forward_finish);
5113 +
5114 +       return NF_STOLEN;
5115 +}
5116 +
5117 +
5118 +/* PF_BRIDGE/LOCAL_OUT ***********************************************/
5119 +static int br_nf_local_out_finish(struct sk_buff *skb)
5120 +{
5121 +#ifdef CONFIG_NETFILTER_DEBUG
5122 +       skb->nf_debug &= ~(1 << NF_BR_LOCAL_OUT);
5123 +#endif
5124 +
5125 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
5126 +                       br_forward_finish, NF_BR_PRI_FIRST + 1);
5127 +
5128 +       return 0;
5129 +}
5130 +
5131 +
5132 +/* This function sees both locally originated IP packets and forwarded
5133 + * IP packets (in both cases the destination device is a bridge
5134 + * device). It also sees bridged-and-DNAT'ed packets.
5135 + * To be able to filter on the physical bridge devices (with the ipt_physdev.c
5136 + * module), we steal packets destined to a bridge device away from the
5137 + * PF_INET/FORWARD and PF_INET/OUTPUT hook functions, and give them back later,
5138 + * when we have determined the real output device. This is done in here.
5139 + *
5140 + * If (nf_bridge->mask & BRNF_BRIDGED_DNAT) then the packet is bridged
5141 + * and we fake the PF_BRIDGE/FORWARD hook. The function br_nf_forward()
5142 + * will then fake the PF_INET/FORWARD hook. br_nf_local_out() has priority
5143 + * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
5144 + * will be executed.
5145 + * Otherwise, if nf_bridge->physindev is NULL, the bridge-nf code never touched
5146 + * this packet before, and so the packet was locally originated. We fake
5147 + * the PF_INET/LOCAL_OUT hook.
5148 + * Finally, if nf_bridge->physindev isn't NULL, then the packet was IP routed,
5149 + * so we fake the PF_INET/FORWARD hook. ipv4_sabotage_out() makes sure
5150 + * even routed packets that didn't arrive on a bridge interface have their
5151 + * nf_bridge->physindev set.
5152 + */
5153 +
5154 +static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
5155 +   const struct net_device *in, const struct net_device *out,
5156 +   int (*_okfn)(struct sk_buff *))
5157 +{
5158 +       int (*okfn)(struct sk_buff *skb);
5159 +       struct net_device *realindev;
5160 +       struct sk_buff *skb = *pskb;
5161 +       struct nf_bridge_info *nf_bridge;
5162 +
5163 +       if (skb->protocol != __constant_htons(ETH_P_IP))
5164 +               return NF_ACCEPT;
5165 +
5166 +       /* Sometimes we get packets with NULL ->dst here (for example,
5167 +        * running a dhcp client daemon triggers this).
5168 +        */
5169 +       if (skb->dst == NULL)
5170 +               return NF_ACCEPT;
5171 +
5172 +       nf_bridge = skb->nf_bridge;
5173 +       nf_bridge->physoutdev = skb->dev;
5174 +
5175 +       realindev = nf_bridge->physindev;
5176 +
5177 +       /* Bridged, take PF_BRIDGE/FORWARD.
5178 +        * (see big note in front of br_nf_pre_routing_finish)
5179 +        */
5180 +       if (nf_bridge->mask & BRNF_BRIDGED_DNAT) {
5181 +               okfn = br_forward_finish;
5182 +
5183 +               if (nf_bridge->mask & BRNF_PKT_TYPE) {
5184 +                       skb->pkt_type = PACKET_OTHERHOST;
5185 +                       nf_bridge->mask ^= BRNF_PKT_TYPE;
5186 +               }
5187 +
5188 +               NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev,
5189 +                       skb->dev, okfn);
5190 +       } else {
5191 +               okfn = br_nf_local_out_finish;
5192 +               /* IP forwarded traffic has a physindev, locally
5193 +                * generated traffic hasn't.
5194 +                */
5195 +               if (realindev != NULL) {
5196 +                       if (((nf_bridge->mask & BRNF_DONT_TAKE_PARENT) == 0) &&
5197 +                           has_bridge_parent(realindev))
5198 +                               realindev = bridge_parent(realindev);
5199 +
5200 +                       NF_HOOK_THRESH(PF_INET, NF_IP_FORWARD, skb, realindev,
5201 +                                      bridge_parent(skb->dev), okfn,
5202 +                                      NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
5203 +               } else {
5204 +#ifdef CONFIG_NETFILTER_DEBUG
5205 +                       skb->nf_debug ^= (1 << NF_IP_LOCAL_OUT);
5206 +#endif
5207 +
5208 +                       NF_HOOK_THRESH(PF_INET, NF_IP_LOCAL_OUT, skb, realindev,
5209 +                                      bridge_parent(skb->dev), okfn,
5210 +                                      NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
5211 +               }
5212 +       }
5213 +
5214 +       return NF_STOLEN;
5215 +}
5216 +
5217 +
5218 +/* PF_BRIDGE/POST_ROUTING ********************************************/
5219 +static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
5220 +   const struct net_device *in, const struct net_device *out,
5221 +   int (*okfn)(struct sk_buff *))
5222 +{
5223 +       struct sk_buff *skb = *pskb;
5224 +       struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
5225 +
5226 +       /* Be very paranoid. Must be a device driver bug. */
5227 +       if (skb->mac.raw < skb->head || skb->mac.raw + ETH_HLEN > skb->data) {
5228 +               printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
5229 +                                "bad mac.raw pointer.");
5230 +               if (skb->dev != NULL) {
5231 +                       printk("[%s]", skb->dev->name);
5232 +                       if (has_bridge_parent(skb->dev))
5233 +                               printk("[%s]", bridge_parent(skb->dev)->name);
5234 +               }
5235 +               printk("\n");
5236 +               return NF_ACCEPT;
5237 +       }
5238 +
5239 +       if (skb->protocol != __constant_htons(ETH_P_IP))
5240 +               return NF_ACCEPT;
5241 +
5242 +       /* Sometimes we get packets with NULL ->dst here (for example,
5243 +        * running a dhcp client daemon triggers this).
5244 +        */
5245 +       if (skb->dst == NULL)
5246 +               return NF_ACCEPT;
5247 +
5248 +#ifdef CONFIG_NETFILTER_DEBUG
5249 +       skb->nf_debug ^= (1 << NF_IP_POST_ROUTING);
5250 +#endif
5251 +
5252 +       /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
5253 +        * about the value of skb->pkt_type.
5254 +        */
5255 +       if (skb->pkt_type == PACKET_OTHERHOST) {
5256 +               skb->pkt_type = PACKET_HOST;
5257 +               nf_bridge->mask |= BRNF_PKT_TYPE;
5258 +       }
5259 +
5260 +       memcpy(nf_bridge->hh, skb->data - 16, 16);
5261 +
5262 +       NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL,
5263 +               bridge_parent(skb->dev), br_dev_queue_push_xmit);
5264 +
5265 +       return NF_STOLEN;
5266 +}
5267 +
5268 +
5269 +/* IPv4/SABOTAGE *****************************************************/
5270 +
5271 +/* Don't hand locally destined packets to PF_INET/PRE_ROUTING
5272 + * for the second time.
5273 + */
5274 +static unsigned int ipv4_sabotage_in(unsigned int hook, struct sk_buff **pskb,
5275 +   const struct net_device *in, const struct net_device *out,
5276 +   int (*okfn)(struct sk_buff *))
5277 +{
5278 +       if (in->hard_start_xmit == br_dev_xmit &&
5279 +           okfn != br_nf_pre_routing_finish) {
5280 +               okfn(*pskb);
5281 +               return NF_STOLEN;
5282 +       }
5283 +
5284 +       return NF_ACCEPT;
5285 +}
5286 +
5287 +/* Postpone execution of PF_INET/FORWARD, PF_INET/LOCAL_OUT
5288 + * and PF_INET/POST_ROUTING until we have done the forwarding
5289 + * decision in the bridge code and have determined skb->physoutdev.
5290 + */
5291 +static unsigned int ipv4_sabotage_out(unsigned int hook, struct sk_buff **pskb,
5292 +   const struct net_device *in, const struct net_device *out,
5293 +   int (*okfn)(struct sk_buff *))
5294 +{
5295 +       if (out->hard_start_xmit == br_dev_xmit &&
5296 +           okfn != br_nf_forward_finish &&
5297 +           okfn != br_nf_local_out_finish &&
5298 +           okfn != br_dev_queue_push_xmit) {
5299 +               struct sk_buff *skb = *pskb;
5300 +               struct nf_bridge_info *nf_bridge;
5301 +
5302 +               if (!skb->nf_bridge && !nf_bridge_alloc(skb))
5303 +                       return NF_DROP;
5304 +
5305 +               nf_bridge = skb->nf_bridge;
5306 +
5307 +               /* This frame will arrive on PF_BRIDGE/LOCAL_OUT and we
5308 +                * will need the indev then. For a brouter, the real indev
5309 +                * can be a bridge port, so we make sure br_nf_local_out()
5310 +                * doesn't use the bridge parent of the indev by using
5311 +                * the BRNF_DONT_TAKE_PARENT mask.
5312 +                */
5313 +               if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
5314 +                       nf_bridge->mask &= BRNF_DONT_TAKE_PARENT;
5315 +                       nf_bridge->physindev = (struct net_device *)in;
5316 +               }
5317 +               okfn(skb);
5318 +               return NF_STOLEN;
5319 +       }
5320 +
5321 +       return NF_ACCEPT;
5322 +}
5323 +
5324 +/* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent
5325 + * PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
5326 + * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
5327 + * ip_refrag() can return NF_STOLEN.
5328 + */
5329 +static struct nf_hook_ops br_nf_ops[] = {
5330 +       { .hook = br_nf_pre_routing,
5331 +         .pf = PF_BRIDGE,
5332 +         .hooknum = NF_BR_PRE_ROUTING,
5333 +         .priority = NF_BR_PRI_BRNF, },
5334 +       { .hook = br_nf_local_in,
5335 +         .pf = PF_BRIDGE,
5336 +         .hooknum = NF_BR_LOCAL_IN,
5337 +         .priority = NF_BR_PRI_BRNF, },
5338 +       { .hook = br_nf_forward,
5339 +         .pf = PF_BRIDGE,
5340 +         .hooknum = NF_BR_FORWARD,
5341 +         .priority = NF_BR_PRI_BRNF, },
5342 +       { .hook = br_nf_local_out,
5343 +         .pf = PF_BRIDGE,
5344 +         .hooknum = NF_BR_LOCAL_OUT,
5345 +         .priority = NF_BR_PRI_FIRST, },
5346 +       { .hook = br_nf_post_routing,
5347 +         .pf = PF_BRIDGE,
5348 +         .hooknum = NF_BR_POST_ROUTING,
5349 +         .priority = NF_BR_PRI_LAST, },
5350 +       { .hook = ipv4_sabotage_in,
5351 +         .pf = PF_INET,
5352 +         .hooknum = NF_IP_PRE_ROUTING,
5353 +         .priority = NF_IP_PRI_FIRST, },
5354 +       { .hook = ipv4_sabotage_out,
5355 +         .pf = PF_INET,
5356 +         .hooknum = NF_IP_FORWARD,
5357 +         .priority = NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD, },
5358 +       { .hook = ipv4_sabotage_out,
5359 +         .pf = PF_INET,
5360 +         .hooknum = NF_IP_LOCAL_OUT,
5361 +         .priority = NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
5362 +       { .hook = ipv4_sabotage_out,
5363 +         .pf = PF_INET,
5364 +         .hooknum = NF_IP_POST_ROUTING,
5365 +         .priority = NF_IP_PRI_FIRST, },
5366 +};
5367 +
5368 +int br_netfilter_init(void)
5369 +{
5370 +       int i;
5371 +
5372 +       for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++) {
5373 +               int ret;
5374 +
5375 +               if ((ret = nf_register_hook(&br_nf_ops[i])) >= 0)
5376 +                       continue;
5377 +
5378 +               while (i--)
5379 +                       nf_unregister_hook(&br_nf_ops[i]);
5380 +
5381 +               return ret;
5382 +       }
5383 +
5384 +       printk(KERN_NOTICE "Bridge firewalling registered\n");
5385 +
5386 +       return 0;
5387 +}
5388 +
5389 +void br_netfilter_fini(void)
5390 +{
5391 +       int i;
5392 +
5393 +       for (i = ARRAY_SIZE(br_nf_ops) - 1; i >= 0; i--)
5394 +               nf_unregister_hook(&br_nf_ops[i]);
5395 +}
5396 --- /dev/null   Thu Aug 24 11:00:32 2000
5397 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/ipt_physdev.c    Fri Aug  8 01:09:06 2003
5398 @@ -0,0 +1,127 @@
5399 +/* Kernel module to match the bridge port in and
5400 + * out device for IP packets coming into contact with a bridge. */
5401 +#include <linux/module.h>
5402 +#include <linux/skbuff.h>
5403 +#include <linux/netfilter_ipv4/ipt_physdev.h>
5404 +#include <linux/netfilter_ipv4/ip_tables.h>
5405 +#include <linux/netfilter_bridge.h>
5406 +#include <linux/netdevice.h>
5407 +#define MATCH   1
5408 +#define NOMATCH 0
5409 +
5410 +static int
5411 +match(const struct sk_buff *skb,
5412 +      const struct net_device *in,
5413 +      const struct net_device *out,
5414 +      const void *matchinfo,
5415 +      int offset,
5416 +      const void *hdr,
5417 +      u_int16_t datalen,
5418 +      int *hotdrop)
5419 +{
5420 +       int i;
5421 +       static const char nulldevname[IFNAMSIZ] = { 0 };
5422 +       const struct ipt_physdev_info *info = matchinfo;
5423 +       unsigned long ret;
5424 +       const char *indev, *outdev;
5425 +       struct nf_bridge_info *nf_bridge;
5426 +
5427 +       /* Not a bridged IP packet or no info available yet:
5428 +        * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
5429 +        * the destination device will be a bridge. */
5430 +       if (!(nf_bridge = skb->nf_bridge)) {
5431 +               /* Return MATCH if the invert flags of the used options are on */
5432 +               if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
5433 +                   !(info->invert & IPT_PHYSDEV_OP_BRIDGED))
5434 +                       return NOMATCH;
5435 +               if ((info->bitmask & IPT_PHYSDEV_OP_ISIN) &&
5436 +                   !(info->invert & IPT_PHYSDEV_OP_ISIN))
5437 +                       return NOMATCH;
5438 +               if ((info->bitmask & IPT_PHYSDEV_OP_ISOUT) &&
5439 +                   !(info->invert & IPT_PHYSDEV_OP_ISOUT))
5440 +                       return NOMATCH;
5441 +               if ((info->bitmask & IPT_PHYSDEV_OP_IN) &&
5442 +                   !(info->invert & IPT_PHYSDEV_OP_IN))
5443 +                       return NOMATCH;
5444 +               if ((info->bitmask & IPT_PHYSDEV_OP_OUT) &&
5445 +                   !(info->invert & IPT_PHYSDEV_OP_OUT))
5446 +                       return NOMATCH;
5447 +               return MATCH;
5448 +       }
5449 +
5450 +       /* This only makes sense in the FORWARD and POSTROUTING chains */
5451 +       if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
5452 +           (!!(nf_bridge->mask & BRNF_BRIDGED) ^
5453 +           !(info->invert & IPT_PHYSDEV_OP_BRIDGED)))
5454 +               return NOMATCH;
5455 +
5456 +       if ((info->bitmask & IPT_PHYSDEV_OP_ISIN &&
5457 +           (!nf_bridge->physindev ^ !!(info->invert & IPT_PHYSDEV_OP_ISIN))) ||
5458 +           (info->bitmask & IPT_PHYSDEV_OP_ISOUT &&
5459 +           (!nf_bridge->physoutdev ^ !!(info->invert & IPT_PHYSDEV_OP_ISOUT))))
5460 +               return NOMATCH;
5461 +
5462 +       if (!(info->bitmask & IPT_PHYSDEV_OP_IN))
5463 +               goto match_outdev;
5464 +       indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
5465 +       for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5466 +               ret |= (((const unsigned long *)indev)[i]
5467 +                       ^ ((const unsigned long *)info->physindev)[i])
5468 +                       & ((const unsigned long *)info->in_mask)[i];
5469 +       }
5470 +
5471 +       if ((ret == 0) ^ !(info->invert & IPT_PHYSDEV_OP_IN))
5472 +               return NOMATCH;
5473 +
5474 +match_outdev:
5475 +       if (!(info->bitmask & IPT_PHYSDEV_OP_OUT))
5476 +               return MATCH;
5477 +       outdev = nf_bridge->physoutdev ?
5478 +                nf_bridge->physoutdev->name : nulldevname;
5479 +       for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5480 +               ret |= (((const unsigned long *)outdev)[i]
5481 +                       ^ ((const unsigned long *)info->physoutdev)[i])
5482 +                       & ((const unsigned long *)info->out_mask)[i];
5483 +       }
5484 +
5485 +       return (ret != 0) ^ !(info->invert & IPT_PHYSDEV_OP_OUT);
5486 +}
5487 +
5488 +static int
5489 +checkentry(const char *tablename,
5490 +                      const struct ipt_ip *ip,
5491 +                      void *matchinfo,
5492 +                      unsigned int matchsize,
5493 +                      unsigned int hook_mask)
5494 +{
5495 +       const struct ipt_physdev_info *info = matchinfo;
5496 +
5497 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_physdev_info)))
5498 +               return 0;
5499 +       if (!(info->bitmask & IPT_PHYSDEV_OP_MASK) ||
5500 +           info->bitmask & ~IPT_PHYSDEV_OP_MASK)
5501 +               return 0;
5502 +       return 1;
5503 +}
5504 +
5505 +static struct ipt_match physdev_match = {
5506 +       .name           = "physdev",
5507 +       .match          = &match,
5508 +       .checkentry     = &checkentry,
5509 +       .me             = THIS_MODULE,
5510 +};
5511 +
5512 +static int __init init(void)
5513 +{
5514 +       return ipt_register_match(&physdev_match);
5515 +}
5516 +
5517 +static void __exit fini(void)
5518 +{
5519 +       ipt_unregister_match(&physdev_match);
5520 +}
5521 +
5522 +module_init(init);
5523 +module_exit(fini);
5524 +MODULE_LICENSE("GPL");
5525 +EXPORT_NO_SYMBOLS;
5526 --- /dev/null   Thu Aug 24 11:00:32 2000
5527 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_ipv4/ipt_physdev.h  Fri Aug  8 01:09:06 2003
5528 @@ -0,0 +1,24 @@
5529 +#ifndef _IPT_PHYSDEV_H
5530 +#define _IPT_PHYSDEV_H
5531 +
5532 +#ifdef __KERNEL__
5533 +#include <linux/if.h>
5534 +#endif
5535 +
5536 +#define IPT_PHYSDEV_OP_IN              0x01
5537 +#define IPT_PHYSDEV_OP_OUT             0x02
5538 +#define IPT_PHYSDEV_OP_BRIDGED         0x04
5539 +#define IPT_PHYSDEV_OP_ISIN            0x08
5540 +#define IPT_PHYSDEV_OP_ISOUT           0x10
5541 +#define IPT_PHYSDEV_OP_MASK            (0x20 - 1)
5542 +
5543 +struct ipt_physdev_info {
5544 +       u_int8_t invert;
5545 +       u_int8_t bitmask;
5546 +       char physindev[IFNAMSIZ];
5547 +       char in_mask[IFNAMSIZ];
5548 +       char physoutdev[IFNAMSIZ];
5549 +       char out_mask[IFNAMSIZ];
5550 +};
5551 +
5552 +#endif /*_IPT_PHYSDEV_H*/