net/bridge/netfilter/ebtables.c

   1 /*
   2  *  ebtables
   3  *
   4  *  Author:
   5  *  Bart De Schuymer            <bdschuym@pandora.be>
   6  *
   7  *  ebtables.c,v 2.0, July, 2002
   8  *
   9  *  This code is stongly inspired on the iptables code which is
  10  *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  *
  12  *  This program is free software; you can redistribute it and/or
  13  *  modify it under the terms of the GNU General Public License
  14  *  as published by the Free Software Foundation; either version
  15  *  2 of the License, or (at your option) any later version.
  16  */
  17
  18 /* used for print_string */
  19 #include <linux/sched.h>
  20 #include <linux/tty.h>
  21
  22 #include <linux/kmod.h>
  23 #include <linux/module.h>
  24 #include <linux/vmalloc.h>
  25 #include <linux/netfilter_bridge/ebtables.h>
  26 #include <linux/spinlock.h>
  27 #include <linux/mutex.h>
  28 #include <asm/uaccess.h>
  29 #include <linux/smp.h>
  30 #include <linux/cpumask.h>
  31 #include <net/sock.h>
  32 /* needed for logical [in,out]-dev filtering */
  33 #include "../br_private.h"
  34
  35 #define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
  36                                          "report to author: "format, ## args)
  37 /* #define BUGPRINT(format, args...) */
  38 #define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
  39                                          ": out of memory: "format, ## args)
  40 /* #define MEMPRINT(format, args...) */
  41
  42
  43
  44 /*
  45  * Each cpu has its own set of counters, so there is no need for write_lock in
  46  * the softirq
  47  * For reading or updating the counters, the user context needs to
  48  * get a write_lock
  49  */
  50
  51 /* The size of each set of counters is altered to get cache alignment */
  52 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
  53 #define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
  54 #define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
  55    COUNTER_OFFSET(n) * cpu))
  56
  57
  58
  59 static DEFINE_MUTEX(ebt_mutex);
  60 static LIST_HEAD(ebt_tables);
  61 static LIST_HEAD(ebt_targets);
  62 static LIST_HEAD(ebt_matches);
  63 static LIST_HEAD(ebt_watchers);
  64
  65 static struct ebt_target ebt_standard_target =
  66 { {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
  67
  68 static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
  69    const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
  70    const struct net_device *out)
  71 {
  72         w->u.watcher->watcher(skb, hooknr, in, out, w->data,
  73            w->watcher_size);
  74         /* watchers don't give a verdict */
  75         return 0;
  76 }
  77
  78 static inline int ebt_do_match (struct ebt_entry_match *m,
  79    const struct sk_buff *skb, const struct net_device *in,
  80    const struct net_device *out)
  81 {
  82         return m->u.match->match(skb, in, out, m->data,
  83            m->match_size);
  84 }
  85
  86 static inline int ebt_dev_check(char *entry, const struct net_device *device)
  87 {
  88         int i = 0;
  89         const char *devname = device->name;
  90
  91         if (*entry == '\0')
  92                 return 0;
  93         if (!device)
  94                 return 1;
  95         /* 1 is the wildcard token */
  96         while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
  97                 i++;
  98         return (devname[i] != entry[i] && entry[i] != 1);
  99 }
 100
 101 #define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
 102 /* process standard matches */
 103 static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
 104    const struct net_device *in, const struct net_device *out)
 105 {
 106         int verdict, i;
 107
 108         if (e->bitmask & EBT_802_3) {
 109                 if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
 110                         return 1;
 111         } else if (!(e->bitmask & EBT_NOPROTO) &&
 112            FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
 113                 return 1;
 114
 115         if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
 116                 return 1;
 117         if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
 118                 return 1;
 119         if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
 120            e->logical_in, in->br_port->br->dev), EBT_ILOGICALIN))
 121                 return 1;
 122         if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
 123            e->logical_out, out->br_port->br->dev), EBT_ILOGICALOUT))
 124                 return 1;
 125
 126         if (e->bitmask & EBT_SOURCEMAC) {
 127                 verdict = 0;
 128                 for (i = 0; i < 6; i++)
 129                         verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
 130                            e->sourcemsk[i];
 131                 if (FWINV2(verdict != 0, EBT_ISOURCE) )
 132                         return 1;
 133         }
 134         if (e->bitmask & EBT_DESTMAC) {
 135                 verdict = 0;
 136                 for (i = 0; i < 6; i++)
 137                         verdict |= (h->h_dest[i] ^ e->destmac[i]) &
 138                            e->destmsk[i];
 139                 if (FWINV2(verdict != 0, EBT_IDEST) )
 140                         return 1;
 141         }
 142         return 0;
 143 }
 144
 145 /* Do some firewalling */
 146 unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
 147    const struct net_device *in, const struct net_device *out,
 148    struct ebt_table *table)
 149 {
 150         int i, nentries;
 151         struct ebt_entry *point;
 152         struct ebt_counter *counter_base, *cb_base;
 153         struct ebt_entry_target *t;
 154         int verdict, sp = 0;
 155         struct ebt_chainstack *cs;
 156         struct ebt_entries *chaininfo;
 157         char *base;
 158         struct ebt_table_info *private;
 159
 160         read_lock_bh(&table->lock);
 161         private = table->private;
 162         cb_base = COUNTER_BASE(private->counters, private->nentries,
 163            smp_processor_id());
 164         if (private->chainstack)
 165                 cs = private->chainstack[smp_processor_id()];
 166         else
 167                 cs = NULL;
 168         chaininfo = private->hook_entry[hook];
 169         nentries = private->hook_entry[hook]->nentries;
 170         point = (struct ebt_entry *)(private->hook_entry[hook]->data);
 171         counter_base = cb_base + private->hook_entry[hook]->counter_offset;
 172         /* base for chain jumps */
 173         base = private->entries;
 174         i = 0;
 175         while (i < nentries) {
 176                 if (ebt_basic_match(point, eth_hdr(*pskb), in, out))
 177                         goto letscontinue;
 178
 179                 if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
 180                         goto letscontinue;
 181
 182                 /* increase counter */
 183                 (*(counter_base + i)).pcnt++;
 184                 (*(counter_base + i)).bcnt+=(**pskb).len;
 185
 186                 /* these should only watch: not modify, nor tell us
 187                    what to do with the packet */
 188                 EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
 189                    out);
 190
 191                 t = (struct ebt_entry_target *)
 192                    (((char *)point) + point->target_offset);
 193                 /* standard target */
 194                 if (!t->u.target->target)
 195                         verdict = ((struct ebt_standard_target *)t)->verdict;
 196                 else
 197                         verdict = t->u.target->target(pskb, hook,
 198                            in, out, t->data, t->target_size);
 199                 if (verdict == EBT_ACCEPT) {
 200                         read_unlock_bh(&table->lock);
 201                         return NF_ACCEPT;
 202                 }
 203                 if (verdict == EBT_DROP) {
 204                         read_unlock_bh(&table->lock);
 205                         return NF_DROP;
 206                 }
 207                 if (verdict == EBT_RETURN) {
 208 letsreturn:
 209 #ifdef CONFIG_NETFILTER_DEBUG
 210                         if (sp == 0) {
 211                                 BUGPRINT("RETURN on base chain");
 212                                 /* act like this is EBT_CONTINUE */
 213                                 goto letscontinue;
 214                         }
 215 #endif
 216                         sp--;
 217                         /* put all the local variables right */
 218                         i = cs[sp].n;
 219                         chaininfo = cs[sp].chaininfo;
 220                         nentries = chaininfo->nentries;
 221                         point = cs[sp].e;
 222                         counter_base = cb_base +
 223                            chaininfo->counter_offset;
 224                         continue;
 225                 }
 226                 if (verdict == EBT_CONTINUE)
 227                         goto letscontinue;
 228 #ifdef CONFIG_NETFILTER_DEBUG
 229                 if (verdict < 0) {
 230                         BUGPRINT("bogus standard verdict\n");
 231                         read_unlock_bh(&table->lock);
 232                         return NF_DROP;
 233                 }
 234 #endif
 235                 /* jump to a udc */
 236                 cs[sp].n = i + 1;
 237                 cs[sp].chaininfo = chaininfo;
 238                 cs[sp].e = (struct ebt_entry *)
 239                    (((char *)point) + point->next_offset);
 240                 i = 0;
 241                 chaininfo = (struct ebt_entries *) (base + verdict);
 242 #ifdef CONFIG_NETFILTER_DEBUG
 243                 if (chaininfo->distinguisher) {
 244                         BUGPRINT("jump to non-chain\n");
 245                         read_unlock_bh(&table->lock);
 246                         return NF_DROP;
 247                 }
 248 #endif
 249                 nentries = chaininfo->nentries;
 250                 point = (struct ebt_entry *)chaininfo->data;
 251                 counter_base = cb_base + chaininfo->counter_offset;
 252                 sp++;
 253                 continue;
 254 letscontinue:
 255                 point = (struct ebt_entry *)
 256                    (((char *)point) + point->next_offset);
 257                 i++;
 258         }
 259
 260         /* I actually like this :) */
 261         if (chaininfo->policy == EBT_RETURN)
 262                 goto letsreturn;
 263         if (chaininfo->policy == EBT_ACCEPT) {
 264                 read_unlock_bh(&table->lock);
 265                 return NF_ACCEPT;
 266         }
 267         read_unlock_bh(&table->lock);
 268         return NF_DROP;
 269 }
 270
 271 /* If it succeeds, returns element and locks mutex */
 272 static inline void *
 273 find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
 274    struct mutex *mutex)
 275 {
 276         struct {
 277                 struct list_head list;
 278                 char name[EBT_FUNCTION_MAXNAMELEN];
 279         } *e;
 280
 281         *error = mutex_lock_interruptible(mutex);
 282         if (*error != 0)
 283                 return NULL;
 284
 285         list_for_each_entry(e, head, list) {
 286                 if (strcmp(e->name, name) == 0)
 287                         return e;
 288         }
 289         *error = -ENOENT;
 290         mutex_unlock(mutex);
 291         return NULL;
 292 }
 293
 294 #ifndef CONFIG_KMOD
 295 #define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
 296 #else
 297 static void *
 298 find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
 299    int *error, struct mutex *mutex)
 300 {
 301         void *ret;
 302
 303         ret = find_inlist_lock_noload(head, name, error, mutex);
 304         if (!ret) {
 305                 request_module("%s%s", prefix, name);
 306                 ret = find_inlist_lock_noload(head, name, error, mutex);
 307         }
 308         return ret;
 309 }
 310 #endif
 311
 312 static inline struct ebt_table *
 313 find_table_lock(const char *name, int *error, struct mutex *mutex)
 314 {
 315         return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
 316 }
 317
 318 static inline struct ebt_match *
 319 find_match_lock(const char *name, int *error, struct mutex *mutex)
 320 {
 321         return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
 322 }
 323
 324 static inline struct ebt_watcher *
 325 find_watcher_lock(const char *name, int *error, struct mutex *mutex)
 326 {
 327         return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
 328 }
 329
 330 static inline struct ebt_target *
 331 find_target_lock(const char *name, int *error, struct mutex *mutex)
 332 {
 333         return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
 334 }
 335
 336 static inline int
 337 ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
 338    const char *name, unsigned int hookmask, unsigned int *cnt)
 339 {
 340         struct ebt_match *match;
 341         size_t left = ((char *)e + e->watchers_offset) - (char *)m;
 342         int ret;
 343
 344         if (left < sizeof(struct ebt_entry_match) ||
 345             left - sizeof(struct ebt_entry_match) < m->match_size)
 346                 return -EINVAL;
 347         match = find_match_lock(m->u.name, &ret, &ebt_mutex);
 348         if (!match)
 349                 return ret;
 350         m->u.match = match;
 351         if (!try_module_get(match->me)) {
 352                 mutex_unlock(&ebt_mutex);
 353                 return -ENOENT;
 354         }
 355         mutex_unlock(&ebt_mutex);
 356         if (match->check &&
 357            match->check(name, hookmask, e, m->data, m->match_size) != 0) {
 358                 BUGPRINT("match->check failed\n");
 359                 module_put(match->me);
 360                 return -EINVAL;
 361         }
 362         (*cnt)++;
 363         return 0;
 364 }
 365
 366 static inline int
 367 ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
 368    const char *name, unsigned int hookmask, unsigned int *cnt)
 369 {
 370         struct ebt_watcher *watcher;
 371         size_t left = ((char *)e + e->target_offset) - (char *)w;
 372         int ret;
 373
 374         if (left < sizeof(struct ebt_entry_watcher) ||
 375            left - sizeof(struct ebt_entry_watcher) < w->watcher_size)
 376                 return -EINVAL;
 377         watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
 378         if (!watcher)
 379                 return ret;
 380         w->u.watcher = watcher;
 381         if (!try_module_get(watcher->me)) {
 382                 mutex_unlock(&ebt_mutex);
 383                 return -ENOENT;
 384         }
 385         mutex_unlock(&ebt_mutex);
 386         if (watcher->check &&
 387            watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
 388                 BUGPRINT("watcher->check failed\n");
 389                 module_put(watcher->me);
 390                 return -EINVAL;
 391         }
 392         (*cnt)++;
 393         return 0;
 394 }
 395
 396 static int ebt_verify_pointers(struct ebt_replace *repl,
 397                                struct ebt_table_info *newinfo)
 398 {
 399         unsigned int limit = repl->entries_size;
 400         unsigned int valid_hooks = repl->valid_hooks;
 401         unsigned int offset = 0;
 402         int i;
 403
 404         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 405                 newinfo->hook_entry[i] = NULL;
 406
 407         newinfo->entries_size = repl->entries_size;
 408         newinfo->nentries = repl->nentries;
 409
 410         while (offset < limit) {
 411                 size_t left = limit - offset;
 412                 struct ebt_entry *e = (void *)newinfo->entries + offset;
 413
 414                 if (left < sizeof(unsigned int))
 415                         break;
 416
 417                 for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 418                         if ((valid_hooks & (1 << i)) == 0)
 419                                 continue;
 420                         if ((char *)repl->hook_entry[i] == repl->entries + offset)
 421                                 break;
 422                 }
 423
 424                 if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
 425                         if (e->bitmask != 0) {
 426                                 /* we make userspace set this right,
 427                                    so there is no misunderstanding */
 428                                 BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
 429                                          "in distinguisher\n");
 430                                 return -EINVAL;
 431                         }
 432                         if (i != NF_BR_NUMHOOKS)
 433                                 newinfo->hook_entry[i] = (struct ebt_entries *)e;
 434                         if (left < sizeof(struct ebt_entries))
 435                                 break;
 436                         offset += sizeof(struct ebt_entries);
 437                 } else {
 438                         if (left < sizeof(struct ebt_entry))
 439                                 break;
 440                         if (left < e->next_offset)
 441                                 break;
 442                         offset += e->next_offset;
 443                 }
 444         }
 445         if (offset != limit) {
 446                 BUGPRINT("entries_size too small\n");
 447                 return -EINVAL;
 448         }
 449
 450         /* check if all valid hooks have a chain */
 451         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 452                 if (!newinfo->hook_entry[i] &&
 453                    (valid_hooks & (1 << i))) {
 454                         BUGPRINT("Valid hook without chain\n");
 455                         return -EINVAL;
 456                 }
 457         }
 458         return 0;
 459 }
 460
 461 /*
 462  * this one is very careful, as it is the first function
 463  * to parse the userspace data
 464  */
 465 static inline int
 466 ebt_check_entry_size_and_hooks(struct ebt_entry *e,
 467    struct ebt_table_info *newinfo,
 468    unsigned int *n, unsigned int *cnt,
 469    unsigned int *totalcnt, unsigned int *udc_cnt)
 470 {
 471         int i;
 472
 473         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 474                 if ((void *)e == (void *)newinfo->hook_entry[i])
 475                         break;
 476         }
 477         /* beginning of a new chain
 478            if i == NF_BR_NUMHOOKS it must be a user defined chain */
 479         if (i != NF_BR_NUMHOOKS || !e->bitmask) {
 480                 /* this checks if the previous chain has as many entries
 481                    as it said it has */
 482                 if (*n != *cnt) {
 483                         BUGPRINT("nentries does not equal the nr of entries "
 484                                  "in the chain\n");
 485                         return -EINVAL;
 486                 }
 487                 if (((struct ebt_entries *)e)->policy != EBT_DROP &&
 488                    ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
 489                         /* only RETURN from udc */
 490                         if (i != NF_BR_NUMHOOKS ||
 491                            ((struct ebt_entries *)e)->policy != EBT_RETURN) {
 492                                 BUGPRINT("bad policy\n");
 493                                 return -EINVAL;
 494                         }
 495                 }
 496                 if (i == NF_BR_NUMHOOKS) /* it's a user defined chain */
 497                         (*udc_cnt)++;
 498                 if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
 499                         BUGPRINT("counter_offset != totalcnt");
 500                         return -EINVAL;
 501                 }
 502                 *n = ((struct ebt_entries *)e)->nentries;
 503                 *cnt = 0;
 504                 return 0;
 505         }
 506         /* a plain old entry, heh */
 507         if (sizeof(struct ebt_entry) > e->watchers_offset ||
 508            e->watchers_offset > e->target_offset ||
 509            e->target_offset >= e->next_offset) {
 510                 BUGPRINT("entry offsets not in right order\n");
 511                 return -EINVAL;
 512         }
 513         /* this is not checked anywhere else */
 514         if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
 515                 BUGPRINT("target size too small\n");
 516                 return -EINVAL;
 517         }
 518         (*cnt)++;
 519         (*totalcnt)++;
 520         return 0;
 521 }
 522
 523 struct ebt_cl_stack
 524 {
 525         struct ebt_chainstack cs;
 526         int from;
 527         unsigned int hookmask;
 528 };
 529
 530 /*
 531  * we need these positions to check that the jumps to a different part of the
 532  * entries is a jump to the beginning of a new chain.
 533  */
 534 static inline int
 535 ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
 536    unsigned int *n, struct ebt_cl_stack *udc)
 537 {
 538         int i;
 539
 540         /* we're only interested in chain starts */
 541         if (e->bitmask)
 542                 return 0;
 543         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 544                 if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
 545                         break;
 546         }
 547         /* only care about udc */
 548         if (i != NF_BR_NUMHOOKS)
 549                 return 0;
 550
 551         udc[*n].cs.chaininfo = (struct ebt_entries *)e;
 552         /* these initialisations are depended on later in check_chainloops() */
 553         udc[*n].cs.n = 0;
 554         udc[*n].hookmask = 0;
 555
 556         (*n)++;
 557         return 0;
 558 }
 559
 560 static inline int
 561 ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
 562 {
 563         if (i && (*i)-- == 0)
 564                 return 1;
 565         if (m->u.match->destroy)
 566                 m->u.match->destroy(m->data, m->match_size);
 567         module_put(m->u.match->me);
 568
 569         return 0;
 570 }
 571
 572 static inline int
 573 ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
 574 {
 575         if (i && (*i)-- == 0)
 576                 return 1;
 577         if (w->u.watcher->destroy)
 578                 w->u.watcher->destroy(w->data, w->watcher_size);
 579         module_put(w->u.watcher->me);
 580
 581         return 0;
 582 }
 583
 584 static inline int
 585 ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
 586 {
 587         struct ebt_entry_target *t;
 588
 589         if (e->bitmask == 0)
 590                 return 0;
 591         /* we're done */
 592         if (cnt && (*cnt)-- == 0)
 593                 return 1;
 594         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
 595         EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
 596         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 597         if (t->u.target->destroy)
 598                 t->u.target->destroy(t->data, t->target_size);
 599         module_put(t->u.target->me);
 600
 601         return 0;
 602 }
 603
 604 static inline int
 605 ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
 606    const char *name, unsigned int *cnt,
 607    struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
 608 {
 609         struct ebt_entry_target *t;
 610         struct ebt_target *target;
 611         unsigned int i, j, hook = 0, hookmask = 0;
 612         size_t gap = e->next_offset - e->target_offset;
 613         int ret;
 614
 615         /* don't mess with the struct ebt_entries */
 616         if (e->bitmask == 0)
 617                 return 0;
 618
 619         if (e->bitmask & ~EBT_F_MASK) {
 620                 BUGPRINT("Unknown flag for bitmask\n");
 621                 return -EINVAL;
 622         }
 623         if (e->invflags & ~EBT_INV_MASK) {
 624                 BUGPRINT("Unknown flag for inv bitmask\n");
 625                 return -EINVAL;
 626         }
 627         if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
 628                 BUGPRINT("NOPROTO & 802_3 not allowed\n");
 629                 return -EINVAL;
 630         }
 631         /* what hook do we belong to? */
 632         for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 633                 if (!newinfo->hook_entry[i])
 634                         continue;
 635                 if ((char *)newinfo->hook_entry[i] < (char *)e)
 636                         hook = i;
 637                 else
 638                         break;
 639         }
 640         /* (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
 641            a base chain */
 642         if (i < NF_BR_NUMHOOKS)
 643                 hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 644         else {
 645                 for (i = 0; i < udc_cnt; i++)
 646                         if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
 647                                 break;
 648                 if (i == 0)
 649                         hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
 650                 else
 651                         hookmask = cl_s[i - 1].hookmask;
 652         }
 653         i = 0;
 654         ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
 655         if (ret != 0)
 656                 goto cleanup_matches;
 657         j = 0;
 658         ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
 659         if (ret != 0)
 660                 goto cleanup_watchers;
 661         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
 662         target = find_target_lock(t->u.name, &ret, &ebt_mutex);
 663         if (!target)
 664                 goto cleanup_watchers;
 665         if (!try_module_get(target->me)) {
 666                 mutex_unlock(&ebt_mutex);
 667                 ret = -ENOENT;
 668                 goto cleanup_watchers;
 669         }
 670         mutex_unlock(&ebt_mutex);
 671
 672         t->u.target = target;
 673         if (t->u.target == &ebt_standard_target) {
 674                 if (gap < sizeof(struct ebt_standard_target)) {
 675                         BUGPRINT("Standard target size too big\n");
 676                         ret = -EFAULT;
 677                         goto cleanup_watchers;
 678                 }
 679                 if (((struct ebt_standard_target *)t)->verdict <
 680                    -NUM_STANDARD_TARGETS) {
 681                         BUGPRINT("Invalid standard target\n");
 682                         ret = -EFAULT;
 683                         goto cleanup_watchers;
 684                 }
 685         } else if (t->target_size > gap - sizeof(struct ebt_entry_target) ||
 686            (t->u.target->check &&
 687            t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
 688                 module_put(t->u.target->me);
 689                 ret = -EFAULT;
 690                 goto cleanup_watchers;
 691         }
 692         (*cnt)++;
 693         return 0;
 694 cleanup_watchers:
 695         EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
 696 cleanup_matches:
 697         EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
 698         return ret;
 699 }
 700
 701 /*
 702  * checks for loops and sets the hook mask for udc
 703  * the hook mask for udc tells us from which base chains the udc can be
 704  * accessed. This mask is a parameter to the check() functions of the extensions
 705  */
 706 static int check_chainloops(struct ebt_entries *chain, struct ebt_cl_stack *cl_s,
 707    unsigned int udc_cnt, unsigned int hooknr, char *base)
 708 {
 709         int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
 710         struct ebt_entry *e = (struct ebt_entry *)chain->data;
 711         struct ebt_entry_target *t;
 712
 713         while (pos < nentries || chain_nr != -1) {
 714                 /* end of udc, go back one 'recursion' step */
 715                 if (pos == nentries) {
 716                         /* put back values of the time when this chain was called */
 717                         e = cl_s[chain_nr].cs.e;
 718                         if (cl_s[chain_nr].from != -1)
 719                                 nentries =
 720                                 cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
 721                         else
 722                                 nentries = chain->nentries;
 723                         pos = cl_s[chain_nr].cs.n;
 724                         /* make sure we won't see a loop that isn't one */
 725                         cl_s[chain_nr].cs.n = 0;
 726                         chain_nr = cl_s[chain_nr].from;
 727                         if (pos == nentries)
 728                                 continue;
 729                 }
 730                 t = (struct ebt_entry_target *)
 731                    (((char *)e) + e->target_offset);
 732                 if (strcmp(t->u.name, EBT_STANDARD_TARGET))
 733                         goto letscontinue;
 734                 if (e->target_offset + sizeof(struct ebt_standard_target) >
 735                    e->next_offset) {
 736                         BUGPRINT("Standard target size too big\n");
 737                         return -1;
 738                 }
 739                 verdict = ((struct ebt_standard_target *)t)->verdict;
 740                 if (verdict >= 0) { /* jump to another chain */
 741                         struct ebt_entries *hlp2 =
 742                            (struct ebt_entries *)(base + verdict);
 743                         for (i = 0; i < udc_cnt; i++)
 744                                 if (hlp2 == cl_s[i].cs.chaininfo)
 745                                         break;
 746                         /* bad destination or loop */
 747                         if (i == udc_cnt) {
 748                                 BUGPRINT("bad destination\n");
 749                                 return -1;
 750                         }
 751                         if (cl_s[i].cs.n) {
 752                                 BUGPRINT("loop\n");
 753                                 return -1;
 754                         }
 755                         if (cl_s[i].hookmask & (1 << hooknr))
 756                                 goto letscontinue;
 757                         /* this can't be 0, so the loop test is correct */
 758                         cl_s[i].cs.n = pos + 1;
 759                         pos = 0;
 760                         cl_s[i].cs.e = ((void *)e + e->next_offset);
 761                         e = (struct ebt_entry *)(hlp2->data);
 762                         nentries = hlp2->nentries;
 763                         cl_s[i].from = chain_nr;
 764                         chain_nr = i;
 765                         /* this udc is accessible from the base chain for hooknr */
 766                         cl_s[i].hookmask |= (1 << hooknr);
 767                         continue;
 768                 }
 769 letscontinue:
 770                 e = (void *)e + e->next_offset;
 771                 pos++;
 772         }
 773         return 0;
 774 }
 775
 776 /* do the parsing of the table/chains/entries/matches/watchers/targets, heh */
 777 static int translate_table(struct ebt_replace *repl,
 778    struct ebt_table_info *newinfo)
 779 {
 780         unsigned int i, j, k, udc_cnt;
 781         int ret;
 782         struct ebt_cl_stack *cl_s = NULL; /* used in the checking for chain loops */
 783
 784         ret = ebt_verify_pointers(repl, newinfo);
 785         if (ret != 0)
 786                 return ret;
 787
 788         i = 0;
 789         while (i < NF_BR_NUMHOOKS && !newinfo->hook_entry[i])
 790                 i++;
 791         if (i == NF_BR_NUMHOOKS) {
 792                 BUGPRINT("No valid hooks specified\n");
 793                 return -EINVAL;
 794         }
 795         if (newinfo->hook_entry[i] != (struct ebt_entries *)newinfo->entries) {
 796                 BUGPRINT("Chains don't start at beginning\n");
 797                 return -EINVAL;
 798         }
 799         /* make sure chains are ordered after each other in same order
 800            as their corresponding hooks */
 801         for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
 802                 if (!newinfo->hook_entry[j])
 803                         continue;
 804                 if (newinfo->hook_entry[j] <= newinfo->hook_entry[i]) {
 805                         BUGPRINT("Hook order must be followed\n");
 806                         return -EINVAL;
 807                 }
 808                 i = j;
 809         }
 810
 811         /* do some early checkings and initialize some things */
 812         i = 0; /* holds the expected nr. of entries for the chain */
 813         j = 0; /* holds the up to now counted entries for the chain */
 814         k = 0; /* holds the total nr. of entries, should equal
 815                   newinfo->nentries afterwards */
 816         udc_cnt = 0; /* will hold the nr. of user defined chains (udc) */
 817         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 818            ebt_check_entry_size_and_hooks, newinfo,
 819            &i, &j, &k, &udc_cnt);
 820
 821         if (ret != 0)
 822                 return ret;
 823
 824         if (i != j) {
 825                 BUGPRINT("nentries does not equal the nr of entries in the "
 826                          "(last) chain\n");
 827                 return -EINVAL;
 828         }
 829         if (k != newinfo->nentries) {
 830                 BUGPRINT("Total nentries is wrong\n");
 831                 return -EINVAL;
 832         }
 833
 834         /* get the location of the udc, put them in an array
 835            while we're at it, allocate the chainstack */
 836         if (udc_cnt) {
 837                 /* this will get free'd in do_replace()/ebt_register_table()
 838                    if an error occurs */
 839                 newinfo->chainstack =
 840                         vmalloc((highest_possible_processor_id()+1)
 841                                         * sizeof(*(newinfo->chainstack)));
 842                 if (!newinfo->chainstack)
 843                         return -ENOMEM;
 844                 for_each_possible_cpu(i) {
 845                         newinfo->chainstack[i] =
 846                           vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
 847                         if (!newinfo->chainstack[i]) {
 848                                 while (i)
 849                                         vfree(newinfo->chainstack[--i]);
 850                                 vfree(newinfo->chainstack);
 851                                 newinfo->chainstack = NULL;
 852                                 return -ENOMEM;
 853                         }
 854                 }
 855
 856                 cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
 857                 if (!cl_s)
 858                         return -ENOMEM;
 859                 i = 0; /* the i'th udc */
 860                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 861                    ebt_get_udc_positions, newinfo, &i, cl_s);
 862                 /* sanity check */
 863                 if (i != udc_cnt) {
 864                         BUGPRINT("i != udc_cnt\n");
 865                         vfree(cl_s);
 866                         return -EFAULT;
 867                 }
 868         }
 869
 870         /* Check for loops */
 871         for (i = 0; i < NF_BR_NUMHOOKS; i++)
 872                 if (newinfo->hook_entry[i])
 873                         if (check_chainloops(newinfo->hook_entry[i],
 874                            cl_s, udc_cnt, i, newinfo->entries)) {
 875                                 vfree(cl_s);
 876                                 return -EINVAL;
 877                         }
 878
 879         /* we now know the following (along with E=mc²):
 880            - the nr of entries in each chain is right
 881            - the size of the allocated space is right
 882            - all valid hooks have a corresponding chain
 883            - there are no loops
 884            - wrong data can still be on the level of a single entry
 885            - could be there are jumps to places that are not the
 886              beginning of a chain. This can only occur in chains that
 887              are not accessible from any base chains, so we don't care. */
 888
 889         /* used to know what we need to clean up if something goes wrong */
 890         i = 0;
 891         ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 892            ebt_check_entry, newinfo, repl->name, &i, cl_s, udc_cnt);
 893         if (ret != 0) {
 894                 EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
 895                    ebt_cleanup_entry, &i);
 896         }
 897         vfree(cl_s);
 898         return ret;
 899 }
 900
 901 /* called under write_lock */
 902 static void get_counters(struct ebt_counter *oldcounters,
 903    struct ebt_counter *counters, unsigned int nentries)
 904 {
 905         int i, cpu;
 906         struct ebt_counter *counter_base;
 907
 908         /* counters of cpu 0 */
 909         memcpy(counters, oldcounters,
 910                sizeof(struct ebt_counter) * nentries);
 911
 912         /* add other counters to those of cpu 0 */
 913         for_each_possible_cpu(cpu) {
 914                 if (cpu == 0)
 915                         continue;
 916                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
 917                 for (i = 0; i < nentries; i++) {
 918                         counters[i].pcnt += counter_base[i].pcnt;
 919                         counters[i].bcnt += counter_base[i].bcnt;
 920                 }
 921         }
 922 }
 923
 924 /* replace the table */
 925 static int do_replace(void __user *user, unsigned int len)
 926 {
 927         int ret, i, countersize;
 928         struct ebt_table_info *newinfo;
 929         struct ebt_replace tmp;
 930         struct ebt_table *t;
 931         struct ebt_counter *counterstmp = NULL;
 932         /* used to be able to unlock earlier */
 933         struct ebt_table_info *table;
 934
 935         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
 936                 return -EFAULT;
 937
 938         if (len != sizeof(tmp) + tmp.entries_size) {
 939                 BUGPRINT("Wrong len argument\n");
 940                 return -EINVAL;
 941         }
 942
 943         if (tmp.entries_size == 0) {
 944                 BUGPRINT("Entries_size never zero\n");
 945                 return -EINVAL;
 946         }
 947         /* overflow check */
 948         if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
 949                         SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
 950                 return -ENOMEM;
 951         if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
 952                 return -ENOMEM;
 953
 954         countersize = COUNTER_OFFSET(tmp.nentries) *
 955                                         (highest_possible_processor_id()+1);
 956         newinfo = vmalloc(sizeof(*newinfo) + countersize);
 957         if (!newinfo)
 958                 return -ENOMEM;
 959
 960         if (countersize)
 961                 memset(newinfo->counters, 0, countersize);
 962
 963         newinfo->entries = vmalloc(tmp.entries_size);
 964         if (!newinfo->entries) {
 965                 ret = -ENOMEM;
 966                 goto free_newinfo;
 967         }
 968         if (copy_from_user(
 969            newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
 970                 BUGPRINT("Couldn't copy entries from userspace\n");
 971                 ret = -EFAULT;
 972                 goto free_entries;
 973         }
 974
 975         /* the user wants counters back
 976            the check on the size is done later, when we have the lock */
 977         if (tmp.num_counters) {
 978                 counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
 979                 if (!counterstmp) {
 980                         ret = -ENOMEM;
 981                         goto free_entries;
 982                 }
 983         }
 984         else
 985                 counterstmp = NULL;
 986
 987         /* this can get initialized by translate_table() */
 988         newinfo->chainstack = NULL;
 989         ret = translate_table(&tmp, newinfo);
 990
 991         if (ret != 0)
 992                 goto free_counterstmp;
 993
 994         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
 995         if (!t) {
 996                 ret = -ENOENT;
 997                 goto free_iterate;
 998         }
 999
1000         /* the table doesn't like it */
1001         if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
1002                 goto free_unlock;
1003
1004         if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
1005                 BUGPRINT("Wrong nr. of counters requested\n");
1006                 ret = -EINVAL;
1007                 goto free_unlock;
1008         }
1009
1010         /* we have the mutex lock, so no danger in reading this pointer */
1011         table = t->private;
1012         /* make sure the table can only be rmmod'ed if it contains no rules */
1013         if (!table->nentries && newinfo->nentries && !try_module_get(t->me)) {
1014                 ret = -ENOENT;
1015                 goto free_unlock;
1016         } else if (table->nentries && !newinfo->nentries)
1017                 module_put(t->me);
1018         /* we need an atomic snapshot of the counters */
1019         write_lock_bh(&t->lock);
1020         if (tmp.num_counters)
1021                 get_counters(t->private->counters, counterstmp,
1022                    t->private->nentries);
1023
1024         t->private = newinfo;
1025         write_unlock_bh(&t->lock);
1026         mutex_unlock(&ebt_mutex);
1027         /* so, a user can change the chains while having messed up her counter
1028            allocation. Only reason why this is done is because this way the lock
1029            is held only once, while this doesn't bring the kernel into a
1030            dangerous state. */
1031         if (tmp.num_counters &&
1032            copy_to_user(tmp.counters, counterstmp,
1033            tmp.num_counters * sizeof(struct ebt_counter))) {
1034                 BUGPRINT("Couldn't copy counters to userspace\n");
1035                 ret = -EFAULT;
1036         }
1037         else
1038                 ret = 0;
1039
1040         /* decrease module count and free resources */
1041         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
1042            ebt_cleanup_entry, NULL);
1043
1044         vfree(table->entries);
1045         if (table->chainstack) {
1046                 for_each_possible_cpu(i)
1047                         vfree(table->chainstack[i]);
1048                 vfree(table->chainstack);
1049         }
1050         vfree(table);
1051
1052         vfree(counterstmp);
1053         return ret;
1054
1055 free_unlock:
1056         mutex_unlock(&ebt_mutex);
1057 free_iterate:
1058         EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
1059            ebt_cleanup_entry, NULL);
1060 free_counterstmp:
1061         vfree(counterstmp);
1062         /* can be initialized in translate_table() */
1063         if (newinfo->chainstack) {
1064                 for_each_possible_cpu(i)
1065                         vfree(newinfo->chainstack[i]);
1066                 vfree(newinfo->chainstack);
1067         }
1068 free_entries:
1069         vfree(newinfo->entries);
1070 free_newinfo:
1071         vfree(newinfo);
1072         return ret;
1073 }
1074
1075 int ebt_register_target(struct ebt_target *target)
1076 {
1077         struct ebt_target *t;
1078         int ret;
1079
1080         ret = mutex_lock_interruptible(&ebt_mutex);
1081         if (ret != 0)
1082                 return ret;
1083         list_for_each_entry(t, &ebt_targets, list) {
1084                 if (strcmp(t->name, target->name) == 0) {
1085                         mutex_unlock(&ebt_mutex);
1086                         return -EEXIST;
1087                 }
1088         }
1089         list_add(&target->list, &ebt_targets);
1090         mutex_unlock(&ebt_mutex);
1091
1092         return 0;
1093 }
1094
1095 void ebt_unregister_target(struct ebt_target *target)
1096 {
1097         mutex_lock(&ebt_mutex);
1098         list_del(&target->list);
1099         mutex_unlock(&ebt_mutex);
1100 }
1101
1102 int ebt_register_match(struct ebt_match *match)
1103 {
1104         struct ebt_match *m;
1105         int ret;
1106
1107         ret = mutex_lock_interruptible(&ebt_mutex);
1108         if (ret != 0)
1109                 return ret;
1110         list_for_each_entry(m, &ebt_matches, list) {
1111                 if (strcmp(m->name, match->name) == 0) {
1112                         mutex_unlock(&ebt_mutex);
1113                         return -EEXIST;
1114                 }
1115         }
1116         list_add(&match->list, &ebt_matches);
1117         mutex_unlock(&ebt_mutex);
1118
1119         return 0;
1120 }
1121
1122 void ebt_unregister_match(struct ebt_match *match)
1123 {
1124         mutex_lock(&ebt_mutex);
1125         list_del(&match->list);
1126         mutex_unlock(&ebt_mutex);
1127 }
1128
1129 int ebt_register_watcher(struct ebt_watcher *watcher)
1130 {
1131         struct ebt_watcher *w;
1132         int ret;
1133
1134         ret = mutex_lock_interruptible(&ebt_mutex);
1135         if (ret != 0)
1136                 return ret;
1137         list_for_each_entry(w, &ebt_watchers, list) {
1138                 if (strcmp(w->name, watcher->name) == 0) {
1139                         mutex_unlock(&ebt_mutex);
1140                         return -EEXIST;
1141                 }
1142         }
1143         list_add(&watcher->list, &ebt_watchers);
1144         mutex_unlock(&ebt_mutex);
1145
1146         return 0;
1147 }
1148
1149 void ebt_unregister_watcher(struct ebt_watcher *watcher)
1150 {
1151         mutex_lock(&ebt_mutex);
1152         list_del(&watcher->list);
1153         mutex_unlock(&ebt_mutex);
1154 }
1155
1156 int ebt_register_table(struct ebt_table *table)
1157 {
1158         struct ebt_table_info *newinfo;
1159         struct ebt_table *t;
1160         int ret, i, countersize;
1161
1162         if (!table || !table->table ||!table->table->entries ||
1163             table->table->entries_size == 0 ||
1164             table->table->counters || table->private) {
1165                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
1166                 return -EINVAL;
1167         }
1168
1169         countersize = COUNTER_OFFSET(table->table->nentries) *
1170                                         (highest_possible_processor_id()+1);
1171         newinfo = vmalloc(sizeof(*newinfo) + countersize);
1172         ret = -ENOMEM;
1173         if (!newinfo)
1174                 return -ENOMEM;
1175
1176         newinfo->entries = vmalloc(table->table->entries_size);
1177         if (!(newinfo->entries))
1178                 goto free_newinfo;
1179
1180         memcpy(newinfo->entries, table->table->entries,
1181            table->table->entries_size);
1182
1183         if (countersize)
1184                 memset(newinfo->counters, 0, countersize);
1185
1186         /* fill in newinfo and parse the entries */
1187         newinfo->chainstack = NULL;
1188         ret = translate_table(table->table, newinfo);
1189         if (ret != 0) {
1190                 BUGPRINT("Translate_table failed\n");
1191                 goto free_chainstack;
1192         }
1193
1194         if (table->check && table->check(newinfo, table->valid_hooks)) {
1195                 BUGPRINT("The table doesn't like its own initial data, lol\n");
1196                 return -EINVAL;
1197         }
1198
1199         table->private = newinfo;
1200         rwlock_init(&table->lock);
1201         ret = mutex_lock_interruptible(&ebt_mutex);
1202         if (ret != 0)
1203                 goto free_chainstack;
1204
1205         list_for_each_entry(t, &ebt_tables, list) {
1206                 if (strcmp(t->name, table->name) == 0) {
1207                         ret = -EEXIST;
1208                         BUGPRINT("Table name already exists\n");
1209                         goto free_unlock;
1210                 }
1211         }
1212
1213         /* Hold a reference count if the chains aren't empty */
1214         if (newinfo->nentries && !try_module_get(table->me)) {
1215                 ret = -ENOENT;
1216                 goto free_unlock;
1217         }
1218         list_add(&table->list, &ebt_tables);
1219         mutex_unlock(&ebt_mutex);
1220         return 0;
1221 free_unlock:
1222         mutex_unlock(&ebt_mutex);
1223 free_chainstack:
1224         if (newinfo->chainstack) {
1225                 for_each_possible_cpu(i)
1226                         vfree(newinfo->chainstack[i]);
1227                 vfree(newinfo->chainstack);
1228         }
1229         vfree(newinfo->entries);
1230 free_newinfo:
1231         vfree(newinfo);
1232         return ret;
1233 }
1234
1235 void ebt_unregister_table(struct ebt_table *table)
1236 {
1237         int i;
1238
1239         if (!table) {
1240                 BUGPRINT("Request to unregister NULL table!!!\n");
1241                 return;
1242         }
1243         mutex_lock(&ebt_mutex);
1244         list_del(&table->list);
1245         mutex_unlock(&ebt_mutex);
1246         vfree(table->private->entries);
1247         if (table->private->chainstack) {
1248                 for_each_possible_cpu(i)
1249                         vfree(table->private->chainstack[i]);
1250                 vfree(table->private->chainstack);
1251         }
1252         vfree(table->private);
1253 }
1254
1255 /* userspace just supplied us with counters */
1256 static int update_counters(void __user *user, unsigned int len)
1257 {
1258         int i, ret;
1259         struct ebt_counter *tmp;
1260         struct ebt_replace hlp;
1261         struct ebt_table *t;
1262
1263         if (copy_from_user(&hlp, user, sizeof(hlp)))
1264                 return -EFAULT;
1265
1266         if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
1267                 return -EINVAL;
1268         if (hlp.num_counters == 0)
1269                 return -EINVAL;
1270
1271         if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
1272                 MEMPRINT("Update_counters && nomemory\n");
1273                 return -ENOMEM;
1274         }
1275
1276         t = find_table_lock(hlp.name, &ret, &ebt_mutex);
1277         if (!t)
1278                 goto free_tmp;
1279
1280         if (hlp.num_counters != t->private->nentries) {
1281                 BUGPRINT("Wrong nr of counters\n");
1282                 ret = -EINVAL;
1283                 goto unlock_mutex;
1284         }
1285
1286         if ( copy_from_user(tmp, hlp.counters,
1287            hlp.num_counters * sizeof(struct ebt_counter)) ) {
1288                 BUGPRINT("Updata_counters && !cfu\n");
1289                 ret = -EFAULT;
1290                 goto unlock_mutex;
1291         }
1292
1293         /* we want an atomic add of the counters */
1294         write_lock_bh(&t->lock);
1295
1296         /* we add to the counters of the first cpu */
1297         for (i = 0; i < hlp.num_counters; i++) {
1298                 t->private->counters[i].pcnt += tmp[i].pcnt;
1299                 t->private->counters[i].bcnt += tmp[i].bcnt;
1300         }
1301
1302         write_unlock_bh(&t->lock);
1303         ret = 0;
1304 unlock_mutex:
1305         mutex_unlock(&ebt_mutex);
1306 free_tmp:
1307         vfree(tmp);
1308         return ret;
1309 }
1310
1311 static inline int ebt_make_matchname(struct ebt_entry_match *m,
1312    char *base, char *ubase)
1313 {
1314         char *hlp = ubase - base + (char *)m;
1315         if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
1316                 return -EFAULT;
1317         return 0;
1318 }
1319
1320 static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
1321    char *base, char *ubase)
1322 {
1323         char *hlp = ubase - base + (char *)w;
1324         if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
1325                 return -EFAULT;
1326         return 0;
1327 }
1328
1329 static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
1330 {
1331         int ret;
1332         char *hlp;
1333         struct ebt_entry_target *t;
1334
1335         if (e->bitmask == 0)
1336                 return 0;
1337
1338         hlp = ubase - base + (char *)e + e->target_offset;
1339         t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
1340
1341         ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
1342         if (ret != 0)
1343                 return ret;
1344         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
1345         if (ret != 0)
1346                 return ret;
1347         if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
1348                 return -EFAULT;
1349         return 0;
1350 }
1351
1352 /* called with ebt_mutex locked */
1353 static int copy_everything_to_user(struct ebt_table *t, void __user *user,
1354    int *len, int cmd)
1355 {
1356         struct ebt_replace tmp;
1357         struct ebt_counter *counterstmp, *oldcounters;
1358         unsigned int entries_size, nentries;
1359         char *entries;
1360
1361         if (cmd == EBT_SO_GET_ENTRIES) {
1362                 entries_size = t->private->entries_size;
1363                 nentries = t->private->nentries;
1364                 entries = t->private->entries;
1365                 oldcounters = t->private->counters;
1366         } else {
1367                 entries_size = t->table->entries_size;
1368                 nentries = t->table->nentries;
1369                 entries = t->table->entries;
1370                 oldcounters = t->table->counters;
1371         }
1372
1373         if (copy_from_user(&tmp, user, sizeof(tmp))) {
1374                 BUGPRINT("Cfu didn't work\n");
1375                 return -EFAULT;
1376         }
1377
1378         if (*len != sizeof(struct ebt_replace) + entries_size +
1379            (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
1380                 BUGPRINT("Wrong size\n");
1381                 return -EINVAL;
1382         }
1383
1384         if (tmp.nentries != nentries) {
1385                 BUGPRINT("Nentries wrong\n");
1386                 return -EINVAL;
1387         }
1388
1389         if (tmp.entries_size != entries_size) {
1390                 BUGPRINT("Wrong size\n");
1391                 return -EINVAL;
1392         }
1393
1394         /* userspace might not need the counters */
1395         if (tmp.num_counters) {
1396                 if (tmp.num_counters != nentries) {
1397                         BUGPRINT("Num_counters wrong\n");
1398                         return -EINVAL;
1399                 }
1400                 counterstmp = vmalloc(nentries * sizeof(*counterstmp));
1401                 if (!counterstmp) {
1402                         MEMPRINT("Couldn't copy counters, out of memory\n");
1403                         return -ENOMEM;
1404                 }
1405                 write_lock_bh(&t->lock);
1406                 get_counters(oldcounters, counterstmp, nentries);
1407                 write_unlock_bh(&t->lock);
1408
1409                 if (copy_to_user(tmp.counters, counterstmp,
1410                    nentries * sizeof(struct ebt_counter))) {
1411                         BUGPRINT("Couldn't copy counters to userspace\n");
1412                         vfree(counterstmp);
1413                         return -EFAULT;
1414                 }
1415                 vfree(counterstmp);
1416         }
1417
1418         if (copy_to_user(tmp.entries, entries, entries_size)) {
1419                 BUGPRINT("Couldn't copy entries to userspace\n");
1420                 return -EFAULT;
1421         }
1422         /* set the match/watcher/target names right */
1423         return EBT_ENTRY_ITERATE(entries, entries_size,
1424            ebt_make_names, entries, tmp.entries);
1425 }
1426
1427 static int do_ebt_set_ctl(struct sock *sk,
1428         int cmd, void __user *user, unsigned int len)
1429 {
1430         int ret;
1431
1432         switch(cmd) {
1433         case EBT_SO_SET_ENTRIES:
1434                 ret = do_replace(user, len);
1435                 break;
1436         case EBT_SO_SET_COUNTERS:
1437                 ret = update_counters(user, len);
1438                 break;
1439         default:
1440                 ret = -EINVAL;
1441   }
1442         return ret;
1443 }
1444
1445 static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
1446 {
1447         int ret;
1448         struct ebt_replace tmp;
1449         struct ebt_table *t;
1450
1451         if (copy_from_user(&tmp, user, sizeof(tmp)))
1452                 return -EFAULT;
1453
1454         t = find_table_lock(tmp.name, &ret, &ebt_mutex);
1455         if (!t)
1456                 return ret;
1457
1458         switch(cmd) {
1459         case EBT_SO_GET_INFO:
1460         case EBT_SO_GET_INIT_INFO:
1461                 if (*len != sizeof(struct ebt_replace)){
1462                         ret = -EINVAL;
1463                         mutex_unlock(&ebt_mutex);
1464                         break;
1465                 }
1466                 if (cmd == EBT_SO_GET_INFO) {
1467                         tmp.nentries = t->private->nentries;
1468                         tmp.entries_size = t->private->entries_size;
1469                         tmp.valid_hooks = t->valid_hooks;
1470                 } else {
1471                         tmp.nentries = t->table->nentries;
1472                         tmp.entries_size = t->table->entries_size;
1473                         tmp.valid_hooks = t->table->valid_hooks;
1474                 }
1475                 mutex_unlock(&ebt_mutex);
1476                 if (copy_to_user(user, &tmp, *len) != 0){
1477                         BUGPRINT("c2u Didn't work\n");
1478                         ret = -EFAULT;
1479                         break;
1480                 }
1481                 ret = 0;
1482                 break;
1483
1484         case EBT_SO_GET_ENTRIES:
1485         case EBT_SO_GET_INIT_ENTRIES:
1486                 ret = copy_everything_to_user(t, user, len, cmd);
1487                 mutex_unlock(&ebt_mutex);
1488                 break;
1489
1490         default:
1491                 mutex_unlock(&ebt_mutex);
1492                 ret = -EINVAL;
1493         }
1494
1495         return ret;
1496 }
1497
1498 static struct nf_sockopt_ops ebt_sockopts =
1499 {
1500         .pf             = PF_INET,
1501         .set_optmin     = EBT_BASE_CTL,
1502         .set_optmax     = EBT_SO_SET_MAX + 1,
1503         .set            = do_ebt_set_ctl,
1504         .get_optmin     = EBT_BASE_CTL,
1505         .get_optmax     = EBT_SO_GET_MAX + 1,
1506         .get            = do_ebt_get_ctl,
1507 };
1508
1509 static int __init ebtables_init(void)
1510 {
1511         int ret;
1512
1513         mutex_lock(&ebt_mutex);
1514         list_add(&ebt_standard_target.list, &ebt_targets);
1515         mutex_unlock(&ebt_mutex);
1516         if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
1517                 return ret;
1518
1519         printk(KERN_NOTICE "Ebtables v2.0 registered\n");
1520         return 0;
1521 }
1522
1523 static void __exit ebtables_fini(void)
1524 {
1525         nf_unregister_sockopt(&ebt_sockopts);
1526         printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
1527 }
1528
1529 EXPORT_SYMBOL(ebt_register_table);
1530 EXPORT_SYMBOL(ebt_unregister_table);
1531 EXPORT_SYMBOL(ebt_register_match);
1532 EXPORT_SYMBOL(ebt_unregister_match);
1533 EXPORT_SYMBOL(ebt_register_watcher);
1534 EXPORT_SYMBOL(ebt_unregister_watcher);
1535 EXPORT_SYMBOL(ebt_register_target);
1536 EXPORT_SYMBOL(ebt_unregister_target);
1537 EXPORT_SYMBOL(ebt_do_table);
1538 module_init(ebtables_init);
1539 module_exit(ebtables_fini);
1540 MODULE_LICENSE("GPL");