projects / openwrt / svn-archive / archive.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
fix svn patch breakage in glib
[openwrt/svn-archive/archive.git] / obsolete-buildroot / sources / openwrt / kernel / patches / 140-ebtables-brnf-5.patch
1 --- linux-2.4.21/net/bridge/br_private.h Mon Feb 25 20:38:14 2002
2 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_private.h Fri Aug 8 01:09:06 2003
3 @@ -144,8 +144,10 @@ extern void br_fdb_insert(struct net_bri
4 /* br_forward.c */
5 extern void br_deliver(struct net_bridge_port *to,
6 struct sk_buff *skb);
7 +extern int br_dev_queue_push_xmit(struct sk_buff *skb);
8 extern void br_forward(struct net_bridge_port *to,
9 struct sk_buff *skb);
10 +extern int br_forward_finish(struct sk_buff *skb);
11 extern void br_flood_deliver(struct net_bridge *br,
12 struct sk_buff *skb,
13 int clone);
14 @@ -166,7 +168,8 @@ extern void br_get_port_ifindices(struct
15 int *ifindices);
16
17 /* br_input.c */
18 -extern void br_handle_frame(struct sk_buff *skb);
19 +extern int br_handle_frame_finish(struct sk_buff *skb);
20 +extern int br_handle_frame(struct sk_buff *skb);
21
22 /* br_ioctl.c */
23 extern void br_call_ioctl_atomic(void (*fn)(void));
24 @@ -176,6 +179,10 @@ extern int br_ioctl(struct net_bridge *b
25 unsigned long arg1,
26 unsigned long arg2);
27 extern int br_ioctl_deviceless_stub(unsigned long arg);
28 +
29 +/* br_netfilter.c */
30 +extern int br_netfilter_init(void);
31 +extern void br_netfilter_fini(void);
32
33 /* br_stp.c */
34 extern int br_is_root_bridge(struct net_bridge *br);
35 --- linux-2.4.21/include/linux/if_bridge.h Thu Nov 22 20:47:12 2001
36 +++ linux-2.4.21-ebt-brnf-3/include/linux/if_bridge.h Fri Aug 8 01:09:06 2003
37 @@ -102,7 +102,8 @@ struct net_bridge;
38 struct net_bridge_port;
39
40 extern int (*br_ioctl_hook)(unsigned long arg);
41 -extern void (*br_handle_frame_hook)(struct sk_buff *skb);
42 +extern int (*br_handle_frame_hook)(struct sk_buff *skb);
43 +extern int (*br_should_route_hook)(struct sk_buff **pskb);
44
45 #endif
46
47 --- linux-2.4.21/net/core/dev.c Fri Jun 13 16:51:39 2003
48 +++ linux-2.4.21-ebt-brnf-3/net/core/dev.c Fri Aug 8 01:10:03 2003
49 @@ -1424,7 +1424,7 @@ static void net_tx_action(struct softirq
50
51
52 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
53 -void (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
54 +int (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
55 #endif
56
57 static __inline__ int handle_bridge(struct sk_buff *skb,
58 @@ -1441,7 +1441,6 @@ static __inline__ int handle_bridge(stru
59 }
60 }
61
62 - br_handle_frame_hook(skb);
63 return ret;
64 }
65
66 @@ -1497,11 +1496,16 @@ int netif_receive_skb(struct sk_buff *sk
67 if (skb->dev->divert && skb->dev->divert->divert)
68 ret = handle_diverter(skb);
69 #endif /* CONFIG_NET_DIVERT */
70 -
71 +
72 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
73 if (skb->dev->br_port != NULL &&
74 - br_handle_frame_hook != NULL) {
75 - return handle_bridge(skb, pt_prev);
76 + br_handle_frame_hook != NULL) {
77 + int ret;
78 +
79 + ret = handle_bridge(skb, pt_prev);
80 + if (br_handle_frame_hook(skb) == 0)
81 + return ret;
82 + pt_prev = NULL;
83 }
84 #endif
85
86 @@ -1897,7 +1901,7 @@ static int dev_proc_stats(char *buffer,
87 * are adjusted, %RTM_NEWLINK is sent to the routing socket and the
88 * function returns zero.
89 */
90 -
91 +
92 int netdev_set_master(struct net_device *slave, struct net_device *master)
93 {
94 struct net_device *old = slave->master;
95 --- linux-2.4.21/net/bridge/br_input.c Sat Aug 3 02:39:46 2002
96 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_input.c Fri Aug 8 01:09:06 2003
97 @@ -24,6 +24,9 @@ unsigned char bridge_ula[6] = { 0x01, 0x
98
99 static int br_pass_frame_up_finish(struct sk_buff *skb)
100 {
101 +#ifdef CONFIG_NETFILTER_DEBUG
102 + skb->nf_debug = 0;
103 +#endif
104 netif_rx(skb);
105
106 return 0;
107 @@ -46,7 +49,7 @@ static void br_pass_frame_up(struct net_
108 br_pass_frame_up_finish);
109 }
110
111 -static int br_handle_frame_finish(struct sk_buff *skb)
112 +int br_handle_frame_finish(struct sk_buff *skb)
113 {
114 struct net_bridge *br;
115 unsigned char *dest;
116 @@ -112,7 +115,7 @@ err_nolock:
117 return 0;
118 }
119
120 -void br_handle_frame(struct sk_buff *skb)
121 +int br_handle_frame(struct sk_buff *skb)
122 {
123 struct net_bridge *br;
124 unsigned char *dest;
125 @@ -146,25 +149,35 @@ void br_handle_frame(struct sk_buff *skb
126 goto handle_special_frame;
127
128 if (p->state == BR_STATE_FORWARDING) {
129 +
130 + if (br_should_route_hook && br_should_route_hook(&skb)) {
131 + read_unlock(&br->lock);
132 + return -1;
133 + }
134 +
135 + if (!memcmp(p->br->dev.dev_addr, dest, ETH_ALEN))
136 + skb->pkt_type = PACKET_HOST;
137 +
138 NF_HOOK(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
139 br_handle_frame_finish);
140 read_unlock(&br->lock);
141 - return;
142 + return 0;
143 }
144
145 err:
146 read_unlock(&br->lock);
147 err_nolock:
148 kfree_skb(skb);
149 - return;
150 + return 0;
151
152 handle_special_frame:
153 if (!dest[5]) {
154 br_stp_handle_bpdu(skb);
155 read_unlock(&br->lock);
156 - return;
157 + return 0;
158 }
159
160 read_unlock(&br->lock);
161 kfree_skb(skb);
162 + return 0;
163 }
164 --- linux-2.4.21/net/bridge/br_forward.c Sat Aug 3 02:39:46 2002
165 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_forward.c Fri Aug 8 01:09:06 2003
166 @@ -30,18 +30,22 @@ static inline int should_deliver(struct
167 return 1;
168 }
169
170 -static int __dev_queue_push_xmit(struct sk_buff *skb)
171 +int br_dev_queue_push_xmit(struct sk_buff *skb)
172 {
173 +#ifdef CONFIG_NETFILTER
174 + if (skb->nf_bridge)
175 + memcpy(skb->data - 16, skb->nf_bridge->hh, 16);
176 +#endif
177 skb_push(skb, ETH_HLEN);
178 dev_queue_xmit(skb);
179
180 return 0;
181 }
182
183 -static int __br_forward_finish(struct sk_buff *skb)
184 +int br_forward_finish(struct sk_buff *skb)
185 {
186 NF_HOOK(PF_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
187 - __dev_queue_push_xmit);
188 + br_dev_queue_push_xmit);
189
190 return 0;
191 }
192 @@ -49,8 +53,11 @@ static int __br_forward_finish(struct sk
193 static void __br_deliver(struct net_bridge_port *to, struct sk_buff *skb)
194 {
195 skb->dev = to->dev;
196 +#ifdef CONFIG_NETFILTER_DEBUG
197 + skb->nf_debug = 0;
198 +#endif
199 NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
200 - __br_forward_finish);
201 + br_forward_finish);
202 }
203
204 static void __br_forward(struct net_bridge_port *to, struct sk_buff *skb)
205 @@ -61,7 +68,7 @@ static void __br_forward(struct net_brid
206 skb->dev = to->dev;
207
208 NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
209 - __br_forward_finish);
210 + br_forward_finish);
211 }
212
213 /* called under bridge lock */
214 --- linux-2.4.21/net/bridge/br.c Fri Nov 29 00:53:15 2002
215 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br.c Fri Aug 8 01:09:06 2003
216 @@ -29,6 +29,8 @@
217 #include "../atm/lec.h"
218 #endif
219
220 +int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
221 +
222 void br_dec_use_count()
223 {
224 MOD_DEC_USE_COUNT;
225 @@ -43,6 +45,10 @@ static int __init br_init(void)
226 {
227 printk(KERN_INFO "NET4: Ethernet Bridge 008 for NET4.0\n");
228
229 +#ifdef CONFIG_NETFILTER
230 + if (br_netfilter_init())
231 + return 1;
232 +#endif
233 br_handle_frame_hook = br_handle_frame;
234 br_ioctl_hook = br_ioctl_deviceless_stub;
235 #if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
236 @@ -61,6 +67,9 @@ static void __br_clear_ioctl_hook(void)
237
238 static void __exit br_deinit(void)
239 {
240 +#ifdef CONFIG_NETFILTER
241 + br_netfilter_fini();
242 +#endif
243 unregister_netdevice_notifier(&br_device_notifier);
244 br_call_ioctl_atomic(__br_clear_ioctl_hook);
245
246 @@ -74,7 +83,7 @@ static void __exit br_deinit(void)
247 #endif
248 }
249
250 -EXPORT_NO_SYMBOLS;
251 +EXPORT_SYMBOL(br_should_route_hook);
252
253 module_init(br_init)
254 module_exit(br_deinit)
255 --- linux-2.4.21/net/bridge/Makefile Fri Dec 29 23:07:24 2000
256 +++ linux-2.4.21-ebt-brnf-3/net/bridge/Makefile Fri Aug 8 01:09:06 2003
257 @@ -7,10 +7,17 @@
258 #
259 # Note 2! The CFLAGS definition is now in the main makefile...
260
261 +export-objs := br.o
262 +
263 O_TARGET := bridge.o
264 obj-y := br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
265 br_ioctl.o br_notify.o br_stp.o br_stp_bpdu.o \
266 br_stp_if.o br_stp_timer.o
267 +
268 +ifeq ($(CONFIG_NETFILTER),y)
269 +obj-y += br_netfilter.o
270 +endif
271 +
272 obj-m := $(O_TARGET)
273
274 include $(TOPDIR)/Rules.make
275 --- linux-2.4.21/include/linux/netfilter_bridge.h Tue Jun 12 04:15:27 2001
276 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge.h Fri Aug 8 01:09:06 2003
277 @@ -1,11 +1,14 @@
278 #ifndef __LINUX_BRIDGE_NETFILTER_H
279 #define __LINUX_BRIDGE_NETFILTER_H
280
281 -/* bridge-specific defines for netfilter.
282 +/* bridge-specific defines for netfilter.
283 */
284
285 #include <linux/config.h>
286 #include <linux/netfilter.h>
287 +#if defined(__KERNEL__) && defined(CONFIG_NETFILTER)
288 +#include <asm/atomic.h>
289 +#endif
290
291 /* Bridge Hooks */
292 /* After promisc drops, checksum checks. */
293 @@ -18,7 +21,49 @@
294 #define NF_BR_LOCAL_OUT 3
295 /* Packets about to hit the wire. */
296 #define NF_BR_POST_ROUTING 4
297 -#define NF_BR_NUMHOOKS 5
298 +/* Not really a hook, but used for the ebtables broute table */
299 +#define NF_BR_BROUTING 5
300 +#define NF_BR_NUMHOOKS 6
301
302 +#ifdef __KERNEL__
303
304 +#define BRNF_PKT_TYPE 0x01
305 +#define BRNF_BRIDGED_DNAT 0x02
306 +#define BRNF_DONT_TAKE_PARENT 0x04
307 +#define BRNF_BRIDGED 0x08
308 +
309 +enum nf_br_hook_priorities {
310 + NF_BR_PRI_FIRST = INT_MIN,
311 + NF_BR_PRI_NAT_DST_BRIDGED = -300,
312 + NF_BR_PRI_FILTER_BRIDGED = -200,
313 + NF_BR_PRI_BRNF = 0,
314 + NF_BR_PRI_NAT_DST_OTHER = 100,
315 + NF_BR_PRI_FILTER_OTHER = 200,
316 + NF_BR_PRI_NAT_SRC = 300,
317 + NF_BR_PRI_LAST = INT_MAX,
318 +};
319 +
320 +#ifdef CONFIG_NETFILTER
321 +static inline
322 +struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
323 +{
324 + struct nf_bridge_info **nf_bridge = &(skb->nf_bridge);
325 +
326 + if ((*nf_bridge = kmalloc(sizeof(**nf_bridge), GFP_ATOMIC)) != NULL) {
327 + atomic_set(&(*nf_bridge)->use, 1);
328 + (*nf_bridge)->mask = 0;
329 + (*nf_bridge)->physindev = (*nf_bridge)->physoutdev = NULL;
330 + }
331 +
332 + return *nf_bridge;
333 +}
334 +
335 +struct bridge_skb_cb {
336 + union {
337 + __u32 ipv4;
338 + } daddr;
339 +};
340 +#endif /* CONFIG_NETFILTER */
341 +
342 +#endif /* __KERNEL__ */
343 #endif
344 --- linux-2.4.21/net/Makefile Sat Aug 3 02:39:46 2002
345 +++ linux-2.4.21-ebt-brnf-3/net/Makefile Fri Aug 8 01:09:06 2003
346 @@ -7,7 +7,8 @@
347
348 O_TARGET := network.o
349
350 -mod-subdirs := ipv4/netfilter ipv6/netfilter ipx irda bluetooth atm netlink sched core
351 +mod-subdirs := ipv4/netfilter ipv6/netfilter bridge/netfilter ipx irda \
352 + bluetooth atm netlink sched core
353 export-objs := netsyms.o
354
355 subdir-y := core ethernet
356 @@ -23,6 +24,12 @@ subdir-$(CONFIG_IPV6) += ipv6
357 ifneq ($(CONFIG_IPV6),n)
358 ifneq ($(CONFIG_IPV6),)
359 subdir-$(CONFIG_NETFILTER) += ipv6/netfilter
360 +endif
361 +endif
362 +
363 +ifneq ($(CONFIG_BRIDGE),n)
364 +ifneq ($(CONFIG_BRIDGE),)
365 +subdir-$(CONFIG_BRIDGE) += bridge/netfilter
366 endif
367 endif
368
369 --- linux-2.4.21/net/Config.in Sat Aug 3 02:39:46 2002
370 +++ linux-2.4.21-ebt-brnf-3/net/Config.in Fri Aug 8 01:09:06 2003
371 @@ -65,6 +65,9 @@ if [ "$CONFIG_DECNET" != "n" ]; then
372 source net/decnet/Config.in
373 fi
374 dep_tristate '802.1d Ethernet Bridging' CONFIG_BRIDGE $CONFIG_INET
375 +if [ "$CONFIG_BRIDGE" != "n" -a "$CONFIG_NETFILTER" != "n" ]; then
376 + source net/bridge/netfilter/Config.in
377 +fi
378 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
379 tristate 'CCITT X.25 Packet Layer (EXPERIMENTAL)' CONFIG_X25
380 tristate 'LAPB Data Link Driver (EXPERIMENTAL)' CONFIG_LAPB
381 --- /dev/null Thu Aug 24 11:00:32 2000
382 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/Makefile Fri Aug 8 01:09:06 2003
383 @@ -0,0 +1,30 @@
384 +#
385 +# Makefile for the netfilter modules on top of bridging.
386 +#
387 +# Note! Dependencies are done automagically by 'make dep', which also
388 +# removes any old dependencies. DON'T put your own dependencies here
389 +# unless it's something special (ie not a .c file).
390 +#
391 +# Note 2! The CFLAGS definition is now in the main makefile...
392 +
393 +O_TARGET := netfilter.o
394 +
395 +export-objs := ebtables.o
396 +
397 +obj-$(CONFIG_BRIDGE_NF_EBTABLES) += ebtables.o
398 +obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebtable_filter.o
399 +obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
400 +obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
401 +obj-$(CONFIG_BRIDGE_EBT_IPF) += ebt_ip.o
402 +obj-$(CONFIG_BRIDGE_EBT_ARPF) += ebt_arp.o
403 +obj-$(CONFIG_BRIDGE_EBT_VLANF) += ebt_vlan.o
404 +obj-$(CONFIG_BRIDGE_EBT_MARKF) += ebt_mark_m.o
405 +obj-$(CONFIG_BRIDGE_EBT_802_3) += ebt_802_3.o
406 +obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_pkttype.o
407 +obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_stp.o
408 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
409 +obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
410 +obj-$(CONFIG_BRIDGE_EBT_DNAT) += ebt_dnat.o
411 +obj-$(CONFIG_BRIDGE_EBT_REDIRECT) += ebt_redirect.o
412 +obj-$(CONFIG_BRIDGE_EBT_MARK_T) += ebt_mark.o
413 +include $(TOPDIR)/Rules.make
414 --- /dev/null Thu Aug 24 11:00:32 2000
415 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/Config.in Fri Aug 8 01:09:06 2003
416 @@ -0,0 +1,19 @@
417 +#
418 +# Bridge netfilter configuration
419 +#
420 +dep_tristate ' Bridge: ebtables' CONFIG_BRIDGE_NF_EBTABLES $CONFIG_BRIDGE
421 +dep_tristate ' ebt: filter table support' CONFIG_BRIDGE_EBT_T_FILTER $CONFIG_BRIDGE_NF_EBTABLES
422 +dep_tristate ' ebt: nat table support' CONFIG_BRIDGE_EBT_T_NAT $CONFIG_BRIDGE_NF_EBTABLES
423 +dep_tristate ' ebt: broute table support' CONFIG_BRIDGE_EBT_BROUTE $CONFIG_BRIDGE_NF_EBTABLES
424 +dep_tristate ' ebt: log support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
425 +dep_tristate ' ebt: IP filter support' CONFIG_BRIDGE_EBT_IPF $CONFIG_BRIDGE_NF_EBTABLES
426 +dep_tristate ' ebt: ARP filter support' CONFIG_BRIDGE_EBT_ARPF $CONFIG_BRIDGE_NF_EBTABLES
427 +dep_tristate ' ebt: 802.1Q VLAN filter support' CONFIG_BRIDGE_EBT_VLANF $CONFIG_BRIDGE_NF_EBTABLES
428 +dep_tristate ' ebt: 802.3 filter support' CONFIG_BRIDGE_EBT_802_3 $CONFIG_BRIDGE_NF_EBTABLES
429 +dep_tristate ' ebt: packet type filter support' CONFIG_BRIDGE_EBT_PKTTYPE $CONFIG_BRIDGE_NF_EBTABLES
430 +dep_tristate ' ebt: STP filter support' CONFIG_BRIDGE_EBT_STP $CONFIG_BRIDGE_NF_EBTABLES
431 +dep_tristate ' ebt: mark filter support' CONFIG_BRIDGE_EBT_MARKF $CONFIG_BRIDGE_NF_EBTABLES
432 +dep_tristate ' ebt: snat target support' CONFIG_BRIDGE_EBT_SNAT $CONFIG_BRIDGE_NF_EBTABLES
433 +dep_tristate ' ebt: dnat target support' CONFIG_BRIDGE_EBT_DNAT $CONFIG_BRIDGE_NF_EBTABLES
434 +dep_tristate ' ebt: redirect target support' CONFIG_BRIDGE_EBT_REDIRECT $CONFIG_BRIDGE_NF_EBTABLES
435 +dep_tristate ' ebt: mark target support' CONFIG_BRIDGE_EBT_MARK_T $CONFIG_BRIDGE_NF_EBTABLES
436 --- /dev/null Thu Aug 24 11:00:32 2000
437 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtable_filter.c Fri Aug 8 01:09:06 2003
438 @@ -0,0 +1,90 @@
439 +/*
440 + * ebtable_filter
441 + *
442 + * Authors:
443 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
444 + *
445 + * April, 2002
446 + *
447 + */
448 +
449 +#include <linux/netfilter_bridge/ebtables.h>
450 +#include <linux/module.h>
451 +
452 +#define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
453 + (1 << NF_BR_LOCAL_OUT))
454 +
455 +static struct ebt_entries initial_chains[] =
456 +{
457 + {0, "INPUT", 0, EBT_ACCEPT, 0},
458 + {0, "FORWARD", 0, EBT_ACCEPT, 0},
459 + {0, "OUTPUT", 0, EBT_ACCEPT, 0}
460 +};
461 +
462 +static struct ebt_replace initial_table =
463 +{
464 + "filter", FILTER_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
465 + { [NF_BR_LOCAL_IN]&initial_chains[0], [NF_BR_FORWARD]&initial_chains[1],
466 + [NF_BR_LOCAL_OUT]&initial_chains[2] }, 0, NULL, (char *)initial_chains
467 +};
468 +
469 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
470 +{
471 + if (valid_hooks & ~FILTER_VALID_HOOKS)
472 + return -EINVAL;
473 + return 0;
474 +}
475 +
476 +static struct ebt_table frame_filter =
477 +{
478 + {NULL, NULL}, "filter", &initial_table, FILTER_VALID_HOOKS,
479 + RW_LOCK_UNLOCKED, check, NULL
480 +};
481 +
482 +static unsigned int
483 +ebt_hook (unsigned int hook, struct sk_buff **pskb, const struct net_device *in,
484 + const struct net_device *out, int (*okfn)(struct sk_buff *))
485 +{
486 + return ebt_do_table(hook, pskb, in, out, &frame_filter);
487 +}
488 +
489 +static struct nf_hook_ops ebt_ops_filter[] = {
490 + { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_IN,
491 + NF_BR_PRI_FILTER_BRIDGED},
492 + { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_FORWARD,
493 + NF_BR_PRI_FILTER_BRIDGED},
494 + { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_OUT,
495 + NF_BR_PRI_FILTER_OTHER}
496 +};
497 +
498 +static int __init init(void)
499 +{
500 + int i, j, ret;
501 +
502 + ret = ebt_register_table(&frame_filter);
503 + if (ret < 0)
504 + return ret;
505 + for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
506 + if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
507 + goto cleanup;
508 + return ret;
509 +cleanup:
510 + for (j = 0; j < i; j++)
511 + nf_unregister_hook(&ebt_ops_filter[j]);
512 + ebt_unregister_table(&frame_filter);
513 + return ret;
514 +}
515 +
516 +static void __exit fini(void)
517 +{
518 + int i;
519 +
520 + for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
521 + nf_unregister_hook(&ebt_ops_filter[i]);
522 + ebt_unregister_table(&frame_filter);
523 +}
524 +
525 +module_init(init);
526 +module_exit(fini);
527 +EXPORT_NO_SYMBOLS;
528 +MODULE_LICENSE("GPL");
529 --- /dev/null Thu Aug 24 11:00:32 2000
530 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtable_nat.c Fri Aug 8 01:09:06 2003
531 @@ -0,0 +1,96 @@
532 +/*
533 + * ebtable_nat
534 + *
535 + * Authors:
536 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
537 + *
538 + * April, 2002
539 + *
540 + */
541 +
542 +#include <linux/netfilter_bridge/ebtables.h>
543 +#include <linux/module.h>
544 +#define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
545 + (1 << NF_BR_POST_ROUTING))
546 +
547 +static struct ebt_entries initial_chains[] =
548 +{
549 + {0, "PREROUTING", 0, EBT_ACCEPT, 0},
550 + {0, "OUTPUT", 0, EBT_ACCEPT, 0},
551 + {0, "POSTROUTING", 0, EBT_ACCEPT, 0}
552 +};
553 +
554 +static struct ebt_replace initial_table =
555 +{
556 + "nat", NAT_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
557 + { [NF_BR_PRE_ROUTING]&initial_chains[0], [NF_BR_LOCAL_OUT]&initial_chains[1],
558 + [NF_BR_POST_ROUTING]&initial_chains[2] }, 0, NULL, (char *)initial_chains
559 +};
560 +
561 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
562 +{
563 + if (valid_hooks & ~NAT_VALID_HOOKS)
564 + return -EINVAL;
565 + return 0;
566 +}
567 +
568 +static struct ebt_table frame_nat =
569 +{
570 + {NULL, NULL}, "nat", &initial_table, NAT_VALID_HOOKS,
571 + RW_LOCK_UNLOCKED, check, NULL
572 +};
573 +
574 +static unsigned int
575 +ebt_nat_dst(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
576 + , const struct net_device *out, int (*okfn)(struct sk_buff *))
577 +{
578 + return ebt_do_table(hook, pskb, in, out, &frame_nat);
579 +}
580 +
581 +static unsigned int
582 +ebt_nat_src(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
583 + , const struct net_device *out, int (*okfn)(struct sk_buff *))
584 +{
585 + return ebt_do_table(hook, pskb, in, out, &frame_nat);
586 +}
587 +
588 +static struct nf_hook_ops ebt_ops_nat[] = {
589 + { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_LOCAL_OUT,
590 + NF_BR_PRI_NAT_DST_OTHER},
591 + { { NULL, NULL }, ebt_nat_src, PF_BRIDGE, NF_BR_POST_ROUTING,
592 + NF_BR_PRI_NAT_SRC},
593 + { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_PRE_ROUTING,
594 + NF_BR_PRI_NAT_DST_BRIDGED},
595 +};
596 +
597 +static int __init init(void)
598 +{
599 + int i, ret, j;
600 +
601 + ret = ebt_register_table(&frame_nat);
602 + if (ret < 0)
603 + return ret;
604 + for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
605 + if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
606 + goto cleanup;
607 + return ret;
608 +cleanup:
609 + for (j = 0; j < i; j++)
610 + nf_unregister_hook(&ebt_ops_nat[j]);
611 + ebt_unregister_table(&frame_nat);
612 + return ret;
613 +}
614 +
615 +static void __exit fini(void)
616 +{
617 + int i;
618 +
619 + for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
620 + nf_unregister_hook(&ebt_ops_nat[i]);
621 + ebt_unregister_table(&frame_nat);
622 +}
623 +
624 +module_init(init);
625 +module_exit(fini);
626 +EXPORT_NO_SYMBOLS;
627 +MODULE_LICENSE("GPL");
628 --- /dev/null Thu Aug 24 11:00:32 2000
629 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtable_broute.c Fri Aug 8 01:09:06 2003
630 @@ -0,0 +1,79 @@
631 +/*
632 + * ebtable_broute
633 + *
634 + * Authors:
635 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
636 + *
637 + * April, 2002
638 + *
639 + * This table lets you choose between routing and bridging for frames
640 + * entering on a bridge enslaved nic. This table is traversed before any
641 + * other ebtables table. See net/bridge/br_input.c.
642 + */
643 +
644 +#include <linux/netfilter_bridge/ebtables.h>
645 +#include <linux/module.h>
646 +#include <linux/if_bridge.h>
647 +#include <linux/brlock.h>
648 +
649 +// EBT_ACCEPT means the frame will be bridged
650 +// EBT_DROP means the frame will be routed
651 +static struct ebt_entries initial_chain =
652 + {0, "BROUTING", 0, EBT_ACCEPT, 0};
653 +
654 +static struct ebt_replace initial_table =
655 +{
656 + "broute", 1 << NF_BR_BROUTING, 0, sizeof(struct ebt_entries),
657 + { [NF_BR_BROUTING]&initial_chain}, 0, NULL, (char *)&initial_chain
658 +};
659 +
660 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
661 +{
662 + if (valid_hooks & ~(1 << NF_BR_BROUTING))
663 + return -EINVAL;
664 + return 0;
665 +}
666 +
667 +static struct ebt_table broute_table =
668 +{
669 + {NULL, NULL}, "broute", &initial_table, 1 << NF_BR_BROUTING,
670 + RW_LOCK_UNLOCKED, check, NULL
671 +};
672 +
673 +static int ebt_broute(struct sk_buff **pskb)
674 +{
675 + int ret;
676 +
677 + ret = ebt_do_table(NF_BR_BROUTING, pskb, (*pskb)->dev, NULL,
678 + &broute_table);
679 + if (ret == NF_DROP)
680 + return 1; // route it
681 + return 0; // bridge it
682 +}
683 +
684 +static int __init init(void)
685 +{
686 + int ret;
687 +
688 + ret = ebt_register_table(&broute_table);
689 + if (ret < 0)
690 + return ret;
691 + br_write_lock_bh(BR_NETPROTO_LOCK);
692 + // see br_input.c
693 + br_should_route_hook = ebt_broute;
694 + br_write_unlock_bh(BR_NETPROTO_LOCK);
695 + return ret;
696 +}
697 +
698 +static void __exit fini(void)
699 +{
700 + br_write_lock_bh(BR_NETPROTO_LOCK);
701 + br_should_route_hook = NULL;
702 + br_write_unlock_bh(BR_NETPROTO_LOCK);
703 + ebt_unregister_table(&broute_table);
704 +}
705 +
706 +module_init(init);
707 +module_exit(fini);
708 +EXPORT_NO_SYMBOLS;
709 +MODULE_LICENSE("GPL");
710 --- /dev/null Thu Aug 24 11:00:32 2000
711 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_802_3.c Fri Aug 8 01:09:06 2003
712 @@ -0,0 +1,74 @@
713 +/*
714 + * 802_3
715 + *
716 + * Author:
717 + * Chris Vitale csv@bluetail.com
718 + *
719 + * May 2003
720 + *
721 + */
722 +
723 +#include <linux/netfilter_bridge/ebtables.h>
724 +#include <linux/netfilter_bridge/ebt_802_3.h>
725 +#include <linux/module.h>
726 +
727 +static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
728 + const struct net_device *out, const void *data, unsigned int datalen)
729 +{
730 + struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
731 + struct ebt_802_3_hdr *hdr = (struct ebt_802_3_hdr *)skb->mac.ethernet;
732 + uint16_t type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
733 +
734 + if (info->bitmask & EBT_802_3_SAP) {
735 + if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP))
736 + return EBT_NOMATCH;
737 + if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
738 + return EBT_NOMATCH;
739 + }
740 +
741 + if (info->bitmask & EBT_802_3_TYPE) {
742 + if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
743 + return EBT_NOMATCH;
744 + if (FWINV(info->type != type, EBT_802_3_TYPE))
745 + return EBT_NOMATCH;
746 + }
747 +
748 + return EBT_MATCH;
749 +}
750 +
751 +static struct ebt_match filter_802_3;
752 +static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
753 + const struct ebt_entry *e, void *data, unsigned int datalen)
754 +{
755 + struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
756 +
757 + if (datalen != EBT_ALIGN(sizeof(struct ebt_802_3_info)))
758 + return -EINVAL;
759 + if (info->bitmask & ~EBT_802_3_MASK || info->invflags & ~EBT_802_3_MASK)
760 + return -EINVAL;
761 +
762 + return 0;
763 +}
764 +
765 +static struct ebt_match filter_802_3 =
766 +{
767 + .name = EBT_802_3_MATCH,
768 + .match = ebt_filter_802_3,
769 + .check = ebt_802_3_check,
770 + .me = THIS_MODULE,
771 +};
772 +
773 +static int __init init(void)
774 +{
775 + return ebt_register_match(&filter_802_3);
776 +}
777 +
778 +static void __exit fini(void)
779 +{
780 + ebt_unregister_match(&filter_802_3);
781 +}
782 +
783 +module_init(init);
784 +module_exit(fini);
785 +EXPORT_NO_SYMBOLS;
786 +MODULE_LICENSE("GPL");
787 --- /dev/null Thu Aug 24 11:00:32 2000
788 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_mark.c Fri Aug 8 01:09:06 2003
789 @@ -0,0 +1,66 @@
790 +/*
791 + * ebt_mark
792 + *
793 + * Authors:
794 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
795 + *
796 + * July, 2002
797 + *
798 + */
799 +
800 +// The mark target can be used in any chain
801 +// I believe adding a mangle table just for marking is total overkill
802 +// Marking a frame doesn't really change anything in the frame anyway
803 +
804 +#include <linux/netfilter_bridge/ebtables.h>
805 +#include <linux/netfilter_bridge/ebt_mark_t.h>
806 +#include <linux/module.h>
807 +
808 +static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
809 + const struct net_device *in, const struct net_device *out,
810 + const void *data, unsigned int datalen)
811 +{
812 + struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
813 +
814 + if ((*pskb)->nfmark != info->mark) {
815 + (*pskb)->nfmark = info->mark;
816 + (*pskb)->nfcache |= NFC_ALTERED;
817 + }
818 + return info->target;
819 +}
820 +
821 +static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
822 + const struct ebt_entry *e, void *data, unsigned int datalen)
823 +{
824 + struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
825 +
826 + if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
827 + return -EINVAL;
828 + if (BASE_CHAIN && info->target == EBT_RETURN)
829 + return -EINVAL;
830 + CLEAR_BASE_CHAIN_BIT;
831 + if (INVALID_TARGET)
832 + return -EINVAL;
833 + return 0;
834 +}
835 +
836 +static struct ebt_target mark_target =
837 +{
838 + {NULL, NULL}, EBT_MARK_TARGET, ebt_target_mark,
839 + ebt_target_mark_check, NULL, THIS_MODULE
840 +};
841 +
842 +static int __init init(void)
843 +{
844 + return ebt_register_target(&mark_target);
845 +}
846 +
847 +static void __exit fini(void)
848 +{
849 + ebt_unregister_target(&mark_target);
850 +}
851 +
852 +module_init(init);
853 +module_exit(fini);
854 +EXPORT_NO_SYMBOLS;
855 +MODULE_LICENSE("GPL");
856 --- /dev/null Thu Aug 24 11:00:32 2000
857 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_mark_m.c Fri Aug 8 01:09:06 2003
858 @@ -0,0 +1,61 @@
859 +/*
860 + * ebt_mark_m
861 + *
862 + * Authors:
863 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
864 + *
865 + * July, 2002
866 + *
867 + */
868 +
869 +#include <linux/netfilter_bridge/ebtables.h>
870 +#include <linux/netfilter_bridge/ebt_mark_m.h>
871 +#include <linux/module.h>
872 +
873 +static int ebt_filter_mark(const struct sk_buff *skb,
874 + const struct net_device *in, const struct net_device *out, const void *data,
875 + unsigned int datalen)
876 +{
877 + struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
878 +
879 + if (info->bitmask & EBT_MARK_OR)
880 + return !(!!(skb->nfmark & info->mask) ^ info->invert);
881 + return !(((skb->nfmark & info->mask) == info->mark) ^ info->invert);
882 +}
883 +
884 +static int ebt_mark_check(const char *tablename, unsigned int hookmask,
885 + const struct ebt_entry *e, void *data, unsigned int datalen)
886 +{
887 + struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
888 +
889 + if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
890 + return -EINVAL;
891 + if (info->bitmask & ~EBT_MARK_MASK)
892 + return -EINVAL;
893 + if ((info->bitmask & EBT_MARK_OR) && (info->bitmask & EBT_MARK_AND))
894 + return -EINVAL;
895 + if (!info->bitmask)
896 + return -EINVAL;
897 + return 0;
898 +}
899 +
900 +static struct ebt_match filter_mark =
901 +{
902 + {NULL, NULL}, EBT_MARK_MATCH, ebt_filter_mark, ebt_mark_check, NULL,
903 + THIS_MODULE
904 +};
905 +
906 +static int __init init(void)
907 +{
908 + return ebt_register_match(&filter_mark);
909 +}
910 +
911 +static void __exit fini(void)
912 +{
913 + ebt_unregister_match(&filter_mark);
914 +}
915 +
916 +module_init(init);
917 +module_exit(fini);
918 +EXPORT_NO_SYMBOLS;
919 +MODULE_LICENSE("GPL");
920 --- /dev/null Thu Aug 24 11:00:32 2000
921 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_pkttype.c Fri Aug 8 01:09:06 2003
922 @@ -0,0 +1,60 @@
923 +/*
924 + * ebt_pkttype
925 + *
926 + * Authors:
927 + * Bart De Schuymer <bdschuym@pandora.be>
928 + *
929 + * April, 2003
930 + *
931 + */
932 +
933 +#include <linux/netfilter_bridge/ebtables.h>
934 +#include <linux/netfilter_bridge/ebt_pkttype.h>
935 +#include <linux/module.h>
936 +
937 +static int ebt_filter_pkttype(const struct sk_buff *skb,
938 + const struct net_device *in,
939 + const struct net_device *out,
940 + const void *data,
941 + unsigned int datalen)
942 +{
943 + struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
944 +
945 + return (skb->pkt_type != info->pkt_type) ^ info->invert;
946 +}
947 +
948 +static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
949 + const struct ebt_entry *e, void *data, unsigned int datalen)
950 +{
951 + struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
952 +
953 + if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
954 + return -EINVAL;
955 + if (info->invert != 0 && info->invert != 1)
956 + return -EINVAL;
957 + /* Allow any pkt_type value */
958 + return 0;
959 +}
960 +
961 +static struct ebt_match filter_pkttype =
962 +{
963 + .name = EBT_PKTTYPE_MATCH,
964 + .match = ebt_filter_pkttype,
965 + .check = ebt_pkttype_check,
966 + .me = THIS_MODULE,
967 +};
968 +
969 +static int __init init(void)
970 +{
971 + return ebt_register_match(&filter_pkttype);
972 +}
973 +
974 +static void __exit fini(void)
975 +{
976 + ebt_unregister_match(&filter_pkttype);
977 +}
978 +
979 +module_init(init);
980 +module_exit(fini);
981 +EXPORT_NO_SYMBOLS;
982 +MODULE_LICENSE("GPL");
983 --- /dev/null Thu Aug 24 11:00:32 2000
984 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_stp.c Fri Aug 8 01:09:06 2003
985 @@ -0,0 +1,191 @@
986 +/*
987 + * ebt_stp
988 + *
989 + * Authors:
990 + * Bart De Schuymer <bdschuym@pandora.be>
991 + * Stephen Hemminger <shemminger@osdl.org>
992 + *
993 + * June, 2003
994 + */
995 +
996 +#include <linux/netfilter_bridge/ebtables.h>
997 +#include <linux/netfilter_bridge/ebt_stp.h>
998 +#include <linux/module.h>
999 +
1000 +#define BPDU_TYPE_CONFIG 0
1001 +#define BPDU_TYPE_TCN 0x80
1002 +
1003 +struct stp_header {
1004 + uint8_t dsap;
1005 + uint8_t ssap;
1006 + uint8_t ctrl;
1007 + uint8_t pid;
1008 + uint8_t vers;
1009 + uint8_t type;
1010 +};
1011 +
1012 +struct stp_config_pdu {
1013 + uint8_t flags;
1014 + uint8_t root[8];
1015 + uint8_t root_cost[4];
1016 + uint8_t sender[8];
1017 + uint8_t port[2];
1018 + uint8_t msg_age[2];
1019 + uint8_t max_age[2];
1020 + uint8_t hello_time[2];
1021 + uint8_t forward_delay[2];
1022 +};
1023 +
1024 +#define NR16(p) (p[0] << 8 | p[1])
1025 +#define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
1026 +
1027 +static int ebt_filter_config(struct ebt_stp_info *info,
1028 + struct stp_config_pdu *stpc)
1029 +{
1030 + struct ebt_stp_config_info *c;
1031 + uint16_t v16;
1032 + uint32_t v32;
1033 + int verdict, i;
1034 +
1035 + c = &info->config;
1036 + if ((info->bitmask & EBT_STP_FLAGS) &&
1037 + FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
1038 + return EBT_NOMATCH;
1039 + if (info->bitmask & EBT_STP_ROOTPRIO) {
1040 + v16 = NR16(stpc->root);
1041 + if (FWINV(v16 < c->root_priol ||
1042 + v16 > c->root_priou, EBT_STP_ROOTPRIO))
1043 + return EBT_NOMATCH;
1044 + }
1045 + if (info->bitmask & EBT_STP_ROOTADDR) {
1046 + verdict = 0;
1047 + for (i = 0; i < 6; i++)
1048 + verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
1049 + c->root_addrmsk[i];
1050 + if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
1051 + return EBT_NOMATCH;
1052 + }
1053 + if (info->bitmask & EBT_STP_ROOTCOST) {
1054 + v32 = NR32(stpc->root_cost);
1055 + if (FWINV(v32 < c->root_costl ||
1056 + v32 > c->root_costu, EBT_STP_ROOTCOST))
1057 + return EBT_NOMATCH;
1058 + }
1059 + if (info->bitmask & EBT_STP_SENDERPRIO) {
1060 + v16 = NR16(stpc->sender);
1061 + if (FWINV(v16 < c->sender_priol ||
1062 + v16 > c->sender_priou, EBT_STP_SENDERPRIO))
1063 + return EBT_NOMATCH;
1064 + }
1065 + if (info->bitmask & EBT_STP_SENDERADDR) {
1066 + verdict = 0;
1067 + for (i = 0; i < 6; i++)
1068 + verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
1069 + c->sender_addrmsk[i];
1070 + if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
1071 + return EBT_NOMATCH;
1072 + }
1073 + if (info->bitmask & EBT_STP_PORT) {
1074 + v16 = NR16(stpc->port);
1075 + if (FWINV(v16 < c->portl ||
1076 + v16 > c->portu, EBT_STP_PORT))
1077 + return EBT_NOMATCH;
1078 + }
1079 + if (info->bitmask & EBT_STP_MSGAGE) {
1080 + v16 = NR16(stpc->msg_age);
1081 + if (FWINV(v16 < c->msg_agel ||
1082 + v16 > c->msg_ageu, EBT_STP_MSGAGE))
1083 + return EBT_NOMATCH;
1084 + }
1085 + if (info->bitmask & EBT_STP_MAXAGE) {
1086 + v16 = NR16(stpc->max_age);
1087 + if (FWINV(v16 < c->max_agel ||
1088 + v16 > c->max_ageu, EBT_STP_MAXAGE))
1089 + return EBT_NOMATCH;
1090 + }
1091 + if (info->bitmask & EBT_STP_HELLOTIME) {
1092 + v16 = NR16(stpc->hello_time);
1093 + if (FWINV(v16 < c->hello_timel ||
1094 + v16 > c->hello_timeu, EBT_STP_HELLOTIME))
1095 + return EBT_NOMATCH;
1096 + }
1097 + if (info->bitmask & EBT_STP_FWDD) {
1098 + v16 = NR16(stpc->forward_delay);
1099 + if (FWINV(v16 < c->forward_delayl ||
1100 + v16 > c->forward_delayu, EBT_STP_FWDD))
1101 + return EBT_NOMATCH;
1102 + }
1103 + return EBT_MATCH;
1104 +}
1105 +
1106 +static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
1107 + const struct net_device *out, const void *data, unsigned int datalen)
1108 +{
1109 + struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1110 + struct stp_header stph;
1111 + uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
1112 + if (skb_copy_bits(skb, 0, &stph, sizeof(stph)))
1113 + return EBT_NOMATCH;
1114 +
1115 + /* The stp code only considers these */
1116 + if (memcmp(&stph, header, sizeof(header)))
1117 + return EBT_NOMATCH;
1118 +
1119 + if (info->bitmask & EBT_STP_TYPE
1120 + && FWINV(info->type != stph.type, EBT_STP_TYPE))
1121 + return EBT_NOMATCH;
1122 +
1123 + if (stph.type == BPDU_TYPE_CONFIG &&
1124 + info->bitmask & EBT_STP_CONFIG_MASK) {
1125 + struct stp_config_pdu stpc;
1126 +
1127 + if (skb_copy_bits(skb, sizeof(stph), &stpc, sizeof(stpc)))
1128 + return EBT_NOMATCH;
1129 + return ebt_filter_config(info, &stpc);
1130 + }
1131 + return EBT_MATCH;
1132 +}
1133 +
1134 +static int ebt_stp_check(const char *tablename, unsigned int hookmask,
1135 + const struct ebt_entry *e, void *data, unsigned int datalen)
1136 +{
1137 + struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1138 + int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
1139 + uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
1140 + uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1141 +
1142 + if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
1143 + !(info->bitmask & EBT_STP_MASK))
1144 + return -EINVAL;
1145 + if (datalen != len)
1146 + return -EINVAL;
1147 + /* Make sure the match only receives stp frames */
1148 + if (memcmp(e->destmac, bridge_ula, ETH_ALEN) ||
1149 + memcmp(e->destmsk, msk, ETH_ALEN) || !(e->bitmask & EBT_DESTMAC))
1150 + return -EINVAL;
1151 +
1152 + return 0;
1153 +}
1154 +
1155 +static struct ebt_match filter_stp =
1156 +{
1157 + .name = EBT_STP_MATCH,
1158 + .match = ebt_filter_stp,
1159 + .check = ebt_stp_check,
1160 + .me = THIS_MODULE,
1161 +};
1162 +
1163 +static int __init init(void)
1164 +{
1165 + return ebt_register_match(&filter_stp);
1166 +}
1167 +
1168 +static void __exit fini(void)
1169 +{
1170 + ebt_unregister_match(&filter_stp);
1171 +}
1172 +
1173 +module_init(init);
1174 +module_exit(fini);
1175 +EXPORT_NO_SYMBOLS;
1176 +MODULE_LICENSE("GPL");
1177 --- /dev/null Thu Aug 24 11:00:32 2000
1178 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_redirect.c Fri Aug 8 01:09:06 2003
1179 @@ -0,0 +1,71 @@
1180 +/*
1181 + * ebt_redirect
1182 + *
1183 + * Authors:
1184 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1185 + *
1186 + * April, 2002
1187 + *
1188 + */
1189 +
1190 +#include <linux/netfilter_bridge/ebtables.h>
1191 +#include <linux/netfilter_bridge/ebt_redirect.h>
1192 +#include <linux/module.h>
1193 +#include <net/sock.h>
1194 +#include "../br_private.h"
1195 +
1196 +static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
1197 + const struct net_device *in, const struct net_device *out,
1198 + const void *data, unsigned int datalen)
1199 +{
1200 + struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1201 +
1202 + if (hooknr != NF_BR_BROUTING)
1203 + memcpy((**pskb).mac.ethernet->h_dest,
1204 + in->br_port->br->dev.dev_addr, ETH_ALEN);
1205 + else {
1206 + memcpy((**pskb).mac.ethernet->h_dest,
1207 + in->dev_addr, ETH_ALEN);
1208 + (*pskb)->pkt_type = PACKET_HOST;
1209 + }
1210 + return info->target;
1211 +}
1212 +
1213 +static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
1214 + const struct ebt_entry *e, void *data, unsigned int datalen)
1215 +{
1216 + struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1217 +
1218 + if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
1219 + return -EINVAL;
1220 + if (BASE_CHAIN && info->target == EBT_RETURN)
1221 + return -EINVAL;
1222 + CLEAR_BASE_CHAIN_BIT;
1223 + if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
1224 + (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
1225 + return -EINVAL;
1226 + if (INVALID_TARGET)
1227 + return -EINVAL;
1228 + return 0;
1229 +}
1230 +
1231 +static struct ebt_target redirect_target =
1232 +{
1233 + {NULL, NULL}, EBT_REDIRECT_TARGET, ebt_target_redirect,
1234 + ebt_target_redirect_check, NULL, THIS_MODULE
1235 +};
1236 +
1237 +static int __init init(void)
1238 +{
1239 + return ebt_register_target(&redirect_target);
1240 +}
1241 +
1242 +static void __exit fini(void)
1243 +{
1244 + ebt_unregister_target(&redirect_target);
1245 +}
1246 +
1247 +module_init(init);
1248 +module_exit(fini);
1249 +EXPORT_NO_SYMBOLS;
1250 +MODULE_LICENSE("GPL");
1251 --- /dev/null Thu Aug 24 11:00:32 2000
1252 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_arp.c Fri Aug 8 01:09:06 2003
1253 @@ -0,0 +1,149 @@
1254 +/*
1255 + * ebt_arp
1256 + *
1257 + * Authors:
1258 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1259 + * Tim Gardner <timg@tpi.com>
1260 + *
1261 + * April, 2002
1262 + *
1263 + */
1264 +
1265 +#include <linux/netfilter_bridge/ebtables.h>
1266 +#include <linux/netfilter_bridge/ebt_arp.h>
1267 +#include <linux/if_arp.h>
1268 +#include <linux/if_ether.h>
1269 +#include <linux/module.h>
1270 +
1271 +static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
1272 + const struct net_device *out, const void *data, unsigned int datalen)
1273 +{
1274 + struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1275 +
1276 + if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
1277 + ((*skb).nh.arph)->ar_op, EBT_ARP_OPCODE))
1278 + return EBT_NOMATCH;
1279 + if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
1280 + ((*skb).nh.arph)->ar_hrd, EBT_ARP_HTYPE))
1281 + return EBT_NOMATCH;
1282 + if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
1283 + ((*skb).nh.arph)->ar_pro, EBT_ARP_PTYPE))
1284 + return EBT_NOMATCH;
1285 +
1286 + if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP))
1287 + {
1288 + uint32_t arp_len = sizeof(struct arphdr) +
1289 + (2 * (((*skb).nh.arph)->ar_hln)) +
1290 + (2 * (((*skb).nh.arph)->ar_pln));
1291 + uint32_t dst;
1292 + uint32_t src;
1293 +
1294 + // Make sure the packet is long enough.
1295 + if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1296 + return EBT_NOMATCH;
1297 + // IPv4 addresses are always 4 bytes.
1298 + if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
1299 + return EBT_NOMATCH;
1300 +
1301 + if (info->bitmask & EBT_ARP_SRC_IP) {
1302 + memcpy(&src, ((*skb).nh.raw) + sizeof(struct arphdr) +
1303 + ((*skb).nh.arph)->ar_hln, sizeof(uint32_t));
1304 + if (FWINV(info->saddr != (src & info->smsk),
1305 + EBT_ARP_SRC_IP))
1306 + return EBT_NOMATCH;
1307 + }
1308 +
1309 + if (info->bitmask & EBT_ARP_DST_IP) {
1310 + memcpy(&dst, ((*skb).nh.raw)+sizeof(struct arphdr) +
1311 + (2*(((*skb).nh.arph)->ar_hln)) +
1312 + (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
1313 + if (FWINV(info->daddr != (dst & info->dmsk),
1314 + EBT_ARP_DST_IP))
1315 + return EBT_NOMATCH;
1316 + }
1317 + }
1318 +
1319 + if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC))
1320 + {
1321 + uint32_t arp_len = sizeof(struct arphdr) +
1322 + (2 * (((*skb).nh.arph)->ar_hln)) +
1323 + (2 * (((*skb).nh.arph)->ar_pln));
1324 + unsigned char dst[ETH_ALEN];
1325 + unsigned char src[ETH_ALEN];
1326 +
1327 + // Make sure the packet is long enough.
1328 + if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1329 + return EBT_NOMATCH;
1330 + // MAC addresses are 6 bytes.
1331 + if (((*skb).nh.arph)->ar_hln != ETH_ALEN)
1332 + return EBT_NOMATCH;
1333 + if (info->bitmask & EBT_ARP_SRC_MAC) {
1334 + uint8_t verdict, i;
1335 +
1336 + memcpy(&src, ((*skb).nh.raw) +
1337 + sizeof(struct arphdr),
1338 + ETH_ALEN);
1339 + verdict = 0;
1340 + for (i = 0; i < 6; i++)
1341 + verdict |= (src[i] ^ info->smaddr[i]) &
1342 + info->smmsk[i];
1343 + if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
1344 + return EBT_NOMATCH;
1345 + }
1346 +
1347 + if (info->bitmask & EBT_ARP_DST_MAC) {
1348 + uint8_t verdict, i;
1349 +
1350 + memcpy(&dst, ((*skb).nh.raw) +
1351 + sizeof(struct arphdr) +
1352 + (((*skb).nh.arph)->ar_hln) +
1353 + (((*skb).nh.arph)->ar_pln),
1354 + ETH_ALEN);
1355 + verdict = 0;
1356 + for (i = 0; i < 6; i++)
1357 + verdict |= (dst[i] ^ info->dmaddr[i]) &
1358 + info->dmmsk[i];
1359 + if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
1360 + return EBT_NOMATCH;
1361 + }
1362 + }
1363 +
1364 + return EBT_MATCH;
1365 +}
1366 +
1367 +static int ebt_arp_check(const char *tablename, unsigned int hookmask,
1368 + const struct ebt_entry *e, void *data, unsigned int datalen)
1369 +{
1370 + struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1371 +
1372 + if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
1373 + return -EINVAL;
1374 + if ((e->ethproto != __constant_htons(ETH_P_ARP) &&
1375 + e->ethproto != __constant_htons(ETH_P_RARP)) ||
1376 + e->invflags & EBT_IPROTO)
1377 + return -EINVAL;
1378 + if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
1379 + return -EINVAL;
1380 + return 0;
1381 +}
1382 +
1383 +static struct ebt_match filter_arp =
1384 +{
1385 + {NULL, NULL}, EBT_ARP_MATCH, ebt_filter_arp, ebt_arp_check, NULL,
1386 + THIS_MODULE
1387 +};
1388 +
1389 +static int __init init(void)
1390 +{
1391 + return ebt_register_match(&filter_arp);
1392 +}
1393 +
1394 +static void __exit fini(void)
1395 +{
1396 + ebt_unregister_match(&filter_arp);
1397 +}
1398 +
1399 +module_init(init);
1400 +module_exit(fini);
1401 +EXPORT_NO_SYMBOLS;
1402 +MODULE_LICENSE("GPL");
1403 --- /dev/null Thu Aug 24 11:00:32 2000
1404 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_ip.c Fri Aug 8 01:09:06 2003
1405 @@ -0,0 +1,121 @@
1406 +/*
1407 + * ebt_ip
1408 + *
1409 + * Authors:
1410 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1411 + *
1412 + * April, 2002
1413 + *
1414 + * Changes:
1415 + * added ip-sport and ip-dport
1416 + * Innominate Security Technologies AG <mhopf@innominate.com>
1417 + * September, 2002
1418 + */
1419 +
1420 +#include <linux/netfilter_bridge/ebtables.h>
1421 +#include <linux/netfilter_bridge/ebt_ip.h>
1422 +#include <linux/ip.h>
1423 +#include <linux/in.h>
1424 +#include <linux/module.h>
1425 +
1426 +struct tcpudphdr {
1427 + uint16_t src;
1428 + uint16_t dst;
1429 +};
1430 +
1431 +union h_u {
1432 + unsigned char *raw;
1433 + struct tcpudphdr *tuh;
1434 +};
1435 +
1436 +static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
1437 + const struct net_device *out, const void *data,
1438 + unsigned int datalen)
1439 +{
1440 + struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1441 +
1442 + if (info->bitmask & EBT_IP_TOS &&
1443 + FWINV(info->tos != ((*skb).nh.iph)->tos, EBT_IP_TOS))
1444 + return EBT_NOMATCH;
1445 + if (info->bitmask & EBT_IP_PROTO) {
1446 + if (FWINV(info->protocol != ((*skb).nh.iph)->protocol,
1447 + EBT_IP_PROTO))
1448 + return EBT_NOMATCH;
1449 + if ( info->protocol == IPPROTO_TCP ||
1450 + info->protocol == IPPROTO_UDP )
1451 + {
1452 + union h_u h;
1453 + h.raw = skb->data + skb->nh.iph->ihl*4;
1454 + if (info->bitmask & EBT_IP_DPORT) {
1455 + uint16_t port = ntohs(h.tuh->dst);
1456 + if (FWINV(port < info->dport[0] ||
1457 + port > info->dport[1],
1458 + EBT_IP_DPORT))
1459 + return EBT_NOMATCH;
1460 + }
1461 + if (info->bitmask & EBT_IP_SPORT) {
1462 + uint16_t port = ntohs(h.tuh->src);
1463 + if (FWINV(port < info->sport[0] ||
1464 + port > info->sport[1],
1465 + EBT_IP_SPORT))
1466 + return EBT_NOMATCH;
1467 + }
1468 + }
1469 + }
1470 + if (info->bitmask & EBT_IP_SOURCE &&
1471 + FWINV((((*skb).nh.iph)->saddr & info->smsk) !=
1472 + info->saddr, EBT_IP_SOURCE))
1473 + return EBT_NOMATCH;
1474 + if ((info->bitmask & EBT_IP_DEST) &&
1475 + FWINV((((*skb).nh.iph)->daddr & info->dmsk) !=
1476 + info->daddr, EBT_IP_DEST))
1477 + return EBT_NOMATCH;
1478 + return EBT_MATCH;
1479 +}
1480 +
1481 +static int ebt_ip_check(const char *tablename, unsigned int hookmask,
1482 + const struct ebt_entry *e, void *data, unsigned int datalen)
1483 +{
1484 + struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1485 +
1486 + if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
1487 + return -EINVAL;
1488 + if (e->ethproto != __constant_htons(ETH_P_IP) ||
1489 + e->invflags & EBT_IPROTO)
1490 + return -EINVAL;
1491 + if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
1492 + return -EINVAL;
1493 + if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
1494 + if (!info->bitmask & EBT_IPROTO)
1495 + return -EINVAL;
1496 + if (info->protocol != IPPROTO_TCP &&
1497 + info->protocol != IPPROTO_UDP)
1498 + return -EINVAL;
1499 + }
1500 + if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
1501 + return -EINVAL;
1502 + if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
1503 + return -EINVAL;
1504 + return 0;
1505 +}
1506 +
1507 +static struct ebt_match filter_ip =
1508 +{
1509 + {NULL, NULL}, EBT_IP_MATCH, ebt_filter_ip, ebt_ip_check, NULL,
1510 + THIS_MODULE
1511 +};
1512 +
1513 +static int __init init(void)
1514 +{
1515 + return ebt_register_match(&filter_ip);
1516 +}
1517 +
1518 +static void __exit fini(void)
1519 +{
1520 + ebt_unregister_match(&filter_ip);
1521 +}
1522 +
1523 +module_init(init);
1524 +module_exit(fini);
1525 +EXPORT_NO_SYMBOLS;
1526 +MODULE_LICENSE("GPL");
1527 --- /dev/null Thu Aug 24 11:00:32 2000
1528 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_vlan.c Fri Aug 8 01:09:06 2003
1529 @@ -0,0 +1,259 @@
1530 +/*
1531 + * Description: EBTables 802.1Q match extension kernelspace module.
1532 + * Authors: Nick Fedchik <nick@fedchik.org.ua>
1533 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1534 + *
1535 + * This program is free software; you can redistribute it and/or modify
1536 + * it under the terms of the GNU General Public License as published by
1537 + * the Free Software Foundation; either version 2 of the License, or
1538 + * (at your option) any later version.
1539 + *
1540 + * This program is distributed in the hope that it will be useful,
1541 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
1542 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1543 + * GNU General Public License for more details.
1544 + *
1545 + * You should have received a copy of the GNU General Public License
1546 + * along with this program; if not, write to the Free Software
1547 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
1548 + */
1549 +
1550 +#include <linux/if_ether.h>
1551 +#include <linux/if_vlan.h>
1552 +#include <linux/module.h>
1553 +#include <linux/netfilter_bridge/ebtables.h>
1554 +#include <linux/netfilter_bridge/ebt_vlan.h>
1555 +
1556 +static unsigned char debug;
1557 +#define MODULE_VERSION "0.6"
1558 +
1559 +MODULE_PARM(debug, "0-1b");
1560 +MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
1561 +MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
1562 +MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
1563 + MODULE_VERSION);
1564 +MODULE_LICENSE("GPL");
1565 +
1566 +
1567 +#define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
1568 +#define INV_FLAG(_inv_flag_) (info->invflags & _inv_flag_) ? "!" : ""
1569 +#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
1570 +#define SET_BITMASK(_BIT_MASK_) info->bitmask |= _BIT_MASK_
1571 +#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return 1;
1572 +
1573 +/*
1574 + * Function description: ebt_filter_vlan() is main engine for
1575 + * checking passed 802.1Q frame according to
1576 + * the passed extension parameters (in the *data buffer)
1577 + * ebt_filter_vlan() is called after successfull check the rule params
1578 + * by ebt_check_vlan() function.
1579 + * Parameters:
1580 + * const struct sk_buff *skb - pointer to passed ethernet frame buffer
1581 + * const void *data - pointer to passed extension parameters
1582 + * unsigned int datalen - length of passed *data buffer
1583 + * const struct net_device *in -
1584 + * const struct net_device *out -
1585 + * const struct ebt_counter *c -
1586 + * Returned values:
1587 + * 0 - ok (all rule params matched)
1588 + * 1 - miss (rule params not acceptable to the parsed frame)
1589 + */
1590 +static int
1591 +ebt_filter_vlan(const struct sk_buff *skb,
1592 + const struct net_device *in,
1593 + const struct net_device *out,
1594 + const void *data, unsigned int datalen)
1595 +{
1596 + struct ebt_vlan_info *info = (struct ebt_vlan_info *) data; /* userspace data */
1597 + struct vlan_ethhdr *frame = (struct vlan_ethhdr *) skb->mac.raw; /* Passed tagged frame */
1598 +
1599 + unsigned short TCI; /* Whole TCI, given from parsed frame */
1600 + unsigned short id; /* VLAN ID, given from frame TCI */
1601 + unsigned char prio; /* user_priority, given from frame TCI */
1602 + unsigned short encap; /* VLAN encapsulated Type/Length field, given from orig frame */
1603 +
1604 + /*
1605 + * Tag Control Information (TCI) consists of the following elements:
1606 + * - User_priority. The user_priority field is three bits in length,
1607 + * interpreted as a binary number.
1608 + * - Canonical Format Indicator (CFI). The Canonical Format Indicator
1609 + * (CFI) is a single bit flag value. Currently ignored.
1610 + * - VLAN Identifier (VID). The VID is encoded as
1611 + * an unsigned binary number.
1612 + */
1613 + TCI = ntohs(frame->h_vlan_TCI);
1614 + id = TCI & VLAN_VID_MASK;
1615 + prio = (TCI >> 13) & 0x7;
1616 + encap = frame->h_vlan_encapsulated_proto;
1617 +
1618 + /*
1619 + * Checking VLAN Identifier (VID)
1620 + */
1621 + if (GET_BITMASK(EBT_VLAN_ID)) { /* Is VLAN ID parsed? */
1622 + EXIT_ON_MISMATCH(id, EBT_VLAN_ID);
1623 + }
1624 + /*
1625 + * Checking user_priority
1626 + */
1627 + if (GET_BITMASK(EBT_VLAN_PRIO)) { /* Is VLAN user_priority parsed? */
1628 + EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO);
1629 + }
1630 + /*
1631 + * Checking Encapsulated Proto (Length/Type) field
1632 + */
1633 + if (GET_BITMASK(EBT_VLAN_ENCAP)) { /* Is VLAN Encap parsed? */
1634 + EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
1635 + }
1636 + /*
1637 + * All possible extension parameters was parsed.
1638 + * If rule never returned by missmatch, then all ok.
1639 + */
1640 + return 0;
1641 +}
1642 +
1643 +/*
1644 + * Function description: ebt_vlan_check() is called when userspace
1645 + * delivers the table entry to the kernel,
1646 + * and to check that userspace doesn't give a bad table.
1647 + * Parameters:
1648 + * const char *tablename - table name string
1649 + * unsigned int hooknr - hook number
1650 + * const struct ebt_entry *e - ebtables entry basic set
1651 + * const void *data - pointer to passed extension parameters
1652 + * unsigned int datalen - length of passed *data buffer
1653 + * Returned values:
1654 + * 0 - ok (all delivered rule params are correct)
1655 + * 1 - miss (rule params is out of range, invalid, incompatible, etc.)
1656 + */
1657 +static int
1658 +ebt_check_vlan(const char *tablename,
1659 + unsigned int hooknr,
1660 + const struct ebt_entry *e, void *data, unsigned int datalen)
1661 +{
1662 + struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
1663 +
1664 + /*
1665 + * Parameters buffer overflow check
1666 + */
1667 + if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
1668 + DEBUG_MSG
1669 + ("passed size %d is not eq to ebt_vlan_info (%d)\n",
1670 + datalen, sizeof(struct ebt_vlan_info));
1671 + return -EINVAL;
1672 + }
1673 +
1674 + /*
1675 + * Is it 802.1Q frame checked?
1676 + */
1677 + if (e->ethproto != __constant_htons(ETH_P_8021Q)) {
1678 + DEBUG_MSG
1679 + ("passed entry proto %2.4X is not 802.1Q (8100)\n",
1680 + (unsigned short) ntohs(e->ethproto));
1681 + return -EINVAL;
1682 + }
1683 +
1684 + /*
1685 + * Check for bitmask range
1686 + * True if even one bit is out of mask
1687 + */
1688 + if (info->bitmask & ~EBT_VLAN_MASK) {
1689 + DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
1690 + info->bitmask, EBT_VLAN_MASK);
1691 + return -EINVAL;
1692 + }
1693 +
1694 + /*
1695 + * Check for inversion flags range
1696 + */
1697 + if (info->invflags & ~EBT_VLAN_MASK) {
1698 + DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
1699 + info->invflags, EBT_VLAN_MASK);
1700 + return -EINVAL;
1701 + }
1702 +
1703 + /*
1704 + * Reserved VLAN ID (VID) values
1705 + * -----------------------------
1706 + * 0 - The null VLAN ID.
1707 + * 1 - The default Port VID (PVID)
1708 + * 0x0FFF - Reserved for implementation use.
1709 + * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096.
1710 + */
1711 + if (GET_BITMASK(EBT_VLAN_ID)) { /* when vlan-id param was spec-ed */
1712 + if (!!info->id) { /* if id!=0 => check vid range */
1713 + if (info->id > VLAN_GROUP_ARRAY_LEN) {
1714 + DEBUG_MSG
1715 + ("id %d is out of range (1-4096)\n",
1716 + info->id);
1717 + return -EINVAL;
1718 + }
1719 + /*
1720 + * Note: This is valid VLAN-tagged frame point.
1721 + * Any value of user_priority are acceptable,
1722 + * but should be ignored according to 802.1Q Std.
1723 + * So we just drop the prio flag.
1724 + */
1725 + info->bitmask &= ~EBT_VLAN_PRIO;
1726 + }
1727 + /*
1728 + * Else, id=0 (null VLAN ID) => user_priority range (any?)
1729 + */
1730 + }
1731 +
1732 + if (GET_BITMASK(EBT_VLAN_PRIO)) {
1733 + if ((unsigned char) info->prio > 7) {
1734 + DEBUG_MSG
1735 + ("prio %d is out of range (0-7)\n",
1736 + info->prio);
1737 + return -EINVAL;
1738 + }
1739 + }
1740 + /*
1741 + * Check for encapsulated proto range - it is possible to be
1742 + * any value for u_short range.
1743 + * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS
1744 + */
1745 + if (GET_BITMASK(EBT_VLAN_ENCAP)) {
1746 + if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) {
1747 + DEBUG_MSG
1748 + ("encap frame length %d is less than minimal\n",
1749 + ntohs(info->encap));
1750 + return -EINVAL;
1751 + }
1752 + }
1753 +
1754 + return 0;
1755 +}
1756 +
1757 +static struct ebt_match filter_vlan = {
1758 + {NULL, NULL},
1759 + EBT_VLAN_MATCH,
1760 + ebt_filter_vlan,
1761 + ebt_check_vlan,
1762 + NULL,
1763 + THIS_MODULE
1764 +};
1765 +
1766 +/*
1767 + * Module initialization function.
1768 + */
1769 +static int __init init(void)
1770 +{
1771 + DEBUG_MSG("ebtables 802.1Q extension module v"
1772 + MODULE_VERSION "\n");
1773 + DEBUG_MSG("module debug=%d\n", !!debug);
1774 + return ebt_register_match(&filter_vlan);
1775 +}
1776 +
1777 +/*
1778 + * Module "finalization" function
1779 + */
1780 +static void __exit fini(void)
1781 +{
1782 + ebt_unregister_match(&filter_vlan);
1783 +}
1784 +
1785 +module_init(init);
1786 +module_exit(fini);
1787 +
1788 +EXPORT_NO_SYMBOLS;
1789 --- /dev/null Thu Aug 24 11:00:32 2000
1790 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_log.c Fri Aug 8 01:09:06 2003
1791 @@ -0,0 +1,152 @@
1792 +/*
1793 + * ebt_log
1794 + *
1795 + * Authors:
1796 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1797 + *
1798 + * April, 2002
1799 + *
1800 + */
1801 +
1802 +#include <linux/netfilter_bridge/ebtables.h>
1803 +#include <linux/netfilter_bridge/ebt_log.h>
1804 +#include <linux/module.h>
1805 +#include <linux/ip.h>
1806 +#include <linux/in.h>
1807 +#include <linux/if_arp.h>
1808 +#include <linux/spinlock.h>
1809 +
1810 +static spinlock_t ebt_log_lock = SPIN_LOCK_UNLOCKED;
1811 +
1812 +static int ebt_log_check(const char *tablename, unsigned int hookmask,
1813 + const struct ebt_entry *e, void *data, unsigned int datalen)
1814 +{
1815 + struct ebt_log_info *info = (struct ebt_log_info *)data;
1816 +
1817 + if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
1818 + return -EINVAL;
1819 + if (info->bitmask & ~EBT_LOG_MASK)
1820 + return -EINVAL;
1821 + if (info->loglevel >= 8)
1822 + return -EINVAL;
1823 + info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
1824 + return 0;
1825 +}
1826 +
1827 +struct tcpudphdr
1828 +{
1829 + uint16_t src;
1830 + uint16_t dst;
1831 +};
1832 +
1833 +struct arppayload
1834 +{
1835 + unsigned char mac_src[ETH_ALEN];
1836 + unsigned char ip_src[4];
1837 + unsigned char mac_dst[ETH_ALEN];
1838 + unsigned char ip_dst[4];
1839 +};
1840 +
1841 +static void print_MAC(unsigned char *p)
1842 +{
1843 + int i;
1844 +
1845 + for (i = 0; i < ETH_ALEN; i++, p++)
1846 + printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
1847 +}
1848 +
1849 +#define myNIPQUAD(a) a[0], a[1], a[2], a[3]
1850 +static void ebt_log(const struct sk_buff *skb, const struct net_device *in,
1851 + const struct net_device *out, const void *data, unsigned int datalen)
1852 +{
1853 + struct ebt_log_info *info = (struct ebt_log_info *)data;
1854 + char level_string[4] = "< >";
1855 + level_string[1] = '0' + info->loglevel;
1856 +
1857 + spin_lock_bh(&ebt_log_lock);
1858 + printk(level_string);
1859 + printk("%s IN=%s OUT=%s ", info->prefix, in ? in->name : "",
1860 + out ? out->name : "");
1861 +
1862 + printk("MAC source = ");
1863 + print_MAC((skb->mac.ethernet)->h_source);
1864 + printk("MAC dest = ");
1865 + print_MAC((skb->mac.ethernet)->h_dest);
1866 +
1867 + printk("proto = 0x%04x", ntohs(((*skb).mac.ethernet)->h_proto));
1868 +
1869 + if ((info->bitmask & EBT_LOG_IP) && skb->mac.ethernet->h_proto ==
1870 + htons(ETH_P_IP)){
1871 + struct iphdr *iph = skb->nh.iph;
1872 + printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
1873 + NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
1874 + printk(" IP tos=0x%02X, IP proto=%d", iph->tos, iph->protocol);
1875 + if (iph->protocol == IPPROTO_TCP ||
1876 + iph->protocol == IPPROTO_UDP) {
1877 + struct tcpudphdr *ports = (struct tcpudphdr *)(skb->data + iph->ihl*4);
1878 +
1879 + if (skb->data + iph->ihl*4 > skb->tail) {
1880 + printk(" INCOMPLETE TCP/UDP header");
1881 + goto out;
1882 + }
1883 + printk(" SPT=%u DPT=%u", ntohs(ports->src),
1884 + ntohs(ports->dst));
1885 + }
1886 + goto out;
1887 + }
1888 +
1889 + if ((info->bitmask & EBT_LOG_ARP) &&
1890 + ((skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) ||
1891 + (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_RARP)))) {
1892 + struct arphdr * arph = skb->nh.arph;
1893 + printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
1894 + ntohs(arph->ar_hrd), ntohs(arph->ar_pro),
1895 + ntohs(arph->ar_op));
1896 + /* If it's for Ethernet and the lengths are OK,
1897 + * then log the ARP payload */
1898 + if (arph->ar_hrd == __constant_htons(1) &&
1899 + arph->ar_hln == ETH_ALEN &&
1900 + arph->ar_pln == sizeof(uint32_t)) {
1901 + struct arppayload *arpp = (struct arppayload *)(skb->data + sizeof(*arph));
1902 +
1903 + if (skb->data + sizeof(*arph) > skb->tail) {
1904 + printk(" INCOMPLETE ARP header");
1905 + goto out;
1906 + }
1907 +
1908 + printk(" ARP MAC SRC=");
1909 + print_MAC(arpp->mac_src);
1910 + printk(" ARP IP SRC=%u.%u.%u.%u",
1911 + myNIPQUAD(arpp->ip_src));
1912 + printk(" ARP MAC DST=");
1913 + print_MAC(arpp->mac_dst);
1914 + printk(" ARP IP DST=%u.%u.%u.%u",
1915 + myNIPQUAD(arpp->ip_dst));
1916 + }
1917 +
1918 + }
1919 +out:
1920 + printk("\n");
1921 + spin_unlock_bh(&ebt_log_lock);
1922 +}
1923 +
1924 +static struct ebt_watcher log =
1925 +{
1926 + {NULL, NULL}, EBT_LOG_WATCHER, ebt_log, ebt_log_check, NULL,
1927 + THIS_MODULE
1928 +};
1929 +
1930 +static int __init init(void)
1931 +{
1932 + return ebt_register_watcher(&log);
1933 +}
1934 +
1935 +static void __exit fini(void)
1936 +{
1937 + ebt_unregister_watcher(&log);
1938 +}
1939 +
1940 +module_init(init);
1941 +module_exit(fini);
1942 +EXPORT_NO_SYMBOLS;
1943 +MODULE_LICENSE("GPL");
1944 --- /dev/null Thu Aug 24 11:00:32 2000
1945 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_snat.c Fri Aug 8 01:09:06 2003
1946 @@ -0,0 +1,64 @@
1947 +/*
1948 + * ebt_snat
1949 + *
1950 + * Authors:
1951 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1952 + *
1953 + * June, 2002
1954 + *
1955 + */
1956 +
1957 +#include <linux/netfilter_bridge/ebtables.h>
1958 +#include <linux/netfilter_bridge/ebt_nat.h>
1959 +#include <linux/module.h>
1960 +
1961 +static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
1962 + const struct net_device *in, const struct net_device *out,
1963 + const void *data, unsigned int datalen)
1964 +{
1965 + struct ebt_nat_info *info = (struct ebt_nat_info *) data;
1966 +
1967 + memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
1968 + ETH_ALEN * sizeof(unsigned char));
1969 + return info->target;
1970 +}
1971 +
1972 +static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
1973 + const struct ebt_entry *e, void *data, unsigned int datalen)
1974 +{
1975 + struct ebt_nat_info *info = (struct ebt_nat_info *) data;
1976 +
1977 + if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
1978 + return -EINVAL;
1979 + if (BASE_CHAIN && info->target == EBT_RETURN)
1980 + return -EINVAL;
1981 + CLEAR_BASE_CHAIN_BIT;
1982 + if (strcmp(tablename, "nat"))
1983 + return -EINVAL;
1984 + if (hookmask & ~(1 << NF_BR_POST_ROUTING))
1985 + return -EINVAL;
1986 + if (INVALID_TARGET)
1987 + return -EINVAL;
1988 + return 0;
1989 +}
1990 +
1991 +static struct ebt_target snat =
1992 +{
1993 + {NULL, NULL}, EBT_SNAT_TARGET, ebt_target_snat, ebt_target_snat_check,
1994 + NULL, THIS_MODULE
1995 +};
1996 +
1997 +static int __init init(void)
1998 +{
1999 + return ebt_register_target(&snat);
2000 +}
2001 +
2002 +static void __exit fini(void)
2003 +{
2004 + ebt_unregister_target(&snat);
2005 +}
2006 +
2007 +module_init(init);
2008 +module_exit(fini);
2009 +EXPORT_NO_SYMBOLS;
2010 +MODULE_LICENSE("GPL");
2011 --- /dev/null Thu Aug 24 11:00:32 2000
2012 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebt_dnat.c Fri Aug 8 01:09:06 2003
2013 @@ -0,0 +1,65 @@
2014 +/*
2015 + * ebt_dnat
2016 + *
2017 + * Authors:
2018 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2019 + *
2020 + * June, 2002
2021 + *
2022 + */
2023 +
2024 +#include <linux/netfilter_bridge/ebtables.h>
2025 +#include <linux/netfilter_bridge/ebt_nat.h>
2026 +#include <linux/module.h>
2027 +#include <net/sock.h>
2028 +
2029 +static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
2030 + const struct net_device *in, const struct net_device *out,
2031 + const void *data, unsigned int datalen)
2032 +{
2033 + struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2034 +
2035 + memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
2036 + ETH_ALEN * sizeof(unsigned char));
2037 + return info->target;
2038 +}
2039 +
2040 +static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
2041 + const struct ebt_entry *e, void *data, unsigned int datalen)
2042 +{
2043 + struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2044 +
2045 + if (BASE_CHAIN && info->target == EBT_RETURN)
2046 + return -EINVAL;
2047 + CLEAR_BASE_CHAIN_BIT;
2048 + if ( (strcmp(tablename, "nat") ||
2049 + (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
2050 + (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
2051 + return -EINVAL;
2052 + if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
2053 + return -EINVAL;
2054 + if (INVALID_TARGET)
2055 + return -EINVAL;
2056 + return 0;
2057 +}
2058 +
2059 +static struct ebt_target dnat =
2060 +{
2061 + {NULL, NULL}, EBT_DNAT_TARGET, ebt_target_dnat, ebt_target_dnat_check,
2062 + NULL, THIS_MODULE
2063 +};
2064 +
2065 +static int __init init(void)
2066 +{
2067 + return ebt_register_target(&dnat);
2068 +}
2069 +
2070 +static void __exit fini(void)
2071 +{
2072 + ebt_unregister_target(&dnat);
2073 +}
2074 +
2075 +module_init(init);
2076 +module_exit(fini);
2077 +EXPORT_NO_SYMBOLS;
2078 +MODULE_LICENSE("GPL");
2079 --- /dev/null Thu Aug 24 11:00:32 2000
2080 +++ linux-2.4.21-ebt-brnf-3/net/bridge/netfilter/ebtables.c Fri Aug 8 01:09:06 2003
2081 @@ -0,0 +1,1490 @@
2082 +/*
2083 + * ebtables
2084 + *
2085 + * Author:
2086 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2087 + *
2088 + * ebtables.c,v 2.0, July, 2002
2089 + *
2090 + * This code is stongly inspired on the iptables code which is
2091 + * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
2092 + *
2093 + * This program is free software; you can redistribute it and/or
2094 + * modify it under the terms of the GNU General Public License
2095 + * as published by the Free Software Foundation; either version
2096 + * 2 of the License, or (at your option) any later version.
2097 + */
2098 +
2099 +// used for print_string
2100 +#include <linux/sched.h>
2101 +#include <linux/tty.h>
2102 +
2103 +#include <linux/kmod.h>
2104 +#include <linux/module.h>
2105 +#include <linux/vmalloc.h>
2106 +#include <linux/netfilter_bridge/ebtables.h>
2107 +#include <linux/spinlock.h>
2108 +#include <asm/uaccess.h>
2109 +#include <linux/smp.h>
2110 +#include <net/sock.h>
2111 +// needed for logical [in,out]-dev filtering
2112 +#include "../br_private.h"
2113 +
2114 +// list_named_find
2115 +#define ASSERT_READ_LOCK(x)
2116 +#define ASSERT_WRITE_LOCK(x)
2117 +#include <linux/netfilter_ipv4/listhelp.h>
2118 +
2119 +#if 0 // use this for remote debugging
2120 +// Copyright (C) 1998 by Ori Pomerantz
2121 +// Print the string to the appropriate tty, the one
2122 +// the current task uses
2123 +static void print_string(char *str)
2124 +{
2125 + struct tty_struct *my_tty;
2126 +
2127 + /* The tty for the current task */
2128 + my_tty = current->tty;
2129 + if (my_tty != NULL) {
2130 + (*(my_tty->driver).write)(my_tty, 0, str, strlen(str));
2131 + (*(my_tty->driver).write)(my_tty, 0, "\015\012", 2);
2132 + }
2133 +}
2134 +
2135 +#define BUGPRINT(args) print_string(args);
2136 +#else
2137 +#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
2138 + "report to author: "format, ## args)
2139 +// #define BUGPRINT(format, args...)
2140 +#endif
2141 +#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
2142 + ": out of memory: "format, ## args)
2143 +// #define MEMPRINT(format, args...)
2144 +
2145 +
2146 +
2147 +// Each cpu has its own set of counters, so there is no need for write_lock in
2148 +// the softirq
2149 +// For reading or updating the counters, the user context needs to
2150 +// get a write_lock
2151 +
2152 +// The size of each set of counters is altered to get cache alignment
2153 +#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
2154 +#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
2155 +#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
2156 + COUNTER_OFFSET(n) * cpu))
2157 +
2158 +
2159 +
2160 +static DECLARE_MUTEX(ebt_mutex);
2161 +static LIST_HEAD(ebt_tables);
2162 +static LIST_HEAD(ebt_targets);
2163 +static LIST_HEAD(ebt_matches);
2164 +static LIST_HEAD(ebt_watchers);
2165 +
2166 +static struct ebt_target ebt_standard_target =
2167 +{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
2168 +
2169 +static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
2170 + const struct sk_buff *skb, const struct net_device *in,
2171 + const struct net_device *out)
2172 +{
2173 + w->u.watcher->watcher(skb, in, out, w->data,
2174 + w->watcher_size);
2175 + // watchers don't give a verdict
2176 + return 0;
2177 +}
2178 +
2179 +static inline int ebt_do_match (struct ebt_entry_match *m,
2180 + const struct sk_buff *skb, const struct net_device *in,
2181 + const struct net_device *out)
2182 +{
2183 + return m->u.match->match(skb, in, out, m->data,
2184 + m->match_size);
2185 +}
2186 +
2187 +static inline int ebt_dev_check(char *entry, const struct net_device *device)
2188 +{
2189 + if (*entry == '\0')
2190 + return 0;
2191 + if (!device)
2192 + return 1;
2193 + return !!strcmp(entry, device->name);
2194 +}
2195 +
2196 +#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
2197 +// process standard matches
2198 +static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
2199 + const struct net_device *in, const struct net_device *out)
2200 +{
2201 + int verdict, i;
2202 +
2203 + if (e->bitmask & EBT_802_3) {
2204 + if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
2205 + return 1;
2206 + } else if (!(e->bitmask & EBT_NOPROTO) &&
2207 + FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
2208 + return 1;
2209 +
2210 + if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
2211 + return 1;
2212 + if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
2213 + return 1;
2214 + if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
2215 + e->logical_in, &in->br_port->br->dev), EBT_ILOGICALIN))
2216 + return 1;
2217 + if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
2218 + e->logical_out, &out->br_port->br->dev), EBT_ILOGICALOUT))
2219 + return 1;
2220 +
2221 + if (e->bitmask & EBT_SOURCEMAC) {
2222 + verdict = 0;
2223 + for (i = 0; i < 6; i++)
2224 + verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
2225 + e->sourcemsk[i];
2226 + if (FWINV2(verdict != 0, EBT_ISOURCE) )
2227 + return 1;
2228 + }
2229 + if (e->bitmask & EBT_DESTMAC) {
2230 + verdict = 0;
2231 + for (i = 0; i < 6; i++)
2232 + verdict |= (h->h_dest[i] ^ e->destmac[i]) &
2233 + e->destmsk[i];
2234 + if (FWINV2(verdict != 0, EBT_IDEST) )
2235 + return 1;
2236 + }
2237 + return 0;
2238 +}
2239 +
2240 +// Do some firewalling
2241 +unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
2242 + const struct net_device *in, const struct net_device *out,
2243 + struct ebt_table *table)
2244 +{
2245 + int i, nentries;
2246 + struct ebt_entry *point;
2247 + struct ebt_counter *counter_base, *cb_base;
2248 + struct ebt_entry_target *t;
2249 + int verdict, sp = 0;
2250 + struct ebt_chainstack *cs;
2251 + struct ebt_entries *chaininfo;
2252 + char *base;
2253 + struct ebt_table_info *private = table->private;
2254 +
2255 + read_lock_bh(&table->lock);
2256 + cb_base = COUNTER_BASE(private->counters, private->nentries,
2257 + cpu_number_map(smp_processor_id()));
2258 + if (private->chainstack)
2259 + cs = private->chainstack[cpu_number_map(smp_processor_id())];
2260 + else
2261 + cs = NULL;
2262 + chaininfo = private->hook_entry[hook];
2263 + nentries = private->hook_entry[hook]->nentries;
2264 + point = (struct ebt_entry *)(private->hook_entry[hook]->data);
2265 + counter_base = cb_base + private->hook_entry[hook]->counter_offset;
2266 + // base for chain jumps
2267 + base = private->entries;
2268 + i = 0;
2269 + while (i < nentries) {
2270 + if (ebt_basic_match(point, (**pskb).mac.ethernet, in, out))
2271 + goto letscontinue;
2272 +
2273 + if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
2274 + goto letscontinue;
2275 +
2276 + // increase counter
2277 + (*(counter_base + i)).pcnt++;
2278 + (*(counter_base + i)).bcnt+=(**pskb).len;
2279 +
2280 + // these should only watch: not modify, nor tell us
2281 + // what to do with the packet
2282 + EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, in,
2283 + out);
2284 +
2285 + t = (struct ebt_entry_target *)
2286 + (((char *)point) + point->target_offset);
2287 + // standard target
2288 + if (!t->u.target->target)
2289 + verdict = ((struct ebt_standard_target *)t)->verdict;
2290 + else
2291 + verdict = t->u.target->target(pskb, hook,
2292 + in, out, t->data, t->target_size);
2293 + if (verdict == EBT_ACCEPT) {
2294 + read_unlock_bh(&table->lock);
2295 + return NF_ACCEPT;
2296 + }
2297 + if (verdict == EBT_DROP) {
2298 + read_unlock_bh(&table->lock);
2299 + return NF_DROP;
2300 + }
2301 + if (verdict == EBT_RETURN) {
2302 +letsreturn:
2303 +#ifdef CONFIG_NETFILTER_DEBUG
2304 + if (sp == 0) {
2305 + BUGPRINT("RETURN on base chain");
2306 + // act like this is EBT_CONTINUE
2307 + goto letscontinue;
2308 + }
2309 +#endif
2310 + sp--;
2311 + // put all the local variables right
2312 + i = cs[sp].n;
2313 + chaininfo = cs[sp].chaininfo;
2314 + nentries = chaininfo->nentries;
2315 + point = cs[sp].e;
2316 + counter_base = cb_base +
2317 + chaininfo->counter_offset;
2318 + continue;
2319 + }
2320 + if (verdict == EBT_CONTINUE)
2321 + goto letscontinue;
2322 +#ifdef CONFIG_NETFILTER_DEBUG
2323 + if (verdict < 0) {
2324 + BUGPRINT("bogus standard verdict\n");
2325 + read_unlock_bh(&table->lock);
2326 + return NF_DROP;
2327 + }
2328 +#endif
2329 + // jump to a udc
2330 + cs[sp].n = i + 1;
2331 + cs[sp].chaininfo = chaininfo;
2332 + cs[sp].e = (struct ebt_entry *)
2333 + (((char *)point) + point->next_offset);
2334 + i = 0;
2335 + chaininfo = (struct ebt_entries *) (base + verdict);
2336 +#ifdef CONFIG_NETFILTER_DEBUG
2337 + if (chaininfo->distinguisher) {
2338 + BUGPRINT("jump to non-chain\n");
2339 + read_unlock_bh(&table->lock);
2340 + return NF_DROP;
2341 + }
2342 +#endif
2343 + nentries = chaininfo->nentries;
2344 + point = (struct ebt_entry *)chaininfo->data;
2345 + counter_base = cb_base + chaininfo->counter_offset;
2346 + sp++;
2347 + continue;
2348 +letscontinue:
2349 + point = (struct ebt_entry *)
2350 + (((char *)point) + point->next_offset);
2351 + i++;
2352 + }
2353 +
2354 + // I actually like this :)
2355 + if (chaininfo->policy == EBT_RETURN)
2356 + goto letsreturn;
2357 + if (chaininfo->policy == EBT_ACCEPT) {
2358 + read_unlock_bh(&table->lock);
2359 + return NF_ACCEPT;
2360 + }
2361 + read_unlock_bh(&table->lock);
2362 + return NF_DROP;
2363 +}
2364 +
2365 +// If it succeeds, returns element and locks mutex
2366 +static inline void *
2367 +find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
2368 + struct semaphore *mutex)
2369 +{
2370 + void *ret;
2371 +
2372 + *error = down_interruptible(mutex);
2373 + if (*error != 0)
2374 + return NULL;
2375 +
2376 + ret = list_named_find(head, name);
2377 + if (!ret) {
2378 + *error = -ENOENT;
2379 + up(mutex);
2380 + }
2381 + return ret;
2382 +}
2383 +
2384 +#ifndef CONFIG_KMOD
2385 +#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
2386 +#else
2387 +static void *
2388 +find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
2389 + int *error, struct semaphore *mutex)
2390 +{
2391 + void *ret;
2392 +
2393 + ret = find_inlist_lock_noload(head, name, error, mutex);
2394 + if (!ret) {
2395 + char modulename[EBT_FUNCTION_MAXNAMELEN + strlen(prefix) + 1];
2396 + strcpy(modulename, prefix);
2397 + strcat(modulename, name);
2398 + request_module(modulename);
2399 + ret = find_inlist_lock_noload(head, name, error, mutex);
2400 + }
2401 + return ret;
2402 +}
2403 +#endif
2404 +
2405 +static inline struct ebt_table *
2406 +find_table_lock(const char *name, int *error, struct semaphore *mutex)
2407 +{
2408 + return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
2409 +}
2410 +
2411 +static inline struct ebt_match *
2412 +find_match_lock(const char *name, int *error, struct semaphore *mutex)
2413 +{
2414 + return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
2415 +}
2416 +
2417 +static inline struct ebt_watcher *
2418 +find_watcher_lock(const char *name, int *error, struct semaphore *mutex)
2419 +{
2420 + return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
2421 +}
2422 +
2423 +static inline struct ebt_target *
2424 +find_target_lock(const char *name, int *error, struct semaphore *mutex)
2425 +{
2426 + return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
2427 +}
2428 +
2429 +static inline int
2430 +ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
2431 + const char *name, unsigned int hookmask, unsigned int *cnt)
2432 +{
2433 + struct ebt_match *match;
2434 + int ret;
2435 +
2436 + if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
2437 + ((char *)e) + e->watchers_offset)
2438 + return -EINVAL;
2439 + match = find_match_lock(m->u.name, &ret, &ebt_mutex);
2440 + if (!match)
2441 + return ret;
2442 + m->u.match = match;
2443 + if (match->me)
2444 + __MOD_INC_USE_COUNT(match->me);
2445 + up(&ebt_mutex);
2446 + if (match->check &&
2447 + match->check(name, hookmask, e, m->data, m->match_size) != 0) {
2448 + BUGPRINT("match->check failed\n");
2449 + if (match->me)
2450 + __MOD_DEC_USE_COUNT(match->me);
2451 + return -EINVAL;
2452 + }
2453 + (*cnt)++;
2454 + return 0;
2455 +}
2456 +
2457 +static inline int
2458 +ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
2459 + const char *name, unsigned int hookmask, unsigned int *cnt)
2460 +{
2461 + struct ebt_watcher *watcher;
2462 + int ret;
2463 +
2464 + if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
2465 + ((char *)e) + e->target_offset)
2466 + return -EINVAL;
2467 + watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
2468 + if (!watcher)
2469 + return ret;
2470 + w->u.watcher = watcher;
2471 + if (watcher->me)
2472 + __MOD_INC_USE_COUNT(watcher->me);
2473 + up(&ebt_mutex);
2474 + if (watcher->check &&
2475 + watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
2476 + BUGPRINT("watcher->check failed\n");
2477 + if (watcher->me)
2478 + __MOD_DEC_USE_COUNT(watcher->me);
2479 + return -EINVAL;
2480 + }
2481 + (*cnt)++;
2482 + return 0;
2483 +}
2484 +
2485 +// this one is very careful, as it is the first function
2486 +// to parse the userspace data
2487 +static inline int
2488 +ebt_check_entry_size_and_hooks(struct ebt_entry *e,
2489 + struct ebt_table_info *newinfo, char *base, char *limit,
2490 + struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
2491 + unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
2492 +{
2493 + int i;
2494 +
2495 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2496 + if ((valid_hooks & (1 << i)) == 0)
2497 + continue;
2498 + if ( (char *)hook_entries[i] - base ==
2499 + (char *)e - newinfo->entries)
2500 + break;
2501 + }
2502 + // beginning of a new chain
2503 + // if i == NF_BR_NUMHOOKS it must be a user defined chain
2504 + if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
2505 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
2506 + // we make userspace set this right,
2507 + // so there is no misunderstanding
2508 + BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
2509 + "in distinguisher\n");
2510 + return -EINVAL;
2511 + }
2512 + // this checks if the previous chain has as many entries
2513 + // as it said it has
2514 + if (*n != *cnt) {
2515 + BUGPRINT("nentries does not equal the nr of entries "
2516 + "in the chain\n");
2517 + return -EINVAL;
2518 + }
2519 + // before we look at the struct, be sure it is not too big
2520 + if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
2521 + > limit) {
2522 + BUGPRINT("entries_size too small\n");
2523 + return -EINVAL;
2524 + }
2525 + if (((struct ebt_entries *)e)->policy != EBT_DROP &&
2526 + ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
2527 + // only RETURN from udc
2528 + if (i != NF_BR_NUMHOOKS ||
2529 + ((struct ebt_entries *)e)->policy != EBT_RETURN) {
2530 + BUGPRINT("bad policy\n");
2531 + return -EINVAL;
2532 + }
2533 + }
2534 + if (i == NF_BR_NUMHOOKS) // it's a user defined chain
2535 + (*udc_cnt)++;
2536 + else
2537 + newinfo->hook_entry[i] = (struct ebt_entries *)e;
2538 + if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
2539 + BUGPRINT("counter_offset != totalcnt");
2540 + return -EINVAL;
2541 + }
2542 + *n = ((struct ebt_entries *)e)->nentries;
2543 + *cnt = 0;
2544 + return 0;
2545 + }
2546 + // a plain old entry, heh
2547 + if (sizeof(struct ebt_entry) > e->watchers_offset ||
2548 + e->watchers_offset > e->target_offset ||
2549 + e->target_offset >= e->next_offset) {
2550 + BUGPRINT("entry offsets not in right order\n");
2551 + return -EINVAL;
2552 + }
2553 + // this is not checked anywhere else
2554 + if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
2555 + BUGPRINT("target size too small\n");
2556 + return -EINVAL;
2557 + }
2558 +
2559 + (*cnt)++;
2560 + (*totalcnt)++;
2561 + return 0;
2562 +}
2563 +
2564 +struct ebt_cl_stack
2565 +{
2566 + struct ebt_chainstack cs;
2567 + int from;
2568 + unsigned int hookmask;
2569 +};
2570 +
2571 +// we need these positions to check that the jumps to a different part of the
2572 +// entries is a jump to the beginning of a new chain.
2573 +static inline int
2574 +ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
2575 + struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
2576 + struct ebt_cl_stack *udc)
2577 +{
2578 + int i;
2579 +
2580 + // we're only interested in chain starts
2581 + if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
2582 + return 0;
2583 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2584 + if ((valid_hooks & (1 << i)) == 0)
2585 + continue;
2586 + if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
2587 + break;
2588 + }
2589 + // only care about udc
2590 + if (i != NF_BR_NUMHOOKS)
2591 + return 0;
2592 +
2593 + udc[*n].cs.chaininfo = (struct ebt_entries *)e;
2594 + // these initialisations are depended on later in check_chainloops()
2595 + udc[*n].cs.n = 0;
2596 + udc[*n].hookmask = 0;
2597 +
2598 + (*n)++;
2599 + return 0;
2600 +}
2601 +
2602 +static inline int
2603 +ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
2604 +{
2605 + if (i && (*i)-- == 0)
2606 + return 1;
2607 + if (m->u.match->destroy)
2608 + m->u.match->destroy(m->data, m->match_size);
2609 + if (m->u.match->me)
2610 + __MOD_DEC_USE_COUNT(m->u.match->me);
2611 +
2612 + return 0;
2613 +}
2614 +
2615 +static inline int
2616 +ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
2617 +{
2618 + if (i && (*i)-- == 0)
2619 + return 1;
2620 + if (w->u.watcher->destroy)
2621 + w->u.watcher->destroy(w->data, w->watcher_size);
2622 + if (w->u.watcher->me)
2623 + __MOD_DEC_USE_COUNT(w->u.watcher->me);
2624 +
2625 + return 0;
2626 +}
2627 +
2628 +static inline int
2629 +ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
2630 +{
2631 + struct ebt_entry_target *t;
2632 +
2633 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2634 + return 0;
2635 + // we're done
2636 + if (cnt && (*cnt)-- == 0)
2637 + return 1;
2638 + EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
2639 + EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
2640 + t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2641 + if (t->u.target->destroy)
2642 + t->u.target->destroy(t->data, t->target_size);
2643 + if (t->u.target->me)
2644 + __MOD_DEC_USE_COUNT(t->u.target->me);
2645 +
2646 + return 0;
2647 +}
2648 +
2649 +static inline int
2650 +ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
2651 + const char *name, unsigned int *cnt, unsigned int valid_hooks,
2652 + struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
2653 +{
2654 + struct ebt_entry_target *t;
2655 + struct ebt_target *target;
2656 + unsigned int i, j, hook = 0, hookmask = 0;
2657 + int ret;
2658 +
2659 + // Don't mess with the struct ebt_entries
2660 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
2661 + return 0;
2662 +
2663 + if (e->bitmask & ~EBT_F_MASK) {
2664 + BUGPRINT("Unknown flag for bitmask\n");
2665 + return -EINVAL;
2666 + }
2667 + if (e->invflags & ~EBT_INV_MASK) {
2668 + BUGPRINT("Unknown flag for inv bitmask\n");
2669 + return -EINVAL;
2670 + }
2671 + if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
2672 + BUGPRINT("NOPROTO & 802_3 not allowed\n");
2673 + return -EINVAL;
2674 + }
2675 + // what hook do we belong to?
2676 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2677 + if ((valid_hooks & (1 << i)) == 0)
2678 + continue;
2679 + if ((char *)newinfo->hook_entry[i] < (char *)e)
2680 + hook = i;
2681 + else
2682 + break;
2683 + }
2684 + // (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
2685 + // a base chain
2686 + if (i < NF_BR_NUMHOOKS)
2687 + hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
2688 + else {
2689 + for (i = 0; i < udc_cnt; i++)
2690 + if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
2691 + break;
2692 + if (i == 0)
2693 + hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
2694 + else
2695 + hookmask = cl_s[i - 1].hookmask;
2696 + }
2697 + i = 0;
2698 + ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
2699 + if (ret != 0)
2700 + goto cleanup_matches;
2701 + j = 0;
2702 + ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
2703 + if (ret != 0)
2704 + goto cleanup_watchers;
2705 + t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
2706 + target = find_target_lock(t->u.name, &ret, &ebt_mutex);
2707 + if (!target)
2708 + goto cleanup_watchers;
2709 + if (target->me)
2710 + __MOD_INC_USE_COUNT(target->me);
2711 + up(&ebt_mutex);
2712 +
2713 + t->u.target = target;
2714 + if (t->u.target == &ebt_standard_target) {
2715 + if (e->target_offset + sizeof(struct ebt_standard_target) >
2716 + e->next_offset) {
2717 + BUGPRINT("Standard target size too big\n");
2718 + ret = -EFAULT;
2719 + goto cleanup_watchers;
2720 + }
2721 + if (((struct ebt_standard_target *)t)->verdict <
2722 + -NUM_STANDARD_TARGETS) {
2723 + BUGPRINT("Invalid standard target\n");
2724 + ret = -EFAULT;
2725 + goto cleanup_watchers;
2726 + }
2727 + } else if ((e->target_offset + t->target_size +
2728 + sizeof(struct ebt_entry_target) > e->next_offset) ||
2729 + (t->u.target->check &&
2730 + t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
2731 + if (t->u.target->me)
2732 + __MOD_DEC_USE_COUNT(t->u.target->me);
2733 + ret = -EFAULT;
2734 + goto cleanup_watchers;
2735 + }
2736 + (*cnt)++;
2737 + return 0;
2738 +cleanup_watchers:
2739 + EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
2740 +cleanup_matches:
2741 + EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
2742 + return ret;
2743 +}
2744 +
2745 +// checks for loops and sets the hook mask for udc
2746 +// the hook mask for udc tells us from which base chains the udc can be
2747 +// accessed. This mask is a parameter to the check() functions of the extensions
2748 +static int check_chainloops(struct ebt_entries *chain,
2749 + struct ebt_cl_stack *cl_s, unsigned int udc_cnt,
2750 + unsigned int hooknr, char *base)
2751 +{
2752 + int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
2753 + struct ebt_entry *e = (struct ebt_entry *)chain->data;
2754 + struct ebt_entry_target *t;
2755 +
2756 + while (pos < nentries || chain_nr != -1) {
2757 + // end of udc, go back one 'recursion' step
2758 + if (pos == nentries) {
2759 + // put back values of the time when this chain was called
2760 + e = cl_s[chain_nr].cs.e;
2761 + if (cl_s[chain_nr].from != -1)
2762 + nentries =
2763 + cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
2764 + else
2765 + nentries = chain->nentries;
2766 + pos = cl_s[chain_nr].cs.n;
2767 + // make sure we won't see a loop that isn't one
2768 + cl_s[chain_nr].cs.n = 0;
2769 + chain_nr = cl_s[chain_nr].from;
2770 + if (pos == nentries)
2771 + continue;
2772 + }
2773 + t = (struct ebt_entry_target *)
2774 + (((char *)e) + e->target_offset);
2775 + if (strcmp(t->u.name, EBT_STANDARD_TARGET))
2776 + goto letscontinue;
2777 + if (e->target_offset + sizeof(struct ebt_standard_target) >
2778 + e->next_offset) {
2779 + BUGPRINT("Standard target size too big\n");
2780 + return -1;
2781 + }
2782 + verdict = ((struct ebt_standard_target *)t)->verdict;
2783 + if (verdict >= 0) { // jump to another chain
2784 + struct ebt_entries *hlp2 =
2785 + (struct ebt_entries *)(base + verdict);
2786 + for (i = 0; i < udc_cnt; i++)
2787 + if (hlp2 == cl_s[i].cs.chaininfo)
2788 + break;
2789 + // bad destination or loop
2790 + if (i == udc_cnt) {
2791 + BUGPRINT("bad destination\n");
2792 + return -1;
2793 + }
2794 + if (cl_s[i].cs.n) {
2795 + BUGPRINT("loop\n");
2796 + return -1;
2797 + }
2798 + // this can't be 0, so the above test is correct
2799 + cl_s[i].cs.n = pos + 1;
2800 + pos = 0;
2801 + cl_s[i].cs.e = ((void *)e + e->next_offset);
2802 + e = (struct ebt_entry *)(hlp2->data);
2803 + nentries = hlp2->nentries;
2804 + cl_s[i].from = chain_nr;
2805 + chain_nr = i;
2806 + // this udc is accessible from the base chain for hooknr
2807 + cl_s[i].hookmask |= (1 << hooknr);
2808 + continue;
2809 + }
2810 +letscontinue:
2811 + e = (void *)e + e->next_offset;
2812 + pos++;
2813 + }
2814 + return 0;
2815 +}
2816 +
2817 +// do the parsing of the table/chains/entries/matches/watchers/targets, heh
2818 +static int translate_table(struct ebt_replace *repl,
2819 + struct ebt_table_info *newinfo)
2820 +{
2821 + unsigned int i, j, k, udc_cnt;
2822 + int ret;
2823 + struct ebt_cl_stack *cl_s = NULL; // used in the checking for chain loops
2824 +
2825 + i = 0;
2826 + while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
2827 + i++;
2828 + if (i == NF_BR_NUMHOOKS) {
2829 + BUGPRINT("No valid hooks specified\n");
2830 + return -EINVAL;
2831 + }
2832 + if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
2833 + BUGPRINT("Chains don't start at beginning\n");
2834 + return -EINVAL;
2835 + }
2836 + // make sure chains are ordered after each other in same order
2837 + // as their corresponding hooks
2838 + for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
2839 + if (!(repl->valid_hooks & (1 << j)))
2840 + continue;
2841 + if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
2842 + BUGPRINT("Hook order must be followed\n");
2843 + return -EINVAL;
2844 + }
2845 + i = j;
2846 + }
2847 +
2848 + for (i = 0; i < NF_BR_NUMHOOKS; i++)
2849 + newinfo->hook_entry[i] = NULL;
2850 +
2851 + newinfo->entries_size = repl->entries_size;
2852 + newinfo->nentries = repl->nentries;
2853 +
2854 + // do some early checkings and initialize some things
2855 + i = 0; // holds the expected nr. of entries for the chain
2856 + j = 0; // holds the up to now counted entries for the chain
2857 + k = 0; // holds the total nr. of entries, should equal
2858 + // newinfo->nentries afterwards
2859 + udc_cnt = 0; // will hold the nr. of user defined chains (udc)
2860 + ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2861 + ebt_check_entry_size_and_hooks, newinfo, repl->entries,
2862 + repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
2863 + &udc_cnt, repl->valid_hooks);
2864 +
2865 + if (ret != 0)
2866 + return ret;
2867 +
2868 + if (i != j) {
2869 + BUGPRINT("nentries does not equal the nr of entries in the "
2870 + "(last) chain\n");
2871 + return -EINVAL;
2872 + }
2873 + if (k != newinfo->nentries) {
2874 + BUGPRINT("Total nentries is wrong\n");
2875 + return -EINVAL;
2876 + }
2877 +
2878 + // check if all valid hooks have a chain
2879 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
2880 + if (newinfo->hook_entry[i] == NULL &&
2881 + (repl->valid_hooks & (1 << i))) {
2882 + BUGPRINT("Valid hook without chain\n");
2883 + return -EINVAL;
2884 + }
2885 + }
2886 +
2887 + // Get the location of the udc, put them in an array
2888 + // While we're at it, allocate the chainstack
2889 + if (udc_cnt) {
2890 + // this will get free'd in do_replace()/ebt_register_table()
2891 + // if an error occurs
2892 + newinfo->chainstack = (struct ebt_chainstack **)
2893 + vmalloc(smp_num_cpus * sizeof(struct ebt_chainstack));
2894 + if (!newinfo->chainstack)
2895 + return -ENOMEM;
2896 + for (i = 0; i < smp_num_cpus; i++) {
2897 + newinfo->chainstack[i] =
2898 + vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
2899 + if (!newinfo->chainstack[i]) {
2900 + while (i)
2901 + vfree(newinfo->chainstack[--i]);
2902 + vfree(newinfo->chainstack);
2903 + newinfo->chainstack = NULL;
2904 + return -ENOMEM;
2905 + }
2906 + }
2907 +
2908 + cl_s = (struct ebt_cl_stack *)
2909 + vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
2910 + if (!cl_s)
2911 + return -ENOMEM;
2912 + i = 0; // the i'th udc
2913 + EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2914 + ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
2915 + repl->valid_hooks, cl_s);
2916 + // sanity check
2917 + if (i != udc_cnt) {
2918 + BUGPRINT("i != udc_cnt\n");
2919 + vfree(cl_s);
2920 + return -EFAULT;
2921 + }
2922 + }
2923 +
2924 + // Check for loops
2925 + for (i = 0; i < NF_BR_NUMHOOKS; i++)
2926 + if (repl->valid_hooks & (1 << i))
2927 + if (check_chainloops(newinfo->hook_entry[i],
2928 + cl_s, udc_cnt, i, newinfo->entries)) {
2929 + if (cl_s)
2930 + vfree(cl_s);
2931 + return -EINVAL;
2932 + }
2933 +
2934 + // we now know the following (along with E=mc²):
2935 + // - the nr of entries in each chain is right
2936 + // - the size of the allocated space is right
2937 + // - all valid hooks have a corresponding chain
2938 + // - there are no loops
2939 + // - wrong data can still be on the level of a single entry
2940 + // - could be there are jumps to places that are not the
2941 + // beginning of a chain. This can only occur in chains that
2942 + // are not accessible from any base chains, so we don't care.
2943 +
2944 + // used to know what we need to clean up if something goes wrong
2945 + i = 0;
2946 + ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2947 + ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
2948 + cl_s, udc_cnt);
2949 + if (ret != 0) {
2950 + EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
2951 + ebt_cleanup_entry, &i);
2952 + }
2953 + if (cl_s)
2954 + vfree(cl_s);
2955 + return ret;
2956 +}
2957 +
2958 +// called under write_lock
2959 +static void get_counters(struct ebt_counter *oldcounters,
2960 + struct ebt_counter *counters, unsigned int nentries)
2961 +{
2962 + int i, cpu;
2963 + struct ebt_counter *counter_base;
2964 +
2965 + // counters of cpu 0
2966 + memcpy(counters, oldcounters,
2967 + sizeof(struct ebt_counter) * nentries);
2968 + // add other counters to those of cpu 0
2969 + for (cpu = 1; cpu < smp_num_cpus; cpu++) {
2970 + counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
2971 + for (i = 0; i < nentries; i++) {
2972 + counters[i].pcnt += counter_base[i].pcnt;
2973 + counters[i].bcnt += counter_base[i].bcnt;
2974 + }
2975 + }
2976 +}
2977 +
2978 +// replace the table
2979 +static int do_replace(void *user, unsigned int len)
2980 +{
2981 + int ret, i, countersize;
2982 + struct ebt_table_info *newinfo;
2983 + struct ebt_replace tmp;
2984 + struct ebt_table *t;
2985 + struct ebt_counter *counterstmp = NULL;
2986 + // used to be able to unlock earlier
2987 + struct ebt_table_info *table;
2988 +
2989 + if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
2990 + return -EFAULT;
2991 +
2992 + if (len != sizeof(tmp) + tmp.entries_size) {
2993 + BUGPRINT("Wrong len argument\n");
2994 + return -EINVAL;
2995 + }
2996 +
2997 + if (tmp.entries_size == 0) {
2998 + BUGPRINT("Entries_size never zero\n");
2999 + return -EINVAL;
3000 + }
3001 + countersize = COUNTER_OFFSET(tmp.nentries) * smp_num_cpus;
3002 + newinfo = (struct ebt_table_info *)
3003 + vmalloc(sizeof(struct ebt_table_info) + countersize);
3004 + if (!newinfo)
3005 + return -ENOMEM;
3006 +
3007 + if (countersize)
3008 + memset(newinfo->counters, 0, countersize);
3009 +
3010 + newinfo->entries = (char *)vmalloc(tmp.entries_size);
3011 + if (!newinfo->entries) {
3012 + ret = -ENOMEM;
3013 + goto free_newinfo;
3014 + }
3015 + if (copy_from_user(
3016 + newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
3017 + BUGPRINT("Couldn't copy entries from userspace\n");
3018 + ret = -EFAULT;
3019 + goto free_entries;
3020 + }
3021 +
3022 + // the user wants counters back
3023 + // the check on the size is done later, when we have the lock
3024 + if (tmp.num_counters) {
3025 + counterstmp = (struct ebt_counter *)
3026 + vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
3027 + if (!counterstmp) {
3028 + ret = -ENOMEM;
3029 + goto free_entries;
3030 + }
3031 + }
3032 + else
3033 + counterstmp = NULL;
3034 +
3035 + // this can get initialized by translate_table()
3036 + newinfo->chainstack = NULL;
3037 + ret = translate_table(&tmp, newinfo);
3038 +
3039 + if (ret != 0)
3040 + goto free_counterstmp;
3041 +
3042 + t = find_table_lock(tmp.name, &ret, &ebt_mutex);
3043 + if (!t)
3044 + goto free_iterate;
3045 +
3046 + // the table doesn't like it
3047 + if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
3048 + goto free_unlock;
3049 +
3050 + if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
3051 + BUGPRINT("Wrong nr. of counters requested\n");
3052 + ret = -EINVAL;
3053 + goto free_unlock;
3054 + }
3055 +
3056 + // we have the mutex lock, so no danger in reading this pointer
3057 + table = t->private;
3058 + // we need an atomic snapshot of the counters
3059 + write_lock_bh(&t->lock);
3060 + if (tmp.num_counters)
3061 + get_counters(t->private->counters, counterstmp,
3062 + t->private->nentries);
3063 +
3064 + t->private = newinfo;
3065 + write_unlock_bh(&t->lock);
3066 + up(&ebt_mutex);
3067 + // So, a user can change the chains while having messed up her counter
3068 + // allocation. Only reason why this is done is because this way the lock
3069 + // is held only once, while this doesn't bring the kernel into a
3070 + // dangerous state.
3071 + if (tmp.num_counters &&
3072 + copy_to_user(tmp.counters, counterstmp,
3073 + tmp.num_counters * sizeof(struct ebt_counter))) {
3074 + BUGPRINT("Couldn't copy counters to userspace\n");
3075 + ret = -EFAULT;
3076 + }
3077 + else
3078 + ret = 0;
3079 +
3080 + // decrease module count and free resources
3081 + EBT_ENTRY_ITERATE(table->entries, table->entries_size,
3082 + ebt_cleanup_entry, NULL);
3083 +
3084 + vfree(table->entries);
3085 + if (table->chainstack) {
3086 + for (i = 0; i < smp_num_cpus; i++)
3087 + vfree(table->chainstack[i]);
3088 + vfree(table->chainstack);
3089 + }
3090 + vfree(table);
3091 +
3092 + if (counterstmp)
3093 + vfree(counterstmp);
3094 + return ret;
3095 +
3096 +free_unlock:
3097 + up(&ebt_mutex);
3098 +free_iterate:
3099 + EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3100 + ebt_cleanup_entry, NULL);
3101 +free_counterstmp:
3102 + if (counterstmp)
3103 + vfree(counterstmp);
3104 + // can be initialized in translate_table()
3105 + if (newinfo->chainstack) {
3106 + for (i = 0; i < smp_num_cpus; i++)
3107 + vfree(newinfo->chainstack[i]);
3108 + vfree(newinfo->chainstack);
3109 + }
3110 +free_entries:
3111 + if (newinfo->entries)
3112 + vfree(newinfo->entries);
3113 +free_newinfo:
3114 + if (newinfo)
3115 + vfree(newinfo);
3116 + return ret;
3117 +}
3118 +
3119 +int ebt_register_target(struct ebt_target *target)
3120 +{
3121 + int ret;
3122 +
3123 + ret = down_interruptible(&ebt_mutex);
3124 + if (ret != 0)
3125 + return ret;
3126 + if (!list_named_insert(&ebt_targets, target)) {
3127 + up(&ebt_mutex);
3128 + return -EEXIST;
3129 + }
3130 + up(&ebt_mutex);
3131 + MOD_INC_USE_COUNT;
3132 +
3133 + return 0;
3134 +}
3135 +
3136 +void ebt_unregister_target(struct ebt_target *target)
3137 +{
3138 + down(&ebt_mutex);
3139 + LIST_DELETE(&ebt_targets, target);
3140 + up(&ebt_mutex);
3141 + MOD_DEC_USE_COUNT;
3142 +}
3143 +
3144 +int ebt_register_match(struct ebt_match *match)
3145 +{
3146 + int ret;
3147 +
3148 + ret = down_interruptible(&ebt_mutex);
3149 + if (ret != 0)
3150 + return ret;
3151 + if (!list_named_insert(&ebt_matches, match)) {
3152 + up(&ebt_mutex);
3153 + return -EEXIST;
3154 + }
3155 + up(&ebt_mutex);
3156 + MOD_INC_USE_COUNT;
3157 +
3158 + return 0;
3159 +}
3160 +
3161 +void ebt_unregister_match(struct ebt_match *match)
3162 +{
3163 + down(&ebt_mutex);
3164 + LIST_DELETE(&ebt_matches, match);
3165 + up(&ebt_mutex);
3166 + MOD_DEC_USE_COUNT;
3167 +}
3168 +
3169 +int ebt_register_watcher(struct ebt_watcher *watcher)
3170 +{
3171 + int ret;
3172 +
3173 + ret = down_interruptible(&ebt_mutex);
3174 + if (ret != 0)
3175 + return ret;
3176 + if (!list_named_insert(&ebt_watchers, watcher)) {
3177 + up(&ebt_mutex);
3178 + return -EEXIST;
3179 + }
3180 + up(&ebt_mutex);
3181 + MOD_INC_USE_COUNT;
3182 +
3183 + return 0;
3184 +}
3185 +
3186 +void ebt_unregister_watcher(struct ebt_watcher *watcher)
3187 +{
3188 + down(&ebt_mutex);
3189 + LIST_DELETE(&ebt_watchers, watcher);
3190 + up(&ebt_mutex);
3191 + MOD_DEC_USE_COUNT;
3192 +}
3193 +
3194 +int ebt_register_table(struct ebt_table *table)
3195 +{
3196 + struct ebt_table_info *newinfo;
3197 + int ret, i, countersize;
3198 +
3199 + if (!table || !table->table ||!table->table->entries ||
3200 + table->table->entries_size == 0 ||
3201 + table->table->counters || table->private) {
3202 + BUGPRINT("Bad table data for ebt_register_table!!!\n");
3203 + return -EINVAL;
3204 + }
3205 +
3206 + countersize = COUNTER_OFFSET(table->table->nentries) * smp_num_cpus;
3207 + newinfo = (struct ebt_table_info *)
3208 + vmalloc(sizeof(struct ebt_table_info) + countersize);
3209 + ret = -ENOMEM;
3210 + if (!newinfo)
3211 + return -ENOMEM;
3212 +
3213 + newinfo->entries = (char *)vmalloc(table->table->entries_size);
3214 + if (!(newinfo->entries))
3215 + goto free_newinfo;
3216 +
3217 + memcpy(newinfo->entries, table->table->entries,
3218 + table->table->entries_size);
3219 +
3220 + if (countersize)
3221 + memset(newinfo->counters, 0, countersize);
3222 +
3223 + // fill in newinfo and parse the entries
3224 + newinfo->chainstack = NULL;
3225 + ret = translate_table(table->table, newinfo);
3226 + if (ret != 0) {
3227 + BUGPRINT("Translate_table failed\n");
3228 + goto free_chainstack;
3229 + }
3230 +
3231 + if (table->check && table->check(newinfo, table->valid_hooks)) {
3232 + BUGPRINT("The table doesn't like its own initial data, lol\n");
3233 + return -EINVAL;
3234 + }
3235 +
3236 + table->private = newinfo;
3237 + table->lock = RW_LOCK_UNLOCKED;
3238 + ret = down_interruptible(&ebt_mutex);
3239 + if (ret != 0)
3240 + goto free_chainstack;
3241 +
3242 + if (list_named_find(&ebt_tables, table->name)) {
3243 + ret = -EEXIST;
3244 + BUGPRINT("Table name already exists\n");
3245 + goto free_unlock;
3246 + }
3247 +
3248 + list_prepend(&ebt_tables, table);
3249 + up(&ebt_mutex);
3250 + MOD_INC_USE_COUNT;
3251 + return 0;
3252 +free_unlock:
3253 + up(&ebt_mutex);
3254 +free_chainstack:
3255 + if (newinfo->chainstack) {
3256 + for (i = 0; i < smp_num_cpus; i++)
3257 + vfree(newinfo->chainstack[i]);
3258 + vfree(newinfo->chainstack);
3259 + }
3260 + vfree(newinfo->entries);
3261 +free_newinfo:
3262 + vfree(newinfo);
3263 + return ret;
3264 +}
3265 +
3266 +void ebt_unregister_table(struct ebt_table *table)
3267 +{
3268 + int i;
3269 +
3270 + if (!table) {
3271 + BUGPRINT("Request to unregister NULL table!!!\n");
3272 + return;
3273 + }
3274 + down(&ebt_mutex);
3275 + LIST_DELETE(&ebt_tables, table);
3276 + up(&ebt_mutex);
3277 + EBT_ENTRY_ITERATE(table->private->entries,
3278 + table->private->entries_size, ebt_cleanup_entry, NULL);
3279 + if (table->private->entries)
3280 + vfree(table->private->entries);
3281 + if (table->private->chainstack) {
3282 + for (i = 0; i < smp_num_cpus; i++)
3283 + vfree(table->private->chainstack[i]);
3284 + vfree(table->private->chainstack);
3285 + }
3286 + vfree(table->private);
3287 + MOD_DEC_USE_COUNT;
3288 +}
3289 +
3290 +// userspace just supplied us with counters
3291 +static int update_counters(void *user, unsigned int len)
3292 +{
3293 + int i, ret;
3294 + struct ebt_counter *tmp;
3295 + struct ebt_replace hlp;
3296 + struct ebt_table *t;
3297 +
3298 + if (copy_from_user(&hlp, user, sizeof(hlp)))
3299 + return -EFAULT;
3300 +
3301 + if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
3302 + return -EINVAL;
3303 + if (hlp.num_counters == 0)
3304 + return -EINVAL;
3305 +
3306 + if ( !(tmp = (struct ebt_counter *)
3307 + vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
3308 + MEMPRINT("Update_counters && nomemory\n");
3309 + return -ENOMEM;
3310 + }
3311 +
3312 + t = find_table_lock(hlp.name, &ret, &ebt_mutex);
3313 + if (!t)
3314 + goto free_tmp;
3315 +
3316 + if (hlp.num_counters != t->private->nentries) {
3317 + BUGPRINT("Wrong nr of counters\n");
3318 + ret = -EINVAL;
3319 + goto unlock_mutex;
3320 + }
3321 +
3322 + if ( copy_from_user(tmp, hlp.counters,
3323 + hlp.num_counters * sizeof(struct ebt_counter)) ) {
3324 + BUGPRINT("Updata_counters && !cfu\n");
3325 + ret = -EFAULT;
3326 + goto unlock_mutex;
3327 + }
3328 +
3329 + // we want an atomic add of the counters
3330 + write_lock_bh(&t->lock);
3331 +
3332 + // we add to the counters of the first cpu
3333 + for (i = 0; i < hlp.num_counters; i++) {
3334 + t->private->counters[i].pcnt += tmp[i].pcnt;
3335 + t->private->counters[i].bcnt += tmp[i].bcnt;
3336 + }
3337 +
3338 + write_unlock_bh(&t->lock);
3339 + ret = 0;
3340 +unlock_mutex:
3341 + up(&ebt_mutex);
3342 +free_tmp:
3343 + vfree(tmp);
3344 + return ret;
3345 +}
3346 +
3347 +static inline int ebt_make_matchname(struct ebt_entry_match *m,
3348 + char *base, char *ubase)
3349 +{
3350 + char *hlp = ubase - base + (char *)m;
3351 + if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
3352 + return -EFAULT;
3353 + return 0;
3354 +}
3355 +
3356 +static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
3357 + char *base, char *ubase)
3358 +{
3359 + char *hlp = ubase - base + (char *)w;
3360 + if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
3361 + return -EFAULT;
3362 + return 0;
3363 +}
3364 +
3365 +static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
3366 +{
3367 + int ret;
3368 + char *hlp;
3369 + struct ebt_entry_target *t;
3370 +
3371 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
3372 + return 0;
3373 +
3374 + hlp = ubase - base + (char *)e + e->target_offset;
3375 + t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
3376 +
3377 + ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
3378 + if (ret != 0)
3379 + return ret;
3380 + ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
3381 + if (ret != 0)
3382 + return ret;
3383 + if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
3384 + return -EFAULT;
3385 + return 0;
3386 +}
3387 +
3388 +// called with ebt_mutex down
3389 +static int copy_everything_to_user(struct ebt_table *t, void *user,
3390 + int *len, int cmd)
3391 +{
3392 + struct ebt_replace tmp;
3393 + struct ebt_counter *counterstmp, *oldcounters;
3394 + unsigned int entries_size, nentries;
3395 + char *entries;
3396 +
3397 + if (cmd == EBT_SO_GET_ENTRIES) {
3398 + entries_size = t->private->entries_size;
3399 + nentries = t->private->nentries;
3400 + entries = t->private->entries;
3401 + oldcounters = t->private->counters;
3402 + } else {
3403 + entries_size = t->table->entries_size;
3404 + nentries = t->table->nentries;
3405 + entries = t->table->entries;
3406 + oldcounters = t->table->counters;
3407 + }
3408 +
3409 + if (copy_from_user(&tmp, user, sizeof(tmp))) {
3410 + BUGPRINT("Cfu didn't work\n");
3411 + return -EFAULT;
3412 + }
3413 +
3414 + if (*len != sizeof(struct ebt_replace) + entries_size +
3415 + (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
3416 + BUGPRINT("Wrong size\n");
3417 + return -EINVAL;
3418 + }
3419 +
3420 + if (tmp.nentries != nentries) {
3421 + BUGPRINT("Nentries wrong\n");
3422 + return -EINVAL;
3423 + }
3424 +
3425 + if (tmp.entries_size != entries_size) {
3426 + BUGPRINT("Wrong size\n");
3427 + return -EINVAL;
3428 + }
3429 +
3430 + // userspace might not need the counters
3431 + if (tmp.num_counters) {
3432 + if (tmp.num_counters != nentries) {
3433 + BUGPRINT("Num_counters wrong\n");
3434 + return -EINVAL;
3435 + }
3436 + counterstmp = (struct ebt_counter *)
3437 + vmalloc(nentries * sizeof(struct ebt_counter));
3438 + if (!counterstmp) {
3439 + MEMPRINT("Couldn't copy counters, out of memory\n");
3440 + return -ENOMEM;
3441 + }
3442 + write_lock_bh(&t->lock);
3443 + get_counters(oldcounters, counterstmp, nentries);
3444 + write_unlock_bh(&t->lock);
3445 +
3446 + if (copy_to_user(tmp.counters, counterstmp,
3447 + nentries * sizeof(struct ebt_counter))) {
3448 + BUGPRINT("Couldn't copy counters to userspace\n");
3449 + vfree(counterstmp);
3450 + return -EFAULT;
3451 + }
3452 + vfree(counterstmp);
3453 + }
3454 +
3455 + if (copy_to_user(tmp.entries, entries, entries_size)) {
3456 + BUGPRINT("Couldn't copy entries to userspace\n");
3457 + return -EFAULT;
3458 + }
3459 + // set the match/watcher/target names right
3460 + return EBT_ENTRY_ITERATE(entries, entries_size,
3461 + ebt_make_names, entries, tmp.entries);
3462 +}
3463 +
3464 +static int do_ebt_set_ctl(struct sock *sk,
3465 + int cmd, void *user, unsigned int len)
3466 +{
3467 + int ret;
3468 +
3469 + switch(cmd) {
3470 + case EBT_SO_SET_ENTRIES:
3471 + ret = do_replace(user, len);
3472 + break;
3473 + case EBT_SO_SET_COUNTERS:
3474 + ret = update_counters(user, len);
3475 + break;
3476 + default:
3477 + ret = -EINVAL;
3478 + }
3479 + return ret;
3480 +}
3481 +
3482 +static int do_ebt_get_ctl(struct sock *sk, int cmd, void *user, int *len)
3483 +{
3484 + int ret;
3485 + struct ebt_replace tmp;
3486 + struct ebt_table *t;
3487 +
3488 + if (copy_from_user(&tmp, user, sizeof(tmp)))
3489 + return -EFAULT;
3490 +
3491 + t = find_table_lock(tmp.name, &ret, &ebt_mutex);
3492 + if (!t)
3493 + return ret;
3494 +
3495 + switch(cmd) {
3496 + case EBT_SO_GET_INFO:
3497 + case EBT_SO_GET_INIT_INFO:
3498 + if (*len != sizeof(struct ebt_replace)){
3499 + ret = -EINVAL;
3500 + up(&ebt_mutex);
3501 + break;
3502 + }
3503 + if (cmd == EBT_SO_GET_INFO) {
3504 + tmp.nentries = t->private->nentries;
3505 + tmp.entries_size = t->private->entries_size;
3506 + tmp.valid_hooks = t->valid_hooks;
3507 + } else {
3508 + tmp.nentries = t->table->nentries;
3509 + tmp.entries_size = t->table->entries_size;
3510 + tmp.valid_hooks = t->table->valid_hooks;
3511 + }
3512 + up(&ebt_mutex);
3513 + if (copy_to_user(user, &tmp, *len) != 0){
3514 + BUGPRINT("c2u Didn't work\n");
3515 + ret = -EFAULT;
3516 + break;
3517 + }
3518 + ret = 0;
3519 + break;
3520 +
3521 + case EBT_SO_GET_ENTRIES:
3522 + case EBT_SO_GET_INIT_ENTRIES:
3523 + ret = copy_everything_to_user(t, user, len, cmd);
3524 + up(&ebt_mutex);
3525 + break;
3526 +
3527 + default:
3528 + up(&ebt_mutex);
3529 + ret = -EINVAL;
3530 + }
3531 +
3532 + return ret;
3533 +}
3534 +
3535 +static struct nf_sockopt_ops ebt_sockopts =
3536 +{ { NULL, NULL }, PF_INET, EBT_BASE_CTL, EBT_SO_SET_MAX + 1, do_ebt_set_ctl,
3537 + EBT_BASE_CTL, EBT_SO_GET_MAX + 1, do_ebt_get_ctl, 0, NULL
3538 +};
3539 +
3540 +static int __init init(void)
3541 +{
3542 + int ret;
3543 +
3544 + down(&ebt_mutex);
3545 + list_named_insert(&ebt_targets, &ebt_standard_target);
3546 + up(&ebt_mutex);
3547 + if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
3548 + return ret;
3549 +
3550 + printk(KERN_NOTICE "Ebtables v2.0 registered\n");
3551 + return 0;
3552 +}
3553 +
3554 +static void __exit fini(void)
3555 +{
3556 + nf_unregister_sockopt(&ebt_sockopts);
3557 + printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
3558 +}
3559 +
3560 +EXPORT_SYMBOL(ebt_register_table);
3561 +EXPORT_SYMBOL(ebt_unregister_table);
3562 +EXPORT_SYMBOL(ebt_register_match);
3563 +EXPORT_SYMBOL(ebt_unregister_match);
3564 +EXPORT_SYMBOL(ebt_register_watcher);
3565 +EXPORT_SYMBOL(ebt_unregister_watcher);
3566 +EXPORT_SYMBOL(ebt_register_target);
3567 +EXPORT_SYMBOL(ebt_unregister_target);
3568 +EXPORT_SYMBOL(ebt_do_table);
3569 +module_init(init);
3570 +module_exit(fini);
3571 +MODULE_LICENSE("GPL");
3572 --- /dev/null Thu Aug 24 11:00:32 2000
3573 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebtables.h Fri Aug 8 01:09:06 2003
3574 @@ -0,0 +1,361 @@
3575 +/*
3576 + * ebtables
3577 + *
3578 + * Authors:
3579 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
3580 + *
3581 + * ebtables.c,v 2.0, September, 2002
3582 + *
3583 + * This code is stongly inspired on the iptables code which is
3584 + * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
3585 + */
3586 +
3587 +#ifndef __LINUX_BRIDGE_EFF_H
3588 +#define __LINUX_BRIDGE_EFF_H
3589 +#include <linux/if.h>
3590 +#include <linux/netfilter_bridge.h>
3591 +#include <linux/if_ether.h>
3592 +
3593 +#define EBT_TABLE_MAXNAMELEN 32
3594 +#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
3595 +#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
3596 +
3597 +// verdicts >0 are "branches"
3598 +#define EBT_ACCEPT -1
3599 +#define EBT_DROP -2
3600 +#define EBT_CONTINUE -3
3601 +#define EBT_RETURN -4
3602 +#define NUM_STANDARD_TARGETS 4
3603 +
3604 +struct ebt_replace
3605 +{
3606 + char name[EBT_TABLE_MAXNAMELEN];
3607 + unsigned int valid_hooks;
3608 + // nr of rules in the table
3609 + unsigned int nentries;
3610 + // total size of the entries
3611 + unsigned int entries_size;
3612 + // start of the chains
3613 + struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
3614 + // nr of counters userspace expects back
3615 + unsigned int num_counters;
3616 + // where the kernel will put the old counters
3617 + struct ebt_counter *counters;
3618 + char *entries;
3619 +};
3620 +
3621 +struct ebt_counter
3622 +{
3623 + uint64_t pcnt;
3624 + uint64_t bcnt;
3625 +};
3626 +
3627 +struct ebt_entries {
3628 + // this field is always set to zero
3629 + // See EBT_ENTRY_OR_ENTRIES.
3630 + // Must be same size as ebt_entry.bitmask
3631 + unsigned int distinguisher;
3632 + // the chain name
3633 + char name[EBT_CHAIN_MAXNAMELEN];
3634 + // counter offset for this chain
3635 + unsigned int counter_offset;
3636 + // one standard (accept, drop, return) per hook
3637 + int policy;
3638 + // nr. of entries
3639 + unsigned int nentries;
3640 + // entry list
3641 + char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3642 +};
3643 +
3644 +// used for the bitmask of struct ebt_entry
3645 +
3646 +// This is a hack to make a difference between an ebt_entry struct and an
3647 +// ebt_entries struct when traversing the entries from start to end.
3648 +// Using this simplifies the code alot, while still being able to use
3649 +// ebt_entries.
3650 +// Contrary, iptables doesn't use something like ebt_entries and therefore uses
3651 +// different techniques for naming the policy and such. So, iptables doesn't
3652 +// need a hack like this.
3653 +#define EBT_ENTRY_OR_ENTRIES 0x01
3654 +// these are the normal masks
3655 +#define EBT_NOPROTO 0x02
3656 +#define EBT_802_3 0x04
3657 +#define EBT_SOURCEMAC 0x08
3658 +#define EBT_DESTMAC 0x10
3659 +#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
3660 + | EBT_ENTRY_OR_ENTRIES)
3661 +
3662 +#define EBT_IPROTO 0x01
3663 +#define EBT_IIN 0x02
3664 +#define EBT_IOUT 0x04
3665 +#define EBT_ISOURCE 0x8
3666 +#define EBT_IDEST 0x10
3667 +#define EBT_ILOGICALIN 0x20
3668 +#define EBT_ILOGICALOUT 0x40
3669 +#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
3670 + | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
3671 +
3672 +struct ebt_entry_match
3673 +{
3674 + union {
3675 + char name[EBT_FUNCTION_MAXNAMELEN];
3676 + struct ebt_match *match;
3677 + } u;
3678 + // size of data
3679 + unsigned int match_size;
3680 + unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3681 +};
3682 +
3683 +struct ebt_entry_watcher
3684 +{
3685 + union {
3686 + char name[EBT_FUNCTION_MAXNAMELEN];
3687 + struct ebt_watcher *watcher;
3688 + } u;
3689 + // size of data
3690 + unsigned int watcher_size;
3691 + unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3692 +};
3693 +
3694 +struct ebt_entry_target
3695 +{
3696 + union {
3697 + char name[EBT_FUNCTION_MAXNAMELEN];
3698 + struct ebt_target *target;
3699 + } u;
3700 + // size of data
3701 + unsigned int target_size;
3702 + unsigned char data[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3703 +};
3704 +
3705 +#define EBT_STANDARD_TARGET "standard"
3706 +struct ebt_standard_target
3707 +{
3708 + struct ebt_entry_target target;
3709 + int verdict;
3710 +};
3711 +
3712 +// one entry
3713 +struct ebt_entry {
3714 + // this needs to be the first field
3715 + unsigned int bitmask;
3716 + unsigned int invflags;
3717 + uint16_t ethproto;
3718 + // the physical in-dev
3719 + char in[IFNAMSIZ];
3720 + // the logical in-dev
3721 + char logical_in[IFNAMSIZ];
3722 + // the physical out-dev
3723 + char out[IFNAMSIZ];
3724 + // the logical out-dev
3725 + char logical_out[IFNAMSIZ];
3726 + unsigned char sourcemac[ETH_ALEN];
3727 + unsigned char sourcemsk[ETH_ALEN];
3728 + unsigned char destmac[ETH_ALEN];
3729 + unsigned char destmsk[ETH_ALEN];
3730 + // sizeof ebt_entry + matches
3731 + unsigned int watchers_offset;
3732 + // sizeof ebt_entry + matches + watchers
3733 + unsigned int target_offset;
3734 + // sizeof ebt_entry + matches + watchers + target
3735 + unsigned int next_offset;
3736 + unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
3737 +};
3738 +
3739 +// [gs]etsockopt numbers
3740 +#define EBT_BASE_CTL 128
3741 +
3742 +#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
3743 +#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
3744 +#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
3745 +
3746 +#define EBT_SO_GET_INFO (EBT_BASE_CTL)
3747 +#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
3748 +#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
3749 +#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
3750 +#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
3751 +
3752 +#ifdef __KERNEL__
3753 +
3754 +// return values for match() functions
3755 +#define EBT_MATCH 0
3756 +#define EBT_NOMATCH 1
3757 +
3758 +struct ebt_match
3759 +{
3760 + struct list_head list;
3761 + const char name[EBT_FUNCTION_MAXNAMELEN];
3762 + // 0 == it matches
3763 + int (*match)(const struct sk_buff *skb, const struct net_device *in,
3764 + const struct net_device *out, const void *matchdata,
3765 + unsigned int datalen);
3766 + // 0 == let it in
3767 + int (*check)(const char *tablename, unsigned int hookmask,
3768 + const struct ebt_entry *e, void *matchdata, unsigned int datalen);
3769 + void (*destroy)(void *matchdata, unsigned int datalen);
3770 + struct module *me;
3771 +};
3772 +
3773 +struct ebt_watcher
3774 +{
3775 + struct list_head list;
3776 + const char name[EBT_FUNCTION_MAXNAMELEN];
3777 + void (*watcher)(const struct sk_buff *skb, const struct net_device *in,
3778 + const struct net_device *out, const void *watcherdata,
3779 + unsigned int datalen);
3780 + // 0 == let it in
3781 + int (*check)(const char *tablename, unsigned int hookmask,
3782 + const struct ebt_entry *e, void *watcherdata, unsigned int datalen);
3783 + void (*destroy)(void *watcherdata, unsigned int datalen);
3784 + struct module *me;
3785 +};
3786 +
3787 +struct ebt_target
3788 +{
3789 + struct list_head list;
3790 + const char name[EBT_FUNCTION_MAXNAMELEN];
3791 + // returns one of the standard verdicts
3792 + int (*target)(struct sk_buff **pskb, unsigned int hooknr,
3793 + const struct net_device *in, const struct net_device *out,
3794 + const void *targetdata, unsigned int datalen);
3795 + // 0 == let it in
3796 + int (*check)(const char *tablename, unsigned int hookmask,
3797 + const struct ebt_entry *e, void *targetdata, unsigned int datalen);
3798 + void (*destroy)(void *targetdata, unsigned int datalen);
3799 + struct module *me;
3800 +};
3801 +
3802 +// used for jumping from and into user defined chains (udc)
3803 +struct ebt_chainstack
3804 +{
3805 + struct ebt_entries *chaininfo; // pointer to chain data
3806 + struct ebt_entry *e; // pointer to entry data
3807 + unsigned int n; // n'th entry
3808 +};
3809 +
3810 +struct ebt_table_info
3811 +{
3812 + // total size of the entries
3813 + unsigned int entries_size;
3814 + unsigned int nentries;
3815 + // pointers to the start of the chains
3816 + struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
3817 + // room to maintain the stack used for jumping from and into udc
3818 + struct ebt_chainstack **chainstack;
3819 + char *entries;
3820 + struct ebt_counter counters[0] ____cacheline_aligned;
3821 +};
3822 +
3823 +struct ebt_table
3824 +{
3825 + struct list_head list;
3826 + char name[EBT_TABLE_MAXNAMELEN];
3827 + struct ebt_replace *table;
3828 + unsigned int valid_hooks;
3829 + rwlock_t lock;
3830 + // e.g. could be the table explicitly only allows certain
3831 + // matches, targets, ... 0 == let it in
3832 + int (*check)(const struct ebt_table_info *info,
3833 + unsigned int valid_hooks);
3834 + // the data used by the kernel
3835 + struct ebt_table_info *private;
3836 +};
3837 +
3838 +#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
3839 + ~(__alignof__(struct ebt_replace)-1))
3840 +extern int ebt_register_table(struct ebt_table *table);
3841 +extern void ebt_unregister_table(struct ebt_table *table);
3842 +extern int ebt_register_match(struct ebt_match *match);
3843 +extern void ebt_unregister_match(struct ebt_match *match);
3844 +extern int ebt_register_watcher(struct ebt_watcher *watcher);
3845 +extern void ebt_unregister_watcher(struct ebt_watcher *watcher);
3846 +extern int ebt_register_target(struct ebt_target *target);
3847 +extern void ebt_unregister_target(struct ebt_target *target);
3848 +extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff **pskb,
3849 + const struct net_device *in, const struct net_device *out,
3850 + struct ebt_table *table);
3851 +
3852 + // Used in the kernel match() functions
3853 +#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
3854 +// True if the hook mask denotes that the rule is in a base chain,
3855 +// used in the check() functions
3856 +#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
3857 +// Clear the bit in the hook mask that tells if the rule is on a base chain
3858 +#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
3859 +// True if the target is not a standard target
3860 +#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
3861 +
3862 +#endif /* __KERNEL__ */
3863 +
3864 +// blatently stolen from ip_tables.h
3865 +// fn returns 0 to continue iteration
3866 +#define EBT_MATCH_ITERATE(e, fn, args...) \
3867 +({ \
3868 + unsigned int __i; \
3869 + int __ret = 0; \
3870 + struct ebt_entry_match *__match; \
3871 + \
3872 + for (__i = sizeof(struct ebt_entry); \
3873 + __i < (e)->watchers_offset; \
3874 + __i += __match->match_size + \
3875 + sizeof(struct ebt_entry_match)) { \
3876 + __match = (void *)(e) + __i; \
3877 + \
3878 + __ret = fn(__match , ## args); \
3879 + if (__ret != 0) \
3880 + break; \
3881 + } \
3882 + if (__ret == 0) { \
3883 + if (__i != (e)->watchers_offset) \
3884 + __ret = -EINVAL; \
3885 + } \
3886 + __ret; \
3887 +})
3888 +
3889 +#define EBT_WATCHER_ITERATE(e, fn, args...) \
3890 +({ \
3891 + unsigned int __i; \
3892 + int __ret = 0; \
3893 + struct ebt_entry_watcher *__watcher; \
3894 + \
3895 + for (__i = e->watchers_offset; \
3896 + __i < (e)->target_offset; \
3897 + __i += __watcher->watcher_size + \
3898 + sizeof(struct ebt_entry_watcher)) { \
3899 + __watcher = (void *)(e) + __i; \
3900 + \
3901 + __ret = fn(__watcher , ## args); \
3902 + if (__ret != 0) \
3903 + break; \
3904 + } \
3905 + if (__ret == 0) { \
3906 + if (__i != (e)->target_offset) \
3907 + __ret = -EINVAL; \
3908 + } \
3909 + __ret; \
3910 +})
3911 +
3912 +#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
3913 +({ \
3914 + unsigned int __i; \
3915 + int __ret = 0; \
3916 + struct ebt_entry *__entry; \
3917 + \
3918 + for (__i = 0; __i < (size);) { \
3919 + __entry = (void *)(entries) + __i; \
3920 + __ret = fn(__entry , ## args); \
3921 + if (__ret != 0) \
3922 + break; \
3923 + if (__entry->bitmask != 0) \
3924 + __i += __entry->next_offset; \
3925 + else \
3926 + __i += sizeof(struct ebt_entries); \
3927 + } \
3928 + if (__ret == 0) { \
3929 + if (__i != (size)) \
3930 + __ret = -EINVAL; \
3931 + } \
3932 + __ret; \
3933 +})
3934 +
3935 +#endif
3936 --- /dev/null Thu Aug 24 11:00:32 2000
3937 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_802_3.h Fri Aug 8 01:09:06 2003
3938 @@ -0,0 +1,60 @@
3939 +#ifndef __LINUX_BRIDGE_EBT_802_3_H
3940 +#define __LINUX_BRIDGE_EBT_802_3_H
3941 +
3942 +#define EBT_802_3_SAP 0x01
3943 +#define EBT_802_3_TYPE 0x02
3944 +
3945 +#define EBT_802_3_MATCH "802_3"
3946 +
3947 +/*
3948 + * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
3949 + * to discover what kind of packet we're carrying.
3950 + */
3951 +#define CHECK_TYPE 0xaa
3952 +
3953 +/*
3954 + * Control field may be one or two bytes. If the first byte has
3955 + * the value 0x03 then the entire length is one byte, otherwise it is two.
3956 + * One byte controls are used in Unnumbered Information frames.
3957 + * Two byte controls are used in Numbered Information frames.
3958 + */
3959 +#define IS_UI 0x03
3960 +
3961 +#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
3962 +
3963 +/* ui has one byte ctrl, ni has two */
3964 +struct hdr_ui {
3965 + uint8_t dsap;
3966 + uint8_t ssap;
3967 + uint8_t ctrl;
3968 + uint8_t orig[3];
3969 + uint16_t type;
3970 +};
3971 +
3972 +struct hdr_ni {
3973 + uint8_t dsap;
3974 + uint8_t ssap;
3975 + uint16_t ctrl;
3976 + uint8_t orig[3];
3977 + uint16_t type;
3978 +};
3979 +
3980 +struct ebt_802_3_hdr {
3981 + uint8_t daddr[6];
3982 + uint8_t saddr[6];
3983 + uint16_t len;
3984 + union {
3985 + struct hdr_ui ui;
3986 + struct hdr_ni ni;
3987 + } llc;
3988 +};
3989 +
3990 +struct ebt_802_3_info
3991 +{
3992 + uint8_t sap;
3993 + uint16_t type;
3994 + uint8_t bitmask;
3995 + uint8_t invflags;
3996 +};
3997 +
3998 +#endif
3999 --- /dev/null Thu Aug 24 11:00:32 2000
4000 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_arp.h Fri Aug 8 01:09:06 2003
4001 @@ -0,0 +1,32 @@
4002 +#ifndef __LINUX_BRIDGE_EBT_ARP_H
4003 +#define __LINUX_BRIDGE_EBT_ARP_H
4004 +
4005 +#define EBT_ARP_OPCODE 0x01
4006 +#define EBT_ARP_HTYPE 0x02
4007 +#define EBT_ARP_PTYPE 0x04
4008 +#define EBT_ARP_SRC_IP 0x08
4009 +#define EBT_ARP_DST_IP 0x10
4010 +#define EBT_ARP_SRC_MAC 0x20
4011 +#define EBT_ARP_DST_MAC 0x40
4012 +#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
4013 + EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)
4014 +#define EBT_ARP_MATCH "arp"
4015 +
4016 +struct ebt_arp_info
4017 +{
4018 + uint16_t htype;
4019 + uint16_t ptype;
4020 + uint16_t opcode;
4021 + uint32_t saddr;
4022 + uint32_t smsk;
4023 + uint32_t daddr;
4024 + uint32_t dmsk;
4025 + unsigned char smaddr[ETH_ALEN];
4026 + unsigned char smmsk[ETH_ALEN];
4027 + unsigned char dmaddr[ETH_ALEN];
4028 + unsigned char dmmsk[ETH_ALEN];
4029 + uint8_t bitmask;
4030 + uint8_t invflags;
4031 +};
4032 +
4033 +#endif
4034 --- /dev/null Thu Aug 24 11:00:32 2000
4035 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_ip.h Fri Aug 8 01:09:06 2003
4036 @@ -0,0 +1,43 @@
4037 +/*
4038 + * ebt_ip
4039 + *
4040 + * Authors:
4041 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
4042 + *
4043 + * April, 2002
4044 + *
4045 + * Changes:
4046 + * added ip-sport and ip-dport
4047 + * Innominate Security Technologies AG <mhopf@innominate.com>
4048 + * September, 2002
4049 + */
4050 +
4051 +#ifndef __LINUX_BRIDGE_EBT_IP_H
4052 +#define __LINUX_BRIDGE_EBT_IP_H
4053 +
4054 +#define EBT_IP_SOURCE 0x01
4055 +#define EBT_IP_DEST 0x02
4056 +#define EBT_IP_TOS 0x04
4057 +#define EBT_IP_PROTO 0x08
4058 +#define EBT_IP_SPORT 0x10
4059 +#define EBT_IP_DPORT 0x20
4060 +#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
4061 + EBT_IP_SPORT | EBT_IP_DPORT )
4062 +#define EBT_IP_MATCH "ip"
4063 +
4064 +// the same values are used for the invflags
4065 +struct ebt_ip_info
4066 +{
4067 + uint32_t saddr;
4068 + uint32_t daddr;
4069 + uint32_t smsk;
4070 + uint32_t dmsk;
4071 + uint8_t tos;
4072 + uint8_t protocol;
4073 + uint8_t bitmask;
4074 + uint8_t invflags;
4075 + uint16_t sport[2];
4076 + uint16_t dport[2];
4077 +};
4078 +
4079 +#endif
4080 --- /dev/null Thu Aug 24 11:00:32 2000
4081 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_pkttype.h Fri Aug 8 01:09:06 2003
4082 @@ -0,0 +1,11 @@
4083 +#ifndef __LINUX_BRIDGE_EBT_PKTTYPE_H
4084 +#define __LINUX_BRIDGE_EBT_PKTTYPE_H
4085 +
4086 +struct ebt_pkttype_info
4087 +{
4088 + uint8_t pkt_type;
4089 + uint8_t invert;
4090 +};
4091 +#define EBT_PKTTYPE_MATCH "pkttype"
4092 +
4093 +#endif
4094 --- /dev/null Thu Aug 24 11:00:32 2000
4095 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_stp.h Fri Aug 8 01:09:06 2003
4096 @@ -0,0 +1,46 @@
4097 +#ifndef __LINUX_BRIDGE_EBT_STP_H
4098 +#define __LINUX_BRIDGE_EBT_STP_H
4099 +
4100 +#define EBT_STP_TYPE 0x0001
4101 +
4102 +#define EBT_STP_FLAGS 0x0002
4103 +#define EBT_STP_ROOTPRIO 0x0004
4104 +#define EBT_STP_ROOTADDR 0x0008
4105 +#define EBT_STP_ROOTCOST 0x0010
4106 +#define EBT_STP_SENDERPRIO 0x0020
4107 +#define EBT_STP_SENDERADDR 0x0040
4108 +#define EBT_STP_PORT 0x0080
4109 +#define EBT_STP_MSGAGE 0x0100
4110 +#define EBT_STP_MAXAGE 0x0200
4111 +#define EBT_STP_HELLOTIME 0x0400
4112 +#define EBT_STP_FWDD 0x0800
4113 +
4114 +#define EBT_STP_MASK 0x0fff
4115 +#define EBT_STP_CONFIG_MASK 0x0ffe
4116 +
4117 +#define EBT_STP_MATCH "stp"
4118 +
4119 +struct ebt_stp_config_info
4120 +{
4121 + uint8_t flags;
4122 + uint16_t root_priol, root_priou;
4123 + char root_addr[6], root_addrmsk[6];
4124 + uint32_t root_costl, root_costu;
4125 + uint16_t sender_priol, sender_priou;
4126 + char sender_addr[6], sender_addrmsk[6];
4127 + uint16_t portl, portu;
4128 + uint16_t msg_agel, msg_ageu;
4129 + uint16_t max_agel, max_ageu;
4130 + uint16_t hello_timel, hello_timeu;
4131 + uint16_t forward_delayl, forward_delayu;
4132 +};
4133 +
4134 +struct ebt_stp_info
4135 +{
4136 + uint8_t type;
4137 + struct ebt_stp_config_info config;
4138 + uint16_t bitmask;
4139 + uint16_t invflags;
4140 +};
4141 +
4142 +#endif
4143 --- /dev/null Thu Aug 24 11:00:32 2000
4144 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_vlan.h Fri Aug 8 01:09:06 2003
4145 @@ -0,0 +1,20 @@
4146 +#ifndef __LINUX_BRIDGE_EBT_VLAN_H
4147 +#define __LINUX_BRIDGE_EBT_VLAN_H
4148 +
4149 +#define EBT_VLAN_ID 0x01
4150 +#define EBT_VLAN_PRIO 0x02
4151 +#define EBT_VLAN_ENCAP 0x04
4152 +#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
4153 +#define EBT_VLAN_MATCH "vlan"
4154 +
4155 +struct ebt_vlan_info {
4156 + uint16_t id; /* VLAN ID {1-4095} */
4157 + uint8_t prio; /* VLAN User Priority {0-7} */
4158 + uint16_t encap; /* VLAN Encapsulated frame code {0-65535} */
4159 + uint8_t bitmask; /* Args bitmask bit 1=1 - ID arg,
4160 + bit 2=1 User-Priority arg, bit 3=1 encap*/
4161 + uint8_t invflags; /* Inverse bitmask bit 1=1 - inversed ID arg,
4162 + bit 2=1 - inversed Pirority arg */
4163 +};
4164 +
4165 +#endif
4166 --- /dev/null Thu Aug 24 11:00:32 2000
4167 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_log.h Fri Aug 8 01:09:06 2003
4168 @@ -0,0 +1,17 @@
4169 +#ifndef __LINUX_BRIDGE_EBT_LOG_H
4170 +#define __LINUX_BRIDGE_EBT_LOG_H
4171 +
4172 +#define EBT_LOG_IP 0x01 // if the frame is made by ip, log the ip information
4173 +#define EBT_LOG_ARP 0x02
4174 +#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
4175 +#define EBT_LOG_PREFIX_SIZE 30
4176 +#define EBT_LOG_WATCHER "log"
4177 +
4178 +struct ebt_log_info
4179 +{
4180 + uint8_t loglevel;
4181 + uint8_t prefix[EBT_LOG_PREFIX_SIZE];
4182 + uint32_t bitmask;
4183 +};
4184 +
4185 +#endif
4186 --- /dev/null Thu Aug 24 11:00:32 2000
4187 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_nat.h Fri Aug 8 01:09:06 2003
4188 @@ -0,0 +1,13 @@
4189 +#ifndef __LINUX_BRIDGE_EBT_NAT_H
4190 +#define __LINUX_BRIDGE_EBT_NAT_H
4191 +
4192 +struct ebt_nat_info
4193 +{
4194 + unsigned char mac[ETH_ALEN];
4195 + // EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN
4196 + int target;
4197 +};
4198 +#define EBT_SNAT_TARGET "snat"
4199 +#define EBT_DNAT_TARGET "dnat"
4200 +
4201 +#endif
4202 --- /dev/null Thu Aug 24 11:00:32 2000
4203 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_redirect.h Fri Aug 8 01:09:06 2003
4204 @@ -0,0 +1,11 @@
4205 +#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
4206 +#define __LINUX_BRIDGE_EBT_REDIRECT_H
4207 +
4208 +struct ebt_redirect_info
4209 +{
4210 + // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
4211 + int target;
4212 +};
4213 +#define EBT_REDIRECT_TARGET "redirect"
4214 +
4215 +#endif
4216 --- /dev/null Thu Aug 24 11:00:32 2000
4217 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_mark_m.h Fri Aug 8 01:09:06 2003
4218 @@ -0,0 +1,15 @@
4219 +#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
4220 +#define __LINUX_BRIDGE_EBT_MARK_M_H
4221 +
4222 +#define EBT_MARK_AND 0x01
4223 +#define EBT_MARK_OR 0x02
4224 +#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
4225 +struct ebt_mark_m_info
4226 +{
4227 + unsigned long mark, mask;
4228 + uint8_t invert;
4229 + uint8_t bitmask;
4230 +};
4231 +#define EBT_MARK_MATCH "mark_m"
4232 +
4233 +#endif
4234 --- /dev/null Thu Aug 24 11:00:32 2000
4235 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_bridge/ebt_mark_t.h Fri Aug 8 01:09:06 2003
4236 @@ -0,0 +1,12 @@
4237 +#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
4238 +#define __LINUX_BRIDGE_EBT_MARK_T_H
4239 +
4240 +struct ebt_mark_t_info
4241 +{
4242 + unsigned long mark;
4243 + // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
4244 + int target;
4245 +};
4246 +#define EBT_MARK_TARGET "mark"
4247 +
4248 +#endif
4249 --- linux-2.4.21/include/linux/netfilter.h Thu Nov 22 20:47:48 2001
4250 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter.h Fri Aug 8 01:09:06 2003
4251 @@ -117,28 +117,34 @@ extern struct list_head nf_hooks[NPROTO]
4252 /* This is gross, but inline doesn't cut it for avoiding the function
4253 call in fast path: gcc doesn't inline (needs value tracking?). --RR */
4254 #ifdef CONFIG_NETFILTER_DEBUG
4255 -#define NF_HOOK nf_hook_slow
4256 +#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
4257 +nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn), INT_MIN)
4258 +#define NF_HOOK_THRESH nf_hook_slow
4259 #else
4260 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
4261 (list_empty(&nf_hooks[(pf)][(hook)]) \
4262 ? (okfn)(skb) \
4263 - : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn)))
4264 + : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn), INT_MIN))
4265 +#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
4266 +(list_empty(&nf_hooks[(pf)][(hook)]) \
4267 + ? (okfn)(skb) \
4268 + : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn), (thresh)))
4269 #endif
4270
4271 int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
4272 struct net_device *indev, struct net_device *outdev,
4273 - int (*okfn)(struct sk_buff *));
4274 + int (*okfn)(struct sk_buff *), int thresh);
4275
4276 /* Call setsockopt() */
4277 -int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
4278 +int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
4279 int len);
4280 int nf_getsockopt(struct sock *sk, int pf, int optval, char *opt,
4281 int *len);
4282
4283 /* Packet queuing */
4284 -typedef int (*nf_queue_outfn_t)(struct sk_buff *skb,
4285 +typedef int (*nf_queue_outfn_t)(struct sk_buff *skb,
4286 struct nf_info *info, void *data);
4287 -extern int nf_register_queue_handler(int pf,
4288 +extern int nf_register_queue_handler(int pf,
4289 nf_queue_outfn_t outfn, void *data);
4290 extern int nf_unregister_queue_handler(int pf);
4291 extern void nf_reinject(struct sk_buff *skb,
4292 --- linux-2.4.21/include/linux/netfilter_ipv4.h Mon Feb 25 20:38:13 2002
4293 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_ipv4.h Fri Aug 8 01:09:06 2003
4294 @@ -52,8 +52,10 @@
4295 enum nf_ip_hook_priorities {
4296 NF_IP_PRI_FIRST = INT_MIN,
4297 NF_IP_PRI_CONNTRACK = -200,
4298 + NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
4299 NF_IP_PRI_MANGLE = -150,
4300 NF_IP_PRI_NAT_DST = -100,
4301 + NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
4302 NF_IP_PRI_FILTER = 0,
4303 NF_IP_PRI_NAT_SRC = 100,
4304 NF_IP_PRI_LAST = INT_MAX,
4305 --- linux-2.4.21/include/linux/skbuff.h Fri Jun 13 16:51:39 2003
4306 +++ linux-2.4.21-ebt-brnf-3/include/linux/skbuff.h Fri Aug 8 01:09:06 2003
4307 @@ -92,6 +92,17 @@ struct nf_conntrack {
4308 struct nf_ct_info {
4309 struct nf_conntrack *master;
4310 };
4311 +
4312 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4313 +struct nf_bridge_info {
4314 + atomic_t use;
4315 + struct net_device *physindev;
4316 + struct net_device *physoutdev;
4317 + unsigned int mask;
4318 + unsigned long hh[16 / sizeof(unsigned long)];
4319 +};
4320 +#endif
4321 +
4322 #endif
4323
4324 struct sk_buff_head {
4325 @@ -204,6 +215,9 @@ struct sk_buff {
4326 #ifdef CONFIG_NETFILTER_DEBUG
4327 unsigned int nf_debug;
4328 #endif
4329 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4330 + struct nf_bridge_info *nf_bridge; /* Saved data about a bridged frame - see br_netfilter.c */
4331 +#endif
4332 #endif /*CONFIG_NETFILTER*/
4333
4334 #if defined(CONFIG_HIPPI)
4335 @@ -278,7 +292,7 @@ static inline struct sk_buff *skb_get(st
4336 * If users==1, we are the only owner and are can avoid redundant
4337 * atomic change.
4338 */
4339 -
4340 +
4341 /**
4342 * kfree_skb - free an sk_buff
4343 * @skb: buffer to free
4344 @@ -286,7 +300,7 @@ static inline struct sk_buff *skb_get(st
4345 * Drop a reference to the buffer and free it if the usage count has
4346 * hit zero.
4347 */
4348 -
4349 +
4350 static inline void kfree_skb(struct sk_buff *skb)
4351 {
4352 if (atomic_read(&skb->users) == 1 || atomic_dec_and_test(&skb->users))
4353 @@ -1165,6 +1179,20 @@ nf_conntrack_get(struct nf_ct_info *nfct
4354 if (nfct)
4355 atomic_inc(&nfct->master->use);
4356 }
4357 +
4358 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4359 +static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
4360 +{
4361 + if (nf_bridge && atomic_dec_and_test(&nf_bridge->use))
4362 + kfree(nf_bridge);
4363 +}
4364 +static inline void nf_bridge_get(struct nf_bridge_info *nf_bridge)
4365 +{
4366 + if (nf_bridge)
4367 + atomic_inc(&nf_bridge->use);
4368 +}
4369 +#endif
4370 +
4371 #endif
4372
4373 #endif /* __KERNEL__ */
4374 --- linux-2.4.21/net/core/netfilter.c Sat Aug 3 02:39:46 2002
4375 +++ linux-2.4.21-ebt-brnf-3/net/core/netfilter.c Fri Aug 8 01:09:06 2003
4376 @@ -1,4 +1,4 @@
4377 -/* netfilter.c: look after the filters for various protocols.
4378 +/* netfilter.c: look after the filters for various protocols.
4379 * Heavily influenced by the old firewall.c by David Bonn and Alan Cox.
4380 *
4381 * Thanks to Rob `CmdrTaco' Malda for not influencing this code in any
4382 @@ -342,10 +342,15 @@ static unsigned int nf_iterate(struct li
4383 const struct net_device *indev,
4384 const struct net_device *outdev,
4385 struct list_head **i,
4386 - int (*okfn)(struct sk_buff *))
4387 + int (*okfn)(struct sk_buff *),
4388 + int hook_thresh)
4389 {
4390 for (*i = (*i)->next; *i != head; *i = (*i)->next) {
4391 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
4392 +
4393 + if (hook_thresh > elem->priority)
4394 + continue;
4395 +
4396 switch (elem->hook(hook, skb, indev, outdev, okfn)) {
4397 case NF_QUEUE:
4398 return NF_QUEUE;
4399 @@ -365,7 +370,7 @@ static unsigned int nf_iterate(struct li
4400 break;
4401
4402 default:
4403 - NFDEBUG("Evil return from %p(%u).\n",
4404 + NFDEBUG("Evil return from %p(%u).\n",
4405 elem->hook, hook);
4406 #endif
4407 }
4408 @@ -374,7 +379,7 @@ static unsigned int nf_iterate(struct li
4409 }
4410
4411 int nf_register_queue_handler(int pf, nf_queue_outfn_t outfn, void *data)
4412 -{
4413 +{
4414 int ret;
4415
4416 br_write_lock_bh(BR_NETPROTO_LOCK);
4417 @@ -400,12 +405,12 @@ int nf_unregister_queue_handler(int pf)
4418 return 0;
4419 }
4420
4421 -/*
4422 - * Any packet that leaves via this function must come back
4423 +/*
4424 + * Any packet that leaves via this function must come back
4425 * through nf_reinject().
4426 */
4427 -static void nf_queue(struct sk_buff *skb,
4428 - struct list_head *elem,
4429 +static void nf_queue(struct sk_buff *skb,
4430 + struct list_head *elem,
4431 int pf, unsigned int hook,
4432 struct net_device *indev,
4433 struct net_device *outdev,
4434 @@ -413,6 +418,10 @@ static void nf_queue(struct sk_buff *skb
4435 {
4436 int status;
4437 struct nf_info *info;
4438 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4439 + struct net_device *physindev = NULL;
4440 + struct net_device *physoutdev = NULL;
4441 +#endif
4442
4443 if (!queue_handler[pf].outfn) {
4444 kfree_skb(skb);
4445 @@ -428,18 +437,31 @@ static void nf_queue(struct sk_buff *skb
4446 return;
4447 }
4448
4449 - *info = (struct nf_info) {
4450 + *info = (struct nf_info) {
4451 (struct nf_hook_ops *)elem, pf, hook, indev, outdev, okfn };
4452
4453 /* Bump dev refs so they don't vanish while packet is out */
4454 if (indev) dev_hold(indev);
4455 if (outdev) dev_hold(outdev);
4456
4457 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4458 + if (skb->nf_bridge) {
4459 + physindev = skb->nf_bridge->physindev;
4460 + if (physindev) dev_hold(physindev);
4461 + physoutdev = skb->nf_bridge->physoutdev;
4462 + if (physoutdev) dev_hold(physoutdev);
4463 + }
4464 +#endif
4465 +
4466 status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data);
4467 if (status < 0) {
4468 /* James M doesn't say fuck enough. */
4469 if (indev) dev_put(indev);
4470 if (outdev) dev_put(outdev);
4471 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4472 + if (physindev) dev_put(physindev);
4473 + if (physoutdev) dev_put(physoutdev);
4474 +#endif
4475 kfree(info);
4476 kfree_skb(skb);
4477 return;
4478 @@ -449,7 +471,8 @@ static void nf_queue(struct sk_buff *skb
4479 int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
4480 struct net_device *indev,
4481 struct net_device *outdev,
4482 - int (*okfn)(struct sk_buff *))
4483 + int (*okfn)(struct sk_buff *),
4484 + int hook_thresh)
4485 {
4486 struct list_head *elem;
4487 unsigned int verdict;
4488 @@ -481,7 +504,7 @@ int nf_hook_slow(int pf, unsigned int ho
4489
4490 elem = &nf_hooks[pf][hook];
4491 verdict = nf_iterate(&nf_hooks[pf][hook], &skb, hook, indev,
4492 - outdev, &elem, okfn);
4493 + outdev, &elem, okfn, hook_thresh);
4494 if (verdict == NF_QUEUE) {
4495 NFDEBUG("nf_hook: Verdict = QUEUE.\n");
4496 nf_queue(skb, elem, pf, hook, indev, outdev, okfn);
4497 @@ -510,6 +533,14 @@ void nf_reinject(struct sk_buff *skb, st
4498
4499 /* We don't have BR_NETPROTO_LOCK here */
4500 br_read_lock_bh(BR_NETPROTO_LOCK);
4501 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4502 + if (skb->nf_bridge) {
4503 + if (skb->nf_bridge->physindev)
4504 + dev_put(skb->nf_bridge->physindev);
4505 + if (skb->nf_bridge->physoutdev)
4506 + dev_put(skb->nf_bridge->physoutdev);
4507 + }
4508 +#endif
4509 for (i = nf_hooks[info->pf][info->hook].next; i != elem; i = i->next) {
4510 if (i == &nf_hooks[info->pf][info->hook]) {
4511 /* The module which sent it to userspace is gone. */
4512 @@ -528,9 +559,9 @@ void nf_reinject(struct sk_buff *skb, st
4513
4514 if (verdict == NF_ACCEPT) {
4515 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
4516 - &skb, info->hook,
4517 + &skb, info->hook,
4518 info->indev, info->outdev, &elem,
4519 - info->okfn);
4520 + info->okfn, INT_MIN);
4521 }
4522
4523 switch (verdict) {
4524 @@ -539,20 +570,19 @@ void nf_reinject(struct sk_buff *skb, st
4525 break;
4526
4527 case NF_QUEUE:
4528 - nf_queue(skb, elem, info->pf, info->hook,
4529 + nf_queue(skb, elem, info->pf, info->hook,
4530 info->indev, info->outdev, info->okfn);
4531 break;
4532 -
4533 - case NF_DROP:
4534 - kfree_skb(skb);
4535 - break;
4536 }
4537 br_read_unlock_bh(BR_NETPROTO_LOCK);
4538
4539 /* Release those devices we held, or Alexey will kill me. */
4540 if (info->indev) dev_put(info->indev);
4541 if (info->outdev) dev_put(info->outdev);
4542 -
4543 +
4544 + if (verdict == NF_DROP)
4545 + kfree_skb(skb);
4546 +
4547 kfree(info);
4548 return;
4549 }
4550 --- linux-2.4.21/net/core/skbuff.c Fri Jun 13 16:51:39 2003
4551 +++ linux-2.4.21-ebt-brnf-3/net/core/skbuff.c Fri Aug 8 01:09:06 2003
4552 @@ -245,6 +245,9 @@ static inline void skb_headerinit(void *
4553 #ifdef CONFIG_NETFILTER_DEBUG
4554 skb->nf_debug = 0;
4555 #endif
4556 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4557 + skb->nf_bridge = NULL;
4558 +#endif
4559 #endif
4560 #ifdef CONFIG_NET_SCHED
4561 skb->tc_index = 0;
4562 @@ -325,6 +328,9 @@ void __kfree_skb(struct sk_buff *skb)
4563 }
4564 #ifdef CONFIG_NETFILTER
4565 nf_conntrack_put(skb->nfct);
4566 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4567 + nf_bridge_put(skb->nf_bridge);
4568 +#endif
4569 #endif
4570 skb_headerinit(skb, NULL, 0); /* clean state */
4571 kfree_skbmem(skb);
4572 @@ -391,6 +397,9 @@ struct sk_buff *skb_clone(struct sk_buff
4573 #ifdef CONFIG_NETFILTER_DEBUG
4574 C(nf_debug);
4575 #endif
4576 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4577 + C(nf_bridge);
4578 +#endif
4579 #endif /*CONFIG_NETFILTER*/
4580 #if defined(CONFIG_HIPPI)
4581 C(private);
4582 @@ -403,6 +412,9 @@ struct sk_buff *skb_clone(struct sk_buff
4583 skb->cloned = 1;
4584 #ifdef CONFIG_NETFILTER
4585 nf_conntrack_get(skb->nfct);
4586 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4587 + nf_bridge_get(skb->nf_bridge);
4588 +#endif
4589 #endif
4590 return n;
4591 }
4592 @@ -436,6 +448,10 @@ static void copy_skb_header(struct sk_bu
4593 nf_conntrack_get(new->nfct);
4594 #ifdef CONFIG_NETFILTER_DEBUG
4595 new->nf_debug=old->nf_debug;
4596 +#endif
4597 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4598 + new->nf_bridge=old->nf_bridge;
4599 + nf_bridge_get(new->nf_bridge);
4600 #endif
4601 #endif
4602 #ifdef CONFIG_NET_SCHED
4603 --- linux-2.4.21/net/ipv4/netfilter/ip_tables.c Fri Jun 13 16:51:39 2003
4604 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/ip_tables.c Fri Aug 8 01:09:06 2003
4605 @@ -121,12 +121,19 @@ static LIST_HEAD(ipt_tables);
4606 static inline int
4607 ip_packet_match(const struct iphdr *ip,
4608 const char *indev,
4609 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4610 + const char *physindev,
4611 +#endif
4612 const char *outdev,
4613 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4614 + const char *physoutdev,
4615 +#endif
4616 const struct ipt_ip *ipinfo,
4617 int isfrag)
4618 {
4619 size_t i;
4620 unsigned long ret;
4621 + unsigned long ret2 = 1;
4622
4623 #define FWINV(bool,invflg) ((bool) ^ !!(ipinfo->invflags & invflg))
4624
4625 @@ -156,7 +163,15 @@ ip_packet_match(const struct iphdr *ip,
4626 & ((const unsigned long *)ipinfo->iniface_mask)[i];
4627 }
4628
4629 - if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
4630 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4631 + for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
4632 + ret2 |= (((const unsigned long *)physindev)[i]
4633 + ^ ((const unsigned long *)ipinfo->iniface)[i])
4634 + & ((const unsigned long *)ipinfo->iniface_mask)[i];
4635 + }
4636 +#endif
4637 +
4638 + if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_IN)) {
4639 dprintf("VIA in mismatch (%s vs %s).%s\n",
4640 indev, ipinfo->iniface,
4641 ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
4642 @@ -169,7 +184,15 @@ ip_packet_match(const struct iphdr *ip,
4643 & ((const unsigned long *)ipinfo->outiface_mask)[i];
4644 }
4645
4646 - if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
4647 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4648 + for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
4649 + ret2 |= (((const unsigned long *)physoutdev)[i]
4650 + ^ ((const unsigned long *)ipinfo->outiface)[i])
4651 + & ((const unsigned long *)ipinfo->outiface_mask)[i];
4652 + }
4653 +#endif
4654 +
4655 + if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_OUT)) {
4656 dprintf("VIA out mismatch (%s vs %s).%s\n",
4657 outdev, ipinfo->outiface,
4658 ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
4659 @@ -268,6 +291,9 @@ ipt_do_table(struct sk_buff **pskb,
4660 /* Initializing verdict to NF_DROP keeps gcc happy. */
4661 unsigned int verdict = NF_DROP;
4662 const char *indev, *outdev;
4663 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4664 + const char *physindev, *physoutdev;
4665 +#endif
4666 void *table_base;
4667 struct ipt_entry *e, *back;
4668
4669 @@ -277,6 +303,13 @@ ipt_do_table(struct sk_buff **pskb,
4670 datalen = (*pskb)->len - ip->ihl * 4;
4671 indev = in ? in->name : nulldevname;
4672 outdev = out ? out->name : nulldevname;
4673 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4674 + physindev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physindev) ?
4675 + (*pskb)->nf_bridge->physindev->name : nulldevname;
4676 + physoutdev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physoutdev) ?
4677 + (*pskb)->nf_bridge->physoutdev->name : nulldevname;
4678 +#endif
4679 +
4680 /* We handle fragments by dealing with the first fragment as
4681 * if it was a normal packet. All other fragments are treated
4682 * normally, except that they will NEVER match rules that ask
4683 @@ -312,7 +345,15 @@ ipt_do_table(struct sk_buff **pskb,
4684 IP_NF_ASSERT(e);
4685 IP_NF_ASSERT(back);
4686 (*pskb)->nfcache |= e->nfcache;
4687 - if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
4688 + if (ip_packet_match(ip, indev,
4689 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4690 + physindev,
4691 +#endif
4692 + outdev,
4693 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4694 + physoutdev,
4695 +#endif
4696 + &e->ip, offset)) {
4697 struct ipt_entry_target *t;
4698
4699 if (IPT_MATCH_ITERATE(e, do_match,
4700 --- linux-2.4.21/net/ipv4/ip_output.c Fri Nov 29 00:53:15 2002
4701 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/ip_output.c Fri Aug 8 01:09:06 2003
4702 @@ -879,6 +879,10 @@ int ip_fragment(struct sk_buff *skb, int
4703 /* Connection association is same as pre-frag packet */
4704 skb2->nfct = skb->nfct;
4705 nf_conntrack_get(skb2->nfct);
4706 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4707 + skb2->nf_bridge = skb->nf_bridge;
4708 + nf_bridge_get(skb2->nf_bridge);
4709 +#endif
4710 #ifdef CONFIG_NETFILTER_DEBUG
4711 skb2->nf_debug = skb->nf_debug;
4712 #endif
4713 --- linux-2.4.21/net/ipv4/netfilter/ipt_LOG.c Mon Feb 25 20:38:14 2002
4714 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/ipt_LOG.c Fri Aug 8 01:09:06 2003
4715 @@ -289,6 +289,18 @@ ipt_log_target(struct sk_buff **pskb,
4716 loginfo->prefix,
4717 in ? in->name : "",
4718 out ? out->name : "");
4719 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
4720 + if ((*pskb)->nf_bridge) {
4721 + struct net_device *physindev = (*pskb)->nf_bridge->physindev;
4722 + struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
4723 +
4724 + if (physindev && in != physindev)
4725 + printk("PHYSIN=%s ", physindev->name);
4726 + if (physoutdev && out != physoutdev)
4727 + printk("PHYSOUT=%s ", physoutdev->name);
4728 + }
4729 +#endif
4730 +
4731 if (in && !out) {
4732 /* MAC logging for input chain only. */
4733 printk("MAC=");
4734 --- linux-2.4.21/net/ipv4/netfilter/Makefile Fri Jun 13 16:51:39 2003
4735 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/Makefile Fri Aug 8 01:09:06 2003
4736 @@ -84,6 +84,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i
4737 obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
4738 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
4739
4740 +obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
4741 +
4742 # targets
4743 obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
4744 obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o
4745 --- linux-2.4.21/net/ipv4/netfilter/Config.in Fri Jun 13 16:51:39 2003
4746 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/Config.in Fri Aug 8 01:09:06 2003
4747 @@ -43,6 +43,9 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
4748 dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
4749 dep_tristate ' Owner match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_OWNER $CONFIG_IP_NF_IPTABLES
4750 fi
4751 + if [ "$CONFIG_BRIDGE" != "n" ]; then
4752 + dep_tristate ' Physdev match support' CONFIG_IP_NF_MATCH_PHYSDEV
4753 + fi
4754 # The targets
4755 dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
4756 if [ "$CONFIG_IP_NF_FILTER" != "n" ]; then
4757 --- /dev/null Thu Aug 24 11:00:32 2000
4758 +++ linux-2.4.21-ebt-brnf-3/net/bridge/br_netfilter.c Fri Aug 8 01:09:06 2003
4759 @@ -0,0 +1,636 @@
4760 +/*
4761 + * Handle firewalling
4762 + * Linux ethernet bridge
4763 + *
4764 + * Authors:
4765 + * Lennert Buytenhek <buytenh@gnu.org>
4766 + * Bart De Schuymer <bdschuym@pandora.be>
4767 + *
4768 + * This program is free software; you can redistribute it and/or
4769 + * modify it under the terms of the GNU General Public License
4770 + * as published by the Free Software Foundation; either version
4771 + * 2 of the License, or (at your option) any later version.
4772 + *
4773 + * Lennert dedicates this file to Kerstin Wurdinger.
4774 + */
4775 +
4776 +#include <linux/module.h>
4777 +#include <linux/kernel.h>
4778 +#include <linux/ip.h>
4779 +#include <linux/netdevice.h>
4780 +#include <linux/skbuff.h>
4781 +#include <linux/if_ether.h>
4782 +#include <linux/netfilter_bridge.h>
4783 +#include <linux/netfilter_ipv4.h>
4784 +#include <linux/in_route.h>
4785 +#include <net/ip.h>
4786 +#include <asm/uaccess.h>
4787 +#include <asm/checksum.h>
4788 +#include "br_private.h"
4789 +
4790 +
4791 +#define skb_origaddr(skb) (((struct bridge_skb_cb *) \
4792 + (skb->cb))->daddr.ipv4)
4793 +#define store_orig_dstaddr(skb) (skb_origaddr(skb) = (skb)->nh.iph->daddr)
4794 +#define dnat_took_place(skb) (skb_origaddr(skb) != (skb)->nh.iph->daddr)
4795 +#define clear_cb(skb) (memset(&skb_origaddr(skb), 0, \
4796 + sizeof(struct bridge_skb_cb)))
4797 +
4798 +#define has_bridge_parent(device) ((device)->br_port != NULL)
4799 +#define bridge_parent(device) (&((device)->br_port->br->dev))
4800 +
4801 +/* We need these fake structures to make netfilter happy --
4802 + * lots of places assume that skb->dst != NULL, which isn't
4803 + * all that unreasonable.
4804 + *
4805 + * Currently, we fill in the PMTU entry because netfilter
4806 + * refragmentation needs it, and the rt_flags entry because
4807 + * ipt_REJECT needs it. Future netfilter modules might
4808 + * require us to fill additional fields.
4809 + */
4810 +static struct net_device __fake_net_device = {
4811 + .hard_header_len = ETH_HLEN
4812 +};
4813 +
4814 +static struct rtable __fake_rtable = {
4815 + u: {
4816 + dst: {
4817 + __refcnt: ATOMIC_INIT(1),
4818 + dev: &__fake_net_device,
4819 + pmtu: 1500
4820 + }
4821 + },
4822 +
4823 + rt_flags: 0
4824 +};
4825 +
4826 +
4827 +/* PF_BRIDGE/PRE_ROUTING *********************************************/
4828 +static void __br_dnat_complain(void)
4829 +{
4830 + static unsigned long last_complaint = 0;
4831 +
4832 + if (jiffies - last_complaint >= 5 * HZ) {
4833 + printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
4834 + "forwarding to be enabled\n");
4835 + last_complaint = jiffies;
4836 + }
4837 +}
4838 +
4839 +
4840 +/* This requires some explaining. If DNAT has taken place,
4841 + * we will need to fix up the destination Ethernet address,
4842 + * and this is a tricky process.
4843 + *
4844 + * There are two cases to consider:
4845 + * 1. The packet was DNAT'ed to a device in the same bridge
4846 + * port group as it was received on. We can still bridge
4847 + * the packet.
4848 + * 2. The packet was DNAT'ed to a different device, either
4849 + * a non-bridged device or another bridge port group.
4850 + * The packet will need to be routed.
4851 + *
4852 + * The correct way of distinguishing between these two cases is to
4853 + * call ip_route_input() and to look at skb->dst->dev, which is
4854 + * changed to the destination device if ip_route_input() succeeds.
4855 + *
4856 + * Let us first consider the case that ip_route_input() succeeds:
4857 + *
4858 + * If skb->dst->dev equals the logical bridge device the packet
4859 + * came in on, we can consider this bridging. We then call
4860 + * skb->dst->output() which will make the packet enter br_nf_local_out()
4861 + * not much later. In that function it is assured that the iptables
4862 + * FORWARD chain is traversed for the packet.
4863 + *
4864 + * Otherwise, the packet is considered to be routed and we just
4865 + * change the destination MAC address so that the packet will
4866 + * later be passed up to the IP stack to be routed.
4867 + *
4868 + * Let us now consider the case that ip_route_input() fails:
4869 + *
4870 + * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
4871 + * will fail, while __ip_route_output_key() will return success. The source
4872 + * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
4873 + * thinks we're handling a locally generated packet and won't care
4874 + * if IP forwarding is allowed. We send a warning message to the users's
4875 + * log telling her to put IP forwarding on.
4876 + *
4877 + * ip_route_input() will also fail if there is no route available.
4878 + * In that case we just drop the packet.
4879 + *
4880 + * --Lennert, 20020411
4881 + * --Bart, 20020416 (updated)
4882 + * --Bart, 20021007 (updated)
4883 + */
4884 +
4885 +static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
4886 +{
4887 +#ifdef CONFIG_NETFILTER_DEBUG
4888 + skb->nf_debug |= (1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_FORWARD);
4889 +#endif
4890 +
4891 + if (skb->pkt_type == PACKET_OTHERHOST) {
4892 + skb->pkt_type = PACKET_HOST;
4893 + skb->nf_bridge->mask |= BRNF_PKT_TYPE;
4894 + }
4895 +
4896 + skb->dev = bridge_parent(skb->dev);
4897 + skb->dst->output(skb);
4898 + return 0;
4899 +}
4900 +
4901 +static int br_nf_pre_routing_finish(struct sk_buff *skb)
4902 +{
4903 + struct net_device *dev = skb->dev;
4904 + struct iphdr *iph = skb->nh.iph;
4905 + struct nf_bridge_info *nf_bridge = skb->nf_bridge;
4906 +
4907 +#ifdef CONFIG_NETFILTER_DEBUG
4908 + skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
4909 +#endif
4910 +
4911 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
4912 + skb->pkt_type = PACKET_OTHERHOST;
4913 + nf_bridge->mask ^= BRNF_PKT_TYPE;
4914 + }
4915 +
4916 + if (dnat_took_place(skb)) {
4917 + if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
4918 + dev)) {
4919 + struct rtable *rt;
4920 +
4921 + if (!ip_route_output(&rt, iph->daddr, 0, iph->tos, 0)) {
4922 + /* Bridged-and-DNAT'ed traffic doesn't
4923 + * require ip_forwarding.
4924 + */
4925 + if (((struct dst_entry *)rt)->dev == dev) {
4926 + skb->dst = (struct dst_entry *)rt;
4927 + goto bridged_dnat;
4928 + }
4929 + __br_dnat_complain();
4930 + dst_release((struct dst_entry *)rt);
4931 + }
4932 + kfree_skb(skb);
4933 + return 0;
4934 + } else {
4935 + if (skb->dst->dev == dev) {
4936 +bridged_dnat:
4937 + /* Tell br_nf_local_out this is a
4938 + * bridged frame
4939 + */
4940 + nf_bridge->mask |= BRNF_BRIDGED_DNAT;
4941 + skb->dev = nf_bridge->physindev;
4942 + clear_cb(skb);
4943 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
4944 + skb, skb->dev, NULL,
4945 + br_nf_pre_routing_finish_bridge,
4946 + 1);
4947 + return 0;
4948 + }
4949 + memcpy(skb->mac.ethernet->h_dest, dev->dev_addr,
4950 + ETH_ALEN);
4951 + }
4952 + } else {
4953 + skb->dst = (struct dst_entry *)&__fake_rtable;
4954 + dst_hold(skb->dst);
4955 + }
4956 +
4957 + clear_cb(skb);
4958 + skb->dev = nf_bridge->physindev;
4959 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
4960 + br_handle_frame_finish, 1);
4961 +
4962 + return 0;
4963 +}
4964 +
4965 +/* Replicate the checks that IPv4 does on packet reception.
4966 + * Set skb->dev to the bridge device (i.e. parent of the
4967 + * receiving device) to make netfilter happy, the REDIRECT
4968 + * target in particular. Save the original destination IP
4969 + * address to be able to detect DNAT afterwards.
4970 + */
4971 +static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
4972 + const struct net_device *in, const struct net_device *out,
4973 + int (*okfn)(struct sk_buff *))
4974 +{
4975 + struct iphdr *iph;
4976 + __u32 len;
4977 + struct sk_buff *skb;
4978 + struct nf_bridge_info *nf_bridge;
4979 +
4980 + if ((*pskb)->protocol != __constant_htons(ETH_P_IP))
4981 + return NF_ACCEPT;
4982 +
4983 + if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
4984 + goto out;
4985 +
4986 + if (!pskb_may_pull(skb, sizeof(struct iphdr)))
4987 + goto inhdr_error;
4988 +
4989 + iph = skb->nh.iph;
4990 + if (iph->ihl < 5 || iph->version != 4)
4991 + goto inhdr_error;
4992 +
4993 + if (!pskb_may_pull(skb, 4*iph->ihl))
4994 + goto inhdr_error;
4995 +
4996 + iph = skb->nh.iph;
4997 + if (ip_fast_csum((__u8 *)iph, iph->ihl) != 0)
4998 + goto inhdr_error;
4999 +
5000 + len = ntohs(iph->tot_len);
5001 + if (skb->len < len || len < 4*iph->ihl)
5002 + goto inhdr_error;
5003 +
5004 + if (skb->len > len) {
5005 + __pskb_trim(skb, len);
5006 + if (skb->ip_summed == CHECKSUM_HW)
5007 + skb->ip_summed = CHECKSUM_NONE;
5008 + }
5009 +
5010 +#ifdef CONFIG_NETFILTER_DEBUG
5011 + skb->nf_debug ^= (1 << NF_IP_PRE_ROUTING);
5012 +#endif
5013 + if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
5014 + return NF_DROP;
5015 +
5016 + if (skb->pkt_type == PACKET_OTHERHOST) {
5017 + skb->pkt_type = PACKET_HOST;
5018 + nf_bridge->mask |= BRNF_PKT_TYPE;
5019 + }
5020 +
5021 + nf_bridge->physindev = skb->dev;
5022 + skb->dev = bridge_parent(skb->dev);
5023 + store_orig_dstaddr(skb);
5024 +
5025 + NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
5026 + br_nf_pre_routing_finish);
5027 +
5028 + return NF_STOLEN;
5029 +
5030 +inhdr_error:
5031 +// IP_INC_STATS_BH(IpInHdrErrors);
5032 +out:
5033 + return NF_DROP;
5034 +}
5035 +
5036 +
5037 +/* PF_BRIDGE/LOCAL_IN ************************************************/
5038 +/* The packet is locally destined, which requires a real
5039 + * dst_entry, so detach the fake one. On the way up, the
5040 + * packet would pass through PRE_ROUTING again (which already
5041 + * took place when the packet entered the bridge), but we
5042 + * register an IPv4 PRE_ROUTING 'sabotage' hook that will
5043 + * prevent this from happening.
5044 + */
5045 +static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
5046 + const struct net_device *in, const struct net_device *out,
5047 + int (*okfn)(struct sk_buff *))
5048 +{
5049 + struct sk_buff *skb = *pskb;
5050 +
5051 + if (skb->protocol != __constant_htons(ETH_P_IP))
5052 + return NF_ACCEPT;
5053 +
5054 + if (skb->dst == (struct dst_entry *)&__fake_rtable) {
5055 + dst_release(skb->dst);
5056 + skb->dst = NULL;
5057 + }
5058 +
5059 + return NF_ACCEPT;
5060 +}
5061 +
5062 +
5063 +/* PF_BRIDGE/FORWARD *************************************************/
5064 +static int br_nf_forward_finish(struct sk_buff *skb)
5065 +{
5066 + struct nf_bridge_info *nf_bridge = skb->nf_bridge;
5067 +
5068 +#ifdef CONFIG_NETFILTER_DEBUG
5069 + skb->nf_debug ^= (1 << NF_BR_FORWARD);
5070 +#endif
5071 +
5072 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
5073 + skb->pkt_type = PACKET_OTHERHOST;
5074 + nf_bridge->mask ^= BRNF_PKT_TYPE;
5075 + }
5076 +
5077 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, nf_bridge->physindev,
5078 + skb->dev, br_forward_finish, 1);
5079 +
5080 + return 0;
5081 +}
5082 +
5083 +/* This is the 'purely bridged' case. We pass the packet to
5084 + * netfilter with indev and outdev set to the bridge device,
5085 + * but we are still able to filter on the 'real' indev/outdev
5086 + * because of the ipt_physdev.c module.
5087 + */
5088 +static unsigned int br_nf_forward(unsigned int hook, struct sk_buff **pskb,
5089 + const struct net_device *in, const struct net_device *out,
5090 + int (*okfn)(struct sk_buff *))
5091 +{
5092 + struct sk_buff *skb = *pskb;
5093 + struct nf_bridge_info *nf_bridge;
5094 +
5095 + if (skb->protocol != __constant_htons(ETH_P_IP))
5096 + return NF_ACCEPT;
5097 +
5098 +#ifdef CONFIG_NETFILTER_DEBUG
5099 + skb->nf_debug ^= (1 << NF_BR_FORWARD);
5100 +#endif
5101 +
5102 + nf_bridge = skb->nf_bridge;
5103 + if (skb->pkt_type == PACKET_OTHERHOST) {
5104 + skb->pkt_type = PACKET_HOST;
5105 + nf_bridge->mask |= BRNF_PKT_TYPE;
5106 + }
5107 +
5108 + nf_bridge->mask |= BRNF_BRIDGED; /* The physdev module checks on this */
5109 + nf_bridge->physoutdev = skb->dev;
5110 +
5111 + NF_HOOK(PF_INET, NF_IP_FORWARD, skb, bridge_parent(nf_bridge->physindev),
5112 + bridge_parent(skb->dev), br_nf_forward_finish);
5113 +
5114 + return NF_STOLEN;
5115 +}
5116 +
5117 +
5118 +/* PF_BRIDGE/LOCAL_OUT ***********************************************/
5119 +static int br_nf_local_out_finish(struct sk_buff *skb)
5120 +{
5121 +#ifdef CONFIG_NETFILTER_DEBUG
5122 + skb->nf_debug &= ~(1 << NF_BR_LOCAL_OUT);
5123 +#endif
5124 +
5125 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
5126 + br_forward_finish, NF_BR_PRI_FIRST + 1);
5127 +
5128 + return 0;
5129 +}
5130 +
5131 +
5132 +/* This function sees both locally originated IP packets and forwarded
5133 + * IP packets (in both cases the destination device is a bridge
5134 + * device). It also sees bridged-and-DNAT'ed packets.
5135 + * To be able to filter on the physical bridge devices (with the ipt_physdev.c
5136 + * module), we steal packets destined to a bridge device away from the
5137 + * PF_INET/FORWARD and PF_INET/OUTPUT hook functions, and give them back later,
5138 + * when we have determined the real output device. This is done in here.
5139 + *
5140 + * If (nf_bridge->mask & BRNF_BRIDGED_DNAT) then the packet is bridged
5141 + * and we fake the PF_BRIDGE/FORWARD hook. The function br_nf_forward()
5142 + * will then fake the PF_INET/FORWARD hook. br_nf_local_out() has priority
5143 + * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
5144 + * will be executed.
5145 + * Otherwise, if nf_bridge->physindev is NULL, the bridge-nf code never touched
5146 + * this packet before, and so the packet was locally originated. We fake
5147 + * the PF_INET/LOCAL_OUT hook.
5148 + * Finally, if nf_bridge->physindev isn't NULL, then the packet was IP routed,
5149 + * so we fake the PF_INET/FORWARD hook. ipv4_sabotage_out() makes sure
5150 + * even routed packets that didn't arrive on a bridge interface have their
5151 + * nf_bridge->physindev set.
5152 + */
5153 +
5154 +static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
5155 + const struct net_device *in, const struct net_device *out,
5156 + int (*_okfn)(struct sk_buff *))
5157 +{
5158 + int (*okfn)(struct sk_buff *skb);
5159 + struct net_device *realindev;
5160 + struct sk_buff *skb = *pskb;
5161 + struct nf_bridge_info *nf_bridge;
5162 +
5163 + if (skb->protocol != __constant_htons(ETH_P_IP))
5164 + return NF_ACCEPT;
5165 +
5166 + /* Sometimes we get packets with NULL ->dst here (for example,
5167 + * running a dhcp client daemon triggers this).
5168 + */
5169 + if (skb->dst == NULL)
5170 + return NF_ACCEPT;
5171 +
5172 + nf_bridge = skb->nf_bridge;
5173 + nf_bridge->physoutdev = skb->dev;
5174 +
5175 + realindev = nf_bridge->physindev;
5176 +
5177 + /* Bridged, take PF_BRIDGE/FORWARD.
5178 + * (see big note in front of br_nf_pre_routing_finish)
5179 + */
5180 + if (nf_bridge->mask & BRNF_BRIDGED_DNAT) {
5181 + okfn = br_forward_finish;
5182 +
5183 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
5184 + skb->pkt_type = PACKET_OTHERHOST;
5185 + nf_bridge->mask ^= BRNF_PKT_TYPE;
5186 + }
5187 +
5188 + NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev,
5189 + skb->dev, okfn);
5190 + } else {
5191 + okfn = br_nf_local_out_finish;
5192 + /* IP forwarded traffic has a physindev, locally
5193 + * generated traffic hasn't.
5194 + */
5195 + if (realindev != NULL) {
5196 + if (((nf_bridge->mask & BRNF_DONT_TAKE_PARENT) == 0) &&
5197 + has_bridge_parent(realindev))
5198 + realindev = bridge_parent(realindev);
5199 +
5200 + NF_HOOK_THRESH(PF_INET, NF_IP_FORWARD, skb, realindev,
5201 + bridge_parent(skb->dev), okfn,
5202 + NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
5203 + } else {
5204 +#ifdef CONFIG_NETFILTER_DEBUG
5205 + skb->nf_debug ^= (1 << NF_IP_LOCAL_OUT);
5206 +#endif
5207 +
5208 + NF_HOOK_THRESH(PF_INET, NF_IP_LOCAL_OUT, skb, realindev,
5209 + bridge_parent(skb->dev), okfn,
5210 + NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
5211 + }
5212 + }
5213 +
5214 + return NF_STOLEN;
5215 +}
5216 +
5217 +
5218 +/* PF_BRIDGE/POST_ROUTING ********************************************/
5219 +static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
5220 + const struct net_device *in, const struct net_device *out,
5221 + int (*okfn)(struct sk_buff *))
5222 +{
5223 + struct sk_buff *skb = *pskb;
5224 + struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
5225 +
5226 + /* Be very paranoid. Must be a device driver bug. */
5227 + if (skb->mac.raw < skb->head || skb->mac.raw + ETH_HLEN > skb->data) {
5228 + printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
5229 + "bad mac.raw pointer.");
5230 + if (skb->dev != NULL) {
5231 + printk("[%s]", skb->dev->name);
5232 + if (has_bridge_parent(skb->dev))
5233 + printk("[%s]", bridge_parent(skb->dev)->name);
5234 + }
5235 + printk("\n");
5236 + return NF_ACCEPT;
5237 + }
5238 +
5239 + if (skb->protocol != __constant_htons(ETH_P_IP))
5240 + return NF_ACCEPT;
5241 +
5242 + /* Sometimes we get packets with NULL ->dst here (for example,
5243 + * running a dhcp client daemon triggers this).
5244 + */
5245 + if (skb->dst == NULL)
5246 + return NF_ACCEPT;
5247 +
5248 +#ifdef CONFIG_NETFILTER_DEBUG
5249 + skb->nf_debug ^= (1 << NF_IP_POST_ROUTING);
5250 +#endif
5251 +
5252 + /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
5253 + * about the value of skb->pkt_type.
5254 + */
5255 + if (skb->pkt_type == PACKET_OTHERHOST) {
5256 + skb->pkt_type = PACKET_HOST;
5257 + nf_bridge->mask |= BRNF_PKT_TYPE;
5258 + }
5259 +
5260 + memcpy(nf_bridge->hh, skb->data - 16, 16);
5261 +
5262 + NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL,
5263 + bridge_parent(skb->dev), br_dev_queue_push_xmit);
5264 +
5265 + return NF_STOLEN;
5266 +}
5267 +
5268 +
5269 +/* IPv4/SABOTAGE *****************************************************/
5270 +
5271 +/* Don't hand locally destined packets to PF_INET/PRE_ROUTING
5272 + * for the second time.
5273 + */
5274 +static unsigned int ipv4_sabotage_in(unsigned int hook, struct sk_buff **pskb,
5275 + const struct net_device *in, const struct net_device *out,
5276 + int (*okfn)(struct sk_buff *))
5277 +{
5278 + if (in->hard_start_xmit == br_dev_xmit &&
5279 + okfn != br_nf_pre_routing_finish) {
5280 + okfn(*pskb);
5281 + return NF_STOLEN;
5282 + }
5283 +
5284 + return NF_ACCEPT;
5285 +}
5286 +
5287 +/* Postpone execution of PF_INET/FORWARD, PF_INET/LOCAL_OUT
5288 + * and PF_INET/POST_ROUTING until we have done the forwarding
5289 + * decision in the bridge code and have determined skb->physoutdev.
5290 + */
5291 +static unsigned int ipv4_sabotage_out(unsigned int hook, struct sk_buff **pskb,
5292 + const struct net_device *in, const struct net_device *out,
5293 + int (*okfn)(struct sk_buff *))
5294 +{
5295 + if (out->hard_start_xmit == br_dev_xmit &&
5296 + okfn != br_nf_forward_finish &&
5297 + okfn != br_nf_local_out_finish &&
5298 + okfn != br_dev_queue_push_xmit) {
5299 + struct sk_buff *skb = *pskb;
5300 + struct nf_bridge_info *nf_bridge;
5301 +
5302 + if (!skb->nf_bridge && !nf_bridge_alloc(skb))
5303 + return NF_DROP;
5304 +
5305 + nf_bridge = skb->nf_bridge;
5306 +
5307 + /* This frame will arrive on PF_BRIDGE/LOCAL_OUT and we
5308 + * will need the indev then. For a brouter, the real indev
5309 + * can be a bridge port, so we make sure br_nf_local_out()
5310 + * doesn't use the bridge parent of the indev by using
5311 + * the BRNF_DONT_TAKE_PARENT mask.
5312 + */
5313 + if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
5314 + nf_bridge->mask &= BRNF_DONT_TAKE_PARENT;
5315 + nf_bridge->physindev = (struct net_device *)in;
5316 + }
5317 + okfn(skb);
5318 + return NF_STOLEN;
5319 + }
5320 +
5321 + return NF_ACCEPT;
5322 +}
5323 +
5324 +/* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent
5325 + * PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
5326 + * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
5327 + * ip_refrag() can return NF_STOLEN.
5328 + */
5329 +static struct nf_hook_ops br_nf_ops[] = {
5330 + { .hook = br_nf_pre_routing,
5331 + .pf = PF_BRIDGE,
5332 + .hooknum = NF_BR_PRE_ROUTING,
5333 + .priority = NF_BR_PRI_BRNF, },
5334 + { .hook = br_nf_local_in,
5335 + .pf = PF_BRIDGE,
5336 + .hooknum = NF_BR_LOCAL_IN,
5337 + .priority = NF_BR_PRI_BRNF, },
5338 + { .hook = br_nf_forward,
5339 + .pf = PF_BRIDGE,
5340 + .hooknum = NF_BR_FORWARD,
5341 + .priority = NF_BR_PRI_BRNF, },
5342 + { .hook = br_nf_local_out,
5343 + .pf = PF_BRIDGE,
5344 + .hooknum = NF_BR_LOCAL_OUT,
5345 + .priority = NF_BR_PRI_FIRST, },
5346 + { .hook = br_nf_post_routing,
5347 + .pf = PF_BRIDGE,
5348 + .hooknum = NF_BR_POST_ROUTING,
5349 + .priority = NF_BR_PRI_LAST, },
5350 + { .hook = ipv4_sabotage_in,
5351 + .pf = PF_INET,
5352 + .hooknum = NF_IP_PRE_ROUTING,
5353 + .priority = NF_IP_PRI_FIRST, },
5354 + { .hook = ipv4_sabotage_out,
5355 + .pf = PF_INET,
5356 + .hooknum = NF_IP_FORWARD,
5357 + .priority = NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD, },
5358 + { .hook = ipv4_sabotage_out,
5359 + .pf = PF_INET,
5360 + .hooknum = NF_IP_LOCAL_OUT,
5361 + .priority = NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
5362 + { .hook = ipv4_sabotage_out,
5363 + .pf = PF_INET,
5364 + .hooknum = NF_IP_POST_ROUTING,
5365 + .priority = NF_IP_PRI_FIRST, },
5366 +};
5367 +
5368 +int br_netfilter_init(void)
5369 +{
5370 + int i;
5371 +
5372 + for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++) {
5373 + int ret;
5374 +
5375 + if ((ret = nf_register_hook(&br_nf_ops[i])) >= 0)
5376 + continue;
5377 +
5378 + while (i--)
5379 + nf_unregister_hook(&br_nf_ops[i]);
5380 +
5381 + return ret;
5382 + }
5383 +
5384 + printk(KERN_NOTICE "Bridge firewalling registered\n");
5385 +
5386 + return 0;
5387 +}
5388 +
5389 +void br_netfilter_fini(void)
5390 +{
5391 + int i;
5392 +
5393 + for (i = ARRAY_SIZE(br_nf_ops) - 1; i >= 0; i--)
5394 + nf_unregister_hook(&br_nf_ops[i]);
5395 +}
5396 --- /dev/null Thu Aug 24 11:00:32 2000
5397 +++ linux-2.4.21-ebt-brnf-3/net/ipv4/netfilter/ipt_physdev.c Fri Aug 8 01:09:06 2003
5398 @@ -0,0 +1,127 @@
5399 +/* Kernel module to match the bridge port in and
5400 + * out device for IP packets coming into contact with a bridge. */
5401 +#include <linux/module.h>
5402 +#include <linux/skbuff.h>
5403 +#include <linux/netfilter_ipv4/ipt_physdev.h>
5404 +#include <linux/netfilter_ipv4/ip_tables.h>
5405 +#include <linux/netfilter_bridge.h>
5406 +#include <linux/netdevice.h>
5407 +#define MATCH 1
5408 +#define NOMATCH 0
5409 +
5410 +static int
5411 +match(const struct sk_buff *skb,
5412 + const struct net_device *in,
5413 + const struct net_device *out,
5414 + const void *matchinfo,
5415 + int offset,
5416 + const void *hdr,
5417 + u_int16_t datalen,
5418 + int *hotdrop)
5419 +{
5420 + int i;
5421 + static const char nulldevname[IFNAMSIZ] = { 0 };
5422 + const struct ipt_physdev_info *info = matchinfo;
5423 + unsigned long ret;
5424 + const char *indev, *outdev;
5425 + struct nf_bridge_info *nf_bridge;
5426 +
5427 + /* Not a bridged IP packet or no info available yet:
5428 + * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
5429 + * the destination device will be a bridge. */
5430 + if (!(nf_bridge = skb->nf_bridge)) {
5431 + /* Return MATCH if the invert flags of the used options are on */
5432 + if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
5433 + !(info->invert & IPT_PHYSDEV_OP_BRIDGED))
5434 + return NOMATCH;
5435 + if ((info->bitmask & IPT_PHYSDEV_OP_ISIN) &&
5436 + !(info->invert & IPT_PHYSDEV_OP_ISIN))
5437 + return NOMATCH;
5438 + if ((info->bitmask & IPT_PHYSDEV_OP_ISOUT) &&
5439 + !(info->invert & IPT_PHYSDEV_OP_ISOUT))
5440 + return NOMATCH;
5441 + if ((info->bitmask & IPT_PHYSDEV_OP_IN) &&
5442 + !(info->invert & IPT_PHYSDEV_OP_IN))
5443 + return NOMATCH;
5444 + if ((info->bitmask & IPT_PHYSDEV_OP_OUT) &&
5445 + !(info->invert & IPT_PHYSDEV_OP_OUT))
5446 + return NOMATCH;
5447 + return MATCH;
5448 + }
5449 +
5450 + /* This only makes sense in the FORWARD and POSTROUTING chains */
5451 + if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
5452 + (!!(nf_bridge->mask & BRNF_BRIDGED) ^
5453 + !(info->invert & IPT_PHYSDEV_OP_BRIDGED)))
5454 + return NOMATCH;
5455 +
5456 + if ((info->bitmask & IPT_PHYSDEV_OP_ISIN &&
5457 + (!nf_bridge->physindev ^ !!(info->invert & IPT_PHYSDEV_OP_ISIN))) ||
5458 + (info->bitmask & IPT_PHYSDEV_OP_ISOUT &&
5459 + (!nf_bridge->physoutdev ^ !!(info->invert & IPT_PHYSDEV_OP_ISOUT))))
5460 + return NOMATCH;
5461 +
5462 + if (!(info->bitmask & IPT_PHYSDEV_OP_IN))
5463 + goto match_outdev;
5464 + indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
5465 + for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5466 + ret |= (((const unsigned long *)indev)[i]
5467 + ^ ((const unsigned long *)info->physindev)[i])
5468 + & ((const unsigned long *)info->in_mask)[i];
5469 + }
5470 +
5471 + if ((ret == 0) ^ !(info->invert & IPT_PHYSDEV_OP_IN))
5472 + return NOMATCH;
5473 +
5474 +match_outdev:
5475 + if (!(info->bitmask & IPT_PHYSDEV_OP_OUT))
5476 + return MATCH;
5477 + outdev = nf_bridge->physoutdev ?
5478 + nf_bridge->physoutdev->name : nulldevname;
5479 + for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5480 + ret |= (((const unsigned long *)outdev)[i]
5481 + ^ ((const unsigned long *)info->physoutdev)[i])
5482 + & ((const unsigned long *)info->out_mask)[i];
5483 + }
5484 +
5485 + return (ret != 0) ^ !(info->invert & IPT_PHYSDEV_OP_OUT);
5486 +}
5487 +
5488 +static int
5489 +checkentry(const char *tablename,
5490 + const struct ipt_ip *ip,
5491 + void *matchinfo,
5492 + unsigned int matchsize,
5493 + unsigned int hook_mask)
5494 +{
5495 + const struct ipt_physdev_info *info = matchinfo;
5496 +
5497 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_physdev_info)))
5498 + return 0;
5499 + if (!(info->bitmask & IPT_PHYSDEV_OP_MASK) ||
5500 + info->bitmask & ~IPT_PHYSDEV_OP_MASK)
5501 + return 0;
5502 + return 1;
5503 +}
5504 +
5505 +static struct ipt_match physdev_match = {
5506 + .name = "physdev",
5507 + .match = &match,
5508 + .checkentry = &checkentry,
5509 + .me = THIS_MODULE,
5510 +};
5511 +
5512 +static int __init init(void)
5513 +{
5514 + return ipt_register_match(&physdev_match);
5515 +}
5516 +
5517 +static void __exit fini(void)
5518 +{
5519 + ipt_unregister_match(&physdev_match);
5520 +}
5521 +
5522 +module_init(init);
5523 +module_exit(fini);
5524 +MODULE_LICENSE("GPL");
5525 +EXPORT_NO_SYMBOLS;
5526 --- /dev/null Thu Aug 24 11:00:32 2000
5527 +++ linux-2.4.21-ebt-brnf-3/include/linux/netfilter_ipv4/ipt_physdev.h Fri Aug 8 01:09:06 2003
5528 @@ -0,0 +1,24 @@
5529 +#ifndef _IPT_PHYSDEV_H
5530 +#define _IPT_PHYSDEV_H
5531 +
5532 +#ifdef __KERNEL__
5533 +#include <linux/if.h>
5534 +#endif
5535 +
5536 +#define IPT_PHYSDEV_OP_IN 0x01
5537 +#define IPT_PHYSDEV_OP_OUT 0x02
5538 +#define IPT_PHYSDEV_OP_BRIDGED 0x04
5539 +#define IPT_PHYSDEV_OP_ISIN 0x08
5540 +#define IPT_PHYSDEV_OP_ISOUT 0x10
5541 +#define IPT_PHYSDEV_OP_MASK (0x20 - 1)
5542 +
5543 +struct ipt_physdev_info {
5544 + u_int8_t invert;
5545 + u_int8_t bitmask;
5546 + char physindev[IFNAMSIZ];
5547 + char in_mask[IFNAMSIZ];
5548 + char physoutdev[IFNAMSIZ];
5549 + char out_mask[IFNAMSIZ];
5550 +};
5551 +
5552 +#endif /*_IPT_PHYSDEV_H*/
OpenWrt SVN history