projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Put back kmod-ebtables for 2.4 kernels
[openwrt.git] / target / linux / generic-2.4 / patches / 116-ebtables-brnf-11.patch
1 --- linux-2.4.31/net/bridge/br_private.h 2004-08-07 23:26:06.000000000 +0000
2 +++ linux-2.4.31-ebt-brnf/net/bridge/br_private.h 2005-09-15 16:57:22.000000000 +0000
3 @@ -143,8 +143,10 @@ extern void br_fdb_insert(struct net_bri
4 /* br_forward.c */
5 extern void br_deliver(struct net_bridge_port *to,
6 struct sk_buff *skb);
7 +extern int br_dev_queue_push_xmit(struct sk_buff *skb);
8 extern void br_forward(struct net_bridge_port *to,
9 struct sk_buff *skb);
10 +extern int br_forward_finish(struct sk_buff *skb);
11 extern void br_flood_deliver(struct net_bridge *br,
12 struct sk_buff *skb,
13 int clone);
14 @@ -165,7 +167,8 @@ extern void br_get_port_ifindices(struct
15 int *ifindices);
16
17 /* br_input.c */
18 -extern void br_handle_frame(struct sk_buff *skb);
19 +extern int br_handle_frame_finish(struct sk_buff *skb);
20 +extern int br_handle_frame(struct sk_buff *skb);
21
22 /* br_ioctl.c */
23 extern int br_ioctl(struct net_bridge *br,
24 @@ -175,6 +178,10 @@ extern int br_ioctl(struct net_bridge *b
25 unsigned long arg2);
26 extern int br_ioctl_deviceless_stub(unsigned long arg);
27
28 +/* br_netfilter.c */
29 +extern int br_netfilter_init(void);
30 +extern void br_netfilter_fini(void);
31 +
32 /* br_stp.c */
33 extern int br_is_root_bridge(struct net_bridge *br);
34 extern struct net_bridge_port *br_get_port(struct net_bridge *br,
35 --- linux-2.4.31/include/linux/if_bridge.h 2001-11-22 19:47:12.000000000 +0000
36 +++ linux-2.4.31-ebt-brnf/include/linux/if_bridge.h 2005-09-15 16:57:23.000000000 +0000
37 @@ -102,7 +102,8 @@ struct net_bridge;
38 struct net_bridge_port;
39
40 extern int (*br_ioctl_hook)(unsigned long arg);
41 -extern void (*br_handle_frame_hook)(struct sk_buff *skb);
42 +extern int (*br_handle_frame_hook)(struct sk_buff *skb);
43 +extern int (*br_should_route_hook)(struct sk_buff **pskb);
44
45 #endif
46
47 --- linux-2.4.31/net/core/dev.c 2005-04-04 01:42:20.000000000 +0000
48 +++ linux-2.4.31-ebt-brnf/net/core/dev.c 2005-09-15 16:57:23.000000000 +0000
49 @@ -1426,7 +1426,7 @@ static void net_tx_action(struct softirq
50
51
52 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
53 -void (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
54 +int (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
55 #endif
56
57 static __inline__ int handle_bridge(struct sk_buff *skb,
58 @@ -1443,7 +1443,6 @@ static __inline__ int handle_bridge(stru
59 }
60 }
61
62 - br_handle_frame_hook(skb);
63 return ret;
64 }
65
66 @@ -1503,7 +1502,12 @@ int netif_receive_skb(struct sk_buff *sk
67 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
68 if (skb->dev->br_port != NULL && br_handle_frame_hook != NULL &&
69 skb->pkt_type != PACKET_LOOPBACK) {
70 - return handle_bridge(skb, pt_prev);
71 + int ret;
72 +
73 + ret = handle_bridge(skb, pt_prev);
74 + if (br_handle_frame_hook(skb) == 0)
75 + return ret;
76 + pt_prev = NULL;
77 }
78 #endif
79
80 --- linux-2.4.31/net/bridge/br_input.c 2003-08-25 11:44:44.000000000 +0000
81 +++ linux-2.4.31-ebt-brnf/net/bridge/br_input.c 2005-09-22 17:19:52.212834152 +0000
82 @@ -24,6 +24,9 @@ unsigned char bridge_ula[6] = { 0x01, 0x
83
84 static int br_pass_frame_up_finish(struct sk_buff *skb)
85 {
86 +#ifdef CONFIG_NETFILTER_DEBUG
87 + skb->nf_debug = 0;
88 +#endif
89 netif_rx(skb);
90
91 return 0;
92 @@ -46,7 +49,7 @@ static void br_pass_frame_up(struct net_
93 br_pass_frame_up_finish);
94 }
95
96 -static int br_handle_frame_finish(struct sk_buff *skb)
97 +int br_handle_frame_finish(struct sk_buff *skb)
98 {
99 struct net_bridge *br;
100 unsigned char *dest;
101 @@ -61,6 +64,9 @@ static int br_handle_frame_finish(struct
102 goto err_nolock;
103
104 br = p->br;
105 + /* insert into forwarding database after filtering to avoid spoofing */
106 + br_fdb_insert(br, p, skb->mac.ethernet->h_source, 0);
107 +
108 read_lock(&br->lock);
109 if (skb->dev->br_port == NULL)
110 goto err;
111 @@ -112,7 +118,7 @@ err_nolock:
112 return 0;
113 }
114
115 -void br_handle_frame(struct sk_buff *skb)
116 +int br_handle_frame(struct sk_buff *skb)
117 {
118 struct net_bridge *br;
119 unsigned char *dest;
120 @@ -136,8 +142,7 @@ void br_handle_frame(struct sk_buff *skb
121 if (skb->mac.ethernet->h_source[0] & 1)
122 goto err;
123
124 - if (p->state == BR_STATE_LEARNING ||
125 - p->state == BR_STATE_FORWARDING)
126 + if (p->state == BR_STATE_LEARNING)
127 br_fdb_insert(br, p, skb->mac.ethernet->h_source, 0);
128
129 if (br->stp_enabled &&
130 @@ -146,26 +151,35 @@ void br_handle_frame(struct sk_buff *skb
131 goto handle_special_frame;
132
133 if (p->state == BR_STATE_FORWARDING) {
134 + if (br_should_route_hook && br_should_route_hook(&skb)) {
135 + read_unlock(&br->lock);
136 + return -1;
137 + }
138 +
139 + if (!memcmp(p->br->dev.dev_addr, dest, ETH_ALEN))
140 + skb->pkt_type = PACKET_HOST;
141 +
142 NF_HOOK(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
143 br_handle_frame_finish);
144 read_unlock(&br->lock);
145 - return;
146 + return 0;
147 }
148
149 err:
150 read_unlock(&br->lock);
151 err_nolock:
152 kfree_skb(skb);
153 - return;
154 + return 0;
155
156 handle_special_frame:
157 if (!dest[5]) {
158 NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,NULL,
159 br_stp_handle_bpdu);
160 read_unlock(&br->lock);
161 - return;
162 + return 0;
163 }
164
165 read_unlock(&br->lock);
166 kfree_skb(skb);
167 + return 0;
168 }
169 --- linux-2.4.31/net/bridge/br_stp_bpdu.c 2003-11-28 18:26:21.000000000 +0000
170 +++ linux-2.4.31-ebt-brnf/net/bridge/br_stp_bpdu.c 2005-09-22 17:20:13.385615400 +0000
171 @@ -142,6 +142,9 @@ int br_stp_handle_bpdu(struct sk_buff *s
172
173 p = skb->dev->br_port;
174
175 + /* insert into forwarding database after filtering to avoid spoofing */
176 + br_fdb_insert(p->br, p, skb->mac.ethernet->h_source, 0);
177 +
178 if (!p->br->stp_enabled ||
179 !pskb_may_pull(skb, sizeof(header)+1) ||
180 memcmp(skb->data, header, sizeof(header)))
181 --- linux-2.4.31/net/bridge/br_forward.c 2003-11-28 18:26:21.000000000 +0000
182 +++ linux-2.4.31-ebt-brnf/net/bridge/br_forward.c 2005-09-15 16:57:23.000000000 +0000
183 @@ -30,18 +30,21 @@ static inline int should_deliver(struct
184 return 1;
185 }
186
187 -static int __dev_queue_push_xmit(struct sk_buff *skb)
188 +int br_dev_queue_push_xmit(struct sk_buff *skb)
189 {
190 +#ifdef CONFIG_NETFILTER
191 + nf_bridge_maybe_copy_header(skb);
192 +#endif
193 skb_push(skb, ETH_HLEN);
194 dev_queue_xmit(skb);
195
196 return 0;
197 }
198
199 -static int __br_forward_finish(struct sk_buff *skb)
200 +int br_forward_finish(struct sk_buff *skb)
201 {
202 NF_HOOK(PF_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
203 - __dev_queue_push_xmit);
204 + br_dev_queue_push_xmit);
205
206 return 0;
207 }
208 @@ -49,8 +52,11 @@ static int __br_forward_finish(struct sk
209 static void __br_deliver(struct net_bridge_port *to, struct sk_buff *skb)
210 {
211 skb->dev = to->dev;
212 +#ifdef CONFIG_NETFILTER_DEBUG
213 + skb->nf_debug = 0;
214 +#endif
215 NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
216 - __br_forward_finish);
217 + br_forward_finish);
218 }
219
220 static void __br_forward(struct net_bridge_port *to, struct sk_buff *skb)
221 @@ -62,7 +68,7 @@ static void __br_forward(struct net_brid
222 skb->ip_summed = CHECKSUM_NONE;
223
224 NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
225 - __br_forward_finish);
226 + br_forward_finish);
227 }
228
229 /* called under bridge lock */
230 --- linux-2.4.31/net/bridge/br.c 2004-08-07 23:26:06.000000000 +0000
231 +++ linux-2.4.31-ebt-brnf/net/bridge/br.c 2005-09-15 16:57:23.000000000 +0000
232 @@ -30,6 +30,8 @@
233 #include "../atm/lec.h"
234 #endif
235
236 +int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
237 +
238 void br_dec_use_count()
239 {
240 MOD_DEC_USE_COUNT;
241 @@ -44,6 +46,10 @@ static int __init br_init(void)
242 {
243 printk(KERN_INFO "NET4: Ethernet Bridge 008 for NET4.0\n");
244
245 +#ifdef CONFIG_NETFILTER
246 + if (br_netfilter_init())
247 + return 1;
248 +#endif
249 br_handle_frame_hook = br_handle_frame;
250 br_ioctl_hook = br_ioctl_deviceless_stub;
251 #if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
252 @@ -57,6 +63,9 @@ static int __init br_init(void)
253
254 static void __exit br_deinit(void)
255 {
256 +#ifdef CONFIG_NETFILTER
257 + br_netfilter_fini();
258 +#endif
259 unregister_netdevice_notifier(&br_device_notifier);
260
261 rtnl_lock();
262 @@ -73,7 +82,7 @@ static void __exit br_deinit(void)
263 #endif
264 }
265
266 -EXPORT_NO_SYMBOLS;
267 +EXPORT_SYMBOL(br_should_route_hook);
268
269 module_init(br_init)
270 module_exit(br_deinit)
271 --- linux-2.4.31/net/bridge/Makefile 2000-12-29 22:07:24.000000000 +0000
272 +++ linux-2.4.31-ebt-brnf/net/bridge/Makefile 2005-09-15 16:57:23.000000000 +0000
273 @@ -7,10 +7,17 @@
274 #
275 # Note 2! The CFLAGS definition is now in the main makefile...
276
277 +export-objs := br.o
278 +
279 O_TARGET := bridge.o
280 obj-y := br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
281 br_ioctl.o br_notify.o br_stp.o br_stp_bpdu.o \
282 br_stp_if.o br_stp_timer.o
283 +
284 +ifeq ($(CONFIG_NETFILTER),y)
285 +obj-y += br_netfilter.o
286 +endif
287 +
288 obj-m := $(O_TARGET)
289
290 include $(TOPDIR)/Rules.make
291 --- linux-2.4.31/include/linux/netfilter_bridge.h 2001-06-12 02:15:27.000000000 +0000
292 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge.h 2005-09-15 16:57:23.000000000 +0000
293 @@ -6,6 +6,10 @@
294
295 #include <linux/config.h>
296 #include <linux/netfilter.h>
297 +#if defined(__KERNEL__) && defined(CONFIG_NETFILTER)
298 +#include <asm/atomic.h>
299 +#include <linux/if_ether.h>
300 +#endif
301
302 /* Bridge Hooks */
303 /* After promisc drops, checksum checks. */
304 @@ -18,7 +22,89 @@
305 #define NF_BR_LOCAL_OUT 3
306 /* Packets about to hit the wire. */
307 #define NF_BR_POST_ROUTING 4
308 -#define NF_BR_NUMHOOKS 5
309 +/* Not really a hook, but used for the ebtables broute table */
310 +#define NF_BR_BROUTING 5
311 +#define NF_BR_NUMHOOKS 6
312 +
313 +#ifdef __KERNEL__
314 +
315 +#define BRNF_PKT_TYPE 0x01
316 +#define BRNF_BRIDGED_DNAT 0x02
317 +#define BRNF_DONT_TAKE_PARENT 0x04
318 +#define BRNF_BRIDGED 0x08
319 +#define BRNF_NF_BRIDGE_PREROUTING 0x10
320 +
321 +enum nf_br_hook_priorities {
322 + NF_BR_PRI_FIRST = INT_MIN,
323 + NF_BR_PRI_NAT_DST_BRIDGED = -300,
324 + NF_BR_PRI_FILTER_BRIDGED = -200,
325 + NF_BR_PRI_BRNF = 0,
326 + NF_BR_PRI_NAT_DST_OTHER = 100,
327 + NF_BR_PRI_FILTER_OTHER = 200,
328 + NF_BR_PRI_NAT_SRC = 300,
329 + NF_BR_PRI_LAST = INT_MAX,
330 +};
331 +
332 +#ifdef CONFIG_NETFILTER
333 +static inline
334 +struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
335 +{
336 + struct nf_bridge_info **nf_bridge = &(skb->nf_bridge);
337 +
338 + if ((*nf_bridge = kmalloc(sizeof(**nf_bridge), GFP_ATOMIC)) != NULL) {
339 + atomic_set(&(*nf_bridge)->use, 1);
340 + (*nf_bridge)->mask = 0;
341 + (*nf_bridge)->physindev = (*nf_bridge)->physoutdev = NULL;
342 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
343 + (*nf_bridge)->netoutdev = NULL;
344 +#endif
345 + }
346 +
347 + return *nf_bridge;
348 +}
349 +
350 +/* Only used in br_forward.c */
351 +static inline
352 +void nf_bridge_maybe_copy_header(struct sk_buff *skb)
353 +{
354 + if (skb->nf_bridge) {
355 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
356 + memcpy(skb->data - 18, skb->nf_bridge->data, 18);
357 + skb_push(skb, 4);
358 + } else
359 + memcpy(skb->data - 16, skb->nf_bridge->data, 16);
360 + }
361 +}
362 +
363 +static inline
364 +void nf_bridge_save_header(struct sk_buff *skb)
365 +{
366 + int header_size = 16;
367 +
368 + if (skb->protocol == __constant_htons(ETH_P_8021Q))
369 + header_size = 18;
370 + memcpy(skb->nf_bridge->data, skb->data - header_size, header_size);
371 +}
372 +
373 +struct bridge_skb_cb {
374 + union {
375 + __u32 ipv4;
376 + } daddr;
377 +};
378 +
379
380 +/* This is called by the IP fragmenting code and it ensures there is
381 + * enough room for the encapsulating header (if there is one). */
382 +static inline
383 +int nf_bridge_pad(struct sk_buff *skb)
384 +{
385 + if (skb->nf_bridge) {
386 + if (skb->protocol == __constant_htons(ETH_P_8021Q))
387 + return 4;
388 + }
389 + return 0;
390 +}
391 +#endif /* CONFIG_NETFILTER */
392
393 +#endif /* __KERNEL__ */
394 #endif
395 --- linux-2.4.31/include/linux/netfilter_ipv4/ip_tables.h 2005-04-04 01:42:20.000000000 +0000
396 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_ipv4/ip_tables.h 2005-09-15 16:57:23.000000000 +0000
397 @@ -159,7 +159,7 @@ struct ipt_entry
398 #define IPT_CONTINUE 0xFFFFFFFF
399
400 /* For standard target */
401 -#define IPT_RETURN (-NF_MAX_VERDICT - 1)
402 +#define IPT_RETURN (-NF_REPEAT - 1)
403
404 /* TCP matching stuff */
405 struct ipt_tcp
406 --- linux-2.4.31/include/linux/netfilter_ipv6/ip6_tables.h 2005-04-04 01:42:20.000000000 +0000
407 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_ipv6/ip6_tables.h 2005-09-15 16:57:23.000000000 +0000
408 @@ -165,7 +165,7 @@ struct ip6t_entry
409 #define IP6T_CONTINUE 0xFFFFFFFF
410
411 /* For standard target */
412 -#define IP6T_RETURN (-NF_MAX_VERDICT - 1)
413 +#define IP6T_RETURN (-NF_REPEAT - 1)
414
415 /* TCP matching stuff */
416 struct ip6t_tcp
417 --- linux-2.4.31/include/linux/netfilter_arp/arp_tables.h 2003-08-25 11:44:44.000000000 +0000
418 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_arp/arp_tables.h 2005-09-15 16:57:23.000000000 +0000
419 @@ -154,7 +154,7 @@ struct arpt_entry
420 #define ARPT_CONTINUE 0xFFFFFFFF
421
422 /* For standard target */
423 -#define ARPT_RETURN (-NF_MAX_VERDICT - 1)
424 +#define ARPT_RETURN (-NF_REPEAT - 1)
425
426 /* The argument to ARPT_SO_GET_INFO */
427 struct arpt_getinfo
428 --- linux-2.4.31/net/Makefile 2004-08-07 23:26:06.000000000 +0000
429 +++ linux-2.4.31-ebt-brnf/net/Makefile 2005-09-15 16:57:23.000000000 +0000
430 @@ -7,7 +7,8 @@
431
432 O_TARGET := network.o
433
434 -mod-subdirs := ipv4/netfilter ipv6/netfilter ipx irda bluetooth atm netlink sched core sctp 802
435 +mod-subdirs := ipv4/netfilter ipv6/netfilter bridge/netfilter ipx irda \
436 + bluetooth atm netlink sched core sctp 802
437 export-objs := netsyms.o
438
439 subdir-y := core ethernet
440 @@ -27,6 +28,12 @@ subdir-$(CONFIG_NETFILTER) += ipv6/netfi
441 endif
442 endif
443
444 +ifneq ($(CONFIG_BRIDGE),n)
445 +ifneq ($(CONFIG_BRIDGE),)
446 +subdir-$(CONFIG_BRIDGE) += bridge/netfilter
447 +endif
448 +endif
449 +
450 subdir-$(CONFIG_KHTTPD) += khttpd
451 subdir-$(CONFIG_PACKET) += packet
452 subdir-$(CONFIG_NET_SCHED) += sched
453 --- linux-2.4.31/net/Config.in 2005-01-19 14:10:13.000000000 +0000
454 +++ linux-2.4.31-ebt-brnf/net/Config.in 2005-09-15 16:57:23.000000000 +0000
455 @@ -70,6 +70,9 @@ if [ "$CONFIG_DECNET" != "n" ]; then
456 source net/decnet/Config.in
457 fi
458 dep_tristate '802.1d Ethernet Bridging' CONFIG_BRIDGE $CONFIG_INET
459 +if [ "$CONFIG_BRIDGE" != "n" -a "$CONFIG_NETFILTER" != "n" ]; then
460 + source net/bridge/netfilter/Config.in
461 +fi
462 if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
463 tristate 'CCITT X.25 Packet Layer (EXPERIMENTAL)' CONFIG_X25
464 tristate 'LAPB Data Link Driver (EXPERIMENTAL)' CONFIG_LAPB
465 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
466 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/Makefile 2005-09-15 16:57:23.000000000 +0000
467 @@ -0,0 +1,34 @@
468 +#
469 +# Makefile for the netfilter modules on top of bridging.
470 +#
471 +# Note! Dependencies are done automagically by 'make dep', which also
472 +# removes any old dependencies. DON'T put your own dependencies here
473 +# unless it's something special (ie not a .c file).
474 +#
475 +# Note 2! The CFLAGS definition is now in the main makefile...
476 +
477 +O_TARGET := netfilter.o
478 +
479 +export-objs := ebtables.o
480 +
481 +obj-$(CONFIG_BRIDGE_NF_EBTABLES) += ebtables.o
482 +obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebtable_filter.o
483 +obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
484 +obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
485 +obj-$(CONFIG_BRIDGE_EBT_802_3) += ebt_802_3.o
486 +obj-$(CONFIG_BRIDGE_EBT_ARPF) += ebt_arp.o
487 +obj-$(CONFIG_BRIDGE_EBT_AMONG) += ebt_among.o
488 +obj-$(CONFIG_BRIDGE_EBT_IPF) += ebt_ip.o
489 +obj-$(CONFIG_BRIDGE_EBT_LIMIT) += ebt_limit.o
490 +obj-$(CONFIG_BRIDGE_EBT_MARKF) += ebt_mark_m.o
491 +obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_pkttype.o
492 +obj-$(CONFIG_BRIDGE_EBT_STP) += ebt_stp.o
493 +obj-$(CONFIG_BRIDGE_EBT_VLANF) += ebt_vlan.o
494 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
495 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_ulog.o
496 +obj-$(CONFIG_BRIDGE_EBT_ARPREPLY) += ebt_arpreply.o
497 +obj-$(CONFIG_BRIDGE_EBT_DNAT) += ebt_dnat.o
498 +obj-$(CONFIG_BRIDGE_EBT_MARK_T) += ebt_mark.o
499 +obj-$(CONFIG_BRIDGE_EBT_REDIRECT) += ebt_redirect.o
500 +obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
501 +include $(TOPDIR)/Rules.make
502 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
503 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/Config.in 2005-09-15 16:57:23.000000000 +0000
504 @@ -0,0 +1,23 @@
505 +#
506 +# Bridge netfilter configuration
507 +#
508 +dep_tristate ' Bridge: ebtables' CONFIG_BRIDGE_NF_EBTABLES $CONFIG_BRIDGE
509 +dep_tristate ' ebt: filter table support' CONFIG_BRIDGE_EBT_T_FILTER $CONFIG_BRIDGE_NF_EBTABLES
510 +dep_tristate ' ebt: nat table support' CONFIG_BRIDGE_EBT_T_NAT $CONFIG_BRIDGE_NF_EBTABLES
511 +dep_tristate ' ebt: broute table support' CONFIG_BRIDGE_EBT_BROUTE $CONFIG_BRIDGE_NF_EBTABLES
512 +dep_tristate ' ebt: log support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
513 +dep_tristate ' ebt: ulog support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
514 +dep_tristate ' ebt: IP filter support' CONFIG_BRIDGE_EBT_IPF $CONFIG_BRIDGE_NF_EBTABLES
515 +dep_tristate ' ebt: ARP filter support' CONFIG_BRIDGE_EBT_ARPF $CONFIG_BRIDGE_NF_EBTABLES
516 +dep_tristate ' ebt: among filter support' CONFIG_BRIDGE_EBT_AMONG $CONFIG_BRIDGE_NF_EBTABLES
517 +dep_tristate ' ebt: limit filter support' CONFIG_BRIDGE_EBT_LIMIT $CONFIG_BRIDGE_NF_EBTABLES
518 +dep_tristate ' ebt: 802.1Q VLAN filter support' CONFIG_BRIDGE_EBT_VLANF $CONFIG_BRIDGE_NF_EBTABLES
519 +dep_tristate ' ebt: 802.3 filter support' CONFIG_BRIDGE_EBT_802_3 $CONFIG_BRIDGE_NF_EBTABLES
520 +dep_tristate ' ebt: packet type filter support' CONFIG_BRIDGE_EBT_PKTTYPE $CONFIG_BRIDGE_NF_EBTABLES
521 +dep_tristate ' ebt: STP filter support' CONFIG_BRIDGE_EBT_STP $CONFIG_BRIDGE_NF_EBTABLES
522 +dep_tristate ' ebt: mark filter support' CONFIG_BRIDGE_EBT_MARKF $CONFIG_BRIDGE_NF_EBTABLES
523 +dep_tristate ' ebt: arp reply target support' CONFIG_BRIDGE_EBT_ARPREPLY $CONFIG_BRIDGE_NF_EBTABLES
524 +dep_tristate ' ebt: snat target support' CONFIG_BRIDGE_EBT_SNAT $CONFIG_BRIDGE_NF_EBTABLES
525 +dep_tristate ' ebt: dnat target support' CONFIG_BRIDGE_EBT_DNAT $CONFIG_BRIDGE_NF_EBTABLES
526 +dep_tristate ' ebt: redirect target support' CONFIG_BRIDGE_EBT_REDIRECT $CONFIG_BRIDGE_NF_EBTABLES
527 +dep_tristate ' ebt: mark target support' CONFIG_BRIDGE_EBT_MARK_T $CONFIG_BRIDGE_NF_EBTABLES
528 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
529 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebtable_filter.c 2005-09-15 16:57:23.000000000 +0000
530 @@ -0,0 +1,90 @@
531 +/*
532 + * ebtable_filter
533 + *
534 + * Authors:
535 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
536 + *
537 + * April, 2002
538 + *
539 + */
540 +
541 +#include <linux/netfilter_bridge/ebtables.h>
542 +#include <linux/module.h>
543 +
544 +#define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
545 + (1 << NF_BR_LOCAL_OUT))
546 +
547 +static struct ebt_entries initial_chains[] =
548 +{
549 + {0, "INPUT", 0, EBT_ACCEPT, 0},
550 + {0, "FORWARD", 0, EBT_ACCEPT, 0},
551 + {0, "OUTPUT", 0, EBT_ACCEPT, 0}
552 +};
553 +
554 +static struct ebt_replace initial_table =
555 +{
556 + "filter", FILTER_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
557 + { [NF_BR_LOCAL_IN]&initial_chains[0], [NF_BR_FORWARD]&initial_chains[1],
558 + [NF_BR_LOCAL_OUT]&initial_chains[2] }, 0, NULL, (char *)initial_chains
559 +};
560 +
561 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
562 +{
563 + if (valid_hooks & ~FILTER_VALID_HOOKS)
564 + return -EINVAL;
565 + return 0;
566 +}
567 +
568 +static struct ebt_table frame_filter =
569 +{
570 + {NULL, NULL}, "filter", &initial_table, FILTER_VALID_HOOKS,
571 + RW_LOCK_UNLOCKED, check, NULL
572 +};
573 +
574 +static unsigned int
575 +ebt_hook (unsigned int hook, struct sk_buff **pskb, const struct net_device *in,
576 + const struct net_device *out, int (*okfn)(struct sk_buff *))
577 +{
578 + return ebt_do_table(hook, pskb, in, out, &frame_filter);
579 +}
580 +
581 +static struct nf_hook_ops ebt_ops_filter[] = {
582 + { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_IN,
583 + NF_BR_PRI_FILTER_BRIDGED},
584 + { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_FORWARD,
585 + NF_BR_PRI_FILTER_BRIDGED},
586 + { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_OUT,
587 + NF_BR_PRI_FILTER_OTHER}
588 +};
589 +
590 +static int __init init(void)
591 +{
592 + int i, j, ret;
593 +
594 + ret = ebt_register_table(&frame_filter);
595 + if (ret < 0)
596 + return ret;
597 + for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
598 + if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
599 + goto cleanup;
600 + return ret;
601 +cleanup:
602 + for (j = 0; j < i; j++)
603 + nf_unregister_hook(&ebt_ops_filter[j]);
604 + ebt_unregister_table(&frame_filter);
605 + return ret;
606 +}
607 +
608 +static void __exit fini(void)
609 +{
610 + int i;
611 +
612 + for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
613 + nf_unregister_hook(&ebt_ops_filter[i]);
614 + ebt_unregister_table(&frame_filter);
615 +}
616 +
617 +module_init(init);
618 +module_exit(fini);
619 +EXPORT_NO_SYMBOLS;
620 +MODULE_LICENSE("GPL");
621 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
622 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebtable_nat.c 2005-09-15 16:57:23.000000000 +0000
623 @@ -0,0 +1,96 @@
624 +/*
625 + * ebtable_nat
626 + *
627 + * Authors:
628 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
629 + *
630 + * April, 2002
631 + *
632 + */
633 +
634 +#include <linux/netfilter_bridge/ebtables.h>
635 +#include <linux/module.h>
636 +#define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
637 + (1 << NF_BR_POST_ROUTING))
638 +
639 +static struct ebt_entries initial_chains[] =
640 +{
641 + {0, "PREROUTING", 0, EBT_ACCEPT, 0},
642 + {0, "OUTPUT", 0, EBT_ACCEPT, 0},
643 + {0, "POSTROUTING", 0, EBT_ACCEPT, 0}
644 +};
645 +
646 +static struct ebt_replace initial_table =
647 +{
648 + "nat", NAT_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
649 + { [NF_BR_PRE_ROUTING]&initial_chains[0], [NF_BR_LOCAL_OUT]&initial_chains[1],
650 + [NF_BR_POST_ROUTING]&initial_chains[2] }, 0, NULL, (char *)initial_chains
651 +};
652 +
653 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
654 +{
655 + if (valid_hooks & ~NAT_VALID_HOOKS)
656 + return -EINVAL;
657 + return 0;
658 +}
659 +
660 +static struct ebt_table frame_nat =
661 +{
662 + {NULL, NULL}, "nat", &initial_table, NAT_VALID_HOOKS,
663 + RW_LOCK_UNLOCKED, check, NULL
664 +};
665 +
666 +static unsigned int
667 +ebt_nat_dst(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
668 + , const struct net_device *out, int (*okfn)(struct sk_buff *))
669 +{
670 + return ebt_do_table(hook, pskb, in, out, &frame_nat);
671 +}
672 +
673 +static unsigned int
674 +ebt_nat_src(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
675 + , const struct net_device *out, int (*okfn)(struct sk_buff *))
676 +{
677 + return ebt_do_table(hook, pskb, in, out, &frame_nat);
678 +}
679 +
680 +static struct nf_hook_ops ebt_ops_nat[] = {
681 + { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_LOCAL_OUT,
682 + NF_BR_PRI_NAT_DST_OTHER},
683 + { { NULL, NULL }, ebt_nat_src, PF_BRIDGE, NF_BR_POST_ROUTING,
684 + NF_BR_PRI_NAT_SRC},
685 + { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_PRE_ROUTING,
686 + NF_BR_PRI_NAT_DST_BRIDGED},
687 +};
688 +
689 +static int __init init(void)
690 +{
691 + int i, ret, j;
692 +
693 + ret = ebt_register_table(&frame_nat);
694 + if (ret < 0)
695 + return ret;
696 + for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
697 + if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
698 + goto cleanup;
699 + return ret;
700 +cleanup:
701 + for (j = 0; j < i; j++)
702 + nf_unregister_hook(&ebt_ops_nat[j]);
703 + ebt_unregister_table(&frame_nat);
704 + return ret;
705 +}
706 +
707 +static void __exit fini(void)
708 +{
709 + int i;
710 +
711 + for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
712 + nf_unregister_hook(&ebt_ops_nat[i]);
713 + ebt_unregister_table(&frame_nat);
714 +}
715 +
716 +module_init(init);
717 +module_exit(fini);
718 +EXPORT_NO_SYMBOLS;
719 +MODULE_LICENSE("GPL");
720 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
721 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebtable_broute.c 2005-09-15 16:57:23.000000000 +0000
722 @@ -0,0 +1,79 @@
723 +/*
724 + * ebtable_broute
725 + *
726 + * Authors:
727 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
728 + *
729 + * April, 2002
730 + *
731 + * This table lets you choose between routing and bridging for frames
732 + * entering on a bridge enslaved nic. This table is traversed before any
733 + * other ebtables table. See net/bridge/br_input.c.
734 + */
735 +
736 +#include <linux/netfilter_bridge/ebtables.h>
737 +#include <linux/module.h>
738 +#include <linux/if_bridge.h>
739 +#include <linux/brlock.h>
740 +
741 +// EBT_ACCEPT means the frame will be bridged
742 +// EBT_DROP means the frame will be routed
743 +static struct ebt_entries initial_chain =
744 + {0, "BROUTING", 0, EBT_ACCEPT, 0};
745 +
746 +static struct ebt_replace initial_table =
747 +{
748 + "broute", 1 << NF_BR_BROUTING, 0, sizeof(struct ebt_entries),
749 + { [NF_BR_BROUTING]&initial_chain}, 0, NULL, (char *)&initial_chain
750 +};
751 +
752 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
753 +{
754 + if (valid_hooks & ~(1 << NF_BR_BROUTING))
755 + return -EINVAL;
756 + return 0;
757 +}
758 +
759 +static struct ebt_table broute_table =
760 +{
761 + {NULL, NULL}, "broute", &initial_table, 1 << NF_BR_BROUTING,
762 + RW_LOCK_UNLOCKED, check, NULL
763 +};
764 +
765 +static int ebt_broute(struct sk_buff **pskb)
766 +{
767 + int ret;
768 +
769 + ret = ebt_do_table(NF_BR_BROUTING, pskb, (*pskb)->dev, NULL,
770 + &broute_table);
771 + if (ret == NF_DROP)
772 + return 1; // route it
773 + return 0; // bridge it
774 +}
775 +
776 +static int __init init(void)
777 +{
778 + int ret;
779 +
780 + ret = ebt_register_table(&broute_table);
781 + if (ret < 0)
782 + return ret;
783 + br_write_lock_bh(BR_NETPROTO_LOCK);
784 + // see br_input.c
785 + br_should_route_hook = ebt_broute;
786 + br_write_unlock_bh(BR_NETPROTO_LOCK);
787 + return ret;
788 +}
789 +
790 +static void __exit fini(void)
791 +{
792 + br_write_lock_bh(BR_NETPROTO_LOCK);
793 + br_should_route_hook = NULL;
794 + br_write_unlock_bh(BR_NETPROTO_LOCK);
795 + ebt_unregister_table(&broute_table);
796 +}
797 +
798 +module_init(init);
799 +module_exit(fini);
800 +EXPORT_NO_SYMBOLS;
801 +MODULE_LICENSE("GPL");
802 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
803 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_among.c 2005-09-15 16:57:23.000000000 +0000
804 @@ -0,0 +1,223 @@
805 +/*
806 + * ebt_among
807 + *
808 + * Authors:
809 + * Grzegorz Borowiak <grzes@gnu.univ.gda.pl>
810 + *
811 + * August, 2003
812 + *
813 + */
814 +
815 +#include <linux/netfilter_bridge/ebtables.h>
816 +#include <linux/netfilter_bridge/ebt_among.h>
817 +#include <linux/ip.h>
818 +#include <linux/if_arp.h>
819 +#include <linux/module.h>
820 +
821 +static int ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
822 + const char *mac, uint32_t ip)
823 +{
824 + /* You may be puzzled as to how this code works.
825 + * Some tricks were used, refer to
826 + * include/linux/netfilter_bridge/ebt_among.h
827 + * as there you can find a solution of this mystery.
828 + */
829 + const struct ebt_mac_wormhash_tuple *p;
830 + int start, limit, i;
831 + uint32_t cmp[2] = { 0, 0 };
832 + int key = (const unsigned char) mac[5];
833 +
834 + memcpy(((char *) cmp) + 2, mac, 6);
835 + start = wh->table[key];
836 + limit = wh->table[key + 1];
837 + if (ip) {
838 + for (i = start; i < limit; i++) {
839 + p = &wh->pool[i];
840 + if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0]) {
841 + if (p->ip == 0 || p->ip == ip) {
842 + return 1;
843 + }
844 + }
845 + }
846 + } else {
847 + for (i = start; i < limit; i++) {
848 + p = &wh->pool[i];
849 + if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0]) {
850 + if (p->ip == 0) {
851 + return 1;
852 + }
853 + }
854 + }
855 + }
856 + return 0;
857 +}
858 +
859 +static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
860 + *wh)
861 +{
862 + int i;
863 +
864 + for (i = 0; i < 256; i++) {
865 + if (wh->table[i] > wh->table[i + 1])
866 + return -0x100 - i;
867 + if (wh->table[i] < 0)
868 + return -0x200 - i;
869 + if (wh->table[i] > wh->poolsize)
870 + return -0x300 - i;
871 + }
872 + if (wh->table[256] > wh->poolsize)
873 + return -0xc00;
874 + return 0;
875 +}
876 +
877 +static int get_ip_dst(const struct sk_buff *skb, uint32_t * addr)
878 +{
879 + if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_IP))
880 + *addr = skb->nh.iph->daddr;
881 + else if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) {
882 + uint32_t arp_len = sizeof(struct arphdr) +
883 + (2 * (((*skb).nh.arph)->ar_hln)) +
884 + (2 * (((*skb).nh.arph)->ar_pln));
885 +
886 + /* Make sure the packet is long enough. */
887 + if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
888 + return -1;
889 + /* IPv4 addresses are always 4 bytes. */
890 + if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
891 + return -1;
892 +
893 + memcpy(addr, ((*skb).nh.raw) + sizeof(struct arphdr) +
894 + (2 * (((*skb).nh.arph)->ar_hln)) +
895 + (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
896 +
897 + }
898 + return 0;
899 +}
900 +
901 +static int get_ip_src(const struct sk_buff *skb, uint32_t * addr)
902 +{
903 + if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_IP))
904 + *addr = skb->nh.iph->saddr;
905 + else if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) {
906 + uint32_t arp_len = sizeof(struct arphdr) +
907 + (2 * (((*skb).nh.arph)->ar_hln)) +
908 + (2 * (((*skb).nh.arph)->ar_pln));
909 +
910 + /* Make sure the packet is long enough. */
911 + if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
912 + return -1;
913 + /* IPv4 addresses are always 4 bytes. */
914 + if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
915 + return -1;
916 +
917 + memcpy(addr, ((*skb).nh.raw) + sizeof(struct arphdr) +
918 + ((((*skb).nh.arph)->ar_hln)), sizeof(uint32_t));
919 +
920 + }
921 + return 0;
922 +}
923 +
924 +static int ebt_filter_among(const struct sk_buff *skb,
925 + const struct net_device *in,
926 + const struct net_device *out, const void *data,
927 + unsigned int datalen)
928 +{
929 + struct ebt_among_info *info = (struct ebt_among_info *) data;
930 + const char *dmac, *smac;
931 + const struct ebt_mac_wormhash *wh_dst, *wh_src;
932 + uint32_t dip = 0, sip = 0;
933 +
934 + wh_dst = ebt_among_wh_dst(info);
935 + wh_src = ebt_among_wh_src(info);
936 +
937 + if (wh_src) {
938 + smac = skb->mac.ethernet->h_source;
939 + if (get_ip_src(skb, &sip))
940 + return EBT_NOMATCH;
941 + if (!(info->bitmask & EBT_AMONG_SRC_NEG)) {
942 + /* we match only if it contains */
943 + if (!ebt_mac_wormhash_contains(wh_src, smac, sip))
944 + return EBT_NOMATCH;
945 + } else {
946 + /* we match only if it DOES NOT contain */
947 + if (ebt_mac_wormhash_contains(wh_src, smac, sip))
948 + return EBT_NOMATCH;
949 + }
950 + }
951 +
952 + if (wh_dst) {
953 + dmac = skb->mac.ethernet->h_dest;
954 + if (get_ip_dst(skb, &dip))
955 + return EBT_NOMATCH;
956 + if (!(info->bitmask & EBT_AMONG_DST_NEG)) {
957 + /* we match only if it contains */
958 + if (!ebt_mac_wormhash_contains(wh_dst, dmac, dip))
959 + return EBT_NOMATCH;
960 + } else {
961 + /* we match only if it DOES NOT contain */
962 + if (ebt_mac_wormhash_contains(wh_dst, dmac, dip))
963 + return EBT_NOMATCH;
964 + }
965 + }
966 +
967 + return EBT_MATCH;
968 +}
969 +
970 +static int ebt_among_check(const char *tablename, unsigned int hookmask,
971 + const struct ebt_entry *e, void *data,
972 + unsigned int datalen)
973 +{
974 + struct ebt_among_info *info = (struct ebt_among_info *) data;
975 + int expected_length = sizeof(struct ebt_among_info);
976 + const struct ebt_mac_wormhash *wh_dst, *wh_src;
977 + int err;
978 +
979 + wh_dst = ebt_among_wh_dst(info);
980 + wh_src = ebt_among_wh_src(info);
981 + expected_length += ebt_mac_wormhash_size(wh_dst);
982 + expected_length += ebt_mac_wormhash_size(wh_src);
983 +
984 + if (datalen != EBT_ALIGN(expected_length)) {
985 + printk(KERN_WARNING
986 + "ebtables: among: wrong size: %d"
987 + "against expected %d, rounded to %d\n",
988 + datalen, expected_length,
989 + EBT_ALIGN(expected_length));
990 + return -EINVAL;
991 + }
992 + if (wh_dst && (err = ebt_mac_wormhash_check_integrity(wh_dst))) {
993 + printk(KERN_WARNING
994 + "ebtables: among: dst integrity fail: %x\n", -err);
995 + return -EINVAL;
996 + }
997 + if (wh_src && (err = ebt_mac_wormhash_check_integrity(wh_src))) {
998 + printk(KERN_WARNING
999 + "ebtables: among: src integrity fail: %x\n", -err);
1000 + return -EINVAL;
1001 + }
1002 + return 0;
1003 +}
1004 +
1005 +static struct ebt_match filter_among = {
1006 + {NULL, NULL},
1007 + EBT_AMONG_MATCH,
1008 + ebt_filter_among,
1009 + ebt_among_check,
1010 + NULL,
1011 + THIS_MODULE
1012 +};
1013 +
1014 +static int __init init(void)
1015 +{
1016 + return ebt_register_match(&filter_among);
1017 +}
1018 +
1019 +static void __exit fini(void)
1020 +{
1021 + ebt_unregister_match(&filter_among);
1022 +}
1023 +
1024 +module_init(init);
1025 +module_exit(fini);
1026 +EXPORT_NO_SYMBOLS;
1027 +MODULE_LICENSE("GPL");
1028 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1029 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_limit.c 2005-09-15 16:57:23.000000000 +0000
1030 @@ -0,0 +1,101 @@
1031 +/*
1032 + * ebt_limit
1033 + *
1034 + * Authors:
1035 + * Tom Marshall <tommy@home.tig-grr.com>
1036 + *
1037 + * Mostly copied from netfilter's ipt_limit.c, see that file for explanation
1038 + *
1039 + * September, 2003
1040 + *
1041 + */
1042 +
1043 +#include <linux/netfilter_bridge/ebtables.h>
1044 +#include <linux/netfilter_bridge/ebt_limit.h>
1045 +#include <linux/module.h>
1046 +
1047 +#include <linux/netdevice.h>
1048 +#include <linux/spinlock.h>
1049 +
1050 +static spinlock_t limit_lock = SPIN_LOCK_UNLOCKED;
1051 +
1052 +#define CREDITS_PER_JIFFY 128
1053 +
1054 +static int ebt_limit_match(const struct sk_buff *skb, const struct net_device *in,
1055 + const struct net_device *out, const void *data, unsigned int datalen)
1056 +{
1057 + struct ebt_limit_info *info = (struct ebt_limit_info *)data;
1058 + unsigned long now = jiffies;
1059 +
1060 + spin_lock_bh(&limit_lock);
1061 + info->credit += (now - xchg(&info->prev, now)) * CREDITS_PER_JIFFY;
1062 + if (info->credit > info->credit_cap)
1063 + info->credit = info->credit_cap;
1064 +
1065 + if (info->credit >= info->cost) {
1066 + /* We're not limited. */
1067 + info->credit -= info->cost;
1068 + spin_unlock_bh(&limit_lock);
1069 + return EBT_MATCH;
1070 + }
1071 +
1072 + spin_unlock_bh(&limit_lock);
1073 + return EBT_NOMATCH;
1074 +}
1075 +
1076 +/* Precision saver. */
1077 +static u_int32_t
1078 +user2credits(u_int32_t user)
1079 +{
1080 + /* If multiplying would overflow... */
1081 + if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY))
1082 + /* Divide first. */
1083 + return (user / EBT_LIMIT_SCALE) * HZ * CREDITS_PER_JIFFY;
1084 +
1085 + return (user * HZ * CREDITS_PER_JIFFY) / EBT_LIMIT_SCALE;
1086 +}
1087 +
1088 +static int ebt_limit_check(const char *tablename, unsigned int hookmask,
1089 + const struct ebt_entry *e, void *data, unsigned int datalen)
1090 +{
1091 + struct ebt_limit_info *info = (struct ebt_limit_info *)data;
1092 +
1093 + if (datalen != EBT_ALIGN(sizeof(struct ebt_limit_info)))
1094 + return -EINVAL;
1095 +
1096 + /* Check for overflow. */
1097 + if (info->burst == 0
1098 + || user2credits(info->avg * info->burst) < user2credits(info->avg)) {
1099 + printk("Overflow in ebt_limit: %u/%u\n",
1100 + info->avg, info->burst);
1101 + return -EINVAL;
1102 + }
1103 +
1104 + /* User avg in seconds * EBT_LIMIT_SCALE: convert to jiffies * 128. */
1105 + info->prev = jiffies;
1106 + info->credit = user2credits(info->avg * info->burst);
1107 + info->credit_cap = user2credits(info->avg * info->burst);
1108 + info->cost = user2credits(info->avg);
1109 + return 0;
1110 +}
1111 +
1112 +static struct ebt_match ebt_limit_reg =
1113 +{
1114 + {NULL, NULL}, EBT_LIMIT_MATCH, ebt_limit_match, ebt_limit_check, NULL,
1115 + THIS_MODULE
1116 +};
1117 +
1118 +static int __init init(void)
1119 +{
1120 + return ebt_register_match(&ebt_limit_reg);
1121 +}
1122 +
1123 +static void __exit fini(void)
1124 +{
1125 + ebt_unregister_match(&ebt_limit_reg);
1126 +}
1127 +
1128 +module_init(init);
1129 +module_exit(fini);
1130 +EXPORT_NO_SYMBOLS;
1131 +MODULE_LICENSE("GPL");
1132 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1133 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_arpreply.c 2005-09-15 16:57:23.000000000 +0000
1134 @@ -0,0 +1,86 @@
1135 +/*
1136 + * ebt_arpreply
1137 + *
1138 + * Authors:
1139 + * Grzegorz Borowiak <grzes@gnu.univ.gda.pl>
1140 + * Bart De Schuymer <bdschuym@pandora.be>
1141 + *
1142 + * August, 2003
1143 + *
1144 + */
1145 +
1146 +#include <linux/netfilter_bridge/ebtables.h>
1147 +#include <linux/netfilter_bridge/ebt_arpreply.h>
1148 +#include <linux/if_arp.h>
1149 +#include <net/arp.h>
1150 +#include <linux/module.h>
1151 +
1152 +static int ebt_target_reply(struct sk_buff **pskb, unsigned int hooknr,
1153 + const struct net_device *in, const struct net_device *out,
1154 + const void *data, unsigned int datalen)
1155 +{
1156 + struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
1157 + struct arphdr *ah;
1158 + unsigned char *sha, *arp_ptr;
1159 + u32 sip, tip;
1160 +
1161 + ah = (**pskb).nh.arph;
1162 + if (ah->ar_op != __constant_htons(ARPOP_REQUEST) ||
1163 + ah->ar_hln != ETH_ALEN || ah->ar_pro != htons(ETH_P_IP) ||
1164 + ah->ar_pln != 4)
1165 + return EBT_CONTINUE;
1166 +
1167 + arp_ptr = (unsigned char *)(ah + 1);
1168 +
1169 + /* get source and target IP */
1170 + sha = arp_ptr;
1171 + arp_ptr += ETH_ALEN;
1172 + memcpy(&sip, arp_ptr, 4);
1173 + arp_ptr += 4 + ETH_ALEN;
1174 + memcpy(&tip, arp_ptr, 4);
1175 +
1176 + arp_send(ARPOP_REPLY, ETH_P_ARP, sip, in, tip, sha, info->mac, sha);
1177 +
1178 + return info->target;
1179 +}
1180 +
1181 +static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
1182 + const struct ebt_entry *e, void *data, unsigned int datalen)
1183 +{
1184 + struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
1185 +
1186 + if (datalen != EBT_ALIGN(sizeof(struct ebt_arpreply_info)))
1187 + return -EINVAL;
1188 + if (BASE_CHAIN && info->target == EBT_RETURN)
1189 + return -EINVAL;
1190 + if (e->ethproto != __constant_htons(ETH_P_ARP) ||
1191 + e->invflags & EBT_IPROTO)
1192 + return -EINVAL;
1193 + CLEAR_BASE_CHAIN_BIT;
1194 + if (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING))
1195 + return -EINVAL;
1196 + return 0;
1197 +}
1198 +
1199 +static struct ebt_target reply_target =
1200 +{
1201 + .name = EBT_ARPREPLY_TARGET,
1202 + .target = ebt_target_reply,
1203 + .check = ebt_target_reply_check,
1204 + .me = THIS_MODULE,
1205 +};
1206 +
1207 +static int __init init(void)
1208 +{
1209 + return ebt_register_target(&reply_target);
1210 +}
1211 +
1212 +static void __exit fini(void)
1213 +{
1214 + ebt_unregister_target(&reply_target);
1215 +}
1216 +
1217 +module_init(init);
1218 +module_exit(fini);
1219 +EXPORT_NO_SYMBOLS;
1220 +MODULE_LICENSE("GPL");
1221 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1222 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_802_3.c 2005-09-15 16:57:23.000000000 +0000
1223 @@ -0,0 +1,74 @@
1224 +/*
1225 + * 802_3
1226 + *
1227 + * Author:
1228 + * Chris Vitale csv@bluetail.com
1229 + *
1230 + * May 2003
1231 + *
1232 + */
1233 +
1234 +#include <linux/netfilter_bridge/ebtables.h>
1235 +#include <linux/netfilter_bridge/ebt_802_3.h>
1236 +#include <linux/module.h>
1237 +
1238 +static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
1239 + const struct net_device *out, const void *data, unsigned int datalen)
1240 +{
1241 + struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
1242 + struct ebt_802_3_hdr *hdr = (struct ebt_802_3_hdr *)skb->mac.ethernet;
1243 + uint16_t type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
1244 +
1245 + if (info->bitmask & EBT_802_3_SAP) {
1246 + if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP))
1247 + return EBT_NOMATCH;
1248 + if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
1249 + return EBT_NOMATCH;
1250 + }
1251 +
1252 + if (info->bitmask & EBT_802_3_TYPE) {
1253 + if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
1254 + return EBT_NOMATCH;
1255 + if (FWINV(info->type != type, EBT_802_3_TYPE))
1256 + return EBT_NOMATCH;
1257 + }
1258 +
1259 + return EBT_MATCH;
1260 +}
1261 +
1262 +static struct ebt_match filter_802_3;
1263 +static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
1264 + const struct ebt_entry *e, void *data, unsigned int datalen)
1265 +{
1266 + struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
1267 +
1268 + if (datalen != EBT_ALIGN(sizeof(struct ebt_802_3_info)))
1269 + return -EINVAL;
1270 + if (info->bitmask & ~EBT_802_3_MASK || info->invflags & ~EBT_802_3_MASK)
1271 + return -EINVAL;
1272 +
1273 + return 0;
1274 +}
1275 +
1276 +static struct ebt_match filter_802_3 =
1277 +{
1278 + .name = EBT_802_3_MATCH,
1279 + .match = ebt_filter_802_3,
1280 + .check = ebt_802_3_check,
1281 + .me = THIS_MODULE,
1282 +};
1283 +
1284 +static int __init init(void)
1285 +{
1286 + return ebt_register_match(&filter_802_3);
1287 +}
1288 +
1289 +static void __exit fini(void)
1290 +{
1291 + ebt_unregister_match(&filter_802_3);
1292 +}
1293 +
1294 +module_init(init);
1295 +module_exit(fini);
1296 +EXPORT_NO_SYMBOLS;
1297 +MODULE_LICENSE("GPL");
1298 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1299 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_mark.c 2005-09-15 16:57:23.000000000 +0000
1300 @@ -0,0 +1,66 @@
1301 +/*
1302 + * ebt_mark
1303 + *
1304 + * Authors:
1305 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1306 + *
1307 + * July, 2002
1308 + *
1309 + */
1310 +
1311 +// The mark target can be used in any chain
1312 +// I believe adding a mangle table just for marking is total overkill
1313 +// Marking a frame doesn't really change anything in the frame anyway
1314 +
1315 +#include <linux/netfilter_bridge/ebtables.h>
1316 +#include <linux/netfilter_bridge/ebt_mark_t.h>
1317 +#include <linux/module.h>
1318 +
1319 +static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
1320 + const struct net_device *in, const struct net_device *out,
1321 + const void *data, unsigned int datalen)
1322 +{
1323 + struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
1324 +
1325 + if ((*pskb)->nfmark != info->mark) {
1326 + (*pskb)->nfmark = info->mark;
1327 + (*pskb)->nfcache |= NFC_ALTERED;
1328 + }
1329 + return info->target;
1330 +}
1331 +
1332 +static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
1333 + const struct ebt_entry *e, void *data, unsigned int datalen)
1334 +{
1335 + struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
1336 +
1337 + if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
1338 + return -EINVAL;
1339 + if (BASE_CHAIN && info->target == EBT_RETURN)
1340 + return -EINVAL;
1341 + CLEAR_BASE_CHAIN_BIT;
1342 + if (INVALID_TARGET)
1343 + return -EINVAL;
1344 + return 0;
1345 +}
1346 +
1347 +static struct ebt_target mark_target =
1348 +{
1349 + {NULL, NULL}, EBT_MARK_TARGET, ebt_target_mark,
1350 + ebt_target_mark_check, NULL, THIS_MODULE
1351 +};
1352 +
1353 +static int __init init(void)
1354 +{
1355 + return ebt_register_target(&mark_target);
1356 +}
1357 +
1358 +static void __exit fini(void)
1359 +{
1360 + ebt_unregister_target(&mark_target);
1361 +}
1362 +
1363 +module_init(init);
1364 +module_exit(fini);
1365 +EXPORT_NO_SYMBOLS;
1366 +MODULE_LICENSE("GPL");
1367 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1368 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_mark_m.c 2005-09-15 16:57:23.000000000 +0000
1369 @@ -0,0 +1,61 @@
1370 +/*
1371 + * ebt_mark_m
1372 + *
1373 + * Authors:
1374 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1375 + *
1376 + * July, 2002
1377 + *
1378 + */
1379 +
1380 +#include <linux/netfilter_bridge/ebtables.h>
1381 +#include <linux/netfilter_bridge/ebt_mark_m.h>
1382 +#include <linux/module.h>
1383 +
1384 +static int ebt_filter_mark(const struct sk_buff *skb,
1385 + const struct net_device *in, const struct net_device *out, const void *data,
1386 + unsigned int datalen)
1387 +{
1388 + struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
1389 +
1390 + if (info->bitmask & EBT_MARK_OR)
1391 + return !(!!(skb->nfmark & info->mask) ^ info->invert);
1392 + return !(((skb->nfmark & info->mask) == info->mark) ^ info->invert);
1393 +}
1394 +
1395 +static int ebt_mark_check(const char *tablename, unsigned int hookmask,
1396 + const struct ebt_entry *e, void *data, unsigned int datalen)
1397 +{
1398 + struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
1399 +
1400 + if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
1401 + return -EINVAL;
1402 + if (info->bitmask & ~EBT_MARK_MASK)
1403 + return -EINVAL;
1404 + if ((info->bitmask & EBT_MARK_OR) && (info->bitmask & EBT_MARK_AND))
1405 + return -EINVAL;
1406 + if (!info->bitmask)
1407 + return -EINVAL;
1408 + return 0;
1409 +}
1410 +
1411 +static struct ebt_match filter_mark =
1412 +{
1413 + {NULL, NULL}, EBT_MARK_MATCH, ebt_filter_mark, ebt_mark_check, NULL,
1414 + THIS_MODULE
1415 +};
1416 +
1417 +static int __init init(void)
1418 +{
1419 + return ebt_register_match(&filter_mark);
1420 +}
1421 +
1422 +static void __exit fini(void)
1423 +{
1424 + ebt_unregister_match(&filter_mark);
1425 +}
1426 +
1427 +module_init(init);
1428 +module_exit(fini);
1429 +EXPORT_NO_SYMBOLS;
1430 +MODULE_LICENSE("GPL");
1431 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1432 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_pkttype.c 2005-09-15 16:57:23.000000000 +0000
1433 @@ -0,0 +1,60 @@
1434 +/*
1435 + * ebt_pkttype
1436 + *
1437 + * Authors:
1438 + * Bart De Schuymer <bdschuym@pandora.be>
1439 + *
1440 + * April, 2003
1441 + *
1442 + */
1443 +
1444 +#include <linux/netfilter_bridge/ebtables.h>
1445 +#include <linux/netfilter_bridge/ebt_pkttype.h>
1446 +#include <linux/module.h>
1447 +
1448 +static int ebt_filter_pkttype(const struct sk_buff *skb,
1449 + const struct net_device *in,
1450 + const struct net_device *out,
1451 + const void *data,
1452 + unsigned int datalen)
1453 +{
1454 + struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
1455 +
1456 + return (skb->pkt_type != info->pkt_type) ^ info->invert;
1457 +}
1458 +
1459 +static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
1460 + const struct ebt_entry *e, void *data, unsigned int datalen)
1461 +{
1462 + struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
1463 +
1464 + if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
1465 + return -EINVAL;
1466 + if (info->invert != 0 && info->invert != 1)
1467 + return -EINVAL;
1468 + /* Allow any pkt_type value */
1469 + return 0;
1470 +}
1471 +
1472 +static struct ebt_match filter_pkttype =
1473 +{
1474 + .name = EBT_PKTTYPE_MATCH,
1475 + .match = ebt_filter_pkttype,
1476 + .check = ebt_pkttype_check,
1477 + .me = THIS_MODULE,
1478 +};
1479 +
1480 +static int __init init(void)
1481 +{
1482 + return ebt_register_match(&filter_pkttype);
1483 +}
1484 +
1485 +static void __exit fini(void)
1486 +{
1487 + ebt_unregister_match(&filter_pkttype);
1488 +}
1489 +
1490 +module_init(init);
1491 +module_exit(fini);
1492 +EXPORT_NO_SYMBOLS;
1493 +MODULE_LICENSE("GPL");
1494 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1495 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_stp.c 2005-09-15 16:57:23.000000000 +0000
1496 @@ -0,0 +1,191 @@
1497 +/*
1498 + * ebt_stp
1499 + *
1500 + * Authors:
1501 + * Bart De Schuymer <bdschuym@pandora.be>
1502 + * Stephen Hemminger <shemminger@osdl.org>
1503 + *
1504 + * June, 2003
1505 + */
1506 +
1507 +#include <linux/netfilter_bridge/ebtables.h>
1508 +#include <linux/netfilter_bridge/ebt_stp.h>
1509 +#include <linux/module.h>
1510 +
1511 +#define BPDU_TYPE_CONFIG 0
1512 +#define BPDU_TYPE_TCN 0x80
1513 +
1514 +struct stp_header {
1515 + uint8_t dsap;
1516 + uint8_t ssap;
1517 + uint8_t ctrl;
1518 + uint8_t pid;
1519 + uint8_t vers;
1520 + uint8_t type;
1521 +};
1522 +
1523 +struct stp_config_pdu {
1524 + uint8_t flags;
1525 + uint8_t root[8];
1526 + uint8_t root_cost[4];
1527 + uint8_t sender[8];
1528 + uint8_t port[2];
1529 + uint8_t msg_age[2];
1530 + uint8_t max_age[2];
1531 + uint8_t hello_time[2];
1532 + uint8_t forward_delay[2];
1533 +};
1534 +
1535 +#define NR16(p) (p[0] << 8 | p[1])
1536 +#define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
1537 +
1538 +static int ebt_filter_config(struct ebt_stp_info *info,
1539 + struct stp_config_pdu *stpc)
1540 +{
1541 + struct ebt_stp_config_info *c;
1542 + uint16_t v16;
1543 + uint32_t v32;
1544 + int verdict, i;
1545 +
1546 + c = &info->config;
1547 + if ((info->bitmask & EBT_STP_FLAGS) &&
1548 + FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
1549 + return EBT_NOMATCH;
1550 + if (info->bitmask & EBT_STP_ROOTPRIO) {
1551 + v16 = NR16(stpc->root);
1552 + if (FWINV(v16 < c->root_priol ||
1553 + v16 > c->root_priou, EBT_STP_ROOTPRIO))
1554 + return EBT_NOMATCH;
1555 + }
1556 + if (info->bitmask & EBT_STP_ROOTADDR) {
1557 + verdict = 0;
1558 + for (i = 0; i < 6; i++)
1559 + verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
1560 + c->root_addrmsk[i];
1561 + if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
1562 + return EBT_NOMATCH;
1563 + }
1564 + if (info->bitmask & EBT_STP_ROOTCOST) {
1565 + v32 = NR32(stpc->root_cost);
1566 + if (FWINV(v32 < c->root_costl ||
1567 + v32 > c->root_costu, EBT_STP_ROOTCOST))
1568 + return EBT_NOMATCH;
1569 + }
1570 + if (info->bitmask & EBT_STP_SENDERPRIO) {
1571 + v16 = NR16(stpc->sender);
1572 + if (FWINV(v16 < c->sender_priol ||
1573 + v16 > c->sender_priou, EBT_STP_SENDERPRIO))
1574 + return EBT_NOMATCH;
1575 + }
1576 + if (info->bitmask & EBT_STP_SENDERADDR) {
1577 + verdict = 0;
1578 + for (i = 0; i < 6; i++)
1579 + verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
1580 + c->sender_addrmsk[i];
1581 + if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
1582 + return EBT_NOMATCH;
1583 + }
1584 + if (info->bitmask & EBT_STP_PORT) {
1585 + v16 = NR16(stpc->port);
1586 + if (FWINV(v16 < c->portl ||
1587 + v16 > c->portu, EBT_STP_PORT))
1588 + return EBT_NOMATCH;
1589 + }
1590 + if (info->bitmask & EBT_STP_MSGAGE) {
1591 + v16 = NR16(stpc->msg_age);
1592 + if (FWINV(v16 < c->msg_agel ||
1593 + v16 > c->msg_ageu, EBT_STP_MSGAGE))
1594 + return EBT_NOMATCH;
1595 + }
1596 + if (info->bitmask & EBT_STP_MAXAGE) {
1597 + v16 = NR16(stpc->max_age);
1598 + if (FWINV(v16 < c->max_agel ||
1599 + v16 > c->max_ageu, EBT_STP_MAXAGE))
1600 + return EBT_NOMATCH;
1601 + }
1602 + if (info->bitmask & EBT_STP_HELLOTIME) {
1603 + v16 = NR16(stpc->hello_time);
1604 + if (FWINV(v16 < c->hello_timel ||
1605 + v16 > c->hello_timeu, EBT_STP_HELLOTIME))
1606 + return EBT_NOMATCH;
1607 + }
1608 + if (info->bitmask & EBT_STP_FWDD) {
1609 + v16 = NR16(stpc->forward_delay);
1610 + if (FWINV(v16 < c->forward_delayl ||
1611 + v16 > c->forward_delayu, EBT_STP_FWDD))
1612 + return EBT_NOMATCH;
1613 + }
1614 + return EBT_MATCH;
1615 +}
1616 +
1617 +static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
1618 + const struct net_device *out, const void *data, unsigned int datalen)
1619 +{
1620 + struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1621 + struct stp_header stph;
1622 + uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
1623 + if (skb_copy_bits(skb, 0, &stph, sizeof(stph)))
1624 + return EBT_NOMATCH;
1625 +
1626 + /* The stp code only considers these */
1627 + if (memcmp(&stph, header, sizeof(header)))
1628 + return EBT_NOMATCH;
1629 +
1630 + if (info->bitmask & EBT_STP_TYPE
1631 + && FWINV(info->type != stph.type, EBT_STP_TYPE))
1632 + return EBT_NOMATCH;
1633 +
1634 + if (stph.type == BPDU_TYPE_CONFIG &&
1635 + info->bitmask & EBT_STP_CONFIG_MASK) {
1636 + struct stp_config_pdu stpc;
1637 +
1638 + if (skb_copy_bits(skb, sizeof(stph), &stpc, sizeof(stpc)))
1639 + return EBT_NOMATCH;
1640 + return ebt_filter_config(info, &stpc);
1641 + }
1642 + return EBT_MATCH;
1643 +}
1644 +
1645 +static int ebt_stp_check(const char *tablename, unsigned int hookmask,
1646 + const struct ebt_entry *e, void *data, unsigned int datalen)
1647 +{
1648 + struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1649 + int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
1650 + uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
1651 + uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1652 +
1653 + if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
1654 + !(info->bitmask & EBT_STP_MASK))
1655 + return -EINVAL;
1656 + if (datalen != len)
1657 + return -EINVAL;
1658 + /* Make sure the match only receives stp frames */
1659 + if (memcmp(e->destmac, bridge_ula, ETH_ALEN) ||
1660 + memcmp(e->destmsk, msk, ETH_ALEN) || !(e->bitmask & EBT_DESTMAC))
1661 + return -EINVAL;
1662 +
1663 + return 0;
1664 +}
1665 +
1666 +static struct ebt_match filter_stp =
1667 +{
1668 + .name = EBT_STP_MATCH,
1669 + .match = ebt_filter_stp,
1670 + .check = ebt_stp_check,
1671 + .me = THIS_MODULE,
1672 +};
1673 +
1674 +static int __init init(void)
1675 +{
1676 + return ebt_register_match(&filter_stp);
1677 +}
1678 +
1679 +static void __exit fini(void)
1680 +{
1681 + ebt_unregister_match(&filter_stp);
1682 +}
1683 +
1684 +module_init(init);
1685 +module_exit(fini);
1686 +EXPORT_NO_SYMBOLS;
1687 +MODULE_LICENSE("GPL");
1688 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1689 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_redirect.c 2005-09-15 16:57:23.000000000 +0000
1690 @@ -0,0 +1,71 @@
1691 +/*
1692 + * ebt_redirect
1693 + *
1694 + * Authors:
1695 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1696 + *
1697 + * April, 2002
1698 + *
1699 + */
1700 +
1701 +#include <linux/netfilter_bridge/ebtables.h>
1702 +#include <linux/netfilter_bridge/ebt_redirect.h>
1703 +#include <linux/module.h>
1704 +#include <net/sock.h>
1705 +#include "../br_private.h"
1706 +
1707 +static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
1708 + const struct net_device *in, const struct net_device *out,
1709 + const void *data, unsigned int datalen)
1710 +{
1711 + struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1712 +
1713 + if (hooknr != NF_BR_BROUTING)
1714 + memcpy((**pskb).mac.ethernet->h_dest,
1715 + in->br_port->br->dev.dev_addr, ETH_ALEN);
1716 + else {
1717 + memcpy((**pskb).mac.ethernet->h_dest,
1718 + in->dev_addr, ETH_ALEN);
1719 + (*pskb)->pkt_type = PACKET_HOST;
1720 + }
1721 + return info->target;
1722 +}
1723 +
1724 +static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
1725 + const struct ebt_entry *e, void *data, unsigned int datalen)
1726 +{
1727 + struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1728 +
1729 + if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
1730 + return -EINVAL;
1731 + if (BASE_CHAIN && info->target == EBT_RETURN)
1732 + return -EINVAL;
1733 + CLEAR_BASE_CHAIN_BIT;
1734 + if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
1735 + (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
1736 + return -EINVAL;
1737 + if (INVALID_TARGET)
1738 + return -EINVAL;
1739 + return 0;
1740 +}
1741 +
1742 +static struct ebt_target redirect_target =
1743 +{
1744 + {NULL, NULL}, EBT_REDIRECT_TARGET, ebt_target_redirect,
1745 + ebt_target_redirect_check, NULL, THIS_MODULE
1746 +};
1747 +
1748 +static int __init init(void)
1749 +{
1750 + return ebt_register_target(&redirect_target);
1751 +}
1752 +
1753 +static void __exit fini(void)
1754 +{
1755 + ebt_unregister_target(&redirect_target);
1756 +}
1757 +
1758 +module_init(init);
1759 +module_exit(fini);
1760 +EXPORT_NO_SYMBOLS;
1761 +MODULE_LICENSE("GPL");
1762 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1763 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_arp.c 2005-09-15 16:57:23.000000000 +0000
1764 @@ -0,0 +1,149 @@
1765 +/*
1766 + * ebt_arp
1767 + *
1768 + * Authors:
1769 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1770 + * Tim Gardner <timg@tpi.com>
1771 + *
1772 + * April, 2002
1773 + *
1774 + */
1775 +
1776 +#include <linux/netfilter_bridge/ebtables.h>
1777 +#include <linux/netfilter_bridge/ebt_arp.h>
1778 +#include <linux/if_arp.h>
1779 +#include <linux/if_ether.h>
1780 +#include <linux/module.h>
1781 +
1782 +static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
1783 + const struct net_device *out, const void *data, unsigned int datalen)
1784 +{
1785 + struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1786 +
1787 + if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
1788 + ((*skb).nh.arph)->ar_op, EBT_ARP_OPCODE))
1789 + return EBT_NOMATCH;
1790 + if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
1791 + ((*skb).nh.arph)->ar_hrd, EBT_ARP_HTYPE))
1792 + return EBT_NOMATCH;
1793 + if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
1794 + ((*skb).nh.arph)->ar_pro, EBT_ARP_PTYPE))
1795 + return EBT_NOMATCH;
1796 +
1797 + if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP))
1798 + {
1799 + uint32_t arp_len = sizeof(struct arphdr) +
1800 + (2 * (((*skb).nh.arph)->ar_hln)) +
1801 + (2 * (((*skb).nh.arph)->ar_pln));
1802 + uint32_t dst;
1803 + uint32_t src;
1804 +
1805 + // Make sure the packet is long enough.
1806 + if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1807 + return EBT_NOMATCH;
1808 + // IPv4 addresses are always 4 bytes.
1809 + if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
1810 + return EBT_NOMATCH;
1811 +
1812 + if (info->bitmask & EBT_ARP_SRC_IP) {
1813 + memcpy(&src, ((*skb).nh.raw) + sizeof(struct arphdr) +
1814 + ((*skb).nh.arph)->ar_hln, sizeof(uint32_t));
1815 + if (FWINV(info->saddr != (src & info->smsk),
1816 + EBT_ARP_SRC_IP))
1817 + return EBT_NOMATCH;
1818 + }
1819 +
1820 + if (info->bitmask & EBT_ARP_DST_IP) {
1821 + memcpy(&dst, ((*skb).nh.raw)+sizeof(struct arphdr) +
1822 + (2*(((*skb).nh.arph)->ar_hln)) +
1823 + (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
1824 + if (FWINV(info->daddr != (dst & info->dmsk),
1825 + EBT_ARP_DST_IP))
1826 + return EBT_NOMATCH;
1827 + }
1828 + }
1829 +
1830 + if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC))
1831 + {
1832 + uint32_t arp_len = sizeof(struct arphdr) +
1833 + (2 * (((*skb).nh.arph)->ar_hln)) +
1834 + (2 * (((*skb).nh.arph)->ar_pln));
1835 + unsigned char dst[ETH_ALEN];
1836 + unsigned char src[ETH_ALEN];
1837 +
1838 + // Make sure the packet is long enough.
1839 + if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1840 + return EBT_NOMATCH;
1841 + // MAC addresses are 6 bytes.
1842 + if (((*skb).nh.arph)->ar_hln != ETH_ALEN)
1843 + return EBT_NOMATCH;
1844 + if (info->bitmask & EBT_ARP_SRC_MAC) {
1845 + uint8_t verdict, i;
1846 +
1847 + memcpy(&src, ((*skb).nh.raw) +
1848 + sizeof(struct arphdr),
1849 + ETH_ALEN);
1850 + verdict = 0;
1851 + for (i = 0; i < 6; i++)
1852 + verdict |= (src[i] ^ info->smaddr[i]) &
1853 + info->smmsk[i];
1854 + if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
1855 + return EBT_NOMATCH;
1856 + }
1857 +
1858 + if (info->bitmask & EBT_ARP_DST_MAC) {
1859 + uint8_t verdict, i;
1860 +
1861 + memcpy(&dst, ((*skb).nh.raw) +
1862 + sizeof(struct arphdr) +
1863 + (((*skb).nh.arph)->ar_hln) +
1864 + (((*skb).nh.arph)->ar_pln),
1865 + ETH_ALEN);
1866 + verdict = 0;
1867 + for (i = 0; i < 6; i++)
1868 + verdict |= (dst[i] ^ info->dmaddr[i]) &
1869 + info->dmmsk[i];
1870 + if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
1871 + return EBT_NOMATCH;
1872 + }
1873 + }
1874 +
1875 + return EBT_MATCH;
1876 +}
1877 +
1878 +static int ebt_arp_check(const char *tablename, unsigned int hookmask,
1879 + const struct ebt_entry *e, void *data, unsigned int datalen)
1880 +{
1881 + struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1882 +
1883 + if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
1884 + return -EINVAL;
1885 + if ((e->ethproto != __constant_htons(ETH_P_ARP) &&
1886 + e->ethproto != __constant_htons(ETH_P_RARP)) ||
1887 + e->invflags & EBT_IPROTO)
1888 + return -EINVAL;
1889 + if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
1890 + return -EINVAL;
1891 + return 0;
1892 +}
1893 +
1894 +static struct ebt_match filter_arp =
1895 +{
1896 + {NULL, NULL}, EBT_ARP_MATCH, ebt_filter_arp, ebt_arp_check, NULL,
1897 + THIS_MODULE
1898 +};
1899 +
1900 +static int __init init(void)
1901 +{
1902 + return ebt_register_match(&filter_arp);
1903 +}
1904 +
1905 +static void __exit fini(void)
1906 +{
1907 + ebt_unregister_match(&filter_arp);
1908 +}
1909 +
1910 +module_init(init);
1911 +module_exit(fini);
1912 +EXPORT_NO_SYMBOLS;
1913 +MODULE_LICENSE("GPL");
1914 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
1915 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_ip.c 2005-09-15 16:57:23.000000000 +0000
1916 @@ -0,0 +1,121 @@
1917 +/*
1918 + * ebt_ip
1919 + *
1920 + * Authors:
1921 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
1922 + *
1923 + * April, 2002
1924 + *
1925 + * Changes:
1926 + * added ip-sport and ip-dport
1927 + * Innominate Security Technologies AG <mhopf@innominate.com>
1928 + * September, 2002
1929 + */
1930 +
1931 +#include <linux/netfilter_bridge/ebtables.h>
1932 +#include <linux/netfilter_bridge/ebt_ip.h>
1933 +#include <linux/ip.h>
1934 +#include <linux/in.h>
1935 +#include <linux/module.h>
1936 +
1937 +struct tcpudphdr {
1938 + uint16_t src;
1939 + uint16_t dst;
1940 +};
1941 +
1942 +union h_u {
1943 + unsigned char *raw;
1944 + struct tcpudphdr *tuh;
1945 +};
1946 +
1947 +static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
1948 + const struct net_device *out, const void *data,
1949 + unsigned int datalen)
1950 +{
1951 + struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1952 +
1953 + if (info->bitmask & EBT_IP_TOS &&
1954 + FWINV(info->tos != ((*skb).nh.iph)->tos, EBT_IP_TOS))
1955 + return EBT_NOMATCH;
1956 + if (info->bitmask & EBT_IP_PROTO) {
1957 + if (FWINV(info->protocol != ((*skb).nh.iph)->protocol,
1958 + EBT_IP_PROTO))
1959 + return EBT_NOMATCH;
1960 + if ( info->protocol == IPPROTO_TCP ||
1961 + info->protocol == IPPROTO_UDP )
1962 + {
1963 + union h_u h;
1964 + h.raw = skb->data + skb->nh.iph->ihl*4;
1965 + if (info->bitmask & EBT_IP_DPORT) {
1966 + uint16_t port = ntohs(h.tuh->dst);
1967 + if (FWINV(port < info->dport[0] ||
1968 + port > info->dport[1],
1969 + EBT_IP_DPORT))
1970 + return EBT_NOMATCH;
1971 + }
1972 + if (info->bitmask & EBT_IP_SPORT) {
1973 + uint16_t port = ntohs(h.tuh->src);
1974 + if (FWINV(port < info->sport[0] ||
1975 + port > info->sport[1],
1976 + EBT_IP_SPORT))
1977 + return EBT_NOMATCH;
1978 + }
1979 + }
1980 + }
1981 + if (info->bitmask & EBT_IP_SOURCE &&
1982 + FWINV((((*skb).nh.iph)->saddr & info->smsk) !=
1983 + info->saddr, EBT_IP_SOURCE))
1984 + return EBT_NOMATCH;
1985 + if ((info->bitmask & EBT_IP_DEST) &&
1986 + FWINV((((*skb).nh.iph)->daddr & info->dmsk) !=
1987 + info->daddr, EBT_IP_DEST))
1988 + return EBT_NOMATCH;
1989 + return EBT_MATCH;
1990 +}
1991 +
1992 +static int ebt_ip_check(const char *tablename, unsigned int hookmask,
1993 + const struct ebt_entry *e, void *data, unsigned int datalen)
1994 +{
1995 + struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1996 +
1997 + if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
1998 + return -EINVAL;
1999 + if (e->ethproto != __constant_htons(ETH_P_IP) ||
2000 + e->invflags & EBT_IPROTO)
2001 + return -EINVAL;
2002 + if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
2003 + return -EINVAL;
2004 + if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
2005 + if (!info->bitmask & EBT_IPROTO)
2006 + return -EINVAL;
2007 + if (info->protocol != IPPROTO_TCP &&
2008 + info->protocol != IPPROTO_UDP)
2009 + return -EINVAL;
2010 + }
2011 + if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
2012 + return -EINVAL;
2013 + if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
2014 + return -EINVAL;
2015 + return 0;
2016 +}
2017 +
2018 +static struct ebt_match filter_ip =
2019 +{
2020 + {NULL, NULL}, EBT_IP_MATCH, ebt_filter_ip, ebt_ip_check, NULL,
2021 + THIS_MODULE
2022 +};
2023 +
2024 +static int __init init(void)
2025 +{
2026 + return ebt_register_match(&filter_ip);
2027 +}
2028 +
2029 +static void __exit fini(void)
2030 +{
2031 + ebt_unregister_match(&filter_ip);
2032 +}
2033 +
2034 +module_init(init);
2035 +module_exit(fini);
2036 +EXPORT_NO_SYMBOLS;
2037 +MODULE_LICENSE("GPL");
2038 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
2039 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_vlan.c 2005-09-15 16:57:23.000000000 +0000
2040 @@ -0,0 +1,259 @@
2041 +/*
2042 + * Description: EBTables 802.1Q match extension kernelspace module.
2043 + * Authors: Nick Fedchik <nick@fedchik.org.ua>
2044 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2045 + *
2046 + * This program is free software; you can redistribute it and/or modify
2047 + * it under the terms of the GNU General Public License as published by
2048 + * the Free Software Foundation; either version 2 of the License, or
2049 + * (at your option) any later version.
2050 + *
2051 + * This program is distributed in the hope that it will be useful,
2052 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
2053 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
2054 + * GNU General Public License for more details.
2055 + *
2056 + * You should have received a copy of the GNU General Public License
2057 + * along with this program; if not, write to the Free Software
2058 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
2059 + */
2060 +
2061 +#include <linux/if_ether.h>
2062 +#include <linux/if_vlan.h>
2063 +#include <linux/module.h>
2064 +#include <linux/netfilter_bridge/ebtables.h>
2065 +#include <linux/netfilter_bridge/ebt_vlan.h>
2066 +
2067 +static unsigned char debug;
2068 +#define MODULE_VERSION "0.6"
2069 +
2070 +MODULE_PARM(debug, "0-1b");
2071 +MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
2072 +MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
2073 +MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
2074 + MODULE_VERSION);
2075 +MODULE_LICENSE("GPL");
2076 +
2077 +
2078 +#define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
2079 +#define INV_FLAG(_inv_flag_) (info->invflags & _inv_flag_) ? "!" : ""
2080 +#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
2081 +#define SET_BITMASK(_BIT_MASK_) info->bitmask |= _BIT_MASK_
2082 +#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return 1;
2083 +
2084 +/*
2085 + * Function description: ebt_filter_vlan() is main engine for
2086 + * checking passed 802.1Q frame according to
2087 + * the passed extension parameters (in the *data buffer)
2088 + * ebt_filter_vlan() is called after successfull check the rule params
2089 + * by ebt_check_vlan() function.
2090 + * Parameters:
2091 + * const struct sk_buff *skb - pointer to passed ethernet frame buffer
2092 + * const void *data - pointer to passed extension parameters
2093 + * unsigned int datalen - length of passed *data buffer
2094 + * const struct net_device *in -
2095 + * const struct net_device *out -
2096 + * const struct ebt_counter *c -
2097 + * Returned values:
2098 + * 0 - ok (all rule params matched)
2099 + * 1 - miss (rule params not acceptable to the parsed frame)
2100 + */
2101 +static int
2102 +ebt_filter_vlan(const struct sk_buff *skb,
2103 + const struct net_device *in,
2104 + const struct net_device *out,
2105 + const void *data, unsigned int datalen)
2106 +{
2107 + struct ebt_vlan_info *info = (struct ebt_vlan_info *) data; /* userspace data */
2108 + struct vlan_ethhdr *frame = (struct vlan_ethhdr *) skb->mac.raw; /* Passed tagged frame */
2109 +
2110 + unsigned short TCI; /* Whole TCI, given from parsed frame */
2111 + unsigned short id; /* VLAN ID, given from frame TCI */
2112 + unsigned char prio; /* user_priority, given from frame TCI */
2113 + unsigned short encap; /* VLAN encapsulated Type/Length field, given from orig frame */
2114 +
2115 + /*
2116 + * Tag Control Information (TCI) consists of the following elements:
2117 + * - User_priority. The user_priority field is three bits in length,
2118 + * interpreted as a binary number.
2119 + * - Canonical Format Indicator (CFI). The Canonical Format Indicator
2120 + * (CFI) is a single bit flag value. Currently ignored.
2121 + * - VLAN Identifier (VID). The VID is encoded as
2122 + * an unsigned binary number.
2123 + */
2124 + TCI = ntohs(frame->h_vlan_TCI);
2125 + id = TCI & VLAN_VID_MASK;
2126 + prio = (TCI >> 13) & 0x7;
2127 + encap = frame->h_vlan_encapsulated_proto;
2128 +
2129 + /*
2130 + * Checking VLAN Identifier (VID)
2131 + */
2132 + if (GET_BITMASK(EBT_VLAN_ID)) { /* Is VLAN ID parsed? */
2133 + EXIT_ON_MISMATCH(id, EBT_VLAN_ID);
2134 + }
2135 + /*
2136 + * Checking user_priority
2137 + */
2138 + if (GET_BITMASK(EBT_VLAN_PRIO)) { /* Is VLAN user_priority parsed? */
2139 + EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO);
2140 + }
2141 + /*
2142 + * Checking Encapsulated Proto (Length/Type) field
2143 + */
2144 + if (GET_BITMASK(EBT_VLAN_ENCAP)) { /* Is VLAN Encap parsed? */
2145 + EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
2146 + }
2147 + /*
2148 + * All possible extension parameters was parsed.
2149 + * If rule never returned by missmatch, then all ok.
2150 + */
2151 + return 0;
2152 +}
2153 +
2154 +/*
2155 + * Function description: ebt_vlan_check() is called when userspace
2156 + * delivers the table entry to the kernel,
2157 + * and to check that userspace doesn't give a bad table.
2158 + * Parameters:
2159 + * const char *tablename - table name string
2160 + * unsigned int hooknr - hook number
2161 + * const struct ebt_entry *e - ebtables entry basic set
2162 + * const void *data - pointer to passed extension parameters
2163 + * unsigned int datalen - length of passed *data buffer
2164 + * Returned values:
2165 + * 0 - ok (all delivered rule params are correct)
2166 + * 1 - miss (rule params is out of range, invalid, incompatible, etc.)
2167 + */
2168 +static int
2169 +ebt_check_vlan(const char *tablename,
2170 + unsigned int hooknr,
2171 + const struct ebt_entry *e, void *data, unsigned int datalen)
2172 +{
2173 + struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
2174 +
2175 + /*
2176 + * Parameters buffer overflow check
2177 + */
2178 + if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
2179 + DEBUG_MSG
2180 + ("passed size %d is not eq to ebt_vlan_info (%d)\n",
2181 + datalen, sizeof(struct ebt_vlan_info));
2182 + return -EINVAL;
2183 + }
2184 +
2185 + /*
2186 + * Is it 802.1Q frame checked?
2187 + */
2188 + if (e->ethproto != __constant_htons(ETH_P_8021Q)) {
2189 + DEBUG_MSG
2190 + ("passed entry proto %2.4X is not 802.1Q (8100)\n",
2191 + (unsigned short) ntohs(e->ethproto));
2192 + return -EINVAL;
2193 + }
2194 +
2195 + /*
2196 + * Check for bitmask range
2197 + * True if even one bit is out of mask
2198 + */
2199 + if (info->bitmask & ~EBT_VLAN_MASK) {
2200 + DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
2201 + info->bitmask, EBT_VLAN_MASK);
2202 + return -EINVAL;
2203 + }
2204 +
2205 + /*
2206 + * Check for inversion flags range
2207 + */
2208 + if (info->invflags & ~EBT_VLAN_MASK) {
2209 + DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
2210 + info->invflags, EBT_VLAN_MASK);
2211 + return -EINVAL;
2212 + }
2213 +
2214 + /*
2215 + * Reserved VLAN ID (VID) values
2216 + * -----------------------------
2217 + * 0 - The null VLAN ID.
2218 + * 1 - The default Port VID (PVID)
2219 + * 0x0FFF - Reserved for implementation use.
2220 + * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096.
2221 + */
2222 + if (GET_BITMASK(EBT_VLAN_ID)) { /* when vlan-id param was spec-ed */
2223 + if (!!info->id) { /* if id!=0 => check vid range */
2224 + if (info->id > VLAN_GROUP_ARRAY_LEN) {
2225 + DEBUG_MSG
2226 + ("id %d is out of range (1-4096)\n",
2227 + info->id);
2228 + return -EINVAL;
2229 + }
2230 + /*
2231 + * Note: This is valid VLAN-tagged frame point.
2232 + * Any value of user_priority are acceptable,
2233 + * but should be ignored according to 802.1Q Std.
2234 + * So we just drop the prio flag.
2235 + */
2236 + info->bitmask &= ~EBT_VLAN_PRIO;
2237 + }
2238 + /*
2239 + * Else, id=0 (null VLAN ID) => user_priority range (any?)
2240 + */
2241 + }
2242 +
2243 + if (GET_BITMASK(EBT_VLAN_PRIO)) {
2244 + if ((unsigned char) info->prio > 7) {
2245 + DEBUG_MSG
2246 + ("prio %d is out of range (0-7)\n",
2247 + info->prio);
2248 + return -EINVAL;
2249 + }
2250 + }
2251 + /*
2252 + * Check for encapsulated proto range - it is possible to be
2253 + * any value for u_short range.
2254 + * if_ether.h: ETH_ZLEN 60 - Min. octets in frame sans FCS
2255 + */
2256 + if (GET_BITMASK(EBT_VLAN_ENCAP)) {
2257 + if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) {
2258 + DEBUG_MSG
2259 + ("encap frame length %d is less than minimal\n",
2260 + ntohs(info->encap));
2261 + return -EINVAL;
2262 + }
2263 + }
2264 +
2265 + return 0;
2266 +}
2267 +
2268 +static struct ebt_match filter_vlan = {
2269 + {NULL, NULL},
2270 + EBT_VLAN_MATCH,
2271 + ebt_filter_vlan,
2272 + ebt_check_vlan,
2273 + NULL,
2274 + THIS_MODULE
2275 +};
2276 +
2277 +/*
2278 + * Module initialization function.
2279 + */
2280 +static int __init init(void)
2281 +{
2282 + DEBUG_MSG("ebtables 802.1Q extension module v"
2283 + MODULE_VERSION "\n");
2284 + DEBUG_MSG("module debug=%d\n", !!debug);
2285 + return ebt_register_match(&filter_vlan);
2286 +}
2287 +
2288 +/*
2289 + * Module "finalization" function
2290 + */
2291 +static void __exit fini(void)
2292 +{
2293 + ebt_unregister_match(&filter_vlan);
2294 +}
2295 +
2296 +module_init(init);
2297 +module_exit(fini);
2298 +
2299 +EXPORT_NO_SYMBOLS;
2300 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
2301 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_log.c 2005-09-15 16:57:23.000000000 +0000
2302 @@ -0,0 +1,153 @@
2303 +/*
2304 + * ebt_log
2305 + *
2306 + * Authors:
2307 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2308 + *
2309 + * April, 2002
2310 + *
2311 + */
2312 +
2313 +#include <linux/netfilter_bridge/ebtables.h>
2314 +#include <linux/netfilter_bridge/ebt_log.h>
2315 +#include <linux/module.h>
2316 +#include <linux/ip.h>
2317 +#include <linux/in.h>
2318 +#include <linux/if_arp.h>
2319 +#include <linux/spinlock.h>
2320 +
2321 +static spinlock_t ebt_log_lock = SPIN_LOCK_UNLOCKED;
2322 +
2323 +static int ebt_log_check(const char *tablename, unsigned int hookmask,
2324 + const struct ebt_entry *e, void *data, unsigned int datalen)
2325 +{
2326 + struct ebt_log_info *info = (struct ebt_log_info *)data;
2327 +
2328 + if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
2329 + return -EINVAL;
2330 + if (info->bitmask & ~EBT_LOG_MASK)
2331 + return -EINVAL;
2332 + if (info->loglevel >= 8)
2333 + return -EINVAL;
2334 + info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
2335 + return 0;
2336 +}
2337 +
2338 +struct tcpudphdr
2339 +{
2340 + uint16_t src;
2341 + uint16_t dst;
2342 +};
2343 +
2344 +struct arppayload
2345 +{
2346 + unsigned char mac_src[ETH_ALEN];
2347 + unsigned char ip_src[4];
2348 + unsigned char mac_dst[ETH_ALEN];
2349 + unsigned char ip_dst[4];
2350 +};
2351 +
2352 +static void print_MAC(unsigned char *p)
2353 +{
2354 + int i;
2355 +
2356 + for (i = 0; i < ETH_ALEN; i++, p++)
2357 + printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
2358 +}
2359 +
2360 +#define myNIPQUAD(a) a[0], a[1], a[2], a[3]
2361 +static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
2362 + const struct net_device *in, const struct net_device *out,
2363 + const void *data, unsigned int datalen)
2364 +{
2365 + struct ebt_log_info *info = (struct ebt_log_info *)data;
2366 + char level_string[4] = "< >";
2367 + level_string[1] = '0' + info->loglevel;
2368 +
2369 + spin_lock_bh(&ebt_log_lock);
2370 + printk(level_string);
2371 + printk("%s IN=%s OUT=%s ", info->prefix, in ? in->name : "",
2372 + out ? out->name : "");
2373 +
2374 + printk("MAC source = ");
2375 + print_MAC((skb->mac.ethernet)->h_source);
2376 + printk("MAC dest = ");
2377 + print_MAC((skb->mac.ethernet)->h_dest);
2378 +
2379 + printk("proto = 0x%04x", ntohs(((*skb).mac.ethernet)->h_proto));
2380 +
2381 + if ((info->bitmask & EBT_LOG_IP) && skb->mac.ethernet->h_proto ==
2382 + htons(ETH_P_IP)){
2383 + struct iphdr *iph = skb->nh.iph;
2384 + printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
2385 + NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
2386 + printk(" IP tos=0x%02X, IP proto=%d", iph->tos, iph->protocol);
2387 + if (iph->protocol == IPPROTO_TCP ||
2388 + iph->protocol == IPPROTO_UDP) {
2389 + struct tcpudphdr *ports = (struct tcpudphdr *)(skb->data + iph->ihl*4);
2390 +
2391 + if (skb->data + iph->ihl*4 > skb->tail) {
2392 + printk(" INCOMPLETE TCP/UDP header");
2393 + goto out;
2394 + }
2395 + printk(" SPT=%u DPT=%u", ntohs(ports->src),
2396 + ntohs(ports->dst));
2397 + }
2398 + goto out;
2399 + }
2400 +
2401 + if ((info->bitmask & EBT_LOG_ARP) &&
2402 + ((skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) ||
2403 + (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_RARP)))) {
2404 + struct arphdr * arph = skb->nh.arph;
2405 + printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
2406 + ntohs(arph->ar_hrd), ntohs(arph->ar_pro),
2407 + ntohs(arph->ar_op));
2408 + /* If it's for Ethernet and the lengths are OK,
2409 + * then log the ARP payload */
2410 + if (arph->ar_hrd == __constant_htons(1) &&
2411 + arph->ar_hln == ETH_ALEN &&
2412 + arph->ar_pln == sizeof(uint32_t)) {
2413 + struct arppayload *arpp = (struct arppayload *)(skb->data + sizeof(*arph));
2414 +
2415 + if (skb->data + sizeof(*arph) > skb->tail) {
2416 + printk(" INCOMPLETE ARP header");
2417 + goto out;
2418 + }
2419 +
2420 + printk(" ARP MAC SRC=");
2421 + print_MAC(arpp->mac_src);
2422 + printk(" ARP IP SRC=%u.%u.%u.%u",
2423 + myNIPQUAD(arpp->ip_src));
2424 + printk(" ARP MAC DST=");
2425 + print_MAC(arpp->mac_dst);
2426 + printk(" ARP IP DST=%u.%u.%u.%u",
2427 + myNIPQUAD(arpp->ip_dst));
2428 + }
2429 +
2430 + }
2431 +out:
2432 + printk("\n");
2433 + spin_unlock_bh(&ebt_log_lock);
2434 +}
2435 +
2436 +static struct ebt_watcher log =
2437 +{
2438 + {NULL, NULL}, EBT_LOG_WATCHER, ebt_log, ebt_log_check, NULL,
2439 + THIS_MODULE
2440 +};
2441 +
2442 +static int __init init(void)
2443 +{
2444 + return ebt_register_watcher(&log);
2445 +}
2446 +
2447 +static void __exit fini(void)
2448 +{
2449 + ebt_unregister_watcher(&log);
2450 +}
2451 +
2452 +module_init(init);
2453 +module_exit(fini);
2454 +EXPORT_NO_SYMBOLS;
2455 +MODULE_LICENSE("GPL");
2456 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
2457 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_ulog.c 2005-09-15 16:57:23.000000000 +0000
2458 @@ -0,0 +1,281 @@
2459 +/*
2460 + * netfilter module for userspace bridged Ethernet frames logging daemons
2461 + *
2462 + * Authors:
2463 + * Bart De Schuymer <bdschuym@pandora.be>
2464 + *
2465 + * November, 2004
2466 + *
2467 + * Based on ipt_ULOG.c, which is
2468 + * (C) 2000-2002 by Harald Welte <laforge@netfilter.org>
2469 + *
2470 + * This module accepts two parameters:
2471 + *
2472 + * nlbufsiz:
2473 + * The parameter specifies how big the buffer for each netlink multicast
2474 + * group is. e.g. If you say nlbufsiz=8192, up to eight kb of packets will
2475 + * get accumulated in the kernel until they are sent to userspace. It is
2476 + * NOT possible to allocate more than 128kB, and it is strongly discouraged,
2477 + * because atomically allocating 128kB inside the network rx softirq is not
2478 + * reliable. Please also keep in mind that this buffer size is allocated for
2479 + * each nlgroup you are using, so the total kernel memory usage increases
2480 + * by that factor.
2481 + *
2482 + * flushtimeout:
2483 + * Specify, after how many hundredths of a second the queue should be
2484 + * flushed even if it is not full yet.
2485 + *
2486 + */
2487 +
2488 +#include <linux/module.h>
2489 +#include <linux/config.h>
2490 +#include <linux/spinlock.h>
2491 +#include <linux/socket.h>
2492 +#include <linux/skbuff.h>
2493 +#include <linux/kernel.h>
2494 +#include <linux/timer.h>
2495 +#include <linux/netlink.h>
2496 +#include <linux/netdevice.h>
2497 +#include <linux/module.h>
2498 +#include <linux/netfilter_bridge/ebtables.h>
2499 +#include <linux/netfilter_bridge/ebt_ulog.h>
2500 +#include <net/sock.h>
2501 +#include "../br_private.h"
2502 +
2503 +#define PRINTR(format, args...) do { if (net_ratelimit()) \
2504 + printk(format , ## args); } while (0)
2505 +
2506 +static unsigned int nlbufsiz = 4096;
2507 +MODULE_PARM(nlbufsiz, "i");
2508 +MODULE_PARM_DESC(nlbufsiz, "netlink buffer size (number of bytes) "
2509 + "(defaults to 4096)");
2510 +
2511 +static unsigned int flushtimeout = 10;
2512 +MODULE_PARM(flushtimeout, "i");
2513 +MODULE_PARM_DESC(flushtimeout, "buffer flush timeout (hundredths of a second) "
2514 + "(defaults to 10)");
2515 +
2516 +typedef struct {
2517 + unsigned int qlen; /* number of nlmsgs' in the skb */
2518 + struct nlmsghdr *lastnlh; /* netlink header of last msg in skb */
2519 + struct sk_buff *skb; /* the pre-allocated skb */
2520 + struct timer_list timer; /* the timer function */
2521 + spinlock_t lock; /* the per-queue lock */
2522 +} ebt_ulog_buff_t;
2523 +
2524 +static ebt_ulog_buff_t ulog_buffers[EBT_ULOG_MAXNLGROUPS];
2525 +static struct sock *ebtlognl;
2526 +
2527 +/* send one ulog_buff_t to userspace */
2528 +static void ulog_send(unsigned int nlgroup)
2529 +{
2530 + ebt_ulog_buff_t *ub = &ulog_buffers[nlgroup];
2531 +
2532 + if (timer_pending(&ub->timer))
2533 + del_timer(&ub->timer);
2534 +
2535 + /* last nlmsg needs NLMSG_DONE */
2536 + if (ub->qlen > 1)
2537 + ub->lastnlh->nlmsg_type = NLMSG_DONE;
2538 +
2539 + NETLINK_CB(ub->skb).dst_groups = 1 << nlgroup;
2540 + netlink_broadcast(ebtlognl, ub->skb, 0, 1 << nlgroup, GFP_ATOMIC);
2541 +
2542 + ub->qlen = 0;
2543 + ub->skb = NULL;
2544 +}
2545 +
2546 +/* timer function to flush queue in flushtimeout time */
2547 +static void ulog_timer(unsigned long data)
2548 +{
2549 + spin_lock_bh(&ulog_buffers[data].lock);
2550 + if (ulog_buffers[data].skb)
2551 + ulog_send(data);
2552 + spin_unlock_bh(&ulog_buffers[data].lock);
2553 +}
2554 +
2555 +static struct sk_buff *ulog_alloc_skb(unsigned int size)
2556 +{
2557 + struct sk_buff *skb;
2558 +
2559 + skb = alloc_skb(nlbufsiz, GFP_ATOMIC);
2560 + if (!skb) {
2561 + PRINTR(KERN_ERR "ebt_ulog: can't alloc whole buffer "
2562 + "of size %ub!\n", nlbufsiz);
2563 + if (size < nlbufsiz) {
2564 + /* try to allocate only as much as we need for
2565 + * current packet */
2566 + skb = alloc_skb(size, GFP_ATOMIC);
2567 + if (!skb)
2568 + PRINTR(KERN_ERR "ebt_ulog: can't even allocate "
2569 + "buffer of size %ub\n", size);
2570 + }
2571 + }
2572 +
2573 + return skb;
2574 +}
2575 +
2576 +static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
2577 + const struct net_device *in, const struct net_device *out,
2578 + const void *data, unsigned int datalen)
2579 +{
2580 + ebt_ulog_packet_msg_t *pm;
2581 + size_t size, copy_len;
2582 + struct nlmsghdr *nlh;
2583 + struct ebt_ulog_info *loginfo = (struct ebt_ulog_info *)data;
2584 + unsigned int group = loginfo->nlgroup;
2585 + ebt_ulog_buff_t *ub = &ulog_buffers[group];
2586 + spinlock_t *lock = &ub->lock;
2587 +
2588 + if ((loginfo->cprange == 0) ||
2589 + (loginfo->cprange > skb->len + ETH_HLEN))
2590 + copy_len = skb->len + ETH_HLEN;
2591 + else
2592 + copy_len = loginfo->cprange;
2593 +
2594 + size = NLMSG_SPACE(sizeof(*pm) + copy_len);
2595 +
2596 + spin_lock_bh(lock);
2597 +
2598 + if (!ub->skb) {
2599 + if (!(ub->skb = ulog_alloc_skb(size)))
2600 + goto alloc_failure;
2601 + } else if (size > skb_tailroom(ub->skb)) {
2602 + ulog_send(group);
2603 +
2604 + if (!(ub->skb = ulog_alloc_skb(size)))
2605 + goto alloc_failure;
2606 + }
2607 +
2608 + nlh = NLMSG_PUT(ub->skb, 0, ub->qlen, 0,
2609 + size - NLMSG_ALIGN(sizeof(*nlh)));
2610 + ub->qlen++;
2611 +
2612 + pm = NLMSG_DATA(nlh);
2613 +
2614 + /* Fill in the ulog data */
2615 + do_gettimeofday(&pm->stamp);
2616 + if (ub->qlen == 1)
2617 + ub->skb->stamp = pm->stamp;
2618 + pm->data_len = copy_len;
2619 + pm->mark = skb->nfmark;
2620 + pm->hook = hooknr;
2621 + if (loginfo->prefix != NULL)
2622 + strcpy(pm->prefix, loginfo->prefix);
2623 + else
2624 + *(pm->prefix) = '\0';
2625 +
2626 + if (in) {
2627 + strcpy(pm->physindev, in->name);
2628 + strcpy(pm->indev, in->br_port->br->dev.name);
2629 + } else
2630 + pm->indev[0] = pm->physindev[0] = '\0';
2631 +
2632 + if (out) {
2633 + strcpy(pm->physoutdev, out->name);
2634 + strcpy(pm->outdev, out->br_port->br->dev.name);
2635 + } else
2636 + pm->outdev[0] = pm->physoutdev[0] = '\0';
2637 +
2638 + if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
2639 + BUG();
2640 +
2641 + if (ub->qlen > 1)
2642 + ub->lastnlh->nlmsg_flags |= NLM_F_MULTI;
2643 +
2644 + ub->lastnlh = nlh;
2645 +
2646 + if (ub->qlen >= loginfo->qthreshold)
2647 + ulog_send(group);
2648 + else if (!timer_pending(&ub->timer)) {
2649 + ub->timer.expires = jiffies + flushtimeout * HZ / 100;
2650 + add_timer(&ub->timer);
2651 + }
2652 +
2653 +unlock:
2654 + spin_unlock_bh(lock);
2655 +
2656 + return;
2657 +
2658 +nlmsg_failure:
2659 + PRINTR(KERN_ERR "ebt_ULOG: error during NLMSG_PUT.\n");
2660 + goto unlock;
2661 +alloc_failure:
2662 + goto unlock;
2663 +}
2664 +
2665 +static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
2666 + const struct ebt_entry *e, void *data, unsigned int datalen)
2667 +{
2668 + struct ebt_ulog_info *loginfo = (struct ebt_ulog_info *)data;
2669 +
2670 + if (datalen != EBT_ALIGN(sizeof(struct ebt_ulog_info)) ||
2671 + loginfo->nlgroup > 31)
2672 + return -EINVAL;
2673 +
2674 + loginfo->prefix[EBT_ULOG_PREFIX_LEN - 1] = '\0';
2675 +
2676 + if (loginfo->qthreshold > EBT_ULOG_MAX_QLEN)
2677 + loginfo->qthreshold = EBT_ULOG_MAX_QLEN;
2678 +
2679 + return 0;
2680 +}
2681 +
2682 +static struct ebt_watcher ulog = {
2683 + {NULL, NULL}, EBT_ULOG_WATCHER, ebt_ulog, ebt_ulog_check, NULL,
2684 + THIS_MODULE
2685 +};
2686 +
2687 +static int __init init(void)
2688 +{
2689 + int i, ret = 0;
2690 +
2691 + if (nlbufsiz >= 128*1024) {
2692 + printk(KERN_NOTICE "ebt_ulog: Netlink buffer has to be <= 128kB,"
2693 + " please try a smaller nlbufsiz parameter.\n");
2694 + return -EINVAL;
2695 + }
2696 +
2697 + /* initialize ulog_buffers */
2698 + for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
2699 + init_timer(&ulog_buffers[i].timer);
2700 + ulog_buffers[i].timer.function = ulog_timer;
2701 + ulog_buffers[i].timer.data = i;
2702 + ulog_buffers[i].lock = SPIN_LOCK_UNLOCKED;
2703 + }
2704 +
2705 + ebtlognl = netlink_kernel_create(NETLINK_NFLOG, NULL);
2706 + if (!ebtlognl)
2707 + ret = -ENOMEM;
2708 + else if ((ret = ebt_register_watcher(&ulog)))
2709 + sock_release(ebtlognl->socket);
2710 +
2711 + return ret;
2712 +}
2713 +
2714 +static void __exit fini(void)
2715 +{
2716 + ebt_ulog_buff_t *ub;
2717 + int i;
2718 +
2719 + ebt_unregister_watcher(&ulog);
2720 + for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
2721 + ub = &ulog_buffers[i];
2722 + if (timer_pending(&ub->timer))
2723 + del_timer(&ub->timer);
2724 + spin_lock_bh(&ub->lock);
2725 + if (ub->skb) {
2726 + kfree_skb(ub->skb);
2727 + ub->skb = NULL;
2728 + }
2729 + spin_unlock_bh(&ub->lock);
2730 + }
2731 + sock_release(ebtlognl->socket);
2732 +}
2733 +
2734 +module_init(init);
2735 +module_exit(fini);
2736 +MODULE_LICENSE("GPL");
2737 +MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
2738 +MODULE_DESCRIPTION("ebtables userspace logging module for bridged Ethernet"
2739 + " frames");
2740 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
2741 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_snat.c 2005-09-15 16:57:23.000000000 +0000
2742 @@ -0,0 +1,64 @@
2743 +/*
2744 + * ebt_snat
2745 + *
2746 + * Authors:
2747 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2748 + *
2749 + * June, 2002
2750 + *
2751 + */
2752 +
2753 +#include <linux/netfilter_bridge/ebtables.h>
2754 +#include <linux/netfilter_bridge/ebt_nat.h>
2755 +#include <linux/module.h>
2756 +
2757 +static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
2758 + const struct net_device *in, const struct net_device *out,
2759 + const void *data, unsigned int datalen)
2760 +{
2761 + struct ebt_nat_info *info = (struct ebt_nat_info *) data;
2762 +
2763 + memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
2764 + ETH_ALEN * sizeof(unsigned char));
2765 + return info->target;
2766 +}
2767 +
2768 +static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
2769 + const struct ebt_entry *e, void *data, unsigned int datalen)
2770 +{
2771 + struct ebt_nat_info *info = (struct ebt_nat_info *) data;
2772 +
2773 + if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
2774 + return -EINVAL;
2775 + if (BASE_CHAIN && info->target == EBT_RETURN)
2776 + return -EINVAL;
2777 + CLEAR_BASE_CHAIN_BIT;
2778 + if (strcmp(tablename, "nat"))
2779 + return -EINVAL;
2780 + if (hookmask & ~(1 << NF_BR_POST_ROUTING))
2781 + return -EINVAL;
2782 + if (INVALID_TARGET)
2783 + return -EINVAL;
2784 + return 0;
2785 +}
2786 +
2787 +static struct ebt_target snat =
2788 +{
2789 + {NULL, NULL}, EBT_SNAT_TARGET, ebt_target_snat, ebt_target_snat_check,
2790 + NULL, THIS_MODULE
2791 +};
2792 +
2793 +static int __init init(void)
2794 +{
2795 + return ebt_register_target(&snat);
2796 +}
2797 +
2798 +static void __exit fini(void)
2799 +{
2800 + ebt_unregister_target(&snat);
2801 +}
2802 +
2803 +module_init(init);
2804 +module_exit(fini);
2805 +EXPORT_NO_SYMBOLS;
2806 +MODULE_LICENSE("GPL");
2807 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
2808 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebt_dnat.c 2005-09-15 16:57:23.000000000 +0000
2809 @@ -0,0 +1,65 @@
2810 +/*
2811 + * ebt_dnat
2812 + *
2813 + * Authors:
2814 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2815 + *
2816 + * June, 2002
2817 + *
2818 + */
2819 +
2820 +#include <linux/netfilter_bridge/ebtables.h>
2821 +#include <linux/netfilter_bridge/ebt_nat.h>
2822 +#include <linux/module.h>
2823 +#include <net/sock.h>
2824 +
2825 +static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
2826 + const struct net_device *in, const struct net_device *out,
2827 + const void *data, unsigned int datalen)
2828 +{
2829 + struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2830 +
2831 + memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
2832 + ETH_ALEN * sizeof(unsigned char));
2833 + return info->target;
2834 +}
2835 +
2836 +static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
2837 + const struct ebt_entry *e, void *data, unsigned int datalen)
2838 +{
2839 + struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2840 +
2841 + if (BASE_CHAIN && info->target == EBT_RETURN)
2842 + return -EINVAL;
2843 + CLEAR_BASE_CHAIN_BIT;
2844 + if ( (strcmp(tablename, "nat") ||
2845 + (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
2846 + (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
2847 + return -EINVAL;
2848 + if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
2849 + return -EINVAL;
2850 + if (INVALID_TARGET)
2851 + return -EINVAL;
2852 + return 0;
2853 +}
2854 +
2855 +static struct ebt_target dnat =
2856 +{
2857 + {NULL, NULL}, EBT_DNAT_TARGET, ebt_target_dnat, ebt_target_dnat_check,
2858 + NULL, THIS_MODULE
2859 +};
2860 +
2861 +static int __init init(void)
2862 +{
2863 + return ebt_register_target(&dnat);
2864 +}
2865 +
2866 +static void __exit fini(void)
2867 +{
2868 + ebt_unregister_target(&dnat);
2869 +}
2870 +
2871 +module_init(init);
2872 +module_exit(fini);
2873 +EXPORT_NO_SYMBOLS;
2874 +MODULE_LICENSE("GPL");
2875 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
2876 +++ linux-2.4.31-ebt-brnf/net/bridge/netfilter/ebtables.c 2005-09-15 16:57:23.000000000 +0000
2877 @@ -0,0 +1,1497 @@
2878 +/*
2879 + * ebtables
2880 + *
2881 + * Author:
2882 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
2883 + *
2884 + * ebtables.c,v 2.0, July, 2002
2885 + *
2886 + * This code is stongly inspired on the iptables code which is
2887 + * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
2888 + *
2889 + * This program is free software; you can redistribute it and/or
2890 + * modify it under the terms of the GNU General Public License
2891 + * as published by the Free Software Foundation; either version
2892 + * 2 of the License, or (at your option) any later version.
2893 + */
2894 +
2895 +// used for print_string
2896 +#include <linux/sched.h>
2897 +#include <linux/tty.h>
2898 +
2899 +#include <linux/kmod.h>
2900 +#include <linux/module.h>
2901 +#include <linux/vmalloc.h>
2902 +#include <linux/netfilter_bridge/ebtables.h>
2903 +#include <linux/spinlock.h>
2904 +#include <asm/uaccess.h>
2905 +#include <linux/smp.h>
2906 +#include <net/sock.h>
2907 +// needed for logical [in,out]-dev filtering
2908 +#include "../br_private.h"
2909 +
2910 +// list_named_find
2911 +#define ASSERT_READ_LOCK(x)
2912 +#define ASSERT_WRITE_LOCK(x)
2913 +#include <linux/netfilter_ipv4/listhelp.h>
2914 +
2915 +#if 0 // use this for remote debugging
2916 +// Copyright (C) 1998 by Ori Pomerantz
2917 +// Print the string to the appropriate tty, the one
2918 +// the current task uses
2919 +static void print_string(char *str)
2920 +{
2921 + struct tty_struct *my_tty;
2922 +
2923 + /* The tty for the current task */
2924 + my_tty = current->tty;
2925 + if (my_tty != NULL) {
2926 + (*(my_tty->driver).write)(my_tty, 0, str, strlen(str));
2927 + (*(my_tty->driver).write)(my_tty, 0, "\015\012", 2);
2928 + }
2929 +}
2930 +
2931 +#define BUGPRINT(args) print_string(args);
2932 +#else
2933 +#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
2934 + "report to author: "format, ## args)
2935 +// #define BUGPRINT(format, args...)
2936 +#endif
2937 +#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
2938 + ": out of memory: "format, ## args)
2939 +// #define MEMPRINT(format, args...)
2940 +
2941 +
2942 +
2943 +// Each cpu has its own set of counters, so there is no need for write_lock in
2944 +// the softirq
2945 +// For reading or updating the counters, the user context needs to
2946 +// get a write_lock
2947 +
2948 +// The size of each set of counters is altered to get cache alignment
2949 +#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
2950 +#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
2951 +#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
2952 + COUNTER_OFFSET(n) * cpu))
2953 +
2954 +
2955 +
2956 +static DECLARE_MUTEX(ebt_mutex);
2957 +static LIST_HEAD(ebt_tables);
2958 +static LIST_HEAD(ebt_targets);
2959 +static LIST_HEAD(ebt_matches);
2960 +static LIST_HEAD(ebt_watchers);
2961 +
2962 +static struct ebt_target ebt_standard_target =
2963 +{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
2964 +
2965 +static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
2966 + const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
2967 + const struct net_device *out)
2968 +{
2969 + w->u.watcher->watcher(skb, hooknr, in, out, w->data,
2970 + w->watcher_size);
2971 + // watchers don't give a verdict
2972 + return 0;
2973 +}
2974 +
2975 +static inline int ebt_do_match (struct ebt_entry_match *m,
2976 + const struct sk_buff *skb, const struct net_device *in,
2977 + const struct net_device *out)
2978 +{
2979 + return m->u.match->match(skb, in, out, m->data,
2980 + m->match_size);
2981 +}
2982 +
2983 +static inline int ebt_dev_check(char *entry, const struct net_device *device)
2984 +{
2985 + int i = 0;
2986 + char *devname = device->name;
2987 +
2988 + if (*entry == '\0')
2989 + return 0;
2990 + if (!device)
2991 + return 1;
2992 + /* 1 is the wildcard token */
2993 + while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
2994 + i++;
2995 + return (devname[i] != entry[i] && entry[i] != 1);
2996 +}
2997 +
2998 +#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
2999 +// process standard matches
3000 +static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
3001 + const struct net_device *in, const struct net_device *out)
3002 +{
3003 + int verdict, i;
3004 +
3005 + if (e->bitmask & EBT_802_3) {
3006 + if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
3007 + return 1;
3008 + } else if (!(e->bitmask & EBT_NOPROTO) &&
3009 + FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
3010 + return 1;
3011 +
3012 + if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
3013 + return 1;
3014 + if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
3015 + return 1;
3016 + if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
3017 + e->logical_in, &in->br_port->br->dev), EBT_ILOGICALIN))
3018 + return 1;
3019 + if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
3020 + e->logical_out, &out->br_port->br->dev), EBT_ILOGICALOUT))
3021 + return 1;
3022 +
3023 + if (e->bitmask & EBT_SOURCEMAC) {
3024 + verdict = 0;
3025 + for (i = 0; i < 6; i++)
3026 + verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
3027 + e->sourcemsk[i];
3028 + if (FWINV2(verdict != 0, EBT_ISOURCE) )
3029 + return 1;
3030 + }
3031 + if (e->bitmask & EBT_DESTMAC) {
3032 + verdict = 0;
3033 + for (i = 0; i < 6; i++)
3034 + verdict |= (h->h_dest[i] ^ e->destmac[i]) &
3035 + e->destmsk[i];
3036 + if (FWINV2(verdict != 0, EBT_IDEST) )
3037 + return 1;
3038 + }
3039 + return 0;
3040 +}
3041 +
3042 +// Do some firewalling
3043 +unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
3044 + const struct net_device *in, const struct net_device *out,
3045 + struct ebt_table *table)
3046 +{
3047 + int i, nentries;
3048 + struct ebt_entry *point;
3049 + struct ebt_counter *counter_base, *cb_base;
3050 + struct ebt_entry_target *t;
3051 + int verdict, sp = 0;
3052 + struct ebt_chainstack *cs;
3053 + struct ebt_entries *chaininfo;
3054 + char *base;
3055 + struct ebt_table_info *private;
3056 +
3057 + read_lock_bh(&table->lock);
3058 + private = table->private;
3059 + cb_base = COUNTER_BASE(private->counters, private->nentries,
3060 + cpu_number_map(smp_processor_id()));
3061 + if (private->chainstack)
3062 + cs = private->chainstack[cpu_number_map(smp_processor_id())];
3063 + else
3064 + cs = NULL;
3065 + chaininfo = private->hook_entry[hook];
3066 + nentries = private->hook_entry[hook]->nentries;
3067 + point = (struct ebt_entry *)(private->hook_entry[hook]->data);
3068 + counter_base = cb_base + private->hook_entry[hook]->counter_offset;
3069 + // base for chain jumps
3070 + base = private->entries;
3071 + i = 0;
3072 + while (i < nentries) {
3073 + if (ebt_basic_match(point, (**pskb).mac.ethernet, in, out))
3074 + goto letscontinue;
3075 +
3076 + if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
3077 + goto letscontinue;
3078 +
3079 + // increase counter
3080 + (*(counter_base + i)).pcnt++;
3081 + (*(counter_base + i)).bcnt+=(**pskb).len;
3082 +
3083 + // these should only watch: not modify, nor tell us
3084 + // what to do with the packet
3085 + EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
3086 + out);
3087 +
3088 + t = (struct ebt_entry_target *)
3089 + (((char *)point) + point->target_offset);
3090 + // standard target
3091 + if (!t->u.target->target)
3092 + verdict = ((struct ebt_standard_target *)t)->verdict;
3093 + else
3094 + verdict = t->u.target->target(pskb, hook,
3095 + in, out, t->data, t->target_size);
3096 + if (verdict == EBT_ACCEPT) {
3097 + read_unlock_bh(&table->lock);
3098 + return NF_ACCEPT;
3099 + }
3100 + if (verdict == EBT_DROP) {
3101 + read_unlock_bh(&table->lock);
3102 + return NF_DROP;
3103 + }
3104 + if (verdict == EBT_RETURN) {
3105 +letsreturn:
3106 +#ifdef CONFIG_NETFILTER_DEBUG
3107 + if (sp == 0) {
3108 + BUGPRINT("RETURN on base chain");
3109 + // act like this is EBT_CONTINUE
3110 + goto letscontinue;
3111 + }
3112 +#endif
3113 + sp--;
3114 + // put all the local variables right
3115 + i = cs[sp].n;
3116 + chaininfo = cs[sp].chaininfo;
3117 + nentries = chaininfo->nentries;
3118 + point = cs[sp].e;
3119 + counter_base = cb_base +
3120 + chaininfo->counter_offset;
3121 + continue;
3122 + }
3123 + if (verdict == EBT_CONTINUE)
3124 + goto letscontinue;
3125 +#ifdef CONFIG_NETFILTER_DEBUG
3126 + if (verdict < 0) {
3127 + BUGPRINT("bogus standard verdict\n");
3128 + read_unlock_bh(&table->lock);
3129 + return NF_DROP;
3130 + }
3131 +#endif
3132 + // jump to a udc
3133 + cs[sp].n = i + 1;
3134 + cs[sp].chaininfo = chaininfo;
3135 + cs[sp].e = (struct ebt_entry *)
3136 + (((char *)point) + point->next_offset);
3137 + i = 0;
3138 + chaininfo = (struct ebt_entries *) (base + verdict);
3139 +#ifdef CONFIG_NETFILTER_DEBUG
3140 + if (chaininfo->distinguisher) {
3141 + BUGPRINT("jump to non-chain\n");
3142 + read_unlock_bh(&table->lock);
3143 + return NF_DROP;
3144 + }
3145 +#endif
3146 + nentries = chaininfo->nentries;
3147 + point = (struct ebt_entry *)chaininfo->data;
3148 + counter_base = cb_base + chaininfo->counter_offset;
3149 + sp++;
3150 + continue;
3151 +letscontinue:
3152 + point = (struct ebt_entry *)
3153 + (((char *)point) + point->next_offset);
3154 + i++;
3155 + }
3156 +
3157 + // I actually like this :)
3158 + if (chaininfo->policy == EBT_RETURN)
3159 + goto letsreturn;
3160 + if (chaininfo->policy == EBT_ACCEPT) {
3161 + read_unlock_bh(&table->lock);
3162 + return NF_ACCEPT;
3163 + }
3164 + read_unlock_bh(&table->lock);
3165 + return NF_DROP;
3166 +}
3167 +
3168 +// If it succeeds, returns element and locks mutex
3169 +static inline void *
3170 +find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
3171 + struct semaphore *mutex)
3172 +{
3173 + void *ret;
3174 +
3175 + *error = down_interruptible(mutex);
3176 + if (*error != 0)
3177 + return NULL;
3178 +
3179 + ret = list_named_find(head, name);
3180 + if (!ret) {
3181 + *error = -ENOENT;
3182 + up(mutex);
3183 + }
3184 + return ret;
3185 +}
3186 +
3187 +#ifndef CONFIG_KMOD
3188 +#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
3189 +#else
3190 +static void *
3191 +find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
3192 + int *error, struct semaphore *mutex)
3193 +{
3194 + void *ret;
3195 +
3196 + ret = find_inlist_lock_noload(head, name, error, mutex);
3197 + if (!ret) {
3198 + char modulename[EBT_FUNCTION_MAXNAMELEN + strlen(prefix) + 1];
3199 + strcpy(modulename, prefix);
3200 + strcat(modulename, name);
3201 + request_module(modulename);
3202 + ret = find_inlist_lock_noload(head, name, error, mutex);
3203 + }
3204 + return ret;
3205 +}
3206 +#endif
3207 +
3208 +static inline struct ebt_table *
3209 +find_table_lock(const char *name, int *error, struct semaphore *mutex)
3210 +{
3211 + return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
3212 +}
3213 +
3214 +static inline struct ebt_match *
3215 +find_match_lock(const char *name, int *error, struct semaphore *mutex)
3216 +{
3217 + return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
3218 +}
3219 +
3220 +static inline struct ebt_watcher *
3221 +find_watcher_lock(const char *name, int *error, struct semaphore *mutex)
3222 +{
3223 + return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
3224 +}
3225 +
3226 +static inline struct ebt_target *
3227 +find_target_lock(const char *name, int *error, struct semaphore *mutex)
3228 +{
3229 + return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
3230 +}
3231 +
3232 +static inline int
3233 +ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
3234 + const char *name, unsigned int hookmask, unsigned int *cnt)
3235 +{
3236 + struct ebt_match *match;
3237 + int ret;
3238 +
3239 + if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
3240 + ((char *)e) + e->watchers_offset)
3241 + return -EINVAL;
3242 + match = find_match_lock(m->u.name, &ret, &ebt_mutex);
3243 + if (!match)
3244 + return ret;
3245 + m->u.match = match;
3246 + if (match->me)
3247 + __MOD_INC_USE_COUNT(match->me);
3248 + up(&ebt_mutex);
3249 + if (match->check &&
3250 + match->check(name, hookmask, e, m->data, m->match_size) != 0) {
3251 + BUGPRINT("match->check failed\n");
3252 + if (match->me)
3253 + __MOD_DEC_USE_COUNT(match->me);
3254 + return -EINVAL;
3255 + }
3256 + (*cnt)++;
3257 + return 0;
3258 +}
3259 +
3260 +static inline int
3261 +ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
3262 + const char *name, unsigned int hookmask, unsigned int *cnt)
3263 +{
3264 + struct ebt_watcher *watcher;
3265 + int ret;
3266 +
3267 + if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
3268 + ((char *)e) + e->target_offset)
3269 + return -EINVAL;
3270 + watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
3271 + if (!watcher)
3272 + return ret;
3273 + w->u.watcher = watcher;
3274 + if (watcher->me)
3275 + __MOD_INC_USE_COUNT(watcher->me);
3276 + up(&ebt_mutex);
3277 + if (watcher->check &&
3278 + watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
3279 + BUGPRINT("watcher->check failed\n");
3280 + if (watcher->me)
3281 + __MOD_DEC_USE_COUNT(watcher->me);
3282 + return -EINVAL;
3283 + }
3284 + (*cnt)++;
3285 + return 0;
3286 +}
3287 +
3288 +// this one is very careful, as it is the first function
3289 +// to parse the userspace data
3290 +static inline int
3291 +ebt_check_entry_size_and_hooks(struct ebt_entry *e,
3292 + struct ebt_table_info *newinfo, char *base, char *limit,
3293 + struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
3294 + unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
3295 +{
3296 + int i;
3297 +
3298 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3299 + if ((valid_hooks & (1 << i)) == 0)
3300 + continue;
3301 + if ( (char *)hook_entries[i] - base ==
3302 + (char *)e - newinfo->entries)
3303 + break;
3304 + }
3305 + // beginning of a new chain
3306 + // if i == NF_BR_NUMHOOKS it must be a user defined chain
3307 + if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
3308 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
3309 + // we make userspace set this right,
3310 + // so there is no misunderstanding
3311 + BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
3312 + "in distinguisher\n");
3313 + return -EINVAL;
3314 + }
3315 + // this checks if the previous chain has as many entries
3316 + // as it said it has
3317 + if (*n != *cnt) {
3318 + BUGPRINT("nentries does not equal the nr of entries "
3319 + "in the chain\n");
3320 + return -EINVAL;
3321 + }
3322 + // before we look at the struct, be sure it is not too big
3323 + if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
3324 + > limit) {
3325 + BUGPRINT("entries_size too small\n");
3326 + return -EINVAL;
3327 + }
3328 + if (((struct ebt_entries *)e)->policy != EBT_DROP &&
3329 + ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
3330 + // only RETURN from udc
3331 + if (i != NF_BR_NUMHOOKS ||
3332 + ((struct ebt_entries *)e)->policy != EBT_RETURN) {
3333 + BUGPRINT("bad policy\n");
3334 + return -EINVAL;
3335 + }
3336 + }
3337 + if (i == NF_BR_NUMHOOKS) // it's a user defined chain
3338 + (*udc_cnt)++;
3339 + else
3340 + newinfo->hook_entry[i] = (struct ebt_entries *)e;
3341 + if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
3342 + BUGPRINT("counter_offset != totalcnt");
3343 + return -EINVAL;
3344 + }
3345 + *n = ((struct ebt_entries *)e)->nentries;
3346 + *cnt = 0;
3347 + return 0;
3348 + }
3349 + // a plain old entry, heh
3350 + if (sizeof(struct ebt_entry) > e->watchers_offset ||
3351 + e->watchers_offset > e->target_offset ||
3352 + e->target_offset >= e->next_offset) {
3353 + BUGPRINT("entry offsets not in right order\n");
3354 + return -EINVAL;
3355 + }
3356 + // this is not checked anywhere else
3357 + if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
3358 + BUGPRINT("target size too small\n");
3359 + return -EINVAL;
3360 + }
3361 +
3362 + (*cnt)++;
3363 + (*totalcnt)++;
3364 + return 0;
3365 +}
3366 +
3367 +struct ebt_cl_stack
3368 +{
3369 + struct ebt_chainstack cs;
3370 + int from;
3371 + unsigned int hookmask;
3372 +};
3373 +
3374 +// we need these positions to check that the jumps to a different part of the
3375 +// entries is a jump to the beginning of a new chain.
3376 +static inline int
3377 +ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
3378 + struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
3379 + struct ebt_cl_stack *udc)
3380 +{
3381 + int i;
3382 +
3383 + // we're only interested in chain starts
3384 + if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
3385 + return 0;
3386 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3387 + if ((valid_hooks & (1 << i)) == 0)
3388 + continue;
3389 + if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
3390 + break;
3391 + }
3392 + // only care about udc
3393 + if (i != NF_BR_NUMHOOKS)
3394 + return 0;
3395 +
3396 + udc[*n].cs.chaininfo = (struct ebt_entries *)e;
3397 + // these initialisations are depended on later in check_chainloops()
3398 + udc[*n].cs.n = 0;
3399 + udc[*n].hookmask = 0;
3400 +
3401 + (*n)++;
3402 + return 0;
3403 +}
3404 +
3405 +static inline int
3406 +ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
3407 +{
3408 + if (i && (*i)-- == 0)
3409 + return 1;
3410 + if (m->u.match->destroy)
3411 + m->u.match->destroy(m->data, m->match_size);
3412 + if (m->u.match->me)
3413 + __MOD_DEC_USE_COUNT(m->u.match->me);
3414 +
3415 + return 0;
3416 +}
3417 +
3418 +static inline int
3419 +ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
3420 +{
3421 + if (i && (*i)-- == 0)
3422 + return 1;
3423 + if (w->u.watcher->destroy)
3424 + w->u.watcher->destroy(w->data, w->watcher_size);
3425 + if (w->u.watcher->me)
3426 + __MOD_DEC_USE_COUNT(w->u.watcher->me);
3427 +
3428 + return 0;
3429 +}
3430 +
3431 +static inline int
3432 +ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
3433 +{
3434 + struct ebt_entry_target *t;
3435 +
3436 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
3437 + return 0;
3438 + // we're done
3439 + if (cnt && (*cnt)-- == 0)
3440 + return 1;
3441 + EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
3442 + EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
3443 + t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
3444 + if (t->u.target->destroy)
3445 + t->u.target->destroy(t->data, t->target_size);
3446 + if (t->u.target->me)
3447 + __MOD_DEC_USE_COUNT(t->u.target->me);
3448 +
3449 + return 0;
3450 +}
3451 +
3452 +static inline int
3453 +ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
3454 + const char *name, unsigned int *cnt, unsigned int valid_hooks,
3455 + struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
3456 +{
3457 + struct ebt_entry_target *t;
3458 + struct ebt_target *target;
3459 + unsigned int i, j, hook = 0, hookmask = 0;
3460 + int ret;
3461 +
3462 + // Don't mess with the struct ebt_entries
3463 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
3464 + return 0;
3465 +
3466 + if (e->bitmask & ~EBT_F_MASK) {
3467 + BUGPRINT("Unknown flag for bitmask\n");
3468 + return -EINVAL;
3469 + }
3470 + if (e->invflags & ~EBT_INV_MASK) {
3471 + BUGPRINT("Unknown flag for inv bitmask\n");
3472 + return -EINVAL;
3473 + }
3474 + if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
3475 + BUGPRINT("NOPROTO & 802_3 not allowed\n");
3476 + return -EINVAL;
3477 + }
3478 + // what hook do we belong to?
3479 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3480 + if ((valid_hooks & (1 << i)) == 0)
3481 + continue;
3482 + if ((char *)newinfo->hook_entry[i] < (char *)e)
3483 + hook = i;
3484 + else
3485 + break;
3486 + }
3487 + // (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
3488 + // a base chain
3489 + if (i < NF_BR_NUMHOOKS)
3490 + hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
3491 + else {
3492 + for (i = 0; i < udc_cnt; i++)
3493 + if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
3494 + break;
3495 + if (i == 0)
3496 + hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
3497 + else
3498 + hookmask = cl_s[i - 1].hookmask;
3499 + }
3500 + i = 0;
3501 + ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
3502 + if (ret != 0)
3503 + goto cleanup_matches;
3504 + j = 0;
3505 + ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
3506 + if (ret != 0)
3507 + goto cleanup_watchers;
3508 + t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
3509 + target = find_target_lock(t->u.name, &ret, &ebt_mutex);
3510 + if (!target)
3511 + goto cleanup_watchers;
3512 + if (target->me)
3513 + __MOD_INC_USE_COUNT(target->me);
3514 + up(&ebt_mutex);
3515 +
3516 + t->u.target = target;
3517 + if (t->u.target == &ebt_standard_target) {
3518 + if (e->target_offset + sizeof(struct ebt_standard_target) >
3519 + e->next_offset) {
3520 + BUGPRINT("Standard target size too big\n");
3521 + ret = -EFAULT;
3522 + goto cleanup_watchers;
3523 + }
3524 + if (((struct ebt_standard_target *)t)->verdict <
3525 + -NUM_STANDARD_TARGETS) {
3526 + BUGPRINT("Invalid standard target\n");
3527 + ret = -EFAULT;
3528 + goto cleanup_watchers;
3529 + }
3530 + } else if ((e->target_offset + t->target_size +
3531 + sizeof(struct ebt_entry_target) > e->next_offset) ||
3532 + (t->u.target->check &&
3533 + t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
3534 + if (t->u.target->me)
3535 + __MOD_DEC_USE_COUNT(t->u.target->me);
3536 + ret = -EFAULT;
3537 + goto cleanup_watchers;
3538 + }
3539 + (*cnt)++;
3540 + return 0;
3541 +cleanup_watchers:
3542 + EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
3543 +cleanup_matches:
3544 + EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
3545 + return ret;
3546 +}
3547 +
3548 +// checks for loops and sets the hook mask for udc
3549 +// the hook mask for udc tells us from which base chains the udc can be
3550 +// accessed. This mask is a parameter to the check() functions of the extensions
3551 +static int check_chainloops(struct ebt_entries *chain,
3552 + struct ebt_cl_stack *cl_s, unsigned int udc_cnt,
3553 + unsigned int hooknr, char *base)
3554 +{
3555 + int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
3556 + struct ebt_entry *e = (struct ebt_entry *)chain->data;
3557 + struct ebt_entry_target *t;
3558 +
3559 + while (pos < nentries || chain_nr != -1) {
3560 + // end of udc, go back one 'recursion' step
3561 + if (pos == nentries) {
3562 + // put back values of the time when this chain was called
3563 + e = cl_s[chain_nr].cs.e;
3564 + if (cl_s[chain_nr].from != -1)
3565 + nentries =
3566 + cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
3567 + else
3568 + nentries = chain->nentries;
3569 + pos = cl_s[chain_nr].cs.n;
3570 + // make sure we won't see a loop that isn't one
3571 + cl_s[chain_nr].cs.n = 0;
3572 + chain_nr = cl_s[chain_nr].from;
3573 + if (pos == nentries)
3574 + continue;
3575 + }
3576 + t = (struct ebt_entry_target *)
3577 + (((char *)e) + e->target_offset);
3578 + if (strcmp(t->u.name, EBT_STANDARD_TARGET))
3579 + goto letscontinue;
3580 + if (e->target_offset + sizeof(struct ebt_standard_target) >
3581 + e->next_offset) {
3582 + BUGPRINT("Standard target size too big\n");
3583 + return -1;
3584 + }
3585 + verdict = ((struct ebt_standard_target *)t)->verdict;
3586 + if (verdict >= 0) { // jump to another chain
3587 + struct ebt_entries *hlp2 =
3588 + (struct ebt_entries *)(base + verdict);
3589 + for (i = 0; i < udc_cnt; i++)
3590 + if (hlp2 == cl_s[i].cs.chaininfo)
3591 + break;
3592 + // bad destination or loop
3593 + if (i == udc_cnt) {
3594 + BUGPRINT("bad destination\n");
3595 + return -1;
3596 + }
3597 + if (cl_s[i].cs.n) {
3598 + BUGPRINT("loop\n");
3599 + return -1;
3600 + }
3601 + // this can't be 0, so the above test is correct
3602 + cl_s[i].cs.n = pos + 1;
3603 + pos = 0;
3604 + cl_s[i].cs.e = ((void *)e + e->next_offset);
3605 + e = (struct ebt_entry *)(hlp2->data);
3606 + nentries = hlp2->nentries;
3607 + cl_s[i].from = chain_nr;
3608 + chain_nr = i;
3609 + // this udc is accessible from the base chain for hooknr
3610 + cl_s[i].hookmask |= (1 << hooknr);
3611 + continue;
3612 + }
3613 +letscontinue:
3614 + e = (void *)e + e->next_offset;
3615 + pos++;
3616 + }
3617 + return 0;
3618 +}
3619 +
3620 +// do the parsing of the table/chains/entries/matches/watchers/targets, heh
3621 +static int translate_table(struct ebt_replace *repl,
3622 + struct ebt_table_info *newinfo)
3623 +{
3624 + unsigned int i, j, k, udc_cnt;
3625 + int ret;
3626 + struct ebt_cl_stack *cl_s = NULL; // used in the checking for chain loops
3627 +
3628 + i = 0;
3629 + while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
3630 + i++;
3631 + if (i == NF_BR_NUMHOOKS) {
3632 + BUGPRINT("No valid hooks specified\n");
3633 + return -EINVAL;
3634 + }
3635 + if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
3636 + BUGPRINT("Chains don't start at beginning\n");
3637 + return -EINVAL;
3638 + }
3639 + // make sure chains are ordered after each other in same order
3640 + // as their corresponding hooks
3641 + for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
3642 + if (!(repl->valid_hooks & (1 << j)))
3643 + continue;
3644 + if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
3645 + BUGPRINT("Hook order must be followed\n");
3646 + return -EINVAL;
3647 + }
3648 + i = j;
3649 + }
3650 +
3651 + for (i = 0; i < NF_BR_NUMHOOKS; i++)
3652 + newinfo->hook_entry[i] = NULL;
3653 +
3654 + newinfo->entries_size = repl->entries_size;
3655 + newinfo->nentries = repl->nentries;
3656 +
3657 + // do some early checkings and initialize some things
3658 + i = 0; // holds the expected nr. of entries for the chain
3659 + j = 0; // holds the up to now counted entries for the chain
3660 + k = 0; // holds the total nr. of entries, should equal
3661 + // newinfo->nentries afterwards
3662 + udc_cnt = 0; // will hold the nr. of user defined chains (udc)
3663 + ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3664 + ebt_check_entry_size_and_hooks, newinfo, repl->entries,
3665 + repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
3666 + &udc_cnt, repl->valid_hooks);
3667 +
3668 + if (ret != 0)
3669 + return ret;
3670 +
3671 + if (i != j) {
3672 + BUGPRINT("nentries does not equal the nr of entries in the "
3673 + "(last) chain\n");
3674 + return -EINVAL;
3675 + }
3676 + if (k != newinfo->nentries) {
3677 + BUGPRINT("Total nentries is wrong\n");
3678 + return -EINVAL;
3679 + }
3680 +
3681 + // check if all valid hooks have a chain
3682 + for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3683 + if (newinfo->hook_entry[i] == NULL &&
3684 + (repl->valid_hooks & (1 << i))) {
3685 + BUGPRINT("Valid hook without chain\n");
3686 + return -EINVAL;
3687 + }
3688 + }
3689 +
3690 + // Get the location of the udc, put them in an array
3691 + // While we're at it, allocate the chainstack
3692 + if (udc_cnt) {
3693 + // this will get free'd in do_replace()/ebt_register_table()
3694 + // if an error occurs
3695 + newinfo->chainstack = (struct ebt_chainstack **)
3696 + vmalloc(smp_num_cpus * sizeof(struct ebt_chainstack));
3697 + if (!newinfo->chainstack)
3698 + return -ENOMEM;
3699 + for (i = 0; i < smp_num_cpus; i++) {
3700 + newinfo->chainstack[i] =
3701 + vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
3702 + if (!newinfo->chainstack[i]) {
3703 + while (i)
3704 + vfree(newinfo->chainstack[--i]);
3705 + vfree(newinfo->chainstack);
3706 + newinfo->chainstack = NULL;
3707 + return -ENOMEM;
3708 + }
3709 + }
3710 +
3711 + cl_s = (struct ebt_cl_stack *)
3712 + vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
3713 + if (!cl_s)
3714 + return -ENOMEM;
3715 + i = 0; // the i'th udc
3716 + EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3717 + ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
3718 + repl->valid_hooks, cl_s);
3719 + // sanity check
3720 + if (i != udc_cnt) {
3721 + BUGPRINT("i != udc_cnt\n");
3722 + vfree(cl_s);
3723 + return -EFAULT;
3724 + }
3725 + }
3726 +
3727 + // Check for loops
3728 + for (i = 0; i < NF_BR_NUMHOOKS; i++)
3729 + if (repl->valid_hooks & (1 << i))
3730 + if (check_chainloops(newinfo->hook_entry[i],
3731 + cl_s, udc_cnt, i, newinfo->entries)) {
3732 + if (cl_s)
3733 + vfree(cl_s);
3734 + return -EINVAL;
3735 + }
3736 +
3737 + // we now know the following (along with E=mc):
3738 + // - the nr of entries in each chain is right
3739 + // - the size of the allocated space is right
3740 + // - all valid hooks have a corresponding chain
3741 + // - there are no loops
3742 + // - wrong data can still be on the level of a single entry
3743 + // - could be there are jumps to places that are not the
3744 + // beginning of a chain. This can only occur in chains that
3745 + // are not accessible from any base chains, so we don't care.
3746 +
3747 + // used to know what we need to clean up if something goes wrong
3748 + i = 0;
3749 + ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3750 + ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
3751 + cl_s, udc_cnt);
3752 + if (ret != 0) {
3753 + EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3754 + ebt_cleanup_entry, &i);
3755 + }
3756 + if (cl_s)
3757 + vfree(cl_s);
3758 + return ret;
3759 +}
3760 +
3761 +// called under write_lock
3762 +static void get_counters(struct ebt_counter *oldcounters,
3763 + struct ebt_counter *counters, unsigned int nentries)
3764 +{
3765 + int i, cpu;
3766 + struct ebt_counter *counter_base;
3767 +
3768 + // counters of cpu 0
3769 + memcpy(counters, oldcounters,
3770 + sizeof(struct ebt_counter) * nentries);
3771 + // add other counters to those of cpu 0
3772 + for (cpu = 1; cpu < smp_num_cpus; cpu++) {
3773 + counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
3774 + for (i = 0; i < nentries; i++) {
3775 + counters[i].pcnt += counter_base[i].pcnt;
3776 + counters[i].bcnt += counter_base[i].bcnt;
3777 + }
3778 + }
3779 +}
3780 +
3781 +// replace the table
3782 +static int do_replace(void *user, unsigned int len)
3783 +{
3784 + int ret, i, countersize;
3785 + struct ebt_table_info *newinfo;
3786 + struct ebt_replace tmp;
3787 + struct ebt_table *t;
3788 + struct ebt_counter *counterstmp = NULL;
3789 + // used to be able to unlock earlier
3790 + struct ebt_table_info *table;
3791 +
3792 + if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
3793 + return -EFAULT;
3794 +
3795 + if (len != sizeof(tmp) + tmp.entries_size) {
3796 + BUGPRINT("Wrong len argument\n");
3797 + return -EINVAL;
3798 + }
3799 +
3800 + if (tmp.entries_size == 0) {
3801 + BUGPRINT("Entries_size never zero\n");
3802 + return -EINVAL;
3803 + }
3804 + countersize = COUNTER_OFFSET(tmp.nentries) * smp_num_cpus;
3805 + newinfo = (struct ebt_table_info *)
3806 + vmalloc(sizeof(struct ebt_table_info) + countersize);
3807 + if (!newinfo)
3808 + return -ENOMEM;
3809 +
3810 + if (countersize)
3811 + memset(newinfo->counters, 0, countersize);
3812 +
3813 + newinfo->entries = (char *)vmalloc(tmp.entries_size);
3814 + if (!newinfo->entries) {
3815 + ret = -ENOMEM;
3816 + goto free_newinfo;
3817 + }
3818 + if (copy_from_user(
3819 + newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
3820 + BUGPRINT("Couldn't copy entries from userspace\n");
3821 + ret = -EFAULT;
3822 + goto free_entries;
3823 + }
3824 +
3825 + // the user wants counters back
3826 + // the check on the size is done later, when we have the lock
3827 + if (tmp.num_counters) {
3828 + counterstmp = (struct ebt_counter *)
3829 + vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
3830 + if (!counterstmp) {
3831 + ret = -ENOMEM;
3832 + goto free_entries;
3833 + }
3834 + }
3835 + else
3836 + counterstmp = NULL;
3837 +
3838 + // this can get initialized by translate_table()
3839 + newinfo->chainstack = NULL;
3840 + ret = translate_table(&tmp, newinfo);
3841 +
3842 + if (ret != 0)
3843 + goto free_counterstmp;
3844 +
3845 + t = find_table_lock(tmp.name, &ret, &ebt_mutex);
3846 + if (!t)
3847 + goto free_iterate;
3848 +
3849 + // the table doesn't like it
3850 + if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
3851 + goto free_unlock;
3852 +
3853 + if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
3854 + BUGPRINT("Wrong nr. of counters requested\n");
3855 + ret = -EINVAL;
3856 + goto free_unlock;
3857 + }
3858 +
3859 + // we have the mutex lock, so no danger in reading this pointer
3860 + table = t->private;
3861 + // we need an atomic snapshot of the counters
3862 + write_lock_bh(&t->lock);
3863 + if (tmp.num_counters)
3864 + get_counters(t->private->counters, counterstmp,
3865 + t->private->nentries);
3866 +
3867 + t->private = newinfo;
3868 + write_unlock_bh(&t->lock);
3869 + up(&ebt_mutex);
3870 + // So, a user can change the chains while having messed up her counter
3871 + // allocation. Only reason why this is done is because this way the lock
3872 + // is held only once, while this doesn't bring the kernel into a
3873 + // dangerous state.
3874 + if (tmp.num_counters &&
3875 + copy_to_user(tmp.counters, counterstmp,
3876 + tmp.num_counters * sizeof(struct ebt_counter))) {
3877 + BUGPRINT("Couldn't copy counters to userspace\n");
3878 + ret = -EFAULT;
3879 + }
3880 + else
3881 + ret = 0;
3882 +
3883 + // decrease module count and free resources
3884 + EBT_ENTRY_ITERATE(table->entries, table->entries_size,
3885 + ebt_cleanup_entry, NULL);
3886 +
3887 + vfree(table->entries);
3888 + if (table->chainstack) {
3889 + for (i = 0; i < smp_num_cpus; i++)
3890 + vfree(table->chainstack[i]);
3891 + vfree(table->chainstack);
3892 + }
3893 + vfree(table);
3894 +
3895 + if (counterstmp)
3896 + vfree(counterstmp);
3897 + return ret;
3898 +
3899 +free_unlock:
3900 + up(&ebt_mutex);
3901 +free_iterate:
3902 + EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3903 + ebt_cleanup_entry, NULL);
3904 +free_counterstmp:
3905 + if (counterstmp)
3906 + vfree(counterstmp);
3907 + // can be initialized in translate_table()
3908 + if (newinfo->chainstack) {
3909 + for (i = 0; i < smp_num_cpus; i++)
3910 + vfree(newinfo->chainstack[i]);
3911 + vfree(newinfo->chainstack);
3912 + }
3913 +free_entries:
3914 + if (newinfo->entries)
3915 + vfree(newinfo->entries);
3916 +free_newinfo:
3917 + if (newinfo)
3918 + vfree(newinfo);
3919 + return ret;
3920 +}
3921 +
3922 +int ebt_register_target(struct ebt_target *target)
3923 +{
3924 + int ret;
3925 +
3926 + ret = down_interruptible(&ebt_mutex);
3927 + if (ret != 0)
3928 + return ret;
3929 + if (!list_named_insert(&ebt_targets, target)) {
3930 + up(&ebt_mutex);
3931 + return -EEXIST;
3932 + }
3933 + up(&ebt_mutex);
3934 + MOD_INC_USE_COUNT;
3935 +
3936 + return 0;
3937 +}
3938 +
3939 +void ebt_unregister_target(struct ebt_target *target)
3940 +{
3941 + down(&ebt_mutex);
3942 + LIST_DELETE(&ebt_targets, target);
3943 + up(&ebt_mutex);
3944 + MOD_DEC_USE_COUNT;
3945 +}
3946 +
3947 +int ebt_register_match(struct ebt_match *match)
3948 +{
3949 + int ret;
3950 +
3951 + ret = down_interruptible(&ebt_mutex);
3952 + if (ret != 0)
3953 + return ret;
3954 + if (!list_named_insert(&ebt_matches, match)) {
3955 + up(&ebt_mutex);
3956 + return -EEXIST;
3957 + }
3958 + up(&ebt_mutex);
3959 + MOD_INC_USE_COUNT;
3960 +
3961 + return 0;
3962 +}
3963 +
3964 +void ebt_unregister_match(struct ebt_match *match)
3965 +{
3966 + down(&ebt_mutex);
3967 + LIST_DELETE(&ebt_matches, match);
3968 + up(&ebt_mutex);
3969 + MOD_DEC_USE_COUNT;
3970 +}
3971 +
3972 +int ebt_register_watcher(struct ebt_watcher *watcher)
3973 +{
3974 + int ret;
3975 +
3976 + ret = down_interruptible(&ebt_mutex);
3977 + if (ret != 0)
3978 + return ret;
3979 + if (!list_named_insert(&ebt_watchers, watcher)) {
3980 + up(&ebt_mutex);
3981 + return -EEXIST;
3982 + }
3983 + up(&ebt_mutex);
3984 + MOD_INC_USE_COUNT;
3985 +
3986 + return 0;
3987 +}
3988 +
3989 +void ebt_unregister_watcher(struct ebt_watcher *watcher)
3990 +{
3991 + down(&ebt_mutex);
3992 + LIST_DELETE(&ebt_watchers, watcher);
3993 + up(&ebt_mutex);
3994 + MOD_DEC_USE_COUNT;
3995 +}
3996 +
3997 +int ebt_register_table(struct ebt_table *table)
3998 +{
3999 + struct ebt_table_info *newinfo;
4000 + int ret, i, countersize;
4001 +
4002 + if (!table || !table->table ||!table->table->entries ||
4003 + table->table->entries_size == 0 ||
4004 + table->table->counters || table->private) {
4005 + BUGPRINT("Bad table data for ebt_register_table!!!\n");
4006 + return -EINVAL;
4007 + }
4008 +
4009 + countersize = COUNTER_OFFSET(table->table->nentries) * smp_num_cpus;
4010 + newinfo = (struct ebt_table_info *)
4011 + vmalloc(sizeof(struct ebt_table_info) + countersize);
4012 + ret = -ENOMEM;
4013 + if (!newinfo)
4014 + return -ENOMEM;
4015 +
4016 + newinfo->entries = (char *)vmalloc(table->table->entries_size);
4017 + if (!(newinfo->entries))
4018 + goto free_newinfo;
4019 +
4020 + memcpy(newinfo->entries, table->table->entries,
4021 + table->table->entries_size);
4022 +
4023 + if (countersize)
4024 + memset(newinfo->counters, 0, countersize);
4025 +
4026 + // fill in newinfo and parse the entries
4027 + newinfo->chainstack = NULL;
4028 + ret = translate_table(table->table, newinfo);
4029 + if (ret != 0) {
4030 + BUGPRINT("Translate_table failed\n");
4031 + goto free_chainstack;
4032 + }
4033 +
4034 + if (table->check && table->check(newinfo, table->valid_hooks)) {
4035 + BUGPRINT("The table doesn't like its own initial data, lol\n");
4036 + return -EINVAL;
4037 + }
4038 +
4039 + table->private = newinfo;
4040 + table->lock = RW_LOCK_UNLOCKED;
4041 + ret = down_interruptible(&ebt_mutex);
4042 + if (ret != 0)
4043 + goto free_chainstack;
4044 +
4045 + if (list_named_find(&ebt_tables, table->name)) {
4046 + ret = -EEXIST;
4047 + BUGPRINT("Table name already exists\n");
4048 + goto free_unlock;
4049 + }
4050 +
4051 + list_prepend(&ebt_tables, table);
4052 + up(&ebt_mutex);
4053 + MOD_INC_USE_COUNT;
4054 + return 0;
4055 +free_unlock:
4056 + up(&ebt_mutex);
4057 +free_chainstack:
4058 + if (newinfo->chainstack) {
4059 + for (i = 0; i < smp_num_cpus; i++)
4060 + vfree(newinfo->chainstack[i]);
4061 + vfree(newinfo->chainstack);
4062 + }
4063 + vfree(newinfo->entries);
4064 +free_newinfo:
4065 + vfree(newinfo);
4066 + return ret;
4067 +}
4068 +
4069 +void ebt_unregister_table(struct ebt_table *table)
4070 +{
4071 + int i;
4072 +
4073 + if (!table) {
4074 + BUGPRINT("Request to unregister NULL table!!!\n");
4075 + return;
4076 + }
4077 + down(&ebt_mutex);
4078 + LIST_DELETE(&ebt_tables, table);
4079 + up(&ebt_mutex);
4080 + EBT_ENTRY_ITERATE(table->private->entries,
4081 + table->private->entries_size, ebt_cleanup_entry, NULL);
4082 + if (table->private->entries)
4083 + vfree(table->private->entries);
4084 + if (table->private->chainstack) {
4085 + for (i = 0; i < smp_num_cpus; i++)
4086 + vfree(table->private->chainstack[i]);
4087 + vfree(table->private->chainstack);
4088 + }
4089 + vfree(table->private);
4090 + MOD_DEC_USE_COUNT;
4091 +}
4092 +
4093 +// userspace just supplied us with counters
4094 +static int update_counters(void *user, unsigned int len)
4095 +{
4096 + int i, ret;
4097 + struct ebt_counter *tmp;
4098 + struct ebt_replace hlp;
4099 + struct ebt_table *t;
4100 +
4101 + if (copy_from_user(&hlp, user, sizeof(hlp)))
4102 + return -EFAULT;
4103 +
4104 + if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
4105 + return -EINVAL;
4106 + if (hlp.num_counters == 0)
4107 + return -EINVAL;
4108 +
4109 + if ( !(tmp = (struct ebt_counter *)
4110 + vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
4111 + MEMPRINT("Update_counters && nomemory\n");
4112 + return -ENOMEM;
4113 + }
4114 +
4115 + t = find_table_lock(hlp.name, &ret, &ebt_mutex);
4116 + if (!t)
4117 + goto free_tmp;
4118 +
4119 + if (hlp.num_counters != t->private->nentries) {
4120 + BUGPRINT("Wrong nr of counters\n");
4121 + ret = -EINVAL;
4122 + goto unlock_mutex;
4123 + }
4124 +
4125 + if ( copy_from_user(tmp, hlp.counters,
4126 + hlp.num_counters * sizeof(struct ebt_counter)) ) {
4127 + BUGPRINT("Updata_counters && !cfu\n");
4128 + ret = -EFAULT;
4129 + goto unlock_mutex;
4130 + }
4131 +
4132 + // we want an atomic add of the counters
4133 + write_lock_bh(&t->lock);
4134 +
4135 + // we add to the counters of the first cpu
4136 + for (i = 0; i < hlp.num_counters; i++) {
4137 + t->private->counters[i].pcnt += tmp[i].pcnt;
4138 + t->private->counters[i].bcnt += tmp[i].bcnt;
4139 + }
4140 +
4141 + write_unlock_bh(&t->lock);
4142 + ret = 0;
4143 +unlock_mutex:
4144 + up(&ebt_mutex);
4145 +free_tmp:
4146 + vfree(tmp);
4147 + return ret;
4148 +}
4149 +
4150 +static inline int ebt_make_matchname(struct ebt_entry_match *m,
4151 + char *base, char *ubase)
4152 +{
4153 + char *hlp = ubase - base + (char *)m;
4154 + if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
4155 + return -EFAULT;
4156 + return 0;
4157 +}
4158 +
4159 +static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
4160 + char *base, char *ubase)
4161 +{
4162 + char *hlp = ubase - base + (char *)w;
4163 + if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
4164 + return -EFAULT;
4165 + return 0;
4166 +}
4167 +
4168 +static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
4169 +{
4170 + int ret;
4171 + char *hlp;
4172 + struct ebt_entry_target *t;
4173 +
4174 + if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
4175 + return 0;
4176 +
4177 + hlp = ubase - base + (char *)e + e->target_offset;
4178 + t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
4179 +
4180 + ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
4181 + if (ret != 0)
4182 + return ret;
4183 + ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
4184 + if (ret != 0)
4185 + return ret;
4186 + if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
4187 + return -EFAULT;
4188 + return 0;
4189 +}
4190 +
4191 +// called with ebt_mutex down
4192 +static int copy_everything_to_user(struct ebt_table *t, void *user,
4193 + int *len, int cmd)
4194 +{
4195 + struct ebt_replace tmp;
4196 + struct ebt_counter *counterstmp, *oldcounters;
4197 + unsigned int entries_size, nentries;
4198 + char *entries;
4199 +
4200 + if (cmd == EBT_SO_GET_ENTRIES) {
4201 + entries_size = t->private->entries_size;
4202 + nentries = t->private->nentries;
4203 + entries = t->private->entries;
4204 + oldcounters = t->private->counters;
4205 + } else {
4206 + entries_size = t->table->entries_size;
4207 + nentries = t->table->nentries;
4208 + entries = t->table->entries;
4209 + oldcounters = t->table->counters;
4210 + }
4211 +
4212 + if (copy_from_user(&tmp, user, sizeof(tmp))) {
4213 + BUGPRINT("Cfu didn't work\n");
4214 + return -EFAULT;
4215 + }
4216 +
4217 + if (*len != sizeof(struct ebt_replace) + entries_size +
4218 + (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
4219 + BUGPRINT("Wrong size\n");
4220 + return -EINVAL;
4221 + }
4222 +
4223 + if (tmp.nentries != nentries) {
4224 + BUGPRINT("Nentries wrong\n");
4225 + return -EINVAL;
4226 + }
4227 +
4228 + if (tmp.entries_size != entries_size) {
4229 + BUGPRINT("Wrong size\n");
4230 + return -EINVAL;
4231 + }
4232 +
4233 + // userspace might not need the counters
4234 + if (tmp.num_counters) {
4235 + if (tmp.num_counters != nentries) {
4236 + BUGPRINT("Num_counters wrong\n");
4237 + return -EINVAL;
4238 + }
4239 + counterstmp = (struct ebt_counter *)
4240 + vmalloc(nentries * sizeof(struct ebt_counter));
4241 + if (!counterstmp) {
4242 + MEMPRINT("Couldn't copy counters, out of memory\n");
4243 + return -ENOMEM;
4244 + }
4245 + write_lock_bh(&t->lock);
4246 + get_counters(oldcounters, counterstmp, nentries);
4247 + write_unlock_bh(&t->lock);
4248 +
4249 + if (copy_to_user(tmp.counters, counterstmp,
4250 + nentries * sizeof(struct ebt_counter))) {
4251 + BUGPRINT("Couldn't copy counters to userspace\n");
4252 + vfree(counterstmp);
4253 + return -EFAULT;
4254 + }
4255 + vfree(counterstmp);
4256 + }
4257 +
4258 + if (copy_to_user(tmp.entries, entries, entries_size)) {
4259 + BUGPRINT("Couldn't copy entries to userspace\n");
4260 + return -EFAULT;
4261 + }
4262 + // set the match/watcher/target names right
4263 + return EBT_ENTRY_ITERATE(entries, entries_size,
4264 + ebt_make_names, entries, tmp.entries);
4265 +}
4266 +
4267 +static int do_ebt_set_ctl(struct sock *sk,
4268 + int cmd, void *user, unsigned int len)
4269 +{
4270 + int ret;
4271 +
4272 + switch(cmd) {
4273 + case EBT_SO_SET_ENTRIES:
4274 + ret = do_replace(user, len);
4275 + break;
4276 + case EBT_SO_SET_COUNTERS:
4277 + ret = update_counters(user, len);
4278 + break;
4279 + default:
4280 + ret = -EINVAL;
4281 + }
4282 + return ret;
4283 +}
4284 +
4285 +static int do_ebt_get_ctl(struct sock *sk, int cmd, void *user, int *len)
4286 +{
4287 + int ret;
4288 + struct ebt_replace tmp;
4289 + struct ebt_table *t;
4290 +
4291 + if (copy_from_user(&tmp, user, sizeof(tmp)))
4292 + return -EFAULT;
4293 +
4294 + t = find_table_lock(tmp.name, &ret, &ebt_mutex);
4295 + if (!t)
4296 + return ret;
4297 +
4298 + switch(cmd) {
4299 + case EBT_SO_GET_INFO:
4300 + case EBT_SO_GET_INIT_INFO:
4301 + if (*len != sizeof(struct ebt_replace)){
4302 + ret = -EINVAL;
4303 + up(&ebt_mutex);
4304 + break;
4305 + }
4306 + if (cmd == EBT_SO_GET_INFO) {
4307 + tmp.nentries = t->private->nentries;
4308 + tmp.entries_size = t->private->entries_size;
4309 + tmp.valid_hooks = t->valid_hooks;
4310 + } else {
4311 + tmp.nentries = t->table->nentries;
4312 + tmp.entries_size = t->table->entries_size;
4313 + tmp.valid_hooks = t->table->valid_hooks;
4314 + }
4315 + up(&ebt_mutex);
4316 + if (copy_to_user(user, &tmp, *len) != 0){
4317 + BUGPRINT("c2u Didn't work\n");
4318 + ret = -EFAULT;
4319 + break;
4320 + }
4321 + ret = 0;
4322 + break;
4323 +
4324 + case EBT_SO_GET_ENTRIES:
4325 + case EBT_SO_GET_INIT_ENTRIES:
4326 + ret = copy_everything_to_user(t, user, len, cmd);
4327 + up(&ebt_mutex);
4328 + break;
4329 +
4330 + default:
4331 + up(&ebt_mutex);
4332 + ret = -EINVAL;
4333 + }
4334 +
4335 + return ret;
4336 +}
4337 +
4338 +static struct nf_sockopt_ops ebt_sockopts =
4339 +{ { NULL, NULL }, PF_INET, EBT_BASE_CTL, EBT_SO_SET_MAX + 1, do_ebt_set_ctl,
4340 + EBT_BASE_CTL, EBT_SO_GET_MAX + 1, do_ebt_get_ctl, 0, NULL
4341 +};
4342 +
4343 +static int __init init(void)
4344 +{
4345 + int ret;
4346 +
4347 + down(&ebt_mutex);
4348 + list_named_insert(&ebt_targets, &ebt_standard_target);
4349 + up(&ebt_mutex);
4350 + if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
4351 + return ret;
4352 +
4353 + printk(KERN_NOTICE "Ebtables v2.0 registered\n");
4354 + return 0;
4355 +}
4356 +
4357 +static void __exit fini(void)
4358 +{
4359 + nf_unregister_sockopt(&ebt_sockopts);
4360 + printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
4361 +}
4362 +
4363 +EXPORT_SYMBOL(ebt_register_table);
4364 +EXPORT_SYMBOL(ebt_unregister_table);
4365 +EXPORT_SYMBOL(ebt_register_match);
4366 +EXPORT_SYMBOL(ebt_unregister_match);
4367 +EXPORT_SYMBOL(ebt_register_watcher);
4368 +EXPORT_SYMBOL(ebt_unregister_watcher);
4369 +EXPORT_SYMBOL(ebt_register_target);
4370 +EXPORT_SYMBOL(ebt_unregister_target);
4371 +EXPORT_SYMBOL(ebt_do_table);
4372 +module_init(init);
4373 +module_exit(fini);
4374 +MODULE_LICENSE("GPL");
4375 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4376 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebtables.h 2005-09-15 16:57:23.000000000 +0000
4377 @@ -0,0 +1,361 @@
4378 +/*
4379 + * ebtables
4380 + *
4381 + * Authors:
4382 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
4383 + *
4384 + * ebtables.c,v 2.0, September, 2002
4385 + *
4386 + * This code is stongly inspired on the iptables code which is
4387 + * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
4388 + */
4389 +
4390 +#ifndef __LINUX_BRIDGE_EFF_H
4391 +#define __LINUX_BRIDGE_EFF_H
4392 +#include <linux/if.h>
4393 +#include <linux/netfilter_bridge.h>
4394 +#include <linux/if_ether.h>
4395 +
4396 +#define EBT_TABLE_MAXNAMELEN 32
4397 +#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
4398 +#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
4399 +
4400 +// verdicts >0 are "branches"
4401 +#define EBT_ACCEPT -1
4402 +#define EBT_DROP -2
4403 +#define EBT_CONTINUE -3
4404 +#define EBT_RETURN -4
4405 +#define NUM_STANDARD_TARGETS 4
4406 +
4407 +struct ebt_counter
4408 +{
4409 + uint64_t pcnt;
4410 + uint64_t bcnt;
4411 +};
4412 +
4413 +struct ebt_entries {
4414 + // this field is always set to zero
4415 + // See EBT_ENTRY_OR_ENTRIES.
4416 + // Must be same size as ebt_entry.bitmask
4417 + unsigned int distinguisher;
4418 + // the chain name
4419 + char name[EBT_CHAIN_MAXNAMELEN];
4420 + // counter offset for this chain
4421 + unsigned int counter_offset;
4422 + // one standard (accept, drop, return) per hook
4423 + int policy;
4424 + // nr. of entries
4425 + unsigned int nentries;
4426 + // entry list
4427 + char data[0];
4428 +};
4429 +
4430 +// used for the bitmask of struct ebt_entry
4431 +
4432 +// This is a hack to make a difference between an ebt_entry struct and an
4433 +// ebt_entries struct when traversing the entries from start to end.
4434 +// Using this simplifies the code alot, while still being able to use
4435 +// ebt_entries.
4436 +// Contrary, iptables doesn't use something like ebt_entries and therefore uses
4437 +// different techniques for naming the policy and such. So, iptables doesn't
4438 +// need a hack like this.
4439 +#define EBT_ENTRY_OR_ENTRIES 0x01
4440 +// these are the normal masks
4441 +#define EBT_NOPROTO 0x02
4442 +#define EBT_802_3 0x04
4443 +#define EBT_SOURCEMAC 0x08
4444 +#define EBT_DESTMAC 0x10
4445 +#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
4446 + | EBT_ENTRY_OR_ENTRIES)
4447 +
4448 +#define EBT_IPROTO 0x01
4449 +#define EBT_IIN 0x02
4450 +#define EBT_IOUT 0x04
4451 +#define EBT_ISOURCE 0x8
4452 +#define EBT_IDEST 0x10
4453 +#define EBT_ILOGICALIN 0x20
4454 +#define EBT_ILOGICALOUT 0x40
4455 +#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
4456 + | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
4457 +
4458 +struct ebt_entry_match
4459 +{
4460 + union {
4461 + char name[EBT_FUNCTION_MAXNAMELEN];
4462 + struct ebt_match *match;
4463 + } u;
4464 + // size of data
4465 + unsigned int match_size;
4466 + unsigned char data[0];
4467 +};
4468 +
4469 +struct ebt_entry_watcher
4470 +{
4471 + union {
4472 + char name[EBT_FUNCTION_MAXNAMELEN];
4473 + struct ebt_watcher *watcher;
4474 + } u;
4475 + // size of data
4476 + unsigned int watcher_size;
4477 + unsigned char data[0];
4478 +};
4479 +
4480 +struct ebt_entry_target
4481 +{
4482 + union {
4483 + char name[EBT_FUNCTION_MAXNAMELEN];
4484 + struct ebt_target *target;
4485 + } u;
4486 + // size of data
4487 + unsigned int target_size;
4488 + unsigned char data[0];
4489 +};
4490 +
4491 +#define EBT_STANDARD_TARGET "standard"
4492 +struct ebt_standard_target
4493 +{
4494 + struct ebt_entry_target target;
4495 + int verdict;
4496 +};
4497 +
4498 +// one entry
4499 +struct ebt_entry {
4500 + // this needs to be the first field
4501 + unsigned int bitmask;
4502 + unsigned int invflags;
4503 + uint16_t ethproto;
4504 + // the physical in-dev
4505 + char in[IFNAMSIZ];
4506 + // the logical in-dev
4507 + char logical_in[IFNAMSIZ];
4508 + // the physical out-dev
4509 + char out[IFNAMSIZ];
4510 + // the logical out-dev
4511 + char logical_out[IFNAMSIZ];
4512 + unsigned char sourcemac[ETH_ALEN];
4513 + unsigned char sourcemsk[ETH_ALEN];
4514 + unsigned char destmac[ETH_ALEN];
4515 + unsigned char destmsk[ETH_ALEN];
4516 + // sizeof ebt_entry + matches
4517 + unsigned int watchers_offset;
4518 + // sizeof ebt_entry + matches + watchers
4519 + unsigned int target_offset;
4520 + // sizeof ebt_entry + matches + watchers + target
4521 + unsigned int next_offset;
4522 + unsigned char elems[0];
4523 +};
4524 +
4525 +struct ebt_replace
4526 +{
4527 + char name[EBT_TABLE_MAXNAMELEN];
4528 + unsigned int valid_hooks;
4529 + // nr of rules in the table
4530 + unsigned int nentries;
4531 + // total size of the entries
4532 + unsigned int entries_size;
4533 + // start of the chains
4534 + struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
4535 + // nr of counters userspace expects back
4536 + unsigned int num_counters;
4537 + // where the kernel will put the old counters
4538 + struct ebt_counter *counters;
4539 + char *entries;
4540 +};
4541 +
4542 +// [gs]etsockopt numbers
4543 +#define EBT_BASE_CTL 128
4544 +
4545 +#define EBT_SO_SET_ENTRIES (EBT_BASE_CTL)
4546 +#define EBT_SO_SET_COUNTERS (EBT_SO_SET_ENTRIES+1)
4547 +#define EBT_SO_SET_MAX (EBT_SO_SET_COUNTERS+1)
4548 +
4549 +#define EBT_SO_GET_INFO (EBT_BASE_CTL)
4550 +#define EBT_SO_GET_ENTRIES (EBT_SO_GET_INFO+1)
4551 +#define EBT_SO_GET_INIT_INFO (EBT_SO_GET_ENTRIES+1)
4552 +#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
4553 +#define EBT_SO_GET_MAX (EBT_SO_GET_INIT_ENTRIES+1)
4554 +
4555 +#ifdef __KERNEL__
4556 +
4557 +// return values for match() functions
4558 +#define EBT_MATCH 0
4559 +#define EBT_NOMATCH 1
4560 +
4561 +struct ebt_match
4562 +{
4563 + struct list_head list;
4564 + const char name[EBT_FUNCTION_MAXNAMELEN];
4565 + // 0 == it matches
4566 + int (*match)(const struct sk_buff *skb, const struct net_device *in,
4567 + const struct net_device *out, const void *matchdata,
4568 + unsigned int datalen);
4569 + // 0 == let it in
4570 + int (*check)(const char *tablename, unsigned int hookmask,
4571 + const struct ebt_entry *e, void *matchdata, unsigned int datalen);
4572 + void (*destroy)(void *matchdata, unsigned int datalen);
4573 + struct module *me;
4574 +};
4575 +
4576 +struct ebt_watcher
4577 +{
4578 + struct list_head list;
4579 + const char name[EBT_FUNCTION_MAXNAMELEN];
4580 + void (*watcher)(const struct sk_buff *skb, unsigned int hooknr,
4581 + const struct net_device *in, const struct net_device *out,
4582 + const void *watcherdata, unsigned int datalen);
4583 + // 0 == let it in
4584 + int (*check)(const char *tablename, unsigned int hookmask,
4585 + const struct ebt_entry *e, void *watcherdata, unsigned int datalen);
4586 + void (*destroy)(void *watcherdata, unsigned int datalen);
4587 + struct module *me;
4588 +};
4589 +
4590 +struct ebt_target
4591 +{
4592 + struct list_head list;
4593 + const char name[EBT_FUNCTION_MAXNAMELEN];
4594 + // returns one of the standard verdicts
4595 + int (*target)(struct sk_buff **pskb, unsigned int hooknr,
4596 + const struct net_device *in, const struct net_device *out,
4597 + const void *targetdata, unsigned int datalen);
4598 + // 0 == let it in
4599 + int (*check)(const char *tablename, unsigned int hookmask,
4600 + const struct ebt_entry *e, void *targetdata, unsigned int datalen);
4601 + void (*destroy)(void *targetdata, unsigned int datalen);
4602 + struct module *me;
4603 +};
4604 +
4605 +// used for jumping from and into user defined chains (udc)
4606 +struct ebt_chainstack
4607 +{
4608 + struct ebt_entries *chaininfo; // pointer to chain data
4609 + struct ebt_entry *e; // pointer to entry data
4610 + unsigned int n; // n'th entry
4611 +};
4612 +
4613 +struct ebt_table_info
4614 +{
4615 + // total size of the entries
4616 + unsigned int entries_size;
4617 + unsigned int nentries;
4618 + // pointers to the start of the chains
4619 + struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
4620 + // room to maintain the stack used for jumping from and into udc
4621 + struct ebt_chainstack **chainstack;
4622 + char *entries;
4623 + struct ebt_counter counters[0] ____cacheline_aligned;
4624 +};
4625 +
4626 +struct ebt_table
4627 +{
4628 + struct list_head list;
4629 + char name[EBT_TABLE_MAXNAMELEN];
4630 + struct ebt_replace *table;
4631 + unsigned int valid_hooks;
4632 + rwlock_t lock;
4633 + // e.g. could be the table explicitly only allows certain
4634 + // matches, targets, ... 0 == let it in
4635 + int (*check)(const struct ebt_table_info *info,
4636 + unsigned int valid_hooks);
4637 + // the data used by the kernel
4638 + struct ebt_table_info *private;
4639 +};
4640 +
4641 +#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_entry_target)-1)) & \
4642 + ~(__alignof__(struct ebt_entry_target)-1))
4643 +extern int ebt_register_table(struct ebt_table *table);
4644 +extern void ebt_unregister_table(struct ebt_table *table);
4645 +extern int ebt_register_match(struct ebt_match *match);
4646 +extern void ebt_unregister_match(struct ebt_match *match);
4647 +extern int ebt_register_watcher(struct ebt_watcher *watcher);
4648 +extern void ebt_unregister_watcher(struct ebt_watcher *watcher);
4649 +extern int ebt_register_target(struct ebt_target *target);
4650 +extern void ebt_unregister_target(struct ebt_target *target);
4651 +extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff **pskb,
4652 + const struct net_device *in, const struct net_device *out,
4653 + struct ebt_table *table);
4654 +
4655 + // Used in the kernel match() functions
4656 +#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
4657 +// True if the hook mask denotes that the rule is in a base chain,
4658 +// used in the check() functions
4659 +#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
4660 +// Clear the bit in the hook mask that tells if the rule is on a base chain
4661 +#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
4662 +// True if the target is not a standard target
4663 +#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
4664 +
4665 +#endif /* __KERNEL__ */
4666 +
4667 +// blatently stolen from ip_tables.h
4668 +// fn returns 0 to continue iteration
4669 +#define EBT_MATCH_ITERATE(e, fn, args...) \
4670 +({ \
4671 + unsigned int __i; \
4672 + int __ret = 0; \
4673 + struct ebt_entry_match *__match; \
4674 + \
4675 + for (__i = sizeof(struct ebt_entry); \
4676 + __i < (e)->watchers_offset; \
4677 + __i += __match->match_size + \
4678 + sizeof(struct ebt_entry_match)) { \
4679 + __match = (void *)(e) + __i; \
4680 + \
4681 + __ret = fn(__match , ## args); \
4682 + if (__ret != 0) \
4683 + break; \
4684 + } \
4685 + if (__ret == 0) { \
4686 + if (__i != (e)->watchers_offset) \
4687 + __ret = -EINVAL; \
4688 + } \
4689 + __ret; \
4690 +})
4691 +
4692 +#define EBT_WATCHER_ITERATE(e, fn, args...) \
4693 +({ \
4694 + unsigned int __i; \
4695 + int __ret = 0; \
4696 + struct ebt_entry_watcher *__watcher; \
4697 + \
4698 + for (__i = e->watchers_offset; \
4699 + __i < (e)->target_offset; \
4700 + __i += __watcher->watcher_size + \
4701 + sizeof(struct ebt_entry_watcher)) { \
4702 + __watcher = (void *)(e) + __i; \
4703 + \
4704 + __ret = fn(__watcher , ## args); \
4705 + if (__ret != 0) \
4706 + break; \
4707 + } \
4708 + if (__ret == 0) { \
4709 + if (__i != (e)->target_offset) \
4710 + __ret = -EINVAL; \
4711 + } \
4712 + __ret; \
4713 +})
4714 +
4715 +#define EBT_ENTRY_ITERATE(entries, size, fn, args...) \
4716 +({ \
4717 + unsigned int __i; \
4718 + int __ret = 0; \
4719 + struct ebt_entry *__entry; \
4720 + \
4721 + for (__i = 0; __i < (size);) { \
4722 + __entry = (void *)(entries) + __i; \
4723 + __ret = fn(__entry , ## args); \
4724 + if (__ret != 0) \
4725 + break; \
4726 + if (__entry->bitmask != 0) \
4727 + __i += __entry->next_offset; \
4728 + else \
4729 + __i += sizeof(struct ebt_entries); \
4730 + } \
4731 + if (__ret == 0) { \
4732 + if (__i != (size)) \
4733 + __ret = -EINVAL; \
4734 + } \
4735 + __ret; \
4736 +})
4737 +
4738 +#endif
4739 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4740 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_among.h 2005-09-15 16:57:23.000000000 +0000
4741 @@ -0,0 +1,65 @@
4742 +#ifndef __LINUX_BRIDGE_EBT_AMONG_H
4743 +#define __LINUX_BRIDGE_EBT_AMONG_H
4744 +
4745 +#define EBT_AMONG_DST 0x01
4746 +#define EBT_AMONG_SRC 0x02
4747 +
4748 +/* Grzegorz Borowiak <grzes@gnu.univ.gda.pl> 2003
4749 + *
4750 + * Write-once-read-many hash table, used for checking if a given
4751 + * MAC address belongs to a set or not and possibly for checking
4752 + * if it is related with a given IPv4 address.
4753 + *
4754 + * The hash value of an address is its last byte.
4755 + *
4756 + * In real-world ethernet addresses, values of the last byte are
4757 + * evenly distributed and there is no need to consider other bytes.
4758 + * It would only slow the routines down.
4759 + *
4760 + * For MAC address comparison speedup reasons, we introduce a trick.
4761 + * MAC address is mapped onto an array of two 32-bit integers.
4762 + * This pair of integers is compared with MAC addresses in the
4763 + * hash table, which are stored also in form of pairs of integers
4764 + * (in `cmp' array). This is quick as it requires only two elementary
4765 + * number comparisons in worst case. Further, we take advantage of
4766 + * fact that entropy of 3 last bytes of address is larger than entropy
4767 + * of 3 first bytes. So first we compare 4 last bytes of addresses and
4768 + * if they are the same we compare 2 first.
4769 + *
4770 + * Yes, it is a memory overhead, but in 2003 AD, who cares?
4771 + */
4772 +
4773 +struct ebt_mac_wormhash_tuple
4774 +{
4775 + uint32_t cmp[2];
4776 + uint32_t ip;
4777 +};
4778 +
4779 +struct ebt_mac_wormhash
4780 +{
4781 + int table[257];
4782 + int poolsize;
4783 + struct ebt_mac_wormhash_tuple pool[0];
4784 +};
4785 +
4786 +#define ebt_mac_wormhash_size(x) ((x) ? sizeof(struct ebt_mac_wormhash) \
4787 + + (x)->poolsize * sizeof(struct ebt_mac_wormhash_tuple) : 0)
4788 +
4789 +struct ebt_among_info
4790 +{
4791 + int wh_dst_ofs;
4792 + int wh_src_ofs;
4793 + int bitmask;
4794 +};
4795 +
4796 +#define EBT_AMONG_DST_NEG 0x1
4797 +#define EBT_AMONG_SRC_NEG 0x2
4798 +
4799 +#define ebt_among_wh_dst(x) ((x)->wh_dst_ofs ? \
4800 + (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_dst_ofs) : NULL)
4801 +#define ebt_among_wh_src(x) ((x)->wh_src_ofs ? \
4802 + (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_src_ofs) : NULL)
4803 +
4804 +#define EBT_AMONG_MATCH "among"
4805 +
4806 +#endif
4807 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4808 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_limit.h 2005-09-15 16:57:23.000000000 +0000
4809 @@ -0,0 +1,23 @@
4810 +#ifndef __LINUX_BRIDGE_EBT_LIMIT_H
4811 +#define __LINUX_BRIDGE_EBT_LIMIT_H
4812 +
4813 +#define EBT_LIMIT_MATCH "limit"
4814 +
4815 +/* timings are in milliseconds. */
4816 +#define EBT_LIMIT_SCALE 10000
4817 +
4818 +/* 1/10,000 sec period => max of 10,000/sec. Min rate is then 429490
4819 + seconds, or one every 59 hours. */
4820 +
4821 +struct ebt_limit_info
4822 +{
4823 + u_int32_t avg; /* Average secs between packets * scale */
4824 + u_int32_t burst; /* Period multiplier for upper limit. */
4825 +
4826 + /* Used internally by the kernel */
4827 + unsigned long prev;
4828 + u_int32_t credit;
4829 + u_int32_t credit_cap, cost;
4830 +};
4831 +
4832 +#endif
4833 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4834 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_arpreply.h 2005-09-15 16:57:23.000000000 +0000
4835 @@ -0,0 +1,11 @@
4836 +#ifndef __LINUX_BRIDGE_EBT_ARPREPLY_H
4837 +#define __LINUX_BRIDGE_EBT_ARPREPLY_H
4838 +
4839 +struct ebt_arpreply_info
4840 +{
4841 + unsigned char mac[ETH_ALEN];
4842 + int target;
4843 +};
4844 +#define EBT_ARPREPLY_TARGET "arpreply"
4845 +
4846 +#endif
4847 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4848 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_802_3.h 2005-09-15 16:57:23.000000000 +0000
4849 @@ -0,0 +1,60 @@
4850 +#ifndef __LINUX_BRIDGE_EBT_802_3_H
4851 +#define __LINUX_BRIDGE_EBT_802_3_H
4852 +
4853 +#define EBT_802_3_SAP 0x01
4854 +#define EBT_802_3_TYPE 0x02
4855 +
4856 +#define EBT_802_3_MATCH "802_3"
4857 +
4858 +/*
4859 + * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
4860 + * to discover what kind of packet we're carrying.
4861 + */
4862 +#define CHECK_TYPE 0xaa
4863 +
4864 +/*
4865 + * Control field may be one or two bytes. If the first byte has
4866 + * the value 0x03 then the entire length is one byte, otherwise it is two.
4867 + * One byte controls are used in Unnumbered Information frames.
4868 + * Two byte controls are used in Numbered Information frames.
4869 + */
4870 +#define IS_UI 0x03
4871 +
4872 +#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
4873 +
4874 +/* ui has one byte ctrl, ni has two */
4875 +struct hdr_ui {
4876 + uint8_t dsap;
4877 + uint8_t ssap;
4878 + uint8_t ctrl;
4879 + uint8_t orig[3];
4880 + uint16_t type;
4881 +};
4882 +
4883 +struct hdr_ni {
4884 + uint8_t dsap;
4885 + uint8_t ssap;
4886 + uint16_t ctrl;
4887 + uint8_t orig[3];
4888 + uint16_t type;
4889 +};
4890 +
4891 +struct ebt_802_3_hdr {
4892 + uint8_t daddr[6];
4893 + uint8_t saddr[6];
4894 + uint16_t len;
4895 + union {
4896 + struct hdr_ui ui;
4897 + struct hdr_ni ni;
4898 + } llc;
4899 +};
4900 +
4901 +struct ebt_802_3_info
4902 +{
4903 + uint8_t sap;
4904 + uint16_t type;
4905 + uint8_t bitmask;
4906 + uint8_t invflags;
4907 +};
4908 +
4909 +#endif
4910 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4911 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_arp.h 2005-09-15 16:57:23.000000000 +0000
4912 @@ -0,0 +1,32 @@
4913 +#ifndef __LINUX_BRIDGE_EBT_ARP_H
4914 +#define __LINUX_BRIDGE_EBT_ARP_H
4915 +
4916 +#define EBT_ARP_OPCODE 0x01
4917 +#define EBT_ARP_HTYPE 0x02
4918 +#define EBT_ARP_PTYPE 0x04
4919 +#define EBT_ARP_SRC_IP 0x08
4920 +#define EBT_ARP_DST_IP 0x10
4921 +#define EBT_ARP_SRC_MAC 0x20
4922 +#define EBT_ARP_DST_MAC 0x40
4923 +#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
4924 + EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)
4925 +#define EBT_ARP_MATCH "arp"
4926 +
4927 +struct ebt_arp_info
4928 +{
4929 + uint16_t htype;
4930 + uint16_t ptype;
4931 + uint16_t opcode;
4932 + uint32_t saddr;
4933 + uint32_t smsk;
4934 + uint32_t daddr;
4935 + uint32_t dmsk;
4936 + unsigned char smaddr[ETH_ALEN];
4937 + unsigned char smmsk[ETH_ALEN];
4938 + unsigned char dmaddr[ETH_ALEN];
4939 + unsigned char dmmsk[ETH_ALEN];
4940 + uint8_t bitmask;
4941 + uint8_t invflags;
4942 +};
4943 +
4944 +#endif
4945 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4946 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_ip.h 2005-09-15 16:57:23.000000000 +0000
4947 @@ -0,0 +1,43 @@
4948 +/*
4949 + * ebt_ip
4950 + *
4951 + * Authors:
4952 + * Bart De Schuymer <bart.de.schuymer@pandora.be>
4953 + *
4954 + * April, 2002
4955 + *
4956 + * Changes:
4957 + * added ip-sport and ip-dport
4958 + * Innominate Security Technologies AG <mhopf@innominate.com>
4959 + * September, 2002
4960 + */
4961 +
4962 +#ifndef __LINUX_BRIDGE_EBT_IP_H
4963 +#define __LINUX_BRIDGE_EBT_IP_H
4964 +
4965 +#define EBT_IP_SOURCE 0x01
4966 +#define EBT_IP_DEST 0x02
4967 +#define EBT_IP_TOS 0x04
4968 +#define EBT_IP_PROTO 0x08
4969 +#define EBT_IP_SPORT 0x10
4970 +#define EBT_IP_DPORT 0x20
4971 +#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
4972 + EBT_IP_SPORT | EBT_IP_DPORT )
4973 +#define EBT_IP_MATCH "ip"
4974 +
4975 +// the same values are used for the invflags
4976 +struct ebt_ip_info
4977 +{
4978 + uint32_t saddr;
4979 + uint32_t daddr;
4980 + uint32_t smsk;
4981 + uint32_t dmsk;
4982 + uint8_t tos;
4983 + uint8_t protocol;
4984 + uint8_t bitmask;
4985 + uint8_t invflags;
4986 + uint16_t sport[2];
4987 + uint16_t dport[2];
4988 +};
4989 +
4990 +#endif
4991 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
4992 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_pkttype.h 2005-09-15 16:57:23.000000000 +0000
4993 @@ -0,0 +1,11 @@
4994 +#ifndef __LINUX_BRIDGE_EBT_PKTTYPE_H
4995 +#define __LINUX_BRIDGE_EBT_PKTTYPE_H
4996 +
4997 +struct ebt_pkttype_info
4998 +{
4999 + uint8_t pkt_type;
5000 + uint8_t invert;
5001 +};
5002 +#define EBT_PKTTYPE_MATCH "pkttype"
5003 +
5004 +#endif
5005 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5006 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_stp.h 2005-09-15 16:57:23.000000000 +0000
5007 @@ -0,0 +1,46 @@
5008 +#ifndef __LINUX_BRIDGE_EBT_STP_H
5009 +#define __LINUX_BRIDGE_EBT_STP_H
5010 +
5011 +#define EBT_STP_TYPE 0x0001
5012 +
5013 +#define EBT_STP_FLAGS 0x0002
5014 +#define EBT_STP_ROOTPRIO 0x0004
5015 +#define EBT_STP_ROOTADDR 0x0008
5016 +#define EBT_STP_ROOTCOST 0x0010
5017 +#define EBT_STP_SENDERPRIO 0x0020
5018 +#define EBT_STP_SENDERADDR 0x0040
5019 +#define EBT_STP_PORT 0x0080
5020 +#define EBT_STP_MSGAGE 0x0100
5021 +#define EBT_STP_MAXAGE 0x0200
5022 +#define EBT_STP_HELLOTIME 0x0400
5023 +#define EBT_STP_FWDD 0x0800
5024 +
5025 +#define EBT_STP_MASK 0x0fff
5026 +#define EBT_STP_CONFIG_MASK 0x0ffe
5027 +
5028 +#define EBT_STP_MATCH "stp"
5029 +
5030 +struct ebt_stp_config_info
5031 +{
5032 + uint8_t flags;
5033 + uint16_t root_priol, root_priou;
5034 + char root_addr[6], root_addrmsk[6];
5035 + uint32_t root_costl, root_costu;
5036 + uint16_t sender_priol, sender_priou;
5037 + char sender_addr[6], sender_addrmsk[6];
5038 + uint16_t portl, portu;
5039 + uint16_t msg_agel, msg_ageu;
5040 + uint16_t max_agel, max_ageu;
5041 + uint16_t hello_timel, hello_timeu;
5042 + uint16_t forward_delayl, forward_delayu;
5043 +};
5044 +
5045 +struct ebt_stp_info
5046 +{
5047 + uint8_t type;
5048 + struct ebt_stp_config_info config;
5049 + uint16_t bitmask;
5050 + uint16_t invflags;
5051 +};
5052 +
5053 +#endif
5054 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5055 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_vlan.h 2005-09-15 16:57:23.000000000 +0000
5056 @@ -0,0 +1,20 @@
5057 +#ifndef __LINUX_BRIDGE_EBT_VLAN_H
5058 +#define __LINUX_BRIDGE_EBT_VLAN_H
5059 +
5060 +#define EBT_VLAN_ID 0x01
5061 +#define EBT_VLAN_PRIO 0x02
5062 +#define EBT_VLAN_ENCAP 0x04
5063 +#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
5064 +#define EBT_VLAN_MATCH "vlan"
5065 +
5066 +struct ebt_vlan_info {
5067 + uint16_t id; /* VLAN ID {1-4095} */
5068 + uint8_t prio; /* VLAN User Priority {0-7} */
5069 + uint16_t encap; /* VLAN Encapsulated frame code {0-65535} */
5070 + uint8_t bitmask; /* Args bitmask bit 1=1 - ID arg,
5071 + bit 2=1 User-Priority arg, bit 3=1 encap*/
5072 + uint8_t invflags; /* Inverse bitmask bit 1=1 - inversed ID arg,
5073 + bit 2=1 - inversed Pirority arg */
5074 +};
5075 +
5076 +#endif
5077 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5078 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_log.h 2005-09-15 16:57:23.000000000 +0000
5079 @@ -0,0 +1,17 @@
5080 +#ifndef __LINUX_BRIDGE_EBT_LOG_H
5081 +#define __LINUX_BRIDGE_EBT_LOG_H
5082 +
5083 +#define EBT_LOG_IP 0x01 // if the frame is made by ip, log the ip information
5084 +#define EBT_LOG_ARP 0x02
5085 +#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
5086 +#define EBT_LOG_PREFIX_SIZE 30
5087 +#define EBT_LOG_WATCHER "log"
5088 +
5089 +struct ebt_log_info
5090 +{
5091 + uint8_t loglevel;
5092 + uint8_t prefix[EBT_LOG_PREFIX_SIZE];
5093 + uint32_t bitmask;
5094 +};
5095 +
5096 +#endif
5097 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5098 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_ulog.h 2005-09-15 16:57:23.000000000 +0000
5099 @@ -0,0 +1,33 @@
5100 +#ifndef _EBT_ULOG_H
5101 +#define _EBT_ULOG_H
5102 +
5103 +#define EBT_ULOG_DEFAULT_NLGROUP 0
5104 +#define EBT_ULOG_DEFAULT_QTHRESHOLD 1
5105 +#define EBT_ULOG_MAXNLGROUPS 32 /* hardcoded netlink max */
5106 +#define EBT_ULOG_PREFIX_LEN 32
5107 +#define EBT_ULOG_MAX_QLEN 50
5108 +#define EBT_ULOG_WATCHER "ulog"
5109 +
5110 +struct ebt_ulog_info {
5111 + uint32_t nlgroup;
5112 + unsigned int cprange;
5113 + unsigned int qthreshold;
5114 + char prefix[EBT_ULOG_PREFIX_LEN];
5115 +};
5116 +
5117 +typedef struct ebt_ulog_packet_msg {
5118 + char indev[IFNAMSIZ];
5119 + char outdev[IFNAMSIZ];
5120 + char physindev[IFNAMSIZ];
5121 + char physoutdev[IFNAMSIZ];
5122 + char prefix[EBT_ULOG_PREFIX_LEN];
5123 + struct timeval stamp;
5124 + unsigned long mark;
5125 + unsigned int hook;
5126 + size_t data_len;
5127 + /* The complete packet, including Ethernet header and perhaps
5128 + * the VLAN header is appended */
5129 + unsigned char data[0] __attribute__ ((aligned (__alignof__(int))));
5130 +} ebt_ulog_packet_msg_t;
5131 +
5132 +#endif /* _EBT_ULOG_H */
5133 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5134 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_nat.h 2005-09-15 16:57:23.000000000 +0000
5135 @@ -0,0 +1,13 @@
5136 +#ifndef __LINUX_BRIDGE_EBT_NAT_H
5137 +#define __LINUX_BRIDGE_EBT_NAT_H
5138 +
5139 +struct ebt_nat_info
5140 +{
5141 + unsigned char mac[ETH_ALEN];
5142 + // EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN
5143 + int target;
5144 +};
5145 +#define EBT_SNAT_TARGET "snat"
5146 +#define EBT_DNAT_TARGET "dnat"
5147 +
5148 +#endif
5149 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5150 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_redirect.h 2005-09-15 16:57:23.000000000 +0000
5151 @@ -0,0 +1,11 @@
5152 +#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
5153 +#define __LINUX_BRIDGE_EBT_REDIRECT_H
5154 +
5155 +struct ebt_redirect_info
5156 +{
5157 + // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
5158 + int target;
5159 +};
5160 +#define EBT_REDIRECT_TARGET "redirect"
5161 +
5162 +#endif
5163 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5164 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_mark_m.h 2005-09-15 16:57:23.000000000 +0000
5165 @@ -0,0 +1,15 @@
5166 +#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
5167 +#define __LINUX_BRIDGE_EBT_MARK_M_H
5168 +
5169 +#define EBT_MARK_AND 0x01
5170 +#define EBT_MARK_OR 0x02
5171 +#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
5172 +struct ebt_mark_m_info
5173 +{
5174 + unsigned long mark, mask;
5175 + uint8_t invert;
5176 + uint8_t bitmask;
5177 +};
5178 +#define EBT_MARK_MATCH "mark_m"
5179 +
5180 +#endif
5181 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5182 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_bridge/ebt_mark_t.h 2005-09-15 16:57:23.000000000 +0000
5183 @@ -0,0 +1,12 @@
5184 +#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
5185 +#define __LINUX_BRIDGE_EBT_MARK_T_H
5186 +
5187 +struct ebt_mark_t_info
5188 +{
5189 + unsigned long mark;
5190 + // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
5191 + int target;
5192 +};
5193 +#define EBT_MARK_TARGET "mark"
5194 +
5195 +#endif
5196 --- linux-2.4.31/include/linux/netfilter.h 2005-01-19 14:10:12.000000000 +0000
5197 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter.h 2005-09-15 16:57:23.000000000 +0000
5198 @@ -17,7 +17,8 @@
5199 #define NF_STOLEN 2
5200 #define NF_QUEUE 3
5201 #define NF_REPEAT 4
5202 -#define NF_MAX_VERDICT NF_REPEAT
5203 +#define NF_STOP 5
5204 +#define NF_MAX_VERDICT NF_STOP
5205
5206 /* Generic cache responses from hook functions.
5207 <= 0x2000 is used for protocol-flags. */
5208 @@ -118,17 +119,34 @@ extern struct list_head nf_hooks[NPROTO]
5209 /* This is gross, but inline doesn't cut it for avoiding the function
5210 call in fast path: gcc doesn't inline (needs value tracking?). --RR */
5211 #ifdef CONFIG_NETFILTER_DEBUG
5212 -#define NF_HOOK nf_hook_slow
5213 +#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
5214 +({int __ret; \
5215 +if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
5216 + __ret = (okfn)(skb); \
5217 +__ret;})
5218 +#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
5219 +({int __ret; \
5220 +if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1) \
5221 + __ret = (okfn)(skb); \
5222 +__ret;})
5223 #else
5224 -#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
5225 -(list_empty(&nf_hooks[(pf)][(hook)]) \
5226 - ? (okfn)(skb) \
5227 - : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn)))
5228 +#define NF_HOOK(pf, hook, skb, indev, outdev, okfn) \
5229 +({int __ret; \
5230 +if (list_empty(&nf_hooks[pf][hook]) || \
5231 + (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
5232 + __ret = (okfn)(skb); \
5233 +__ret;})
5234 +#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) \
5235 +({int __ret; \
5236 +if (list_empty(&nf_hooks[pf][hook]) || \
5237 + (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1) \
5238 + __ret = (okfn)(skb); \
5239 +__ret;})
5240 #endif
5241
5242 -int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
5243 +int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
5244 struct net_device *indev, struct net_device *outdev,
5245 - int (*okfn)(struct sk_buff *));
5246 + int (*okfn)(struct sk_buff *), int thresh);
5247
5248 /* Call setsockopt() */
5249 int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
5250 --- linux-2.4.31/include/linux/netfilter_ipv4.h 2002-02-25 19:38:13.000000000 +0000
5251 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_ipv4.h 2005-09-15 16:57:23.000000000 +0000
5252 @@ -52,8 +52,10 @@
5253 enum nf_ip_hook_priorities {
5254 NF_IP_PRI_FIRST = INT_MIN,
5255 NF_IP_PRI_CONNTRACK = -200,
5256 + NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
5257 NF_IP_PRI_MANGLE = -150,
5258 NF_IP_PRI_NAT_DST = -100,
5259 + NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
5260 NF_IP_PRI_FILTER = 0,
5261 NF_IP_PRI_NAT_SRC = 100,
5262 NF_IP_PRI_LAST = INT_MAX,
5263 --- linux-2.4.31/include/linux/netfilter_ipv6.h 2001-01-02 00:17:54.000000000 +0000
5264 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_ipv6.h 2005-09-15 16:57:23.000000000 +0000
5265 @@ -57,8 +57,10 @@
5266 enum nf_ip6_hook_priorities {
5267 NF_IP6_PRI_FIRST = INT_MIN,
5268 NF_IP6_PRI_CONNTRACK = -200,
5269 + NF_IP6_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
5270 NF_IP6_PRI_MANGLE = -150,
5271 NF_IP6_PRI_NAT_DST = -100,
5272 + NF_IP6_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
5273 NF_IP6_PRI_FILTER = 0,
5274 NF_IP6_PRI_NAT_SRC = 100,
5275 NF_IP6_PRI_LAST = INT_MAX,
5276 --- linux-2.4.31/include/linux/skbuff.h 2005-04-04 01:42:20.000000000 +0000
5277 +++ linux-2.4.31-ebt-brnf/include/linux/skbuff.h 2005-09-15 16:57:23.000000000 +0000
5278 @@ -92,6 +92,20 @@ struct nf_conntrack {
5279 struct nf_ct_info {
5280 struct nf_conntrack *master;
5281 };
5282 +
5283 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5284 +struct nf_bridge_info {
5285 + atomic_t use;
5286 + struct net_device *physindev;
5287 + struct net_device *physoutdev;
5288 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
5289 + struct net_device *netoutdev;
5290 +#endif
5291 + unsigned int mask;
5292 + unsigned long data[32 / sizeof(unsigned long)];
5293 +};
5294 +#endif
5295 +
5296 #endif
5297
5298 struct sk_buff_head {
5299 @@ -208,6 +222,9 @@ struct sk_buff {
5300 #ifdef CONFIG_NETFILTER_DEBUG
5301 unsigned int nf_debug;
5302 #endif
5303 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5304 + struct nf_bridge_info *nf_bridge; /* Saved data about a bridged frame - see br_netfilter.c */
5305 +#endif
5306 #endif /*CONFIG_NETFILTER*/
5307
5308 #if defined(CONFIG_HIPPI)
5309 @@ -1171,6 +1188,20 @@ nf_reset(struct sk_buff *skb)
5310 skb->nf_debug = 0;
5311 #endif
5312 }
5313 +
5314 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5315 +static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
5316 +{
5317 + if (nf_bridge && atomic_dec_and_test(&nf_bridge->use))
5318 + kfree(nf_bridge);
5319 +}
5320 +static inline void nf_bridge_get(struct nf_bridge_info *nf_bridge)
5321 +{
5322 + if (nf_bridge)
5323 + atomic_inc(&nf_bridge->use);
5324 +}
5325 +#endif
5326 +
5327 #else /* CONFIG_NETFILTER */
5328 static inline void nf_reset(struct sk_buff *skb) {}
5329 #endif /* CONFIG_NETFILTER */
5330 --- linux-2.4.31/net/core/netfilter.c 2005-01-19 14:10:13.000000000 +0000
5331 +++ linux-2.4.31-ebt-brnf/net/core/netfilter.c 2005-09-15 16:57:23.000000000 +0000
5332 @@ -342,32 +342,29 @@ static unsigned int nf_iterate(struct li
5333 const struct net_device *indev,
5334 const struct net_device *outdev,
5335 struct list_head **i,
5336 - int (*okfn)(struct sk_buff *))
5337 + int (*okfn)(struct sk_buff *),
5338 + int hook_thresh)
5339 {
5340 + unsigned int verdict;
5341 +
5342 for (*i = (*i)->next; *i != head; *i = (*i)->next) {
5343 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
5344 - switch (elem->hook(hook, skb, indev, outdev, okfn)) {
5345 - case NF_QUEUE:
5346 - return NF_QUEUE;
5347 -
5348 - case NF_STOLEN:
5349 - return NF_STOLEN;
5350 -
5351 - case NF_DROP:
5352 - return NF_DROP;
5353
5354 - case NF_REPEAT:
5355 - *i = (*i)->prev;
5356 - break;
5357 + if (hook_thresh > elem->priority)
5358 + continue;
5359
5360 + verdict = elem->hook(hook, skb, indev, outdev, okfn);
5361 + if (verdict != NF_ACCEPT) {
5362 #ifdef CONFIG_NETFILTER_DEBUG
5363 - case NF_ACCEPT:
5364 - break;
5365 -
5366 - default:
5367 - NFDEBUG("Evil return from %p(%u).\n",
5368 - elem->hook, hook);
5369 + if (unlikely(verdict > NF_MAX_VERDICT)) {
5370 + NFDEBUG("Evil return from %p(%u).\n",
5371 + elem->hook, hook);
5372 + continue;
5373 + }
5374 #endif
5375 + if (verdict != NF_REPEAT)
5376 + return verdict;
5377 + *i = (*i)->prev;
5378 }
5379 }
5380 return NF_ACCEPT;
5381 @@ -413,6 +410,10 @@ static void nf_queue(struct sk_buff *skb
5382 {
5383 int status;
5384 struct nf_info *info;
5385 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5386 + struct net_device *physindev = NULL;
5387 + struct net_device *physoutdev = NULL;
5388 +#endif
5389
5390 if (!queue_handler[pf].outfn) {
5391 kfree_skb(skb);
5392 @@ -435,36 +436,52 @@ static void nf_queue(struct sk_buff *skb
5393 if (indev) dev_hold(indev);
5394 if (outdev) dev_hold(outdev);
5395
5396 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5397 + if (skb->nf_bridge) {
5398 + physindev = skb->nf_bridge->physindev;
5399 + if (physindev) dev_hold(physindev);
5400 + physoutdev = skb->nf_bridge->physoutdev;
5401 + if (physoutdev) dev_hold(physoutdev);
5402 + }
5403 +#endif
5404 +
5405 status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data);
5406 if (status < 0) {
5407 /* James M doesn't say fuck enough. */
5408 if (indev) dev_put(indev);
5409 if (outdev) dev_put(outdev);
5410 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5411 + if (physindev) dev_put(physindev);
5412 + if (physoutdev) dev_put(physoutdev);
5413 +#endif
5414 kfree(info);
5415 kfree_skb(skb);
5416 return;
5417 }
5418 }
5419
5420 -int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
5421 +/* Returns 1 if okfn() needs to be executed by the caller,
5422 + * -EPERM for NF_DROP, 0 otherwise. */
5423 +int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
5424 struct net_device *indev,
5425 struct net_device *outdev,
5426 - int (*okfn)(struct sk_buff *))
5427 + int (*okfn)(struct sk_buff *),
5428 + int hook_thresh)
5429 {
5430 struct list_head *elem;
5431 unsigned int verdict;
5432 int ret = 0;
5433
5434 /* This stopgap cannot be removed until all the hooks are audited. */
5435 - if (skb_is_nonlinear(skb) && skb_linearize(skb, GFP_ATOMIC) != 0) {
5436 - kfree_skb(skb);
5437 + if (skb_is_nonlinear(*pskb) && skb_linearize(*pskb, GFP_ATOMIC) != 0) {
5438 + kfree_skb(*pskb);
5439 return -ENOMEM;
5440 }
5441 - if (skb->ip_summed == CHECKSUM_HW) {
5442 + if ((*pskb)->ip_summed == CHECKSUM_HW) {
5443 if (outdev == NULL) {
5444 - skb->ip_summed = CHECKSUM_NONE;
5445 + (*pskb)->ip_summed = CHECKSUM_NONE;
5446 } else {
5447 - skb_checksum_help(skb);
5448 + skb_checksum_help(*pskb);
5449 }
5450 }
5451
5452 @@ -472,30 +489,24 @@ int nf_hook_slow(int pf, unsigned int ho
5453 br_read_lock_bh(BR_NETPROTO_LOCK);
5454
5455 #ifdef CONFIG_NETFILTER_DEBUG
5456 - if (skb->nf_debug & (1 << hook)) {
5457 + if (unlikely((*pskb)->nf_debug & (1 << hook))) {
5458 printk("nf_hook: hook %i already set.\n", hook);
5459 - nf_dump_skb(pf, skb);
5460 + nf_dump_skb(pf, *pskb);
5461 }
5462 - skb->nf_debug |= (1 << hook);
5463 + (*pskb)->nf_debug |= (1 << hook);
5464 #endif
5465
5466 elem = &nf_hooks[pf][hook];
5467 - verdict = nf_iterate(&nf_hooks[pf][hook], &skb, hook, indev,
5468 - outdev, &elem, okfn);
5469 - if (verdict == NF_QUEUE) {
5470 - NFDEBUG("nf_hook: Verdict = QUEUE.\n");
5471 - nf_queue(skb, elem, pf, hook, indev, outdev, okfn);
5472 - }
5473 -
5474 - switch (verdict) {
5475 - case NF_ACCEPT:
5476 - ret = okfn(skb);
5477 - break;
5478 -
5479 - case NF_DROP:
5480 - kfree_skb(skb);
5481 + verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
5482 + outdev, &elem, okfn, hook_thresh);
5483 + if (verdict == NF_ACCEPT || verdict == NF_STOP)
5484 + ret = 1;
5485 + else if (verdict == NF_DROP) {
5486 + kfree_skb(*pskb);
5487 ret = -EPERM;
5488 - break;
5489 + } else if (verdict == NF_QUEUE) {
5490 + NFDEBUG("nf_hook: Verdict = QUEUE.\n");
5491 + nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn);
5492 }
5493
5494 br_read_unlock_bh(BR_NETPROTO_LOCK);
5495 @@ -510,6 +521,14 @@ void nf_reinject(struct sk_buff *skb, st
5496
5497 /* We don't have BR_NETPROTO_LOCK here */
5498 br_read_lock_bh(BR_NETPROTO_LOCK);
5499 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5500 + if (skb->nf_bridge) {
5501 + if (skb->nf_bridge->physindev)
5502 + dev_put(skb->nf_bridge->physindev);
5503 + if (skb->nf_bridge->physoutdev)
5504 + dev_put(skb->nf_bridge->physoutdev);
5505 + }
5506 +#endif
5507 for (i = nf_hooks[info->pf][info->hook].next; i != elem; i = i->next) {
5508 if (i == &nf_hooks[info->pf][info->hook]) {
5509 /* The module which sent it to userspace is gone. */
5510 @@ -530,7 +549,7 @@ void nf_reinject(struct sk_buff *skb, st
5511 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
5512 &skb, info->hook,
5513 info->indev, info->outdev, &elem,
5514 - info->okfn);
5515 + info->okfn, INT_MIN);
5516 }
5517
5518 switch (verdict) {
5519 --- linux-2.4.31/net/core/skbuff.c 2003-08-25 11:44:44.000000000 +0000
5520 +++ linux-2.4.31-ebt-brnf/net/core/skbuff.c 2005-09-15 16:57:23.000000000 +0000
5521 @@ -246,6 +246,9 @@ static inline void skb_headerinit(void *
5522 #ifdef CONFIG_NETFILTER_DEBUG
5523 skb->nf_debug = 0;
5524 #endif
5525 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5526 + skb->nf_bridge = NULL;
5527 +#endif
5528 #endif
5529 #ifdef CONFIG_NET_SCHED
5530 skb->tc_index = 0;
5531 @@ -326,6 +329,9 @@ void __kfree_skb(struct sk_buff *skb)
5532 }
5533 #ifdef CONFIG_NETFILTER
5534 nf_conntrack_put(skb->nfct);
5535 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5536 + nf_bridge_put(skb->nf_bridge);
5537 +#endif
5538 #endif
5539 skb_headerinit(skb, NULL, 0); /* clean state */
5540 kfree_skbmem(skb);
5541 @@ -393,6 +399,9 @@ struct sk_buff *skb_clone(struct sk_buff
5542 #ifdef CONFIG_NETFILTER_DEBUG
5543 C(nf_debug);
5544 #endif
5545 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5546 + C(nf_bridge);
5547 +#endif
5548 #endif /*CONFIG_NETFILTER*/
5549 #if defined(CONFIG_HIPPI)
5550 C(private);
5551 @@ -405,6 +414,9 @@ struct sk_buff *skb_clone(struct sk_buff
5552 skb->cloned = 1;
5553 #ifdef CONFIG_NETFILTER
5554 nf_conntrack_get(skb->nfct);
5555 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5556 + nf_bridge_get(skb->nf_bridge);
5557 +#endif
5558 #endif
5559 return n;
5560 }
5561 @@ -440,6 +452,10 @@ static void copy_skb_header(struct sk_bu
5562 #ifdef CONFIG_NETFILTER_DEBUG
5563 new->nf_debug=old->nf_debug;
5564 #endif
5565 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5566 + new->nf_bridge=old->nf_bridge;
5567 + nf_bridge_get(new->nf_bridge);
5568 +#endif
5569 #endif
5570 #ifdef CONFIG_NET_SCHED
5571 new->tc_index = old->tc_index;
5572 @@ -726,9 +742,9 @@ struct sk_buff *skb_copy_expand(const st
5573 /* Set the tail pointer and length */
5574 skb_put(n,skb->len);
5575
5576 - /* Copy the data only. */
5577 - if (skb_copy_bits(skb, 0, n->data, skb->len))
5578 - BUG();
5579 + /* Copy the linear data and header. */
5580 + if (skb_copy_bits(skb, -newheadroom, n->head, newheadroom + skb->len))
5581 + BUG();
5582
5583 copy_skb_header(n, skb);
5584 return n;
5585 --- linux-2.4.31/net/ipv4/netfilter/ip_tables.c 2005-04-04 01:42:20.000000000 +0000
5586 +++ linux-2.4.31-ebt-brnf/net/ipv4/netfilter/ip_tables.c 2005-09-15 16:57:23.000000000 +0000
5587 @@ -120,12 +120,19 @@ static LIST_HEAD(ipt_tables);
5588 static inline int
5589 ip_packet_match(const struct iphdr *ip,
5590 const char *indev,
5591 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5592 + const char *physindev,
5593 +#endif
5594 const char *outdev,
5595 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5596 + const char *physoutdev,
5597 +#endif
5598 const struct ipt_ip *ipinfo,
5599 int isfrag)
5600 {
5601 size_t i;
5602 unsigned long ret;
5603 + unsigned long ret2 = 1;
5604
5605 #define FWINV(bool,invflg) ((bool) ^ !!(ipinfo->invflags & invflg))
5606
5607 @@ -155,7 +162,15 @@ ip_packet_match(const struct iphdr *ip,
5608 & ((const unsigned long *)ipinfo->iniface_mask)[i];
5609 }
5610
5611 - if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
5612 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5613 + for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5614 + ret2 |= (((const unsigned long *)physindev)[i]
5615 + ^ ((const unsigned long *)ipinfo->iniface)[i])
5616 + & ((const unsigned long *)ipinfo->iniface_mask)[i];
5617 + }
5618 +#endif
5619 +
5620 + if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_IN)) {
5621 dprintf("VIA in mismatch (%s vs %s).%s\n",
5622 indev, ipinfo->iniface,
5623 ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
5624 @@ -168,7 +183,15 @@ ip_packet_match(const struct iphdr *ip,
5625 & ((const unsigned long *)ipinfo->outiface_mask)[i];
5626 }
5627
5628 - if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
5629 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5630 + for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5631 + ret2 |= (((const unsigned long *)physoutdev)[i]
5632 + ^ ((const unsigned long *)ipinfo->outiface)[i])
5633 + & ((const unsigned long *)ipinfo->outiface_mask)[i];
5634 + }
5635 +#endif
5636 +
5637 + if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_OUT)) {
5638 dprintf("VIA out mismatch (%s vs %s).%s\n",
5639 outdev, ipinfo->outiface,
5640 ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
5641 @@ -267,6 +290,9 @@ ipt_do_table(struct sk_buff **pskb,
5642 /* Initializing verdict to NF_DROP keeps gcc happy. */
5643 unsigned int verdict = NF_DROP;
5644 const char *indev, *outdev;
5645 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5646 + const char *physindev, *physoutdev;
5647 +#endif
5648 void *table_base;
5649 struct ipt_entry *e, *back;
5650
5651 @@ -276,6 +302,13 @@ ipt_do_table(struct sk_buff **pskb,
5652 datalen = (*pskb)->len - ip->ihl * 4;
5653 indev = in ? in->name : nulldevname;
5654 outdev = out ? out->name : nulldevname;
5655 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5656 + physindev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physindev) ?
5657 + (*pskb)->nf_bridge->physindev->name : nulldevname;
5658 + physoutdev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physoutdev) ?
5659 + (*pskb)->nf_bridge->physoutdev->name : nulldevname;
5660 +#endif
5661 +
5662 /* We handle fragments by dealing with the first fragment as
5663 * if it was a normal packet. All other fragments are treated
5664 * normally, except that they will NEVER match rules that ask
5665 @@ -311,7 +344,15 @@ ipt_do_table(struct sk_buff **pskb,
5666 IP_NF_ASSERT(e);
5667 IP_NF_ASSERT(back);
5668 (*pskb)->nfcache |= e->nfcache;
5669 - if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
5670 + if (ip_packet_match(ip, indev,
5671 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5672 + physindev,
5673 +#endif
5674 + outdev,
5675 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5676 + physoutdev,
5677 +#endif
5678 + &e->ip, offset)) {
5679 struct ipt_entry_target *t;
5680
5681 if (IPT_MATCH_ITERATE(e, do_match,
5682 --- linux-2.4.31/net/ipv4/ip_output.c 2005-01-19 14:10:13.000000000 +0000
5683 +++ linux-2.4.31-ebt-brnf/net/ipv4/ip_output.c 2005-09-15 16:57:23.000000000 +0000
5684 @@ -77,6 +77,7 @@
5685 #include <linux/netfilter_ipv4.h>
5686 #include <linux/mroute.h>
5687 #include <linux/netlink.h>
5688 +#include <linux/netfilter_bridge.h>
5689
5690 /*
5691 * Shall we try to damage output packets if routing dev changes?
5692 @@ -769,7 +770,8 @@ int ip_fragment(struct sk_buff *skb, int
5693 int not_last_frag;
5694 struct rtable *rt = (struct rtable*)skb->dst;
5695 int err = 0;
5696 -
5697 + unsigned int ll_rs = 0;
5698 +
5699 dev = rt->u.dst.dev;
5700
5701 /*
5702 @@ -785,6 +787,10 @@ int ip_fragment(struct sk_buff *skb, int
5703 hlen = iph->ihl * 4;
5704 left = skb->len - hlen; /* Space per frame */
5705 mtu = rt->u.dst.pmtu - hlen; /* Size of data space */
5706 +#ifdef CONFIG_NETFILTER
5707 + ll_rs = nf_bridge_pad(skb);
5708 + mtu -= ll_rs;
5709 +#endif
5710 ptr = raw + hlen; /* Where to start from */
5711
5712 /*
5713 @@ -812,7 +818,7 @@ int ip_fragment(struct sk_buff *skb, int
5714 * Allocate buffer.
5715 */
5716
5717 - if ((skb2 = alloc_skb(len+hlen+dev->hard_header_len+15,GFP_ATOMIC)) == NULL) {
5718 + if ((skb2 = alloc_skb(len+hlen+dev->hard_header_len+15+ll_rs,GFP_ATOMIC)) == NULL) {
5719 NETDEBUG(printk(KERN_INFO "IP: frag: no memory for new fragment!\n"));
5720 err = -ENOMEM;
5721 goto fail;
5722 @@ -824,7 +830,7 @@ int ip_fragment(struct sk_buff *skb, int
5723
5724 skb2->pkt_type = skb->pkt_type;
5725 skb2->priority = skb->priority;
5726 - skb_reserve(skb2, (dev->hard_header_len+15)&~15);
5727 + skb_reserve(skb2, (dev->hard_header_len+15+ll_rs)&~15);
5728 skb_put(skb2, len + hlen);
5729 skb2->nh.raw = skb2->data;
5730 skb2->h.raw = skb2->data + hlen;
5731 @@ -890,6 +896,10 @@ int ip_fragment(struct sk_buff *skb, int
5732 /* Connection association is same as pre-frag packet */
5733 skb2->nfct = skb->nfct;
5734 nf_conntrack_get(skb2->nfct);
5735 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5736 + skb2->nf_bridge = skb->nf_bridge;
5737 + nf_bridge_get(skb2->nf_bridge);
5738 +#endif
5739 #ifdef CONFIG_NETFILTER_DEBUG
5740 skb2->nf_debug = skb->nf_debug;
5741 #endif
5742 --- linux-2.4.31/net/ipv4/netfilter/ipt_LOG.c 2005-04-04 01:42:20.000000000 +0000
5743 +++ linux-2.4.31-ebt-brnf/net/ipv4/netfilter/ipt_LOG.c 2005-09-15 16:57:23.000000000 +0000
5744 @@ -317,6 +317,18 @@ ipt_log_target(struct sk_buff **pskb,
5745 loginfo->prefix,
5746 in ? in->name : "",
5747 out ? out->name : "");
5748 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5749 + if ((*pskb)->nf_bridge) {
5750 + struct net_device *physindev = (*pskb)->nf_bridge->physindev;
5751 + struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
5752 +
5753 + if (physindev && in != physindev)
5754 + printk("PHYSIN=%s ", physindev->name);
5755 + if (physoutdev && out != physoutdev)
5756 + printk("PHYSOUT=%s ", physoutdev->name);
5757 + }
5758 +#endif
5759 +
5760 if (in && !out) {
5761 /* MAC logging for input chain only. */
5762 printk("MAC=");
5763 --- linux-2.4.31/net/ipv4/netfilter/Makefile 2003-08-25 11:44:44.000000000 +0000
5764 +++ linux-2.4.31-ebt-brnf/net/ipv4/netfilter/Makefile 2005-09-15 16:57:23.000000000 +0000
5765 @@ -87,6 +87,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i
5766 obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
5767 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
5768
5769 +obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
5770 +
5771 # targets
5772 obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
5773 obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o
5774 --- linux-2.4.31/net/ipv4/netfilter/Config.in 2005-01-19 14:10:13.000000000 +0000
5775 +++ linux-2.4.31-ebt-brnf/net/ipv4/netfilter/Config.in 2005-09-15 16:57:23.000000000 +0000
5776 @@ -44,6 +44,9 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
5777 dep_tristate ' Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
5778 dep_tristate ' Owner match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_OWNER $CONFIG_IP_NF_IPTABLES
5779 fi
5780 + if [ "$CONFIG_BRIDGE" != "n" ]; then
5781 + dep_tristate ' Physdev match support' CONFIG_IP_NF_MATCH_PHYSDEV $CONFIG_IP_NF_IPTABLES
5782 + fi
5783 # The targets
5784 dep_tristate ' Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
5785 if [ "$CONFIG_IP_NF_FILTER" != "n" ]; then
5786 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
5787 +++ linux-2.4.31-ebt-brnf/net/bridge/br_netfilter.c 2005-09-15 17:00:24.000000000 +0000
5788 @@ -0,0 +1,1102 @@
5789 +/*
5790 + * Handle firewalling
5791 + * Linux ethernet bridge
5792 + *
5793 + * Authors:
5794 + * Lennert Buytenhek <buytenh@gnu.org>
5795 + * Bart De Schuymer (maintainer) <bdschuym@pandora.be>
5796 + *
5797 + * Changes:
5798 + * Apr 29 2003: physdev module support (bdschuym)
5799 + * Jun 19 2003: let arptables see bridged ARP traffic (bdschuym)
5800 + * Oct 06 2003: filter encapsulated IP/ARP VLAN traffic on untagged bridge
5801 + * (bdschuym)
5802 + * Aug 28 2004: add IPv6 filtering (bdschuym)
5803 + *
5804 + * This program is free software; you can redistribute it and/or
5805 + * modify it under the terms of the GNU General Public License
5806 + * as published by the Free Software Foundation; either version
5807 + * 2 of the License, or (at your option) any later version.
5808 + *
5809 + * Lennert dedicates this file to Kerstin Wurdinger.
5810 + */
5811 +
5812 +#include <linux/module.h>
5813 +#include <linux/kernel.h>
5814 +#include <linux/ip.h>
5815 +#include <linux/netdevice.h>
5816 +#include <linux/skbuff.h>
5817 +#include <linux/if_ether.h>
5818 +#include <linux/if_vlan.h>
5819 +#include <linux/netfilter_bridge.h>
5820 +#include <linux/netfilter_ipv4.h>
5821 +#include <linux/netfilter_ipv6.h>
5822 +#include <linux/in_route.h>
5823 +#include <net/ip.h>
5824 +#include <net/ipv6.h>
5825 +#include <asm/uaccess.h>
5826 +#include <asm/checksum.h>
5827 +#include "br_private.h"
5828 +#ifdef CONFIG_SYSCTL
5829 +#include <linux/sysctl.h>
5830 +#endif
5831 +
5832 +#define skb_origaddr(skb) (((struct bridge_skb_cb *) \
5833 + (skb->nf_bridge->data))->daddr.ipv4)
5834 +#define store_orig_dstaddr(skb) (skb_origaddr(skb) = (skb)->nh.iph->daddr)
5835 +#define dnat_took_place(skb) (skb_origaddr(skb) != (skb)->nh.iph->daddr)
5836 +
5837 +#define has_bridge_parent(device) ((device)->br_port != NULL)
5838 +#define bridge_parent(device) (&((device)->br_port->br->dev))
5839 +
5840 +#ifdef CONFIG_SYSCTL
5841 +static struct ctl_table_header *brnf_sysctl_header;
5842 +static int brnf_call_iptables = 1;
5843 +static int brnf_call_ip6tables = 1;
5844 +static int brnf_call_arptables = 1;
5845 +static int brnf_filter_vlan_tagged = 1;
5846 +#else
5847 +#define brnf_filter_vlan_tagged 1
5848 +#endif
5849 +
5850 +#define IS_VLAN_IP (skb->protocol == __constant_htons(ETH_P_8021Q) && \
5851 + hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_IP) && \
5852 + brnf_filter_vlan_tagged)
5853 +#define IS_VLAN_IPV6 (skb->protocol == __constant_htons(ETH_P_8021Q) && \
5854 + hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_IPV6) && \
5855 + brnf_filter_vlan_tagged)
5856 +/*
5857 +#define IS_VLAN_ARP (skb->protocol == __constant_htons(ETH_P_8021Q) && \
5858 + hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_ARP) && \
5859 + brnf_filter_vlan_tagged)
5860 +*/
5861 +
5862 +/* We need these fake structures to make netfilter happy --
5863 + * lots of places assume that skb->dst != NULL, which isn't
5864 + * all that unreasonable.
5865 + *
5866 + * Currently, we fill in the PMTU entry because netfilter
5867 + * refragmentation needs it, and the rt_flags entry because
5868 + * ipt_REJECT needs it. Future netfilter modules might
5869 + * require us to fill additional fields.
5870 + */
5871 +static struct net_device __fake_net_device = {
5872 + .hard_header_len = ETH_HLEN
5873 +};
5874 +
5875 +static struct rtable __fake_rtable = {
5876 + u: {
5877 + dst: {
5878 + __refcnt: ATOMIC_INIT(1),
5879 + dev: &__fake_net_device,
5880 + pmtu: 1500
5881 + }
5882 + },
5883 +
5884 + rt_flags: 0
5885 +};
5886 +
5887 +
5888 +/* PF_BRIDGE/PRE_ROUTING *********************************************/
5889 +/* Undo the changes made for ip6tables PREROUTING and continue the
5890 + * bridge PRE_ROUTING hook. */
5891 +static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
5892 +{
5893 + struct nf_bridge_info *nf_bridge = skb->nf_bridge;
5894 +
5895 +#ifdef CONFIG_NETFILTER_DEBUG
5896 + skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
5897 +#endif
5898 +
5899 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
5900 + skb->pkt_type = PACKET_OTHERHOST;
5901 + nf_bridge->mask ^= BRNF_PKT_TYPE;
5902 + }
5903 + nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
5904 +
5905 + skb->dst = (struct dst_entry *)&__fake_rtable;
5906 + dst_hold(skb->dst);
5907 +
5908 + skb->dev = nf_bridge->physindev;
5909 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
5910 + skb_push(skb, VLAN_HLEN);
5911 + skb->nh.raw -= VLAN_HLEN;
5912 + }
5913 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
5914 + br_handle_frame_finish, 1);
5915 +
5916 + return 0;
5917 +}
5918 +
5919 +static void __br_dnat_complain(void)
5920 +{
5921 + static unsigned long last_complaint;
5922 +
5923 + if (jiffies - last_complaint >= 5 * HZ) {
5924 + printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
5925 + "forwarding to be enabled\n");
5926 + last_complaint = jiffies;
5927 + }
5928 +}
5929 +
5930 +
5931 +/* This requires some explaining. If DNAT has taken place,
5932 + * we will need to fix up the destination Ethernet address,
5933 + * and this is a tricky process.
5934 + *
5935 + * There are two cases to consider:
5936 + * 1. The packet was DNAT'ed to a device in the same bridge
5937 + * port group as it was received on. We can still bridge
5938 + * the packet.
5939 + * 2. The packet was DNAT'ed to a different device, either
5940 + * a non-bridged device or another bridge port group.
5941 + * The packet will need to be routed.
5942 + *
5943 + * The correct way of distinguishing between these two cases is to
5944 + * call ip_route_input() and to look at skb->dst->dev, which is
5945 + * changed to the destination device if ip_route_input() succeeds.
5946 + *
5947 + * Let us first consider the case that ip_route_input() succeeds:
5948 + *
5949 + * If skb->dst->dev equals the logical bridge device the packet
5950 + * came in on, we can consider this bridging. We then call
5951 + * skb->dst->output() which will make the packet enter br_nf_local_out()
5952 + * not much later. In that function it is assured that the iptables
5953 + * FORWARD chain is traversed for the packet.
5954 + *
5955 + * Otherwise, the packet is considered to be routed and we just
5956 + * change the destination MAC address so that the packet will
5957 + * later be passed up to the IP stack to be routed.
5958 + *
5959 + * Let us now consider the case that ip_route_input() fails:
5960 + *
5961 + * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
5962 + * will fail, while __ip_route_output_key() will return success. The source
5963 + * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
5964 + * thinks we're handling a locally generated packet and won't care
5965 + * if IP forwarding is allowed. We send a warning message to the users's
5966 + * log telling her to put IP forwarding on.
5967 + *
5968 + * ip_route_input() will also fail if there is no route available.
5969 + * In that case we just drop the packet.
5970 + *
5971 + * --Lennert, 20020411
5972 + * --Bart, 20020416 (updated)
5973 + * --Bart, 20021007 (updated)
5974 + */
5975 +
5976 +static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
5977 +{
5978 +#ifdef CONFIG_NETFILTER_DEBUG
5979 + skb->nf_debug |= (1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_FORWARD);
5980 +#endif
5981 +
5982 + if (skb->pkt_type == PACKET_OTHERHOST) {
5983 + skb->pkt_type = PACKET_HOST;
5984 + skb->nf_bridge->mask |= BRNF_PKT_TYPE;
5985 + }
5986 + skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
5987 +
5988 + skb->dev = bridge_parent(skb->dev);
5989 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
5990 + skb_pull(skb, VLAN_HLEN);
5991 + skb->nh.raw += VLAN_HLEN;
5992 + }
5993 + skb->dst->output(skb);
5994 + return 0;
5995 +}
5996 +
5997 +static int br_nf_pre_routing_finish(struct sk_buff *skb)
5998 +{
5999 + struct net_device *dev = skb->dev;
6000 + struct iphdr *iph = skb->nh.iph;
6001 + struct nf_bridge_info *nf_bridge = skb->nf_bridge;
6002 +
6003 +#ifdef CONFIG_NETFILTER_DEBUG
6004 + skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
6005 +#endif
6006 +
6007 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
6008 + skb->pkt_type = PACKET_OTHERHOST;
6009 + nf_bridge->mask ^= BRNF_PKT_TYPE;
6010 + }
6011 + nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
6012 +
6013 + if (dnat_took_place(skb)) {
6014 + if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
6015 + dev)) {
6016 + struct rtable *rt;
6017 +
6018 + if (!ip_route_output(&rt, iph->daddr, 0, iph->tos, 0)) {
6019 + /* - Bridged-and-DNAT'ed traffic doesn't
6020 + * require ip_forwarding.
6021 + * - Deal with redirected traffic. */
6022 + if (((struct dst_entry *)rt)->dev == dev ||
6023 + rt->rt_type == RTN_LOCAL) {
6024 + skb->dst = (struct dst_entry *)rt;
6025 + goto bridged_dnat;
6026 + }
6027 + __br_dnat_complain();
6028 + dst_release((struct dst_entry *)rt);
6029 + }
6030 + kfree_skb(skb);
6031 + return 0;
6032 + } else {
6033 + if (skb->dst->dev == dev) {
6034 +bridged_dnat:
6035 + /* Tell br_nf_local_out this is a
6036 + * bridged frame
6037 + */
6038 + nf_bridge->mask |= BRNF_BRIDGED_DNAT;
6039 + skb->dev = nf_bridge->physindev;
6040 + if (skb->protocol ==
6041 + __constant_htons(ETH_P_8021Q)) {
6042 + skb_push(skb, VLAN_HLEN);
6043 + skb->nh.raw -= VLAN_HLEN;
6044 + }
6045 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
6046 + skb, skb->dev, NULL,
6047 + br_nf_pre_routing_finish_bridge,
6048 + 1);
6049 + return 0;
6050 + }
6051 + memcpy(skb->mac.ethernet->h_dest, dev->dev_addr,
6052 + ETH_ALEN);
6053 + skb->pkt_type = PACKET_HOST;
6054 + }
6055 + } else {
6056 + skb->dst = (struct dst_entry *)&__fake_rtable;
6057 + dst_hold(skb->dst);
6058 + }
6059 +
6060 + skb->dev = nf_bridge->physindev;
6061 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6062 + skb_push(skb, VLAN_HLEN);
6063 + skb->nh.raw -= VLAN_HLEN;
6064 + }
6065 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
6066 + br_handle_frame_finish, 1);
6067 +
6068 + return 0;
6069 +}
6070 +
6071 +/* Some common code for IPv4/IPv6 */
6072 +static void setup_pre_routing(struct sk_buff *skb)
6073 +{
6074 + struct nf_bridge_info *nf_bridge = skb->nf_bridge;
6075 +
6076 + if (skb->pkt_type == PACKET_OTHERHOST) {
6077 + skb->pkt_type = PACKET_HOST;
6078 + nf_bridge->mask |= BRNF_PKT_TYPE;
6079 + }
6080 +
6081 + nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
6082 + nf_bridge->physindev = skb->dev;
6083 + skb->dev = bridge_parent(skb->dev);
6084 +}
6085 +
6086 +/* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */
6087 +static int check_hbh_len(struct sk_buff *skb)
6088 +{
6089 + unsigned char *raw = (u8*)(skb->nh.ipv6h+1);
6090 + u32 pkt_len;
6091 + int off = raw - skb->nh.raw;
6092 + int len = (raw[1]+1)<<3;
6093 +
6094 + if ((raw + len) - skb->data > skb_headlen(skb))
6095 + goto bad;
6096 +
6097 + off += 2;
6098 + len -= 2;
6099 +
6100 + while (len > 0) {
6101 + int optlen = raw[off+1]+2;
6102 +
6103 + switch (skb->nh.raw[off]) {
6104 + case IPV6_TLV_PAD0:
6105 + optlen = 1;
6106 + break;
6107 +
6108 + case IPV6_TLV_PADN:
6109 + break;
6110 +
6111 + case IPV6_TLV_JUMBO:
6112 + if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
6113 + goto bad;
6114 +
6115 + pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
6116 +
6117 + if (pkt_len > skb->len - sizeof(struct ipv6hdr))
6118 + goto bad;
6119 + if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
6120 + if (__pskb_trim(skb,
6121 + pkt_len + sizeof(struct ipv6hdr)))
6122 + goto bad;
6123 + if (skb->ip_summed == CHECKSUM_HW)
6124 + skb->ip_summed = CHECKSUM_NONE;
6125 + }
6126 + break;
6127 + default:
6128 + if (optlen > len)
6129 + goto bad;
6130 + break;
6131 + }
6132 + off += optlen;
6133 + len -= optlen;
6134 + }
6135 + if (len == 0)
6136 + return 0;
6137 +bad:
6138 + return -1;
6139 +
6140 +}
6141 +
6142 +/* Replicate the checks that IPv6 does on packet reception and pass the packet
6143 + * to ip6tables, which doesn't support NAT, so things are fairly simple. */
6144 +static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
6145 + struct sk_buff *skb, const struct net_device *in,
6146 + const struct net_device *out, int (*okfn)(struct sk_buff *))
6147 +{
6148 + struct ipv6hdr *hdr;
6149 + u32 pkt_len;
6150 + struct nf_bridge_info *nf_bridge;
6151 +
6152 + if (skb->len < sizeof(struct ipv6hdr))
6153 + goto inhdr_error;
6154 +
6155 + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
6156 + goto inhdr_error;
6157 +
6158 + hdr = skb->nh.ipv6h;
6159 +
6160 + if (hdr->version != 6)
6161 + goto inhdr_error;
6162 +
6163 + pkt_len = ntohs(hdr->payload_len);
6164 +
6165 + if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
6166 + if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
6167 + goto inhdr_error;
6168 + if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
6169 + if (__pskb_trim(skb, pkt_len + sizeof(struct ipv6hdr)))
6170 + goto inhdr_error;
6171 + if (skb->ip_summed == CHECKSUM_HW)
6172 + skb->ip_summed = CHECKSUM_NONE;
6173 + }
6174 + }
6175 + if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
6176 + goto inhdr_error;
6177 +
6178 +#ifdef CONFIG_NETFILTER_DEBUG
6179 + skb->nf_debug ^= (1 << NF_IP6_PRE_ROUTING);
6180 +#endif
6181 + if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
6182 + return NF_DROP;
6183 + setup_pre_routing(skb);
6184 +
6185 + NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
6186 + br_nf_pre_routing_finish_ipv6);
6187 +
6188 + return NF_STOLEN;
6189 +
6190 +inhdr_error:
6191 + return NF_DROP;
6192 +}
6193 +
6194 +/* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
6195 + * Replicate the checks that IPv4 does on packet reception.
6196 + * Set skb->dev to the bridge device (i.e. parent of the
6197 + * receiving device) to make netfilter happy, the REDIRECT
6198 + * target in particular. Save the original destination IP
6199 + * address to be able to detect DNAT afterwards.
6200 + */
6201 +static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
6202 + const struct net_device *in, const struct net_device *out,
6203 + int (*okfn)(struct sk_buff *))
6204 +{
6205 + struct iphdr *iph;
6206 + __u32 len;
6207 + struct sk_buff *skb = *pskb;
6208 + struct nf_bridge_info *nf_bridge;
6209 + struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)
6210 + ((*pskb)->mac.ethernet);
6211 +
6212 + if (skb->protocol == __constant_htons(ETH_P_IPV6) || IS_VLAN_IPV6) {
6213 +#ifdef CONFIG_SYSCTL
6214 + if (!brnf_call_ip6tables)
6215 + return NF_ACCEPT;
6216 +#endif
6217 + if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
6218 + goto out;
6219 +
6220 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6221 + skb_pull(skb, VLAN_HLEN);
6222 + (skb)->nh.raw += VLAN_HLEN;
6223 + }
6224 + return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
6225 + }
6226 +
6227 +#ifdef CONFIG_SYSCTL
6228 + if (!brnf_call_iptables)
6229 + return NF_ACCEPT;
6230 +#endif
6231 +
6232 + if (skb->protocol != __constant_htons(ETH_P_IP) && !IS_VLAN_IP)
6233 + return NF_ACCEPT;
6234 + if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
6235 + goto out;
6236 +
6237 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6238 + skb_pull(skb, VLAN_HLEN);
6239 + (skb)->nh.raw += VLAN_HLEN;
6240 + }
6241 +
6242 + if (!pskb_may_pull(skb, sizeof(struct iphdr)))
6243 + goto inhdr_error;
6244 +
6245 + iph = skb->nh.iph;
6246 + if (iph->ihl < 5 || iph->version != 4)
6247 + goto inhdr_error;
6248 +
6249 + if (!pskb_may_pull(skb, 4*iph->ihl))
6250 + goto inhdr_error;
6251 +
6252 + iph = skb->nh.iph;
6253 + if (ip_fast_csum((__u8 *)iph, iph->ihl) != 0)
6254 + goto inhdr_error;
6255 +
6256 + len = ntohs(iph->tot_len);
6257 + if (skb->len < len || len < 4*iph->ihl)
6258 + goto inhdr_error;
6259 +
6260 + if (skb->len > len) {
6261 + __pskb_trim(skb, len);
6262 + if (skb->ip_summed == CHECKSUM_HW)
6263 + skb->ip_summed = CHECKSUM_NONE;
6264 + }
6265 +
6266 +#ifdef CONFIG_NETFILTER_DEBUG
6267 + skb->nf_debug ^= (1 << NF_IP_PRE_ROUTING);
6268 +#endif
6269 + if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
6270 + return NF_DROP;
6271 +
6272 + setup_pre_routing(skb);
6273 + store_orig_dstaddr(skb);
6274 +
6275 + NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
6276 + br_nf_pre_routing_finish);
6277 +
6278 + return NF_STOLEN;
6279 +
6280 +inhdr_error:
6281 +// IP_INC_STATS_BH(IpInHdrErrors);
6282 +out:
6283 + return NF_DROP;
6284 +}
6285 +
6286 +
6287 +/* PF_BRIDGE/LOCAL_IN ************************************************/
6288 +/* The packet is locally destined, which requires a real
6289 + * dst_entry, so detach the fake one. On the way up, the
6290 + * packet would pass through PRE_ROUTING again (which already
6291 + * took place when the packet entered the bridge), but we
6292 + * register an IPv4 PRE_ROUTING 'sabotage' hook that will
6293 + * prevent this from happening.
6294 + */
6295 +static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
6296 + const struct net_device *in, const struct net_device *out,
6297 + int (*okfn)(struct sk_buff *))
6298 +{
6299 + struct sk_buff *skb = *pskb;
6300 +
6301 + if (skb->dst == (struct dst_entry *)&__fake_rtable) {
6302 + dst_release(skb->dst);
6303 + skb->dst = NULL;
6304 + }
6305 +
6306 + return NF_ACCEPT;
6307 +}
6308 +
6309 +/* PF_BRIDGE/FORWARD *************************************************/
6310 +static int br_nf_forward_finish(struct sk_buff *skb)
6311 +{
6312 + struct nf_bridge_info *nf_bridge = skb->nf_bridge;
6313 + struct net_device *in;
6314 +/* struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);*/
6315 +
6316 +#ifdef CONFIG_NETFILTER_DEBUG
6317 + skb->nf_debug ^= (1 << NF_BR_FORWARD);
6318 +#endif
6319 +
6320 +/* if (skb->protocol != __constant_htons(ETH_P_ARP) && !IS_VLAN_ARP) {*/
6321 + in = nf_bridge->physindev;
6322 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
6323 + skb->pkt_type = PACKET_OTHERHOST;
6324 + nf_bridge->mask ^= BRNF_PKT_TYPE;
6325 + }
6326 +/* } else {
6327 + in = *((struct net_device **)(skb->cb));
6328 + }*/
6329 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6330 + skb_push(skb, VLAN_HLEN);
6331 + skb->nh.raw -= VLAN_HLEN;
6332 + }
6333 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, in,
6334 + skb->dev, br_forward_finish, 1);
6335 + return 0;
6336 +}
6337 +
6338 +/* This is the 'purely bridged' case. For IP, we pass the packet to
6339 + * netfilter with indev and outdev set to the bridge device,
6340 + * but we are still able to filter on the 'real' indev/outdev
6341 + * because of the ipt_physdev.c module. For ARP, indev and outdev are the
6342 + * bridge ports.
6343 + */
6344 +static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
6345 + const struct net_device *in, const struct net_device *out,
6346 + int (*okfn)(struct sk_buff *))
6347 +{
6348 + struct sk_buff *skb = *pskb;
6349 + struct nf_bridge_info *nf_bridge;
6350 + struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6351 + int pf;
6352 +
6353 + if (!skb->nf_bridge)
6354 + return NF_ACCEPT;
6355 +
6356 + if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
6357 + pf = PF_INET;
6358 + else
6359 + pf = PF_INET6;
6360 +
6361 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6362 + skb_pull(*pskb, VLAN_HLEN);
6363 + (*pskb)->nh.raw += VLAN_HLEN;
6364 + }
6365 +
6366 +#ifdef CONFIG_NETFILTER_DEBUG
6367 + skb->nf_debug ^= (1 << NF_BR_FORWARD);
6368 +#endif
6369 + nf_bridge = skb->nf_bridge;
6370 + if (skb->pkt_type == PACKET_OTHERHOST) {
6371 + skb->pkt_type = PACKET_HOST;
6372 + nf_bridge->mask |= BRNF_PKT_TYPE;
6373 + }
6374 +
6375 + /* The physdev module checks on this */
6376 + nf_bridge->mask |= BRNF_BRIDGED;
6377 + nf_bridge->physoutdev = skb->dev;
6378 +
6379 + NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in),
6380 + bridge_parent(out), br_nf_forward_finish);
6381 +
6382 + return NF_STOLEN;
6383 +}
6384 +
6385 +/*
6386 +static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
6387 + const struct net_device *in, const struct net_device *out,
6388 + int (*okfn)(struct sk_buff *))
6389 +{
6390 + struct sk_buff *skb = *pskb;
6391 + struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6392 + struct net_device **d = (struct net_device **)(skb->cb);
6393 +
6394 + if (!brnf_call_arptables)
6395 + return NF_ACCEPT;
6396 +
6397 + if (skb->protocol != __constant_htons(ETH_P_ARP)) {
6398 + if (!IS_VLAN_ARP)
6399 + return NF_ACCEPT;
6400 + skb_pull(*pskb, VLAN_HLEN);
6401 + (*pskb)->nh.raw += VLAN_HLEN;
6402 + }
6403 +
6404 +#ifdef CONFIG_NETFILTER_DEBUG
6405 + skb->nf_debug ^= (1 << NF_BR_FORWARD);
6406 +#endif
6407 +
6408 + if (skb->nh.arph->ar_pln != 4) {
6409 + if (IS_VLAN_ARP) {
6410 + skb_push(*pskb, VLAN_HLEN);
6411 + (*pskb)->nh.raw -= VLAN_HLEN;
6412 + }
6413 + return NF_ACCEPT;
6414 + }
6415 + *d = (struct net_device *)in;
6416 + NF_HOOK(NF_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
6417 + (struct net_device *)out, br_nf_forward_finish);
6418 +
6419 + return NF_STOLEN;
6420 +}
6421 +*/
6422 +
6423 +/* PF_BRIDGE/LOCAL_OUT ***********************************************/
6424 +static int br_nf_local_out_finish(struct sk_buff *skb)
6425 +{
6426 +#ifdef CONFIG_NETFILTER_DEBUG
6427 + skb->nf_debug &= ~(1 << NF_BR_LOCAL_OUT);
6428 +#endif
6429 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6430 + skb_push(skb, VLAN_HLEN);
6431 + skb->nh.raw -= VLAN_HLEN;
6432 + }
6433 +
6434 + NF_HOOK_THRESH(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
6435 + br_forward_finish, NF_BR_PRI_FIRST + 1);
6436 +
6437 + return 0;
6438 +}
6439 +
6440 +
6441 +/* This function sees both locally originated IP packets and forwarded
6442 + * IP packets (in both cases the destination device is a bridge
6443 + * device). It also sees bridged-and-DNAT'ed packets.
6444 + * To be able to filter on the physical bridge devices (with the ipt_physdev.c
6445 + * module), we steal packets destined to a bridge device away from the
6446 + * PF_INET/FORWARD and PF_INET/OUTPUT hook functions, and give them back later,
6447 + * when we have determined the real output device. This is done in here.
6448 + *
6449 + * If (nf_bridge->mask & BRNF_BRIDGED_DNAT) then the packet is bridged
6450 + * and we fake the PF_BRIDGE/FORWARD hook. The function br_nf_forward()
6451 + * will then fake the PF_INET/FORWARD hook. br_nf_local_out() has priority
6452 + * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
6453 + * will be executed.
6454 + * Otherwise, if nf_bridge->physindev is NULL, the bridge-nf code never touched
6455 + * this packet before, and so the packet was locally originated. We fake
6456 + * the PF_INET/LOCAL_OUT hook.
6457 + * Finally, if nf_bridge->physindev isn't NULL, then the packet was IP routed,
6458 + * so we fake the PF_INET/FORWARD hook. ipv4_sabotage_out() makes sure
6459 + * even routed packets that didn't arrive on a bridge interface have their
6460 + * nf_bridge->physindev set.
6461 + */
6462 +
6463 +static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
6464 + const struct net_device *in, const struct net_device *out,
6465 + int (*okfn)(struct sk_buff *))
6466 +{
6467 + struct net_device *realindev, *realoutdev;
6468 + struct sk_buff *skb = *pskb;
6469 + struct nf_bridge_info *nf_bridge;
6470 + struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6471 + int pf;
6472 +
6473 + if (!skb->nf_bridge)
6474 + return NF_ACCEPT;
6475 +
6476 + if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
6477 + pf = PF_INET;
6478 + else
6479 + pf = PF_INET6;
6480 +
6481 +#ifdef CONFIG_NETFILTER_DEBUG
6482 + /* Sometimes we get packets with NULL ->dst here (for example,
6483 + * running a dhcp client daemon triggers this). This should now
6484 + * be fixed, but let's keep the check around. */
6485 + if (skb->dst == NULL) {
6486 + printk(KERN_CRIT "br_netfilter: skb->dst == NULL.");
6487 + return NF_ACCEPT;
6488 + }
6489 +#endif
6490 +
6491 + nf_bridge = skb->nf_bridge;
6492 + nf_bridge->physoutdev = skb->dev;
6493 + realindev = nf_bridge->physindev;
6494 +
6495 + /* Bridged, take PF_BRIDGE/FORWARD.
6496 + * (see big note in front of br_nf_pre_routing_finish)
6497 + */
6498 + if (nf_bridge->mask & BRNF_BRIDGED_DNAT) {
6499 + if (nf_bridge->mask & BRNF_PKT_TYPE) {
6500 + skb->pkt_type = PACKET_OTHERHOST;
6501 + nf_bridge->mask ^= BRNF_PKT_TYPE;
6502 + }
6503 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6504 + skb_push(skb, VLAN_HLEN);
6505 + skb->nh.raw -= VLAN_HLEN;
6506 + }
6507 +
6508 + NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev,
6509 + skb->dev, br_forward_finish);
6510 + goto out;
6511 + }
6512 + realoutdev = bridge_parent(skb->dev);
6513 +
6514 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6515 + /* iptables should match -o br0.x */
6516 + if (nf_bridge->netoutdev)
6517 + realoutdev = nf_bridge->netoutdev;
6518 +#endif
6519 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6520 + skb_pull(skb, VLAN_HLEN);
6521 + (*pskb)->nh.raw += VLAN_HLEN;
6522 + }
6523 + /* IP forwarded traffic has a physindev, locally
6524 + * generated traffic hasn't.
6525 + */
6526 + if (realindev != NULL) {
6527 + if (((nf_bridge->mask & BRNF_DONT_TAKE_PARENT) == 0) &&
6528 + has_bridge_parent(realindev))
6529 + realindev = bridge_parent(realindev);
6530 + NF_HOOK_THRESH(pf, NF_IP_FORWARD, skb, realindev,
6531 + realoutdev, okfn,
6532 + NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
6533 + } else {
6534 +#ifdef CONFIG_NETFILTER_DEBUG
6535 + skb->nf_debug ^= (1 << NF_IP_LOCAL_OUT);
6536 +#endif
6537 +
6538 + NF_HOOK_THRESH(pf, NF_IP_LOCAL_OUT, skb, realindev,
6539 + realoutdev, okfn,
6540 + NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
6541 + }
6542 +
6543 +out:
6544 + return NF_STOLEN;
6545 +}
6546 +
6547 +
6548 +/* PF_BRIDGE/POST_ROUTING ********************************************/
6549 +static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
6550 + const struct net_device *in, const struct net_device *out,
6551 + int (*okfn)(struct sk_buff *))
6552 +{
6553 + struct sk_buff *skb = *pskb;
6554 + struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
6555 + struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6556 + struct net_device *realoutdev = bridge_parent(skb->dev);
6557 + int pf;
6558 +
6559 +#ifdef CONFIG_NETFILTER_DEBUG
6560 + /* Be very paranoid. This probably won't happen anymore, but let's
6561 + * keep the check just to be sure... */
6562 + if (skb->mac.raw < skb->head || skb->mac.raw + ETH_HLEN > skb->data) {
6563 + printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
6564 + "bad mac.raw pointer.");
6565 + goto print_error;
6566 + }
6567 +#endif
6568 +
6569 + if (!nf_bridge)
6570 + return NF_ACCEPT;
6571 +
6572 + if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
6573 + pf = PF_INET;
6574 + else
6575 + pf = PF_INET6;
6576 +
6577 + /* Sometimes we get packets with NULL ->dst here (for example,
6578 + * running a dhcp client daemon triggers this).
6579 + */
6580 + if (skb->dst == NULL)
6581 + return NF_ACCEPT;
6582 +
6583 +#ifdef CONFIG_NETFILTER_DEBUG
6584 + /* Sometimes we get packets with NULL ->dst here (for example,
6585 + * running a dhcp client daemon triggers this). This should now
6586 + * be fixed, but let's keep the check around.
6587 + */
6588 + if (skb->dst == NULL) {
6589 + printk(KERN_CRIT "br_netfilter: skb->dst == NULL.");
6590 + goto print_error;
6591 + }
6592 +
6593 + skb->nf_debug ^= (1 << NF_IP_POST_ROUTING);
6594 +#endif
6595 +
6596 + /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
6597 + * about the value of skb->pkt_type.
6598 + */
6599 + if (skb->pkt_type == PACKET_OTHERHOST) {
6600 + skb->pkt_type = PACKET_HOST;
6601 + nf_bridge->mask |= BRNF_PKT_TYPE;
6602 + }
6603 +
6604 + if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6605 + skb_pull(skb, VLAN_HLEN);
6606 + skb->nh.raw += VLAN_HLEN;
6607 + }
6608 +
6609 + nf_bridge_save_header(skb);
6610 +
6611 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6612 + if (nf_bridge->netoutdev)
6613 + realoutdev = nf_bridge->netoutdev;
6614 +#endif
6615 + NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL,
6616 + realoutdev, br_dev_queue_push_xmit);
6617 +
6618 + return NF_STOLEN;
6619 +
6620 +#ifdef CONFIG_NETFILTER_DEBUG
6621 +print_error:
6622 + if (skb->dev != NULL) {
6623 + printk("[%s]", skb->dev->name);
6624 + if (has_bridge_parent(skb->dev))
6625 + printk("[%s]", bridge_parent(skb->dev)->name);
6626 + }
6627 + printk(" head:%p, raw:%p, data:%p\n", skb->head, skb->mac.raw,
6628 + skb->data);
6629 + return NF_ACCEPT;
6630 +#endif
6631 +}
6632 +
6633 +
6634 +/* IPv4/SABOTAGE *****************************************************/
6635 +
6636 +/* Don't hand locally destined packets to PF_INET/PRE_ROUTING
6637 + * for the second time.
6638 + */
6639 +static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff **pskb,
6640 + const struct net_device *in, const struct net_device *out,
6641 + int (*okfn)(struct sk_buff *))
6642 +{
6643 + if ((*pskb)->nf_bridge &&
6644 + !((*pskb)->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
6645 + return NF_STOP;
6646 + }
6647 +
6648 + return NF_ACCEPT;
6649 +}
6650 +
6651 +/* Postpone execution of PF_INET/FORWARD, PF_INET/LOCAL_OUT
6652 + * and PF_INET/POST_ROUTING until we have done the forwarding
6653 + * decision in the bridge code and have determined skb->physoutdev.
6654 + */
6655 +static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
6656 + const struct net_device *in, const struct net_device *out,
6657 + int (*okfn)(struct sk_buff *))
6658 +{
6659 + struct sk_buff *skb = *pskb;
6660 +
6661 + if ((out->hard_start_xmit == br_dev_xmit &&
6662 + okfn != br_nf_forward_finish &&
6663 + okfn != br_nf_local_out_finish &&
6664 + okfn != br_dev_queue_push_xmit)
6665 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6666 + || ((out->priv_flags & IFF_802_1Q_VLAN) &&
6667 + VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
6668 +#endif
6669 + ) {
6670 + struct nf_bridge_info *nf_bridge;
6671 +
6672 + if (!skb->nf_bridge) {
6673 +#ifdef CONFIG_SYSCTL
6674 + /* This code is executed while in the IP(v6) stack,
6675 + the version should be 4 or 6. We can't use
6676 + skb->protocol because that isn't set on
6677 + PF_INET(6)/LOCAL_OUT. */
6678 + struct iphdr *ip = skb->nh.iph;
6679 +
6680 + if (ip->version == 4 && !brnf_call_iptables)
6681 + return NF_ACCEPT;
6682 + else if (ip->version == 6 && !brnf_call_ip6tables)
6683 + return NF_ACCEPT;
6684 +#endif
6685 + if (hook == NF_IP_POST_ROUTING)
6686 + return NF_ACCEPT;
6687 + if (!nf_bridge_alloc(skb))
6688 + return NF_DROP;
6689 + }
6690 +
6691 + nf_bridge = skb->nf_bridge;
6692 +
6693 + /* This frame will arrive on PF_BRIDGE/LOCAL_OUT and we
6694 + * will need the indev then. For a brouter, the real indev
6695 + * can be a bridge port, so we make sure br_nf_local_out()
6696 + * doesn't use the bridge parent of the indev by using
6697 + * the BRNF_DONT_TAKE_PARENT mask.
6698 + */
6699 + if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
6700 + nf_bridge->mask &= BRNF_DONT_TAKE_PARENT;
6701 + nf_bridge->physindev = (struct net_device *)in;
6702 + }
6703 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6704 + /* the iptables outdev is br0.x, not br0 */
6705 + if (out->priv_flags & IFF_802_1Q_VLAN)
6706 + nf_bridge->netoutdev = (struct net_device *)out;
6707 +#endif
6708 + return NF_STOP;
6709 + }
6710 +
6711 + return NF_ACCEPT;
6712 +}
6713 +
6714 +/* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent
6715 + * PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
6716 + * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
6717 + * ip_refrag() can return NF_STOLEN.
6718 + */
6719 +static struct nf_hook_ops br_nf_ops[] = {
6720 + { .hook = br_nf_pre_routing,
6721 + .pf = PF_BRIDGE,
6722 + .hooknum = NF_BR_PRE_ROUTING,
6723 + .priority = NF_BR_PRI_BRNF, },
6724 + { .hook = br_nf_local_in,
6725 + .pf = PF_BRIDGE,
6726 + .hooknum = NF_BR_LOCAL_IN,
6727 + .priority = NF_BR_PRI_BRNF, },
6728 + { .hook = br_nf_forward_ip,
6729 + .pf = PF_BRIDGE,
6730 + .hooknum = NF_BR_FORWARD,
6731 + .priority = NF_BR_PRI_BRNF /*- 1*/, },
6732 +/* { .hook = br_nf_forward_arp,
6733 + .pf = PF_BRIDGE,
6734 + .hooknum = NF_BR_FORWARD,
6735 + .priority = NF_BR_PRI_BRNF, },*/
6736 + { .hook = br_nf_local_out,
6737 + .pf = PF_BRIDGE,
6738 + .hooknum = NF_BR_LOCAL_OUT,
6739 + .priority = NF_BR_PRI_FIRST, },
6740 + { .hook = br_nf_post_routing,
6741 + .pf = PF_BRIDGE,
6742 + .hooknum = NF_BR_POST_ROUTING,
6743 + .priority = NF_BR_PRI_LAST, },
6744 + { .hook = ip_sabotage_in,
6745 + .pf = PF_INET,
6746 + .hooknum = NF_IP_PRE_ROUTING,
6747 + .priority = NF_IP_PRI_FIRST, },
6748 + { .hook = ip_sabotage_in,
6749 + .pf = PF_INET6,
6750 + .hooknum = NF_IP6_PRE_ROUTING,
6751 + .priority = NF_IP6_PRI_FIRST, },
6752 + { .hook = ip_sabotage_out,
6753 + .pf = PF_INET,
6754 + .hooknum = NF_IP_FORWARD,
6755 + .priority = NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD, },
6756 + { .hook = ip_sabotage_out,
6757 + .pf = PF_INET6,
6758 + .hooknum = NF_IP6_FORWARD,
6759 + .priority = NF_IP6_PRI_BRIDGE_SABOTAGE_FORWARD, },
6760 + { .hook = ip_sabotage_out,
6761 + .pf = PF_INET,
6762 + .hooknum = NF_IP_LOCAL_OUT,
6763 + .priority = NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
6764 + { .hook = ip_sabotage_out,
6765 + .pf = PF_INET6,
6766 + .hooknum = NF_IP6_LOCAL_OUT,
6767 + .priority = NF_IP6_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
6768 + { .hook = ip_sabotage_out,
6769 + .pf = PF_INET,
6770 + .hooknum = NF_IP_POST_ROUTING,
6771 + .priority = NF_IP_PRI_FIRST, },
6772 + { .hook = ip_sabotage_out,
6773 + .pf = PF_INET6,
6774 + .hooknum = NF_IP6_POST_ROUTING,
6775 + .priority = NF_IP6_PRI_FIRST, },
6776 +};
6777 +
6778 +#ifdef CONFIG_SYSCTL
6779 +static
6780 +int brnf_sysctl_call_tables(ctl_table *ctl, int write, struct file * filp,
6781 + void *buffer, size_t *lenp)
6782 +{
6783 + int ret;
6784 +
6785 + ret = proc_dointvec(ctl, write, filp, buffer, lenp);
6786 +
6787 + if (write && *(int *)(ctl->data))
6788 + *(int *)(ctl->data) = 1;
6789 + return ret;
6790 +}
6791 +
6792 +static ctl_table brnf_table[] = {
6793 + {
6794 + .ctl_name = NET_BRIDGE_NF_CALL_ARPTABLES,
6795 + .procname = "bridge-nf-call-arptables",
6796 + .data = &brnf_call_arptables,
6797 + .maxlen = sizeof(int),
6798 + .mode = 0644,
6799 + .proc_handler = &brnf_sysctl_call_tables,
6800 + },
6801 + {
6802 + .ctl_name = NET_BRIDGE_NF_CALL_IPTABLES,
6803 + .procname = "bridge-nf-call-iptables",
6804 + .data = &brnf_call_iptables,
6805 + .maxlen = sizeof(int),
6806 + .mode = 0644,
6807 + .proc_handler = &brnf_sysctl_call_tables,
6808 + },
6809 + {
6810 + .ctl_name = NET_BRIDGE_NF_CALL_IP6TABLES,
6811 + .procname = "bridge-nf-call-ip6tables",
6812 + .data = &brnf_call_ip6tables,
6813 + .maxlen = sizeof(int),
6814 + .mode = 0644,
6815 + .proc_handler = &brnf_sysctl_call_tables,
6816 + },
6817 + {
6818 + .ctl_name = NET_BRIDGE_NF_FILTER_VLAN_TAGGED,
6819 + .procname = "bridge-nf-filter-vlan-tagged",
6820 + .data = &brnf_filter_vlan_tagged,
6821 + .maxlen = sizeof(int),
6822 + .mode = 0644,
6823 + .proc_handler = &brnf_sysctl_call_tables,
6824 + },
6825 + { .ctl_name = 0 }
6826 +};
6827 +
6828 +static ctl_table brnf_bridge_table[] = {
6829 + {
6830 + .ctl_name = NET_BRIDGE,
6831 + .procname = "bridge",
6832 + .mode = 0555,
6833 + .child = brnf_table,
6834 + },
6835 + { .ctl_name = 0 }
6836 +};
6837 +
6838 +static ctl_table brnf_net_table[] = {
6839 + {
6840 + .ctl_name = CTL_NET,
6841 + .procname = "net",
6842 + .mode = 0555,
6843 + .child = brnf_bridge_table,
6844 + },
6845 + { .ctl_name = 0 }
6846 +};
6847 +#endif
6848 +
6849 +int br_netfilter_init(void)
6850 +{
6851 + int i;
6852 +
6853 + for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++) {
6854 + int ret;
6855 +
6856 + if ((ret = nf_register_hook(&br_nf_ops[i])) >= 0)
6857 + continue;
6858 +
6859 + while (i--)
6860 + nf_unregister_hook(&br_nf_ops[i]);
6861 +
6862 + return ret;
6863 + }
6864 +
6865 +#ifdef CONFIG_SYSCTL
6866 + brnf_sysctl_header = register_sysctl_table(brnf_net_table, 0);
6867 + if (brnf_sysctl_header == NULL) {
6868 + printk(KERN_WARNING "br_netfilter: can't register to sysctl.\n");
6869 + for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++)
6870 + nf_unregister_hook(&br_nf_ops[i]);
6871 + return -EFAULT;
6872 + }
6873 +#endif
6874 +
6875 + printk(KERN_NOTICE "Bridge firewalling registered\n");
6876 +
6877 + return 0;
6878 +}
6879 +
6880 +void br_netfilter_fini(void)
6881 +{
6882 + int i;
6883 +
6884 + for (i = ARRAY_SIZE(br_nf_ops) - 1; i >= 0; i--)
6885 + nf_unregister_hook(&br_nf_ops[i]);
6886 +#ifdef CONFIG_SYSCTL
6887 + unregister_sysctl_table(brnf_sysctl_header);
6888 +#endif
6889 +
6890 +}
6891 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
6892 +++ linux-2.4.31-ebt-brnf/net/ipv4/netfilter/ipt_physdev.c 2005-09-15 16:57:23.000000000 +0000
6893 @@ -0,0 +1,127 @@
6894 +/* Kernel module to match the bridge port in and
6895 + * out device for IP packets coming into contact with a bridge. */
6896 +#include <linux/module.h>
6897 +#include <linux/skbuff.h>
6898 +#include <linux/netfilter_ipv4/ipt_physdev.h>
6899 +#include <linux/netfilter_ipv4/ip_tables.h>
6900 +#include <linux/netfilter_bridge.h>
6901 +#include <linux/netdevice.h>
6902 +#define MATCH 1
6903 +#define NOMATCH 0
6904 +
6905 +static int
6906 +match(const struct sk_buff *skb,
6907 + const struct net_device *in,
6908 + const struct net_device *out,
6909 + const void *matchinfo,
6910 + int offset,
6911 + const void *hdr,
6912 + u_int16_t datalen,
6913 + int *hotdrop)
6914 +{
6915 + int i;
6916 + static const char nulldevname[IFNAMSIZ] = { 0 };
6917 + const struct ipt_physdev_info *info = matchinfo;
6918 + unsigned long ret;
6919 + const char *indev, *outdev;
6920 + struct nf_bridge_info *nf_bridge;
6921 +
6922 + /* Not a bridged IP packet or no info available yet:
6923 + * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
6924 + * the destination device will be a bridge. */
6925 + if (!(nf_bridge = skb->nf_bridge)) {
6926 + /* Return MATCH if the invert flags of the used options are on */
6927 + if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
6928 + !(info->invert & IPT_PHYSDEV_OP_BRIDGED))
6929 + return NOMATCH;
6930 + if ((info->bitmask & IPT_PHYSDEV_OP_ISIN) &&
6931 + !(info->invert & IPT_PHYSDEV_OP_ISIN))
6932 + return NOMATCH;
6933 + if ((info->bitmask & IPT_PHYSDEV_OP_ISOUT) &&
6934 + !(info->invert & IPT_PHYSDEV_OP_ISOUT))
6935 + return NOMATCH;
6936 + if ((info->bitmask & IPT_PHYSDEV_OP_IN) &&
6937 + !(info->invert & IPT_PHYSDEV_OP_IN))
6938 + return NOMATCH;
6939 + if ((info->bitmask & IPT_PHYSDEV_OP_OUT) &&
6940 + !(info->invert & IPT_PHYSDEV_OP_OUT))
6941 + return NOMATCH;
6942 + return MATCH;
6943 + }
6944 +
6945 + /* This only makes sense in the FORWARD and POSTROUTING chains */
6946 + if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
6947 + (!!(nf_bridge->mask & BRNF_BRIDGED) ^
6948 + !(info->invert & IPT_PHYSDEV_OP_BRIDGED)))
6949 + return NOMATCH;
6950 +
6951 + if ((info->bitmask & IPT_PHYSDEV_OP_ISIN &&
6952 + (!nf_bridge->physindev ^ !!(info->invert & IPT_PHYSDEV_OP_ISIN))) ||
6953 + (info->bitmask & IPT_PHYSDEV_OP_ISOUT &&
6954 + (!nf_bridge->physoutdev ^ !!(info->invert & IPT_PHYSDEV_OP_ISOUT))))
6955 + return NOMATCH;
6956 +
6957 + if (!(info->bitmask & IPT_PHYSDEV_OP_IN))
6958 + goto match_outdev;
6959 + indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
6960 + for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
6961 + ret |= (((const unsigned long *)indev)[i]
6962 + ^ ((const unsigned long *)info->physindev)[i])
6963 + & ((const unsigned long *)info->in_mask)[i];
6964 + }
6965 +
6966 + if ((ret == 0) ^ !(info->invert & IPT_PHYSDEV_OP_IN))
6967 + return NOMATCH;
6968 +
6969 +match_outdev:
6970 + if (!(info->bitmask & IPT_PHYSDEV_OP_OUT))
6971 + return MATCH;
6972 + outdev = nf_bridge->physoutdev ?
6973 + nf_bridge->physoutdev->name : nulldevname;
6974 + for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
6975 + ret |= (((const unsigned long *)outdev)[i]
6976 + ^ ((const unsigned long *)info->physoutdev)[i])
6977 + & ((const unsigned long *)info->out_mask)[i];
6978 + }
6979 +
6980 + return (ret != 0) ^ !(info->invert & IPT_PHYSDEV_OP_OUT);
6981 +}
6982 +
6983 +static int
6984 +checkentry(const char *tablename,
6985 + const struct ipt_ip *ip,
6986 + void *matchinfo,
6987 + unsigned int matchsize,
6988 + unsigned int hook_mask)
6989 +{
6990 + const struct ipt_physdev_info *info = matchinfo;
6991 +
6992 + if (matchsize != IPT_ALIGN(sizeof(struct ipt_physdev_info)))
6993 + return 0;
6994 + if (!(info->bitmask & IPT_PHYSDEV_OP_MASK) ||
6995 + info->bitmask & ~IPT_PHYSDEV_OP_MASK)
6996 + return 0;
6997 + return 1;
6998 +}
6999 +
7000 +static struct ipt_match physdev_match = {
7001 + .name = "physdev",
7002 + .match = &match,
7003 + .checkentry = &checkentry,
7004 + .me = THIS_MODULE,
7005 +};
7006 +
7007 +static int __init init(void)
7008 +{
7009 + return ipt_register_match(&physdev_match);
7010 +}
7011 +
7012 +static void __exit fini(void)
7013 +{
7014 + ipt_unregister_match(&physdev_match);
7015 +}
7016 +
7017 +module_init(init);
7018 +module_exit(fini);
7019 +MODULE_LICENSE("GPL");
7020 +EXPORT_NO_SYMBOLS;
7021 --- /dev/null 2005-09-22 15:53:13.374707688 +0000
7022 +++ linux-2.4.31-ebt-brnf/include/linux/netfilter_ipv4/ipt_physdev.h 2005-09-15 16:57:23.000000000 +0000
7023 @@ -0,0 +1,24 @@
7024 +#ifndef _IPT_PHYSDEV_H
7025 +#define _IPT_PHYSDEV_H
7026 +
7027 +#ifdef __KERNEL__
7028 +#include <linux/if.h>
7029 +#endif
7030 +
7031 +#define IPT_PHYSDEV_OP_IN 0x01
7032 +#define IPT_PHYSDEV_OP_OUT 0x02
7033 +#define IPT_PHYSDEV_OP_BRIDGED 0x04
7034 +#define IPT_PHYSDEV_OP_ISIN 0x08
7035 +#define IPT_PHYSDEV_OP_ISOUT 0x10
7036 +#define IPT_PHYSDEV_OP_MASK (0x20 - 1)
7037 +
7038 +struct ipt_physdev_info {
7039 + char physindev[IFNAMSIZ];
7040 + char in_mask[IFNAMSIZ];
7041 + char physoutdev[IFNAMSIZ];
7042 + char out_mask[IFNAMSIZ];
7043 + u_int8_t invert;
7044 + u_int8_t bitmask;
7045 +};
7046 +
7047 +#endif /*_IPT_PHYSDEV_H*/
7048 --- linux-2.4.31/net/8021q/vlan_dev.c 2005-01-19 14:10:13.000000000 +0000
7049 +++ linux-2.4.31-ebt-brnf/net/8021q/vlan_dev.c 2005-09-15 16:57:23.000000000 +0000
7050 @@ -488,6 +488,10 @@ int vlan_dev_hard_start_xmit(struct sk_b
7051 stats->tx_packets++; /* for statics only */
7052 stats->tx_bytes += skb->len;
7053
7054 + skb->protocol = __constant_htons(ETH_P_8021Q);
7055 + skb->mac.raw -= VLAN_HLEN;
7056 + skb->nh.raw -= VLAN_HLEN;
7057 +
7058 skb->dev = VLAN_DEV_INFO(dev)->real_dev;
7059 dev_queue_xmit(skb);
7060
7061 --- linux-2.4.31/include/linux/sysctl.h 2005-04-04 01:42:20.000000000 +0000
7062 +++ linux-2.4.31-ebt-brnf/include/linux/sysctl.h 2005-09-15 16:57:23.000000000 +0000
7063 @@ -609,6 +609,15 @@ enum {
7064 NET_DECNET_CONF_DEV_STATE = 7
7065 };
7066
7067 +/* /proc/sys/net/bridge */
7068 +enum {
7069 + NET_BRIDGE_NF_CALL_ARPTABLES = 1,
7070 + NET_BRIDGE_NF_CALL_IPTABLES = 2,
7071 + NET_BRIDGE_NF_CALL_IP6TABLES = 3,
7072 + NET_BRIDGE_NF_FILTER_VLAN_TAGGED = 4,
7073 +};
7074 +
7075 +
7076 /* CTL_PROC names: */
7077
7078 /* CTL_FS names: */
7079 --- linux-2.4.31/net/ipv4/netfilter/ipt_REJECT.c 2005-01-19 14:10:13.000000000 +0000
7080 +++ linux-2.4.31-ebt-brnf/net/ipv4/netfilter/ipt_REJECT.c 2005-09-15 16:57:23.000000000 +0000
7081 @@ -15,6 +15,9 @@
7082 #include <net/route.h>
7083 #include <linux/netfilter_ipv4/ip_tables.h>
7084 #include <linux/netfilter_ipv4/ipt_REJECT.h>
7085 +#ifdef CONFIG_BRIDGE_NETFILTER
7086 +#include <linux/netfilter_bridge.h>
7087 +#endif
7088
7089 #if 0
7090 #define DEBUGP printk
7091 @@ -29,7 +32,13 @@ static inline struct rtable *route_rever
7092 struct rt_key key = {};
7093 struct rtable *rt;
7094
7095 - if (hook != NF_IP_FORWARD) {
7096 + /* We don't require ip forwarding to be enabled to be able to
7097 + * send a RST reply for bridged traffic. */
7098 + if (hook != NF_IP_FORWARD
7099 +#ifdef CONFIG_BRIDGE_NETFILTER
7100 + || (skb->nf_bridge && skb->nf_bridge->mask & BRNF_BRIDGED)
7101 +#endif
7102 + ) {
7103 key.dst = iph->saddr;
7104 if (hook == NF_IP_LOCAL_IN)
7105 key.src = iph->daddr;
Personal OpenWRT clone
This page took 0.360725 seconds and 5 git commands to generate.