openwrt/package/linux/kernel-patches/302-ebtables

   1 --- linux-2.4.29/net/bridge/br_private.h        2004-08-08 01:26:06.000000000 +0200
   2 +++ linux-2.4.29-ebt-brnf/net/bridge/br_private.h       2005-03-14 21:24:04.000000000 +0100
   3 @@ -143,8 +143,10 @@ extern void br_fdb_insert(struct net_bri
   4  /* br_forward.c */
   5  extern void br_deliver(struct net_bridge_port *to,
   6                 struct sk_buff *skb);
   7 +extern int br_dev_queue_push_xmit(struct sk_buff *skb);
   8  extern void br_forward(struct net_bridge_port *to,
   9                 struct sk_buff *skb);
  10 +extern int br_forward_finish(struct sk_buff *skb);
  11  extern void br_flood_deliver(struct net_bridge *br,
  12                       struct sk_buff *skb,
  13                       int clone);
  14 @@ -165,7 +167,8 @@ extern void br_get_port_ifindices(struct
  15                            int *ifindices);
  16
  17  /* br_input.c */
  18 -extern void br_handle_frame(struct sk_buff *skb);
  19 +extern int br_handle_frame_finish(struct sk_buff *skb);
  20 +extern int br_handle_frame(struct sk_buff *skb);
  21
  22  /* br_ioctl.c */
  23  extern int br_ioctl(struct net_bridge *br,
  24 @@ -175,6 +178,10 @@ extern int br_ioctl(struct net_bridge *b
  25              unsigned long arg2);
  26  extern int br_ioctl_deviceless_stub(unsigned long arg);
  27
  28 +/* br_netfilter.c */
  29 +extern int br_netfilter_init(void);
  30 +extern void br_netfilter_fini(void);
  31 +
  32  /* br_stp.c */
  33  extern int br_is_root_bridge(struct net_bridge *br);
  34  extern struct net_bridge_port *br_get_port(struct net_bridge *br,
  35 --- linux-2.4.29/include/linux/if_bridge.h      2001-11-22 20:47:12.000000000 +0100
  36 +++ linux-2.4.29-ebt-brnf/include/linux/if_bridge.h     2005-03-14 21:11:28.000000000 +0100
  37 @@ -102,7 +102,8 @@ struct net_bridge;
  38  struct net_bridge_port;
  39
  40  extern int (*br_ioctl_hook)(unsigned long arg);
  41 -extern void (*br_handle_frame_hook)(struct sk_buff *skb);
  42 +extern int (*br_handle_frame_hook)(struct sk_buff *skb);
  43 +extern int (*br_should_route_hook)(struct sk_buff **pskb);
  44
  45  #endif
  46
  47 --- linux-2.4.29/net/core/dev.c 2004-04-14 15:05:41.000000000 +0200
  48 +++ linux-2.4.29-ebt-brnf/net/core/dev.c        2005-03-14 00:00:29.000000000 +0100
  49 @@ -1426,7 +1426,7 @@ static void net_tx_action(struct softirq
  50
  51
  52  #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
  53 -void (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
  54 +int (*br_handle_frame_hook)(struct sk_buff *skb) = NULL;
  55  #endif
  56
  57  static __inline__ int handle_bridge(struct sk_buff *skb,
  58 @@ -1443,7 +1443,6 @@ static __inline__ int handle_bridge(stru
  59                 }
  60         }
  61
  62 -       br_handle_frame_hook(skb);
  63         return ret;
  64  }
  65
  66 @@ -1503,7 +1502,12 @@ int netif_receive_skb(struct sk_buff *sk
  67  #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
  68         if (skb->dev->br_port != NULL && br_handle_frame_hook != NULL &&
  69             skb->pkt_type != PACKET_LOOPBACK) {
  70 -               return handle_bridge(skb, pt_prev);
  71 +               int ret;
  72 +
  73 +               ret = handle_bridge(skb, pt_prev);
  74 +               if (br_handle_frame_hook(skb) == 0)
  75 +                       return ret;
  76 +               pt_prev = NULL;
  77         }
  78  #endif
  79
  80 --- linux-2.4.29/net/bridge/br_input.c  2003-08-25 13:44:44.000000000 +0200
  81 +++ linux-2.4.29-ebt-brnf/net/bridge/br_input.c 2005-03-14 00:00:29.000000000 +0100
  82 @@ -24,6 +24,9 @@ unsigned char bridge_ula[6] = { 0x01, 0x
  83
  84  static int br_pass_frame_up_finish(struct sk_buff *skb)
  85  {
  86 +#ifdef CONFIG_NETFILTER_DEBUG
  87 +       skb->nf_debug = 0;
  88 +#endif
  89         netif_rx(skb);
  90
  91         return 0;
  92 @@ -46,7 +49,7 @@ static void br_pass_frame_up(struct net_
  93                         br_pass_frame_up_finish);
  94  }
  95
  96 -static int br_handle_frame_finish(struct sk_buff *skb)
  97 +int br_handle_frame_finish(struct sk_buff *skb)
  98  {
  99         struct net_bridge *br;
 100         unsigned char *dest;
 101 @@ -112,7 +115,7 @@ err_nolock:
 102         return 0;
 103  }
 104
 105 -void br_handle_frame(struct sk_buff *skb)
 106 +int br_handle_frame(struct sk_buff *skb)
 107  {
 108         struct net_bridge *br;
 109         unsigned char *dest;
 110 @@ -146,26 +149,35 @@ void br_handle_frame(struct sk_buff *skb
 111                 goto handle_special_frame;
 112
 113         if (p->state == BR_STATE_FORWARDING) {
 114 +               if (br_should_route_hook && br_should_route_hook(&skb)) {
 115 +                       read_unlock(&br->lock);
 116 +                       return -1;
 117 +               }
 118 +
 119 +               if (!memcmp(p->br->dev.dev_addr, dest, ETH_ALEN))
 120 +                       skb->pkt_type = PACKET_HOST;
 121 +
 122                 NF_HOOK(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
 123                         br_handle_frame_finish);
 124                 read_unlock(&br->lock);
 125 -               return;
 126 +               return 0;
 127         }
 128
 129  err:
 130         read_unlock(&br->lock);
 131  err_nolock:
 132         kfree_skb(skb);
 133 -       return;
 134 +       return 0;
 135
 136  handle_special_frame:
 137         if (!dest[5]) {
 138                 NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,NULL,
 139                         br_stp_handle_bpdu);
 140                 read_unlock(&br->lock);
 141 -               return;
 142 +               return 0;
 143         }
 144
 145         read_unlock(&br->lock);
 146         kfree_skb(skb);
 147 +       return 0;
 148  }
 149 --- linux-2.4.29/net/bridge/br_forward.c        2003-11-28 19:26:21.000000000 +0100
 150 +++ linux-2.4.29-ebt-brnf/net/bridge/br_forward.c       2005-03-14 00:00:29.000000000 +0100
 151 @@ -30,18 +30,21 @@ static inline int should_deliver(struct
 152         return 1;
 153  }
 154
 155 -static int __dev_queue_push_xmit(struct sk_buff *skb)
 156 +int br_dev_queue_push_xmit(struct sk_buff *skb)
 157  {
 158 +#ifdef CONFIG_NETFILTER
 159 +       nf_bridge_maybe_copy_header(skb);
 160 +#endif
 161         skb_push(skb, ETH_HLEN);
 162         dev_queue_xmit(skb);
 163
 164         return 0;
 165  }
 166
 167 -static int __br_forward_finish(struct sk_buff *skb)
 168 +int br_forward_finish(struct sk_buff *skb)
 169  {
 170         NF_HOOK(PF_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
 171 -                       __dev_queue_push_xmit);
 172 +                       br_dev_queue_push_xmit);
 173
 174         return 0;
 175  }
 176 @@ -49,8 +52,11 @@ static int __br_forward_finish(struct sk
 177  static void __br_deliver(struct net_bridge_port *to, struct sk_buff *skb)
 178  {
 179         skb->dev = to->dev;
 180 +#ifdef CONFIG_NETFILTER_DEBUG
 181 +       skb->nf_debug = 0;
 182 +#endif
 183         NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 184 -                       __br_forward_finish);
 185 +                       br_forward_finish);
 186  }
 187
 188  static void __br_forward(struct net_bridge_port *to, struct sk_buff *skb)
 189 @@ -62,7 +68,7 @@ static void __br_forward(struct net_brid
 190         skb->ip_summed = CHECKSUM_NONE;
 191
 192         NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
 193 -                       __br_forward_finish);
 194 +                       br_forward_finish);
 195  }
 196
 197  /* called under bridge lock */
 198 --- linux-2.4.29/net/bridge/br.c        2004-08-08 01:26:06.000000000 +0200
 199 +++ linux-2.4.29-ebt-brnf/net/bridge/br.c       2005-03-14 00:00:29.000000000 +0100
 200 @@ -30,6 +30,8 @@
 201  #include "../atm/lec.h"
 202  #endif
 203
 204 +int (*br_should_route_hook) (struct sk_buff **pskb) = NULL;
 205 +
 206  void br_dec_use_count()
 207  {
 208         MOD_DEC_USE_COUNT;
 209 @@ -44,6 +46,10 @@ static int __init br_init(void)
 210  {
 211         printk(KERN_INFO "NET4: Ethernet Bridge 008 for NET4.0\n");
 212
 213 +#ifdef CONFIG_NETFILTER
 214 +       if (br_netfilter_init())
 215 +               return 1;
 216 +#endif
 217         br_handle_frame_hook = br_handle_frame;
 218         br_ioctl_hook = br_ioctl_deviceless_stub;
 219  #if defined(CONFIG_ATM_LANE) || defined(CONFIG_ATM_LANE_MODULE)
 220 @@ -57,6 +63,9 @@ static int __init br_init(void)
 221
 222  static void __exit br_deinit(void)
 223  {
 224 +#ifdef CONFIG_NETFILTER
 225 +       br_netfilter_fini();
 226 +#endif
 227         unregister_netdevice_notifier(&br_device_notifier);
 228
 229         rtnl_lock();
 230 @@ -73,7 +82,7 @@ static void __exit br_deinit(void)
 231  #endif
 232  }
 233
 234 -EXPORT_NO_SYMBOLS;
 235 +EXPORT_SYMBOL(br_should_route_hook);
 236
 237  module_init(br_init)
 238  module_exit(br_deinit)
 239 --- linux-2.4.29/net/bridge/Makefile    2000-12-29 23:07:24.000000000 +0100
 240 +++ linux-2.4.29-ebt-brnf/net/bridge/Makefile   2005-03-14 00:00:29.000000000 +0100
 241 @@ -7,10 +7,17 @@
 242  #
 243  # Note 2! The CFLAGS definition is now in the main makefile...
 244
 245 +export-objs := br.o
 246 +
 247  O_TARGET       := bridge.o
 248  obj-y          := br.o br_device.o br_fdb.o br_forward.o br_if.o br_input.o \
 249                         br_ioctl.o br_notify.o br_stp.o br_stp_bpdu.o \
 250                         br_stp_if.o br_stp_timer.o
 251 +
 252 +ifeq ($(CONFIG_NETFILTER),y)
 253 +obj-y          += br_netfilter.o
 254 +endif
 255 +
 256  obj-m          := $(O_TARGET)
 257
 258  include $(TOPDIR)/Rules.make
 259 --- linux-2.4.29/include/linux/netfilter_bridge.h       2001-06-12 04:15:27.000000000 +0200
 260 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge.h      2005-03-14 21:24:06.000000000 +0100
 261 @@ -6,6 +6,10 @@
 262
 263  #include <linux/config.h>
 264  #include <linux/netfilter.h>
 265 +#if defined(__KERNEL__) && defined(CONFIG_NETFILTER)
 266 +#include <asm/atomic.h>
 267 +#include <linux/if_ether.h>
 268 +#endif
 269
 270  /* Bridge Hooks */
 271  /* After promisc drops, checksum checks. */
 272 @@ -18,7 +22,76 @@
 273  #define NF_BR_LOCAL_OUT                3
 274  /* Packets about to hit the wire. */
 275  #define NF_BR_POST_ROUTING     4
 276 -#define NF_BR_NUMHOOKS         5
 277 +/* Not really a hook, but used for the ebtables broute table */
 278 +#define NF_BR_BROUTING         5
 279 +#define NF_BR_NUMHOOKS         6
 280 +
 281 +#ifdef __KERNEL__
 282 +
 283 +#define BRNF_PKT_TYPE                  0x01
 284 +#define BRNF_BRIDGED_DNAT              0x02
 285 +#define BRNF_DONT_TAKE_PARENT          0x04
 286 +#define BRNF_BRIDGED                   0x08
 287 +#define BRNF_NF_BRIDGE_PREROUTING      0x10
 288 +
 289 +enum nf_br_hook_priorities {
 290 +       NF_BR_PRI_FIRST = INT_MIN,
 291 +       NF_BR_PRI_NAT_DST_BRIDGED = -300,
 292 +       NF_BR_PRI_FILTER_BRIDGED = -200,
 293 +       NF_BR_PRI_BRNF = 0,
 294 +       NF_BR_PRI_NAT_DST_OTHER = 100,
 295 +       NF_BR_PRI_FILTER_OTHER = 200,
 296 +       NF_BR_PRI_NAT_SRC = 300,
 297 +       NF_BR_PRI_LAST = INT_MAX,
 298 +};
 299 +
 300 +#ifdef CONFIG_NETFILTER
 301 +static inline
 302 +struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
 303 +{
 304 +       struct nf_bridge_info **nf_bridge = &(skb->nf_bridge);
 305 +
 306 +       if ((*nf_bridge = kmalloc(sizeof(**nf_bridge), GFP_ATOMIC)) != NULL) {
 307 +               atomic_set(&(*nf_bridge)->use, 1);
 308 +               (*nf_bridge)->mask = 0;
 309 +               (*nf_bridge)->physindev = (*nf_bridge)->physoutdev = NULL;
 310 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
 311 +               (*nf_bridge)->netoutdev = NULL;
 312 +#endif
 313 +       }
 314 +
 315 +       return *nf_bridge;
 316 +}
 317 +
 318 +/* Only used in br_forward.c */
 319 +static inline
 320 +void nf_bridge_maybe_copy_header(struct sk_buff *skb)
 321 +{
 322 +       if (skb->nf_bridge) {
 323 +               if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
 324 +                       memcpy(skb->data - 18, skb->nf_bridge->data, 18);
 325 +                       skb_push(skb, 4);
 326 +               } else
 327 +                       memcpy(skb->data - 16, skb->nf_bridge->data, 16);
 328 +       }
 329 +}
 330 +
 331 +static inline
 332 +void nf_bridge_save_header(struct sk_buff *skb)
 333 +{
 334 +        int header_size = 16;
 335 +
 336 +       if (skb->protocol == __constant_htons(ETH_P_8021Q))
 337 +               header_size = 18;
 338 +       memcpy(skb->nf_bridge->data, skb->data - header_size, header_size);
 339 +}
 340
 341 +struct bridge_skb_cb {
 342 +       union {
 343 +               __u32 ipv4;
 344 +       } daddr;
 345 +};
 346 +#endif /* CONFIG_NETFILTER */
 347
 348 +#endif /* __KERNEL__ */
 349  #endif
 350 --- linux-2.4.29/include/linux/netfilter_ipv4/ip_tables.h       2004-08-08 01:26:06.000000000 +0200
 351 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_ipv4/ip_tables.h      2005-03-14 21:24:28.000000000 +0100
 352 @@ -159,7 +159,7 @@ struct ipt_entry
 353  #define IPT_CONTINUE 0xFFFFFFFF
 354
 355  /* For standard target */
 356 -#define IPT_RETURN (-NF_MAX_VERDICT - 1)
 357 +#define IPT_RETURN (-NF_REPEAT - 1)
 358
 359  /* TCP matching stuff */
 360  struct ipt_tcp
 361 --- linux-2.4.29/include/linux/netfilter_ipv6/ip6_tables.h      2004-08-08 01:26:06.000000000 +0200
 362 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_ipv6/ip6_tables.h     2005-03-14 00:00:29.000000000 +0100
 363 @@ -167,7 +167,7 @@ struct ip6t_entry
 364  #define IP6T_CONTINUE 0xFFFFFFFF
 365
 366  /* For standard target */
 367 -#define IP6T_RETURN (-NF_MAX_VERDICT - 1)
 368 +#define IP6T_RETURN (-NF_REPEAT - 1)
 369
 370  /* TCP matching stuff */
 371  struct ip6t_tcp
 372 --- linux-2.4.29/include/linux/netfilter_arp/arp_tables.h       2003-08-25 13:44:44.000000000 +0200
 373 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_arp/arp_tables.h      2005-03-14 21:24:31.000000000 +0100
 374 @@ -154,7 +154,7 @@ struct arpt_entry
 375  #define ARPT_CONTINUE 0xFFFFFFFF
 376
 377  /* For standard target */
 378 -#define ARPT_RETURN (-NF_MAX_VERDICT - 1)
 379 +#define ARPT_RETURN (-NF_REPEAT - 1)
 380
 381  /* The argument to ARPT_SO_GET_INFO */
 382  struct arpt_getinfo
 383 --- linux-2.4.29/net/Makefile   2004-08-08 01:26:06.000000000 +0200
 384 +++ linux-2.4.29-ebt-brnf/net/Makefile  2005-03-14 00:00:29.000000000 +0100
 385 @@ -7,7 +7,8 @@
 386
 387  O_TARGET :=    network.o
 388
 389 -mod-subdirs := ipv4/netfilter ipv6/netfilter ipx irda bluetooth atm netlink sched core sctp 802
 390 +mod-subdirs := ipv4/netfilter ipv6/netfilter bridge/netfilter ipx irda \
 391 +       bluetooth atm netlink sched core sctp 802
 392  export-objs := netsyms.o
 393
 394  subdir-y :=    core ethernet
 395 @@ -27,6 +28,12 @@ subdir-$(CONFIG_NETFILTER)   += ipv6/netfi
 396  endif
 397  endif
 398
 399 +ifneq ($(CONFIG_BRIDGE),n)
 400 +ifneq ($(CONFIG_BRIDGE),)
 401 +subdir-$(CONFIG_BRIDGE)                += bridge/netfilter
 402 +endif
 403 +endif
 404 +
 405  subdir-$(CONFIG_KHTTPD)                += khttpd
 406  subdir-$(CONFIG_PACKET)                += packet
 407  subdir-$(CONFIG_NET_SCHED)     += sched
 408 --- linux-2.4.29/net/Config.in  2005-01-19 15:10:13.000000000 +0100
 409 +++ linux-2.4.29-ebt-brnf/net/Config.in 2005-03-14 00:00:29.000000000 +0100
 410 @@ -70,6 +70,9 @@ if [ "$CONFIG_DECNET" != "n" ]; then
 411     source net/decnet/Config.in
 412  fi
 413  dep_tristate '802.1d Ethernet Bridging' CONFIG_BRIDGE $CONFIG_INET
 414 +if [ "$CONFIG_BRIDGE" != "n" -a "$CONFIG_NETFILTER" != "n" ]; then
 415 +   source net/bridge/netfilter/Config.in
 416 +fi
 417  if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 418     tristate 'CCITT X.25 Packet Layer (EXPERIMENTAL)' CONFIG_X25
 419     tristate 'LAPB Data Link Driver (EXPERIMENTAL)' CONFIG_LAPB
 420 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 421 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/Makefile 2005-03-14 00:00:29.000000000 +0100
 422 @@ -0,0 +1,34 @@
 423 +#
 424 +# Makefile for the netfilter modules on top of bridging.
 425 +#
 426 +# Note! Dependencies are done automagically by 'make dep', which also
 427 +# removes any old dependencies. DON'T put your own dependencies here
 428 +# unless it's something special (ie not a .c file).
 429 +#
 430 +# Note 2! The CFLAGS definition is now in the main makefile...
 431 +
 432 +O_TARGET       := netfilter.o
 433 +
 434 +export-objs := ebtables.o
 435 +
 436 +obj-$(CONFIG_BRIDGE_NF_EBTABLES) += ebtables.o
 437 +obj-$(CONFIG_BRIDGE_EBT_T_FILTER) += ebtable_filter.o
 438 +obj-$(CONFIG_BRIDGE_EBT_T_NAT) += ebtable_nat.o
 439 +obj-$(CONFIG_BRIDGE_EBT_BROUTE) += ebtable_broute.o
 440 +obj-$(CONFIG_BRIDGE_EBT_802_3) += ebt_802_3.o
 441 +obj-$(CONFIG_BRIDGE_EBT_ARPF) += ebt_arp.o
 442 +obj-$(CONFIG_BRIDGE_EBT_AMONG) += ebt_among.o
 443 +obj-$(CONFIG_BRIDGE_EBT_IPF) += ebt_ip.o
 444 +obj-$(CONFIG_BRIDGE_EBT_LIMIT) += ebt_limit.o
 445 +obj-$(CONFIG_BRIDGE_EBT_MARKF) += ebt_mark_m.o
 446 +obj-$(CONFIG_BRIDGE_EBT_PKTTYPE) += ebt_pkttype.o
 447 +obj-$(CONFIG_BRIDGE_EBT_STP) += ebt_stp.o
 448 +obj-$(CONFIG_BRIDGE_EBT_VLANF) += ebt_vlan.o
 449 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
 450 +obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_ulog.o
 451 +obj-$(CONFIG_BRIDGE_EBT_ARPREPLY) += ebt_arpreply.o
 452 +obj-$(CONFIG_BRIDGE_EBT_DNAT) += ebt_dnat.o
 453 +obj-$(CONFIG_BRIDGE_EBT_MARK_T) += ebt_mark.o
 454 +obj-$(CONFIG_BRIDGE_EBT_REDIRECT) += ebt_redirect.o
 455 +obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 456 +include $(TOPDIR)/Rules.make
 457 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 458 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/Config.in        2005-03-14 00:00:29.000000000 +0100
 459 @@ -0,0 +1,23 @@
 460 +#
 461 +# Bridge netfilter configuration
 462 +#
 463 +dep_tristate '  Bridge: ebtables' CONFIG_BRIDGE_NF_EBTABLES $CONFIG_BRIDGE
 464 +dep_tristate '    ebt: filter table support' CONFIG_BRIDGE_EBT_T_FILTER $CONFIG_BRIDGE_NF_EBTABLES
 465 +dep_tristate '    ebt: nat table support' CONFIG_BRIDGE_EBT_T_NAT $CONFIG_BRIDGE_NF_EBTABLES
 466 +dep_tristate '    ebt: broute table support' CONFIG_BRIDGE_EBT_BROUTE $CONFIG_BRIDGE_NF_EBTABLES
 467 +dep_tristate '    ebt: log support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
 468 +dep_tristate '    ebt: ulog support' CONFIG_BRIDGE_EBT_LOG $CONFIG_BRIDGE_NF_EBTABLES
 469 +dep_tristate '    ebt: IP filter support' CONFIG_BRIDGE_EBT_IPF $CONFIG_BRIDGE_NF_EBTABLES
 470 +dep_tristate '    ebt: ARP filter support' CONFIG_BRIDGE_EBT_ARPF $CONFIG_BRIDGE_NF_EBTABLES
 471 +dep_tristate '    ebt: among filter support' CONFIG_BRIDGE_EBT_AMONG $CONFIG_BRIDGE_NF_EBTABLES
 472 +dep_tristate '    ebt: limit filter support' CONFIG_BRIDGE_EBT_LIMIT $CONFIG_BRIDGE_NF_EBTABLES
 473 +dep_tristate '    ebt: 802.1Q VLAN filter support' CONFIG_BRIDGE_EBT_VLANF $CONFIG_BRIDGE_NF_EBTABLES
 474 +dep_tristate '    ebt: 802.3 filter support' CONFIG_BRIDGE_EBT_802_3 $CONFIG_BRIDGE_NF_EBTABLES
 475 +dep_tristate '    ebt: packet type filter support' CONFIG_BRIDGE_EBT_PKTTYPE $CONFIG_BRIDGE_NF_EBTABLES
 476 +dep_tristate '    ebt: STP filter support' CONFIG_BRIDGE_EBT_STP $CONFIG_BRIDGE_NF_EBTABLES
 477 +dep_tristate '    ebt: mark filter support' CONFIG_BRIDGE_EBT_MARKF $CONFIG_BRIDGE_NF_EBTABLES
 478 +dep_tristate '    ebt: arp reply target support' CONFIG_BRIDGE_EBT_ARPREPLY $CONFIG_BRIDGE_NF_EBTABLES
 479 +dep_tristate '    ebt: snat target support' CONFIG_BRIDGE_EBT_SNAT $CONFIG_BRIDGE_NF_EBTABLES
 480 +dep_tristate '    ebt: dnat target support' CONFIG_BRIDGE_EBT_DNAT $CONFIG_BRIDGE_NF_EBTABLES
 481 +dep_tristate '    ebt: redirect target support' CONFIG_BRIDGE_EBT_REDIRECT $CONFIG_BRIDGE_NF_EBTABLES
 482 +dep_tristate '    ebt: mark target support' CONFIG_BRIDGE_EBT_MARK_T $CONFIG_BRIDGE_NF_EBTABLES
 483 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 484 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebtable_filter.c 2005-03-14 00:00:29.000000000 +0100
 485 @@ -0,0 +1,90 @@
 486 +/*
 487 + *  ebtable_filter
 488 + *
 489 + *     Authors:
 490 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 491 + *
 492 + *  April, 2002
 493 + *
 494 + */
 495 +
 496 +#include <linux/netfilter_bridge/ebtables.h>
 497 +#include <linux/module.h>
 498 +
 499 +#define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
 500 +   (1 << NF_BR_LOCAL_OUT))
 501 +
 502 +static struct ebt_entries initial_chains[] =
 503 +{
 504 +  {0, "INPUT", 0, EBT_ACCEPT, 0},
 505 +  {0, "FORWARD", 0, EBT_ACCEPT, 0},
 506 +  {0, "OUTPUT", 0, EBT_ACCEPT, 0}
 507 +};
 508 +
 509 +static struct ebt_replace initial_table =
 510 +{
 511 +  "filter", FILTER_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
 512 +  { [NF_BR_LOCAL_IN]&initial_chains[0], [NF_BR_FORWARD]&initial_chains[1],
 513 +    [NF_BR_LOCAL_OUT]&initial_chains[2] }, 0, NULL, (char *)initial_chains
 514 +};
 515 +
 516 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 517 +{
 518 +       if (valid_hooks & ~FILTER_VALID_HOOKS)
 519 +               return -EINVAL;
 520 +       return 0;
 521 +}
 522 +
 523 +static struct ebt_table frame_filter =
 524 +{
 525 +  {NULL, NULL}, "filter", &initial_table, FILTER_VALID_HOOKS,
 526 +  RW_LOCK_UNLOCKED, check, NULL
 527 +};
 528 +
 529 +static unsigned int
 530 +ebt_hook (unsigned int hook, struct sk_buff **pskb, const struct net_device *in,
 531 +   const struct net_device *out, int (*okfn)(struct sk_buff *))
 532 +{
 533 +       return ebt_do_table(hook, pskb, in, out, &frame_filter);
 534 +}
 535 +
 536 +static struct nf_hook_ops ebt_ops_filter[] = {
 537 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_IN,
 538 +          NF_BR_PRI_FILTER_BRIDGED},
 539 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_FORWARD,
 540 +          NF_BR_PRI_FILTER_BRIDGED},
 541 +       { { NULL, NULL }, ebt_hook, PF_BRIDGE, NF_BR_LOCAL_OUT,
 542 +          NF_BR_PRI_FILTER_OTHER}
 543 +};
 544 +
 545 +static int __init init(void)
 546 +{
 547 +       int i, j, ret;
 548 +
 549 +       ret = ebt_register_table(&frame_filter);
 550 +       if (ret < 0)
 551 +               return ret;
 552 +       for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
 553 +               if ((ret = nf_register_hook(&ebt_ops_filter[i])) < 0)
 554 +                       goto cleanup;
 555 +       return ret;
 556 +cleanup:
 557 +       for (j = 0; j < i; j++)
 558 +               nf_unregister_hook(&ebt_ops_filter[j]);
 559 +       ebt_unregister_table(&frame_filter);
 560 +       return ret;
 561 +}
 562 +
 563 +static void __exit fini(void)
 564 +{
 565 +       int i;
 566 +
 567 +       for (i = 0; i < sizeof(ebt_ops_filter) / sizeof(ebt_ops_filter[0]); i++)
 568 +               nf_unregister_hook(&ebt_ops_filter[i]);
 569 +       ebt_unregister_table(&frame_filter);
 570 +}
 571 +
 572 +module_init(init);
 573 +module_exit(fini);
 574 +EXPORT_NO_SYMBOLS;
 575 +MODULE_LICENSE("GPL");
 576 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 577 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebtable_nat.c    2005-03-14 00:00:29.000000000 +0100
 578 @@ -0,0 +1,96 @@
 579 +/*
 580 + *  ebtable_nat
 581 + *
 582 + *     Authors:
 583 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 584 + *
 585 + *  April, 2002
 586 + *
 587 + */
 588 +
 589 +#include <linux/netfilter_bridge/ebtables.h>
 590 +#include <linux/module.h>
 591 +#define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
 592 +   (1 << NF_BR_POST_ROUTING))
 593 +
 594 +static struct ebt_entries initial_chains[] =
 595 +{
 596 +  {0, "PREROUTING", 0, EBT_ACCEPT, 0},
 597 +  {0, "OUTPUT", 0, EBT_ACCEPT, 0},
 598 +  {0, "POSTROUTING", 0, EBT_ACCEPT, 0}
 599 +};
 600 +
 601 +static struct ebt_replace initial_table =
 602 +{
 603 +  "nat", NAT_VALID_HOOKS, 0, 3 * sizeof(struct ebt_entries),
 604 +  { [NF_BR_PRE_ROUTING]&initial_chains[0], [NF_BR_LOCAL_OUT]&initial_chains[1],
 605 +    [NF_BR_POST_ROUTING]&initial_chains[2] }, 0, NULL, (char *)initial_chains
 606 +};
 607 +
 608 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 609 +{
 610 +       if (valid_hooks & ~NAT_VALID_HOOKS)
 611 +               return -EINVAL;
 612 +       return 0;
 613 +}
 614 +
 615 +static struct ebt_table frame_nat =
 616 +{
 617 +  {NULL, NULL}, "nat", &initial_table, NAT_VALID_HOOKS,
 618 +  RW_LOCK_UNLOCKED, check, NULL
 619 +};
 620 +
 621 +static unsigned int
 622 +ebt_nat_dst(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
 623 +   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 624 +{
 625 +       return ebt_do_table(hook, pskb, in, out, &frame_nat);
 626 +}
 627 +
 628 +static unsigned int
 629 +ebt_nat_src(unsigned int hook, struct sk_buff **pskb, const struct net_device *in
 630 +   , const struct net_device *out, int (*okfn)(struct sk_buff *))
 631 +{
 632 +       return ebt_do_table(hook, pskb, in, out, &frame_nat);
 633 +}
 634 +
 635 +static struct nf_hook_ops ebt_ops_nat[] = {
 636 +       { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_LOCAL_OUT,
 637 +          NF_BR_PRI_NAT_DST_OTHER},
 638 +       { { NULL, NULL }, ebt_nat_src, PF_BRIDGE, NF_BR_POST_ROUTING,
 639 +          NF_BR_PRI_NAT_SRC},
 640 +       { { NULL, NULL }, ebt_nat_dst, PF_BRIDGE, NF_BR_PRE_ROUTING,
 641 +          NF_BR_PRI_NAT_DST_BRIDGED},
 642 +};
 643 +
 644 +static int __init init(void)
 645 +{
 646 +       int i, ret, j;
 647 +
 648 +       ret = ebt_register_table(&frame_nat);
 649 +       if (ret < 0)
 650 +               return ret;
 651 +       for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
 652 +               if ((ret = nf_register_hook(&ebt_ops_nat[i])) < 0)
 653 +                       goto cleanup;
 654 +       return ret;
 655 +cleanup:
 656 +       for (j = 0; j < i; j++)
 657 +               nf_unregister_hook(&ebt_ops_nat[j]);
 658 +       ebt_unregister_table(&frame_nat);
 659 +       return ret;
 660 +}
 661 +
 662 +static void __exit fini(void)
 663 +{
 664 +       int i;
 665 +
 666 +       for (i = 0; i < sizeof(ebt_ops_nat) / sizeof(ebt_ops_nat[0]); i++)
 667 +               nf_unregister_hook(&ebt_ops_nat[i]);
 668 +       ebt_unregister_table(&frame_nat);
 669 +}
 670 +
 671 +module_init(init);
 672 +module_exit(fini);
 673 +EXPORT_NO_SYMBOLS;
 674 +MODULE_LICENSE("GPL");
 675 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 676 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebtable_broute.c 2005-03-14 00:00:29.000000000 +0100
 677 @@ -0,0 +1,79 @@
 678 +/*
 679 + *  ebtable_broute
 680 + *
 681 + *     Authors:
 682 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
 683 + *
 684 + *  April, 2002
 685 + *
 686 + *  This table lets you choose between routing and bridging for frames
 687 + *  entering on a bridge enslaved nic. This table is traversed before any
 688 + *  other ebtables table. See net/bridge/br_input.c.
 689 + */
 690 +
 691 +#include <linux/netfilter_bridge/ebtables.h>
 692 +#include <linux/module.h>
 693 +#include <linux/if_bridge.h>
 694 +#include <linux/brlock.h>
 695 +
 696 +// EBT_ACCEPT means the frame will be bridged
 697 +// EBT_DROP means the frame will be routed
 698 +static struct ebt_entries initial_chain =
 699 +  {0, "BROUTING", 0, EBT_ACCEPT, 0};
 700 +
 701 +static struct ebt_replace initial_table =
 702 +{
 703 +  "broute", 1 << NF_BR_BROUTING, 0, sizeof(struct ebt_entries),
 704 +  { [NF_BR_BROUTING]&initial_chain}, 0, NULL, (char *)&initial_chain
 705 +};
 706 +
 707 +static int check(const struct ebt_table_info *info, unsigned int valid_hooks)
 708 +{
 709 +       if (valid_hooks & ~(1 << NF_BR_BROUTING))
 710 +               return -EINVAL;
 711 +       return 0;
 712 +}
 713 +
 714 +static struct ebt_table broute_table =
 715 +{
 716 +  {NULL, NULL}, "broute", &initial_table, 1 << NF_BR_BROUTING,
 717 +  RW_LOCK_UNLOCKED, check, NULL
 718 +};
 719 +
 720 +static int ebt_broute(struct sk_buff **pskb)
 721 +{
 722 +       int ret;
 723 +
 724 +       ret = ebt_do_table(NF_BR_BROUTING, pskb, (*pskb)->dev, NULL,
 725 +          &broute_table);
 726 +       if (ret == NF_DROP)
 727 +               return 1; // route it
 728 +       return 0; // bridge it
 729 +}
 730 +
 731 +static int __init init(void)
 732 +{
 733 +       int ret;
 734 +
 735 +       ret = ebt_register_table(&broute_table);
 736 +       if (ret < 0)
 737 +               return ret;
 738 +       br_write_lock_bh(BR_NETPROTO_LOCK);
 739 +       // see br_input.c
 740 +       br_should_route_hook = ebt_broute;
 741 +       br_write_unlock_bh(BR_NETPROTO_LOCK);
 742 +       return ret;
 743 +}
 744 +
 745 +static void __exit fini(void)
 746 +{
 747 +       br_write_lock_bh(BR_NETPROTO_LOCK);
 748 +       br_should_route_hook = NULL;
 749 +       br_write_unlock_bh(BR_NETPROTO_LOCK);
 750 +       ebt_unregister_table(&broute_table);
 751 +}
 752 +
 753 +module_init(init);
 754 +module_exit(fini);
 755 +EXPORT_NO_SYMBOLS;
 756 +MODULE_LICENSE("GPL");
 757 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 758 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_among.c      2005-03-14 00:00:29.000000000 +0100
 759 @@ -0,0 +1,223 @@
 760 +/*
 761 + *  ebt_among
 762 + *
 763 + *     Authors:
 764 + *     Grzegorz Borowiak <grzes@gnu.univ.gda.pl>
 765 + *
 766 + *  August, 2003
 767 + *
 768 + */
 769 +
 770 +#include <linux/netfilter_bridge/ebtables.h>
 771 +#include <linux/netfilter_bridge/ebt_among.h>
 772 +#include <linux/ip.h>
 773 +#include <linux/if_arp.h>
 774 +#include <linux/module.h>
 775 +
 776 +static int ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
 777 +                                    const char *mac, uint32_t ip)
 778 +{
 779 +       /* You may be puzzled as to how this code works.
 780 +        * Some tricks were used, refer to
 781 +        *      include/linux/netfilter_bridge/ebt_among.h
 782 +        * as there you can find a solution of this mystery.
 783 +        */
 784 +       const struct ebt_mac_wormhash_tuple *p;
 785 +       int start, limit, i;
 786 +       uint32_t cmp[2] = { 0, 0 };
 787 +       int key = (const unsigned char) mac[5];
 788 +
 789 +       memcpy(((char *) cmp) + 2, mac, 6);
 790 +       start = wh->table[key];
 791 +       limit = wh->table[key + 1];
 792 +       if (ip) {
 793 +               for (i = start; i < limit; i++) {
 794 +                       p = &wh->pool[i];
 795 +                       if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0]) {
 796 +                               if (p->ip == 0 || p->ip == ip) {
 797 +                                       return 1;
 798 +                               }
 799 +                       }
 800 +               }
 801 +       } else {
 802 +               for (i = start; i < limit; i++) {
 803 +                       p = &wh->pool[i];
 804 +                       if (cmp[1] == p->cmp[1] && cmp[0] == p->cmp[0]) {
 805 +                               if (p->ip == 0) {
 806 +                                       return 1;
 807 +                               }
 808 +                       }
 809 +               }
 810 +       }
 811 +       return 0;
 812 +}
 813 +
 814 +static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
 815 +                                           *wh)
 816 +{
 817 +       int i;
 818 +
 819 +       for (i = 0; i < 256; i++) {
 820 +               if (wh->table[i] > wh->table[i + 1])
 821 +                       return -0x100 - i;
 822 +               if (wh->table[i] < 0)
 823 +                       return -0x200 - i;
 824 +               if (wh->table[i] > wh->poolsize)
 825 +                       return -0x300 - i;
 826 +       }
 827 +       if (wh->table[256] > wh->poolsize)
 828 +               return -0xc00;
 829 +       return 0;
 830 +}
 831 +
 832 +static int get_ip_dst(const struct sk_buff *skb, uint32_t * addr)
 833 +{
 834 +       if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_IP))
 835 +               *addr = skb->nh.iph->daddr;
 836 +       else if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) {
 837 +               uint32_t arp_len = sizeof(struct arphdr) +
 838 +                   (2 * (((*skb).nh.arph)->ar_hln)) +
 839 +                   (2 * (((*skb).nh.arph)->ar_pln));
 840 +
 841 +               /* Make sure the packet is long enough. */
 842 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
 843 +                       return -1;
 844 +               /* IPv4 addresses are always 4 bytes. */
 845 +               if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
 846 +                       return -1;
 847 +
 848 +               memcpy(addr, ((*skb).nh.raw) + sizeof(struct arphdr) +
 849 +                      (2 * (((*skb).nh.arph)->ar_hln)) +
 850 +                      (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
 851 +
 852 +       }
 853 +       return 0;
 854 +}
 855 +
 856 +static int get_ip_src(const struct sk_buff *skb, uint32_t * addr)
 857 +{
 858 +       if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_IP))
 859 +               *addr = skb->nh.iph->saddr;
 860 +       else if (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) {
 861 +               uint32_t arp_len = sizeof(struct arphdr) +
 862 +                   (2 * (((*skb).nh.arph)->ar_hln)) +
 863 +                   (2 * (((*skb).nh.arph)->ar_pln));
 864 +
 865 +               /* Make sure the packet is long enough. */
 866 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
 867 +                       return -1;
 868 +               /* IPv4 addresses are always 4 bytes. */
 869 +               if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
 870 +                       return -1;
 871 +
 872 +               memcpy(addr, ((*skb).nh.raw) + sizeof(struct arphdr) +
 873 +                      ((((*skb).nh.arph)->ar_hln)), sizeof(uint32_t));
 874 +
 875 +       }
 876 +       return 0;
 877 +}
 878 +
 879 +static int ebt_filter_among(const struct sk_buff *skb,
 880 +                           const struct net_device *in,
 881 +                           const struct net_device *out, const void *data,
 882 +                           unsigned int datalen)
 883 +{
 884 +       struct ebt_among_info *info = (struct ebt_among_info *) data;
 885 +       const char *dmac, *smac;
 886 +       const struct ebt_mac_wormhash *wh_dst, *wh_src;
 887 +       uint32_t dip = 0, sip = 0;
 888 +
 889 +       wh_dst = ebt_among_wh_dst(info);
 890 +       wh_src = ebt_among_wh_src(info);
 891 +
 892 +       if (wh_src) {
 893 +               smac = skb->mac.ethernet->h_source;
 894 +               if (get_ip_src(skb, &sip))
 895 +                       return EBT_NOMATCH;
 896 +               if (!(info->bitmask & EBT_AMONG_SRC_NEG)) {
 897 +                       /* we match only if it contains */
 898 +                       if (!ebt_mac_wormhash_contains(wh_src, smac, sip))
 899 +                               return EBT_NOMATCH;
 900 +               } else {
 901 +                       /* we match only if it DOES NOT contain */
 902 +                       if (ebt_mac_wormhash_contains(wh_src, smac, sip))
 903 +                               return EBT_NOMATCH;
 904 +               }
 905 +       }
 906 +
 907 +       if (wh_dst) {
 908 +               dmac = skb->mac.ethernet->h_dest;
 909 +               if (get_ip_dst(skb, &dip))
 910 +                       return EBT_NOMATCH;
 911 +               if (!(info->bitmask & EBT_AMONG_DST_NEG)) {
 912 +                       /* we match only if it contains */
 913 +                       if (!ebt_mac_wormhash_contains(wh_dst, dmac, dip))
 914 +                               return EBT_NOMATCH;
 915 +               } else {
 916 +                       /* we match only if it DOES NOT contain */
 917 +                       if (ebt_mac_wormhash_contains(wh_dst, dmac, dip))
 918 +                               return EBT_NOMATCH;
 919 +               }
 920 +       }
 921 +
 922 +       return EBT_MATCH;
 923 +}
 924 +
 925 +static int ebt_among_check(const char *tablename, unsigned int hookmask,
 926 +                          const struct ebt_entry *e, void *data,
 927 +                          unsigned int datalen)
 928 +{
 929 +       struct ebt_among_info *info = (struct ebt_among_info *) data;
 930 +       int expected_length = sizeof(struct ebt_among_info);
 931 +       const struct ebt_mac_wormhash *wh_dst, *wh_src;
 932 +       int err;
 933 +
 934 +       wh_dst = ebt_among_wh_dst(info);
 935 +       wh_src = ebt_among_wh_src(info);
 936 +       expected_length += ebt_mac_wormhash_size(wh_dst);
 937 +       expected_length += ebt_mac_wormhash_size(wh_src);
 938 +
 939 +       if (datalen != EBT_ALIGN(expected_length)) {
 940 +               printk(KERN_WARNING
 941 +                      "ebtables: among: wrong size: %d"
 942 +                      "against expected %d, rounded to %d\n",
 943 +                      datalen, expected_length,
 944 +                      EBT_ALIGN(expected_length));
 945 +               return -EINVAL;
 946 +       }
 947 +       if (wh_dst && (err = ebt_mac_wormhash_check_integrity(wh_dst))) {
 948 +               printk(KERN_WARNING
 949 +                      "ebtables: among: dst integrity fail: %x\n", -err);
 950 +               return -EINVAL;
 951 +       }
 952 +       if (wh_src && (err = ebt_mac_wormhash_check_integrity(wh_src))) {
 953 +               printk(KERN_WARNING
 954 +                      "ebtables: among: src integrity fail: %x\n", -err);
 955 +               return -EINVAL;
 956 +       }
 957 +       return 0;
 958 +}
 959 +
 960 +static struct ebt_match filter_among = {
 961 +       {NULL, NULL},
 962 +       EBT_AMONG_MATCH,
 963 +       ebt_filter_among,
 964 +       ebt_among_check,
 965 +       NULL,
 966 +       THIS_MODULE
 967 +};
 968 +
 969 +static int __init init(void)
 970 +{
 971 +       return ebt_register_match(&filter_among);
 972 +}
 973 +
 974 +static void __exit fini(void)
 975 +{
 976 +       ebt_unregister_match(&filter_among);
 977 +}
 978 +
 979 +module_init(init);
 980 +module_exit(fini);
 981 +EXPORT_NO_SYMBOLS;
 982 +MODULE_LICENSE("GPL");
 983 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
 984 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_limit.c      2005-03-14 00:00:29.000000000 +0100
 985 @@ -0,0 +1,101 @@
 986 +/*
 987 + *  ebt_limit
 988 + *
 989 + *     Authors:
 990 + *     Tom Marshall <tommy@home.tig-grr.com>
 991 + *
 992 + *     Mostly copied from netfilter's ipt_limit.c, see that file for explanation
 993 + *
 994 + *  September, 2003
 995 + *
 996 + */
 997 +
 998 +#include <linux/netfilter_bridge/ebtables.h>
 999 +#include <linux/netfilter_bridge/ebt_limit.h>
1000 +#include <linux/module.h>
1001 +
1002 +#include <linux/netdevice.h>
1003 +#include <linux/spinlock.h>
1004 +
1005 +static spinlock_t limit_lock = SPIN_LOCK_UNLOCKED;
1006 +
1007 +#define CREDITS_PER_JIFFY 128
1008 +
1009 +static int ebt_limit_match(const struct sk_buff *skb, const struct net_device *in,
1010 +   const struct net_device *out, const void *data, unsigned int datalen)
1011 +{
1012 +       struct ebt_limit_info *info = (struct ebt_limit_info *)data;
1013 +       unsigned long now = jiffies;
1014 +
1015 +       spin_lock_bh(&limit_lock);
1016 +       info->credit += (now - xchg(&info->prev, now)) * CREDITS_PER_JIFFY;
1017 +       if (info->credit > info->credit_cap)
1018 +               info->credit = info->credit_cap;
1019 +
1020 +       if (info->credit >= info->cost) {
1021 +               /* We're not limited. */
1022 +               info->credit -= info->cost;
1023 +               spin_unlock_bh(&limit_lock);
1024 +               return EBT_MATCH;
1025 +       }
1026 +
1027 +       spin_unlock_bh(&limit_lock);
1028 +       return EBT_NOMATCH;
1029 +}
1030 +
1031 +/* Precision saver. */
1032 +static u_int32_t
1033 +user2credits(u_int32_t user)
1034 +{
1035 +       /* If multiplying would overflow... */
1036 +       if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY))
1037 +               /* Divide first. */
1038 +               return (user / EBT_LIMIT_SCALE) * HZ * CREDITS_PER_JIFFY;
1039 +
1040 +       return (user * HZ * CREDITS_PER_JIFFY) / EBT_LIMIT_SCALE;
1041 +}
1042 +
1043 +static int ebt_limit_check(const char *tablename, unsigned int hookmask,
1044 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1045 +{
1046 +       struct ebt_limit_info *info = (struct ebt_limit_info *)data;
1047 +
1048 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_limit_info)))
1049 +               return -EINVAL;
1050 +
1051 +       /* Check for overflow. */
1052 +       if (info->burst == 0
1053 +           || user2credits(info->avg * info->burst) < user2credits(info->avg)) {
1054 +               printk("Overflow in ebt_limit: %u/%u\n",
1055 +                       info->avg, info->burst);
1056 +               return -EINVAL;
1057 +       }
1058 +
1059 +       /* User avg in seconds * EBT_LIMIT_SCALE: convert to jiffies * 128. */
1060 +       info->prev = jiffies;
1061 +       info->credit = user2credits(info->avg * info->burst);
1062 +       info->credit_cap = user2credits(info->avg * info->burst);
1063 +       info->cost = user2credits(info->avg);
1064 +       return 0;
1065 +}
1066 +
1067 +static struct ebt_match ebt_limit_reg =
1068 +{
1069 +       {NULL, NULL}, EBT_LIMIT_MATCH, ebt_limit_match, ebt_limit_check, NULL,
1070 +       THIS_MODULE
1071 +};
1072 +
1073 +static int __init init(void)
1074 +{
1075 +       return ebt_register_match(&ebt_limit_reg);
1076 +}
1077 +
1078 +static void __exit fini(void)
1079 +{
1080 +       ebt_unregister_match(&ebt_limit_reg);
1081 +}
1082 +
1083 +module_init(init);
1084 +module_exit(fini);
1085 +EXPORT_NO_SYMBOLS;
1086 +MODULE_LICENSE("GPL");
1087 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1088 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_arpreply.c   2005-03-14 00:00:30.000000000 +0100
1089 @@ -0,0 +1,86 @@
1090 +/*
1091 + *  ebt_arpreply
1092 + *
1093 + *     Authors:
1094 + *     Grzegorz Borowiak <grzes@gnu.univ.gda.pl>
1095 + *     Bart De Schuymer <bdschuym@pandora.be>
1096 + *
1097 + *  August, 2003
1098 + *
1099 + */
1100 +
1101 +#include <linux/netfilter_bridge/ebtables.h>
1102 +#include <linux/netfilter_bridge/ebt_arpreply.h>
1103 +#include <linux/if_arp.h>
1104 +#include <net/arp.h>
1105 +#include <linux/module.h>
1106 +
1107 +static int ebt_target_reply(struct sk_buff **pskb, unsigned int hooknr,
1108 +   const struct net_device *in, const struct net_device *out,
1109 +   const void *data, unsigned int datalen)
1110 +{
1111 +       struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
1112 +       struct arphdr *ah;
1113 +       unsigned char *sha, *arp_ptr;
1114 +       u32 sip, tip;
1115 +
1116 +       ah = (**pskb).nh.arph;
1117 +       if (ah->ar_op != __constant_htons(ARPOP_REQUEST) ||
1118 +           ah->ar_hln != ETH_ALEN || ah->ar_pro != htons(ETH_P_IP) ||
1119 +           ah->ar_pln != 4)
1120 +               return EBT_CONTINUE;
1121 +
1122 +       arp_ptr = (unsigned char *)(ah + 1);
1123 +
1124 +       /* get source and target IP */
1125 +       sha = arp_ptr;
1126 +       arp_ptr += ETH_ALEN;
1127 +       memcpy(&sip, arp_ptr, 4);
1128 +       arp_ptr += 4 + ETH_ALEN;
1129 +       memcpy(&tip, arp_ptr, 4);
1130 +
1131 +       arp_send(ARPOP_REPLY, ETH_P_ARP, sip, in, tip, sha, info->mac, sha);
1132 +
1133 +       return info->target;
1134 +}
1135 +
1136 +static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
1137 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1138 +{
1139 +       struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
1140 +
1141 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_arpreply_info)))
1142 +               return -EINVAL;
1143 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1144 +               return -EINVAL;
1145 +       if (e->ethproto != __constant_htons(ETH_P_ARP) ||
1146 +           e->invflags & EBT_IPROTO)
1147 +               return -EINVAL;
1148 +       CLEAR_BASE_CHAIN_BIT;
1149 +       if (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING))
1150 +               return -EINVAL;
1151 +       return 0;
1152 +}
1153 +
1154 +static struct ebt_target reply_target =
1155 +{
1156 +       .name           = EBT_ARPREPLY_TARGET,
1157 +       .target         = ebt_target_reply,
1158 +       .check          = ebt_target_reply_check,
1159 +       .me             = THIS_MODULE,
1160 +};
1161 +
1162 +static int __init init(void)
1163 +{
1164 +       return ebt_register_target(&reply_target);
1165 +}
1166 +
1167 +static void __exit fini(void)
1168 +{
1169 +       ebt_unregister_target(&reply_target);
1170 +}
1171 +
1172 +module_init(init);
1173 +module_exit(fini);
1174 +EXPORT_NO_SYMBOLS;
1175 +MODULE_LICENSE("GPL");
1176 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1177 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_802_3.c      2005-03-14 00:00:30.000000000 +0100
1178 @@ -0,0 +1,74 @@
1179 +/*
1180 + * 802_3
1181 + *
1182 + * Author:
1183 + * Chris Vitale csv@bluetail.com
1184 + *
1185 + * May 2003
1186 + *
1187 + */
1188 +
1189 +#include <linux/netfilter_bridge/ebtables.h>
1190 +#include <linux/netfilter_bridge/ebt_802_3.h>
1191 +#include <linux/module.h>
1192 +
1193 +static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
1194 +   const struct net_device *out, const void *data, unsigned int datalen)
1195 +{
1196 +       struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
1197 +       struct ebt_802_3_hdr *hdr = (struct ebt_802_3_hdr *)skb->mac.ethernet;
1198 +       uint16_t type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
1199 +
1200 +       if (info->bitmask & EBT_802_3_SAP) {
1201 +               if (FWINV(info->sap != hdr->llc.ui.ssap, EBT_802_3_SAP))
1202 +                               return EBT_NOMATCH;
1203 +               if (FWINV(info->sap != hdr->llc.ui.dsap, EBT_802_3_SAP))
1204 +                               return EBT_NOMATCH;
1205 +       }
1206 +
1207 +       if (info->bitmask & EBT_802_3_TYPE) {
1208 +               if (!(hdr->llc.ui.dsap == CHECK_TYPE && hdr->llc.ui.ssap == CHECK_TYPE))
1209 +                       return EBT_NOMATCH;
1210 +               if (FWINV(info->type != type, EBT_802_3_TYPE))
1211 +                       return EBT_NOMATCH;
1212 +       }
1213 +
1214 +       return EBT_MATCH;
1215 +}
1216 +
1217 +static struct ebt_match filter_802_3;
1218 +static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
1219 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1220 +{
1221 +       struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
1222 +
1223 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_802_3_info)))
1224 +               return -EINVAL;
1225 +       if (info->bitmask & ~EBT_802_3_MASK || info->invflags & ~EBT_802_3_MASK)
1226 +               return -EINVAL;
1227 +
1228 +       return 0;
1229 +}
1230 +
1231 +static struct ebt_match filter_802_3 =
1232 +{
1233 +       .name           = EBT_802_3_MATCH,
1234 +       .match          = ebt_filter_802_3,
1235 +       .check          = ebt_802_3_check,
1236 +       .me             = THIS_MODULE,
1237 +};
1238 +
1239 +static int __init init(void)
1240 +{
1241 +       return ebt_register_match(&filter_802_3);
1242 +}
1243 +
1244 +static void __exit fini(void)
1245 +{
1246 +       ebt_unregister_match(&filter_802_3);
1247 +}
1248 +
1249 +module_init(init);
1250 +module_exit(fini);
1251 +EXPORT_NO_SYMBOLS;
1252 +MODULE_LICENSE("GPL");
1253 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1254 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_mark.c       2005-03-14 00:00:30.000000000 +0100
1255 @@ -0,0 +1,66 @@
1256 +/*
1257 + *  ebt_mark
1258 + *
1259 + *     Authors:
1260 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1261 + *
1262 + *  July, 2002
1263 + *
1264 + */
1265 +
1266 +// The mark target can be used in any chain
1267 +// I believe adding a mangle table just for marking is total overkill
1268 +// Marking a frame doesn't really change anything in the frame anyway
1269 +
1270 +#include <linux/netfilter_bridge/ebtables.h>
1271 +#include <linux/netfilter_bridge/ebt_mark_t.h>
1272 +#include <linux/module.h>
1273 +
1274 +static int ebt_target_mark(struct sk_buff **pskb, unsigned int hooknr,
1275 +   const struct net_device *in, const struct net_device *out,
1276 +   const void *data, unsigned int datalen)
1277 +{
1278 +       struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
1279 +
1280 +       if ((*pskb)->nfmark != info->mark) {
1281 +               (*pskb)->nfmark = info->mark;
1282 +               (*pskb)->nfcache |= NFC_ALTERED;
1283 +       }
1284 +       return info->target;
1285 +}
1286 +
1287 +static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
1288 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1289 +{
1290 +       struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
1291 +
1292 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
1293 +               return -EINVAL;
1294 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1295 +               return -EINVAL;
1296 +       CLEAR_BASE_CHAIN_BIT;
1297 +       if (INVALID_TARGET)
1298 +               return -EINVAL;
1299 +       return 0;
1300 +}
1301 +
1302 +static struct ebt_target mark_target =
1303 +{
1304 +       {NULL, NULL}, EBT_MARK_TARGET, ebt_target_mark,
1305 +       ebt_target_mark_check, NULL, THIS_MODULE
1306 +};
1307 +
1308 +static int __init init(void)
1309 +{
1310 +       return ebt_register_target(&mark_target);
1311 +}
1312 +
1313 +static void __exit fini(void)
1314 +{
1315 +       ebt_unregister_target(&mark_target);
1316 +}
1317 +
1318 +module_init(init);
1319 +module_exit(fini);
1320 +EXPORT_NO_SYMBOLS;
1321 +MODULE_LICENSE("GPL");
1322 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1323 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_mark_m.c     2005-03-14 00:00:30.000000000 +0100
1324 @@ -0,0 +1,61 @@
1325 +/*
1326 + *  ebt_mark_m
1327 + *
1328 + *     Authors:
1329 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1330 + *
1331 + *  July, 2002
1332 + *
1333 + */
1334 +
1335 +#include <linux/netfilter_bridge/ebtables.h>
1336 +#include <linux/netfilter_bridge/ebt_mark_m.h>
1337 +#include <linux/module.h>
1338 +
1339 +static int ebt_filter_mark(const struct sk_buff *skb,
1340 +   const struct net_device *in, const struct net_device *out, const void *data,
1341 +   unsigned int datalen)
1342 +{
1343 +       struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
1344 +
1345 +       if (info->bitmask & EBT_MARK_OR)
1346 +               return !(!!(skb->nfmark & info->mask) ^ info->invert);
1347 +       return !(((skb->nfmark & info->mask) == info->mark) ^ info->invert);
1348 +}
1349 +
1350 +static int ebt_mark_check(const char *tablename, unsigned int hookmask,
1351 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1352 +{
1353 +        struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
1354 +
1355 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
1356 +               return -EINVAL;
1357 +       if (info->bitmask & ~EBT_MARK_MASK)
1358 +               return -EINVAL;
1359 +       if ((info->bitmask & EBT_MARK_OR) && (info->bitmask & EBT_MARK_AND))
1360 +               return -EINVAL;
1361 +       if (!info->bitmask)
1362 +               return -EINVAL;
1363 +       return 0;
1364 +}
1365 +
1366 +static struct ebt_match filter_mark =
1367 +{
1368 +       {NULL, NULL}, EBT_MARK_MATCH, ebt_filter_mark, ebt_mark_check, NULL,
1369 +       THIS_MODULE
1370 +};
1371 +
1372 +static int __init init(void)
1373 +{
1374 +       return ebt_register_match(&filter_mark);
1375 +}
1376 +
1377 +static void __exit fini(void)
1378 +{
1379 +       ebt_unregister_match(&filter_mark);
1380 +}
1381 +
1382 +module_init(init);
1383 +module_exit(fini);
1384 +EXPORT_NO_SYMBOLS;
1385 +MODULE_LICENSE("GPL");
1386 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1387 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_pkttype.c    2005-03-14 00:00:30.000000000 +0100
1388 @@ -0,0 +1,60 @@
1389 +/*
1390 + *  ebt_pkttype
1391 + *
1392 + *     Authors:
1393 + *     Bart De Schuymer <bdschuym@pandora.be>
1394 + *
1395 + *  April, 2003
1396 + *
1397 + */
1398 +
1399 +#include <linux/netfilter_bridge/ebtables.h>
1400 +#include <linux/netfilter_bridge/ebt_pkttype.h>
1401 +#include <linux/module.h>
1402 +
1403 +static int ebt_filter_pkttype(const struct sk_buff *skb,
1404 +   const struct net_device *in,
1405 +   const struct net_device *out,
1406 +   const void *data,
1407 +   unsigned int datalen)
1408 +{
1409 +       struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
1410 +
1411 +       return (skb->pkt_type != info->pkt_type) ^ info->invert;
1412 +}
1413 +
1414 +static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
1415 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1416 +{
1417 +       struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
1418 +
1419 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
1420 +               return -EINVAL;
1421 +       if (info->invert != 0 && info->invert != 1)
1422 +               return -EINVAL;
1423 +       /* Allow any pkt_type value */
1424 +       return 0;
1425 +}
1426 +
1427 +static struct ebt_match filter_pkttype =
1428 +{
1429 +       .name           = EBT_PKTTYPE_MATCH,
1430 +       .match          = ebt_filter_pkttype,
1431 +       .check          = ebt_pkttype_check,
1432 +       .me             = THIS_MODULE,
1433 +};
1434 +
1435 +static int __init init(void)
1436 +{
1437 +       return ebt_register_match(&filter_pkttype);
1438 +}
1439 +
1440 +static void __exit fini(void)
1441 +{
1442 +       ebt_unregister_match(&filter_pkttype);
1443 +}
1444 +
1445 +module_init(init);
1446 +module_exit(fini);
1447 +EXPORT_NO_SYMBOLS;
1448 +MODULE_LICENSE("GPL");
1449 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1450 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_stp.c        2005-03-14 00:00:30.000000000 +0100
1451 @@ -0,0 +1,191 @@
1452 +/*
1453 + *  ebt_stp
1454 + *
1455 + *     Authors:
1456 + *     Bart De Schuymer <bdschuym@pandora.be>
1457 + *     Stephen Hemminger <shemminger@osdl.org>
1458 + *
1459 + *  June, 2003
1460 + */
1461 +
1462 +#include <linux/netfilter_bridge/ebtables.h>
1463 +#include <linux/netfilter_bridge/ebt_stp.h>
1464 +#include <linux/module.h>
1465 +
1466 +#define BPDU_TYPE_CONFIG 0
1467 +#define BPDU_TYPE_TCN 0x80
1468 +
1469 +struct stp_header {
1470 +       uint8_t dsap;
1471 +       uint8_t ssap;
1472 +       uint8_t ctrl;
1473 +       uint8_t pid;
1474 +       uint8_t vers;
1475 +       uint8_t type;
1476 +};
1477 +
1478 +struct stp_config_pdu {
1479 +       uint8_t flags;
1480 +       uint8_t root[8];
1481 +       uint8_t root_cost[4];
1482 +       uint8_t sender[8];
1483 +       uint8_t port[2];
1484 +       uint8_t msg_age[2];
1485 +       uint8_t max_age[2];
1486 +       uint8_t hello_time[2];
1487 +       uint8_t forward_delay[2];
1488 +};
1489 +
1490 +#define NR16(p) (p[0] << 8 | p[1])
1491 +#define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
1492 +
1493 +static int ebt_filter_config(struct ebt_stp_info *info,
1494 +   struct stp_config_pdu *stpc)
1495 +{
1496 +       struct ebt_stp_config_info *c;
1497 +       uint16_t v16;
1498 +       uint32_t v32;
1499 +       int verdict, i;
1500 +
1501 +       c = &info->config;
1502 +       if ((info->bitmask & EBT_STP_FLAGS) &&
1503 +           FWINV(c->flags != stpc->flags, EBT_STP_FLAGS))
1504 +               return EBT_NOMATCH;
1505 +       if (info->bitmask & EBT_STP_ROOTPRIO) {
1506 +               v16 = NR16(stpc->root);
1507 +               if (FWINV(v16 < c->root_priol ||
1508 +                   v16 > c->root_priou, EBT_STP_ROOTPRIO))
1509 +                       return EBT_NOMATCH;
1510 +       }
1511 +       if (info->bitmask & EBT_STP_ROOTADDR) {
1512 +               verdict = 0;
1513 +               for (i = 0; i < 6; i++)
1514 +                       verdict |= (stpc->root[2+i] ^ c->root_addr[i]) &
1515 +                                  c->root_addrmsk[i];
1516 +               if (FWINV(verdict != 0, EBT_STP_ROOTADDR))
1517 +                       return EBT_NOMATCH;
1518 +       }
1519 +       if (info->bitmask & EBT_STP_ROOTCOST) {
1520 +               v32 = NR32(stpc->root_cost);
1521 +               if (FWINV(v32 < c->root_costl ||
1522 +                   v32 > c->root_costu, EBT_STP_ROOTCOST))
1523 +                       return EBT_NOMATCH;
1524 +       }
1525 +       if (info->bitmask & EBT_STP_SENDERPRIO) {
1526 +               v16 = NR16(stpc->sender);
1527 +               if (FWINV(v16 < c->sender_priol ||
1528 +                   v16 > c->sender_priou, EBT_STP_SENDERPRIO))
1529 +                       return EBT_NOMATCH;
1530 +       }
1531 +       if (info->bitmask & EBT_STP_SENDERADDR) {
1532 +               verdict = 0;
1533 +               for (i = 0; i < 6; i++)
1534 +                       verdict |= (stpc->sender[2+i] ^ c->sender_addr[i]) &
1535 +                                  c->sender_addrmsk[i];
1536 +               if (FWINV(verdict != 0, EBT_STP_SENDERADDR))
1537 +                       return EBT_NOMATCH;
1538 +       }
1539 +       if (info->bitmask & EBT_STP_PORT) {
1540 +               v16 = NR16(stpc->port);
1541 +               if (FWINV(v16 < c->portl ||
1542 +                   v16 > c->portu, EBT_STP_PORT))
1543 +                       return EBT_NOMATCH;
1544 +       }
1545 +       if (info->bitmask & EBT_STP_MSGAGE) {
1546 +               v16 = NR16(stpc->msg_age);
1547 +               if (FWINV(v16 < c->msg_agel ||
1548 +                   v16 > c->msg_ageu, EBT_STP_MSGAGE))
1549 +                       return EBT_NOMATCH;
1550 +       }
1551 +       if (info->bitmask & EBT_STP_MAXAGE) {
1552 +               v16 = NR16(stpc->max_age);
1553 +               if (FWINV(v16 < c->max_agel ||
1554 +                   v16 > c->max_ageu, EBT_STP_MAXAGE))
1555 +                       return EBT_NOMATCH;
1556 +       }
1557 +       if (info->bitmask & EBT_STP_HELLOTIME) {
1558 +               v16 = NR16(stpc->hello_time);
1559 +               if (FWINV(v16 < c->hello_timel ||
1560 +                   v16 > c->hello_timeu, EBT_STP_HELLOTIME))
1561 +                       return EBT_NOMATCH;
1562 +       }
1563 +       if (info->bitmask & EBT_STP_FWDD) {
1564 +               v16 = NR16(stpc->forward_delay);
1565 +               if (FWINV(v16 < c->forward_delayl ||
1566 +                   v16 > c->forward_delayu, EBT_STP_FWDD))
1567 +                       return EBT_NOMATCH;
1568 +       }
1569 +       return EBT_MATCH;
1570 +}
1571 +
1572 +static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
1573 +   const struct net_device *out, const void *data, unsigned int datalen)
1574 +{
1575 +       struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1576 +       struct stp_header stph;
1577 +       uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
1578 +       if (skb_copy_bits(skb, 0, &stph, sizeof(stph)))
1579 +               return EBT_NOMATCH;
1580 +
1581 +       /* The stp code only considers these */
1582 +       if (memcmp(&stph, header, sizeof(header)))
1583 +               return EBT_NOMATCH;
1584 +
1585 +       if (info->bitmask & EBT_STP_TYPE
1586 +           && FWINV(info->type != stph.type, EBT_STP_TYPE))
1587 +               return EBT_NOMATCH;
1588 +
1589 +       if (stph.type == BPDU_TYPE_CONFIG &&
1590 +           info->bitmask & EBT_STP_CONFIG_MASK) {
1591 +               struct stp_config_pdu stpc;
1592 +
1593 +               if (skb_copy_bits(skb, sizeof(stph), &stpc, sizeof(stpc)))
1594 +                   return EBT_NOMATCH;
1595 +               return ebt_filter_config(info, &stpc);
1596 +       }
1597 +       return EBT_MATCH;
1598 +}
1599 +
1600 +static int ebt_stp_check(const char *tablename, unsigned int hookmask,
1601 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1602 +{
1603 +       struct ebt_stp_info *info = (struct ebt_stp_info *)data;
1604 +       int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
1605 +       uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
1606 +       uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1607 +
1608 +       if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
1609 +           !(info->bitmask & EBT_STP_MASK))
1610 +               return -EINVAL;
1611 +       if (datalen != len)
1612 +               return -EINVAL;
1613 +       /* Make sure the match only receives stp frames */
1614 +       if (memcmp(e->destmac, bridge_ula, ETH_ALEN) ||
1615 +           memcmp(e->destmsk, msk, ETH_ALEN) || !(e->bitmask & EBT_DESTMAC))
1616 +               return -EINVAL;
1617 +
1618 +       return 0;
1619 +}
1620 +
1621 +static struct ebt_match filter_stp =
1622 +{
1623 +       .name           = EBT_STP_MATCH,
1624 +       .match          = ebt_filter_stp,
1625 +       .check          = ebt_stp_check,
1626 +       .me             = THIS_MODULE,
1627 +};
1628 +
1629 +static int __init init(void)
1630 +{
1631 +       return ebt_register_match(&filter_stp);
1632 +}
1633 +
1634 +static void __exit fini(void)
1635 +{
1636 +       ebt_unregister_match(&filter_stp);
1637 +}
1638 +
1639 +module_init(init);
1640 +module_exit(fini);
1641 +EXPORT_NO_SYMBOLS;
1642 +MODULE_LICENSE("GPL");
1643 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1644 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_redirect.c   2005-03-14 00:00:30.000000000 +0100
1645 @@ -0,0 +1,71 @@
1646 +/*
1647 + *  ebt_redirect
1648 + *
1649 + *     Authors:
1650 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1651 + *
1652 + *  April, 2002
1653 + *
1654 + */
1655 +
1656 +#include <linux/netfilter_bridge/ebtables.h>
1657 +#include <linux/netfilter_bridge/ebt_redirect.h>
1658 +#include <linux/module.h>
1659 +#include <net/sock.h>
1660 +#include "../br_private.h"
1661 +
1662 +static int ebt_target_redirect(struct sk_buff **pskb, unsigned int hooknr,
1663 +   const struct net_device *in, const struct net_device *out,
1664 +   const void *data, unsigned int datalen)
1665 +{
1666 +       struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1667 +
1668 +       if (hooknr != NF_BR_BROUTING)
1669 +               memcpy((**pskb).mac.ethernet->h_dest,
1670 +                  in->br_port->br->dev.dev_addr, ETH_ALEN);
1671 +       else {
1672 +               memcpy((**pskb).mac.ethernet->h_dest,
1673 +                  in->dev_addr, ETH_ALEN);
1674 +               (*pskb)->pkt_type = PACKET_HOST;
1675 +       }
1676 +       return info->target;
1677 +}
1678 +
1679 +static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
1680 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1681 +{
1682 +       struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
1683 +
1684 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
1685 +               return -EINVAL;
1686 +       if (BASE_CHAIN && info->target == EBT_RETURN)
1687 +               return -EINVAL;
1688 +       CLEAR_BASE_CHAIN_BIT;
1689 +       if ( (strcmp(tablename, "nat") || hookmask & ~(1 << NF_BR_PRE_ROUTING)) &&
1690 +            (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
1691 +               return -EINVAL;
1692 +       if (INVALID_TARGET)
1693 +               return -EINVAL;
1694 +       return 0;
1695 +}
1696 +
1697 +static struct ebt_target redirect_target =
1698 +{
1699 +       {NULL, NULL}, EBT_REDIRECT_TARGET, ebt_target_redirect,
1700 +       ebt_target_redirect_check, NULL, THIS_MODULE
1701 +};
1702 +
1703 +static int __init init(void)
1704 +{
1705 +       return ebt_register_target(&redirect_target);
1706 +}
1707 +
1708 +static void __exit fini(void)
1709 +{
1710 +       ebt_unregister_target(&redirect_target);
1711 +}
1712 +
1713 +module_init(init);
1714 +module_exit(fini);
1715 +EXPORT_NO_SYMBOLS;
1716 +MODULE_LICENSE("GPL");
1717 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1718 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_arp.c        2005-03-14 00:00:30.000000000 +0100
1719 @@ -0,0 +1,149 @@
1720 +/*
1721 + *  ebt_arp
1722 + *
1723 + *     Authors:
1724 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1725 + *     Tim Gardner <timg@tpi.com>
1726 + *
1727 + *  April, 2002
1728 + *
1729 + */
1730 +
1731 +#include <linux/netfilter_bridge/ebtables.h>
1732 +#include <linux/netfilter_bridge/ebt_arp.h>
1733 +#include <linux/if_arp.h>
1734 +#include <linux/if_ether.h>
1735 +#include <linux/module.h>
1736 +
1737 +static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
1738 +   const struct net_device *out, const void *data, unsigned int datalen)
1739 +{
1740 +       struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1741 +
1742 +       if (info->bitmask & EBT_ARP_OPCODE && FWINV(info->opcode !=
1743 +          ((*skb).nh.arph)->ar_op, EBT_ARP_OPCODE))
1744 +               return EBT_NOMATCH;
1745 +       if (info->bitmask & EBT_ARP_HTYPE && FWINV(info->htype !=
1746 +          ((*skb).nh.arph)->ar_hrd, EBT_ARP_HTYPE))
1747 +               return EBT_NOMATCH;
1748 +       if (info->bitmask & EBT_ARP_PTYPE && FWINV(info->ptype !=
1749 +          ((*skb).nh.arph)->ar_pro, EBT_ARP_PTYPE))
1750 +               return EBT_NOMATCH;
1751 +
1752 +       if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP))
1753 +       {
1754 +               uint32_t arp_len = sizeof(struct arphdr) +
1755 +                  (2 * (((*skb).nh.arph)->ar_hln)) +
1756 +                  (2 * (((*skb).nh.arph)->ar_pln));
1757 +               uint32_t dst;
1758 +               uint32_t src;
1759 +
1760 +               // Make sure the packet is long enough.
1761 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1762 +                       return EBT_NOMATCH;
1763 +               // IPv4 addresses are always 4 bytes.
1764 +               if (((*skb).nh.arph)->ar_pln != sizeof(uint32_t))
1765 +                       return EBT_NOMATCH;
1766 +
1767 +               if (info->bitmask & EBT_ARP_SRC_IP) {
1768 +                       memcpy(&src, ((*skb).nh.raw) + sizeof(struct arphdr) +
1769 +                          ((*skb).nh.arph)->ar_hln, sizeof(uint32_t));
1770 +                       if (FWINV(info->saddr != (src & info->smsk),
1771 +                          EBT_ARP_SRC_IP))
1772 +                               return EBT_NOMATCH;
1773 +               }
1774 +
1775 +               if (info->bitmask & EBT_ARP_DST_IP) {
1776 +                       memcpy(&dst, ((*skb).nh.raw)+sizeof(struct arphdr) +
1777 +                          (2*(((*skb).nh.arph)->ar_hln)) +
1778 +                          (((*skb).nh.arph)->ar_pln), sizeof(uint32_t));
1779 +                       if (FWINV(info->daddr != (dst & info->dmsk),
1780 +                          EBT_ARP_DST_IP))
1781 +                               return EBT_NOMATCH;
1782 +               }
1783 +       }
1784 +
1785 +       if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC))
1786 +       {
1787 +               uint32_t arp_len = sizeof(struct arphdr) +
1788 +                  (2 * (((*skb).nh.arph)->ar_hln)) +
1789 +                  (2 * (((*skb).nh.arph)->ar_pln));
1790 +               unsigned char dst[ETH_ALEN];
1791 +               unsigned char src[ETH_ALEN];
1792 +
1793 +               // Make sure the packet is long enough.
1794 +               if ((((*skb).nh.raw) + arp_len) > (*skb).tail)
1795 +                       return EBT_NOMATCH;
1796 +               // MAC addresses are 6 bytes.
1797 +               if (((*skb).nh.arph)->ar_hln != ETH_ALEN)
1798 +                       return EBT_NOMATCH;
1799 +               if (info->bitmask & EBT_ARP_SRC_MAC) {
1800 +                       uint8_t verdict, i;
1801 +
1802 +                       memcpy(&src, ((*skb).nh.raw) +
1803 +                                       sizeof(struct arphdr),
1804 +                                       ETH_ALEN);
1805 +                       verdict = 0;
1806 +                       for (i = 0; i < 6; i++)
1807 +                               verdict |= (src[i] ^ info->smaddr[i]) &
1808 +                                      info->smmsk[i];
1809 +                       if (FWINV(verdict != 0, EBT_ARP_SRC_MAC))
1810 +                               return EBT_NOMATCH;
1811 +               }
1812 +
1813 +               if (info->bitmask & EBT_ARP_DST_MAC) {
1814 +                       uint8_t verdict, i;
1815 +
1816 +                       memcpy(&dst, ((*skb).nh.raw) +
1817 +                                       sizeof(struct arphdr) +
1818 +                                       (((*skb).nh.arph)->ar_hln) +
1819 +                                       (((*skb).nh.arph)->ar_pln),
1820 +                                       ETH_ALEN);
1821 +                       verdict = 0;
1822 +                       for (i = 0; i < 6; i++)
1823 +                               verdict |= (dst[i] ^ info->dmaddr[i]) &
1824 +                                       info->dmmsk[i];
1825 +                       if (FWINV(verdict != 0, EBT_ARP_DST_MAC))
1826 +                               return EBT_NOMATCH;
1827 +               }
1828 +       }
1829 +
1830 +       return EBT_MATCH;
1831 +}
1832 +
1833 +static int ebt_arp_check(const char *tablename, unsigned int hookmask,
1834 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1835 +{
1836 +       struct ebt_arp_info *info = (struct ebt_arp_info *)data;
1837 +
1838 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
1839 +               return -EINVAL;
1840 +       if ((e->ethproto != __constant_htons(ETH_P_ARP) &&
1841 +          e->ethproto != __constant_htons(ETH_P_RARP)) ||
1842 +          e->invflags & EBT_IPROTO)
1843 +               return -EINVAL;
1844 +       if (info->bitmask & ~EBT_ARP_MASK || info->invflags & ~EBT_ARP_MASK)
1845 +               return -EINVAL;
1846 +       return 0;
1847 +}
1848 +
1849 +static struct ebt_match filter_arp =
1850 +{
1851 +       {NULL, NULL}, EBT_ARP_MATCH, ebt_filter_arp, ebt_arp_check, NULL,
1852 +       THIS_MODULE
1853 +};
1854 +
1855 +static int __init init(void)
1856 +{
1857 +       return ebt_register_match(&filter_arp);
1858 +}
1859 +
1860 +static void __exit fini(void)
1861 +{
1862 +       ebt_unregister_match(&filter_arp);
1863 +}
1864 +
1865 +module_init(init);
1866 +module_exit(fini);
1867 +EXPORT_NO_SYMBOLS;
1868 +MODULE_LICENSE("GPL");
1869 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1870 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_ip.c 2005-03-14 00:00:30.000000000 +0100
1871 @@ -0,0 +1,121 @@
1872 +/*
1873 + *  ebt_ip
1874 + *
1875 + *     Authors:
1876 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
1877 + *
1878 + *  April, 2002
1879 + *
1880 + *  Changes:
1881 + *    added ip-sport and ip-dport
1882 + *    Innominate Security Technologies AG <mhopf@innominate.com>
1883 + *    September, 2002
1884 + */
1885 +
1886 +#include <linux/netfilter_bridge/ebtables.h>
1887 +#include <linux/netfilter_bridge/ebt_ip.h>
1888 +#include <linux/ip.h>
1889 +#include <linux/in.h>
1890 +#include <linux/module.h>
1891 +
1892 +struct tcpudphdr {
1893 +       uint16_t src;
1894 +       uint16_t dst;
1895 +};
1896 +
1897 +union h_u {
1898 +       unsigned char *raw;
1899 +       struct tcpudphdr *tuh;
1900 +};
1901 +
1902 +static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
1903 +   const struct net_device *out, const void *data,
1904 +   unsigned int datalen)
1905 +{
1906 +       struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1907 +
1908 +       if (info->bitmask & EBT_IP_TOS &&
1909 +          FWINV(info->tos != ((*skb).nh.iph)->tos, EBT_IP_TOS))
1910 +               return EBT_NOMATCH;
1911 +       if (info->bitmask & EBT_IP_PROTO) {
1912 +               if (FWINV(info->protocol != ((*skb).nh.iph)->protocol,
1913 +                         EBT_IP_PROTO))
1914 +                       return EBT_NOMATCH;
1915 +               if ( info->protocol == IPPROTO_TCP ||
1916 +                    info->protocol == IPPROTO_UDP )
1917 +               {
1918 +                       union h_u h;
1919 +                       h.raw = skb->data + skb->nh.iph->ihl*4;
1920 +                       if (info->bitmask & EBT_IP_DPORT) {
1921 +                               uint16_t port = ntohs(h.tuh->dst);
1922 +                               if (FWINV(port < info->dport[0] ||
1923 +                                         port > info->dport[1],
1924 +                                         EBT_IP_DPORT))
1925 +                               return EBT_NOMATCH;
1926 +                       }
1927 +                       if (info->bitmask & EBT_IP_SPORT) {
1928 +                               uint16_t port = ntohs(h.tuh->src);
1929 +                               if (FWINV(port < info->sport[0] ||
1930 +                                         port > info->sport[1],
1931 +                                         EBT_IP_SPORT))
1932 +                               return EBT_NOMATCH;
1933 +                       }
1934 +               }
1935 +       }
1936 +       if (info->bitmask & EBT_IP_SOURCE &&
1937 +          FWINV((((*skb).nh.iph)->saddr & info->smsk) !=
1938 +          info->saddr, EBT_IP_SOURCE))
1939 +               return EBT_NOMATCH;
1940 +       if ((info->bitmask & EBT_IP_DEST) &&
1941 +          FWINV((((*skb).nh.iph)->daddr & info->dmsk) !=
1942 +          info->daddr, EBT_IP_DEST))
1943 +               return EBT_NOMATCH;
1944 +       return EBT_MATCH;
1945 +}
1946 +
1947 +static int ebt_ip_check(const char *tablename, unsigned int hookmask,
1948 +   const struct ebt_entry *e, void *data, unsigned int datalen)
1949 +{
1950 +       struct ebt_ip_info *info = (struct ebt_ip_info *)data;
1951 +
1952 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
1953 +               return -EINVAL;
1954 +       if (e->ethproto != __constant_htons(ETH_P_IP) ||
1955 +          e->invflags & EBT_IPROTO)
1956 +               return -EINVAL;
1957 +       if (info->bitmask & ~EBT_IP_MASK || info->invflags & ~EBT_IP_MASK)
1958 +               return -EINVAL;
1959 +       if (info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT)) {
1960 +               if (!info->bitmask & EBT_IPROTO)
1961 +                       return -EINVAL;
1962 +               if (info->protocol != IPPROTO_TCP &&
1963 +                   info->protocol != IPPROTO_UDP)
1964 +                        return -EINVAL;
1965 +       }
1966 +       if (info->bitmask & EBT_IP_DPORT && info->dport[0] > info->dport[1])
1967 +               return -EINVAL;
1968 +       if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
1969 +               return -EINVAL;
1970 +       return 0;
1971 +}
1972 +
1973 +static struct ebt_match filter_ip =
1974 +{
1975 +       {NULL, NULL}, EBT_IP_MATCH, ebt_filter_ip, ebt_ip_check, NULL,
1976 +       THIS_MODULE
1977 +};
1978 +
1979 +static int __init init(void)
1980 +{
1981 +       return ebt_register_match(&filter_ip);
1982 +}
1983 +
1984 +static void __exit fini(void)
1985 +{
1986 +       ebt_unregister_match(&filter_ip);
1987 +}
1988 +
1989 +module_init(init);
1990 +module_exit(fini);
1991 +EXPORT_NO_SYMBOLS;
1992 +MODULE_LICENSE("GPL");
1993 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
1994 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_vlan.c       2005-03-14 00:00:30.000000000 +0100
1995 @@ -0,0 +1,259 @@
1996 +/*
1997 + * Description: EBTables 802.1Q match extension kernelspace module.
1998 + * Authors: Nick Fedchik <nick@fedchik.org.ua>
1999 + *          Bart De Schuymer <bart.de.schuymer@pandora.be>
2000 + *
2001 + * This program is free software; you can redistribute it and/or modify
2002 + * it under the terms of the GNU General Public License as published by
2003 + * the Free Software Foundation; either version 2 of the License, or
2004 + * (at your option) any later version.
2005 + *
2006 + * This program is distributed in the hope that it will be useful,
2007 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
2008 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
2009 + * GNU General Public License for more details.
2010 + *
2011 + * You should have received a copy of the GNU General Public License
2012 + * along with this program; if not, write to the Free Software
2013 + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
2014 + */
2015 +
2016 +#include <linux/if_ether.h>
2017 +#include <linux/if_vlan.h>
2018 +#include <linux/module.h>
2019 +#include <linux/netfilter_bridge/ebtables.h>
2020 +#include <linux/netfilter_bridge/ebt_vlan.h>
2021 +
2022 +static unsigned char debug;
2023 +#define MODULE_VERSION "0.6"
2024 +
2025 +MODULE_PARM(debug, "0-1b");
2026 +MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
2027 +MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
2028 +MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
2029 +                  MODULE_VERSION);
2030 +MODULE_LICENSE("GPL");
2031 +
2032 +
2033 +#define DEBUG_MSG(args...) if (debug) printk (KERN_DEBUG "ebt_vlan: " args)
2034 +#define INV_FLAG(_inv_flag_) (info->invflags & _inv_flag_) ? "!" : ""
2035 +#define GET_BITMASK(_BIT_MASK_) info->bitmask & _BIT_MASK_
2036 +#define SET_BITMASK(_BIT_MASK_) info->bitmask |= _BIT_MASK_
2037 +#define EXIT_ON_MISMATCH(_MATCH_,_MASK_) if (!((info->_MATCH_ == _MATCH_)^!!(info->invflags & _MASK_))) return 1;
2038 +
2039 +/*
2040 + * Function description: ebt_filter_vlan() is main engine for
2041 + * checking passed 802.1Q frame according to
2042 + * the passed extension parameters (in the *data buffer)
2043 + * ebt_filter_vlan() is called after successfull check the rule params
2044 + * by ebt_check_vlan() function.
2045 + * Parameters:
2046 + * const struct sk_buff *skb - pointer to passed ethernet frame buffer
2047 + * const void *data - pointer to passed extension parameters
2048 + * unsigned int datalen - length of passed *data buffer
2049 + * const struct net_device *in  -
2050 + * const struct net_device *out -
2051 + * const struct ebt_counter *c -
2052 + * Returned values:
2053 + * 0 - ok (all rule params matched)
2054 + * 1 - miss (rule params not acceptable to the parsed frame)
2055 + */
2056 +static int
2057 +ebt_filter_vlan(const struct sk_buff *skb,
2058 +               const struct net_device *in,
2059 +               const struct net_device *out,
2060 +               const void *data, unsigned int datalen)
2061 +{
2062 +       struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;     /* userspace data */
2063 +       struct vlan_ethhdr *frame = (struct vlan_ethhdr *) skb->mac.raw;        /* Passed tagged frame */
2064 +
2065 +       unsigned short TCI;     /* Whole TCI, given from parsed frame */
2066 +       unsigned short id;      /* VLAN ID, given from frame TCI */
2067 +       unsigned char prio;     /* user_priority, given from frame TCI */
2068 +       unsigned short encap;   /* VLAN encapsulated Type/Length field, given from orig frame */
2069 +
2070 +       /*
2071 +        * Tag Control Information (TCI) consists of the following elements:
2072 +        * - User_priority. The user_priority field is three bits in length,
2073 +        * interpreted as a binary number.
2074 +        * - Canonical Format Indicator (CFI). The Canonical Format Indicator
2075 +        * (CFI) is a single bit flag value. Currently ignored.
2076 +        * - VLAN Identifier (VID). The VID is encoded as
2077 +        * an unsigned binary number.
2078 +        */
2079 +       TCI = ntohs(frame->h_vlan_TCI);
2080 +       id = TCI & VLAN_VID_MASK;
2081 +       prio = (TCI >> 13) & 0x7;
2082 +       encap = frame->h_vlan_encapsulated_proto;
2083 +
2084 +       /*
2085 +        * Checking VLAN Identifier (VID)
2086 +        */
2087 +       if (GET_BITMASK(EBT_VLAN_ID)) { /* Is VLAN ID parsed? */
2088 +               EXIT_ON_MISMATCH(id, EBT_VLAN_ID);
2089 +       }
2090 +       /*
2091 +        * Checking user_priority
2092 +        */
2093 +       if (GET_BITMASK(EBT_VLAN_PRIO)) {       /* Is VLAN user_priority parsed? */
2094 +               EXIT_ON_MISMATCH(prio, EBT_VLAN_PRIO);
2095 +       }
2096 +       /*
2097 +        * Checking Encapsulated Proto (Length/Type) field
2098 +        */
2099 +       if (GET_BITMASK(EBT_VLAN_ENCAP)) {      /* Is VLAN Encap parsed? */
2100 +               EXIT_ON_MISMATCH(encap, EBT_VLAN_ENCAP);
2101 +       }
2102 +       /*
2103 +        * All possible extension parameters was parsed.
2104 +        * If rule never returned by missmatch, then all ok.
2105 +        */
2106 +       return 0;
2107 +}
2108 +
2109 +/*
2110 + * Function description: ebt_vlan_check() is called when userspace
2111 + * delivers the table entry to the kernel,
2112 + * and to check that userspace doesn't give a bad table.
2113 + * Parameters:
2114 + * const char *tablename - table name string
2115 + * unsigned int hooknr - hook number
2116 + * const struct ebt_entry *e - ebtables entry basic set
2117 + * const void *data - pointer to passed extension parameters
2118 + * unsigned int datalen - length of passed *data buffer
2119 + * Returned values:
2120 + * 0 - ok (all delivered rule params are correct)
2121 + * 1 - miss (rule params is out of range, invalid, incompatible, etc.)
2122 + */
2123 +static int
2124 +ebt_check_vlan(const char *tablename,
2125 +              unsigned int hooknr,
2126 +              const struct ebt_entry *e, void *data, unsigned int datalen)
2127 +{
2128 +       struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
2129 +
2130 +       /*
2131 +        * Parameters buffer overflow check
2132 +        */
2133 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
2134 +               DEBUG_MSG
2135 +                   ("passed size %d is not eq to ebt_vlan_info (%d)\n",
2136 +                    datalen, sizeof(struct ebt_vlan_info));
2137 +               return -EINVAL;
2138 +       }
2139 +
2140 +       /*
2141 +        * Is it 802.1Q frame checked?
2142 +        */
2143 +       if (e->ethproto != __constant_htons(ETH_P_8021Q)) {
2144 +               DEBUG_MSG
2145 +                   ("passed entry proto %2.4X is not 802.1Q (8100)\n",
2146 +                    (unsigned short) ntohs(e->ethproto));
2147 +               return -EINVAL;
2148 +       }
2149 +
2150 +       /*
2151 +        * Check for bitmask range
2152 +        * True if even one bit is out of mask
2153 +        */
2154 +       if (info->bitmask & ~EBT_VLAN_MASK) {
2155 +               DEBUG_MSG("bitmask %2X is out of mask (%2X)\n",
2156 +                         info->bitmask, EBT_VLAN_MASK);
2157 +               return -EINVAL;
2158 +       }
2159 +
2160 +       /*
2161 +        * Check for inversion flags range
2162 +        */
2163 +       if (info->invflags & ~EBT_VLAN_MASK) {
2164 +               DEBUG_MSG("inversion flags %2X is out of mask (%2X)\n",
2165 +                         info->invflags, EBT_VLAN_MASK);
2166 +               return -EINVAL;
2167 +       }
2168 +
2169 +       /*
2170 +        * Reserved VLAN ID (VID) values
2171 +        * -----------------------------
2172 +        * 0 - The null VLAN ID.
2173 +        * 1 - The default Port VID (PVID)
2174 +        * 0x0FFF - Reserved for implementation use.
2175 +        * if_vlan.h: VLAN_GROUP_ARRAY_LEN 4096.
2176 +        */
2177 +       if (GET_BITMASK(EBT_VLAN_ID)) { /* when vlan-id param was spec-ed */
2178 +               if (!!info->id) {       /* if id!=0 => check vid range */
2179 +                       if (info->id > VLAN_GROUP_ARRAY_LEN) {
2180 +                               DEBUG_MSG
2181 +                                   ("id %d is out of range (1-4096)\n",
2182 +                                    info->id);
2183 +                               return -EINVAL;
2184 +                       }
2185 +                       /*
2186 +                        * Note: This is valid VLAN-tagged frame point.
2187 +                        * Any value of user_priority are acceptable,
2188 +                        * but should be ignored according to 802.1Q Std.
2189 +                        * So we just drop the prio flag.
2190 +                        */
2191 +                       info->bitmask &= ~EBT_VLAN_PRIO;
2192 +               }
2193 +               /*
2194 +                * Else, id=0 (null VLAN ID)  => user_priority range (any?)
2195 +                */
2196 +       }
2197 +
2198 +       if (GET_BITMASK(EBT_VLAN_PRIO)) {
2199 +               if ((unsigned char) info->prio > 7) {
2200 +                       DEBUG_MSG
2201 +                           ("prio %d is out of range (0-7)\n",
2202 +                            info->prio);
2203 +                       return -EINVAL;
2204 +               }
2205 +       }
2206 +       /*
2207 +        * Check for encapsulated proto range - it is possible to be
2208 +        * any value for u_short range.
2209 +        * if_ether.h:  ETH_ZLEN        60   -  Min. octets in frame sans FCS
2210 +        */
2211 +       if (GET_BITMASK(EBT_VLAN_ENCAP)) {
2212 +               if ((unsigned short) ntohs(info->encap) < ETH_ZLEN) {
2213 +                       DEBUG_MSG
2214 +                           ("encap frame length %d is less than minimal\n",
2215 +                            ntohs(info->encap));
2216 +                       return -EINVAL;
2217 +               }
2218 +       }
2219 +
2220 +       return 0;
2221 +}
2222 +
2223 +static struct ebt_match filter_vlan = {
2224 +       {NULL, NULL},
2225 +       EBT_VLAN_MATCH,
2226 +       ebt_filter_vlan,
2227 +       ebt_check_vlan,
2228 +       NULL,
2229 +       THIS_MODULE
2230 +};
2231 +
2232 +/*
2233 + * Module initialization function.
2234 + */
2235 +static int __init init(void)
2236 +{
2237 +       DEBUG_MSG("ebtables 802.1Q extension module v"
2238 +                 MODULE_VERSION "\n");
2239 +       DEBUG_MSG("module debug=%d\n", !!debug);
2240 +       return ebt_register_match(&filter_vlan);
2241 +}
2242 +
2243 +/*
2244 + * Module "finalization" function
2245 + */
2246 +static void __exit fini(void)
2247 +{
2248 +       ebt_unregister_match(&filter_vlan);
2249 +}
2250 +
2251 +module_init(init);
2252 +module_exit(fini);
2253 +
2254 +EXPORT_NO_SYMBOLS;
2255 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
2256 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_log.c        2005-03-14 00:00:30.000000000 +0100
2257 @@ -0,0 +1,153 @@
2258 +/*
2259 + *  ebt_log
2260 + *
2261 + *     Authors:
2262 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
2263 + *
2264 + *  April, 2002
2265 + *
2266 + */
2267 +
2268 +#include <linux/netfilter_bridge/ebtables.h>
2269 +#include <linux/netfilter_bridge/ebt_log.h>
2270 +#include <linux/module.h>
2271 +#include <linux/ip.h>
2272 +#include <linux/in.h>
2273 +#include <linux/if_arp.h>
2274 +#include <linux/spinlock.h>
2275 +
2276 +static spinlock_t ebt_log_lock = SPIN_LOCK_UNLOCKED;
2277 +
2278 +static int ebt_log_check(const char *tablename, unsigned int hookmask,
2279 +   const struct ebt_entry *e, void *data, unsigned int datalen)
2280 +{
2281 +       struct ebt_log_info *info = (struct ebt_log_info *)data;
2282 +
2283 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
2284 +               return -EINVAL;
2285 +       if (info->bitmask & ~EBT_LOG_MASK)
2286 +               return -EINVAL;
2287 +       if (info->loglevel >= 8)
2288 +               return -EINVAL;
2289 +       info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
2290 +       return 0;
2291 +}
2292 +
2293 +struct tcpudphdr
2294 +{
2295 +       uint16_t src;
2296 +       uint16_t dst;
2297 +};
2298 +
2299 +struct arppayload
2300 +{
2301 +       unsigned char mac_src[ETH_ALEN];
2302 +       unsigned char ip_src[4];
2303 +       unsigned char mac_dst[ETH_ALEN];
2304 +       unsigned char ip_dst[4];
2305 +};
2306 +
2307 +static void print_MAC(unsigned char *p)
2308 +{
2309 +       int i;
2310 +
2311 +       for (i = 0; i < ETH_ALEN; i++, p++)
2312 +               printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
2313 +}
2314 +
2315 +#define myNIPQUAD(a) a[0], a[1], a[2], a[3]
2316 +static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
2317 +   const struct net_device *in, const struct net_device *out,
2318 +   const void *data, unsigned int datalen)
2319 +{
2320 +       struct ebt_log_info *info = (struct ebt_log_info *)data;
2321 +       char level_string[4] = "< >";
2322 +       level_string[1] = '0' + info->loglevel;
2323 +
2324 +       spin_lock_bh(&ebt_log_lock);
2325 +       printk(level_string);
2326 +       printk("%s IN=%s OUT=%s ", info->prefix, in ? in->name : "",
2327 +          out ? out->name : "");
2328 +
2329 +       printk("MAC source = ");
2330 +       print_MAC((skb->mac.ethernet)->h_source);
2331 +       printk("MAC dest = ");
2332 +       print_MAC((skb->mac.ethernet)->h_dest);
2333 +
2334 +       printk("proto = 0x%04x", ntohs(((*skb).mac.ethernet)->h_proto));
2335 +
2336 +       if ((info->bitmask & EBT_LOG_IP) && skb->mac.ethernet->h_proto ==
2337 +          htons(ETH_P_IP)){
2338 +               struct iphdr *iph = skb->nh.iph;
2339 +               printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u,",
2340 +                  NIPQUAD(iph->saddr), NIPQUAD(iph->daddr));
2341 +               printk(" IP tos=0x%02X, IP proto=%d", iph->tos, iph->protocol);
2342 +               if (iph->protocol == IPPROTO_TCP ||
2343 +                   iph->protocol == IPPROTO_UDP) {
2344 +                       struct tcpudphdr *ports = (struct tcpudphdr *)(skb->data + iph->ihl*4);
2345 +
2346 +                       if (skb->data + iph->ihl*4 > skb->tail) {
2347 +                               printk(" INCOMPLETE TCP/UDP header");
2348 +                               goto out;
2349 +                       }
2350 +                       printk(" SPT=%u DPT=%u", ntohs(ports->src),
2351 +                          ntohs(ports->dst));
2352 +               }
2353 +               goto out;
2354 +       }
2355 +
2356 +       if ((info->bitmask & EBT_LOG_ARP) &&
2357 +           ((skb->mac.ethernet->h_proto == __constant_htons(ETH_P_ARP)) ||
2358 +           (skb->mac.ethernet->h_proto == __constant_htons(ETH_P_RARP)))) {
2359 +               struct arphdr * arph = skb->nh.arph;
2360 +               printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
2361 +                  ntohs(arph->ar_hrd), ntohs(arph->ar_pro),
2362 +                  ntohs(arph->ar_op));
2363 +               /* If it's for Ethernet and the lengths are OK,
2364 +                * then log the ARP payload */
2365 +               if (arph->ar_hrd == __constant_htons(1) &&
2366 +                   arph->ar_hln == ETH_ALEN &&
2367 +                   arph->ar_pln == sizeof(uint32_t)) {
2368 +                       struct arppayload *arpp = (struct arppayload *)(skb->data + sizeof(*arph));
2369 +
2370 +                       if (skb->data + sizeof(*arph) > skb->tail) {
2371 +                               printk(" INCOMPLETE ARP header");
2372 +                               goto out;
2373 +                       }
2374 +
2375 +                       printk(" ARP MAC SRC=");
2376 +                       print_MAC(arpp->mac_src);
2377 +                       printk(" ARP IP SRC=%u.%u.%u.%u",
2378 +                              myNIPQUAD(arpp->ip_src));
2379 +                       printk(" ARP MAC DST=");
2380 +                       print_MAC(arpp->mac_dst);
2381 +                       printk(" ARP IP DST=%u.%u.%u.%u",
2382 +                              myNIPQUAD(arpp->ip_dst));
2383 +               }
2384 +
2385 +       }
2386 +out:
2387 +       printk("\n");
2388 +       spin_unlock_bh(&ebt_log_lock);
2389 +}
2390 +
2391 +static struct ebt_watcher log =
2392 +{
2393 +       {NULL, NULL}, EBT_LOG_WATCHER, ebt_log, ebt_log_check, NULL,
2394 +       THIS_MODULE
2395 +};
2396 +
2397 +static int __init init(void)
2398 +{
2399 +       return ebt_register_watcher(&log);
2400 +}
2401 +
2402 +static void __exit fini(void)
2403 +{
2404 +       ebt_unregister_watcher(&log);
2405 +}
2406 +
2407 +module_init(init);
2408 +module_exit(fini);
2409 +EXPORT_NO_SYMBOLS;
2410 +MODULE_LICENSE("GPL");
2411 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
2412 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_ulog.c       2005-03-14 00:00:30.000000000 +0100
2413 @@ -0,0 +1,281 @@
2414 +/*
2415 + * netfilter module for userspace bridged Ethernet frames logging daemons
2416 + *
2417 + *     Authors:
2418 + *     Bart De Schuymer <bdschuym@pandora.be>
2419 + *
2420 + *  November, 2004
2421 + *
2422 + * Based on ipt_ULOG.c, which is
2423 + * (C) 2000-2002 by Harald Welte <laforge@netfilter.org>
2424 + *
2425 + * This module accepts two parameters:
2426 + *
2427 + * nlbufsiz:
2428 + *   The parameter specifies how big the buffer for each netlink multicast
2429 + * group is. e.g. If you say nlbufsiz=8192, up to eight kb of packets will
2430 + * get accumulated in the kernel until they are sent to userspace. It is
2431 + * NOT possible to allocate more than 128kB, and it is strongly discouraged,
2432 + * because atomically allocating 128kB inside the network rx softirq is not
2433 + * reliable. Please also keep in mind that this buffer size is allocated for
2434 + * each nlgroup you are using, so the total kernel memory usage increases
2435 + * by that factor.
2436 + *
2437 + * flushtimeout:
2438 + *   Specify, after how many hundredths of a second the queue should be
2439 + *   flushed even if it is not full yet.
2440 + *
2441 + */
2442 +
2443 +#include <linux/module.h>
2444 +#include <linux/config.h>
2445 +#include <linux/spinlock.h>
2446 +#include <linux/socket.h>
2447 +#include <linux/skbuff.h>
2448 +#include <linux/kernel.h>
2449 +#include <linux/timer.h>
2450 +#include <linux/netlink.h>
2451 +#include <linux/netdevice.h>
2452 +#include <linux/module.h>
2453 +#include <linux/netfilter_bridge/ebtables.h>
2454 +#include <linux/netfilter_bridge/ebt_ulog.h>
2455 +#include <net/sock.h>
2456 +#include "../br_private.h"
2457 +
2458 +#define PRINTR(format, args...)        do { if (net_ratelimit()) \
2459 +                                               printk(format , ## args); } while (0)
2460 +
2461 +static unsigned int nlbufsiz = 4096;
2462 +MODULE_PARM(nlbufsiz, "i");
2463 +MODULE_PARM_DESC(nlbufsiz, "netlink buffer size (number of bytes) "
2464 +                           "(defaults to 4096)");
2465 +
2466 +static unsigned int flushtimeout = 10;
2467 +MODULE_PARM(flushtimeout, "i");
2468 +MODULE_PARM_DESC(flushtimeout, "buffer flush timeout (hundredths of a second) "
2469 +                               "(defaults to 10)");
2470 +
2471 +typedef struct {
2472 +       unsigned int qlen;              /* number of nlmsgs' in the skb */
2473 +       struct nlmsghdr *lastnlh;       /* netlink header of last msg in skb */
2474 +       struct sk_buff *skb;            /* the pre-allocated skb */
2475 +       struct timer_list timer;        /* the timer function */
2476 +       spinlock_t lock;                /* the per-queue lock */
2477 +} ebt_ulog_buff_t;
2478 +
2479 +static ebt_ulog_buff_t ulog_buffers[EBT_ULOG_MAXNLGROUPS];
2480 +static struct sock *ebtlognl;
2481 +
2482 +/* send one ulog_buff_t to userspace */
2483 +static void ulog_send(unsigned int nlgroup)
2484 +{
2485 +       ebt_ulog_buff_t *ub = &ulog_buffers[nlgroup];
2486 +
2487 +       if (timer_pending(&ub->timer))
2488 +               del_timer(&ub->timer);
2489 +
2490 +       /* last nlmsg needs NLMSG_DONE */
2491 +       if (ub->qlen > 1)
2492 +               ub->lastnlh->nlmsg_type = NLMSG_DONE;
2493 +
2494 +       NETLINK_CB(ub->skb).dst_groups = 1 << nlgroup;
2495 +       netlink_broadcast(ebtlognl, ub->skb, 0, 1 << nlgroup, GFP_ATOMIC);
2496 +
2497 +       ub->qlen = 0;
2498 +       ub->skb = NULL;
2499 +}
2500 +
2501 +/* timer function to flush queue in flushtimeout time */
2502 +static void ulog_timer(unsigned long data)
2503 +{
2504 +       spin_lock_bh(&ulog_buffers[data].lock);
2505 +       if (ulog_buffers[data].skb)
2506 +               ulog_send(data);
2507 +       spin_unlock_bh(&ulog_buffers[data].lock);
2508 +}
2509 +
2510 +static struct sk_buff *ulog_alloc_skb(unsigned int size)
2511 +{
2512 +       struct sk_buff *skb;
2513 +
2514 +       skb = alloc_skb(nlbufsiz, GFP_ATOMIC);
2515 +       if (!skb) {
2516 +               PRINTR(KERN_ERR "ebt_ulog: can't alloc whole buffer "
2517 +                      "of size %ub!\n", nlbufsiz);
2518 +               if (size < nlbufsiz) {
2519 +                       /* try to allocate only as much as we need for
2520 +                        * current packet */
2521 +                       skb = alloc_skb(size, GFP_ATOMIC);
2522 +                       if (!skb)
2523 +                               PRINTR(KERN_ERR "ebt_ulog: can't even allocate "
2524 +                                      "buffer of size %ub\n", size);
2525 +               }
2526 +       }
2527 +
2528 +       return skb;
2529 +}
2530 +
2531 +static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
2532 +   const struct net_device *in, const struct net_device *out,
2533 +   const void *data, unsigned int datalen)
2534 +{
2535 +       ebt_ulog_packet_msg_t *pm;
2536 +       size_t size, copy_len;
2537 +       struct nlmsghdr *nlh;
2538 +       struct ebt_ulog_info *loginfo = (struct ebt_ulog_info *)data;
2539 +       unsigned int group = loginfo->nlgroup;
2540 +       ebt_ulog_buff_t *ub = &ulog_buffers[group];
2541 +       spinlock_t *lock = &ub->lock;
2542 +
2543 +       if ((loginfo->cprange == 0) ||
2544 +           (loginfo->cprange > skb->len + ETH_HLEN))
2545 +               copy_len = skb->len + ETH_HLEN;
2546 +       else
2547 +               copy_len = loginfo->cprange;
2548 +
2549 +       size = NLMSG_SPACE(sizeof(*pm) + copy_len);
2550 +
2551 +       spin_lock_bh(lock);
2552 +
2553 +       if (!ub->skb) {
2554 +               if (!(ub->skb = ulog_alloc_skb(size)))
2555 +                       goto alloc_failure;
2556 +       } else if (size > skb_tailroom(ub->skb)) {
2557 +               ulog_send(group);
2558 +
2559 +               if (!(ub->skb = ulog_alloc_skb(size)))
2560 +                       goto alloc_failure;
2561 +       }
2562 +
2563 +       nlh = NLMSG_PUT(ub->skb, 0, ub->qlen, 0,
2564 +                       size - NLMSG_ALIGN(sizeof(*nlh)));
2565 +       ub->qlen++;
2566 +
2567 +       pm = NLMSG_DATA(nlh);
2568 +
2569 +       /* Fill in the ulog data */
2570 +       do_gettimeofday(&pm->stamp);
2571 +       if (ub->qlen == 1)
2572 +               ub->skb->stamp = pm->stamp;
2573 +       pm->data_len = copy_len;
2574 +       pm->mark = skb->nfmark;
2575 +       pm->hook = hooknr;
2576 +       if (loginfo->prefix != NULL)
2577 +               strcpy(pm->prefix, loginfo->prefix);
2578 +       else
2579 +               *(pm->prefix) = '\0';
2580 +
2581 +       if (in) {
2582 +               strcpy(pm->physindev, in->name);
2583 +               strcpy(pm->indev, in->br_port->br->dev.name);
2584 +       } else
2585 +               pm->indev[0] = pm->physindev[0] = '\0';
2586 +
2587 +       if (out) {
2588 +               strcpy(pm->physoutdev, out->name);
2589 +               strcpy(pm->outdev, out->br_port->br->dev.name);
2590 +       } else
2591 +               pm->outdev[0] = pm->physoutdev[0] = '\0';
2592 +
2593 +       if (skb_copy_bits(skb, -ETH_HLEN, pm->data, copy_len) < 0)
2594 +               BUG();
2595 +
2596 +       if (ub->qlen > 1)
2597 +               ub->lastnlh->nlmsg_flags |= NLM_F_MULTI;
2598 +
2599 +       ub->lastnlh = nlh;
2600 +
2601 +       if (ub->qlen >= loginfo->qthreshold)
2602 +               ulog_send(group);
2603 +       else if (!timer_pending(&ub->timer)) {
2604 +               ub->timer.expires = jiffies + flushtimeout * HZ / 100;
2605 +               add_timer(&ub->timer);
2606 +       }
2607 +
2608 +unlock:
2609 +       spin_unlock_bh(lock);
2610 +
2611 +       return;
2612 +
2613 +nlmsg_failure:
2614 +       PRINTR(KERN_ERR "ebt_ULOG: error during NLMSG_PUT.\n");
2615 +       goto unlock;
2616 +alloc_failure:
2617 +       goto unlock;
2618 +}
2619 +
2620 +static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
2621 +   const struct ebt_entry *e, void *data, unsigned int datalen)
2622 +{
2623 +       struct ebt_ulog_info *loginfo = (struct ebt_ulog_info *)data;
2624 +
2625 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_ulog_info)) ||
2626 +           loginfo->nlgroup > 31)
2627 +               return -EINVAL;
2628 +
2629 +       loginfo->prefix[EBT_ULOG_PREFIX_LEN - 1] = '\0';
2630 +
2631 +       if (loginfo->qthreshold > EBT_ULOG_MAX_QLEN)
2632 +               loginfo->qthreshold = EBT_ULOG_MAX_QLEN;
2633 +
2634 +       return 0;
2635 +}
2636 +
2637 +static struct ebt_watcher ulog = {
2638 +       {NULL, NULL}, EBT_ULOG_WATCHER, ebt_ulog, ebt_ulog_check, NULL,
2639 +       THIS_MODULE
2640 +};
2641 +
2642 +static int __init init(void)
2643 +{
2644 +       int i, ret = 0;
2645 +
2646 +       if (nlbufsiz >= 128*1024) {
2647 +               printk(KERN_NOTICE "ebt_ulog: Netlink buffer has to be <= 128kB,"
2648 +                      " please try a smaller nlbufsiz parameter.\n");
2649 +               return -EINVAL;
2650 +       }
2651 +
2652 +       /* initialize ulog_buffers */
2653 +       for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
2654 +               init_timer(&ulog_buffers[i].timer);
2655 +               ulog_buffers[i].timer.function = ulog_timer;
2656 +               ulog_buffers[i].timer.data = i;
2657 +               ulog_buffers[i].lock = SPIN_LOCK_UNLOCKED;
2658 +       }
2659 +
2660 +       ebtlognl = netlink_kernel_create(NETLINK_NFLOG, NULL);
2661 +       if (!ebtlognl)
2662 +               ret = -ENOMEM;
2663 +       else if ((ret = ebt_register_watcher(&ulog)))
2664 +               sock_release(ebtlognl->socket);
2665 +
2666 +       return ret;
2667 +}
2668 +
2669 +static void __exit fini(void)
2670 +{
2671 +       ebt_ulog_buff_t *ub;
2672 +       int i;
2673 +
2674 +       ebt_unregister_watcher(&ulog);
2675 +       for (i = 0; i < EBT_ULOG_MAXNLGROUPS; i++) {
2676 +               ub = &ulog_buffers[i];
2677 +               if (timer_pending(&ub->timer))
2678 +                       del_timer(&ub->timer);
2679 +               spin_lock_bh(&ub->lock);
2680 +               if (ub->skb) {
2681 +                       kfree_skb(ub->skb);
2682 +                       ub->skb = NULL;
2683 +               }
2684 +               spin_unlock_bh(&ub->lock);
2685 +       }
2686 +       sock_release(ebtlognl->socket);
2687 +}
2688 +
2689 +module_init(init);
2690 +module_exit(fini);
2691 +MODULE_LICENSE("GPL");
2692 +MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
2693 +MODULE_DESCRIPTION("ebtables userspace logging module for bridged Ethernet"
2694 +                   " frames");
2695 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
2696 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_snat.c       2005-03-14 00:00:30.000000000 +0100
2697 @@ -0,0 +1,64 @@
2698 +/*
2699 + *  ebt_snat
2700 + *
2701 + *     Authors:
2702 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
2703 + *
2704 + *  June, 2002
2705 + *
2706 + */
2707 +
2708 +#include <linux/netfilter_bridge/ebtables.h>
2709 +#include <linux/netfilter_bridge/ebt_nat.h>
2710 +#include <linux/module.h>
2711 +
2712 +static int ebt_target_snat(struct sk_buff **pskb, unsigned int hooknr,
2713 +   const struct net_device *in, const struct net_device *out,
2714 +   const void *data, unsigned int datalen)
2715 +{
2716 +       struct ebt_nat_info *info = (struct ebt_nat_info *) data;
2717 +
2718 +       memcpy(((**pskb).mac.ethernet)->h_source, info->mac,
2719 +          ETH_ALEN * sizeof(unsigned char));
2720 +       return info->target;
2721 +}
2722 +
2723 +static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
2724 +   const struct ebt_entry *e, void *data, unsigned int datalen)
2725 +{
2726 +       struct ebt_nat_info *info = (struct ebt_nat_info *) data;
2727 +
2728 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
2729 +               return -EINVAL;
2730 +       if (BASE_CHAIN && info->target == EBT_RETURN)
2731 +               return -EINVAL;
2732 +       CLEAR_BASE_CHAIN_BIT;
2733 +       if (strcmp(tablename, "nat"))
2734 +               return -EINVAL;
2735 +       if (hookmask & ~(1 << NF_BR_POST_ROUTING))
2736 +               return -EINVAL;
2737 +       if (INVALID_TARGET)
2738 +               return -EINVAL;
2739 +       return 0;
2740 +}
2741 +
2742 +static struct ebt_target snat =
2743 +{
2744 +       {NULL, NULL}, EBT_SNAT_TARGET, ebt_target_snat, ebt_target_snat_check,
2745 +       NULL, THIS_MODULE
2746 +};
2747 +
2748 +static int __init init(void)
2749 +{
2750 +       return ebt_register_target(&snat);
2751 +}
2752 +
2753 +static void __exit fini(void)
2754 +{
2755 +       ebt_unregister_target(&snat);
2756 +}
2757 +
2758 +module_init(init);
2759 +module_exit(fini);
2760 +EXPORT_NO_SYMBOLS;
2761 +MODULE_LICENSE("GPL");
2762 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
2763 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebt_dnat.c       2005-03-14 00:00:30.000000000 +0100
2764 @@ -0,0 +1,65 @@
2765 +/*
2766 + *  ebt_dnat
2767 + *
2768 + *     Authors:
2769 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
2770 + *
2771 + *  June, 2002
2772 + *
2773 + */
2774 +
2775 +#include <linux/netfilter_bridge/ebtables.h>
2776 +#include <linux/netfilter_bridge/ebt_nat.h>
2777 +#include <linux/module.h>
2778 +#include <net/sock.h>
2779 +
2780 +static int ebt_target_dnat(struct sk_buff **pskb, unsigned int hooknr,
2781 +   const struct net_device *in, const struct net_device *out,
2782 +   const void *data, unsigned int datalen)
2783 +{
2784 +       struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2785 +
2786 +       memcpy(((**pskb).mac.ethernet)->h_dest, info->mac,
2787 +          ETH_ALEN * sizeof(unsigned char));
2788 +       return info->target;
2789 +}
2790 +
2791 +static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
2792 +   const struct ebt_entry *e, void *data, unsigned int datalen)
2793 +{
2794 +       struct ebt_nat_info *info = (struct ebt_nat_info *)data;
2795 +
2796 +       if (BASE_CHAIN && info->target == EBT_RETURN)
2797 +               return -EINVAL;
2798 +       CLEAR_BASE_CHAIN_BIT;
2799 +       if ( (strcmp(tablename, "nat") ||
2800 +          (hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))) &&
2801 +          (strcmp(tablename, "broute") || hookmask & ~(1 << NF_BR_BROUTING)) )
2802 +               return -EINVAL;
2803 +       if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
2804 +               return -EINVAL;
2805 +       if (INVALID_TARGET)
2806 +               return -EINVAL;
2807 +       return 0;
2808 +}
2809 +
2810 +static struct ebt_target dnat =
2811 +{
2812 +       {NULL, NULL}, EBT_DNAT_TARGET, ebt_target_dnat, ebt_target_dnat_check,
2813 +       NULL, THIS_MODULE
2814 +};
2815 +
2816 +static int __init init(void)
2817 +{
2818 +       return ebt_register_target(&dnat);
2819 +}
2820 +
2821 +static void __exit fini(void)
2822 +{
2823 +       ebt_unregister_target(&dnat);
2824 +}
2825 +
2826 +module_init(init);
2827 +module_exit(fini);
2828 +EXPORT_NO_SYMBOLS;
2829 +MODULE_LICENSE("GPL");
2830 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
2831 +++ linux-2.4.29-ebt-brnf/net/bridge/netfilter/ebtables.c       2005-03-14 21:04:05.155913576 +0100
2832 @@ -0,0 +1,1497 @@
2833 +/*
2834 + *  ebtables
2835 + *
2836 + *  Author:
2837 + *  Bart De Schuymer           <bart.de.schuymer@pandora.be>
2838 + *
2839 + *  ebtables.c,v 2.0, July, 2002
2840 + *
2841 + *  This code is stongly inspired on the iptables code which is
2842 + *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
2843 + *
2844 + *  This program is free software; you can redistribute it and/or
2845 + *  modify it under the terms of the GNU General Public License
2846 + *  as published by the Free Software Foundation; either version
2847 + *  2 of the License, or (at your option) any later version.
2848 + */
2849 +
2850 +// used for print_string
2851 +#include <linux/sched.h>
2852 +#include <linux/tty.h>
2853 +
2854 +#include <linux/kmod.h>
2855 +#include <linux/module.h>
2856 +#include <linux/vmalloc.h>
2857 +#include <linux/netfilter_bridge/ebtables.h>
2858 +#include <linux/spinlock.h>
2859 +#include <asm/uaccess.h>
2860 +#include <linux/smp.h>
2861 +#include <net/sock.h>
2862 +// needed for logical [in,out]-dev filtering
2863 +#include "../br_private.h"
2864 +
2865 +// list_named_find
2866 +#define ASSERT_READ_LOCK(x)
2867 +#define ASSERT_WRITE_LOCK(x)
2868 +#include <linux/netfilter_ipv4/listhelp.h>
2869 +
2870 +#if 0 // use this for remote debugging
2871 +// Copyright (C) 1998 by Ori Pomerantz
2872 +// Print the string to the appropriate tty, the one
2873 +// the current task uses
2874 +static void print_string(char *str)
2875 +{
2876 +       struct tty_struct *my_tty;
2877 +
2878 +       /* The tty for the current task */
2879 +       my_tty = current->tty;
2880 +       if (my_tty != NULL) {
2881 +               (*(my_tty->driver).write)(my_tty, 0, str, strlen(str));
2882 +               (*(my_tty->driver).write)(my_tty, 0, "\015\012", 2);
2883 +       }
2884 +}
2885 +
2886 +#define BUGPRINT(args) print_string(args);
2887 +#else
2888 +#define BUGPRINT(format, args...) printk("kernel msg: ebtables bug: please "\
2889 +                                         "report to author: "format, ## args)
2890 +// #define BUGPRINT(format, args...)
2891 +#endif
2892 +#define MEMPRINT(format, args...) printk("kernel msg: ebtables "\
2893 +                                         ": out of memory: "format, ## args)
2894 +// #define MEMPRINT(format, args...)
2895 +
2896 +
2897 +
2898 +// Each cpu has its own set of counters, so there is no need for write_lock in
2899 +// the softirq
2900 +// For reading or updating the counters, the user context needs to
2901 +// get a write_lock
2902 +
2903 +// The size of each set of counters is altered to get cache alignment
2904 +#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
2905 +#define COUNTER_OFFSET(n) (SMP_ALIGN(n * sizeof(struct ebt_counter)))
2906 +#define COUNTER_BASE(c, n, cpu) ((struct ebt_counter *)(((char *)c) + \
2907 +   COUNTER_OFFSET(n) * cpu))
2908 +
2909 +
2910 +
2911 +static DECLARE_MUTEX(ebt_mutex);
2912 +static LIST_HEAD(ebt_tables);
2913 +static LIST_HEAD(ebt_targets);
2914 +static LIST_HEAD(ebt_matches);
2915 +static LIST_HEAD(ebt_watchers);
2916 +
2917 +static struct ebt_target ebt_standard_target =
2918 +{ {NULL, NULL}, EBT_STANDARD_TARGET, NULL, NULL, NULL, NULL};
2919 +
2920 +static inline int ebt_do_watcher (struct ebt_entry_watcher *w,
2921 +   const struct sk_buff *skb, unsigned int hooknr, const struct net_device *in,
2922 +   const struct net_device *out)
2923 +{
2924 +       w->u.watcher->watcher(skb, hooknr, in, out, w->data,
2925 +          w->watcher_size);
2926 +       // watchers don't give a verdict
2927 +       return 0;
2928 +}
2929 +
2930 +static inline int ebt_do_match (struct ebt_entry_match *m,
2931 +   const struct sk_buff *skb, const struct net_device *in,
2932 +   const struct net_device *out)
2933 +{
2934 +       return m->u.match->match(skb, in, out, m->data,
2935 +          m->match_size);
2936 +}
2937 +
2938 +static inline int ebt_dev_check(char *entry, const struct net_device *device)
2939 +{
2940 +       int i = 0;
2941 +       char *devname = device->name;
2942 +
2943 +       if (*entry == '\0')
2944 +               return 0;
2945 +       if (!device)
2946 +               return 1;
2947 +       /* 1 is the wildcard token */
2948 +       while (entry[i] != '\0' && entry[i] != 1 && entry[i] == devname[i])
2949 +               i++;
2950 +       return (devname[i] != entry[i] && entry[i] != 1);
2951 +}
2952 +
2953 +#define FWINV2(bool,invflg) ((bool) ^ !!(e->invflags & invflg))
2954 +// process standard matches
2955 +static inline int ebt_basic_match(struct ebt_entry *e, struct ethhdr *h,
2956 +   const struct net_device *in, const struct net_device *out)
2957 +{
2958 +       int verdict, i;
2959 +
2960 +       if (e->bitmask & EBT_802_3) {
2961 +               if (FWINV2(ntohs(h->h_proto) >= 1536, EBT_IPROTO))
2962 +                       return 1;
2963 +       } else if (!(e->bitmask & EBT_NOPROTO) &&
2964 +          FWINV2(e->ethproto != h->h_proto, EBT_IPROTO))
2965 +               return 1;
2966 +
2967 +       if (FWINV2(ebt_dev_check(e->in, in), EBT_IIN))
2968 +               return 1;
2969 +       if (FWINV2(ebt_dev_check(e->out, out), EBT_IOUT))
2970 +               return 1;
2971 +       if ((!in || !in->br_port) ? 0 : FWINV2(ebt_dev_check(
2972 +          e->logical_in, &in->br_port->br->dev), EBT_ILOGICALIN))
2973 +               return 1;
2974 +       if ((!out || !out->br_port) ? 0 : FWINV2(ebt_dev_check(
2975 +          e->logical_out, &out->br_port->br->dev), EBT_ILOGICALOUT))
2976 +               return 1;
2977 +
2978 +       if (e->bitmask & EBT_SOURCEMAC) {
2979 +               verdict = 0;
2980 +               for (i = 0; i < 6; i++)
2981 +                       verdict |= (h->h_source[i] ^ e->sourcemac[i]) &
2982 +                          e->sourcemsk[i];
2983 +               if (FWINV2(verdict != 0, EBT_ISOURCE) )
2984 +                       return 1;
2985 +       }
2986 +       if (e->bitmask & EBT_DESTMAC) {
2987 +               verdict = 0;
2988 +               for (i = 0; i < 6; i++)
2989 +                       verdict |= (h->h_dest[i] ^ e->destmac[i]) &
2990 +                          e->destmsk[i];
2991 +               if (FWINV2(verdict != 0, EBT_IDEST) )
2992 +                       return 1;
2993 +       }
2994 +       return 0;
2995 +}
2996 +
2997 +// Do some firewalling
2998 +unsigned int ebt_do_table (unsigned int hook, struct sk_buff **pskb,
2999 +   const struct net_device *in, const struct net_device *out,
3000 +   struct ebt_table *table)
3001 +{
3002 +       int i, nentries;
3003 +       struct ebt_entry *point;
3004 +       struct ebt_counter *counter_base, *cb_base;
3005 +       struct ebt_entry_target *t;
3006 +       int verdict, sp = 0;
3007 +       struct ebt_chainstack *cs;
3008 +       struct ebt_entries *chaininfo;
3009 +       char *base;
3010 +       struct ebt_table_info *private;
3011 +
3012 +       read_lock_bh(&table->lock);
3013 +       private = table->private;
3014 +       cb_base = COUNTER_BASE(private->counters, private->nentries,
3015 +          cpu_number_map(smp_processor_id()));
3016 +       if (private->chainstack)
3017 +               cs = private->chainstack[cpu_number_map(smp_processor_id())];
3018 +       else
3019 +               cs = NULL;
3020 +       chaininfo = private->hook_entry[hook];
3021 +       nentries = private->hook_entry[hook]->nentries;
3022 +       point = (struct ebt_entry *)(private->hook_entry[hook]->data);
3023 +       counter_base = cb_base + private->hook_entry[hook]->counter_offset;
3024 +       // base for chain jumps
3025 +       base = private->entries;
3026 +       i = 0;
3027 +       while (i < nentries) {
3028 +               if (ebt_basic_match(point, (**pskb).mac.ethernet, in, out))
3029 +                       goto letscontinue;
3030 +
3031 +               if (EBT_MATCH_ITERATE(point, ebt_do_match, *pskb, in, out) != 0)
3032 +                       goto letscontinue;
3033 +
3034 +               // increase counter
3035 +               (*(counter_base + i)).pcnt++;
3036 +               (*(counter_base + i)).bcnt+=(**pskb).len;
3037 +
3038 +               // these should only watch: not modify, nor tell us
3039 +               // what to do with the packet
3040 +               EBT_WATCHER_ITERATE(point, ebt_do_watcher, *pskb, hook, in,
3041 +                  out);
3042 +
3043 +               t = (struct ebt_entry_target *)
3044 +                  (((char *)point) + point->target_offset);
3045 +               // standard target
3046 +               if (!t->u.target->target)
3047 +                       verdict = ((struct ebt_standard_target *)t)->verdict;
3048 +               else
3049 +                       verdict = t->u.target->target(pskb, hook,
3050 +                          in, out, t->data, t->target_size);
3051 +               if (verdict == EBT_ACCEPT) {
3052 +                       read_unlock_bh(&table->lock);
3053 +                       return NF_ACCEPT;
3054 +               }
3055 +               if (verdict == EBT_DROP) {
3056 +                       read_unlock_bh(&table->lock);
3057 +                       return NF_DROP;
3058 +               }
3059 +               if (verdict == EBT_RETURN) {
3060 +letsreturn:
3061 +#ifdef CONFIG_NETFILTER_DEBUG
3062 +                       if (sp == 0) {
3063 +                               BUGPRINT("RETURN on base chain");
3064 +                               // act like this is EBT_CONTINUE
3065 +                               goto letscontinue;
3066 +                       }
3067 +#endif
3068 +                       sp--;
3069 +                       // put all the local variables right
3070 +                       i = cs[sp].n;
3071 +                       chaininfo = cs[sp].chaininfo;
3072 +                       nentries = chaininfo->nentries;
3073 +                       point = cs[sp].e;
3074 +                       counter_base = cb_base +
3075 +                          chaininfo->counter_offset;
3076 +                       continue;
3077 +               }
3078 +               if (verdict == EBT_CONTINUE)
3079 +                       goto letscontinue;
3080 +#ifdef CONFIG_NETFILTER_DEBUG
3081 +               if (verdict < 0) {
3082 +                       BUGPRINT("bogus standard verdict\n");
3083 +                       read_unlock_bh(&table->lock);
3084 +                       return NF_DROP;
3085 +               }
3086 +#endif
3087 +               // jump to a udc
3088 +               cs[sp].n = i + 1;
3089 +               cs[sp].chaininfo = chaininfo;
3090 +               cs[sp].e = (struct ebt_entry *)
3091 +                  (((char *)point) + point->next_offset);
3092 +               i = 0;
3093 +               chaininfo = (struct ebt_entries *) (base + verdict);
3094 +#ifdef CONFIG_NETFILTER_DEBUG
3095 +               if (chaininfo->distinguisher) {
3096 +                       BUGPRINT("jump to non-chain\n");
3097 +                       read_unlock_bh(&table->lock);
3098 +                       return NF_DROP;
3099 +               }
3100 +#endif
3101 +               nentries = chaininfo->nentries;
3102 +               point = (struct ebt_entry *)chaininfo->data;
3103 +               counter_base = cb_base + chaininfo->counter_offset;
3104 +               sp++;
3105 +               continue;
3106 +letscontinue:
3107 +               point = (struct ebt_entry *)
3108 +                  (((char *)point) + point->next_offset);
3109 +               i++;
3110 +       }
3111 +
3112 +       // I actually like this :)
3113 +       if (chaininfo->policy == EBT_RETURN)
3114 +               goto letsreturn;
3115 +       if (chaininfo->policy == EBT_ACCEPT) {
3116 +               read_unlock_bh(&table->lock);
3117 +               return NF_ACCEPT;
3118 +       }
3119 +       read_unlock_bh(&table->lock);
3120 +       return NF_DROP;
3121 +}
3122 +
3123 +// If it succeeds, returns element and locks mutex
3124 +static inline void *
3125 +find_inlist_lock_noload(struct list_head *head, const char *name, int *error,
3126 +   struct semaphore *mutex)
3127 +{
3128 +       void *ret;
3129 +
3130 +       *error = down_interruptible(mutex);
3131 +       if (*error != 0)
3132 +               return NULL;
3133 +
3134 +       ret = list_named_find(head, name);
3135 +       if (!ret) {
3136 +               *error = -ENOENT;
3137 +               up(mutex);
3138 +       }
3139 +       return ret;
3140 +}
3141 +
3142 +#ifndef CONFIG_KMOD
3143 +#define find_inlist_lock(h,n,p,e,m) find_inlist_lock_noload((h),(n),(e),(m))
3144 +#else
3145 +static void *
3146 +find_inlist_lock(struct list_head *head, const char *name, const char *prefix,
3147 +   int *error, struct semaphore *mutex)
3148 +{
3149 +       void *ret;
3150 +
3151 +       ret = find_inlist_lock_noload(head, name, error, mutex);
3152 +       if (!ret) {
3153 +               char modulename[EBT_FUNCTION_MAXNAMELEN + strlen(prefix) + 1];
3154 +               strcpy(modulename, prefix);
3155 +               strcat(modulename, name);
3156 +               request_module(modulename);
3157 +               ret = find_inlist_lock_noload(head, name, error, mutex);
3158 +       }
3159 +       return ret;
3160 +}
3161 +#endif
3162 +
3163 +static inline struct ebt_table *
3164 +find_table_lock(const char *name, int *error, struct semaphore *mutex)
3165 +{
3166 +       return find_inlist_lock(&ebt_tables, name, "ebtable_", error, mutex);
3167 +}
3168 +
3169 +static inline struct ebt_match *
3170 +find_match_lock(const char *name, int *error, struct semaphore *mutex)
3171 +{
3172 +       return find_inlist_lock(&ebt_matches, name, "ebt_", error, mutex);
3173 +}
3174 +
3175 +static inline struct ebt_watcher *
3176 +find_watcher_lock(const char *name, int *error, struct semaphore *mutex)
3177 +{
3178 +       return find_inlist_lock(&ebt_watchers, name, "ebt_", error, mutex);
3179 +}
3180 +
3181 +static inline struct ebt_target *
3182 +find_target_lock(const char *name, int *error, struct semaphore *mutex)
3183 +{
3184 +       return find_inlist_lock(&ebt_targets, name, "ebt_", error, mutex);
3185 +}
3186 +
3187 +static inline int
3188 +ebt_check_match(struct ebt_entry_match *m, struct ebt_entry *e,
3189 +   const char *name, unsigned int hookmask, unsigned int *cnt)
3190 +{
3191 +       struct ebt_match *match;
3192 +       int ret;
3193 +
3194 +       if (((char *)m) + m->match_size + sizeof(struct ebt_entry_match) >
3195 +          ((char *)e) + e->watchers_offset)
3196 +               return -EINVAL;
3197 +       match = find_match_lock(m->u.name, &ret, &ebt_mutex);
3198 +       if (!match)
3199 +               return ret;
3200 +       m->u.match = match;
3201 +       if (match->me)
3202 +               __MOD_INC_USE_COUNT(match->me);
3203 +       up(&ebt_mutex);
3204 +       if (match->check &&
3205 +          match->check(name, hookmask, e, m->data, m->match_size) != 0) {
3206 +               BUGPRINT("match->check failed\n");
3207 +               if (match->me)
3208 +                       __MOD_DEC_USE_COUNT(match->me);
3209 +               return -EINVAL;
3210 +       }
3211 +       (*cnt)++;
3212 +       return 0;
3213 +}
3214 +
3215 +static inline int
3216 +ebt_check_watcher(struct ebt_entry_watcher *w, struct ebt_entry *e,
3217 +   const char *name, unsigned int hookmask, unsigned int *cnt)
3218 +{
3219 +       struct ebt_watcher *watcher;
3220 +       int ret;
3221 +
3222 +       if (((char *)w) + w->watcher_size + sizeof(struct ebt_entry_watcher) >
3223 +          ((char *)e) + e->target_offset)
3224 +               return -EINVAL;
3225 +       watcher = find_watcher_lock(w->u.name, &ret, &ebt_mutex);
3226 +       if (!watcher)
3227 +               return ret;
3228 +       w->u.watcher = watcher;
3229 +       if (watcher->me)
3230 +               __MOD_INC_USE_COUNT(watcher->me);
3231 +       up(&ebt_mutex);
3232 +       if (watcher->check &&
3233 +          watcher->check(name, hookmask, e, w->data, w->watcher_size) != 0) {
3234 +               BUGPRINT("watcher->check failed\n");
3235 +               if (watcher->me)
3236 +                       __MOD_DEC_USE_COUNT(watcher->me);
3237 +               return -EINVAL;
3238 +       }
3239 +       (*cnt)++;
3240 +       return 0;
3241 +}
3242 +
3243 +// this one is very careful, as it is the first function
3244 +// to parse the userspace data
3245 +static inline int
3246 +ebt_check_entry_size_and_hooks(struct ebt_entry *e,
3247 +   struct ebt_table_info *newinfo, char *base, char *limit,
3248 +   struct ebt_entries **hook_entries, unsigned int *n, unsigned int *cnt,
3249 +   unsigned int *totalcnt, unsigned int *udc_cnt, unsigned int valid_hooks)
3250 +{
3251 +       int i;
3252 +
3253 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3254 +               if ((valid_hooks & (1 << i)) == 0)
3255 +                       continue;
3256 +               if ( (char *)hook_entries[i] - base ==
3257 +                  (char *)e - newinfo->entries)
3258 +                       break;
3259 +       }
3260 +       // beginning of a new chain
3261 +       // if i == NF_BR_NUMHOOKS it must be a user defined chain
3262 +       if (i != NF_BR_NUMHOOKS || !(e->bitmask & EBT_ENTRY_OR_ENTRIES)) {
3263 +               if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) != 0) {
3264 +                       // we make userspace set this right,
3265 +                       // so there is no misunderstanding
3266 +                       BUGPRINT("EBT_ENTRY_OR_ENTRIES shouldn't be set "
3267 +                                "in distinguisher\n");
3268 +                       return -EINVAL;
3269 +               }
3270 +               // this checks if the previous chain has as many entries
3271 +               // as it said it has
3272 +               if (*n != *cnt) {
3273 +                       BUGPRINT("nentries does not equal the nr of entries "
3274 +                                "in the chain\n");
3275 +                       return -EINVAL;
3276 +               }
3277 +               // before we look at the struct, be sure it is not too big
3278 +               if ((char *)hook_entries[i] + sizeof(struct ebt_entries)
3279 +                  > limit) {
3280 +                       BUGPRINT("entries_size too small\n");
3281 +                       return -EINVAL;
3282 +               }
3283 +               if (((struct ebt_entries *)e)->policy != EBT_DROP &&
3284 +                  ((struct ebt_entries *)e)->policy != EBT_ACCEPT) {
3285 +                       // only RETURN from udc
3286 +                       if (i != NF_BR_NUMHOOKS ||
3287 +                          ((struct ebt_entries *)e)->policy != EBT_RETURN) {
3288 +                               BUGPRINT("bad policy\n");
3289 +                               return -EINVAL;
3290 +                       }
3291 +               }
3292 +               if (i == NF_BR_NUMHOOKS) // it's a user defined chain
3293 +                       (*udc_cnt)++;
3294 +               else
3295 +                       newinfo->hook_entry[i] = (struct ebt_entries *)e;
3296 +               if (((struct ebt_entries *)e)->counter_offset != *totalcnt) {
3297 +                       BUGPRINT("counter_offset != totalcnt");
3298 +                       return -EINVAL;
3299 +               }
3300 +               *n = ((struct ebt_entries *)e)->nentries;
3301 +               *cnt = 0;
3302 +               return 0;
3303 +       }
3304 +       // a plain old entry, heh
3305 +       if (sizeof(struct ebt_entry) > e->watchers_offset ||
3306 +          e->watchers_offset > e->target_offset ||
3307 +          e->target_offset >= e->next_offset) {
3308 +               BUGPRINT("entry offsets not in right order\n");
3309 +               return -EINVAL;
3310 +       }
3311 +       // this is not checked anywhere else
3312 +       if (e->next_offset - e->target_offset < sizeof(struct ebt_entry_target)) {
3313 +               BUGPRINT("target size too small\n");
3314 +               return -EINVAL;
3315 +       }
3316 +
3317 +       (*cnt)++;
3318 +       (*totalcnt)++;
3319 +       return 0;
3320 +}
3321 +
3322 +struct ebt_cl_stack
3323 +{
3324 +       struct ebt_chainstack cs;
3325 +       int from;
3326 +       unsigned int hookmask;
3327 +};
3328 +
3329 +// we need these positions to check that the jumps to a different part of the
3330 +// entries is a jump to the beginning of a new chain.
3331 +static inline int
3332 +ebt_get_udc_positions(struct ebt_entry *e, struct ebt_table_info *newinfo,
3333 +   struct ebt_entries **hook_entries, unsigned int *n, unsigned int valid_hooks,
3334 +   struct ebt_cl_stack *udc)
3335 +{
3336 +       int i;
3337 +
3338 +       // we're only interested in chain starts
3339 +       if (e->bitmask & EBT_ENTRY_OR_ENTRIES)
3340 +               return 0;
3341 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3342 +               if ((valid_hooks & (1 << i)) == 0)
3343 +                       continue;
3344 +               if (newinfo->hook_entry[i] == (struct ebt_entries *)e)
3345 +                       break;
3346 +       }
3347 +       // only care about udc
3348 +       if (i != NF_BR_NUMHOOKS)
3349 +               return 0;
3350 +
3351 +       udc[*n].cs.chaininfo = (struct ebt_entries *)e;
3352 +       // these initialisations are depended on later in check_chainloops()
3353 +       udc[*n].cs.n = 0;
3354 +       udc[*n].hookmask = 0;
3355 +
3356 +       (*n)++;
3357 +       return 0;
3358 +}
3359 +
3360 +static inline int
3361 +ebt_cleanup_match(struct ebt_entry_match *m, unsigned int *i)
3362 +{
3363 +       if (i && (*i)-- == 0)
3364 +               return 1;
3365 +       if (m->u.match->destroy)
3366 +               m->u.match->destroy(m->data, m->match_size);
3367 +       if (m->u.match->me)
3368 +               __MOD_DEC_USE_COUNT(m->u.match->me);
3369 +
3370 +       return 0;
3371 +}
3372 +
3373 +static inline int
3374 +ebt_cleanup_watcher(struct ebt_entry_watcher *w, unsigned int *i)
3375 +{
3376 +       if (i && (*i)-- == 0)
3377 +               return 1;
3378 +       if (w->u.watcher->destroy)
3379 +               w->u.watcher->destroy(w->data, w->watcher_size);
3380 +       if (w->u.watcher->me)
3381 +               __MOD_DEC_USE_COUNT(w->u.watcher->me);
3382 +
3383 +       return 0;
3384 +}
3385 +
3386 +static inline int
3387 +ebt_cleanup_entry(struct ebt_entry *e, unsigned int *cnt)
3388 +{
3389 +       struct ebt_entry_target *t;
3390 +
3391 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
3392 +               return 0;
3393 +       // we're done
3394 +       if (cnt && (*cnt)-- == 0)
3395 +               return 1;
3396 +       EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, NULL);
3397 +       EBT_MATCH_ITERATE(e, ebt_cleanup_match, NULL);
3398 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
3399 +       if (t->u.target->destroy)
3400 +               t->u.target->destroy(t->data, t->target_size);
3401 +       if (t->u.target->me)
3402 +               __MOD_DEC_USE_COUNT(t->u.target->me);
3403 +
3404 +       return 0;
3405 +}
3406 +
3407 +static inline int
3408 +ebt_check_entry(struct ebt_entry *e, struct ebt_table_info *newinfo,
3409 +   const char *name, unsigned int *cnt, unsigned int valid_hooks,
3410 +   struct ebt_cl_stack *cl_s, unsigned int udc_cnt)
3411 +{
3412 +       struct ebt_entry_target *t;
3413 +       struct ebt_target *target;
3414 +       unsigned int i, j, hook = 0, hookmask = 0;
3415 +       int ret;
3416 +
3417 +       // Don't mess with the struct ebt_entries
3418 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
3419 +               return 0;
3420 +
3421 +       if (e->bitmask & ~EBT_F_MASK) {
3422 +               BUGPRINT("Unknown flag for bitmask\n");
3423 +               return -EINVAL;
3424 +       }
3425 +       if (e->invflags & ~EBT_INV_MASK) {
3426 +               BUGPRINT("Unknown flag for inv bitmask\n");
3427 +               return -EINVAL;
3428 +       }
3429 +       if ( (e->bitmask & EBT_NOPROTO) && (e->bitmask & EBT_802_3) ) {
3430 +               BUGPRINT("NOPROTO & 802_3 not allowed\n");
3431 +               return -EINVAL;
3432 +       }
3433 +       // what hook do we belong to?
3434 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3435 +               if ((valid_hooks & (1 << i)) == 0)
3436 +                       continue;
3437 +               if ((char *)newinfo->hook_entry[i] < (char *)e)
3438 +                       hook = i;
3439 +               else
3440 +                       break;
3441 +       }
3442 +       // (1 << NF_BR_NUMHOOKS) tells the check functions the rule is on
3443 +       // a base chain
3444 +       if (i < NF_BR_NUMHOOKS)
3445 +               hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
3446 +       else {
3447 +               for (i = 0; i < udc_cnt; i++)
3448 +                       if ((char *)(cl_s[i].cs.chaininfo) > (char *)e)
3449 +                               break;
3450 +               if (i == 0)
3451 +                       hookmask = (1 << hook) | (1 << NF_BR_NUMHOOKS);
3452 +               else
3453 +                       hookmask = cl_s[i - 1].hookmask;
3454 +       }
3455 +       i = 0;
3456 +       ret = EBT_MATCH_ITERATE(e, ebt_check_match, e, name, hookmask, &i);
3457 +       if (ret != 0)
3458 +               goto cleanup_matches;
3459 +       j = 0;
3460 +       ret = EBT_WATCHER_ITERATE(e, ebt_check_watcher, e, name, hookmask, &j);
3461 +       if (ret != 0)
3462 +               goto cleanup_watchers;
3463 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
3464 +       target = find_target_lock(t->u.name, &ret, &ebt_mutex);
3465 +       if (!target)
3466 +               goto cleanup_watchers;
3467 +       if (target->me)
3468 +               __MOD_INC_USE_COUNT(target->me);
3469 +       up(&ebt_mutex);
3470 +
3471 +       t->u.target = target;
3472 +       if (t->u.target == &ebt_standard_target) {
3473 +               if (e->target_offset + sizeof(struct ebt_standard_target) >
3474 +                  e->next_offset) {
3475 +                       BUGPRINT("Standard target size too big\n");
3476 +                       ret = -EFAULT;
3477 +                       goto cleanup_watchers;
3478 +               }
3479 +               if (((struct ebt_standard_target *)t)->verdict <
3480 +                  -NUM_STANDARD_TARGETS) {
3481 +                       BUGPRINT("Invalid standard target\n");
3482 +                       ret = -EFAULT;
3483 +                       goto cleanup_watchers;
3484 +               }
3485 +       } else if ((e->target_offset + t->target_size +
3486 +          sizeof(struct ebt_entry_target) > e->next_offset) ||
3487 +          (t->u.target->check &&
3488 +          t->u.target->check(name, hookmask, e, t->data, t->target_size) != 0)){
3489 +               if (t->u.target->me)
3490 +                       __MOD_DEC_USE_COUNT(t->u.target->me);
3491 +               ret = -EFAULT;
3492 +               goto cleanup_watchers;
3493 +       }
3494 +       (*cnt)++;
3495 +       return 0;
3496 +cleanup_watchers:
3497 +       EBT_WATCHER_ITERATE(e, ebt_cleanup_watcher, &j);
3498 +cleanup_matches:
3499 +       EBT_MATCH_ITERATE(e, ebt_cleanup_match, &i);
3500 +       return ret;
3501 +}
3502 +
3503 +// checks for loops and sets the hook mask for udc
3504 +// the hook mask for udc tells us from which base chains the udc can be
3505 +// accessed. This mask is a parameter to the check() functions of the extensions
3506 +static int check_chainloops(struct ebt_entries *chain,
3507 +   struct ebt_cl_stack *cl_s, unsigned int udc_cnt,
3508 +   unsigned int hooknr, char *base)
3509 +{
3510 +       int i, chain_nr = -1, pos = 0, nentries = chain->nentries, verdict;
3511 +       struct ebt_entry *e = (struct ebt_entry *)chain->data;
3512 +       struct ebt_entry_target *t;
3513 +
3514 +       while (pos < nentries || chain_nr != -1) {
3515 +               // end of udc, go back one 'recursion' step
3516 +               if (pos == nentries) {
3517 +                       // put back values of the time when this chain was called
3518 +                       e = cl_s[chain_nr].cs.e;
3519 +                       if (cl_s[chain_nr].from != -1)
3520 +                               nentries =
3521 +                               cl_s[cl_s[chain_nr].from].cs.chaininfo->nentries;
3522 +                       else
3523 +                               nentries = chain->nentries;
3524 +                       pos = cl_s[chain_nr].cs.n;
3525 +                       // make sure we won't see a loop that isn't one
3526 +                       cl_s[chain_nr].cs.n = 0;
3527 +                       chain_nr = cl_s[chain_nr].from;
3528 +                       if (pos == nentries)
3529 +                               continue;
3530 +               }
3531 +               t = (struct ebt_entry_target *)
3532 +                  (((char *)e) + e->target_offset);
3533 +               if (strcmp(t->u.name, EBT_STANDARD_TARGET))
3534 +                       goto letscontinue;
3535 +               if (e->target_offset + sizeof(struct ebt_standard_target) >
3536 +                  e->next_offset) {
3537 +                       BUGPRINT("Standard target size too big\n");
3538 +                       return -1;
3539 +               }
3540 +               verdict = ((struct ebt_standard_target *)t)->verdict;
3541 +               if (verdict >= 0) { // jump to another chain
3542 +                       struct ebt_entries *hlp2 =
3543 +                          (struct ebt_entries *)(base + verdict);
3544 +                       for (i = 0; i < udc_cnt; i++)
3545 +                               if (hlp2 == cl_s[i].cs.chaininfo)
3546 +                                       break;
3547 +                       // bad destination or loop
3548 +                       if (i == udc_cnt) {
3549 +                               BUGPRINT("bad destination\n");
3550 +                               return -1;
3551 +                       }
3552 +                       if (cl_s[i].cs.n) {
3553 +                               BUGPRINT("loop\n");
3554 +                               return -1;
3555 +                       }
3556 +                       // this can't be 0, so the above test is correct
3557 +                       cl_s[i].cs.n = pos + 1;
3558 +                       pos = 0;
3559 +                       cl_s[i].cs.e = ((void *)e + e->next_offset);
3560 +                       e = (struct ebt_entry *)(hlp2->data);
3561 +                       nentries = hlp2->nentries;
3562 +                       cl_s[i].from = chain_nr;
3563 +                       chain_nr = i;
3564 +                       // this udc is accessible from the base chain for hooknr
3565 +                       cl_s[i].hookmask |= (1 << hooknr);
3566 +                       continue;
3567 +               }
3568 +letscontinue:
3569 +               e = (void *)e + e->next_offset;
3570 +               pos++;
3571 +       }
3572 +       return 0;
3573 +}
3574 +
3575 +// do the parsing of the table/chains/entries/matches/watchers/targets, heh
3576 +static int translate_table(struct ebt_replace *repl,
3577 +   struct ebt_table_info *newinfo)
3578 +{
3579 +       unsigned int i, j, k, udc_cnt;
3580 +       int ret;
3581 +       struct ebt_cl_stack *cl_s = NULL; // used in the checking for chain loops
3582 +
3583 +       i = 0;
3584 +       while (i < NF_BR_NUMHOOKS && !(repl->valid_hooks & (1 << i)))
3585 +               i++;
3586 +       if (i == NF_BR_NUMHOOKS) {
3587 +               BUGPRINT("No valid hooks specified\n");
3588 +               return -EINVAL;
3589 +       }
3590 +       if (repl->hook_entry[i] != (struct ebt_entries *)repl->entries) {
3591 +               BUGPRINT("Chains don't start at beginning\n");
3592 +               return -EINVAL;
3593 +       }
3594 +       // make sure chains are ordered after each other in same order
3595 +       // as their corresponding hooks
3596 +       for (j = i + 1; j < NF_BR_NUMHOOKS; j++) {
3597 +               if (!(repl->valid_hooks & (1 << j)))
3598 +                       continue;
3599 +               if ( repl->hook_entry[j] <= repl->hook_entry[i] ) {
3600 +                       BUGPRINT("Hook order must be followed\n");
3601 +                       return -EINVAL;
3602 +               }
3603 +               i = j;
3604 +       }
3605 +
3606 +       for (i = 0; i < NF_BR_NUMHOOKS; i++)
3607 +               newinfo->hook_entry[i] = NULL;
3608 +
3609 +       newinfo->entries_size = repl->entries_size;
3610 +       newinfo->nentries = repl->nentries;
3611 +
3612 +       // do some early checkings and initialize some things
3613 +       i = 0; // holds the expected nr. of entries for the chain
3614 +       j = 0; // holds the up to now counted entries for the chain
3615 +       k = 0; // holds the total nr. of entries, should equal
3616 +              // newinfo->nentries afterwards
3617 +       udc_cnt = 0; // will hold the nr. of user defined chains (udc)
3618 +       ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3619 +          ebt_check_entry_size_and_hooks, newinfo, repl->entries,
3620 +          repl->entries + repl->entries_size, repl->hook_entry, &i, &j, &k,
3621 +          &udc_cnt, repl->valid_hooks);
3622 +
3623 +       if (ret != 0)
3624 +               return ret;
3625 +
3626 +       if (i != j) {
3627 +               BUGPRINT("nentries does not equal the nr of entries in the "
3628 +                        "(last) chain\n");
3629 +               return -EINVAL;
3630 +       }
3631 +       if (k != newinfo->nentries) {
3632 +               BUGPRINT("Total nentries is wrong\n");
3633 +               return -EINVAL;
3634 +       }
3635 +
3636 +       // check if all valid hooks have a chain
3637 +       for (i = 0; i < NF_BR_NUMHOOKS; i++) {
3638 +               if (newinfo->hook_entry[i] == NULL &&
3639 +                  (repl->valid_hooks & (1 << i))) {
3640 +                       BUGPRINT("Valid hook without chain\n");
3641 +                       return -EINVAL;
3642 +               }
3643 +       }
3644 +
3645 +       // Get the location of the udc, put them in an array
3646 +       // While we're at it, allocate the chainstack
3647 +       if (udc_cnt) {
3648 +               // this will get free'd in do_replace()/ebt_register_table()
3649 +               // if an error occurs
3650 +               newinfo->chainstack = (struct ebt_chainstack **)
3651 +                  vmalloc(smp_num_cpus * sizeof(struct ebt_chainstack));
3652 +               if (!newinfo->chainstack)
3653 +                       return -ENOMEM;
3654 +               for (i = 0; i < smp_num_cpus; i++) {
3655 +                       newinfo->chainstack[i] =
3656 +                          vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
3657 +                       if (!newinfo->chainstack[i]) {
3658 +                               while (i)
3659 +                                       vfree(newinfo->chainstack[--i]);
3660 +                               vfree(newinfo->chainstack);
3661 +                               newinfo->chainstack = NULL;
3662 +                               return -ENOMEM;
3663 +                       }
3664 +               }
3665 +
3666 +               cl_s = (struct ebt_cl_stack *)
3667 +                  vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
3668 +               if (!cl_s)
3669 +                       return -ENOMEM;
3670 +               i = 0; // the i'th udc
3671 +               EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3672 +                  ebt_get_udc_positions, newinfo, repl->hook_entry, &i,
3673 +                  repl->valid_hooks, cl_s);
3674 +               // sanity check
3675 +               if (i != udc_cnt) {
3676 +                       BUGPRINT("i != udc_cnt\n");
3677 +                       vfree(cl_s);
3678 +                       return -EFAULT;
3679 +               }
3680 +       }
3681 +
3682 +       // Check for loops
3683 +       for (i = 0; i < NF_BR_NUMHOOKS; i++)
3684 +               if (repl->valid_hooks & (1 << i))
3685 +                       if (check_chainloops(newinfo->hook_entry[i],
3686 +                          cl_s, udc_cnt, i, newinfo->entries)) {
3687 +                               if (cl_s)
3688 +                                       vfree(cl_s);
3689 +                               return -EINVAL;
3690 +                       }
3691 +
3692 +       // we now know the following (along with E=mc):
3693 +       // - the nr of entries in each chain is right
3694 +       // - the size of the allocated space is right
3695 +       // - all valid hooks have a corresponding chain
3696 +       // - there are no loops
3697 +       // - wrong data can still be on the level of a single entry
3698 +       // - could be there are jumps to places that are not the
3699 +       //   beginning of a chain. This can only occur in chains that
3700 +       //   are not accessible from any base chains, so we don't care.
3701 +
3702 +       // used to know what we need to clean up if something goes wrong
3703 +       i = 0;
3704 +       ret = EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3705 +          ebt_check_entry, newinfo, repl->name, &i, repl->valid_hooks,
3706 +          cl_s, udc_cnt);
3707 +       if (ret != 0) {
3708 +               EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3709 +                  ebt_cleanup_entry, &i);
3710 +       }
3711 +       if (cl_s)
3712 +               vfree(cl_s);
3713 +       return ret;
3714 +}
3715 +
3716 +// called under write_lock
3717 +static void get_counters(struct ebt_counter *oldcounters,
3718 +   struct ebt_counter *counters, unsigned int nentries)
3719 +{
3720 +       int i, cpu;
3721 +       struct ebt_counter *counter_base;
3722 +
3723 +       // counters of cpu 0
3724 +       memcpy(counters, oldcounters,
3725 +          sizeof(struct ebt_counter) * nentries);
3726 +       // add other counters to those of cpu 0
3727 +       for (cpu = 1; cpu < smp_num_cpus; cpu++) {
3728 +               counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
3729 +               for (i = 0; i < nentries; i++) {
3730 +                       counters[i].pcnt += counter_base[i].pcnt;
3731 +                       counters[i].bcnt += counter_base[i].bcnt;
3732 +               }
3733 +       }
3734 +}
3735 +
3736 +// replace the table
3737 +static int do_replace(void *user, unsigned int len)
3738 +{
3739 +       int ret, i, countersize;
3740 +       struct ebt_table_info *newinfo;
3741 +       struct ebt_replace tmp;
3742 +       struct ebt_table *t;
3743 +       struct ebt_counter *counterstmp = NULL;
3744 +       // used to be able to unlock earlier
3745 +       struct ebt_table_info *table;
3746 +
3747 +       if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
3748 +               return -EFAULT;
3749 +
3750 +       if (len != sizeof(tmp) + tmp.entries_size) {
3751 +               BUGPRINT("Wrong len argument\n");
3752 +               return -EINVAL;
3753 +       }
3754 +
3755 +       if (tmp.entries_size == 0) {
3756 +               BUGPRINT("Entries_size never zero\n");
3757 +               return -EINVAL;
3758 +       }
3759 +       countersize = COUNTER_OFFSET(tmp.nentries) * smp_num_cpus;
3760 +       newinfo = (struct ebt_table_info *)
3761 +          vmalloc(sizeof(struct ebt_table_info) + countersize);
3762 +       if (!newinfo)
3763 +               return -ENOMEM;
3764 +
3765 +       if (countersize)
3766 +               memset(newinfo->counters, 0, countersize);
3767 +
3768 +       newinfo->entries = (char *)vmalloc(tmp.entries_size);
3769 +       if (!newinfo->entries) {
3770 +               ret = -ENOMEM;
3771 +               goto free_newinfo;
3772 +       }
3773 +       if (copy_from_user(
3774 +          newinfo->entries, tmp.entries, tmp.entries_size) != 0) {
3775 +               BUGPRINT("Couldn't copy entries from userspace\n");
3776 +               ret = -EFAULT;
3777 +               goto free_entries;
3778 +       }
3779 +
3780 +       // the user wants counters back
3781 +       // the check on the size is done later, when we have the lock
3782 +       if (tmp.num_counters) {
3783 +               counterstmp = (struct ebt_counter *)
3784 +                  vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
3785 +               if (!counterstmp) {
3786 +                       ret = -ENOMEM;
3787 +                       goto free_entries;
3788 +               }
3789 +       }
3790 +       else
3791 +               counterstmp = NULL;
3792 +
3793 +       // this can get initialized by translate_table()
3794 +       newinfo->chainstack = NULL;
3795 +       ret = translate_table(&tmp, newinfo);
3796 +
3797 +       if (ret != 0)
3798 +               goto free_counterstmp;
3799 +
3800 +       t = find_table_lock(tmp.name, &ret, &ebt_mutex);
3801 +       if (!t)
3802 +               goto free_iterate;
3803 +
3804 +       // the table doesn't like it
3805 +       if (t->check && (ret = t->check(newinfo, tmp.valid_hooks)))
3806 +               goto free_unlock;
3807 +
3808 +       if (tmp.num_counters && tmp.num_counters != t->private->nentries) {
3809 +               BUGPRINT("Wrong nr. of counters requested\n");
3810 +               ret = -EINVAL;
3811 +               goto free_unlock;
3812 +       }
3813 +
3814 +       // we have the mutex lock, so no danger in reading this pointer
3815 +       table = t->private;
3816 +       // we need an atomic snapshot of the counters
3817 +       write_lock_bh(&t->lock);
3818 +       if (tmp.num_counters)
3819 +               get_counters(t->private->counters, counterstmp,
3820 +                  t->private->nentries);
3821 +
3822 +       t->private = newinfo;
3823 +       write_unlock_bh(&t->lock);
3824 +       up(&ebt_mutex);
3825 +       // So, a user can change the chains while having messed up her counter
3826 +       // allocation. Only reason why this is done is because this way the lock
3827 +       // is held only once, while this doesn't bring the kernel into a
3828 +       // dangerous state.
3829 +       if (tmp.num_counters &&
3830 +          copy_to_user(tmp.counters, counterstmp,
3831 +          tmp.num_counters * sizeof(struct ebt_counter))) {
3832 +               BUGPRINT("Couldn't copy counters to userspace\n");
3833 +               ret = -EFAULT;
3834 +       }
3835 +       else
3836 +               ret = 0;
3837 +
3838 +       // decrease module count and free resources
3839 +       EBT_ENTRY_ITERATE(table->entries, table->entries_size,
3840 +          ebt_cleanup_entry, NULL);
3841 +
3842 +       vfree(table->entries);
3843 +       if (table->chainstack) {
3844 +               for (i = 0; i < smp_num_cpus; i++)
3845 +                       vfree(table->chainstack[i]);
3846 +               vfree(table->chainstack);
3847 +       }
3848 +       vfree(table);
3849 +
3850 +       if (counterstmp)
3851 +               vfree(counterstmp);
3852 +       return ret;
3853 +
3854 +free_unlock:
3855 +       up(&ebt_mutex);
3856 +free_iterate:
3857 +       EBT_ENTRY_ITERATE(newinfo->entries, newinfo->entries_size,
3858 +          ebt_cleanup_entry, NULL);
3859 +free_counterstmp:
3860 +       if (counterstmp)
3861 +               vfree(counterstmp);
3862 +       // can be initialized in translate_table()
3863 +       if (newinfo->chainstack) {
3864 +               for (i = 0; i < smp_num_cpus; i++)
3865 +                       vfree(newinfo->chainstack[i]);
3866 +               vfree(newinfo->chainstack);
3867 +       }
3868 +free_entries:
3869 +       if (newinfo->entries)
3870 +               vfree(newinfo->entries);
3871 +free_newinfo:
3872 +       if (newinfo)
3873 +               vfree(newinfo);
3874 +       return ret;
3875 +}
3876 +
3877 +int ebt_register_target(struct ebt_target *target)
3878 +{
3879 +       int ret;
3880 +
3881 +       ret = down_interruptible(&ebt_mutex);
3882 +       if (ret != 0)
3883 +               return ret;
3884 +       if (!list_named_insert(&ebt_targets, target)) {
3885 +               up(&ebt_mutex);
3886 +               return -EEXIST;
3887 +       }
3888 +       up(&ebt_mutex);
3889 +       MOD_INC_USE_COUNT;
3890 +
3891 +       return 0;
3892 +}
3893 +
3894 +void ebt_unregister_target(struct ebt_target *target)
3895 +{
3896 +       down(&ebt_mutex);
3897 +       LIST_DELETE(&ebt_targets, target);
3898 +       up(&ebt_mutex);
3899 +       MOD_DEC_USE_COUNT;
3900 +}
3901 +
3902 +int ebt_register_match(struct ebt_match *match)
3903 +{
3904 +       int ret;
3905 +
3906 +       ret = down_interruptible(&ebt_mutex);
3907 +       if (ret != 0)
3908 +               return ret;
3909 +       if (!list_named_insert(&ebt_matches, match)) {
3910 +               up(&ebt_mutex);
3911 +               return -EEXIST;
3912 +       }
3913 +       up(&ebt_mutex);
3914 +       MOD_INC_USE_COUNT;
3915 +
3916 +       return 0;
3917 +}
3918 +
3919 +void ebt_unregister_match(struct ebt_match *match)
3920 +{
3921 +       down(&ebt_mutex);
3922 +       LIST_DELETE(&ebt_matches, match);
3923 +       up(&ebt_mutex);
3924 +       MOD_DEC_USE_COUNT;
3925 +}
3926 +
3927 +int ebt_register_watcher(struct ebt_watcher *watcher)
3928 +{
3929 +       int ret;
3930 +
3931 +       ret = down_interruptible(&ebt_mutex);
3932 +       if (ret != 0)
3933 +               return ret;
3934 +       if (!list_named_insert(&ebt_watchers, watcher)) {
3935 +               up(&ebt_mutex);
3936 +               return -EEXIST;
3937 +       }
3938 +       up(&ebt_mutex);
3939 +       MOD_INC_USE_COUNT;
3940 +
3941 +       return 0;
3942 +}
3943 +
3944 +void ebt_unregister_watcher(struct ebt_watcher *watcher)
3945 +{
3946 +       down(&ebt_mutex);
3947 +       LIST_DELETE(&ebt_watchers, watcher);
3948 +       up(&ebt_mutex);
3949 +       MOD_DEC_USE_COUNT;
3950 +}
3951 +
3952 +int ebt_register_table(struct ebt_table *table)
3953 +{
3954 +       struct ebt_table_info *newinfo;
3955 +       int ret, i, countersize;
3956 +
3957 +       if (!table || !table->table ||!table->table->entries ||
3958 +           table->table->entries_size == 0 ||
3959 +           table->table->counters || table->private) {
3960 +               BUGPRINT("Bad table data for ebt_register_table!!!\n");
3961 +               return -EINVAL;
3962 +       }
3963 +
3964 +       countersize = COUNTER_OFFSET(table->table->nentries) * smp_num_cpus;
3965 +       newinfo = (struct ebt_table_info *)
3966 +          vmalloc(sizeof(struct ebt_table_info) + countersize);
3967 +       ret = -ENOMEM;
3968 +       if (!newinfo)
3969 +               return -ENOMEM;
3970 +
3971 +       newinfo->entries = (char *)vmalloc(table->table->entries_size);
3972 +       if (!(newinfo->entries))
3973 +               goto free_newinfo;
3974 +
3975 +       memcpy(newinfo->entries, table->table->entries,
3976 +          table->table->entries_size);
3977 +
3978 +       if (countersize)
3979 +               memset(newinfo->counters, 0, countersize);
3980 +
3981 +       // fill in newinfo and parse the entries
3982 +       newinfo->chainstack = NULL;
3983 +       ret = translate_table(table->table, newinfo);
3984 +       if (ret != 0) {
3985 +               BUGPRINT("Translate_table failed\n");
3986 +               goto free_chainstack;
3987 +       }
3988 +
3989 +       if (table->check && table->check(newinfo, table->valid_hooks)) {
3990 +               BUGPRINT("The table doesn't like its own initial data, lol\n");
3991 +               return -EINVAL;
3992 +       }
3993 +
3994 +       table->private = newinfo;
3995 +       table->lock = RW_LOCK_UNLOCKED;
3996 +       ret = down_interruptible(&ebt_mutex);
3997 +       if (ret != 0)
3998 +               goto free_chainstack;
3999 +
4000 +       if (list_named_find(&ebt_tables, table->name)) {
4001 +               ret = -EEXIST;
4002 +               BUGPRINT("Table name already exists\n");
4003 +               goto free_unlock;
4004 +       }
4005 +
4006 +       list_prepend(&ebt_tables, table);
4007 +       up(&ebt_mutex);
4008 +       MOD_INC_USE_COUNT;
4009 +       return 0;
4010 +free_unlock:
4011 +       up(&ebt_mutex);
4012 +free_chainstack:
4013 +       if (newinfo->chainstack) {
4014 +               for (i = 0; i < smp_num_cpus; i++)
4015 +                       vfree(newinfo->chainstack[i]);
4016 +               vfree(newinfo->chainstack);
4017 +       }
4018 +       vfree(newinfo->entries);
4019 +free_newinfo:
4020 +       vfree(newinfo);
4021 +       return ret;
4022 +}
4023 +
4024 +void ebt_unregister_table(struct ebt_table *table)
4025 +{
4026 +       int i;
4027 +
4028 +       if (!table) {
4029 +               BUGPRINT("Request to unregister NULL table!!!\n");
4030 +               return;
4031 +       }
4032 +       down(&ebt_mutex);
4033 +       LIST_DELETE(&ebt_tables, table);
4034 +       up(&ebt_mutex);
4035 +       EBT_ENTRY_ITERATE(table->private->entries,
4036 +          table->private->entries_size, ebt_cleanup_entry, NULL);
4037 +       if (table->private->entries)
4038 +               vfree(table->private->entries);
4039 +       if (table->private->chainstack) {
4040 +               for (i = 0; i < smp_num_cpus; i++)
4041 +                       vfree(table->private->chainstack[i]);
4042 +               vfree(table->private->chainstack);
4043 +       }
4044 +       vfree(table->private);
4045 +       MOD_DEC_USE_COUNT;
4046 +}
4047 +
4048 +// userspace just supplied us with counters
4049 +static int update_counters(void *user, unsigned int len)
4050 +{
4051 +       int i, ret;
4052 +       struct ebt_counter *tmp;
4053 +       struct ebt_replace hlp;
4054 +       struct ebt_table *t;
4055 +
4056 +       if (copy_from_user(&hlp, user, sizeof(hlp)))
4057 +               return -EFAULT;
4058 +
4059 +       if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
4060 +               return -EINVAL;
4061 +       if (hlp.num_counters == 0)
4062 +               return -EINVAL;
4063 +
4064 +       if ( !(tmp = (struct ebt_counter *)
4065 +          vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
4066 +               MEMPRINT("Update_counters && nomemory\n");
4067 +               return -ENOMEM;
4068 +       }
4069 +
4070 +       t = find_table_lock(hlp.name, &ret, &ebt_mutex);
4071 +       if (!t)
4072 +               goto free_tmp;
4073 +
4074 +       if (hlp.num_counters != t->private->nentries) {
4075 +               BUGPRINT("Wrong nr of counters\n");
4076 +               ret = -EINVAL;
4077 +               goto unlock_mutex;
4078 +       }
4079 +
4080 +       if ( copy_from_user(tmp, hlp.counters,
4081 +          hlp.num_counters * sizeof(struct ebt_counter)) ) {
4082 +               BUGPRINT("Updata_counters && !cfu\n");
4083 +               ret = -EFAULT;
4084 +               goto unlock_mutex;
4085 +       }
4086 +
4087 +       // we want an atomic add of the counters
4088 +       write_lock_bh(&t->lock);
4089 +
4090 +       // we add to the counters of the first cpu
4091 +       for (i = 0; i < hlp.num_counters; i++) {
4092 +               t->private->counters[i].pcnt += tmp[i].pcnt;
4093 +               t->private->counters[i].bcnt += tmp[i].bcnt;
4094 +       }
4095 +
4096 +       write_unlock_bh(&t->lock);
4097 +       ret = 0;
4098 +unlock_mutex:
4099 +       up(&ebt_mutex);
4100 +free_tmp:
4101 +       vfree(tmp);
4102 +       return ret;
4103 +}
4104 +
4105 +static inline int ebt_make_matchname(struct ebt_entry_match *m,
4106 +   char *base, char *ubase)
4107 +{
4108 +       char *hlp = ubase - base + (char *)m;
4109 +       if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
4110 +               return -EFAULT;
4111 +       return 0;
4112 +}
4113 +
4114 +static inline int ebt_make_watchername(struct ebt_entry_watcher *w,
4115 +   char *base, char *ubase)
4116 +{
4117 +       char *hlp = ubase - base + (char *)w;
4118 +       if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
4119 +               return -EFAULT;
4120 +       return 0;
4121 +}
4122 +
4123 +static inline int ebt_make_names(struct ebt_entry *e, char *base, char *ubase)
4124 +{
4125 +       int ret;
4126 +       char *hlp;
4127 +       struct ebt_entry_target *t;
4128 +
4129 +       if ((e->bitmask & EBT_ENTRY_OR_ENTRIES) == 0)
4130 +               return 0;
4131 +
4132 +       hlp = ubase - base + (char *)e + e->target_offset;
4133 +       t = (struct ebt_entry_target *)(((char *)e) + e->target_offset);
4134 +
4135 +       ret = EBT_MATCH_ITERATE(e, ebt_make_matchname, base, ubase);
4136 +       if (ret != 0)
4137 +               return ret;
4138 +       ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
4139 +       if (ret != 0)
4140 +               return ret;
4141 +       if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
4142 +               return -EFAULT;
4143 +       return 0;
4144 +}
4145 +
4146 +// called with ebt_mutex down
4147 +static int copy_everything_to_user(struct ebt_table *t, void *user,
4148 +   int *len, int cmd)
4149 +{
4150 +       struct ebt_replace tmp;
4151 +       struct ebt_counter *counterstmp, *oldcounters;
4152 +       unsigned int entries_size, nentries;
4153 +       char *entries;
4154 +
4155 +       if (cmd == EBT_SO_GET_ENTRIES) {
4156 +               entries_size = t->private->entries_size;
4157 +               nentries = t->private->nentries;
4158 +               entries = t->private->entries;
4159 +               oldcounters = t->private->counters;
4160 +       } else {
4161 +               entries_size = t->table->entries_size;
4162 +               nentries = t->table->nentries;
4163 +               entries = t->table->entries;
4164 +               oldcounters = t->table->counters;
4165 +       }
4166 +
4167 +       if (copy_from_user(&tmp, user, sizeof(tmp))) {
4168 +               BUGPRINT("Cfu didn't work\n");
4169 +               return -EFAULT;
4170 +       }
4171 +
4172 +       if (*len != sizeof(struct ebt_replace) + entries_size +
4173 +          (tmp.num_counters? nentries * sizeof(struct ebt_counter): 0)) {
4174 +               BUGPRINT("Wrong size\n");
4175 +               return -EINVAL;
4176 +       }
4177 +
4178 +       if (tmp.nentries != nentries) {
4179 +               BUGPRINT("Nentries wrong\n");
4180 +               return -EINVAL;
4181 +       }
4182 +
4183 +       if (tmp.entries_size != entries_size) {
4184 +               BUGPRINT("Wrong size\n");
4185 +               return -EINVAL;
4186 +       }
4187 +
4188 +       // userspace might not need the counters
4189 +       if (tmp.num_counters) {
4190 +               if (tmp.num_counters != nentries) {
4191 +                       BUGPRINT("Num_counters wrong\n");
4192 +                       return -EINVAL;
4193 +               }
4194 +               counterstmp = (struct ebt_counter *)
4195 +                  vmalloc(nentries * sizeof(struct ebt_counter));
4196 +               if (!counterstmp) {
4197 +                       MEMPRINT("Couldn't copy counters, out of memory\n");
4198 +                       return -ENOMEM;
4199 +               }
4200 +               write_lock_bh(&t->lock);
4201 +               get_counters(oldcounters, counterstmp, nentries);
4202 +               write_unlock_bh(&t->lock);
4203 +
4204 +               if (copy_to_user(tmp.counters, counterstmp,
4205 +                  nentries * sizeof(struct ebt_counter))) {
4206 +                       BUGPRINT("Couldn't copy counters to userspace\n");
4207 +                       vfree(counterstmp);
4208 +                       return -EFAULT;
4209 +               }
4210 +               vfree(counterstmp);
4211 +       }
4212 +
4213 +       if (copy_to_user(tmp.entries, entries, entries_size)) {
4214 +               BUGPRINT("Couldn't copy entries to userspace\n");
4215 +               return -EFAULT;
4216 +       }
4217 +       // set the match/watcher/target names right
4218 +       return EBT_ENTRY_ITERATE(entries, entries_size,
4219 +          ebt_make_names, entries, tmp.entries);
4220 +}
4221 +
4222 +static int do_ebt_set_ctl(struct sock *sk,
4223 +       int cmd, void *user, unsigned int len)
4224 +{
4225 +       int ret;
4226 +
4227 +       switch(cmd) {
4228 +       case EBT_SO_SET_ENTRIES:
4229 +               ret = do_replace(user, len);
4230 +               break;
4231 +       case EBT_SO_SET_COUNTERS:
4232 +               ret = update_counters(user, len);
4233 +               break;
4234 +       default:
4235 +               ret = -EINVAL;
4236 +  }
4237 +       return ret;
4238 +}
4239 +
4240 +static int do_ebt_get_ctl(struct sock *sk, int cmd, void *user, int *len)
4241 +{
4242 +       int ret;
4243 +       struct ebt_replace tmp;
4244 +       struct ebt_table *t;
4245 +
4246 +       if (copy_from_user(&tmp, user, sizeof(tmp)))
4247 +               return -EFAULT;
4248 +
4249 +       t = find_table_lock(tmp.name, &ret, &ebt_mutex);
4250 +       if (!t)
4251 +               return ret;
4252 +
4253 +       switch(cmd) {
4254 +       case EBT_SO_GET_INFO:
4255 +       case EBT_SO_GET_INIT_INFO:
4256 +               if (*len != sizeof(struct ebt_replace)){
4257 +                       ret = -EINVAL;
4258 +                       up(&ebt_mutex);
4259 +                       break;
4260 +               }
4261 +               if (cmd == EBT_SO_GET_INFO) {
4262 +                       tmp.nentries = t->private->nentries;
4263 +                       tmp.entries_size = t->private->entries_size;
4264 +                       tmp.valid_hooks = t->valid_hooks;
4265 +               } else {
4266 +                       tmp.nentries = t->table->nentries;
4267 +                       tmp.entries_size = t->table->entries_size;
4268 +                       tmp.valid_hooks = t->table->valid_hooks;
4269 +               }
4270 +               up(&ebt_mutex);
4271 +               if (copy_to_user(user, &tmp, *len) != 0){
4272 +                       BUGPRINT("c2u Didn't work\n");
4273 +                       ret = -EFAULT;
4274 +                       break;
4275 +               }
4276 +               ret = 0;
4277 +               break;
4278 +
4279 +       case EBT_SO_GET_ENTRIES:
4280 +       case EBT_SO_GET_INIT_ENTRIES:
4281 +               ret = copy_everything_to_user(t, user, len, cmd);
4282 +               up(&ebt_mutex);
4283 +               break;
4284 +
4285 +       default:
4286 +               up(&ebt_mutex);
4287 +               ret = -EINVAL;
4288 +       }
4289 +
4290 +       return ret;
4291 +}
4292 +
4293 +static struct nf_sockopt_ops ebt_sockopts =
4294 +{ { NULL, NULL }, PF_INET, EBT_BASE_CTL, EBT_SO_SET_MAX + 1, do_ebt_set_ctl,
4295 +    EBT_BASE_CTL, EBT_SO_GET_MAX + 1, do_ebt_get_ctl, 0, NULL
4296 +};
4297 +
4298 +static int __init init(void)
4299 +{
4300 +       int ret;
4301 +
4302 +       down(&ebt_mutex);
4303 +       list_named_insert(&ebt_targets, &ebt_standard_target);
4304 +       up(&ebt_mutex);
4305 +       if ((ret = nf_register_sockopt(&ebt_sockopts)) < 0)
4306 +               return ret;
4307 +
4308 +       printk(KERN_NOTICE "Ebtables v2.0 registered\n");
4309 +       return 0;
4310 +}
4311 +
4312 +static void __exit fini(void)
4313 +{
4314 +       nf_unregister_sockopt(&ebt_sockopts);
4315 +       printk(KERN_NOTICE "Ebtables v2.0 unregistered\n");
4316 +}
4317 +
4318 +EXPORT_SYMBOL(ebt_register_table);
4319 +EXPORT_SYMBOL(ebt_unregister_table);
4320 +EXPORT_SYMBOL(ebt_register_match);
4321 +EXPORT_SYMBOL(ebt_unregister_match);
4322 +EXPORT_SYMBOL(ebt_register_watcher);
4323 +EXPORT_SYMBOL(ebt_unregister_watcher);
4324 +EXPORT_SYMBOL(ebt_register_target);
4325 +EXPORT_SYMBOL(ebt_unregister_target);
4326 +EXPORT_SYMBOL(ebt_do_table);
4327 +module_init(init);
4328 +module_exit(fini);
4329 +MODULE_LICENSE("GPL");
4330 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4331 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebtables.h     2005-03-14 21:24:12.000000000 +0100
4332 @@ -0,0 +1,361 @@
4333 +/*
4334 + *  ebtables
4335 + *
4336 + *     Authors:
4337 + *     Bart De Schuymer                <bart.de.schuymer@pandora.be>
4338 + *
4339 + *  ebtables.c,v 2.0, September, 2002
4340 + *
4341 + *  This code is stongly inspired on the iptables code which is
4342 + *  Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
4343 + */
4344 +
4345 +#ifndef __LINUX_BRIDGE_EFF_H
4346 +#define __LINUX_BRIDGE_EFF_H
4347 +#include <linux/if.h>
4348 +#include <linux/netfilter_bridge.h>
4349 +#include <linux/if_ether.h>
4350 +
4351 +#define EBT_TABLE_MAXNAMELEN 32
4352 +#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
4353 +#define EBT_FUNCTION_MAXNAMELEN EBT_TABLE_MAXNAMELEN
4354 +
4355 +// verdicts >0 are "branches"
4356 +#define EBT_ACCEPT   -1
4357 +#define EBT_DROP     -2
4358 +#define EBT_CONTINUE -3
4359 +#define EBT_RETURN   -4
4360 +#define NUM_STANDARD_TARGETS   4
4361 +
4362 +struct ebt_counter
4363 +{
4364 +       uint64_t pcnt;
4365 +       uint64_t bcnt;
4366 +};
4367 +
4368 +struct ebt_entries {
4369 +       // this field is always set to zero
4370 +       // See EBT_ENTRY_OR_ENTRIES.
4371 +       // Must be same size as ebt_entry.bitmask
4372 +       unsigned int distinguisher;
4373 +       // the chain name
4374 +       char name[EBT_CHAIN_MAXNAMELEN];
4375 +       // counter offset for this chain
4376 +       unsigned int counter_offset;
4377 +       // one standard (accept, drop, return) per hook
4378 +       int policy;
4379 +       // nr. of entries
4380 +       unsigned int nentries;
4381 +       // entry list
4382 +       char data[0];
4383 +};
4384 +
4385 +// used for the bitmask of struct ebt_entry
4386 +
4387 +// This is a hack to make a difference between an ebt_entry struct and an
4388 +// ebt_entries struct when traversing the entries from start to end.
4389 +// Using this simplifies the code alot, while still being able to use
4390 +// ebt_entries.
4391 +// Contrary, iptables doesn't use something like ebt_entries and therefore uses
4392 +// different techniques for naming the policy and such. So, iptables doesn't
4393 +// need a hack like this.
4394 +#define EBT_ENTRY_OR_ENTRIES 0x01
4395 +// these are the normal masks
4396 +#define EBT_NOPROTO 0x02
4397 +#define EBT_802_3 0x04
4398 +#define EBT_SOURCEMAC 0x08
4399 +#define EBT_DESTMAC 0x10
4400 +#define EBT_F_MASK (EBT_NOPROTO | EBT_802_3 | EBT_SOURCEMAC | EBT_DESTMAC \
4401 +   | EBT_ENTRY_OR_ENTRIES)
4402 +
4403 +#define EBT_IPROTO 0x01
4404 +#define EBT_IIN 0x02
4405 +#define EBT_IOUT 0x04
4406 +#define EBT_ISOURCE 0x8
4407 +#define EBT_IDEST 0x10
4408 +#define EBT_ILOGICALIN 0x20
4409 +#define EBT_ILOGICALOUT 0x40
4410 +#define EBT_INV_MASK (EBT_IPROTO | EBT_IIN | EBT_IOUT | EBT_ILOGICALIN \
4411 +   | EBT_ILOGICALOUT | EBT_ISOURCE | EBT_IDEST)
4412 +
4413 +struct ebt_entry_match
4414 +{
4415 +       union {
4416 +               char name[EBT_FUNCTION_MAXNAMELEN];
4417 +               struct ebt_match *match;
4418 +       } u;
4419 +       // size of data
4420 +       unsigned int match_size;
4421 +       unsigned char data[0];
4422 +};
4423 +
4424 +struct ebt_entry_watcher
4425 +{
4426 +       union {
4427 +               char name[EBT_FUNCTION_MAXNAMELEN];
4428 +               struct ebt_watcher *watcher;
4429 +       } u;
4430 +       // size of data
4431 +       unsigned int watcher_size;
4432 +       unsigned char data[0];
4433 +};
4434 +
4435 +struct ebt_entry_target
4436 +{
4437 +       union {
4438 +               char name[EBT_FUNCTION_MAXNAMELEN];
4439 +               struct ebt_target *target;
4440 +       } u;
4441 +       // size of data
4442 +       unsigned int target_size;
4443 +       unsigned char data[0];
4444 +};
4445 +
4446 +#define EBT_STANDARD_TARGET "standard"
4447 +struct ebt_standard_target
4448 +{
4449 +       struct ebt_entry_target target;
4450 +       int verdict;
4451 +};
4452 +
4453 +// one entry
4454 +struct ebt_entry {
4455 +       // this needs to be the first field
4456 +       unsigned int bitmask;
4457 +       unsigned int invflags;
4458 +       uint16_t ethproto;
4459 +       // the physical in-dev
4460 +       char in[IFNAMSIZ];
4461 +       // the logical in-dev
4462 +       char logical_in[IFNAMSIZ];
4463 +       // the physical out-dev
4464 +       char out[IFNAMSIZ];
4465 +       // the logical out-dev
4466 +       char logical_out[IFNAMSIZ];
4467 +       unsigned char sourcemac[ETH_ALEN];
4468 +       unsigned char sourcemsk[ETH_ALEN];
4469 +       unsigned char destmac[ETH_ALEN];
4470 +       unsigned char destmsk[ETH_ALEN];
4471 +       // sizeof ebt_entry + matches
4472 +       unsigned int watchers_offset;
4473 +       // sizeof ebt_entry + matches + watchers
4474 +       unsigned int target_offset;
4475 +       // sizeof ebt_entry + matches + watchers + target
4476 +       unsigned int next_offset;
4477 +       unsigned char elems[0];
4478 +};
4479 +
4480 +struct ebt_replace
4481 +{
4482 +       char name[EBT_TABLE_MAXNAMELEN];
4483 +       unsigned int valid_hooks;
4484 +       // nr of rules in the table
4485 +       unsigned int nentries;
4486 +       // total size of the entries
4487 +       unsigned int entries_size;
4488 +       // start of the chains
4489 +       struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
4490 +       // nr of counters userspace expects back
4491 +       unsigned int num_counters;
4492 +       // where the kernel will put the old counters
4493 +       struct ebt_counter *counters;
4494 +       char *entries;
4495 +};
4496 +
4497 +// [gs]etsockopt numbers
4498 +#define EBT_BASE_CTL            128
4499 +
4500 +#define EBT_SO_SET_ENTRIES      (EBT_BASE_CTL)
4501 +#define EBT_SO_SET_COUNTERS     (EBT_SO_SET_ENTRIES+1)
4502 +#define EBT_SO_SET_MAX          (EBT_SO_SET_COUNTERS+1)
4503 +
4504 +#define EBT_SO_GET_INFO         (EBT_BASE_CTL)
4505 +#define EBT_SO_GET_ENTRIES      (EBT_SO_GET_INFO+1)
4506 +#define EBT_SO_GET_INIT_INFO    (EBT_SO_GET_ENTRIES+1)
4507 +#define EBT_SO_GET_INIT_ENTRIES (EBT_SO_GET_INIT_INFO+1)
4508 +#define EBT_SO_GET_MAX          (EBT_SO_GET_INIT_ENTRIES+1)
4509 +
4510 +#ifdef __KERNEL__
4511 +
4512 +// return values for match() functions
4513 +#define EBT_MATCH 0
4514 +#define EBT_NOMATCH 1
4515 +
4516 +struct ebt_match
4517 +{
4518 +       struct list_head list;
4519 +       const char name[EBT_FUNCTION_MAXNAMELEN];
4520 +       // 0 == it matches
4521 +       int (*match)(const struct sk_buff *skb, const struct net_device *in,
4522 +          const struct net_device *out, const void *matchdata,
4523 +          unsigned int datalen);
4524 +       // 0 == let it in
4525 +       int (*check)(const char *tablename, unsigned int hookmask,
4526 +          const struct ebt_entry *e, void *matchdata, unsigned int datalen);
4527 +       void (*destroy)(void *matchdata, unsigned int datalen);
4528 +       struct module *me;
4529 +};
4530 +
4531 +struct ebt_watcher
4532 +{
4533 +       struct list_head list;
4534 +       const char name[EBT_FUNCTION_MAXNAMELEN];
4535 +       void (*watcher)(const struct sk_buff *skb, unsigned int hooknr,
4536 +          const struct net_device *in, const struct net_device *out,
4537 +          const void *watcherdata, unsigned int datalen);
4538 +       // 0 == let it in
4539 +       int (*check)(const char *tablename, unsigned int hookmask,
4540 +          const struct ebt_entry *e, void *watcherdata, unsigned int datalen);
4541 +       void (*destroy)(void *watcherdata, unsigned int datalen);
4542 +       struct module *me;
4543 +};
4544 +
4545 +struct ebt_target
4546 +{
4547 +       struct list_head list;
4548 +       const char name[EBT_FUNCTION_MAXNAMELEN];
4549 +       // returns one of the standard verdicts
4550 +       int (*target)(struct sk_buff **pskb, unsigned int hooknr,
4551 +          const struct net_device *in, const struct net_device *out,
4552 +          const void *targetdata, unsigned int datalen);
4553 +       // 0 == let it in
4554 +       int (*check)(const char *tablename, unsigned int hookmask,
4555 +          const struct ebt_entry *e, void *targetdata, unsigned int datalen);
4556 +       void (*destroy)(void *targetdata, unsigned int datalen);
4557 +       struct module *me;
4558 +};
4559 +
4560 +// used for jumping from and into user defined chains (udc)
4561 +struct ebt_chainstack
4562 +{
4563 +       struct ebt_entries *chaininfo; // pointer to chain data
4564 +       struct ebt_entry *e; // pointer to entry data
4565 +       unsigned int n; // n'th entry
4566 +};
4567 +
4568 +struct ebt_table_info
4569 +{
4570 +       // total size of the entries
4571 +       unsigned int entries_size;
4572 +       unsigned int nentries;
4573 +       // pointers to the start of the chains
4574 +       struct ebt_entries *hook_entry[NF_BR_NUMHOOKS];
4575 +       // room to maintain the stack used for jumping from and into udc
4576 +       struct ebt_chainstack **chainstack;
4577 +       char *entries;
4578 +       struct ebt_counter counters[0] ____cacheline_aligned;
4579 +};
4580 +
4581 +struct ebt_table
4582 +{
4583 +       struct list_head list;
4584 +       char name[EBT_TABLE_MAXNAMELEN];
4585 +       struct ebt_replace *table;
4586 +       unsigned int valid_hooks;
4587 +       rwlock_t lock;
4588 +       // e.g. could be the table explicitly only allows certain
4589 +       // matches, targets, ... 0 == let it in
4590 +       int (*check)(const struct ebt_table_info *info,
4591 +          unsigned int valid_hooks);
4592 +       // the data used by the kernel
4593 +       struct ebt_table_info *private;
4594 +};
4595 +
4596 +#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_entry_target)-1)) & \
4597 +                    ~(__alignof__(struct ebt_entry_target)-1))
4598 +extern int ebt_register_table(struct ebt_table *table);
4599 +extern void ebt_unregister_table(struct ebt_table *table);
4600 +extern int ebt_register_match(struct ebt_match *match);
4601 +extern void ebt_unregister_match(struct ebt_match *match);
4602 +extern int ebt_register_watcher(struct ebt_watcher *watcher);
4603 +extern void ebt_unregister_watcher(struct ebt_watcher *watcher);
4604 +extern int ebt_register_target(struct ebt_target *target);
4605 +extern void ebt_unregister_target(struct ebt_target *target);
4606 +extern unsigned int ebt_do_table(unsigned int hook, struct sk_buff **pskb,
4607 +   const struct net_device *in, const struct net_device *out,
4608 +   struct ebt_table *table);
4609 +
4610 +   // Used in the kernel match() functions
4611 +#define FWINV(bool,invflg) ((bool) ^ !!(info->invflags & invflg))
4612 +// True if the hook mask denotes that the rule is in a base chain,
4613 +// used in the check() functions
4614 +#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
4615 +// Clear the bit in the hook mask that tells if the rule is on a base chain
4616 +#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
4617 +// True if the target is not a standard target
4618 +#define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
4619 +
4620 +#endif /* __KERNEL__ */
4621 +
4622 +// blatently stolen from ip_tables.h
4623 +// fn returns 0 to continue iteration
4624 +#define EBT_MATCH_ITERATE(e, fn, args...)                   \
4625 +({                                                          \
4626 +       unsigned int __i;                                   \
4627 +       int __ret = 0;                                      \
4628 +       struct ebt_entry_match *__match;                    \
4629 +                                                           \
4630 +       for (__i = sizeof(struct ebt_entry);                \
4631 +            __i < (e)->watchers_offset;                    \
4632 +            __i += __match->match_size +                   \
4633 +            sizeof(struct ebt_entry_match)) {              \
4634 +               __match = (void *)(e) + __i;                \
4635 +                                                           \
4636 +               __ret = fn(__match , ## args);              \
4637 +               if (__ret != 0)                             \
4638 +                       break;                              \
4639 +       }                                                   \
4640 +       if (__ret == 0) {                                   \
4641 +               if (__i != (e)->watchers_offset)            \
4642 +                       __ret = -EINVAL;                    \
4643 +       }                                                   \
4644 +       __ret;                                              \
4645 +})
4646 +
4647 +#define EBT_WATCHER_ITERATE(e, fn, args...)                 \
4648 +({                                                          \
4649 +       unsigned int __i;                                   \
4650 +       int __ret = 0;                                      \
4651 +       struct ebt_entry_watcher *__watcher;                \
4652 +                                                           \
4653 +       for (__i = e->watchers_offset;                      \
4654 +            __i < (e)->target_offset;                      \
4655 +            __i += __watcher->watcher_size +               \
4656 +            sizeof(struct ebt_entry_watcher)) {            \
4657 +               __watcher = (void *)(e) + __i;              \
4658 +                                                           \
4659 +               __ret = fn(__watcher , ## args);            \
4660 +               if (__ret != 0)                             \
4661 +                       break;                              \
4662 +       }                                                   \
4663 +       if (__ret == 0) {                                   \
4664 +               if (__i != (e)->target_offset)              \
4665 +                       __ret = -EINVAL;                    \
4666 +       }                                                   \
4667 +       __ret;                                              \
4668 +})
4669 +
4670 +#define EBT_ENTRY_ITERATE(entries, size, fn, args...)       \
4671 +({                                                          \
4672 +       unsigned int __i;                                   \
4673 +       int __ret = 0;                                      \
4674 +       struct ebt_entry *__entry;                          \
4675 +                                                           \
4676 +       for (__i = 0; __i < (size);) {                      \
4677 +               __entry = (void *)(entries) + __i;          \
4678 +               __ret = fn(__entry , ## args);              \
4679 +               if (__ret != 0)                             \
4680 +                       break;                              \
4681 +               if (__entry->bitmask != 0)                  \
4682 +                       __i += __entry->next_offset;        \
4683 +               else                                        \
4684 +                       __i += sizeof(struct ebt_entries);  \
4685 +       }                                                   \
4686 +       if (__ret == 0) {                                   \
4687 +               if (__i != (size))                          \
4688 +                       __ret = -EINVAL;                    \
4689 +       }                                                   \
4690 +       __ret;                                              \
4691 +})
4692 +
4693 +#endif
4694 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4695 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_among.h    2005-03-14 00:00:30.000000000 +0100
4696 @@ -0,0 +1,65 @@
4697 +#ifndef __LINUX_BRIDGE_EBT_AMONG_H
4698 +#define __LINUX_BRIDGE_EBT_AMONG_H
4699 +
4700 +#define EBT_AMONG_DST 0x01
4701 +#define EBT_AMONG_SRC 0x02
4702 +
4703 +/* Grzegorz Borowiak <grzes@gnu.univ.gda.pl> 2003
4704 + *
4705 + * Write-once-read-many hash table, used for checking if a given
4706 + * MAC address belongs to a set or not and possibly for checking
4707 + * if it is related with a given IPv4 address.
4708 + *
4709 + * The hash value of an address is its last byte.
4710 + *
4711 + * In real-world ethernet addresses, values of the last byte are
4712 + * evenly distributed and there is no need to consider other bytes.
4713 + * It would only slow the routines down.
4714 + *
4715 + * For MAC address comparison speedup reasons, we introduce a trick.
4716 + * MAC address is mapped onto an array of two 32-bit integers.
4717 + * This pair of integers is compared with MAC addresses in the
4718 + * hash table, which are stored also in form of pairs of integers
4719 + * (in `cmp' array). This is quick as it requires only two elementary
4720 + * number comparisons in worst case. Further, we take advantage of
4721 + * fact that entropy of 3 last bytes of address is larger than entropy
4722 + * of 3 first bytes. So first we compare 4 last bytes of addresses and
4723 + * if they are the same we compare 2 first.
4724 + *
4725 + * Yes, it is a memory overhead, but in 2003 AD, who cares?
4726 + */
4727 +
4728 +struct ebt_mac_wormhash_tuple
4729 +{
4730 +       uint32_t cmp[2];
4731 +       uint32_t ip;
4732 +};
4733 +
4734 +struct ebt_mac_wormhash
4735 +{
4736 +       int table[257];
4737 +       int poolsize;
4738 +       struct ebt_mac_wormhash_tuple pool[0];
4739 +};
4740 +
4741 +#define ebt_mac_wormhash_size(x) ((x) ? sizeof(struct ebt_mac_wormhash) \
4742 +               + (x)->poolsize * sizeof(struct ebt_mac_wormhash_tuple) : 0)
4743 +
4744 +struct ebt_among_info
4745 +{
4746 +       int wh_dst_ofs;
4747 +       int wh_src_ofs;
4748 +       int bitmask;
4749 +};
4750 +
4751 +#define EBT_AMONG_DST_NEG 0x1
4752 +#define EBT_AMONG_SRC_NEG 0x2
4753 +
4754 +#define ebt_among_wh_dst(x) ((x)->wh_dst_ofs ? \
4755 +       (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_dst_ofs) : NULL)
4756 +#define ebt_among_wh_src(x) ((x)->wh_src_ofs ? \
4757 +       (struct ebt_mac_wormhash*)((char*)(x) + (x)->wh_src_ofs) : NULL)
4758 +
4759 +#define EBT_AMONG_MATCH "among"
4760 +
4761 +#endif
4762 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4763 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_limit.h    2005-03-14 00:00:30.000000000 +0100
4764 @@ -0,0 +1,23 @@
4765 +#ifndef __LINUX_BRIDGE_EBT_LIMIT_H
4766 +#define __LINUX_BRIDGE_EBT_LIMIT_H
4767 +
4768 +#define EBT_LIMIT_MATCH "limit"
4769 +
4770 +/* timings are in milliseconds. */
4771 +#define EBT_LIMIT_SCALE 10000
4772 +
4773 +/* 1/10,000 sec period => max of 10,000/sec.  Min rate is then 429490
4774 +   seconds, or one every 59 hours. */
4775 +
4776 +struct ebt_limit_info
4777 +{
4778 +       u_int32_t avg;    /* Average secs between packets * scale */
4779 +       u_int32_t burst;  /* Period multiplier for upper limit. */
4780 +
4781 +       /* Used internally by the kernel */
4782 +       unsigned long prev;
4783 +       u_int32_t credit;
4784 +       u_int32_t credit_cap, cost;
4785 +};
4786 +
4787 +#endif
4788 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4789 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_arpreply.h 2005-03-14 00:00:30.000000000 +0100
4790 @@ -0,0 +1,11 @@
4791 +#ifndef __LINUX_BRIDGE_EBT_ARPREPLY_H
4792 +#define __LINUX_BRIDGE_EBT_ARPREPLY_H
4793 +
4794 +struct ebt_arpreply_info
4795 +{
4796 +       unsigned char mac[ETH_ALEN];
4797 +       int target;
4798 +};
4799 +#define EBT_ARPREPLY_TARGET "arpreply"
4800 +
4801 +#endif
4802 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4803 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_802_3.h    2005-03-14 00:00:30.000000000 +0100
4804 @@ -0,0 +1,60 @@
4805 +#ifndef __LINUX_BRIDGE_EBT_802_3_H
4806 +#define __LINUX_BRIDGE_EBT_802_3_H
4807 +
4808 +#define EBT_802_3_SAP 0x01
4809 +#define EBT_802_3_TYPE 0x02
4810 +
4811 +#define EBT_802_3_MATCH "802_3"
4812 +
4813 +/*
4814 + * If frame has DSAP/SSAP value 0xaa you must check the SNAP type
4815 + * to discover what kind of packet we're carrying.
4816 + */
4817 +#define CHECK_TYPE 0xaa
4818 +
4819 +/*
4820 + * Control field may be one or two bytes.  If the first byte has
4821 + * the value 0x03 then the entire length is one byte, otherwise it is two.
4822 + * One byte controls are used in Unnumbered Information frames.
4823 + * Two byte controls are used in Numbered Information frames.
4824 + */
4825 +#define IS_UI 0x03
4826 +
4827 +#define EBT_802_3_MASK (EBT_802_3_SAP | EBT_802_3_TYPE | EBT_802_3)
4828 +
4829 +/* ui has one byte ctrl, ni has two */
4830 +struct hdr_ui {
4831 +       uint8_t dsap;
4832 +       uint8_t ssap;
4833 +       uint8_t ctrl;
4834 +       uint8_t orig[3];
4835 +       uint16_t type;
4836 +};
4837 +
4838 +struct hdr_ni {
4839 +       uint8_t dsap;
4840 +       uint8_t ssap;
4841 +       uint16_t ctrl;
4842 +       uint8_t  orig[3];
4843 +       uint16_t type;
4844 +};
4845 +
4846 +struct ebt_802_3_hdr {
4847 +       uint8_t  daddr[6];
4848 +       uint8_t  saddr[6];
4849 +       uint16_t len;
4850 +       union {
4851 +               struct hdr_ui ui;
4852 +               struct hdr_ni ni;
4853 +       } llc;
4854 +};
4855 +
4856 +struct ebt_802_3_info
4857 +{
4858 +       uint8_t  sap;
4859 +       uint16_t type;
4860 +       uint8_t  bitmask;
4861 +       uint8_t  invflags;
4862 +};
4863 +
4864 +#endif
4865 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4866 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_arp.h      2005-03-14 00:00:30.000000000 +0100
4867 @@ -0,0 +1,32 @@
4868 +#ifndef __LINUX_BRIDGE_EBT_ARP_H
4869 +#define __LINUX_BRIDGE_EBT_ARP_H
4870 +
4871 +#define EBT_ARP_OPCODE 0x01
4872 +#define EBT_ARP_HTYPE 0x02
4873 +#define EBT_ARP_PTYPE 0x04
4874 +#define EBT_ARP_SRC_IP 0x08
4875 +#define EBT_ARP_DST_IP 0x10
4876 +#define EBT_ARP_SRC_MAC 0x20
4877 +#define EBT_ARP_DST_MAC 0x40
4878 +#define EBT_ARP_MASK (EBT_ARP_OPCODE | EBT_ARP_HTYPE | EBT_ARP_PTYPE | \
4879 +   EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)
4880 +#define EBT_ARP_MATCH "arp"
4881 +
4882 +struct ebt_arp_info
4883 +{
4884 +       uint16_t htype;
4885 +       uint16_t ptype;
4886 +       uint16_t opcode;
4887 +       uint32_t saddr;
4888 +       uint32_t smsk;
4889 +       uint32_t daddr;
4890 +       uint32_t dmsk;
4891 +       unsigned char smaddr[ETH_ALEN];
4892 +       unsigned char smmsk[ETH_ALEN];
4893 +       unsigned char dmaddr[ETH_ALEN];
4894 +       unsigned char dmmsk[ETH_ALEN];
4895 +       uint8_t  bitmask;
4896 +       uint8_t  invflags;
4897 +};
4898 +
4899 +#endif
4900 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4901 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_ip.h       2005-03-14 00:00:30.000000000 +0100
4902 @@ -0,0 +1,43 @@
4903 +/*
4904 + *  ebt_ip
4905 + *
4906 + *     Authors:
4907 + *     Bart De Schuymer <bart.de.schuymer@pandora.be>
4908 + *
4909 + *  April, 2002
4910 + *
4911 + *  Changes:
4912 + *    added ip-sport and ip-dport
4913 + *    Innominate Security Technologies AG <mhopf@innominate.com>
4914 + *    September, 2002
4915 + */
4916 +
4917 +#ifndef __LINUX_BRIDGE_EBT_IP_H
4918 +#define __LINUX_BRIDGE_EBT_IP_H
4919 +
4920 +#define EBT_IP_SOURCE 0x01
4921 +#define EBT_IP_DEST 0x02
4922 +#define EBT_IP_TOS 0x04
4923 +#define EBT_IP_PROTO 0x08
4924 +#define EBT_IP_SPORT 0x10
4925 +#define EBT_IP_DPORT 0x20
4926 +#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
4927 + EBT_IP_SPORT | EBT_IP_DPORT )
4928 +#define EBT_IP_MATCH "ip"
4929 +
4930 +// the same values are used for the invflags
4931 +struct ebt_ip_info
4932 +{
4933 +       uint32_t saddr;
4934 +       uint32_t daddr;
4935 +       uint32_t smsk;
4936 +       uint32_t dmsk;
4937 +       uint8_t  tos;
4938 +       uint8_t  protocol;
4939 +       uint8_t  bitmask;
4940 +       uint8_t  invflags;
4941 +       uint16_t sport[2];
4942 +       uint16_t dport[2];
4943 +};
4944 +
4945 +#endif
4946 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4947 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_pkttype.h  2005-03-14 00:00:30.000000000 +0100
4948 @@ -0,0 +1,11 @@
4949 +#ifndef __LINUX_BRIDGE_EBT_PKTTYPE_H
4950 +#define __LINUX_BRIDGE_EBT_PKTTYPE_H
4951 +
4952 +struct ebt_pkttype_info
4953 +{
4954 +       uint8_t pkt_type;
4955 +       uint8_t invert;
4956 +};
4957 +#define EBT_PKTTYPE_MATCH "pkttype"
4958 +
4959 +#endif
4960 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
4961 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_stp.h      2005-03-14 00:00:30.000000000 +0100
4962 @@ -0,0 +1,46 @@
4963 +#ifndef __LINUX_BRIDGE_EBT_STP_H
4964 +#define __LINUX_BRIDGE_EBT_STP_H
4965 +
4966 +#define EBT_STP_TYPE           0x0001
4967 +
4968 +#define EBT_STP_FLAGS          0x0002
4969 +#define EBT_STP_ROOTPRIO       0x0004
4970 +#define EBT_STP_ROOTADDR       0x0008
4971 +#define EBT_STP_ROOTCOST       0x0010
4972 +#define EBT_STP_SENDERPRIO     0x0020
4973 +#define EBT_STP_SENDERADDR     0x0040
4974 +#define EBT_STP_PORT           0x0080
4975 +#define EBT_STP_MSGAGE         0x0100
4976 +#define EBT_STP_MAXAGE         0x0200
4977 +#define EBT_STP_HELLOTIME      0x0400
4978 +#define EBT_STP_FWDD           0x0800
4979 +
4980 +#define EBT_STP_MASK           0x0fff
4981 +#define EBT_STP_CONFIG_MASK    0x0ffe
4982 +
4983 +#define EBT_STP_MATCH "stp"
4984 +
4985 +struct ebt_stp_config_info
4986 +{
4987 +       uint8_t flags;
4988 +       uint16_t root_priol, root_priou;
4989 +       char root_addr[6], root_addrmsk[6];
4990 +       uint32_t root_costl, root_costu;
4991 +       uint16_t sender_priol, sender_priou;
4992 +       char sender_addr[6], sender_addrmsk[6];
4993 +       uint16_t portl, portu;
4994 +       uint16_t msg_agel, msg_ageu;
4995 +       uint16_t max_agel, max_ageu;
4996 +       uint16_t hello_timel, hello_timeu;
4997 +       uint16_t forward_delayl, forward_delayu;
4998 +};
4999 +
5000 +struct ebt_stp_info
5001 +{
5002 +       uint8_t type;
5003 +       struct ebt_stp_config_info config;
5004 +       uint16_t bitmask;
5005 +       uint16_t invflags;
5006 +};
5007 +
5008 +#endif
5009 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5010 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_vlan.h     2005-03-14 00:00:30.000000000 +0100
5011 @@ -0,0 +1,20 @@
5012 +#ifndef __LINUX_BRIDGE_EBT_VLAN_H
5013 +#define __LINUX_BRIDGE_EBT_VLAN_H
5014 +
5015 +#define EBT_VLAN_ID    0x01
5016 +#define EBT_VLAN_PRIO  0x02
5017 +#define EBT_VLAN_ENCAP 0x04
5018 +#define EBT_VLAN_MASK (EBT_VLAN_ID | EBT_VLAN_PRIO | EBT_VLAN_ENCAP)
5019 +#define EBT_VLAN_MATCH "vlan"
5020 +
5021 +struct ebt_vlan_info {
5022 +       uint16_t id;            /* VLAN ID {1-4095} */
5023 +       uint8_t prio;           /* VLAN User Priority {0-7} */
5024 +       uint16_t encap;         /* VLAN Encapsulated frame code {0-65535} */
5025 +       uint8_t bitmask;                /* Args bitmask bit 1=1 - ID arg,
5026 +                                  bit 2=1 User-Priority arg, bit 3=1 encap*/
5027 +       uint8_t invflags;               /* Inverse bitmask  bit 1=1 - inversed ID arg,
5028 +                                  bit 2=1 - inversed Pirority arg */
5029 +};
5030 +
5031 +#endif
5032 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5033 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_log.h      2005-03-14 00:00:30.000000000 +0100
5034 @@ -0,0 +1,17 @@
5035 +#ifndef __LINUX_BRIDGE_EBT_LOG_H
5036 +#define __LINUX_BRIDGE_EBT_LOG_H
5037 +
5038 +#define EBT_LOG_IP 0x01 // if the frame is made by ip, log the ip information
5039 +#define EBT_LOG_ARP 0x02
5040 +#define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
5041 +#define EBT_LOG_PREFIX_SIZE 30
5042 +#define EBT_LOG_WATCHER "log"
5043 +
5044 +struct ebt_log_info
5045 +{
5046 +       uint8_t loglevel;
5047 +       uint8_t prefix[EBT_LOG_PREFIX_SIZE];
5048 +       uint32_t bitmask;
5049 +};
5050 +
5051 +#endif
5052 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5053 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_ulog.h     2005-03-14 00:00:30.000000000 +0100
5054 @@ -0,0 +1,33 @@
5055 +#ifndef _EBT_ULOG_H
5056 +#define _EBT_ULOG_H
5057 +
5058 +#define EBT_ULOG_DEFAULT_NLGROUP 0
5059 +#define EBT_ULOG_DEFAULT_QTHRESHOLD 1
5060 +#define EBT_ULOG_MAXNLGROUPS 32 /* hardcoded netlink max */
5061 +#define EBT_ULOG_PREFIX_LEN 32
5062 +#define EBT_ULOG_MAX_QLEN 50
5063 +#define EBT_ULOG_WATCHER "ulog"
5064 +
5065 +struct ebt_ulog_info {
5066 +       uint32_t nlgroup;
5067 +       unsigned int cprange;
5068 +       unsigned int qthreshold;
5069 +       char prefix[EBT_ULOG_PREFIX_LEN];
5070 +};
5071 +
5072 +typedef struct ebt_ulog_packet_msg {
5073 +       char indev[IFNAMSIZ];
5074 +       char outdev[IFNAMSIZ];
5075 +       char physindev[IFNAMSIZ];
5076 +       char physoutdev[IFNAMSIZ];
5077 +       char prefix[EBT_ULOG_PREFIX_LEN];
5078 +       struct timeval stamp;
5079 +       unsigned long mark;
5080 +       unsigned int hook;
5081 +       size_t data_len;
5082 +       /* The complete packet, including Ethernet header and perhaps
5083 +        * the VLAN header is appended */
5084 +       unsigned char data[0] __attribute__ ((aligned (__alignof__(int))));
5085 +} ebt_ulog_packet_msg_t;
5086 +
5087 +#endif /* _EBT_ULOG_H */
5088 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5089 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_nat.h      2005-03-14 00:00:30.000000000 +0100
5090 @@ -0,0 +1,13 @@
5091 +#ifndef __LINUX_BRIDGE_EBT_NAT_H
5092 +#define __LINUX_BRIDGE_EBT_NAT_H
5093 +
5094 +struct ebt_nat_info
5095 +{
5096 +       unsigned char mac[ETH_ALEN];
5097 +       // EBT_ACCEPT, EBT_DROP, EBT_CONTINUE or EBT_RETURN
5098 +       int target;
5099 +};
5100 +#define EBT_SNAT_TARGET "snat"
5101 +#define EBT_DNAT_TARGET "dnat"
5102 +
5103 +#endif
5104 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5105 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_redirect.h 2005-03-14 00:00:30.000000000 +0100
5106 @@ -0,0 +1,11 @@
5107 +#ifndef __LINUX_BRIDGE_EBT_REDIRECT_H
5108 +#define __LINUX_BRIDGE_EBT_REDIRECT_H
5109 +
5110 +struct ebt_redirect_info
5111 +{
5112 +       // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
5113 +       int target;
5114 +};
5115 +#define EBT_REDIRECT_TARGET "redirect"
5116 +
5117 +#endif
5118 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5119 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_mark_m.h   2005-03-14 00:00:30.000000000 +0100
5120 @@ -0,0 +1,15 @@
5121 +#ifndef __LINUX_BRIDGE_EBT_MARK_M_H
5122 +#define __LINUX_BRIDGE_EBT_MARK_M_H
5123 +
5124 +#define EBT_MARK_AND 0x01
5125 +#define EBT_MARK_OR 0x02
5126 +#define EBT_MARK_MASK (EBT_MARK_AND | EBT_MARK_OR)
5127 +struct ebt_mark_m_info
5128 +{
5129 +       unsigned long mark, mask;
5130 +       uint8_t invert;
5131 +       uint8_t bitmask;
5132 +};
5133 +#define EBT_MARK_MATCH "mark_m"
5134 +
5135 +#endif
5136 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5137 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_bridge/ebt_mark_t.h   2005-03-14 00:00:30.000000000 +0100
5138 @@ -0,0 +1,12 @@
5139 +#ifndef __LINUX_BRIDGE_EBT_MARK_T_H
5140 +#define __LINUX_BRIDGE_EBT_MARK_T_H
5141 +
5142 +struct ebt_mark_t_info
5143 +{
5144 +       unsigned long mark;
5145 +       // EBT_ACCEPT, EBT_DROP or EBT_CONTINUE or EBT_RETURN
5146 +       int target;
5147 +};
5148 +#define EBT_MARK_TARGET "mark"
5149 +
5150 +#endif
5151 --- linux-2.4.29/include/linux/netfilter.h      2005-01-19 15:10:12.000000000 +0100
5152 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter.h     2005-03-14 21:11:36.000000000 +0100
5153 @@ -17,7 +17,8 @@
5154  #define NF_STOLEN 2
5155  #define NF_QUEUE 3
5156  #define NF_REPEAT 4
5157 -#define NF_MAX_VERDICT NF_REPEAT
5158 +#define NF_STOP 5
5159 +#define NF_MAX_VERDICT NF_STOP
5160
5161  /* Generic cache responses from hook functions.
5162     <= 0x2000 is used for protocol-flags. */
5163 @@ -118,17 +119,34 @@ extern struct list_head nf_hooks[NPROTO]
5164  /* This is gross, but inline doesn't cut it for avoiding the function
5165     call in fast path: gcc doesn't inline (needs value tracking?). --RR */
5166  #ifdef CONFIG_NETFILTER_DEBUG
5167 -#define NF_HOOK nf_hook_slow
5168 +#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)                           \
5169 +({int __ret;                                                                  \
5170 +if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
5171 +       __ret = (okfn)(skb);                                                   \
5172 +__ret;})
5173 +#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)            \
5174 +({int __ret;                                                                  \
5175 +if ((__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)  \
5176 +       __ret = (okfn)(skb);                                                   \
5177 +__ret;})
5178  #else
5179 -#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)                    \
5180 -(list_empty(&nf_hooks[(pf)][(hook)])                                   \
5181 - ? (okfn)(skb)                                                         \
5182 - : nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn)))
5183 +#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)                           \
5184 +({int __ret;                                                                  \
5185 +if (list_empty(&nf_hooks[pf][hook]) ||                                        \
5186 +    (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, INT_MIN)) == 1) \
5187 +       __ret = (okfn)(skb);                                                   \
5188 +__ret;})
5189 +#define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)            \
5190 +({int __ret;                                                                  \
5191 +if (list_empty(&nf_hooks[pf][hook]) ||                                        \
5192 +    (__ret=nf_hook_slow(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)  \
5193 +       __ret = (okfn)(skb);                                                   \
5194 +__ret;})
5195  #endif
5196
5197 -int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
5198 +int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
5199                  struct net_device *indev, struct net_device *outdev,
5200 -                int (*okfn)(struct sk_buff *));
5201 +                int (*okfn)(struct sk_buff *), int thresh);
5202
5203  /* Call setsockopt() */
5204  int nf_setsockopt(struct sock *sk, int pf, int optval, char *opt,
5205 --- linux-2.4.29/include/linux/netfilter_ipv4.h 2002-02-25 20:38:13.000000000 +0100
5206 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_ipv4.h        2005-03-14 21:11:36.000000000 +0100
5207 @@ -52,8 +52,10 @@
5208  enum nf_ip_hook_priorities {
5209         NF_IP_PRI_FIRST = INT_MIN,
5210         NF_IP_PRI_CONNTRACK = -200,
5211 +       NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
5212         NF_IP_PRI_MANGLE = -150,
5213         NF_IP_PRI_NAT_DST = -100,
5214 +       NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
5215         NF_IP_PRI_FILTER = 0,
5216         NF_IP_PRI_NAT_SRC = 100,
5217         NF_IP_PRI_LAST = INT_MAX,
5218 --- linux-2.4.29/include/linux/netfilter_ipv6.h 2001-01-02 01:17:54.000000000 +0100
5219 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_ipv6.h        2005-03-14 21:24:11.000000000 +0100
5220 @@ -57,8 +57,10 @@
5221  enum nf_ip6_hook_priorities {
5222         NF_IP6_PRI_FIRST = INT_MIN,
5223         NF_IP6_PRI_CONNTRACK = -200,
5224 +       NF_IP6_PRI_BRIDGE_SABOTAGE_FORWARD = -175,
5225         NF_IP6_PRI_MANGLE = -150,
5226         NF_IP6_PRI_NAT_DST = -100,
5227 +       NF_IP6_PRI_BRIDGE_SABOTAGE_LOCAL_OUT = -50,
5228         NF_IP6_PRI_FILTER = 0,
5229         NF_IP6_PRI_NAT_SRC = 100,
5230         NF_IP6_PRI_LAST = INT_MAX,
5231 --- linux-2.4.29/include/linux/skbuff.h 2004-08-08 01:26:06.000000000 +0200
5232 +++ linux-2.4.29-ebt-brnf/include/linux/skbuff.h        2005-03-14 21:07:31.000000000 +0100
5233 @@ -92,6 +92,20 @@ struct nf_conntrack {
5234  struct nf_ct_info {
5235         struct nf_conntrack *master;
5236  };
5237 +
5238 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5239 +struct nf_bridge_info {
5240 +       atomic_t use;
5241 +       struct net_device *physindev;
5242 +       struct net_device *physoutdev;
5243 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
5244 +       struct net_device *netoutdev;
5245 +#endif
5246 +       unsigned int mask;
5247 +       unsigned long data[32 / sizeof(unsigned long)];
5248 +};
5249 +#endif
5250 +
5251  #endif
5252
5253  struct sk_buff_head {
5254 @@ -208,6 +222,9 @@ struct sk_buff {
5255  #ifdef CONFIG_NETFILTER_DEBUG
5256          unsigned int nf_debug;
5257  #endif
5258 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5259 +       struct nf_bridge_info   *nf_bridge;     /* Saved data about a bridged frame - see br_netfilter.c */
5260 +#endif
5261  #endif /*CONFIG_NETFILTER*/
5262
5263  #if defined(CONFIG_HIPPI)
5264 @@ -1175,6 +1192,20 @@ nf_reset(struct sk_buff *skb)
5265         skb->nf_debug = 0;
5266  #endif
5267  }
5268 +
5269 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5270 +static inline void nf_bridge_put(struct nf_bridge_info *nf_bridge)
5271 +{
5272 +       if (nf_bridge && atomic_dec_and_test(&nf_bridge->use))
5273 +               kfree(nf_bridge);
5274 +}
5275 +static inline void nf_bridge_get(struct nf_bridge_info *nf_bridge)
5276 +{
5277 +       if (nf_bridge)
5278 +               atomic_inc(&nf_bridge->use);
5279 +}
5280 +#endif
5281 +
5282  #else /* CONFIG_NETFILTER */
5283  static inline void nf_reset(struct sk_buff *skb) {}
5284  #endif /* CONFIG_NETFILTER */
5285 --- linux-2.4.29/net/core/netfilter.c   2005-01-19 15:10:13.000000000 +0100
5286 +++ linux-2.4.29-ebt-brnf/net/core/netfilter.c  2005-03-14 21:21:41.825275416 +0100
5287 @@ -342,32 +342,29 @@ static unsigned int nf_iterate(struct li
5288                                const struct net_device *indev,
5289                                const struct net_device *outdev,
5290                                struct list_head **i,
5291 -                              int (*okfn)(struct sk_buff *))
5292 +                              int (*okfn)(struct sk_buff *),
5293 +                              int hook_thresh)
5294  {
5295 +       unsigned int verdict;
5296 +
5297         for (*i = (*i)->next; *i != head; *i = (*i)->next) {
5298                 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
5299 -               switch (elem->hook(hook, skb, indev, outdev, okfn)) {
5300 -               case NF_QUEUE:
5301 -                       return NF_QUEUE;
5302 -
5303 -               case NF_STOLEN:
5304 -                       return NF_STOLEN;
5305 -
5306 -               case NF_DROP:
5307 -                       return NF_DROP;
5308
5309 -               case NF_REPEAT:
5310 -                       *i = (*i)->prev;
5311 -                       break;
5312 +               if (hook_thresh > elem->priority)
5313 +                       continue;
5314
5315 +               verdict = elem->hook(hook, skb, indev, outdev, okfn);
5316 +               if (verdict != NF_ACCEPT) {
5317  #ifdef CONFIG_NETFILTER_DEBUG
5318 -               case NF_ACCEPT:
5319 -                       break;
5320 -
5321 -               default:
5322 -                       NFDEBUG("Evil return from %p(%u).\n",
5323 -                               elem->hook, hook);
5324 +                       if (unlikely(verdict > NF_MAX_VERDICT)) {
5325 +                               NFDEBUG("Evil return from %p(%u).\n",
5326 +                                       elem->hook, hook);
5327 +                               continue;
5328 +                       }
5329  #endif
5330 +                       if (verdict != NF_REPEAT)
5331 +                               return verdict;
5332 +                       *i = (*i)->prev;
5333                 }
5334         }
5335         return NF_ACCEPT;
5336 @@ -413,6 +410,10 @@ static void nf_queue(struct sk_buff *skb
5337  {
5338         int status;
5339         struct nf_info *info;
5340 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5341 +       struct net_device *physindev = NULL;
5342 +       struct net_device *physoutdev = NULL;
5343 +#endif
5344
5345         if (!queue_handler[pf].outfn) {
5346                 kfree_skb(skb);
5347 @@ -435,36 +436,52 @@ static void nf_queue(struct sk_buff *skb
5348         if (indev) dev_hold(indev);
5349         if (outdev) dev_hold(outdev);
5350
5351 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5352 +       if (skb->nf_bridge) {
5353 +               physindev = skb->nf_bridge->physindev;
5354 +               if (physindev) dev_hold(physindev);
5355 +               physoutdev = skb->nf_bridge->physoutdev;
5356 +               if (physoutdev) dev_hold(physoutdev);
5357 +       }
5358 +#endif
5359 +
5360         status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data);
5361         if (status < 0) {
5362                 /* James M doesn't say fuck enough. */
5363                 if (indev) dev_put(indev);
5364                 if (outdev) dev_put(outdev);
5365 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5366 +               if (physindev) dev_put(physindev);
5367 +               if (physoutdev) dev_put(physoutdev);
5368 +#endif
5369                 kfree(info);
5370                 kfree_skb(skb);
5371                 return;
5372         }
5373  }
5374
5375 -int nf_hook_slow(int pf, unsigned int hook, struct sk_buff *skb,
5376 +/* Returns 1 if okfn() needs to be executed by the caller,
5377 + * -EPERM for NF_DROP, 0 otherwise. */
5378 +int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
5379                  struct net_device *indev,
5380                  struct net_device *outdev,
5381 -                int (*okfn)(struct sk_buff *))
5382 +                int (*okfn)(struct sk_buff *),
5383 +                int hook_thresh)
5384  {
5385         struct list_head *elem;
5386         unsigned int verdict;
5387         int ret = 0;
5388
5389         /* This stopgap cannot be removed until all the hooks are audited. */
5390 -       if (skb_is_nonlinear(skb) && skb_linearize(skb, GFP_ATOMIC) != 0) {
5391 -               kfree_skb(skb);
5392 +       if (skb_is_nonlinear(*pskb) && skb_linearize(*pskb, GFP_ATOMIC) != 0) {
5393 +               kfree_skb(*pskb);
5394                 return -ENOMEM;
5395         }
5396 -       if (skb->ip_summed == CHECKSUM_HW) {
5397 +       if ((*pskb)->ip_summed == CHECKSUM_HW) {
5398                 if (outdev == NULL) {
5399 -                       skb->ip_summed = CHECKSUM_NONE;
5400 +                       (*pskb)->ip_summed = CHECKSUM_NONE;
5401                 } else {
5402 -                       skb_checksum_help(skb);
5403 +                       skb_checksum_help(*pskb);
5404                 }
5405         }
5406
5407 @@ -472,30 +489,24 @@ int nf_hook_slow(int pf, unsigned int ho
5408         br_read_lock_bh(BR_NETPROTO_LOCK);
5409
5410  #ifdef CONFIG_NETFILTER_DEBUG
5411 -       if (skb->nf_debug & (1 << hook)) {
5412 +       if (unlikely((*pskb)->nf_debug & (1 << hook))) {
5413                 printk("nf_hook: hook %i already set.\n", hook);
5414 -               nf_dump_skb(pf, skb);
5415 +               nf_dump_skb(pf, *pskb);
5416         }
5417 -       skb->nf_debug |= (1 << hook);
5418 +       (*pskb)->nf_debug |= (1 << hook);
5419  #endif
5420
5421         elem = &nf_hooks[pf][hook];
5422 -       verdict = nf_iterate(&nf_hooks[pf][hook], &skb, hook, indev,
5423 -                            outdev, &elem, okfn);
5424 -       if (verdict == NF_QUEUE) {
5425 -               NFDEBUG("nf_hook: Verdict = QUEUE.\n");
5426 -               nf_queue(skb, elem, pf, hook, indev, outdev, okfn);
5427 -       }
5428 -
5429 -       switch (verdict) {
5430 -       case NF_ACCEPT:
5431 -               ret = okfn(skb);
5432 -               break;
5433 -
5434 -       case NF_DROP:
5435 -               kfree_skb(skb);
5436 +       verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
5437 +                            outdev, &elem, okfn, hook_thresh);
5438 +       if (verdict == NF_ACCEPT || verdict == NF_STOP)
5439 +               ret = 1;
5440 +       else if (verdict == NF_DROP) {
5441 +               kfree_skb(*pskb);
5442                 ret = -EPERM;
5443 -               break;
5444 +       } else if (verdict == NF_QUEUE) {
5445 +               NFDEBUG("nf_hook: Verdict = QUEUE.\n");
5446 +               nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn);
5447         }
5448
5449         br_read_unlock_bh(BR_NETPROTO_LOCK);
5450 @@ -510,6 +521,14 @@ void nf_reinject(struct sk_buff *skb, st
5451
5452         /* We don't have BR_NETPROTO_LOCK here */
5453         br_read_lock_bh(BR_NETPROTO_LOCK);
5454 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5455 +       if (skb->nf_bridge) {
5456 +               if (skb->nf_bridge->physindev)
5457 +                       dev_put(skb->nf_bridge->physindev);
5458 +               if (skb->nf_bridge->physoutdev)
5459 +                       dev_put(skb->nf_bridge->physoutdev);
5460 +       }
5461 +#endif
5462         for (i = nf_hooks[info->pf][info->hook].next; i != elem; i = i->next) {
5463                 if (i == &nf_hooks[info->pf][info->hook]) {
5464                         /* The module which sent it to userspace is gone. */
5465 @@ -530,7 +549,7 @@ void nf_reinject(struct sk_buff *skb, st
5466                 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
5467                                      &skb, info->hook,
5468                                      info->indev, info->outdev, &elem,
5469 -                                    info->okfn);
5470 +                                    info->okfn, INT_MIN);
5471         }
5472
5473         switch (verdict) {
5474 --- linux-2.4.29/net/core/skbuff.c      2003-08-25 13:44:44.000000000 +0200
5475 +++ linux-2.4.29-ebt-brnf/net/core/skbuff.c     2005-03-14 00:00:30.000000000 +0100
5476 @@ -246,6 +246,9 @@ static inline void skb_headerinit(void *
5477  #ifdef CONFIG_NETFILTER_DEBUG
5478         skb->nf_debug = 0;
5479  #endif
5480 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5481 +       skb->nf_bridge    = NULL;
5482 +#endif
5483  #endif
5484  #ifdef CONFIG_NET_SCHED
5485         skb->tc_index = 0;
5486 @@ -326,6 +329,9 @@ void __kfree_skb(struct sk_buff *skb)
5487         }
5488  #ifdef CONFIG_NETFILTER
5489         nf_conntrack_put(skb->nfct);
5490 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5491 +       nf_bridge_put(skb->nf_bridge);
5492 +#endif
5493  #endif
5494         skb_headerinit(skb, NULL, 0);  /* clean state */
5495         kfree_skbmem(skb);
5496 @@ -393,6 +399,9 @@ struct sk_buff *skb_clone(struct sk_buff
5497  #ifdef CONFIG_NETFILTER_DEBUG
5498         C(nf_debug);
5499  #endif
5500 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5501 +       C(nf_bridge);
5502 +#endif
5503  #endif /*CONFIG_NETFILTER*/
5504  #if defined(CONFIG_HIPPI)
5505         C(private);
5506 @@ -405,6 +414,9 @@ struct sk_buff *skb_clone(struct sk_buff
5507         skb->cloned = 1;
5508  #ifdef CONFIG_NETFILTER
5509         nf_conntrack_get(skb->nfct);
5510 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5511 +       nf_bridge_get(skb->nf_bridge);
5512 +#endif
5513  #endif
5514         return n;
5515  }
5516 @@ -440,6 +452,10 @@ static void copy_skb_header(struct sk_bu
5517  #ifdef CONFIG_NETFILTER_DEBUG
5518         new->nf_debug=old->nf_debug;
5519  #endif
5520 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5521 +       new->nf_bridge=old->nf_bridge;
5522 +       nf_bridge_get(new->nf_bridge);
5523 +#endif
5524  #endif
5525  #ifdef CONFIG_NET_SCHED
5526         new->tc_index = old->tc_index;
5527 @@ -726,9 +742,9 @@ struct sk_buff *skb_copy_expand(const st
5528         /* Set the tail pointer and length */
5529         skb_put(n,skb->len);
5530
5531 -       /* Copy the data only. */
5532 -       if (skb_copy_bits(skb, 0, n->data, skb->len))
5533 -               BUG();
5534 +       /* Copy the linear data and header. */
5535 +       if (skb_copy_bits(skb, -newheadroom, n->head, newheadroom + skb->len))
5536 +                BUG();
5537
5538         copy_skb_header(n, skb);
5539         return n;
5540 --- linux-2.4.29/net/ipv4/netfilter/ip_tables.c 2005-01-19 15:10:13.000000000 +0100
5541 +++ linux-2.4.29-ebt-brnf/net/ipv4/netfilter/ip_tables.c        2005-03-14 00:00:30.000000000 +0100
5542 @@ -118,12 +118,19 @@ static LIST_HEAD(ipt_tables);
5543  static inline int
5544  ip_packet_match(const struct iphdr *ip,
5545                 const char *indev,
5546 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5547 +               const char *physindev,
5548 +#endif
5549                 const char *outdev,
5550 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5551 +               const char *physoutdev,
5552 +#endif
5553                 const struct ipt_ip *ipinfo,
5554                 int isfrag)
5555  {
5556         size_t i;
5557         unsigned long ret;
5558 +       unsigned long ret2 = 1;
5559
5560  #define FWINV(bool,invflg) ((bool) ^ !!(ipinfo->invflags & invflg))
5561
5562 @@ -153,7 +160,15 @@ ip_packet_match(const struct iphdr *ip,
5563                         & ((const unsigned long *)ipinfo->iniface_mask)[i];
5564         }
5565
5566 -       if (FWINV(ret != 0, IPT_INV_VIA_IN)) {
5567 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5568 +       for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5569 +               ret2 |= (((const unsigned long *)physindev)[i]
5570 +                       ^ ((const unsigned long *)ipinfo->iniface)[i])
5571 +                       & ((const unsigned long *)ipinfo->iniface_mask)[i];
5572 +       }
5573 +#endif
5574 +
5575 +       if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_IN)) {
5576                 dprintf("VIA in mismatch (%s vs %s).%s\n",
5577                         indev, ipinfo->iniface,
5578                         ipinfo->invflags&IPT_INV_VIA_IN ?" (INV)":"");
5579 @@ -166,7 +181,15 @@ ip_packet_match(const struct iphdr *ip,
5580                         & ((const unsigned long *)ipinfo->outiface_mask)[i];
5581         }
5582
5583 -       if (FWINV(ret != 0, IPT_INV_VIA_OUT)) {
5584 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5585 +       for (i = 0, ret2 = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
5586 +               ret2 |= (((const unsigned long *)physoutdev)[i]
5587 +                       ^ ((const unsigned long *)ipinfo->outiface)[i])
5588 +                       & ((const unsigned long *)ipinfo->outiface_mask)[i];
5589 +       }
5590 +#endif
5591 +
5592 +       if (FWINV(ret != 0 && ret2 != 0, IPT_INV_VIA_OUT)) {
5593                 dprintf("VIA out mismatch (%s vs %s).%s\n",
5594                         outdev, ipinfo->outiface,
5595                         ipinfo->invflags&IPT_INV_VIA_OUT ?" (INV)":"");
5596 @@ -265,6 +288,9 @@ ipt_do_table(struct sk_buff **pskb,
5597         /* Initializing verdict to NF_DROP keeps gcc happy. */
5598         unsigned int verdict = NF_DROP;
5599         const char *indev, *outdev;
5600 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5601 +       const char *physindev, *physoutdev;
5602 +#endif
5603         void *table_base;
5604         struct ipt_entry *e, *back;
5605
5606 @@ -274,6 +300,13 @@ ipt_do_table(struct sk_buff **pskb,
5607         datalen = (*pskb)->len - ip->ihl * 4;
5608         indev = in ? in->name : nulldevname;
5609         outdev = out ? out->name : nulldevname;
5610 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5611 +       physindev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physindev) ?
5612 +               (*pskb)->nf_bridge->physindev->name : nulldevname;
5613 +       physoutdev = ((*pskb)->nf_bridge && (*pskb)->nf_bridge->physoutdev) ?
5614 +               (*pskb)->nf_bridge->physoutdev->name : nulldevname;
5615 +#endif
5616 +
5617         /* We handle fragments by dealing with the first fragment as
5618          * if it was a normal packet.  All other fragments are treated
5619          * normally, except that they will NEVER match rules that ask
5620 @@ -309,7 +342,15 @@ ipt_do_table(struct sk_buff **pskb,
5621                 IP_NF_ASSERT(e);
5622                 IP_NF_ASSERT(back);
5623                 (*pskb)->nfcache |= e->nfcache;
5624 -               if (ip_packet_match(ip, indev, outdev, &e->ip, offset)) {
5625 +               if (ip_packet_match(ip, indev,
5626 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5627 +                   physindev,
5628 +#endif
5629 +                   outdev,
5630 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5631 +                   physoutdev,
5632 +#endif
5633 +                   &e->ip, offset)) {
5634                         struct ipt_entry_target *t;
5635
5636                         if (IPT_MATCH_ITERATE(e, do_match,
5637 --- linux-2.4.29/net/ipv4/ip_output.c   2005-01-19 15:10:13.000000000 +0100
5638 +++ linux-2.4.29-ebt-brnf/net/ipv4/ip_output.c  2005-03-14 00:00:30.000000000 +0100
5639 @@ -890,6 +890,10 @@ int ip_fragment(struct sk_buff *skb, int
5640                 /* Connection association is same as pre-frag packet */
5641                 skb2->nfct = skb->nfct;
5642                 nf_conntrack_get(skb2->nfct);
5643 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5644 +               skb2->nf_bridge = skb->nf_bridge;
5645 +               nf_bridge_get(skb2->nf_bridge);
5646 +#endif
5647  #ifdef CONFIG_NETFILTER_DEBUG
5648                 skb2->nf_debug = skb->nf_debug;
5649  #endif
5650 --- linux-2.4.29/net/ipv4/netfilter/ipt_LOG.c   2003-11-28 19:26:21.000000000 +0100
5651 +++ linux-2.4.29-ebt-brnf/net/ipv4/netfilter/ipt_LOG.c  2005-03-14 00:00:30.000000000 +0100
5652 @@ -316,6 +316,18 @@ ipt_log_target(struct sk_buff **pskb,
5653                loginfo->prefix,
5654                in ? in->name : "",
5655                out ? out->name : "");
5656 +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
5657 +       if ((*pskb)->nf_bridge) {
5658 +               struct net_device *physindev = (*pskb)->nf_bridge->physindev;
5659 +               struct net_device *physoutdev = (*pskb)->nf_bridge->physoutdev;
5660 +
5661 +               if (physindev && in != physindev)
5662 +                       printk("PHYSIN=%s ", physindev->name);
5663 +               if (physoutdev && out != physoutdev)
5664 +                       printk("PHYSOUT=%s ", physoutdev->name);
5665 +       }
5666 +#endif
5667 +
5668         if (in && !out) {
5669                 /* MAC logging for input chain only. */
5670                 printk("MAC=");
5671 --- linux-2.4.29/net/ipv4/netfilter/Makefile    2003-08-25 13:44:44.000000000 +0200
5672 +++ linux-2.4.29-ebt-brnf/net/ipv4/netfilter/Makefile   2005-03-14 00:00:30.000000000 +0100
5673 @@ -87,6 +87,8 @@ obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += i
5674  obj-$(CONFIG_IP_NF_MATCH_UNCLEAN) += ipt_unclean.o
5675  obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
5676
5677 +obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
5678 +
5679  # targets
5680  obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
5681  obj-$(CONFIG_IP_NF_TARGET_MIRROR) += ipt_MIRROR.o
5682 --- linux-2.4.29/net/ipv4/netfilter/Config.in   2005-01-19 15:10:13.000000000 +0100
5683 +++ linux-2.4.29-ebt-brnf/net/ipv4/netfilter/Config.in  2005-03-14 00:00:30.000000000 +0100
5684 @@ -44,6 +44,9 @@ if [ "$CONFIG_IP_NF_IPTABLES" != "n" ];
5685      dep_tristate '  Unclean match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_UNCLEAN $CONFIG_IP_NF_IPTABLES
5686      dep_tristate '  Owner match support (EXPERIMENTAL)' CONFIG_IP_NF_MATCH_OWNER $CONFIG_IP_NF_IPTABLES
5687    fi
5688 +  if [ "$CONFIG_BRIDGE" != "n" ]; then
5689 +    dep_tristate '  Physdev match support' CONFIG_IP_NF_MATCH_PHYSDEV $CONFIG_IP_NF_IPTABLES
5690 +  fi
5691  # The targets
5692    dep_tristate '  Packet filtering' CONFIG_IP_NF_FILTER $CONFIG_IP_NF_IPTABLES
5693    if [ "$CONFIG_IP_NF_FILTER" != "n" ]; then
5694 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
5695 +++ linux-2.4.29-ebt-brnf/net/bridge/br_netfilter.c     2005-03-14 00:00:30.000000000 +0100
5696 @@ -0,0 +1,1101 @@
5697 +/*
5698 + *     Handle firewalling
5699 + *     Linux ethernet bridge
5700 + *
5701 + *     Authors:
5702 + *     Lennert Buytenhek               <buytenh@gnu.org>
5703 + *     Bart De Schuymer (maintainer)   <bdschuym@pandora.be>
5704 + *
5705 + *     Changes:
5706 + *     Apr 29 2003: physdev module support (bdschuym)
5707 + *     Jun 19 2003: let arptables see bridged ARP traffic (bdschuym)
5708 + *     Oct 06 2003: filter encapsulated IP/ARP VLAN traffic on untagged bridge
5709 + *                  (bdschuym)
5710 + *     Aug 28 2004: add IPv6 filtering (bdschuym)
5711 + *
5712 + *     This program is free software; you can redistribute it and/or
5713 + *     modify it under the terms of the GNU General Public License
5714 + *     as published by the Free Software Foundation; either version
5715 + *     2 of the License, or (at your option) any later version.
5716 + *
5717 + *     Lennert dedicates this file to Kerstin Wurdinger.
5718 + */
5719 +
5720 +#include <linux/module.h>
5721 +#include <linux/kernel.h>
5722 +#include <linux/ip.h>
5723 +#include <linux/netdevice.h>
5724 +#include <linux/skbuff.h>
5725 +#include <linux/if_ether.h>
5726 +#include <linux/if_vlan.h>
5727 +#include <linux/netfilter_bridge.h>
5728 +#include <linux/netfilter_ipv4.h>
5729 +#include <linux/netfilter_ipv6.h>
5730 +#include <linux/in_route.h>
5731 +#include <net/ip.h>
5732 +#include <net/ipv6.h>
5733 +#include <asm/uaccess.h>
5734 +#include <asm/checksum.h>
5735 +#include "br_private.h"
5736 +#ifdef CONFIG_SYSCTL
5737 +#include <linux/sysctl.h>
5738 +#endif
5739 +
5740 +#define skb_origaddr(skb)       (((struct bridge_skb_cb *) \
5741 +                                (skb->nf_bridge->data))->daddr.ipv4)
5742 +#define store_orig_dstaddr(skb)         (skb_origaddr(skb) = (skb)->nh.iph->daddr)
5743 +#define dnat_took_place(skb)    (skb_origaddr(skb) != (skb)->nh.iph->daddr)
5744 +
5745 +#define has_bridge_parent(device)      ((device)->br_port != NULL)
5746 +#define bridge_parent(device)          (&((device)->br_port->br->dev))
5747 +
5748 +#ifdef CONFIG_SYSCTL
5749 +static struct ctl_table_header *brnf_sysctl_header;
5750 +static int brnf_call_iptables = 1;
5751 +static int brnf_call_ip6tables = 1;
5752 +static int brnf_call_arptables = 1;
5753 +static int brnf_filter_vlan_tagged = 1;
5754 +#else
5755 +#define brnf_filter_vlan_tagged 1
5756 +#endif
5757 +
5758 +#define IS_VLAN_IP (skb->protocol == __constant_htons(ETH_P_8021Q) &&    \
5759 +       hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_IP) &&  \
5760 +       brnf_filter_vlan_tagged)
5761 +#define IS_VLAN_IPV6 (skb->protocol == __constant_htons(ETH_P_8021Q) &&    \
5762 +       hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_IPV6) &&  \
5763 +       brnf_filter_vlan_tagged)
5764 +/*
5765 +#define IS_VLAN_ARP (skb->protocol == __constant_htons(ETH_P_8021Q) &&   \
5766 +       hdr->h_vlan_encapsulated_proto == __constant_htons(ETH_P_ARP) && \
5767 +       brnf_filter_vlan_tagged)
5768 +*/
5769 +
5770 +/* We need these fake structures to make netfilter happy --
5771 + * lots of places assume that skb->dst != NULL, which isn't
5772 + * all that unreasonable.
5773 + *
5774 + * Currently, we fill in the PMTU entry because netfilter
5775 + * refragmentation needs it, and the rt_flags entry because
5776 + * ipt_REJECT needs it.  Future netfilter modules might
5777 + * require us to fill additional fields.
5778 + */
5779 +static struct net_device __fake_net_device = {
5780 +       .hard_header_len        = ETH_HLEN
5781 +};
5782 +
5783 +static struct rtable __fake_rtable = {
5784 +       u: {
5785 +               dst: {
5786 +                       __refcnt:               ATOMIC_INIT(1),
5787 +                       dev:                    &__fake_net_device,
5788 +                       pmtu:                   1500
5789 +               }
5790 +       },
5791 +
5792 +       rt_flags:       0
5793 +};
5794 +
5795 +
5796 +/* PF_BRIDGE/PRE_ROUTING *********************************************/
5797 +/* Undo the changes made for ip6tables PREROUTING and continue the
5798 + * bridge PRE_ROUTING hook. */
5799 +static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
5800 +{
5801 +       struct nf_bridge_info *nf_bridge = skb->nf_bridge;
5802 +
5803 +#ifdef CONFIG_NETFILTER_DEBUG
5804 +       skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
5805 +#endif
5806 +
5807 +       if (nf_bridge->mask & BRNF_PKT_TYPE) {
5808 +               skb->pkt_type = PACKET_OTHERHOST;
5809 +               nf_bridge->mask ^= BRNF_PKT_TYPE;
5810 +       }
5811 +       nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
5812 +
5813 +       skb->dst = (struct dst_entry *)&__fake_rtable;
5814 +       dst_hold(skb->dst);
5815 +
5816 +       skb->dev = nf_bridge->physindev;
5817 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
5818 +               skb_push(skb, VLAN_HLEN);
5819 +               skb->nh.raw -= VLAN_HLEN;
5820 +       }
5821 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
5822 +                      br_handle_frame_finish, 1);
5823 +
5824 +       return 0;
5825 +}
5826 +
5827 +static void __br_dnat_complain(void)
5828 +{
5829 +       static unsigned long last_complaint;
5830 +
5831 +       if (jiffies - last_complaint >= 5 * HZ) {
5832 +               printk(KERN_WARNING "Performing cross-bridge DNAT requires IP "
5833 +                       "forwarding to be enabled\n");
5834 +               last_complaint = jiffies;
5835 +       }
5836 +}
5837 +
5838 +
5839 +/* This requires some explaining. If DNAT has taken place,
5840 + * we will need to fix up the destination Ethernet address,
5841 + * and this is a tricky process.
5842 + *
5843 + * There are two cases to consider:
5844 + * 1. The packet was DNAT'ed to a device in the same bridge
5845 + *    port group as it was received on. We can still bridge
5846 + *    the packet.
5847 + * 2. The packet was DNAT'ed to a different device, either
5848 + *    a non-bridged device or another bridge port group.
5849 + *    The packet will need to be routed.
5850 + *
5851 + * The correct way of distinguishing between these two cases is to
5852 + * call ip_route_input() and to look at skb->dst->dev, which is
5853 + * changed to the destination device if ip_route_input() succeeds.
5854 + *
5855 + * Let us first consider the case that ip_route_input() succeeds:
5856 + *
5857 + * If skb->dst->dev equals the logical bridge device the packet
5858 + * came in on, we can consider this bridging. We then call
5859 + * skb->dst->output() which will make the packet enter br_nf_local_out()
5860 + * not much later. In that function it is assured that the iptables
5861 + * FORWARD chain is traversed for the packet.
5862 + *
5863 + * Otherwise, the packet is considered to be routed and we just
5864 + * change the destination MAC address so that the packet will
5865 + * later be passed up to the IP stack to be routed.
5866 + *
5867 + * Let us now consider the case that ip_route_input() fails:
5868 + *
5869 + * After a "echo '0' > /proc/sys/net/ipv4/ip_forward" ip_route_input()
5870 + * will fail, while __ip_route_output_key() will return success. The source
5871 + * address for __ip_route_output_key() is set to zero, so __ip_route_output_key
5872 + * thinks we're handling a locally generated packet and won't care
5873 + * if IP forwarding is allowed. We send a warning message to the users's
5874 + * log telling her to put IP forwarding on.
5875 + *
5876 + * ip_route_input() will also fail if there is no route available.
5877 + * In that case we just drop the packet.
5878 + *
5879 + * --Lennert, 20020411
5880 + * --Bart, 20020416 (updated)
5881 + * --Bart, 20021007 (updated)
5882 + */
5883 +
5884 +static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
5885 +{
5886 +#ifdef CONFIG_NETFILTER_DEBUG
5887 +       skb->nf_debug |= (1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_FORWARD);
5888 +#endif
5889 +
5890 +       if (skb->pkt_type == PACKET_OTHERHOST) {
5891 +               skb->pkt_type = PACKET_HOST;
5892 +               skb->nf_bridge->mask |= BRNF_PKT_TYPE;
5893 +       }
5894 +       skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
5895 +
5896 +       skb->dev = bridge_parent(skb->dev);
5897 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
5898 +               skb_pull(skb, VLAN_HLEN);
5899 +               skb->nh.raw += VLAN_HLEN;
5900 +       }
5901 +       skb->dst->output(skb);
5902 +       return 0;
5903 +}
5904 +
5905 +static int br_nf_pre_routing_finish(struct sk_buff *skb)
5906 +{
5907 +       struct net_device *dev = skb->dev;
5908 +       struct iphdr *iph = skb->nh.iph;
5909 +       struct nf_bridge_info *nf_bridge = skb->nf_bridge;
5910 +
5911 +#ifdef CONFIG_NETFILTER_DEBUG
5912 +       skb->nf_debug ^= (1 << NF_BR_PRE_ROUTING);
5913 +#endif
5914 +
5915 +       if (nf_bridge->mask & BRNF_PKT_TYPE) {
5916 +               skb->pkt_type = PACKET_OTHERHOST;
5917 +               nf_bridge->mask ^= BRNF_PKT_TYPE;
5918 +       }
5919 +       nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
5920 +
5921 +       if (dnat_took_place(skb)) {
5922 +               if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
5923 +                   dev)) {
5924 +                       struct rtable *rt;
5925 +
5926 +                       if (!ip_route_output(&rt, iph->daddr, 0, iph->tos, 0)) {
5927 +                               /* Bridged-and-DNAT'ed traffic doesn't
5928 +                                * require ip_forwarding.
5929 +                                */
5930 +                               if (((struct dst_entry *)rt)->dev == dev) {
5931 +                                       skb->dst = (struct dst_entry *)rt;
5932 +                                       goto bridged_dnat;
5933 +                               }
5934 +                               __br_dnat_complain();
5935 +                               dst_release((struct dst_entry *)rt);
5936 +                       }
5937 +                       kfree_skb(skb);
5938 +                       return 0;
5939 +               } else {
5940 +                       if (skb->dst->dev == dev) {
5941 +bridged_dnat:
5942 +                               /* Tell br_nf_local_out this is a
5943 +                                * bridged frame
5944 +                                */
5945 +                               nf_bridge->mask |= BRNF_BRIDGED_DNAT;
5946 +                               skb->dev = nf_bridge->physindev;
5947 +                               if (skb->protocol ==
5948 +                                   __constant_htons(ETH_P_8021Q)) {
5949 +                                       skb_push(skb, VLAN_HLEN);
5950 +                                       skb->nh.raw -= VLAN_HLEN;
5951 +                               }
5952 +                               NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING,
5953 +                                              skb, skb->dev, NULL,
5954 +                                              br_nf_pre_routing_finish_bridge,
5955 +                                              1);
5956 +                               return 0;
5957 +                       }
5958 +                       memcpy(skb->mac.ethernet->h_dest, dev->dev_addr,
5959 +                              ETH_ALEN);
5960 +                       skb->pkt_type = PACKET_HOST;
5961 +               }
5962 +       } else {
5963 +               skb->dst = (struct dst_entry *)&__fake_rtable;
5964 +               dst_hold(skb->dst);
5965 +       }
5966 +
5967 +       skb->dev = nf_bridge->physindev;
5968 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
5969 +               skb_push(skb, VLAN_HLEN);
5970 +               skb->nh.raw -= VLAN_HLEN;
5971 +       }
5972 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
5973 +                      br_handle_frame_finish, 1);
5974 +
5975 +       return 0;
5976 +}
5977 +
5978 +/* Some common code for IPv4/IPv6 */
5979 +static void setup_pre_routing(struct sk_buff *skb)
5980 +{
5981 +       struct nf_bridge_info *nf_bridge = skb->nf_bridge;
5982 +
5983 +       if (skb->pkt_type == PACKET_OTHERHOST) {
5984 +               skb->pkt_type = PACKET_HOST;
5985 +               nf_bridge->mask |= BRNF_PKT_TYPE;
5986 +       }
5987 +
5988 +       nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
5989 +       nf_bridge->physindev = skb->dev;
5990 +       skb->dev = bridge_parent(skb->dev);
5991 +}
5992 +
5993 +/* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */
5994 +static int check_hbh_len(struct sk_buff *skb)
5995 +{
5996 +       unsigned char *raw = (u8*)(skb->nh.ipv6h+1);
5997 +       u32 pkt_len;
5998 +       int off = raw - skb->nh.raw;
5999 +       int len = (raw[1]+1)<<3;
6000 +
6001 +       if ((raw + len) - skb->data > skb_headlen(skb))
6002 +               goto bad;
6003 +
6004 +       off += 2;
6005 +       len -= 2;
6006 +
6007 +       while (len > 0) {
6008 +               int optlen = raw[off+1]+2;
6009 +
6010 +               switch (skb->nh.raw[off]) {
6011 +               case IPV6_TLV_PAD0:
6012 +                       optlen = 1;
6013 +                       break;
6014 +
6015 +               case IPV6_TLV_PADN:
6016 +                       break;
6017 +
6018 +               case IPV6_TLV_JUMBO:
6019 +                       if (skb->nh.raw[off+1] != 4 || (off&3) != 2)
6020 +                               goto bad;
6021 +
6022 +                       pkt_len = ntohl(*(u32*)(skb->nh.raw+off+2));
6023 +
6024 +                       if (pkt_len > skb->len - sizeof(struct ipv6hdr))
6025 +                               goto bad;
6026 +                       if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
6027 +                               if (__pskb_trim(skb,
6028 +                                   pkt_len + sizeof(struct ipv6hdr)))
6029 +                                       goto bad;
6030 +                               if (skb->ip_summed == CHECKSUM_HW)
6031 +                                       skb->ip_summed = CHECKSUM_NONE;
6032 +                       }
6033 +                       break;
6034 +               default:
6035 +                       if (optlen > len)
6036 +                               goto bad;
6037 +                       break;
6038 +               }
6039 +               off += optlen;
6040 +               len -= optlen;
6041 +       }
6042 +       if (len == 0)
6043 +               return 0;
6044 +bad:
6045 +       return -1;
6046 +
6047 +}
6048 +
6049 +/* Replicate the checks that IPv6 does on packet reception and pass the packet
6050 + * to ip6tables, which doesn't support NAT, so things are fairly simple. */
6051 +static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
6052 +   struct sk_buff *skb, const struct net_device *in,
6053 +   const struct net_device *out, int (*okfn)(struct sk_buff *))
6054 +{
6055 +       struct ipv6hdr *hdr;
6056 +       u32 pkt_len;
6057 +       struct nf_bridge_info *nf_bridge;
6058 +
6059 +       if (skb->len < sizeof(struct ipv6hdr))
6060 +               goto inhdr_error;
6061 +
6062 +       if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
6063 +               goto inhdr_error;
6064 +
6065 +       hdr = skb->nh.ipv6h;
6066 +
6067 +       if (hdr->version != 6)
6068 +               goto inhdr_error;
6069 +
6070 +       pkt_len = ntohs(hdr->payload_len);
6071 +
6072 +       if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
6073 +               if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
6074 +                       goto inhdr_error;
6075 +               if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
6076 +                       if (__pskb_trim(skb, pkt_len + sizeof(struct ipv6hdr)))
6077 +                               goto inhdr_error;
6078 +                       if (skb->ip_summed == CHECKSUM_HW)
6079 +                               skb->ip_summed = CHECKSUM_NONE;
6080 +               }
6081 +       }
6082 +       if (hdr->nexthdr == NEXTHDR_HOP && check_hbh_len(skb))
6083 +               goto inhdr_error;
6084 +
6085 +#ifdef CONFIG_NETFILTER_DEBUG
6086 +       skb->nf_debug ^= (1 << NF_IP6_PRE_ROUTING);
6087 +#endif
6088 +       if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
6089 +               return NF_DROP;
6090 +       setup_pre_routing(skb);
6091 +
6092 +       NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
6093 +               br_nf_pre_routing_finish_ipv6);
6094 +
6095 +       return NF_STOLEN;
6096 +
6097 +inhdr_error:
6098 +       return NF_DROP;
6099 +}
6100 +
6101 +/* Direct IPv6 traffic to br_nf_pre_routing_ipv6.
6102 + * Replicate the checks that IPv4 does on packet reception.
6103 + * Set skb->dev to the bridge device (i.e. parent of the
6104 + * receiving device) to make netfilter happy, the REDIRECT
6105 + * target in particular.  Save the original destination IP
6106 + * address to be able to detect DNAT afterwards.
6107 + */
6108 +static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
6109 +   const struct net_device *in, const struct net_device *out,
6110 +   int (*okfn)(struct sk_buff *))
6111 +{
6112 +       struct iphdr *iph;
6113 +       __u32 len;
6114 +       struct sk_buff *skb = *pskb;
6115 +       struct nf_bridge_info *nf_bridge;
6116 +       struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)
6117 +                                  ((*pskb)->mac.ethernet);
6118 +
6119 +       if (skb->protocol == __constant_htons(ETH_P_IPV6) || IS_VLAN_IPV6) {
6120 +#ifdef CONFIG_SYSCTL
6121 +               if (!brnf_call_ip6tables)
6122 +                       return NF_ACCEPT;
6123 +#endif
6124 +               if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
6125 +                       goto out;
6126 +
6127 +               if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6128 +                       skb_pull(skb, VLAN_HLEN);
6129 +                       (skb)->nh.raw += VLAN_HLEN;
6130 +               }
6131 +               return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
6132 +       }
6133 +
6134 +#ifdef CONFIG_SYSCTL
6135 +       if (!brnf_call_iptables)
6136 +               return NF_ACCEPT;
6137 +#endif
6138 +
6139 +       if (skb->protocol != __constant_htons(ETH_P_IP) && !IS_VLAN_IP)
6140 +               return NF_ACCEPT;
6141 +       if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
6142 +               goto out;
6143 +
6144 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6145 +               skb_pull(skb, VLAN_HLEN);
6146 +               (skb)->nh.raw += VLAN_HLEN;
6147 +       }
6148 +
6149 +       if (!pskb_may_pull(skb, sizeof(struct iphdr)))
6150 +               goto inhdr_error;
6151 +
6152 +       iph = skb->nh.iph;
6153 +       if (iph->ihl < 5 || iph->version != 4)
6154 +               goto inhdr_error;
6155 +
6156 +       if (!pskb_may_pull(skb, 4*iph->ihl))
6157 +               goto inhdr_error;
6158 +
6159 +       iph = skb->nh.iph;
6160 +       if (ip_fast_csum((__u8 *)iph, iph->ihl) != 0)
6161 +               goto inhdr_error;
6162 +
6163 +       len = ntohs(iph->tot_len);
6164 +       if (skb->len < len || len < 4*iph->ihl)
6165 +               goto inhdr_error;
6166 +
6167 +       if (skb->len > len) {
6168 +               __pskb_trim(skb, len);
6169 +               if (skb->ip_summed == CHECKSUM_HW)
6170 +                       skb->ip_summed = CHECKSUM_NONE;
6171 +       }
6172 +
6173 +#ifdef CONFIG_NETFILTER_DEBUG
6174 +       skb->nf_debug ^= (1 << NF_IP_PRE_ROUTING);
6175 +#endif
6176 +       if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
6177 +               return NF_DROP;
6178 +
6179 +       setup_pre_routing(skb);
6180 +       store_orig_dstaddr(skb);
6181 +
6182 +       NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
6183 +               br_nf_pre_routing_finish);
6184 +
6185 +       return NF_STOLEN;
6186 +
6187 +inhdr_error:
6188 +//     IP_INC_STATS_BH(IpInHdrErrors);
6189 +out:
6190 +       return NF_DROP;
6191 +}
6192 +
6193 +
6194 +/* PF_BRIDGE/LOCAL_IN ************************************************/
6195 +/* The packet is locally destined, which requires a real
6196 + * dst_entry, so detach the fake one.  On the way up, the
6197 + * packet would pass through PRE_ROUTING again (which already
6198 + * took place when the packet entered the bridge), but we
6199 + * register an IPv4 PRE_ROUTING 'sabotage' hook that will
6200 + * prevent this from happening.
6201 + */
6202 +static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff **pskb,
6203 +   const struct net_device *in, const struct net_device *out,
6204 +   int (*okfn)(struct sk_buff *))
6205 +{
6206 +       struct sk_buff *skb = *pskb;
6207 +
6208 +       if (skb->dst == (struct dst_entry *)&__fake_rtable) {
6209 +               dst_release(skb->dst);
6210 +               skb->dst = NULL;
6211 +       }
6212 +
6213 +       return NF_ACCEPT;
6214 +}
6215 +
6216 +/* PF_BRIDGE/FORWARD *************************************************/
6217 +static int br_nf_forward_finish(struct sk_buff *skb)
6218 +{
6219 +       struct nf_bridge_info *nf_bridge = skb->nf_bridge;
6220 +       struct net_device *in;
6221 +/*     struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);*/
6222 +
6223 +#ifdef CONFIG_NETFILTER_DEBUG
6224 +       skb->nf_debug ^= (1 << NF_BR_FORWARD);
6225 +#endif
6226 +
6227 +/*     if (skb->protocol != __constant_htons(ETH_P_ARP) && !IS_VLAN_ARP) {*/
6228 +               in = nf_bridge->physindev;
6229 +               if (nf_bridge->mask & BRNF_PKT_TYPE) {
6230 +                       skb->pkt_type = PACKET_OTHERHOST;
6231 +                       nf_bridge->mask ^= BRNF_PKT_TYPE;
6232 +               }
6233 +/*     } else {
6234 +               in = *((struct net_device **)(skb->cb));
6235 +       }*/
6236 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6237 +               skb_push(skb, VLAN_HLEN);
6238 +               skb->nh.raw -= VLAN_HLEN;
6239 +       }
6240 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_FORWARD, skb, in,
6241 +                       skb->dev, br_forward_finish, 1);
6242 +       return 0;
6243 +}
6244 +
6245 +/* This is the 'purely bridged' case.  For IP, we pass the packet to
6246 + * netfilter with indev and outdev set to the bridge device,
6247 + * but we are still able to filter on the 'real' indev/outdev
6248 + * because of the ipt_physdev.c module. For ARP, indev and outdev are the
6249 + * bridge ports.
6250 + */
6251 +static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
6252 +   const struct net_device *in, const struct net_device *out,
6253 +   int (*okfn)(struct sk_buff *))
6254 +{
6255 +       struct sk_buff *skb = *pskb;
6256 +       struct nf_bridge_info *nf_bridge;
6257 +       struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6258 +       int pf;
6259 +
6260 +       if (!skb->nf_bridge)
6261 +               return NF_ACCEPT;
6262 +
6263 +       if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
6264 +               pf = PF_INET;
6265 +       else
6266 +               pf = PF_INET6;
6267 +
6268 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6269 +               skb_pull(*pskb, VLAN_HLEN);
6270 +               (*pskb)->nh.raw += VLAN_HLEN;
6271 +       }
6272 +
6273 +#ifdef CONFIG_NETFILTER_DEBUG
6274 +       skb->nf_debug ^= (1 << NF_BR_FORWARD);
6275 +#endif
6276 +       nf_bridge = skb->nf_bridge;
6277 +       if (skb->pkt_type == PACKET_OTHERHOST) {
6278 +               skb->pkt_type = PACKET_HOST;
6279 +               nf_bridge->mask |= BRNF_PKT_TYPE;
6280 +       }
6281 +
6282 +       /* The physdev module checks on this */
6283 +       nf_bridge->mask |= BRNF_BRIDGED;
6284 +       nf_bridge->physoutdev = skb->dev;
6285 +
6286 +       NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in),
6287 +               bridge_parent(out), br_nf_forward_finish);
6288 +
6289 +       return NF_STOLEN;
6290 +}
6291 +
6292 +/*
6293 +static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff **pskb,
6294 +   const struct net_device *in, const struct net_device *out,
6295 +   int (*okfn)(struct sk_buff *))
6296 +{
6297 +       struct sk_buff *skb = *pskb;
6298 +       struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6299 +       struct net_device **d = (struct net_device **)(skb->cb);
6300 +
6301 +       if (!brnf_call_arptables)
6302 +               return NF_ACCEPT;
6303 +
6304 +       if (skb->protocol != __constant_htons(ETH_P_ARP)) {
6305 +               if (!IS_VLAN_ARP)
6306 +                       return NF_ACCEPT;
6307 +               skb_pull(*pskb, VLAN_HLEN);
6308 +               (*pskb)->nh.raw += VLAN_HLEN;
6309 +       }
6310 +
6311 +#ifdef CONFIG_NETFILTER_DEBUG
6312 +       skb->nf_debug ^= (1 << NF_BR_FORWARD);
6313 +#endif
6314 +
6315 +       if (skb->nh.arph->ar_pln != 4) {
6316 +               if (IS_VLAN_ARP) {
6317 +                       skb_push(*pskb, VLAN_HLEN);
6318 +                       (*pskb)->nh.raw -= VLAN_HLEN;
6319 +               }
6320 +               return NF_ACCEPT;
6321 +       }
6322 +       *d = (struct net_device *)in;
6323 +       NF_HOOK(NF_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
6324 +               (struct net_device *)out, br_nf_forward_finish);
6325 +
6326 +       return NF_STOLEN;
6327 +}
6328 +*/
6329 +
6330 +/* PF_BRIDGE/LOCAL_OUT ***********************************************/
6331 +static int br_nf_local_out_finish(struct sk_buff *skb)
6332 +{
6333 +#ifdef CONFIG_NETFILTER_DEBUG
6334 +       skb->nf_debug &= ~(1 << NF_BR_LOCAL_OUT);
6335 +#endif
6336 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6337 +               skb_push(skb, VLAN_HLEN);
6338 +               skb->nh.raw -= VLAN_HLEN;
6339 +       }
6340 +
6341 +       NF_HOOK_THRESH(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
6342 +                       br_forward_finish, NF_BR_PRI_FIRST + 1);
6343 +
6344 +       return 0;
6345 +}
6346 +
6347 +
6348 +/* This function sees both locally originated IP packets and forwarded
6349 + * IP packets (in both cases the destination device is a bridge
6350 + * device). It also sees bridged-and-DNAT'ed packets.
6351 + * To be able to filter on the physical bridge devices (with the ipt_physdev.c
6352 + * module), we steal packets destined to a bridge device away from the
6353 + * PF_INET/FORWARD and PF_INET/OUTPUT hook functions, and give them back later,
6354 + * when we have determined the real output device. This is done in here.
6355 + *
6356 + * If (nf_bridge->mask & BRNF_BRIDGED_DNAT) then the packet is bridged
6357 + * and we fake the PF_BRIDGE/FORWARD hook. The function br_nf_forward()
6358 + * will then fake the PF_INET/FORWARD hook. br_nf_local_out() has priority
6359 + * NF_BR_PRI_FIRST, so no relevant PF_BRIDGE/INPUT functions have been nor
6360 + * will be executed.
6361 + * Otherwise, if nf_bridge->physindev is NULL, the bridge-nf code never touched
6362 + * this packet before, and so the packet was locally originated. We fake
6363 + * the PF_INET/LOCAL_OUT hook.
6364 + * Finally, if nf_bridge->physindev isn't NULL, then the packet was IP routed,
6365 + * so we fake the PF_INET/FORWARD hook. ipv4_sabotage_out() makes sure
6366 + * even routed packets that didn't arrive on a bridge interface have their
6367 + * nf_bridge->physindev set.
6368 + */
6369 +
6370 +static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
6371 +   const struct net_device *in, const struct net_device *out,
6372 +   int (*okfn)(struct sk_buff *))
6373 +{
6374 +       struct net_device *realindev, *realoutdev;
6375 +       struct sk_buff *skb = *pskb;
6376 +       struct nf_bridge_info *nf_bridge;
6377 +       struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6378 +       int pf;
6379 +
6380 +       if (!skb->nf_bridge)
6381 +               return NF_ACCEPT;
6382 +
6383 +       if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
6384 +               pf = PF_INET;
6385 +       else
6386 +               pf = PF_INET6;
6387 +
6388 +#ifdef CONFIG_NETFILTER_DEBUG
6389 +       /* Sometimes we get packets with NULL ->dst here (for example,
6390 +        * running a dhcp client daemon triggers this). This should now
6391 +        * be fixed, but let's keep the check around. */
6392 +       if (skb->dst == NULL) {
6393 +               printk(KERN_CRIT "br_netfilter: skb->dst == NULL.");
6394 +               return NF_ACCEPT;
6395 +       }
6396 +#endif
6397 +
6398 +       nf_bridge = skb->nf_bridge;
6399 +       nf_bridge->physoutdev = skb->dev;
6400 +       realindev = nf_bridge->physindev;
6401 +
6402 +       /* Bridged, take PF_BRIDGE/FORWARD.
6403 +        * (see big note in front of br_nf_pre_routing_finish)
6404 +        */
6405 +       if (nf_bridge->mask & BRNF_BRIDGED_DNAT) {
6406 +               if (nf_bridge->mask & BRNF_PKT_TYPE) {
6407 +                       skb->pkt_type = PACKET_OTHERHOST;
6408 +                       nf_bridge->mask ^= BRNF_PKT_TYPE;
6409 +               }
6410 +               if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6411 +                       skb_push(skb, VLAN_HLEN);
6412 +                       skb->nh.raw -= VLAN_HLEN;
6413 +               }
6414 +
6415 +               NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev,
6416 +                       skb->dev, br_forward_finish);
6417 +               goto out;
6418 +       }
6419 +       realoutdev = bridge_parent(skb->dev);
6420 +
6421 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6422 +       /* iptables should match -o br0.x */
6423 +       if (nf_bridge->netoutdev)
6424 +               realoutdev = nf_bridge->netoutdev;
6425 +#endif
6426 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6427 +               skb_pull(skb, VLAN_HLEN);
6428 +               (*pskb)->nh.raw += VLAN_HLEN;
6429 +       }
6430 +       /* IP forwarded traffic has a physindev, locally
6431 +        * generated traffic hasn't.
6432 +        */
6433 +       if (realindev != NULL) {
6434 +               if (((nf_bridge->mask & BRNF_DONT_TAKE_PARENT) == 0) &&
6435 +                   has_bridge_parent(realindev))
6436 +                       realindev = bridge_parent(realindev);
6437 +               NF_HOOK_THRESH(pf, NF_IP_FORWARD, skb, realindev,
6438 +                              realoutdev, okfn,
6439 +                              NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD + 1);
6440 +       } else {
6441 +#ifdef CONFIG_NETFILTER_DEBUG
6442 +               skb->nf_debug ^= (1 << NF_IP_LOCAL_OUT);
6443 +#endif
6444 +
6445 +               NF_HOOK_THRESH(pf, NF_IP_LOCAL_OUT, skb, realindev,
6446 +                              realoutdev, okfn,
6447 +                              NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT + 1);
6448 +       }
6449 +
6450 +out:
6451 +       return NF_STOLEN;
6452 +}
6453 +
6454 +
6455 +/* PF_BRIDGE/POST_ROUTING ********************************************/
6456 +static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
6457 +   const struct net_device *in, const struct net_device *out,
6458 +   int (*okfn)(struct sk_buff *))
6459 +{
6460 +       struct sk_buff *skb = *pskb;
6461 +       struct nf_bridge_info *nf_bridge = (*pskb)->nf_bridge;
6462 +       struct vlan_ethhdr *hdr = (struct vlan_ethhdr *)(skb->mac.ethernet);
6463 +       struct net_device *realoutdev = bridge_parent(skb->dev);
6464 +       int pf;
6465 +
6466 +#ifdef CONFIG_NETFILTER_DEBUG
6467 +       /* Be very paranoid. This probably won't happen anymore, but let's
6468 +        * keep the check just to be sure... */
6469 +       if (skb->mac.raw < skb->head || skb->mac.raw + ETH_HLEN > skb->data) {
6470 +               printk(KERN_CRIT "br_netfilter: Argh!! br_nf_post_routing: "
6471 +                                "bad mac.raw pointer.");
6472 +               goto print_error;
6473 +       }
6474 +#endif
6475 +
6476 +       if (!nf_bridge)
6477 +               return NF_ACCEPT;
6478 +
6479 +       if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
6480 +               pf = PF_INET;
6481 +       else
6482 +               pf = PF_INET6;
6483 +
6484 +       /* Sometimes we get packets with NULL ->dst here (for example,
6485 +        * running a dhcp client daemon triggers this).
6486 +        */
6487 +       if (skb->dst == NULL)
6488 +               return NF_ACCEPT;
6489 +
6490 +#ifdef CONFIG_NETFILTER_DEBUG
6491 +       /* Sometimes we get packets with NULL ->dst here (for example,
6492 +        * running a dhcp client daemon triggers this). This should now
6493 +        * be fixed, but let's keep the check around.
6494 +        */
6495 +       if (skb->dst == NULL) {
6496 +               printk(KERN_CRIT "br_netfilter: skb->dst == NULL.");
6497 +               goto print_error;
6498 +       }
6499 +
6500 +       skb->nf_debug ^= (1 << NF_IP_POST_ROUTING);
6501 +#endif
6502 +
6503 +       /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
6504 +        * about the value of skb->pkt_type.
6505 +        */
6506 +       if (skb->pkt_type == PACKET_OTHERHOST) {
6507 +               skb->pkt_type = PACKET_HOST;
6508 +               nf_bridge->mask |= BRNF_PKT_TYPE;
6509 +       }
6510 +
6511 +       if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
6512 +               skb_pull(skb, VLAN_HLEN);
6513 +               skb->nh.raw += VLAN_HLEN;
6514 +       }
6515 +
6516 +       nf_bridge_save_header(skb);
6517 +
6518 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6519 +       if (nf_bridge->netoutdev)
6520 +               realoutdev = nf_bridge->netoutdev;
6521 +#endif
6522 +       NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL,
6523 +               realoutdev, br_dev_queue_push_xmit);
6524 +
6525 +       return NF_STOLEN;
6526 +
6527 +#ifdef CONFIG_NETFILTER_DEBUG
6528 +print_error:
6529 +       if (skb->dev != NULL) {
6530 +               printk("[%s]", skb->dev->name);
6531 +               if (has_bridge_parent(skb->dev))
6532 +                       printk("[%s]", bridge_parent(skb->dev)->name);
6533 +       }
6534 +       printk(" head:%p, raw:%p, data:%p\n", skb->head, skb->mac.raw,
6535 +                                             skb->data);
6536 +       return NF_ACCEPT;
6537 +#endif
6538 +}
6539 +
6540 +
6541 +/* IPv4/SABOTAGE *****************************************************/
6542 +
6543 +/* Don't hand locally destined packets to PF_INET/PRE_ROUTING
6544 + * for the second time.
6545 + */
6546 +static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff **pskb,
6547 +   const struct net_device *in, const struct net_device *out,
6548 +   int (*okfn)(struct sk_buff *))
6549 +{
6550 +       if ((*pskb)->nf_bridge &&
6551 +           !((*pskb)->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)) {
6552 +               return NF_STOP;
6553 +       }
6554 +
6555 +       return NF_ACCEPT;
6556 +}
6557 +
6558 +/* Postpone execution of PF_INET/FORWARD, PF_INET/LOCAL_OUT
6559 + * and PF_INET/POST_ROUTING until we have done the forwarding
6560 + * decision in the bridge code and have determined skb->physoutdev.
6561 + */
6562 +static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
6563 +   const struct net_device *in, const struct net_device *out,
6564 +   int (*okfn)(struct sk_buff *))
6565 +{
6566 +       struct sk_buff *skb = *pskb;
6567 +
6568 +       if ((out->hard_start_xmit == br_dev_xmit &&
6569 +           okfn != br_nf_forward_finish &&
6570 +           okfn != br_nf_local_out_finish &&
6571 +           okfn != br_dev_queue_push_xmit)
6572 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6573 +           || ((out->priv_flags & IFF_802_1Q_VLAN) &&
6574 +           VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
6575 +#endif
6576 +           ) {
6577 +               struct nf_bridge_info *nf_bridge;
6578 +
6579 +               if (!skb->nf_bridge) {
6580 +#ifdef CONFIG_SYSCTL
6581 +                       /* This code is executed while in the IP(v6) stack,
6582 +                          the version should be 4 or 6. We can't use
6583 +                          skb->protocol because that isn't set on
6584 +                          PF_INET(6)/LOCAL_OUT. */
6585 +                       struct iphdr *ip = skb->nh.iph;
6586 +
6587 +                       if (ip->version == 4 && !brnf_call_iptables)
6588 +                               return NF_ACCEPT;
6589 +                       else if (ip->version == 6 && !brnf_call_ip6tables)
6590 +                               return NF_ACCEPT;
6591 +#endif
6592 +                       if (hook == NF_IP_POST_ROUTING)
6593 +                               return NF_ACCEPT;
6594 +                       if (!nf_bridge_alloc(skb))
6595 +                               return NF_DROP;
6596 +               }
6597 +
6598 +               nf_bridge = skb->nf_bridge;
6599 +
6600 +               /* This frame will arrive on PF_BRIDGE/LOCAL_OUT and we
6601 +                * will need the indev then. For a brouter, the real indev
6602 +                * can be a bridge port, so we make sure br_nf_local_out()
6603 +                * doesn't use the bridge parent of the indev by using
6604 +                * the BRNF_DONT_TAKE_PARENT mask.
6605 +                */
6606 +               if (hook == NF_IP_FORWARD && nf_bridge->physindev == NULL) {
6607 +                       nf_bridge->mask &= BRNF_DONT_TAKE_PARENT;
6608 +                       nf_bridge->physindev = (struct net_device *)in;
6609 +               }
6610 +#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
6611 +               /* the iptables outdev is br0.x, not br0 */
6612 +               if (out->priv_flags & IFF_802_1Q_VLAN)
6613 +                       nf_bridge->netoutdev = (struct net_device *)out;
6614 +#endif
6615 +               return NF_STOP;
6616 +       }
6617 +
6618 +       return NF_ACCEPT;
6619 +}
6620 +
6621 +/* For br_nf_local_out we need (prio = NF_BR_PRI_FIRST), to insure that innocent
6622 + * PF_BRIDGE/NF_BR_LOCAL_OUT functions don't get bridged traffic as input.
6623 + * For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
6624 + * ip_refrag() can return NF_STOLEN.
6625 + */
6626 +static struct nf_hook_ops br_nf_ops[] = {
6627 +       { .hook = br_nf_pre_routing,
6628 +         .pf = PF_BRIDGE,
6629 +         .hooknum = NF_BR_PRE_ROUTING,
6630 +         .priority = NF_BR_PRI_BRNF, },
6631 +       { .hook = br_nf_local_in,
6632 +         .pf = PF_BRIDGE,
6633 +         .hooknum = NF_BR_LOCAL_IN,
6634 +         .priority = NF_BR_PRI_BRNF, },
6635 +       { .hook = br_nf_forward_ip,
6636 +         .pf = PF_BRIDGE,
6637 +         .hooknum = NF_BR_FORWARD,
6638 +         .priority = NF_BR_PRI_BRNF /*- 1*/, },
6639 +/*     { .hook = br_nf_forward_arp,
6640 +         .pf = PF_BRIDGE,
6641 +         .hooknum = NF_BR_FORWARD,
6642 +         .priority = NF_BR_PRI_BRNF, },*/
6643 +       { .hook = br_nf_local_out,
6644 +         .pf = PF_BRIDGE,
6645 +         .hooknum = NF_BR_LOCAL_OUT,
6646 +         .priority = NF_BR_PRI_FIRST, },
6647 +       { .hook = br_nf_post_routing,
6648 +         .pf = PF_BRIDGE,
6649 +         .hooknum = NF_BR_POST_ROUTING,
6650 +         .priority = NF_BR_PRI_LAST, },
6651 +       { .hook = ip_sabotage_in,
6652 +         .pf = PF_INET,
6653 +         .hooknum = NF_IP_PRE_ROUTING,
6654 +         .priority = NF_IP_PRI_FIRST, },
6655 +       { .hook = ip_sabotage_in,
6656 +         .pf = PF_INET6,
6657 +         .hooknum = NF_IP6_PRE_ROUTING,
6658 +         .priority = NF_IP6_PRI_FIRST, },
6659 +       { .hook = ip_sabotage_out,
6660 +         .pf = PF_INET,
6661 +         .hooknum = NF_IP_FORWARD,
6662 +         .priority = NF_IP_PRI_BRIDGE_SABOTAGE_FORWARD, },
6663 +       { .hook = ip_sabotage_out,
6664 +         .pf = PF_INET6,
6665 +         .hooknum = NF_IP6_FORWARD,
6666 +         .priority = NF_IP6_PRI_BRIDGE_SABOTAGE_FORWARD, },
6667 +       { .hook = ip_sabotage_out,
6668 +         .pf = PF_INET,
6669 +         .hooknum = NF_IP_LOCAL_OUT,
6670 +         .priority = NF_IP_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
6671 +       { .hook = ip_sabotage_out,
6672 +         .pf = PF_INET6,
6673 +         .hooknum = NF_IP6_LOCAL_OUT,
6674 +         .priority = NF_IP6_PRI_BRIDGE_SABOTAGE_LOCAL_OUT, },
6675 +       { .hook = ip_sabotage_out,
6676 +         .pf = PF_INET,
6677 +         .hooknum = NF_IP_POST_ROUTING,
6678 +         .priority = NF_IP_PRI_FIRST, },
6679 +       { .hook = ip_sabotage_out,
6680 +         .pf = PF_INET6,
6681 +         .hooknum = NF_IP6_POST_ROUTING,
6682 +         .priority = NF_IP6_PRI_FIRST, },
6683 +};
6684 +
6685 +#ifdef CONFIG_SYSCTL
6686 +static
6687 +int brnf_sysctl_call_tables(ctl_table *ctl, int write, struct file * filp,
6688 +                       void *buffer, size_t *lenp)
6689 +{
6690 +       int ret;
6691 +
6692 +       ret = proc_dointvec(ctl, write, filp, buffer, lenp);
6693 +
6694 +       if (write && *(int *)(ctl->data))
6695 +               *(int *)(ctl->data) = 1;
6696 +       return ret;
6697 +}
6698 +
6699 +static ctl_table brnf_table[] = {
6700 +       {
6701 +               .ctl_name       = NET_BRIDGE_NF_CALL_ARPTABLES,
6702 +               .procname       = "bridge-nf-call-arptables",
6703 +               .data           = &brnf_call_arptables,
6704 +               .maxlen         = sizeof(int),
6705 +               .mode           = 0644,
6706 +               .proc_handler   = &brnf_sysctl_call_tables,
6707 +       },
6708 +       {
6709 +               .ctl_name       = NET_BRIDGE_NF_CALL_IPTABLES,
6710 +               .procname       = "bridge-nf-call-iptables",
6711 +               .data           = &brnf_call_iptables,
6712 +               .maxlen         = sizeof(int),
6713 +               .mode           = 0644,
6714 +               .proc_handler   = &brnf_sysctl_call_tables,
6715 +       },
6716 +       {
6717 +               .ctl_name       = NET_BRIDGE_NF_CALL_IP6TABLES,
6718 +               .procname       = "bridge-nf-call-ip6tables",
6719 +               .data           = &brnf_call_ip6tables,
6720 +               .maxlen         = sizeof(int),
6721 +               .mode           = 0644,
6722 +               .proc_handler   = &brnf_sysctl_call_tables,
6723 +       },
6724 +       {
6725 +               .ctl_name       = NET_BRIDGE_NF_FILTER_VLAN_TAGGED,
6726 +               .procname       = "bridge-nf-filter-vlan-tagged",
6727 +               .data           = &brnf_filter_vlan_tagged,
6728 +               .maxlen         = sizeof(int),
6729 +               .mode           = 0644,
6730 +               .proc_handler   = &brnf_sysctl_call_tables,
6731 +       },
6732 +       { .ctl_name = 0 }
6733 +};
6734 +
6735 +static ctl_table brnf_bridge_table[] = {
6736 +       {
6737 +               .ctl_name       = NET_BRIDGE,
6738 +               .procname       = "bridge",
6739 +               .mode           = 0555,
6740 +               .child          = brnf_table,
6741 +       },
6742 +       { .ctl_name = 0 }
6743 +};
6744 +
6745 +static ctl_table brnf_net_table[] = {
6746 +       {
6747 +               .ctl_name       = CTL_NET,
6748 +               .procname       = "net",
6749 +               .mode           = 0555,
6750 +               .child          = brnf_bridge_table,
6751 +       },
6752 +       { .ctl_name = 0 }
6753 +};
6754 +#endif
6755 +
6756 +int br_netfilter_init(void)
6757 +{
6758 +       int i;
6759 +
6760 +       for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++) {
6761 +               int ret;
6762 +
6763 +               if ((ret = nf_register_hook(&br_nf_ops[i])) >= 0)
6764 +                       continue;
6765 +
6766 +               while (i--)
6767 +                       nf_unregister_hook(&br_nf_ops[i]);
6768 +
6769 +               return ret;
6770 +       }
6771 +
6772 +#ifdef CONFIG_SYSCTL
6773 +       brnf_sysctl_header = register_sysctl_table(brnf_net_table, 0);
6774 +       if (brnf_sysctl_header == NULL) {
6775 +               printk(KERN_WARNING "br_netfilter: can't register to sysctl.\n");
6776 +               for (i = 0; i < ARRAY_SIZE(br_nf_ops); i++)
6777 +                       nf_unregister_hook(&br_nf_ops[i]);
6778 +               return -EFAULT;
6779 +       }
6780 +#endif
6781 +
6782 +       printk(KERN_NOTICE "Bridge firewalling registered\n");
6783 +
6784 +       return 0;
6785 +}
6786 +
6787 +void br_netfilter_fini(void)
6788 +{
6789 +       int i;
6790 +
6791 +       for (i = ARRAY_SIZE(br_nf_ops) - 1; i >= 0; i--)
6792 +               nf_unregister_hook(&br_nf_ops[i]);
6793 +#ifdef CONFIG_SYSCTL
6794 +       unregister_sysctl_table(brnf_sysctl_header);
6795 +#endif
6796 +
6797 +}
6798 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
6799 +++ linux-2.4.29-ebt-brnf/net/ipv4/netfilter/ipt_physdev.c      2005-03-14 00:00:30.000000000 +0100
6800 @@ -0,0 +1,127 @@
6801 +/* Kernel module to match the bridge port in and
6802 + * out device for IP packets coming into contact with a bridge. */
6803 +#include <linux/module.h>
6804 +#include <linux/skbuff.h>
6805 +#include <linux/netfilter_ipv4/ipt_physdev.h>
6806 +#include <linux/netfilter_ipv4/ip_tables.h>
6807 +#include <linux/netfilter_bridge.h>
6808 +#include <linux/netdevice.h>
6809 +#define MATCH   1
6810 +#define NOMATCH 0
6811 +
6812 +static int
6813 +match(const struct sk_buff *skb,
6814 +      const struct net_device *in,
6815 +      const struct net_device *out,
6816 +      const void *matchinfo,
6817 +      int offset,
6818 +      const void *hdr,
6819 +      u_int16_t datalen,
6820 +      int *hotdrop)
6821 +{
6822 +       int i;
6823 +       static const char nulldevname[IFNAMSIZ] = { 0 };
6824 +       const struct ipt_physdev_info *info = matchinfo;
6825 +       unsigned long ret;
6826 +       const char *indev, *outdev;
6827 +       struct nf_bridge_info *nf_bridge;
6828 +
6829 +       /* Not a bridged IP packet or no info available yet:
6830 +        * LOCAL_OUT/mangle and LOCAL_OUT/nat don't know if
6831 +        * the destination device will be a bridge. */
6832 +       if (!(nf_bridge = skb->nf_bridge)) {
6833 +               /* Return MATCH if the invert flags of the used options are on */
6834 +               if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
6835 +                   !(info->invert & IPT_PHYSDEV_OP_BRIDGED))
6836 +                       return NOMATCH;
6837 +               if ((info->bitmask & IPT_PHYSDEV_OP_ISIN) &&
6838 +                   !(info->invert & IPT_PHYSDEV_OP_ISIN))
6839 +                       return NOMATCH;
6840 +               if ((info->bitmask & IPT_PHYSDEV_OP_ISOUT) &&
6841 +                   !(info->invert & IPT_PHYSDEV_OP_ISOUT))
6842 +                       return NOMATCH;
6843 +               if ((info->bitmask & IPT_PHYSDEV_OP_IN) &&
6844 +                   !(info->invert & IPT_PHYSDEV_OP_IN))
6845 +                       return NOMATCH;
6846 +               if ((info->bitmask & IPT_PHYSDEV_OP_OUT) &&
6847 +                   !(info->invert & IPT_PHYSDEV_OP_OUT))
6848 +                       return NOMATCH;
6849 +               return MATCH;
6850 +       }
6851 +
6852 +       /* This only makes sense in the FORWARD and POSTROUTING chains */
6853 +       if ((info->bitmask & IPT_PHYSDEV_OP_BRIDGED) &&
6854 +           (!!(nf_bridge->mask & BRNF_BRIDGED) ^
6855 +           !(info->invert & IPT_PHYSDEV_OP_BRIDGED)))
6856 +               return NOMATCH;
6857 +
6858 +       if ((info->bitmask & IPT_PHYSDEV_OP_ISIN &&
6859 +           (!nf_bridge->physindev ^ !!(info->invert & IPT_PHYSDEV_OP_ISIN))) ||
6860 +           (info->bitmask & IPT_PHYSDEV_OP_ISOUT &&
6861 +           (!nf_bridge->physoutdev ^ !!(info->invert & IPT_PHYSDEV_OP_ISOUT))))
6862 +               return NOMATCH;
6863 +
6864 +       if (!(info->bitmask & IPT_PHYSDEV_OP_IN))
6865 +               goto match_outdev;
6866 +       indev = nf_bridge->physindev ? nf_bridge->physindev->name : nulldevname;
6867 +       for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
6868 +               ret |= (((const unsigned long *)indev)[i]
6869 +                       ^ ((const unsigned long *)info->physindev)[i])
6870 +                       & ((const unsigned long *)info->in_mask)[i];
6871 +       }
6872 +
6873 +       if ((ret == 0) ^ !(info->invert & IPT_PHYSDEV_OP_IN))
6874 +               return NOMATCH;
6875 +
6876 +match_outdev:
6877 +       if (!(info->bitmask & IPT_PHYSDEV_OP_OUT))
6878 +               return MATCH;
6879 +       outdev = nf_bridge->physoutdev ?
6880 +                nf_bridge->physoutdev->name : nulldevname;
6881 +       for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
6882 +               ret |= (((const unsigned long *)outdev)[i]
6883 +                       ^ ((const unsigned long *)info->physoutdev)[i])
6884 +                       & ((const unsigned long *)info->out_mask)[i];
6885 +       }
6886 +
6887 +       return (ret != 0) ^ !(info->invert & IPT_PHYSDEV_OP_OUT);
6888 +}
6889 +
6890 +static int
6891 +checkentry(const char *tablename,
6892 +                      const struct ipt_ip *ip,
6893 +                      void *matchinfo,
6894 +                      unsigned int matchsize,
6895 +                      unsigned int hook_mask)
6896 +{
6897 +       const struct ipt_physdev_info *info = matchinfo;
6898 +
6899 +       if (matchsize != IPT_ALIGN(sizeof(struct ipt_physdev_info)))
6900 +               return 0;
6901 +       if (!(info->bitmask & IPT_PHYSDEV_OP_MASK) ||
6902 +           info->bitmask & ~IPT_PHYSDEV_OP_MASK)
6903 +               return 0;
6904 +       return 1;
6905 +}
6906 +
6907 +static struct ipt_match physdev_match = {
6908 +       .name           = "physdev",
6909 +       .match          = &match,
6910 +       .checkentry     = &checkentry,
6911 +       .me             = THIS_MODULE,
6912 +};
6913 +
6914 +static int __init init(void)
6915 +{
6916 +       return ipt_register_match(&physdev_match);
6917 +}
6918 +
6919 +static void __exit fini(void)
6920 +{
6921 +       ipt_unregister_match(&physdev_match);
6922 +}
6923 +
6924 +module_init(init);
6925 +module_exit(fini);
6926 +MODULE_LICENSE("GPL");
6927 +EXPORT_NO_SYMBOLS;
6928 --- /dev/null   2005-03-14 20:10:29.001600248 +0100
6929 +++ linux-2.4.29-ebt-brnf/include/linux/netfilter_ipv4/ipt_physdev.h    2005-03-14 21:24:30.000000000 +0100
6930 @@ -0,0 +1,24 @@
6931 +#ifndef _IPT_PHYSDEV_H
6932 +#define _IPT_PHYSDEV_H
6933 +
6934 +#ifdef __KERNEL__
6935 +#include <linux/if.h>
6936 +#endif
6937 +
6938 +#define IPT_PHYSDEV_OP_IN              0x01
6939 +#define IPT_PHYSDEV_OP_OUT             0x02
6940 +#define IPT_PHYSDEV_OP_BRIDGED         0x04
6941 +#define IPT_PHYSDEV_OP_ISIN            0x08
6942 +#define IPT_PHYSDEV_OP_ISOUT           0x10
6943 +#define IPT_PHYSDEV_OP_MASK            (0x20 - 1)
6944 +
6945 +struct ipt_physdev_info {
6946 +       char physindev[IFNAMSIZ];
6947 +       char in_mask[IFNAMSIZ];
6948 +       char physoutdev[IFNAMSIZ];
6949 +       char out_mask[IFNAMSIZ];
6950 +       u_int8_t invert;
6951 +       u_int8_t bitmask;
6952 +};
6953 +
6954 +#endif /*_IPT_PHYSDEV_H*/
6955 --- linux-2.4.29/net/8021q/vlan_dev.c   2005-01-19 15:10:13.000000000 +0100
6956 +++ linux-2.4.29-ebt-brnf/net/8021q/vlan_dev.c  2005-03-14 00:00:30.000000000 +0100
6957 @@ -488,6 +488,10 @@ int vlan_dev_hard_start_xmit(struct sk_b
6958         stats->tx_packets++; /* for statics only */
6959         stats->tx_bytes += skb->len;
6960
6961 +       skb->protocol = __constant_htons(ETH_P_8021Q);
6962 +       skb->mac.raw -= VLAN_HLEN;
6963 +       skb->nh.raw -= VLAN_HLEN;
6964 +
6965         skb->dev = VLAN_DEV_INFO(dev)->real_dev;
6966         dev_queue_xmit(skb);
6967
6968 --- linux-2.4.29/include/linux/sysctl.h 2005-01-19 15:10:13.000000000 +0100
6969 +++ linux-2.4.29-ebt-brnf/include/linux/sysctl.h        2005-03-14 21:07:18.000000000 +0100
6970 @@ -608,6 +608,15 @@ enum {
6971         NET_DECNET_CONF_DEV_STATE = 7
6972  };
6973
6974 +/* /proc/sys/net/bridge */
6975 +enum {
6976 +       NET_BRIDGE_NF_CALL_ARPTABLES = 1,
6977 +       NET_BRIDGE_NF_CALL_IPTABLES = 2,
6978 +       NET_BRIDGE_NF_CALL_IP6TABLES = 3,
6979 +       NET_BRIDGE_NF_FILTER_VLAN_TAGGED = 4,
6980 +};
6981 +
6982 +
6983  /* CTL_PROC names: */
6984
6985  /* CTL_FS names: */
6986 --- linux-2.4.29/net/ipv4/netfilter/ipt_REJECT.c        2005-01-19 15:10:13.000000000 +0100
6987 +++ linux-2.4.29-ebt-brnf/net/ipv4/netfilter/ipt_REJECT.c       2005-03-14 00:00:30.000000000 +0100
6988 @@ -15,6 +15,9 @@
6989  #include <net/route.h>
6990  #include <linux/netfilter_ipv4/ip_tables.h>
6991  #include <linux/netfilter_ipv4/ipt_REJECT.h>
6992 +#ifdef CONFIG_BRIDGE_NETFILTER
6993 +#include <linux/netfilter_bridge.h>
6994 +#endif
6995
6996  #if 0
6997  #define DEBUGP printk
6998 @@ -29,7 +32,13 @@ static inline struct rtable *route_rever
6999         struct rt_key key = {};
7000         struct rtable *rt;
7001
7002 -       if (hook != NF_IP_FORWARD) {
7003 +       /* We don't require ip forwarding to be enabled to be able to
7004 +        * send a RST reply for bridged traffic. */
7005 +       if (hook != NF_IP_FORWARD
7006 +#ifdef CONFIG_BRIDGE_NETFILTER
7007 +           || (skb->nf_bridge && skb->nf_bridge->mask & BRNF_BRIDGED)
7008 +#endif
7009 +          ) {
7010                 key.dst = iph->saddr;
7011                 if (hook == NF_IP_LOCAL_IN)
7012                         key.src = iph->daddr;