more cleanup
diff --git a/communication.c b/communication.c
index e429d15..6db6858 100644
--- a/communication.c
+++ b/communication.c
@@ -369,12 +369,20 @@
/* Don't use this old counter */
old++;
} else {
- if (cc->type == CNT_INCR) {
- new->pcnt = old->pcnt + next->cnt_surplus.pcnt;
- new->bcnt = old->bcnt + next->cnt_surplus.bcnt;
- } else if (cc->type == CNT_DECR) {
- new->pcnt = old->pcnt - next->cnt_surplus.pcnt;
- new->bcnt = old->bcnt - next->cnt_surplus.bcnt;
+ if (cc->type == CNT_CHANGE) {
+ new->pcnt = old->pcnt;
+ if (cc->change % 3 == 1)
+ new->pcnt = old->pcnt + next->cnt_surplus.pcnt;
+ else if (cc->change % 3 == 2)
+ new->pcnt = old->pcnt - next->cnt_surplus.pcnt;
+ else
+ new->pcnt = next->cnt.pcnt;
+ if (cc->change / 3 == 1)
+ new->bcnt = old->bcnt + next->cnt_surplus.bcnt;
+ else if (cc->change / 3 == 2)
+ new->bcnt = old->bcnt - next->cnt_surplus.bcnt;
+ else
+ new->bcnt = next->cnt.bcnt;
} else
*new = next->cnt;
next->cnt = *new;
@@ -415,6 +423,7 @@
cc = u_repl->counterchanges;
for (i = 0; i < u_repl->nentries; i++) {
cc->type = CNT_NORM;
+ cc->change = 0;
cc3 = &cc->next;
cc = cc->next;
}
@@ -513,6 +522,7 @@
if (*totalcnt >= u_repl->nentries)
ebt_print_bug("*totalcnt >= u_repl->nentries");
new->cnt = u_repl->counters[*totalcnt];
+ new->cnt_surplus.pcnt = new->cnt_surplus.bcnt = 0;
new->m_list = NULL;
new->w_list = NULL;
new->next = NULL;
@@ -792,6 +802,7 @@
if (!new_cc)
ebt_print_memory();
new_cc->type = CNT_NORM;
+ new_cc->change = 0;
new_cc->next = NULL;
*prev_cc = new_cc;
prev_cc = &(new_cc->next);
diff --git a/ebtables.c b/ebtables.c
index 59c1584..0cffb90 100644
--- a/ebtables.c
+++ b/ebtables.c
@@ -318,14 +318,8 @@
while (cc->type == CNT_DEL)
cc = cc->next;
- /* This can only happen in daemon mode */
- if (cc->type == CNT_INCR) {
- pcnt += hlp->cnt_surplus.pcnt;
- bcnt += hlp->cnt_surplus.bcnt;
- } else if (cc->type == CNT_DECR) {
- pcnt -= hlp->cnt_surplus.pcnt;
- bcnt -= hlp->cnt_surplus.bcnt;
- }
+ if (cc->change != 0) /* in daemon mode, only change==0 is allowed */
+ ebt_print_bug("cc->change != 0");
cc = cc->next;
if (replace->flags & LIST_X)
printf("-c %llu %llu", pcnt, bcnt);
@@ -490,13 +484,16 @@
return 0;
}
-static int parse_change_counters_rule(int argc, char **argv, int *rule_nr, int *rule_nr_end)
+/* Incrementing or decrementing rules in daemon mode is not supported as the
+ * involved code overload is not worth it. */
+static int parse_change_counters_rule(int argc, char **argv, int *rule_nr, int *rule_nr_end, int exec_style)
{
char *buffer;
+ int ret = 0;
if (optind + 1 >= argc || (argv[optind][0] == '-' && (argv[optind][1] < '0' || argv[optind][1] > '9')) ||
(argv[optind + 1][0] == '-' && (argv[optind + 1][1] < '0' && argv[optind + 1][1] > '9')))
- ebt_print_error2("The command -C needs at least 3 arguments");
+ ebt_print_error2("The command -C needs at least 2 arguments");
if (optind + 2 < argc && (argv[optind + 2][0] != '-' || (argv[optind + 2][1] >= '0' && argv[optind + 2][1] <= '9'))) {
if (optind + 3 != argc)
ebt_print_error2("No extra options allowed with -C start_nr[:end_nr] pcnt bcnt");
@@ -506,36 +503,40 @@
}
if (argv[optind][0] == '+') {
- if (argv[optind + 1][0] != '+')
- ebt_print_error2("If one counter is increased, the other should be increased too (perhaps put a '+' before '%s')", argv[optind + 1]);
- replace->flags |= OPT_CNT_INCR;
+ if (exec_style == EXEC_STYLE_DAEMON)
+daemon_incr:
+ ebt_print_error2("Incrementing rule counters (%s) not allowed in daemon mode", argv[optind]);
+ ret += 1;
new_entry->cnt_surplus.pcnt = strtoull(argv[optind] + 1, &buffer, 10);
- if (*buffer != '\0')
- goto invalid;
- optind++;
- new_entry->cnt_surplus.bcnt = strtoull(argv[optind] + 1, &buffer, 10);
} else if (argv[optind][0] == '-') {
- if (argv[optind + 1][0] != '-')
- ebt_print_error2("If one counter is decreased, the other should be decreased too (perhaps put a '-' before '%s')", argv[optind + 1]);
- replace->flags |= OPT_CNT_DECR;
+ if (exec_style == EXEC_STYLE_DAEMON)
+daemon_decr:
+ ebt_print_error2("Decrementing rule counters (%s) not allowed in daemon mode", argv[optind]);
+ ret += 2;
new_entry->cnt_surplus.pcnt = strtoull(argv[optind] + 1, &buffer, 10);
- if (*buffer != '\0')
- goto invalid;
- optind++;
- new_entry->cnt_surplus.bcnt = strtoull(argv[optind] + 1, &buffer, 10);
- } else {
- if (argv[optind + 1][0] == '-' || argv[optind + 1][0] == '+')
- ebt_print_error2("If one counter is %screased, the other should be %screased too (perhaps put a '%c' before '%s')",
- argv[optind + 1][0] == '-' ? "de" : "in", argv[optind + 1][0] == '-' ? "de" : "in", argv[optind + 1][0], argv[optind]);
+ } else
new_entry->cnt_surplus.pcnt = strtoull(argv[optind], &buffer, 10);
- optind++;
- new_entry->cnt_surplus.bcnt = strtoull(argv[optind], &buffer, 10);
- }
if (*buffer != '\0')
goto invalid;
optind++;
- return 0;
+ if (argv[optind][0] == '+') {
+ if (exec_style == EXEC_STYLE_DAEMON)
+ goto daemon_incr;
+ ret += 3;
+ new_entry->cnt_surplus.bcnt = strtoull(argv[optind] + 1, &buffer, 10);
+ } else if (argv[optind][0] == '-') {
+ if (exec_style == EXEC_STYLE_DAEMON)
+ goto daemon_decr;
+ ret += 6;
+ new_entry->cnt_surplus.bcnt = strtoull(argv[optind] + 1, &buffer, 10);
+ } else
+ new_entry->cnt_surplus.bcnt = strtoull(argv[optind], &buffer, 10);
+
+ if (*buffer != '\0')
+ goto invalid;
+ optind++;
+ return ret;
invalid:
ebt_print_error2("Packet counter '%s' invalid", argv[optind]);
}
@@ -567,6 +568,7 @@
char *buffer;
int c, i;
int zerochain = -1; /* Needed for the -Z option (we can have -Z <this> -L <that>) */
+ int chcounter; /* Needed for -C */
int policy = 0;
int rule_nr = 0;
int rule_nr_end = 0;
@@ -686,7 +688,7 @@
ebt_print_error2("Problem with the specified rule number(s) '%s'", argv[optind]);
optind++;
} else if (c == 'C') {
- if (parse_change_counters_rule(argc, argv, &rule_nr, &rule_nr_end))
+ if ((chcounter = parse_change_counters_rule(argc, argv, &rule_nr, &rule_nr_end, exec_style)) == -1)
return -1;
} else if (c == 'I') {
if (optind >= argc || (argv[optind][0] == '-' && (argv[optind][1] < '0' || argv[optind][1] > '9')))
@@ -1224,7 +1226,7 @@
if (ebt_errormsg[0] != '\0')
return -1;
} else if (replace->command == 'C') {
- ebt_change_counters(replace, new_entry, rule_nr, rule_nr_end, &(new_entry->cnt_surplus));
+ ebt_change_counters(replace, new_entry, rule_nr, rule_nr_end, &(new_entry->cnt_surplus), chcounter);
if (ebt_errormsg[0] != '\0')
return -1;
}
diff --git a/libebtc.c b/libebtc.c
index 964fa8e..6760dbc 100644
--- a/libebtc.c
+++ b/libebtc.c
@@ -23,12 +23,10 @@
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
-#include <getopt.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
-#include <netinet/ether.h>
#include "include/ebtables_u.h"
#include "include/ethernetdb.h"
#include <unistd.h>
@@ -140,7 +138,7 @@
int ebt_get_kernel_table(struct ebt_u_replace *replace, int init)
{
if (!ebt_find_table(replace->name)) {
- ebt_print_error("Bad table name");
+ ebt_print_error("Bad table name '%s'", replace->name);
return -1;
}
/* Get the kernel's information */
@@ -149,7 +147,7 @@
return -1;
ebtables_insmod("ebtables");
if (ebt_get_table(replace, init)) {
- ebt_print_error("The kernel doesn't support the ebtables %s table", replace->name);
+ ebt_print_error("The kernel doesn't support the ebtables '%s' table", replace->name);
return -1;
}
}
@@ -212,10 +210,7 @@
else
break;
}
- entries->nentries = 0;
- entries->counter_offset = 0;
u_e1 = entries->entries;
- entries->entries = NULL;
while (u_e1) {
ebt_free_u_entry(u_e1);
u_e2 = u_e1->next;
@@ -223,6 +218,11 @@
u_e1 = u_e2;
}
}
+ for (i = 0; i < NF_BR_NUMHOOKS; i++)
+ if (replace->hook_entry[i]) {
+ free(replace->hook_entry[i]);
+ replace->hook_entry[i] = NULL;
+ }
udc1 = replace->udc;
while (udc1) {
free(udc1->udc);
@@ -314,8 +314,6 @@
free(e->t);
}
-/* Blatently stolen (again) from iptables.c userspace program
- * find out where the modprobe utility is located */
static char *get_modprobe(void)
{
int procfile;
@@ -327,12 +325,9 @@
ret = malloc(1024);
if (ret) {
- switch (read(procfile, ret, 1024)) {
- case -1: goto fail;
- case 1024: goto fail; /* Partial read. Wierd */
- }
- if (ret[strlen(ret)-1] == '\n')
- ret[strlen(ret)-1] = 0;
+ if (read(procfile, ret, 1024) == -1)
+ goto fail;
+ ret[1023] = '\0';
close(procfile);
return ret;
}
@@ -343,7 +338,7 @@
}
char *ebt_modprobe;
-/* Try to load the kernel module */
+/* Try to load the kernel module, analogous to ip_tables.c */
int ebtables_insmod(const char *modname)
{
char *buf = NULL;
@@ -380,8 +375,7 @@
/* Gives back a pointer to the chain base, based on nr.
* If nr >= NF_BR_NUMHOOKS you'll get back a user-defined chain.
* Returns NULL on failure. */
-struct ebt_u_entries *ebt_nr_to_chain(const struct ebt_u_replace *replace,
- int nr)
+struct ebt_u_entries *ebt_nr_to_chain(const struct ebt_u_replace *replace, int nr)
{
if (nr == -1)
return NULL;
@@ -418,7 +412,7 @@
struct ebt_u_chain_list *cl = replace->udc;
for (i = 0; i < NF_BR_NUMHOOKS; i++) {
- if (!(replace->valid_hooks & (1 << i)))
+ if (!replace->hook_entry[i])
continue;
if (!strcmp(arg, replace->hook_entry[i]->name))
return replace->hook_entry[i];
@@ -439,7 +433,7 @@
struct ebt_u_chain_list *cl = replace->udc;
for (i = 0; i < NF_BR_NUMHOOKS; i++) {
- if (!(replace->valid_hooks & (1 << i)))
+ if (!replace->hook_entry[i])
continue;
if (!strcmp(arg, replace->hook_entry[i]->name))
return i;
@@ -473,7 +467,7 @@
}
/* Flush one chain or the complete table
- * If selected_chain == -1: flush the complete table */
+ * If selected_chain == -1 then flush the complete table */
void ebt_flush_chains(struct ebt_u_replace *replace)
{
int i, j, numdel;
@@ -690,8 +684,8 @@
* This function expects the ebt_{match,watcher,target} members of new_entry
* to contain pointers to ebt_u_{match,watcher,target} and updates these
* pointers so that they point to ebt_{match,watcher,target}, before adding
- * the rule to the chain. Don't free() the ebt_{match,watcher,target} after a
- * successful call to ebt_add_rule() */
+ * the rule to the chain. Don't free() the ebt_{match,watcher,target} and
+ * don't reuse the new_entry after a successful call to ebt_add_rule() */
void ebt_add_rule(struct ebt_u_replace *replace, struct ebt_u_entry *new_entry,
int rule_nr)
{
@@ -717,7 +711,7 @@
/* Handle counter stuff */
for (i = 0; i < replace->selected_chain; i++) {
- if (i < NF_BR_NUMHOOKS && !(replace->valid_hooks & (1 << i)))
+ if (i < NF_BR_NUMHOOKS && !(replace->hook_entry[i]))
continue;
j = ebt_nr_to_chain(replace, i)->nentries;
while (j) {
@@ -737,11 +731,11 @@
if (cc && cc->type == CNT_DEL)
cc->type = CNT_OWRITE;
else {
- new_cc = (struct ebt_cntchanges *)
- malloc(sizeof(struct ebt_cntchanges));
+ new_cc = (struct ebt_cntchanges *)malloc(sizeof(struct ebt_cntchanges));
if (!new_cc)
ebt_print_memory();
new_cc->type = CNT_ADD;
+ new_cc->change = 0;
new_cc->next = cc;
*prev_cc = new_cc;
}
@@ -780,6 +774,8 @@
}
}
+/* If *begin==*end==0 then find the rule corresponding to new_entry,
+ * else make the rule numbers positive and check for bad rule numbers. */
static int check_and_change_rule_number(struct ebt_u_replace *replace,
struct ebt_u_entry *new_entry, int *begin, int *end)
{
@@ -837,7 +833,7 @@
/* Handle counter stuff */
for (i = 0; i < replace->selected_chain; i++) {
- if (i < NF_BR_NUMHOOKS && !(replace->valid_hooks & (1 << i)))
+ if (i < NF_BR_NUMHOOKS && !(replace->hook_entry[i]))
continue;
j = ebt_nr_to_chain(replace, i)->nentries;
while (j) {
@@ -899,17 +895,19 @@
}
}
-#define OPT_CNT_INCR 0x2000 /* This value is also defined in ebtables.c */
-#define OPT_CNT_DECR 0x4000 /* This value is also defined in ebtables.c */
/* Change the counters of a rule or rules
* begin == end == 0: change counters of the rule corresponding to new_entry
*
* The first rule has rule nr 1, the last rule has rule nr -1, etc.
* This function expects the ebt_{match,watcher,target} members of new_entry
- * to contain pointers to ebt_u_{match,watcher,target}. */
+ * to contain pointers to ebt_u_{match,watcher,target}.
+ * The mask denotes the following:
+ * pcnt: mask % 3 = 0 : change; = 1: increment; = 2: decrement
+ * bcnt: mask / 3 = 0 : change; = 1: increment = 2: increment
+ * In daemon mode, mask==0 must hold */
void ebt_change_counters(struct ebt_u_replace *replace,
struct ebt_u_entry *new_entry, int begin, int end,
- struct ebt_counter *cnt)
+ struct ebt_counter *cnt, int mask)
{
int i, j;
struct ebt_u_entry *u_e;
@@ -920,7 +918,7 @@
return;
for (i = 0; i < replace->selected_chain; i++) {
- if (i < NF_BR_NUMHOOKS && !(replace->valid_hooks & (1 << i)))
+ if (i < NF_BR_NUMHOOKS && !(replace->hook_entry[i]))
continue;
j = ebt_nr_to_chain(replace, i)->nentries;
while (j) {
@@ -942,40 +940,34 @@
while (i) {
if (cc->type != CNT_DEL) {
i--;
- if (cc->type != CNT_ADD && cc->type != CNT_OWRITE) {
- /* In daemon mode, we want to make sure we don't lose
- * any counted packets/bytes (the kernel is still counting
- * while we are changing things in userspace). Therefore,
- * we need to add the amount to the counters in the kernel,
- * not the counters copied earlier from the kernel. */
- u_e->cnt_surplus = *cnt;
- if (replace->flags & OPT_CNT_INCR) {
- cc->type = CNT_INCR;
- } else if (replace->flags & OPT_CNT_DECR)
- cc->type = CNT_DECR;
- else {
- cc->type = CNT_CHANGE;
- u_e->cnt = *cnt;
- u_e->cnt_surplus.pcnt = u_e->cnt_surplus.bcnt = 0;
- }
- } else { /* A -C after a -A remains a -A */
- if (replace->flags & OPT_CNT_INCR) {
- u_e->cnt.pcnt += cnt->pcnt;
- u_e->cnt.bcnt += cnt->bcnt;
- } else if (replace->flags & OPT_CNT_DECR) {
- u_e->cnt.pcnt -= cnt->pcnt;
- u_e->cnt.bcnt -= cnt->bcnt;
- } else
- u_e->cnt = *cnt;
+ if (mask % 3 == 0) {
+ u_e->cnt.pcnt = (*cnt).pcnt;
+ u_e->cnt_surplus.pcnt = 0;
+ } else {
+ if (cc->type != CNT_NORM)
+ ebt_print_bug("cc->type != CNT_NORM");
+ u_e->cnt_surplus.pcnt = (*cnt).pcnt;
}
+
+ if (mask / 3 == 0) {
+ u_e->cnt.bcnt = (*cnt).bcnt;
+ u_e->cnt_surplus.bcnt = 0;
+ } else {
+ if (cc->type != CNT_NORM)
+ ebt_print_bug("cc->type != CNT_NORM");
+ u_e->cnt_surplus.bcnt = (*cnt).bcnt;
+ }
+ if (cc->type == CNT_NORM || cc->type == CNT_ZERO)
+ cc->type = CNT_CHANGE;
+ cc->change = mask;
u_e = u_e->next;
}
cc = cc->next;
}
}
-/* Selected_chain == -1 : zero all counters
- * Otherwise, zero the counters of selected_chain */
+/* If selected_chain == -1 then zero all counters,
+ * otherwise, zero the counters of selected_chain */
void ebt_zero_counters(struct ebt_u_replace *replace)
{
struct ebt_u_entries *entries = ebt_to_chain(replace);
@@ -992,7 +984,7 @@
i = -1;
while (1) {
i++;
- if (i < NF_BR_NUMHOOKS && !(replace->valid_hooks & (1 << i)))
+ if (i < NF_BR_NUMHOOKS && !(replace->hook_entry[i]))
continue;
entries = ebt_nr_to_chain(replace, i);
if (!entries) {
@@ -1006,14 +998,13 @@
next = next->next;
}
}
-
} else {
next = entries->entries;
if (entries->nentries == 0)
return;
for (i = 0; i < replace->selected_chain; i++) {
- if (i < NF_BR_NUMHOOKS && !(replace->valid_hooks & (1 << i)))
+ if (i < NF_BR_NUMHOOKS && !(replace->hook_entry[i]))
continue;
j = ebt_nr_to_chain(replace, i)->nentries;
while (j) {
@@ -1059,8 +1050,7 @@
if (!cl)
ebt_print_memory();
cl->next = NULL;
- cl->udc = (struct ebt_u_entries *)
- malloc(sizeof(struct ebt_u_entries));
+ cl->udc = (struct ebt_u_entries *)malloc(sizeof(struct ebt_u_entries));
if (!cl->udc)
ebt_print_memory();
cl->udc->nentries = 0;
@@ -1217,7 +1207,7 @@
/* Initialize hook_mask to 0 */
while (1) {
i++;
- if (i < NF_BR_NUMHOOKS && !(replace->valid_hooks & (1 << i)))
+ if (i < NF_BR_NUMHOOKS && !(replace->hook_entry[i]))
continue;
entries = ebt_nr_to_chain(replace, i);
if (!entries)
@@ -1225,15 +1215,14 @@
entries->hook_mask = 0;
}
if (i > NF_BR_NUMHOOKS) {
- stack = (struct ebt_u_stack *)malloc((i - NF_BR_NUMHOOKS) *
- sizeof(struct ebt_u_stack));
+ stack = (struct ebt_u_stack *)malloc((i - NF_BR_NUMHOOKS) * sizeof(struct ebt_u_stack));
if (!stack)
ebt_print_memory();
}
/* Check for loops, starting from every base chain */
for (i = 0; i < NF_BR_NUMHOOKS; i++) {
- if (!(replace->valid_hooks & (1 << i)))
+ if (!(replace->hook_entry[i]))
continue;
entries = ebt_nr_to_chain(replace, i);
/* (1 << NF_BR_NUMHOOKS) implies it's a standard chain