static struct option *merge_options(struct option *oldopts, const struct option *newopts, unsigned int *options_offset) { unsigned int num_old, num_new, i; struct option *merge; if (!newopts || !oldopts || !options_offset) ebt_print_bug("merge wrong"); for (num_old = 0; oldopts[num_old].name; num_old++); for (num_new = 0; newopts[num_new].name; num_new++); global_option_offset += OPTION_OFFSET; *options_offset = global_option_offset; merge = malloc(sizeof(struct option) * (num_new + num_old + 1)); if (!merge) ebt_print_memory(); memcpy(merge, oldopts, num_old * sizeof(struct option)); for (i = 0; i < num_new; i++) { merge[num_old + i] = newopts[i]; merge[num_old + i].val += *options_offset; } memset(merge + num_old + num_new, 0, sizeof(struct option)); /* Only free dynamically allocated stuff */ if (oldopts != ebt_original_options) free(oldopts); return merge; }
static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry, unsigned int *flags, struct ebt_entry_match **match) { struct ebt_among_info *info = (struct ebt_among_info *) (*match)->data; struct ebt_mac_wormhash *wh; struct ebt_entry_match *h; int new_size, old_size; switch (c) { case AMONG_DST: case AMONG_SRC: if (c == AMONG_DST) { ebt_check_option2(flags, OPT_DST); } else { ebt_check_option2(flags, OPT_SRC); } if (ebt_check_inverse2(optarg)) { if (c == AMONG_DST) info->bitmask |= EBT_AMONG_DST_NEG; else info->bitmask |= EBT_AMONG_SRC_NEG; } wh = create_wormhash(optarg); if (ebt_errormsg[0] != '\0') break; old_size = sizeof(struct ebt_entry_match) + (**match).match_size; h = malloc((new_size = old_size + ebt_mac_wormhash_size(wh))); if (!h) ebt_print_memory(); memcpy(h, *match, old_size); memcpy((char *) h + old_size, wh, ebt_mac_wormhash_size(wh)); h->match_size = new_size - sizeof(struct ebt_entry_match); info = (struct ebt_among_info *) h->data; if (c == AMONG_DST) { info->wh_dst_ofs = old_size - sizeof(struct ebt_entry_match); } else { info->wh_src_ofs = old_size - sizeof(struct ebt_entry_match); } free(*match); *match = h; free(wh); break; default: return 0; } return 1; }
static struct ebt_mac_wormhash *new_wormhash(int n) { int size = sizeof(struct ebt_mac_wormhash) + n * sizeof(struct ebt_mac_wormhash_tuple); struct ebt_mac_wormhash *result = (struct ebt_mac_wormhash *) malloc(size); if (!result) ebt_print_memory(); memset(result, 0, size); result->poolsize = n; return result; }
/* We use exec_style instead of #ifdef's because ebtables.so is a shared object. */ int do_command(int argc, char *argv[], struct ebt_u_replace *replace_) { char *buffer; int c, i; int policy = 0; int rule_nr = 0; int rule_nr_end = 0; struct ebt_u_target *t; struct ebt_u_match *m; struct ebt_u_match_list *m_l; struct ebt_u_entries *entries; opterr = 0; replace = replace_; replace->flags = 0; replace->selected_chain = -1; replace->command = 'h'; if (!new_entry) { new_entry = (struct ebt_u_entry *)malloc(sizeof(struct ebt_u_entry)); if (!new_entry) ebt_print_memory(); } /* Put some sane values in our new entry */ ebt_initialize_entry(new_entry); new_entry->replace = replace; /* The scenario induced by this loop makes that: * '-t' and '-M' (if specified) have to come * before '-A' and the like */ /* Getopt saves the day */ while ((c = getopt_long(argc, argv, "-A:D:I:N:E:X::L::F::P:Vhi:o:j:p:s:d:t:", ebt_options, NULL)) != -1) { switch (c) { case 'A': /* Add a rule */ case 'D': /* Delete a rule */ case 'P': /* Define policy */ case 'I': /* Insert a rule */ case 'N': /* Make a user defined chain */ case 'E': /* Rename chain */ case 'X': /* Delete chain */ /* We allow -N chainname -P policy */ if (replace->command == 'N' && c == 'P') { replace->command = c; optind--; /* No table specified */ goto handle_P; } if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->command = c; replace->flags |= OPT_COMMAND; ebt_get_kernel_table(replace); if (optarg && (optarg[0] == '-' || !strcmp(optarg, "!"))) ebt_print_error2("No chain name specified"); if (c == 'N') { if (ebt_get_chainnr(replace, optarg) != -1) ebt_print_error2("Chain %s already exists", optarg); else if (ebt_find_target(optarg)) ebt_print_error2("Target with name %s exists", optarg); else if (strlen(optarg) >= EBT_CHAIN_MAXNAMELEN) ebt_print_error2("Chain name length can't exceed %d", EBT_CHAIN_MAXNAMELEN - 1); else if (strchr(optarg, ' ') != NULL) ebt_print_error2("Use of ' ' not allowed in chain names"); ebt_new_chain(replace, optarg, EBT_ACCEPT); /* This is needed to get -N x -P y working */ replace->selected_chain = ebt_get_chainnr(replace, optarg); break; } else if (c == 'X') { if (optind >= argc) { replace->selected_chain = -1; ebt_delete_chain(replace); break; } if (optind < argc - 1) ebt_print_error2("No extra options allowed with -X"); if ((replace->selected_chain = ebt_get_chainnr(replace, argv[optind])) == -1) ebt_print_error2("Chain '%s' doesn't exist", argv[optind]); ebt_delete_chain(replace); optind++; break; } if ((replace->selected_chain = ebt_get_chainnr(replace, optarg)) == -1) ebt_print_error2("Chain '%s' doesn't exist", optarg); if (c == 'E') { if (optind >= argc) ebt_print_error2("No new chain name specified"); else if (optind < argc - 1) ebt_print_error2("No extra options allowed with -E"); else if (strlen(argv[optind]) >= EBT_CHAIN_MAXNAMELEN) ebt_print_error2("Chain name length can't exceed %d characters", EBT_CHAIN_MAXNAMELEN - 1); else if (ebt_get_chainnr(replace, argv[optind]) != -1) ebt_print_error2("Chain '%s' already exists", argv[optind]); else if (ebt_find_target(argv[optind])) ebt_print_error2("Target with name '%s' exists", argv[optind]); else if (strchr(argv[optind], ' ') != NULL) ebt_print_error2("Use of ' ' not allowed in chain names"); ebt_rename_chain(replace, argv[optind]); optind++; break; } else if (c == 'D' && optind < argc && (argv[optind][0] != '-' || (argv[optind][1] >= '0' && argv[optind][1] <= '9'))) { if (optind != argc - 1) ebt_print_error2("No extra options allowed with -D start_nr[:end_nr]"); if (parse_rule_range(argv[optind], &rule_nr, &rule_nr_end)) ebt_print_error2("Problem with the specified rule number(s) '%s'", argv[optind]); optind++; } else if (c == 'I') { if (optind >= argc || (argv[optind][0] == '-' && (argv[optind][1] < '0' || argv[optind][1] > '9'))) rule_nr = 1; else { rule_nr = strtol(argv[optind], &buffer, 10); if (*buffer != '\0') ebt_print_error2("Problem with the specified rule number '%s'", argv[optind]); optind++; } } else if (c == 'P') { handle_P: if (optind >= argc) ebt_print_error2("No policy specified"); for (i = 0; i < NUM_STANDARD_TARGETS; i++) if (!strcmp(argv[optind], ebt_standard_targets[i])) { policy = -i -1; if (policy == EBT_CONTINUE) ebt_print_error2("Wrong policy '%s'", argv[optind]); break; } if (i == NUM_STANDARD_TARGETS) ebt_print_error2("Unknown policy '%s'", argv[optind]); optind++; } break; case 'L': /* List */ case 'F': /* Flush */ if (replace->flags & OPT_COMMAND) ebt_print_error2("Multiple commands are not allowed"); replace->command = c; replace->flags |= OPT_COMMAND; ebt_get_kernel_table(replace); i = -1; if (optind < argc && argv[optind][0] != '-') { if ((i = ebt_get_chainnr(replace, argv[optind])) == -1) ebt_print_error2("Chain '%s' doesn't exist", argv[optind]); optind++; } if (i != -1) replace->selected_chain = i; break; case 'V': /* Version */ if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->command = 'V'; PRINT_VERSION; exit(0); case 'h': /* Help */ if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->command = 'h'; /* All other arguments should be extension names */ while (optind < argc) { struct ebt_u_match *m; if (!strcasecmp("list_extensions", argv[optind])) { ebt_list_extensions(); exit(0); } if ((m = ebt_find_match(argv[optind]))) ebt_add_match(new_entry, m); else { if (!(t = ebt_find_target(argv[optind]))) ebt_print_error2("Extension '%s' not found", argv[optind]); if (replace->flags & OPT_JUMP) ebt_print_error2("Sorry, you can only see help for one target extension at a time"); replace->flags |= OPT_JUMP; new_entry->t = (struct ebt_entry_target *)t; } optind++; } break; case 't': /* Table */ if (OPT_COMMANDS) ebt_print_error2("Please put the -t option first"); ebt_check_option2(&(replace->flags), OPT_TABLE); if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) ebt_print_error2("Table name length cannot exceed %d characters", EBT_TABLE_MAXNAMELEN - 1); strcpy(replace->name, optarg); break; case 'i': /* Input interface */ case 2 : /* Logical input interface */ case 'o': /* Output interface */ case 3 : /* Logical output interface */ case 'j': /* Target */ case 'p': /* Net family protocol */ case 's': /* Source mac */ case 'd': /* Destination mac */ if (!OPT_COMMANDS) ebt_print_error2("No command specified"); if (replace->command != 'A' && replace->command != 'D' && replace->command != 'I') ebt_print_error2("Command and option do not match"); if (c == 'i') { ebt_check_option2(&(replace->flags), OPT_IN); if (replace->selected_chain > 2 && replace->selected_chain < NF_BR_BROUTING) ebt_print_error2("Use -i only in INPUT, FORWARD, PREROUTING and BROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IIN; if (strlen(optarg) >= IFNAMSIZ) big_iface_length: ebt_print_error2("Interface name length cannot exceed %d characters", IFNAMSIZ - 1); strcpy(new_entry->in, optarg); if (parse_iface(new_entry->in, "-i")) return -1; break; } else if (c == 2) { ebt_check_option2(&(replace->flags), OPT_LOGICALIN); if (replace->selected_chain > 2 && replace->selected_chain < NF_BR_BROUTING) ebt_print_error2("Use --logical-in only in INPUT, FORWARD, PREROUTING and BROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_ILOGICALIN; if (strlen(optarg) >= IFNAMSIZ) goto big_iface_length; strcpy(new_entry->logical_in, optarg); if (parse_iface(new_entry->logical_in, "--logical-in")) return -1; break; } else if (c == 'o') { ebt_check_option2(&(replace->flags), OPT_OUT); if (replace->selected_chain < 2 || replace->selected_chain == NF_BR_BROUTING) ebt_print_error2("Use -o only in OUTPUT, FORWARD and POSTROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IOUT; if (strlen(optarg) >= IFNAMSIZ) goto big_iface_length; strcpy(new_entry->out, optarg); if (parse_iface(new_entry->out, "-o")) return -1; break; } else if (c == 3) { ebt_check_option2(&(replace->flags), OPT_LOGICALOUT); if (replace->selected_chain < 2 || replace->selected_chain == NF_BR_BROUTING) ebt_print_error2("Use --logical-out only in OUTPUT, FORWARD and POSTROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_ILOGICALOUT; if (strlen(optarg) >= IFNAMSIZ) goto big_iface_length; strcpy(new_entry->logical_out, optarg); if (parse_iface(new_entry->logical_out, "--logical-out")) return -1; break; } else if (c == 'j') { ebt_check_option2(&(replace->flags), OPT_JUMP); for (i = 0; i < NUM_STANDARD_TARGETS; i++) if (!strcmp(optarg, ebt_standard_targets[i])) { t = ebt_find_target(EBT_STANDARD_TARGET); ((struct ebt_standard_target *) t->t)->verdict = -i - 1; break; } if (-i - 1 == EBT_RETURN && replace->selected_chain < NF_BR_NUMHOOKS) { ebt_print_error2("Return target only for user defined chains"); } else if (i != NUM_STANDARD_TARGETS) break; if ((i = ebt_get_chainnr(replace, optarg)) != -1) { if (i < NF_BR_NUMHOOKS) ebt_print_error2("Don't jump to a standard chain"); t = ebt_find_target(EBT_STANDARD_TARGET); ((struct ebt_standard_target *) t->t)->verdict = i - NF_BR_NUMHOOKS; break; } else { /* Must be an extension then */ struct ebt_u_target *t; t = ebt_find_target(optarg); /* -j standard not allowed either */ if (!t || t == (struct ebt_u_target *)new_entry->t) ebt_print_error2("Illegal target name '%s'", optarg); new_entry->t = (struct ebt_entry_target *)t; ebt_find_target(EBT_STANDARD_TARGET)->used = 0; t->used = 1; } break; } else if (c == 's') { ebt_check_option2(&(replace->flags), OPT_SOURCE); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_ISOURCE; if (ebt_get_mac_and_mask(optarg, new_entry->sourcemac, new_entry->sourcemsk)) ebt_print_error2("Problem with specified source mac '%s'", optarg); new_entry->bitmask |= EBT_SOURCEMAC; break; } else if (c == 'd') { ebt_check_option2(&(replace->flags), OPT_DEST); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IDEST; if (ebt_get_mac_and_mask(optarg, new_entry->destmac, new_entry->destmsk)) ebt_print_error2("Problem with specified destination mac '%s'", optarg); new_entry->bitmask |= EBT_DESTMAC; break; } ebt_check_option2(&(replace->flags), OPT_PROTOCOL); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IPROTO; new_entry->bitmask &= ~((unsigned int)EBT_NOPROTO); i = strtol(optarg, &buffer, 16); if (*buffer == '\0' && (i < 0 || i > 0xFFFF)) ebt_print_error2("Problem with the specified protocol"); if (*buffer != '\0') { const struct ethertypeent *ent; if (!strcasecmp(optarg, "LENGTH")) { new_entry->bitmask |= EBT_802_3; break; } ent = getethertypebyname(optarg); if (!ent) ebt_print_error2("Problem with the specified Ethernet protocol '%s'", optarg); new_entry->ethproto = ent->e_ethertype; } else new_entry->ethproto = i; if (new_entry->ethproto < 0x0600) ebt_print_error2("Sorry, protocols have values above or equal to 0x0600"); break; case 1 : if (!strcmp(optarg, "!")) ebt_check_inverse2(optarg); else ebt_print_error2("Bad argument : '%s'", optarg); /* ebt_check_inverse() did optind++ */ optind--; continue; default: /* Is it a target option? */ t = (struct ebt_u_target *)new_entry->t; if ((t->parse(c - t->option_offset, argv, argc, new_entry, &t->flags, &t->t))) { goto check_extension; } /* Is it a match_option? */ for (m = ebt_matches; m; m = m->next) if (m->parse(c - m->option_offset, argv, argc, new_entry, &m->flags, &m->m)) break; if (m != NULL) { if (m->used == 0) { ebt_add_match(new_entry, m); m->used = 1; } goto check_extension; } if (c == '?') ebt_print_error2("Unknown argument: '%s'", argv[optind - 1], (char)optopt, (char)c); else { if (!strcmp(t->name, "standard")) ebt_print_error2("Unknown argument: don't forget the -t option"); else ebt_print_error2("Target-specific option does not correspond with specified target"); } check_extension: if (replace->command != 'A' && replace->command != 'I' && replace->command != 'D') ebt_print_error2("Extensions only for -A, -I and -D"); } ebt_invert = 0; } if (!(table = ebt_find_table(replace->name))) ebt_print_error2("Bad table name"); if (replace->command == 'h') { print_help(); exit(0); } /* Do the final checks */ if (replace->command == 'A' || replace->command == 'I' || replace->command == 'D') { /* This will put the hook_mask right for the chains */ ebt_check_for_loops(replace); entries = ebt_to_chain(replace); m_l = new_entry->m_list; t = (struct ebt_u_target *)new_entry->t; while (m_l) { m = (struct ebt_u_match *)(m_l->m); m->final_check(new_entry, m->m, replace->name, entries->hook_mask, 0); m_l = m_l->next; } t->final_check(new_entry, t->t, replace->name, entries->hook_mask, 0); } /* So, the extensions can work with the host endian. * The kernel does not have to do this of course */ new_entry->ethproto = htons(new_entry->ethproto); if (replace->command == 'P') { if (replace->selected_chain < NF_BR_NUMHOOKS && policy == EBT_RETURN) ebt_print_error2("Policy RETURN only allowed for user defined chains"); ebt_change_policy(replace, policy); } else if (replace->command == 'L') { list_rules(); exit(0); } if (replace->command == 'F') { ebt_flush_chains(replace); } else if (replace->command == 'A' || replace->command == 'I') { ebt_add_rule(replace, new_entry, rule_nr); if (rule_nr <= 0) rule_nr--; rule_nr_end = rule_nr; /* a jump to a udc requires checking for loops */ if (!strcmp(new_entry->t->u.name, EBT_STANDARD_TARGET) && ((struct ebt_standard_target *)(new_entry->t))->verdict >= 0) { /* FIXME: this can be done faster */ ebt_check_for_loops(replace); } /* Do the final_check(), for all entries. * This is needed when adding a rule that has a chain target */ i = -1; while (++i != replace->num_chains) { struct ebt_u_entry *e; entries = replace->chains[i]; if (!entries) { if (i < NF_BR_NUMHOOKS) continue; else ebt_print_bug("whoops\n"); } e = entries->entries->next; while (e != entries->entries) { /* Userspace extensions use host endian */ e->ethproto = ntohs(e->ethproto); ebt_do_final_checks(replace, e, entries); e->ethproto = htons(e->ethproto); e = e->next; } } /* Don't reuse the added rule */ new_entry = NULL; } else if (replace->command == 'D') { ebt_delete_rule(replace, new_entry, rule_nr, rule_nr_end); } /* Commands -N, -E, -X fall through */ if (table->check) table->check(replace); ebt_deliver_table(replace); if (replace->nentries) ebt_deliver_counters(replace); return 0; }
static struct ebt_mac_wormhash *create_wormhash(const char *arg) { const char *pc = arg; const char *anchor; char *endptr; struct ebt_mac_wormhash *workcopy, *result, *h; unsigned char mac[6]; unsigned char ip[4]; int nmacs = 0; int i; char token[4]; if (!(workcopy = new_wormhash(1024))) { ebt_print_memory(); } while (1) { /* remember current position, we'll need it on error */ anchor = pc; /* collect MAC; all its bytes are followed by ':' (colon), * except for the last one which can be followed by * ',' (comma), '=' or '\0' */ for (i = 0; i < 5; i++) { if (read_until(&pc, ":", token, 2) < 0 || token[0] == 0) { ebt_print_error("MAC parse error: %.20s", anchor); return NULL; } mac[i] = strtol(token, &endptr, 16); if (*endptr) { ebt_print_error("MAC parse error: %.20s", anchor); return NULL; } pc++; } if (read_until(&pc, "=,", token, 2) == -2 || token[0] == 0) { ebt_print_error("MAC parse error: %.20s", anchor); return NULL; } mac[i] = strtol(token, &endptr, 16); if (*endptr) { ebt_print_error("MAC parse error: %.20s", anchor); return NULL; } if (*pc == '=') { /* an IP follows the MAC; collect similarly to MAC */ pc++; anchor = pc; for (i = 0; i < 3; i++) { if (read_until(&pc, ".", token, 3) < 0 || token[0] == 0) { ebt_print_error("IP parse error: %.20s", anchor); return NULL; } ip[i] = strtol(token, &endptr, 10); if (*endptr) { ebt_print_error("IP parse error: %.20s", anchor); return NULL; } pc++; } if (read_until(&pc, ",", token, 3) == -2 || token[0] == 0) { ebt_print_error("IP parse error: %.20s", anchor); return NULL; } ip[3] = strtol(token, &endptr, 10); if (*endptr) { ebt_print_error("IP parse error: %.20s", anchor); return NULL; } if (*(uint32_t*)ip == 0) { ebt_print_error("Illegal IP 0.0.0.0"); return NULL; } } else { /* no IP, we set it to 0.0.0.0 */ memset(ip, 0, 4); } /* we have collected MAC and IP, so we add an entry */ memcpy(((char *) workcopy->pool[nmacs].cmp) + 2, mac, 6); workcopy->pool[nmacs].ip = *(const uint32_t *) ip; nmacs++; /* re-allocate memory if needed */ if (*pc && nmacs >= workcopy->poolsize) { if (!(h = new_wormhash(nmacs * 2))) { ebt_print_memory(); } copy_wormhash(h, workcopy); free(workcopy); workcopy = h; } /* check if end of string was reached */ if (!*pc) { break; } /* now `pc' points to comma if we are here; */ /* increment this to the next char */ /* but first assert :-> */ if (*pc != ',') { ebt_print_error("Something went wrong; no comma...\n"); return NULL; } pc++; /* again check if end of string was reached; */ /* we allow an ending comma */ if (!*pc) { break; } } if (!(result = new_wormhash(nmacs))) { ebt_print_memory(); } copy_wormhash(result, workcopy); free(workcopy); qsort(&result->pool, result->poolsize, sizeof(struct ebt_mac_wormhash_tuple), fcmp); index_table(result); return result; }
static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry, unsigned int *flags, struct ebt_entry_match **match) { struct ebt_among_info *info = (struct ebt_among_info *) (*match)->data; struct ebt_mac_wormhash *wh; struct ebt_entry_match *h; int new_size; long flen; int fd; switch (c) { case AMONG_DST_F: case AMONG_SRC_F: case AMONG_DST: case AMONG_SRC: if (c == AMONG_DST || c == AMONG_DST_F) { ebt_check_option2(flags, OPT_DST); } else { ebt_check_option2(flags, OPT_SRC); } if (ebt_check_inverse2(optarg)) { if (c == AMONG_DST || c == AMONG_DST_F) info->bitmask |= EBT_AMONG_DST_NEG; else info->bitmask |= EBT_AMONG_SRC_NEG; } if (c == AMONG_DST_F || c == AMONG_SRC_F) { struct stat stats; if ((fd = open(optarg, O_RDONLY)) == -1) ebt_print_error("Couldn't open file '%s'", optarg); fstat(fd, &stats); flen = stats.st_size; /* use mmap because the file will probably be big */ optarg = mmap(0, flen, PROT_READ|PROT_WRITE, MAP_PRIVATE, fd, 0); if (optarg == MAP_FAILED) ebt_print_error("Couldn't map file to memory"); if (optarg[flen-1] != '\n') ebt_print_error("File should end with a newline"); if (strchr(optarg, '\n') != optarg+flen-1) ebt_print_error("File should only contain one line"); optarg[flen-1] = '\0'; if (ebt_errormsg[0] != '\0') { munmap(argv, flen); close(fd); exit(-1); } } wh = create_wormhash(optarg); if (ebt_errormsg[0] != '\0') break; new_size = old_size+ebt_mac_wormhash_size(wh); h = malloc(sizeof(struct ebt_entry_match)+EBT_ALIGN(new_size)); if (!h) ebt_print_memory(); memcpy(h, *match, old_size+sizeof(struct ebt_entry_match)); memcpy((char *)h+old_size+sizeof(struct ebt_entry_match), wh, ebt_mac_wormhash_size(wh)); h->match_size = EBT_ALIGN(new_size); info = (struct ebt_among_info *) h->data; if (c == AMONG_DST) { info->wh_dst_ofs = old_size; } else { info->wh_src_ofs = old_size; } old_size = new_size; free(*match); *match = h; free(wh); if (c == AMONG_DST_F || c == AMONG_SRC_F) { munmap(argv, flen); close(fd); } break; default: return 0; } return 1; }
/* We use exec_style instead of #ifdef's because ebtables.so is a shared object. */ int do_command(int argc, char *argv[], int exec_style, struct ebt_u_replace *replace_) { char *buffer; int c, i; int zerochain = -1; /* Needed for the -Z option (we can have -Z <this> -L <that>) */ int chcounter; /* Needed for -C */ int policy = 0; int rule_nr = 0; int rule_nr_end = 0; struct ebt_u_target *t; struct ebt_u_match *m; struct ebt_u_watcher *w; struct ebt_u_match_list *m_l; struct ebt_u_watcher_list *w_l; struct ebt_u_entries *entries; opterr = 0; ebt_modprobe = NULL; replace = replace_; /* The daemon doesn't use the environment variable */ if (exec_style == EXEC_STYLE_PRG) { buffer = getenv(ATOMIC_ENV_VARIABLE); if (buffer) { replace->filename = malloc(strlen(buffer) + 1); if (!replace->filename) ebt_print_memory(); strcpy(replace->filename, buffer); buffer = NULL; } } replace->flags &= OPT_KERNELDATA; /* ebtablesd needs OPT_KERNELDATA */ replace->selected_chain = -1; replace->command = 'h'; if (!new_entry) { new_entry = (struct ebt_u_entry *)malloc(sizeof(struct ebt_u_entry)); if (!new_entry) ebt_print_memory(); } /* Put some sane values in our new entry */ ebt_initialize_entry(new_entry); new_entry->replace = replace; /* The scenario induced by this loop makes that: * '-t' ,'-M' and --atomic (if specified) have to come * before '-A' and the like */ /* Getopt saves the day */ while ((c = getopt_long(argc, argv, "-A:D:C:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", ebt_options, NULL)) != -1) { switch (c) { case 'A': /* Add a rule */ case 'D': /* Delete a rule */ case 'C': /* Change counters */ case 'P': /* Define policy */ case 'I': /* Insert a rule */ case 'N': /* Make a user defined chain */ case 'E': /* Rename chain */ case 'X': /* Delete chain */ /* We allow -N chainname -P policy */ if (replace->command == 'N' && c == 'P') { replace->command = c; optind--; /* No table specified */ goto handle_P; } if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->command = c; replace->flags |= OPT_COMMAND; if (!(replace->flags & OPT_KERNELDATA)) ebt_get_kernel_table(replace, 0); if (optarg && (optarg[0] == '-' || !strcmp(optarg, "!"))) ebt_print_error2("No chain name specified"); if (c == 'N') { if (ebt_get_chainnr(replace, optarg) != -1) ebt_print_error2("Chain %s already exists", optarg); else if (ebt_find_target(optarg)) ebt_print_error2("Target with name %s exists", optarg); else if (strlen(optarg) >= EBT_CHAIN_MAXNAMELEN) ebt_print_error2("Chain name length can't exceed %d", EBT_CHAIN_MAXNAMELEN - 1); else if (strchr(optarg, ' ') != NULL) ebt_print_error2("Use of ' ' not allowed in chain names"); ebt_new_chain(replace, optarg, EBT_ACCEPT); /* This is needed to get -N x -P y working */ replace->selected_chain = ebt_get_chainnr(replace, optarg); break; } else if (c == 'X') { if (optind >= argc) { replace->selected_chain = -1; ebt_delete_chain(replace); break; } if (optind < argc - 1) ebt_print_error2("No extra options allowed with -X"); if ((replace->selected_chain = ebt_get_chainnr(replace, argv[optind])) == -1) ebt_print_error2("Chain '%s' doesn't exist", argv[optind]); ebt_delete_chain(replace); if (ebt_errormsg[0] != '\0') return -1; optind++; break; } if ((replace->selected_chain = ebt_get_chainnr(replace, optarg)) == -1) ebt_print_error2("Chain '%s' doesn't exist", optarg); if (c == 'E') { if (optind >= argc) ebt_print_error2("No new chain name specified"); else if (optind < argc - 1) ebt_print_error2("No extra options allowed with -E"); else if (strlen(argv[optind]) >= EBT_CHAIN_MAXNAMELEN) ebt_print_error2("Chain name length can't exceed %d characters", EBT_CHAIN_MAXNAMELEN - 1); else if (ebt_get_chainnr(replace, argv[optind]) != -1) ebt_print_error2("Chain '%s' already exists", argv[optind]); else if (ebt_find_target(argv[optind])) ebt_print_error2("Target with name '%s' exists", argv[optind]); else if (strchr(argv[optind], ' ') != NULL) ebt_print_error2("Use of ' ' not allowed in chain names"); ebt_rename_chain(replace, argv[optind]); optind++; break; } else if (c == 'D' && optind < argc && (argv[optind][0] != '-' || (argv[optind][1] >= '0' && argv[optind][1] <= '9'))) { if (optind != argc - 1) ebt_print_error2("No extra options allowed with -D start_nr[:end_nr]"); if (parse_rule_range(argv[optind], &rule_nr, &rule_nr_end)) ebt_print_error2("Problem with the specified rule number(s) '%s'", argv[optind]); optind++; } else if (c == 'C') { if ((chcounter = parse_change_counters_rule(argc, argv, &rule_nr, &rule_nr_end, exec_style)) == -1) return -1; } else if (c == 'I') { if (optind >= argc || (argv[optind][0] == '-' && (argv[optind][1] < '0' || argv[optind][1] > '9'))) rule_nr = 1; else { rule_nr = strtol(argv[optind], &buffer, 10); if (*buffer != '\0') ebt_print_error2("Problem with the specified rule number '%s'", argv[optind]); optind++; } } else if (c == 'P') { handle_P: if (optind >= argc) ebt_print_error2("No policy specified"); for (i = 0; i < NUM_STANDARD_TARGETS; i++) if (!strcmp(argv[optind], ebt_standard_targets[i])) { policy = -i -1; if (policy == EBT_CONTINUE) ebt_print_error2("Wrong policy '%s'", argv[optind]); break; } if (i == NUM_STANDARD_TARGETS) ebt_print_error2("Unknown policy '%s'", argv[optind]); optind++; } break; case 'L': /* List */ case 'F': /* Flush */ case 'Z': /* Zero counters */ if (c == 'Z') { if ((replace->flags & OPT_ZERO) || (replace->flags & OPT_COMMAND && replace->command != 'L')) print_zero: ebt_print_error2("Command -Z only allowed together with command -L"); replace->flags |= OPT_ZERO; } else { if (replace->flags & OPT_COMMAND) ebt_print_error2("Multiple commands are not allowed"); replace->command = c; replace->flags |= OPT_COMMAND; if (replace->flags & OPT_ZERO && c != 'L') goto print_zero; } #ifdef SILENT_DAEMON if (c== 'L' && exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("-L not supported in daemon mode"); #endif if (!(replace->flags & OPT_KERNELDATA)) ebt_get_kernel_table(replace, 0); i = -1; if (optind < argc && argv[optind][0] != '-') { if ((i = ebt_get_chainnr(replace, argv[optind])) == -1) ebt_print_error2("Chain '%s' doesn't exist", argv[optind]); optind++; } if (i != -1) { if (c == 'Z') zerochain = i; else replace->selected_chain = i; } break; case 'V': /* Version */ if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->command = 'V'; if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2(PROGNAME" v"PROGVERSION" ("PROGDATE")\n"); PRINT_VERSION; exit(0); case 'M': /* Modprobe */ if (OPT_COMMANDS) ebt_print_error2("Please put the -M option earlier"); free(ebt_modprobe); ebt_modprobe = optarg; break; case 'h': /* Help */ #ifdef SILENT_DAEMON if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("-h not supported in daemon mode"); #endif if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->command = 'h'; /* All other arguments should be extension names */ while (optind < argc) { struct ebt_u_match *m; struct ebt_u_watcher *w; if (!strcasecmp("list_extensions", argv[optind])) { ebt_list_extensions(); exit(0); } if ((m = ebt_find_match(argv[optind]))) ebt_add_match(new_entry, m); else if ((w = ebt_find_watcher(argv[optind]))) ebt_add_watcher(new_entry, w); else { if (!(t = ebt_find_target(argv[optind]))) ebt_print_error2("Extension '%s' not found", argv[optind]); if (replace->flags & OPT_JUMP) ebt_print_error2("Sorry, you can only see help for one target extension at a time"); replace->flags |= OPT_JUMP; new_entry->t = (struct ebt_entry_target *)t; } optind++; } break; case 't': /* Table */ if (OPT_COMMANDS) ebt_print_error2("Please put the -t option first"); ebt_check_option2(&(replace->flags), OPT_TABLE); if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) ebt_print_error2("Table name length cannot exceed %d characters", EBT_TABLE_MAXNAMELEN - 1); strcpy(replace->name, optarg); break; case 'i': /* Input interface */ case 2 : /* Logical input interface */ case 'o': /* Output interface */ case 3 : /* Logical output interface */ case 'j': /* Target */ case 'p': /* Net family protocol */ case 's': /* Source mac */ case 'd': /* Destination mac */ case 'c': /* Set counters */ if (!OPT_COMMANDS) ebt_print_error2("No command specified"); if (replace->command != 'A' && replace->command != 'D' && replace->command != 'I' && replace->command != 'C') ebt_print_error2("Command and option do not match"); if (c == 'i') { ebt_check_option2(&(replace->flags), OPT_IN); if (replace->selected_chain > 2 && replace->selected_chain < NF_BR_BROUTING) ebt_print_error2("Use -i only in INPUT, FORWARD, PREROUTING and BROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IIN; if (strlen(optarg) >= IFNAMSIZ) big_iface_length: ebt_print_error2("Interface name length cannot exceed %d characters", IFNAMSIZ - 1); strcpy(new_entry->in, optarg); if (parse_iface(new_entry->in, "-i")) return -1; break; } else if (c == 2) { ebt_check_option2(&(replace->flags), OPT_LOGICALIN); if (replace->selected_chain > 2 && replace->selected_chain < NF_BR_BROUTING) ebt_print_error2("Use --logical-in only in INPUT, FORWARD, PREROUTING and BROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_ILOGICALIN; if (strlen(optarg) >= IFNAMSIZ) goto big_iface_length; strcpy(new_entry->logical_in, optarg); if (parse_iface(new_entry->logical_in, "--logical-in")) return -1; break; } else if (c == 'o') { ebt_check_option2(&(replace->flags), OPT_OUT); if (replace->selected_chain < 2 )//|| replace->selected_chain == NF_BR_BROUTING) ebt_print_error2("Use -o only in OUTPUT, FORWARD and POSTROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IOUT; if (strlen(optarg) >= IFNAMSIZ) goto big_iface_length; strcpy(new_entry->out, optarg); if (parse_iface(new_entry->out, "-o")) return -1; break; } else if (c == 3) { ebt_check_option2(&(replace->flags), OPT_LOGICALOUT); if (replace->selected_chain < 2 || replace->selected_chain == NF_BR_BROUTING) ebt_print_error2("Use --logical-out only in OUTPUT, FORWARD and POSTROUTING chains"); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_ILOGICALOUT; if (strlen(optarg) >= IFNAMSIZ) goto big_iface_length; strcpy(new_entry->logical_out, optarg); if (parse_iface(new_entry->logical_out, "--logical-out")) return -1; break; } else if (c == 'j') { ebt_check_option2(&(replace->flags), OPT_JUMP); for (i = 0; i < NUM_STANDARD_TARGETS; i++) if (!strcmp(optarg, ebt_standard_targets[i])) { t = ebt_find_target(EBT_STANDARD_TARGET); ((struct ebt_standard_target *) t->t)->verdict = -i - 1; break; } if (-i - 1 == EBT_RETURN && replace->selected_chain < NF_BR_NUMHOOKS) { ebt_print_error2("Return target only for user defined chains"); } else if (i != NUM_STANDARD_TARGETS) break; if ((i = ebt_get_chainnr(replace, optarg)) != -1) { if (i < NF_BR_NUMHOOKS) ebt_print_error2("Don't jump to a standard chain"); t = ebt_find_target(EBT_STANDARD_TARGET); ((struct ebt_standard_target *) t->t)->verdict = i - NF_BR_NUMHOOKS; break; } else { /* Must be an extension then */ struct ebt_u_target *t; t = ebt_find_target(optarg); /* -j standard not allowed either */ if (!t || t == (struct ebt_u_target *)new_entry->t) ebt_print_error2("Illegal target name '%s'", optarg); new_entry->t = (struct ebt_entry_target *)t; ebt_find_target(EBT_STANDARD_TARGET)->used = 0; t->used = 1; } break; } else if (c == 's') { ebt_check_option2(&(replace->flags), OPT_SOURCE); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_ISOURCE; if (ebt_get_mac_and_mask(optarg, new_entry->sourcemac, new_entry->sourcemsk)) ebt_print_error2("Problem with specified source mac '%s'", optarg); new_entry->bitmask |= EBT_SOURCEMAC; break; } else if (c == 'd') { ebt_check_option2(&(replace->flags), OPT_DEST); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IDEST; if (ebt_get_mac_and_mask(optarg, new_entry->destmac, new_entry->destmsk)) ebt_print_error2("Problem with specified destination mac '%s'", optarg); new_entry->bitmask |= EBT_DESTMAC; break; } else if (c == 'c') { ebt_check_option2(&(replace->flags), OPT_COUNT); if (ebt_check_inverse2(optarg)) ebt_print_error2("Unexpected '!' after -c"); if (optind >= argc || optarg[0] == '-' || argv[optind][0] == '-') ebt_print_error2("Option -c needs 2 arguments"); new_entry->cnt.pcnt = strtoull(optarg, &buffer, 10); if (*buffer != '\0') ebt_print_error2("Packet counter '%s' invalid", optarg); new_entry->cnt.bcnt = strtoull(argv[optind], &buffer, 10); if (*buffer != '\0') ebt_print_error2("Packet counter '%s' invalid", argv[optind]); optind++; break; } ebt_check_option2(&(replace->flags), OPT_PROTOCOL); if (ebt_check_inverse2(optarg)) new_entry->invflags |= EBT_IPROTO; new_entry->bitmask &= ~((unsigned int)EBT_NOPROTO); i = strtol(optarg, &buffer, 16); if (*buffer == '\0' && (i < 0 || i > 0xFFFF)) ebt_print_error2("Problem with the specified protocol"); if (*buffer != '\0') { struct ethertypeent *ent; if (!strcasecmp(optarg, "LENGTH")) { new_entry->bitmask |= EBT_802_3; break; } ent = getethertypebyname(optarg); if (!ent) ebt_print_error2("Problem with the specified Ethernet protocol '%s', perhaps "_PATH_ETHERTYPES " is missing", optarg); new_entry->ethproto = ent->e_ethertype; } else new_entry->ethproto = i; if (new_entry->ethproto < 0x0600) ebt_print_error2("Sorry, protocols have values above or equal to 0x0600"); break; case 4 : /* Lc */ #ifdef SILENT_DAEMON if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("--Lc is not supported in daemon mode"); #endif ebt_check_option2(&(replace->flags), LIST_C); if (replace->command != 'L') ebt_print_error("Use --Lc with -L"); replace->flags |= LIST_C; break; case 5 : /* Ln */ #ifdef SILENT_DAEMON if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("--Ln is not supported in daemon mode"); #endif ebt_check_option2(&(replace->flags), LIST_N); if (replace->command != 'L') ebt_print_error2("Use --Ln with -L"); if (replace->flags & LIST_X) ebt_print_error2("--Lx is not compatible with --Ln"); replace->flags |= LIST_N; break; case 6 : /* Lx */ #ifdef SILENT_DAEMON if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("--Lx is not supported in daemon mode"); #endif ebt_check_option2(&(replace->flags), LIST_X); if (replace->command != 'L') ebt_print_error2("Use --Lx with -L"); if (replace->flags & LIST_N) ebt_print_error2("--Lx is not compatible with --Ln"); replace->flags |= LIST_X; break; case 12 : /* Lmac2 */ #ifdef SILENT_DAEMON if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error("--Lmac2 is not supported in daemon mode"); #endif ebt_check_option2(&(replace->flags), LIST_MAC2); if (replace->command != 'L') ebt_print_error2("Use --Lmac2 with -L"); replace->flags |= LIST_MAC2; break; case 8 : /* atomic-commit */ if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("--atomic-commit is not supported in daemon mode"); replace->command = c; if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); replace->flags |= OPT_COMMAND; if (!replace->filename) ebt_print_error2("No atomic file specified"); /* Get the information from the file */ ebt_get_table(replace, 0); /* We don't want the kernel giving us its counters, * they would overwrite the counters extracted from * the file */ replace->num_counters = 0; /* Make sure the table will be written to the kernel */ free(replace->filename); replace->filename = NULL; break; case 7 : /* atomic-init */ case 10: /* atomic-save */ case 11: /* init-table */ if (exec_style == EXEC_STYLE_DAEMON) { if (c == 7) { ebt_print_error2("--atomic-init is not supported in daemon mode"); } else if (c == 10) ebt_print_error2("--atomic-save is not supported in daemon mode"); ebt_print_error2("--init-table is not supported in daemon mode"); } replace->command = c; if (OPT_COMMANDS) ebt_print_error2("Multiple commands are not allowed"); if (c != 11 && !replace->filename) ebt_print_error2("No atomic file specified"); replace->flags |= OPT_COMMAND; { char *tmp = replace->filename; /* Get the kernel table */ replace->filename = NULL; ebt_get_kernel_table(replace, c == 10 ? 0 : 1); replace->filename = tmp; } break; case 9 : /* atomic */ if (exec_style == EXEC_STYLE_DAEMON) ebt_print_error2("--atomic is not supported in daemon mode"); if (OPT_COMMANDS) ebt_print_error2("--atomic has to come before the command"); /* A possible memory leak here, but this is not * executed in daemon mode */ replace->filename = (char *)malloc(strlen(optarg) + 1); strcpy(replace->filename, optarg); break; case 13 : /* concurrent */ signal(SIGINT, sighandler); signal(SIGTERM, sighandler); use_lockfd = 1; break; case 1 : if (!strcmp(optarg, "!")) ebt_check_inverse2(optarg); else ebt_print_error2("Bad argument : '%s'", optarg); /* ebt_check_inverse() did optind++ */ optind--; continue; default: /* Is it a target option? */ t = (struct ebt_u_target *)new_entry->t; if ((t->parse(c - t->option_offset, argv, argc, new_entry, &t->flags, &t->t))) { if (ebt_errormsg[0] != '\0') return -1; goto check_extension; } /* Is it a match_option? */ for (m = ebt_matches; m; m = m->next) if (m->parse(c - m->option_offset, argv, argc, new_entry, &m->flags, &m->m)) break; if (m != NULL) { if (ebt_errormsg[0] != '\0') return -1; if (m->used == 0) { ebt_add_match(new_entry, m); m->used = 1; } goto check_extension; } /* Is it a watcher option? */ for (w = ebt_watchers; w; w = w->next) if (w->parse(c - w->option_offset, argv, argc, new_entry, &w->flags, &w->w)) break; if (w == NULL && c == '?') ebt_print_error2("Unknown argument: '%s'", argv[optind - 1], (char)optopt, (char)c); else if (w == NULL) { if (!strcmp(t->name, "standard")) ebt_print_error2("Unknown argument: don't forget the -t option"); else ebt_print_error2("Target-specific option does not correspond with specified target"); } if (ebt_errormsg[0] != '\0') return -1; if (w->used == 0) { ebt_add_watcher(new_entry, w); w->used = 1; } check_extension: if (replace->command != 'A' && replace->command != 'I' && replace->command != 'D' && replace->command != 'C') ebt_print_error2("Extensions only for -A, -I, -D and -C"); } ebt_invert = 0; } /* Just in case we didn't catch an error */ if (ebt_errormsg[0] != '\0') return -1; if (!(table = ebt_find_table(replace->name))) ebt_print_error2("Bad table name"); if (replace->command == 'h' && !(replace->flags & OPT_ZERO)) { print_help(); if (exec_style == EXEC_STYLE_PRG) exit(0); } /* Do the final checks */ if (replace->command == 'A' || replace->command == 'I' || replace->command == 'D' || replace->command == 'C') { /* This will put the hook_mask right for the chains */ ebt_check_for_loops(replace); if (ebt_errormsg[0] != '\0') return -1; entries = ebt_to_chain(replace); m_l = new_entry->m_list; w_l = new_entry->w_list; t = (struct ebt_u_target *)new_entry->t; while (m_l) { m = (struct ebt_u_match *)(m_l->m); m->final_check(new_entry, m->m, replace->name, entries->hook_mask, 0); if (ebt_errormsg[0] != '\0') return -1; m_l = m_l->next; } while (w_l) { w = (struct ebt_u_watcher *)(w_l->w); w->final_check(new_entry, w->w, replace->name, entries->hook_mask, 0); if (ebt_errormsg[0] != '\0') return -1; w_l = w_l->next; } t->final_check(new_entry, t->t, replace->name, entries->hook_mask, 0); if (ebt_errormsg[0] != '\0') return -1; } /* So, the extensions can work with the host endian. * The kernel does not have to do this of course */ new_entry->ethproto = htons(new_entry->ethproto); if (replace->command == 'P') { if (replace->selected_chain < NF_BR_NUMHOOKS && policy == EBT_RETURN) ebt_print_error2("Policy RETURN only allowed for user defined chains"); ebt_change_policy(replace, policy); if (ebt_errormsg[0] != '\0') return -1; } else if (replace->command == 'L') { list_rules(); if (!(replace->flags & OPT_ZERO) && exec_style == EXEC_STYLE_PRG) exit(0); } if (replace->flags & OPT_ZERO) { replace->selected_chain = zerochain; ebt_zero_counters(replace); } else if (replace->command == 'F') { ebt_flush_chains(replace); } else if (replace->command == 'A' || replace->command == 'I') { ebt_add_rule(replace, new_entry, rule_nr); if (ebt_errormsg[0] != '\0') return -1; /* Makes undoing the add easier (jumps to delete_the_rule) */ if (rule_nr <= 0) rule_nr--; rule_nr_end = rule_nr; /* a jump to a udc requires checking for loops */ if (!strcmp(new_entry->t->u.name, EBT_STANDARD_TARGET) && ((struct ebt_standard_target *)(new_entry->t))->verdict >= 0) { /* FIXME: this can be done faster */ ebt_check_for_loops(replace); if (ebt_errormsg[0] != '\0') goto delete_the_rule; } /* Do the final_check(), for all entries. * This is needed when adding a rule that has a chain target */ i = -1; while (++i != replace->num_chains) { struct ebt_u_entry *e; entries = replace->chains[i]; if (!entries) { if (i < NF_BR_NUMHOOKS) continue; else ebt_print_bug("whoops\n"); } e = entries->entries->next; while (e != entries->entries) { /* Userspace extensions use host endian */ e->ethproto = ntohs(e->ethproto); ebt_do_final_checks(replace, e, entries); if (ebt_errormsg[0] != '\0') goto delete_the_rule; e->ethproto = htons(e->ethproto); e = e->next; } } /* Don't reuse the added rule */ new_entry = NULL; } else if (replace->command == 'D') { delete_the_rule: ebt_delete_rule(replace, new_entry, rule_nr, rule_nr_end); if (ebt_errormsg[0] != '\0') return -1; } else if (replace->command == 'C') { ebt_change_counters(replace, new_entry, rule_nr, rule_nr_end, &(new_entry->cnt_surplus), chcounter); if (ebt_errormsg[0] != '\0') return -1; } /* Commands -N, -E, -X, --atomic-commit, --atomic-commit, --atomic-save, * --init-table fall through */ if (ebt_errormsg[0] != '\0') return -1; if (table->check) table->check(replace); if (exec_style == EXEC_STYLE_PRG) {/* Implies ebt_errormsg[0] == '\0' */ ebt_deliver_table(replace); if (replace->nentries) ebt_deliver_counters(replace); } return 0; }