--- ebtables-v2.0-rc1/Makefile	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/Makefile	Sun Aug 11 17:28:10 2002
@@ -2,7 +2,8 @@
 
 KERNEL_DIR?=/usr/src/linux
 PROGNAME:=ebtables
-PROGVERSION:="2.0-rc1 (July 2002)"
+PROGVERSION:="2.0-rc2"
+PROGDATE:="August 2002"
 
 MANDIR?=/usr/local/man
 CFLAGS:=-Wall -Wunused
@@ -22,8 +23,6 @@
 	mkdir -p /usr/include/linux/netfilter_bridge
 	cp -f $(KERNEL_DIR)/include/linux/netfilter_bridge/* \
 		/usr/include/linux/netfilter_bridge/
-	cp -f $(KERNEL_DIR)/include/linux/br_db.h \
-		/usr/include/linux/br_db.h
 	cp -f $(KERNEL_DIR)/include/linux/netfilter_bridge.h \
 		/usr/include/linux/netfilter_bridge.h
 	cp -f $(KERNEL_DIR)/include/linux/if_ether.h \
@@ -35,11 +34,11 @@
 	ln -fs $(KERNEL_DIR)/include/linux /usr/include/linux
 
 communication.o: communication.c include/ebtables_u.h
-	$(CC) $(CFLAGS) -c -o $@ $<
+	$(CC) $(CFLAGS) -DPROGVERSION=\"$(PROGVERSION)\" -c -o $@ $<
 
 ebtables.o: ebtables.c include/ebtables_u.h
 	$(CC) $(CFLAGS) -DPROGVERSION=\"$(PROGVERSION)\" \
-	-DPROGNAME=\"$(PROGNAME)\" -c -o $@ $<
+	-DPROGNAME=\"$(PROGNAME)\" -DPROGDATE=\"$(PROGDATE)\" -c -o $@ $<
 
 ebtables: ebtables.o communication.o $(EXT_OBJS)
 	$(CC) $(CFLAGS) -o $@ $^
--- ebtables-v2.0-rc1/ebtables.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/ebtables.c	Sat Aug 24 20:32:04 2002
@@ -23,20 +23,28 @@
 
 #include <getopt.h>
 #include <string.h>
-#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <sys/socket.h>
-#include <sys/types.h>
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/br_db.h> // the database
-#include <netinet/in.h>
+#include <stdarg.h>
 #include <netinet/ether.h>
 #include "include/ebtables_u.h"
 #include <unistd.h>
 #include <fcntl.h>
 #include <sys/wait.h>
 
+// Don't use this function, use print_bug()
+void __print_bug(char *file, int line, char *format, ...)
+{
+	va_list l;
+
+	va_start(l, format);
+	printf(PROGNAME" v"PROGVERSION":%s:%d:--BUG--: \n", file, line);
+	vprintf(format, l);
+	printf("\n");
+	va_end(l);
+	exit (-1);
+}
+
 // here are the number-name correspondences kept for the Ethernet
 // frame type field
 #define PROTOCOLFILE "/etc/ethertypes"
@@ -45,11 +53,6 @@
 #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
 #endif
 
-#define DATABASEHOOKNR -2
-#define DATABASEHOOKNAME "DB"
-
-static char *prog_name = PROGNAME;
-static char *prog_version = PROGVERSION;
 char *hooknames[NF_BR_NUMHOOKS] =
 {
 	[NF_BR_PRE_ROUTING]"PREROUTING",
@@ -193,7 +196,7 @@
 	// on CONTINUE
 	e->t = (struct ebt_entry_target *)find_target(EBT_STANDARD_TARGET);
 	if (!e->t)
-		print_bug("Couldn't load standard target\n");
+		print_bug("Couldn't load standard target");
 }
 
 // this doesn't free e, becoz the calling function might need e->next
@@ -432,6 +435,7 @@
 
 // translate a hexadecimal number to a protocol name, parsing /etc/ethertypes
 // returns 0 on success
+// this demands the name buffer to be of size at least 21
 int number_to_name(unsigned short proto, char *name)
 {
 	FILE *ifp;
@@ -476,9 +480,9 @@
 		printf("ebtables -t %s -P %s %s\n", replace.name,
 		   entries->name, standard_targets[-entries->policy - 1]);
 	} else if (!(replace.flags & LIST_X)) {
-		printf("\nBridge chain: %s\nPolicy: %s\n", entries->name,
+		printf("\nBridge chain: %s, entries: %d, policy: %s\n",
+		   entries->name, entries->nentries,
 		   standard_targets[-entries->policy - 1]);
-		printf("nr. of entries: %d \n", entries->nentries);
 	}
 
 	i = entries->nentries;
@@ -759,10 +763,6 @@
 	int i;
 	struct ebt_u_chain_list *cl = replace.udc;
 
-	// database is special case (not really a chain)
-	if (!strcmp(arg, DATABASEHOOKNAME))
-		return DATABASEHOOKNR;
-
 	for (i = 0; i < NF_BR_NUMHOOKS; i++) {
 		if (!(replace.valid_hooks & (1 << i)))
 			continue;
@@ -784,27 +784,25 @@
 	struct ebt_u_match_list *m_l;
 	struct ebt_u_watcher_list *w_l;
 
-	printf(
-"%s v%s\n"
+	printf(PROGNAME" v"PROGVERSION" ("PROGDATE")\n"
 "Usage:\n"
 "ebtables -[ADI] chain rule-specification [options]\n"
 "ebtables -P chain target\n"
 "ebtables -[LFZ] [chain]\n"
 "ebtables -[b] [y,n]\n"
 "Commands:\n"
-"--append -A chain             : Append to chain\n"
-"--delete -D chain             : Delete matching rule from chain\n"
-"--delete -D chain rulenum     : Delete rule at position rulenum from chain\n"
+"--append -A chain             : append to chain\n"
+"--delete -D chain             : delete matching rule from chain\n"
+"--delete -D chain rulenum     : delete rule at position rulenum from chain\n"
 "--insert -I chain rulenum     : insert rule at position rulenum in chain\n"
-"--list   -L [chain]           : List the rules in a chain or in all chains\n"
-"--list   -L "DATABASEHOOKNAME"                : List the database (if present)\n"
-"--flush  -F [chain]           : Delete all rules in chain or in all chains\n"
-"--init-table                  : Replace the kernel table with the initial table\n"
-"--zero   -Z [chain]           : Put counters on zero in chain or in all chains\n"
-"--policy -P chain target      : Change policy on chain to target\n"
-"--new-chain -N chain          : Create a user defined chain\n"
-"--rename-chain -E old new     : Rename a chain\n"
-"--delete-chain -X chain       : Delete a user defined chain\n"
+"--list   -L [chain]           : list the rules in a chain or in all chains\n"
+"--flush  -F [chain]           : delete all rules in chain or in all chains\n"
+"--init-table                  : replace the kernel table with the initial table\n"
+"--zero   -Z [chain]           : put counters on zero in chain or in all chains\n"
+"--policy -P chain target      : change policy on chain to target\n"
+"--new-chain -N chain          : create a user defined chain\n"
+"--rename-chain -E old new     : rename a chain\n"
+"--delete-chain -X chain       : delete a user defined chain\n"
 "--atomic-commit file          : update the kernel w/ the table contained in file\n"
 "--atomic-init file            : put the initial kernel table into file\n"
 "--atomic-save file            : put the current kernel table into file\n"
@@ -819,9 +817,7 @@
 "--logical-out [!] name        : logical bridge output interface name\n"
 "--modprobe -M program         : try to insert modules using this program\n"
 "--version -V                  : print package version\n"
-"\n" ,
-	prog_name,
-	prog_version);
+"\n");
 
 	m_l = new_entry->m_list;
 	while (m_l) {
@@ -1311,66 +1307,6 @@
 	}
 }
 
-// list the database (optionally compiled into the kernel)
-static void list_db()
-{
-	struct brdb_dbinfo nr;
-	struct brdb_dbentry *db;
-	char name[21];
-	int i;
-
-	get_dbinfo(&nr);
-
-	// 0 : database disabled (-db n)
-	if (!(nr.nentries))
-		print_error("Database not present"
-		            " (disabled), try ebtables --db y");
-	nr.nentries--;
-	if (!nr.nentries) print_error("Database empty");
-	if ( !(db = (struct brdb_dbentry *)
-	   malloc(nr.nentries * sizeof(struct brdb_dbentry))) )
-		print_memory();
-
-	get_db(nr.nentries, db);
-	printf("number of entries: %d\n", nr.nentries);
-	for (i = 0; i < nr.nentries; i++) {
-		printf(
-		"%d:\n"
-		"hook    : %s\n"
-		"in-if   : %s\n"
-		"out-if  : %s\n"
-		"protocol: ", i + 1, hooknames[db->hook], db->in, db->out);
-		if (db->ethproto == IDENTIFY802_3)
-			printf("802.2/802.3 STYLE LENGTH FIELD\n");
-		else {
-			if (number_to_name(ntohs(db->ethproto), name))
-				printf("%x\n",ntohs(db->ethproto));
-			else
-				printf("%s\n", name);
-		}
-		db++;
-	}
-	exit(0);
-}
-
-// handle db [dis,en]abling
-static void allowdb(char yorn)
-{
-	__u16 decision;
-
-	if (yorn != 'y' && yorn != 'n')
-		print_error("Option [y] or [n] needed");
-
-	if (yorn == 'y')
-		decision = BRDB_DB;
-	else
-		decision = BRDB_NODB;
-
-	deliver_allowdb(&decision);
-
-	exit(0);
-}
-
 //  0 == success
 //  1 == success, but for the special 'protocol' LENGTH
 // -1 == failure
@@ -1526,8 +1462,14 @@
 			print_error("The kernel doesn't support the ebtables "
 			"%s table", replace.name);
 	}
+	// when listing a table contained in a file, we don't expect the user
+	// to know what the table's name is
+	if ( !(table = find_table(replace.name)) )
+		print_error("Bad table name");
 }
 
+#define print_if_l_error print_error("Interface name length must be less " \
+   "than %d", IFNAMSIZ)
 #define OPT_COMMAND    0x01
 #define OPT_TABLE      0x02
 #define OPT_IN         0x04
@@ -1542,7 +1484,7 @@
 // the main thing
 int main(int argc, char *argv[])
 {
-	char *buffer, allowbc = 'n';
+	char *buffer;
 	int c, i;
 	// this special one for the -Z option (we can have -Z <this> -L <that>)
 	int zerochain = -1;
@@ -1576,7 +1518,7 @@
 
 	// getopt saves the day
 	while ((c = getopt_long(argc, argv,
-	   "-A:D:I:N:E:X:L::Z::F::P:Vhi:o:j:p:b:s:d:t:M:", ebt_options, NULL)) != -1) {
+	   "-A:D:I:N:E:X:L::Z::F::P:Vhi:o:j:p:s:d:t:M:", ebt_options, NULL)) != -1) {
 		switch (c) {
 
 		case 'A': // add a rule
@@ -1738,7 +1680,7 @@
 			replace.command = 'V';
 			if (replace.flags & OPT_COMMAND)
 				print_error("Multiple commands not allowed");
-			printf("%s, %s\n", prog_name, prog_version);
+			printf(PROGNAME" v"PROGVERSION" ("PROGDATE")\n");
 			exit(0);
 
 		case 'M': // modprobe
@@ -1812,7 +1754,7 @@
 					print_error("No in-interface "
 					            "specified");
 				if (strlen(argv[optind - 1]) >= IFNAMSIZ)
-					print_error("Illegal interface length");
+					print_if_l_error;
 				strcpy(new_entry->in, argv[optind - 1]);
 				break;
 			}
@@ -1830,7 +1772,7 @@
 					print_error("No logical in-interface "
 					            "specified");
 				if (strlen(argv[optind - 1]) >= IFNAMSIZ)
-					print_error("Illegal interface length");
+					print_if_l_error;
 				strcpy(new_entry->logical_in, argv[optind - 1]);
 				break;
 			}
@@ -1848,8 +1790,7 @@
 					            "specified");
 
 				if (strlen(argv[optind - 1]) >= IFNAMSIZ)
-					print_error("Illegal interface "
-					            "length");
+					print_if_l_error;
 				strcpy(new_entry->out, argv[optind - 1]);
 				break;
 			}
@@ -1867,8 +1808,7 @@
 					            "specified");
 
 				if (strlen(argv[optind - 1]) >= IFNAMSIZ)
-					print_error("Illegal interface "
-					            "length");
+					print_if_l_error;
 				strcpy(new_entry->logical_out,
 				   argv[optind - 1]);
 				break;
@@ -1972,18 +1912,8 @@
 				            " or equal to 0x0600");
 			break;
 
-		case 'b': // allow database?
-			if (replace.flags & OPT_COMMAND)
-				print_error("Multiple commands not allowed");
-			replace.command = c;
-			allowbc = *optarg;
-			break;
-
 		case 4  : // Lc
 			check_option(&replace.flags, LIST_C);
-			if (replace.selected_hook == DATABASEHOOKNR)
-				print_error("--Lc not valid for listing"
-				   " the database");
 			if (replace.command != 'L')
 				print_error("Use --Lc with -L");
 			if (replace.flags & LIST_X)
@@ -1992,9 +1922,6 @@
 			break;
 		case 5  : // Ln
 			check_option(&replace.flags, LIST_N);
-			if (replace.selected_hook == DATABASEHOOKNR)
-				print_error("--Ln not valid for listing"
-				   " the database");
 			if (replace.command != 'L')
 				print_error("Use --Ln with -L");
 			if (replace.flags & LIST_X)
@@ -2003,9 +1930,6 @@
 			break;
 		case 6  : // Lx
 			check_option(&replace.flags, LIST_X);
-			if (replace.selected_hook == DATABASEHOOKNR)
-				print_error("--Lx not valid for listing"
-				   " the database");
 			if (replace.command != 'L')
 				print_error("Use --Lx with -L");
 			if (replace.flags & LIST_C)
@@ -2039,6 +1963,7 @@
 			// make sure the table will be written to the kernel
 			free(replace.filename);
 			replace.filename = NULL;
+			ebtables_insmod("ebtables", modprobe);
 			break;
 		case 7 : // atomic-init
 		case 10: // atomic-save
@@ -2106,11 +2031,6 @@
 
 	if ( !table && !(table = find_table(replace.name)) )
 		print_error("Bad table name");
-	// database stuff before ebtables stuff
-	if (replace.command == 'b')
-		allowdb(allowbc);
-	if (replace.command == 'L' && replace.selected_hook == DATABASEHOOKNR)
-		list_db();
 
 	if ( (replace.flags & OPT_COMMAND) && replace.command != 'L' &&
 	   replace.flags & OPT_ZERO )
@@ -2148,9 +2068,13 @@
 	// the kernel does not have to do this ofcourse
 	new_entry->ethproto = htons(new_entry->ethproto);
 
-	if (replace.command == 'P')
+	if (replace.command == 'P') {
+		if (replace.selected_hook < NF_BR_NUMHOOKS &&
+		   policy == EBT_RETURN)
+			print_error("Policy RETURN only allowed for user "
+			            "defined chains");
 		change_policy(policy);
-	else if (replace.command == 'L') {
+	} else if (replace.command == 'L') {
 		list_rules();
 		if (replace.flags & OPT_ZERO)
 			zero_counters(zerochain);
--- ebtables-v2.0-rc1/communication.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/communication.c	Sat Aug 24 20:33:51 2002
@@ -17,9 +17,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/socket.h>
-#include <linux/netfilter_bridge/ebtables.h>
-#include <linux/br_db.h>
-#include <netinet/in.h> // IPPROTO_IP
 #include "include/ebtables_u.h"
 
 extern char* hooknames[NF_BR_NUMHOOKS];
@@ -32,7 +29,8 @@
 		sockfd = socket(AF_INET, SOCK_RAW, PF_INET);
 		if (sockfd < 0)
 			print_error("Problem getting a socket, "
-			   "do you have the right permissions?");
+			   "you probably don't have the right "
+			   "permissions");
 	}
 }
 
@@ -556,7 +554,7 @@
    char command)
 {
 	FILE *file;
-	char *hlp;
+	char *hlp = NULL;
 	int size;
 
 	if (!(file = fopen(filename, "r+b")))
@@ -658,9 +656,11 @@
 	struct ebt_u_entry **u_e;
 
 	strcpy(repl.name, u_repl->name);
-	if (u_repl->filename != NULL)
+	if (u_repl->filename != NULL) {
 		retrieve_from_file(u_repl->filename, &repl, u_repl->command);
-	else if (retrieve_from_kernel(&repl, u_repl->command) == -1)
+		// -L with a wrong table name should be dealt with silently
+		strcpy(u_repl->name, repl.name);
+	} else if (retrieve_from_kernel(&repl, u_repl->command) == -1)
 		return -1;
 
 	// translate the struct ebt_replace to a struct ebt_u_replace
@@ -682,38 +682,4 @@
 	if (k != u_repl->nentries)
 		print_bug("Wrong total nentries");
 	return 0;
-}
-
-void get_dbinfo(struct brdb_dbinfo *nr)
-{
-	socklen_t optlen = sizeof(struct brdb_dbinfo);
-
-	get_sockfd();
-
-	if (getsockopt(sockfd, IPPROTO_IP, BRDB_SO_GET_DBINFO, nr, &optlen))
-		print_error("Sorry, br_db code probably not in kernel, "
-		            "try insmod br_db");
-}
-
-void get_db(int len, struct brdb_dbentry *db)
-{
-	socklen_t optlen = len;
-
-	get_sockfd();
-
-	if ( getsockopt(sockfd, IPPROTO_IP, BRDB_SO_GET_DB, db, &optlen) ) {
-		print_bug("hmm, what is wrong??? bug#2");
-	}
-}
-
-void deliver_allowdb(__u16 *decision)
-{
-	socklen_t optlen = sizeof(__u16);
-
-	get_sockfd();
-
-	if (setsockopt(sockfd, IPPROTO_IP, BRDB_SO_SET_ALLOWDB,
-	   decision, optlen))
-		print_error("Sorry, br_db code probably not in kernel, "
-		            "try insmod br_db");
 }
--- ebtables-v2.0-rc1/extensions/ebt_redirect.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/extensions/ebt_redirect.c	Sat Aug 24 15:31:38 2002
@@ -1,14 +1,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
 #include <linux/netfilter_bridge/ebt_redirect.h>
 
-extern char *standard_targets[NUM_STANDARD_TARGETS];
-
 #define REDIRECT_TARGET '1'
 static struct option opts[] =
 {
@@ -37,19 +33,13 @@
    const struct ebt_u_entry *entry, unsigned int *flags,
    struct ebt_entry_target **target)
 {
-	int i;
 	struct ebt_redirect_info *redirectinfo =
 	   (struct ebt_redirect_info *)(*target)->data;
 
 	switch (c) {
 	case REDIRECT_TARGET:
 		check_option(flags, OPT_REDIRECT_TARGET);
-		for (i = 0; i < NUM_STANDARD_TARGETS; i++)
-			if (!strcmp(optarg, standard_targets[i])) {
-				redirectinfo->target = -i - 1;
-				break;
-			}
-		if (i == NUM_STANDARD_TARGETS)
+		if (FILL_TARGET(optarg, redirectinfo->target))
 			print_error("Illegal --redirect-target target");
 		break;
 	default:
@@ -60,17 +50,17 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_target *target, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 	struct ebt_redirect_info *redirectinfo =
 	   (struct ebt_redirect_info *)target->data;
 
-	if ((hook_mask & (1 << NF_BR_NUMHOOKS)) &&
-	   redirectinfo->target == EBT_RETURN)
-		print_error("--redirect-target RETURN not allowed on base chain");
-	hook_mask &= ~(1 << NF_BR_NUMHOOKS);
-	if ( ((hook_mask & ~(1 << NF_BR_PRE_ROUTING)) || strcmp(name, "nat")) &&
-	   ((hook_mask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute")) )
+	if (BASE_CHAIN && redirectinfo->target == EBT_RETURN)
+		print_error("--redirect-target RETURN not allowed on "
+		            "base chain");
+	CLEAR_BASE_CHAIN_BIT;
+	if ( ((hookmask & ~(1 << NF_BR_PRE_ROUTING)) || strcmp(name, "nat")) &&
+	   ((hookmask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute")) )
 		print_error("Wrong chain for redirect");
 }
 
@@ -82,8 +72,7 @@
 
 	if (redirectinfo->target == EBT_ACCEPT)
 		return;
-	printf(" --redirect-target %s",
-	   standard_targets[-redirectinfo->target - 1]);
+	printf(" --redirect-target %s", TARGET_NAME(redirectinfo->target));
 }
 
 static int compare(const struct ebt_entry_target *t1,
@@ -107,7 +96,7 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
 static void _init(void) __attribute__ ((constructor));
--- ebtables-v2.0-rc1/extensions/ebtable_broute.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/extensions/ebtable_broute.c	Tue Aug 13 12:59:14 2002
@@ -1,5 +1,4 @@
 #include <stdio.h>
-#include <sys/socket.h>
 #include "../include/ebtables_u.h"
 
 
--- ebtables-v2.0-rc1/extensions/ebt_nat.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/extensions/ebt_nat.c	Sat Aug 24 15:31:03 2002
@@ -1,16 +1,12 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <netinet/ether.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
 #include <linux/netfilter_bridge/ebt_nat.h>
 
-extern char *standard_targets[NUM_STANDARD_TARGETS];
-
-int to_source_supplied, to_dest_supplied;
+static int to_source_supplied, to_dest_supplied;
 
 #define NAT_S '1'
 #define NAT_D '1'
@@ -20,7 +16,7 @@
 {
 	{ "to-source"     , required_argument, 0, NAT_S },
 	{ "to-src"        , required_argument, 0, NAT_S },
-	{ "snat-target"    , required_argument, 0, NAT_S_TARGET },
+	{ "snat-target"   , required_argument, 0, NAT_S_TARGET },
 	{ 0 }
 };
 
@@ -28,7 +24,7 @@
 {
 	{ "to-destination", required_argument, 0, NAT_D },
 	{ "to-dst"        , required_argument, 0, NAT_D },
-	{ "dnat-target"    , required_argument, 0, NAT_D_TARGET },
+	{ "dnat-target"   , required_argument, 0, NAT_D_TARGET },
 	{ 0 }
 };
 
@@ -72,7 +68,6 @@
    const struct ebt_u_entry *entry, unsigned int *flags,
    struct ebt_entry_target **target)
 {
-	int i;
 	struct ebt_nat_info *natinfo = (struct ebt_nat_info *)(*target)->data;
 	struct ether_addr *addr;
 
@@ -86,12 +81,7 @@
 		break;
 	case NAT_S_TARGET:
 		check_option(flags, OPT_SNAT_TARGET);
-		for (i = 0; i < NUM_STANDARD_TARGETS; i++)
-			if (!strcmp(optarg, standard_targets[i])) {
-				natinfo->target = -i - 1;
-				break;
-			}
-		if (i == NUM_STANDARD_TARGETS)
+		if (FILL_TARGET(optarg, natinfo->target))
 			print_error("Illegal --snat-target target");
 		break;
 	default:
@@ -106,7 +96,6 @@
    const struct ebt_u_entry *entry, unsigned int *flags,
    struct ebt_entry_target **target)
 {
-	int i;
 	struct ebt_nat_info *natinfo = (struct ebt_nat_info *)(*target)->data;
 	struct ether_addr *addr;
 
@@ -121,12 +110,7 @@
 		break;
 	case NAT_D_TARGET:
 		check_option(flags, OPT_DNAT_TARGET);
-		for (i = 0; i < NUM_STANDARD_TARGETS; i++)
-			if (!strcmp(optarg, standard_targets[i])) {
-				natinfo->target = -i - 1;
-				break;
-			}
-		if (i == NUM_STANDARD_TARGETS)
+		if (FILL_TARGET(optarg, natinfo->target))
 			print_error("Illegal --dnat-target target");
 		break;
 	default:
@@ -137,14 +121,14 @@
 
 static void final_check_s(const struct ebt_u_entry *entry,
    const struct ebt_entry_target *target, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 	struct ebt_nat_info *natinfo = (struct ebt_nat_info *)target->data;
 
-	if ((hook_mask & (1 << NF_BR_NUMHOOKS)) && natinfo->target == EBT_RETURN)
+	if (BASE_CHAIN && natinfo->target == EBT_RETURN)
 		print_error("--snat-target RETURN not allowed on base chain");
-	hook_mask &= ~(1 << NF_BR_NUMHOOKS);
-	if (!(hook_mask & (1 << NF_BR_POST_ROUTING)) || strcmp(name, "nat"))
+	CLEAR_BASE_CHAIN_BIT;
+	if ((hookmask & ~(1 << NF_BR_POST_ROUTING)) || strcmp(name, "nat"))
 		print_error("Wrong chain for snat");
 	if (time == 0 && to_source_supplied == 0)
 		print_error("No snat address supplied");
@@ -152,16 +136,16 @@
 
 static void final_check_d(const struct ebt_u_entry *entry,
    const struct ebt_entry_target *target, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 	struct ebt_nat_info *natinfo = (struct ebt_nat_info *)target->data;
 
-	if ((hook_mask & (1 << NF_BR_NUMHOOKS)) && natinfo->target == EBT_RETURN)
+	if (BASE_CHAIN && natinfo->target == EBT_RETURN)
 		print_error("--dnat-target RETURN not allowed on base chain");
-	hook_mask &= ~(1 << NF_BR_NUMHOOKS);
-	if (((hook_mask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT))) ||
-	   strcmp(name, "nat")) &&
-	   ((hook_mask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute")))
+	CLEAR_BASE_CHAIN_BIT;
+	if (((hookmask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT)))
+	   || strcmp(name, "nat")) &&
+	   ((hookmask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute")))
 		print_error("Wrong chain for dnat");
 	if (time == 0 && to_dest_supplied == 0)
 		print_error("No dnat address supplied");
@@ -174,7 +158,7 @@
 
 	printf("--to-src ");
 	printf("%s", ether_ntoa((struct ether_addr *)natinfo->mac));
-	printf(" --snat-target %s", standard_targets[-natinfo->target - 1]);
+	printf(" --snat-target %s", TARGET_NAME(natinfo->target));
 }
 
 static void print_d(const struct ebt_u_entry *entry,
@@ -184,7 +168,7 @@
 
 	printf("--to-dst ");
 	printf("%s", ether_ntoa((struct ether_addr *)natinfo->mac));
-	printf(" --dnat-target %s", standard_targets[-natinfo->target - 1]);
+	printf(" --dnat-target %s", TARGET_NAME(natinfo->target));
 }
 
 static int compare(const struct ebt_entry_target *t1,
@@ -221,7 +205,7 @@
 	final_check_d,
 	print_d,
 	compare,
-	opts_d,
+	opts_d
 };
 
 static void _init(void) __attribute__ ((constructor));
--- ebtables-v2.0-rc1/extensions/ebt_ip.c	Thu Jun 27 18:53:55 2002
+++ ebtables-v2.0-rc2/extensions/ebt_ip.c	Thu Aug 29 18:53:30 2002
@@ -1,7 +1,5 @@
 #include <stdio.h>
 #include <stdlib.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <string.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
@@ -28,7 +26,8 @@
 static int undot_ip(char *ip, unsigned char *ip2)
 {
 	char *p, *q, *end;
-	int onebyte, i;
+	long int onebyte;
+	int i;
 	char buf[20];
 
 	strncpy(buf, ip, sizeof(buf) - 1);
@@ -46,7 +45,7 @@
 	}
 
 	onebyte = strtol(p, &end, 10);
-	if (*end != '\0' || onebyte >255 || onebyte < 0)
+	if (*end != '\0' || onebyte > 255 || onebyte < 0)
 		return -1;
 	ip2[3] = (unsigned char)onebyte;
 
@@ -57,8 +56,8 @@
 static int ip_mask(char *mask, unsigned char *mask2)
 {
 	char *end;
-	int bits;
-	__u32 mask22;
+	long int bits;
+	uint32_t mask22;
 
 	if (undot_ip(mask, mask2)) {
 		// not the /a.b.c.e format, maybe the /x format
@@ -77,39 +76,38 @@
 }
 
 // set the ip mask and ip address
-void parse_ip_address(char *address, __u32 *addr, __u32 *msk)
+void parse_ip_address(char *address, uint32_t *addr, uint32_t *msk)
 {
 	char *p;
-	int i;
 
 	// first the mask
 	if ((p = strrchr(address, '/')) != NULL) {
 		*p = '\0';
-		i = ip_mask(p + 1, (unsigned char *)msk);
-		if (i)
-			print_error("Problem with the ip mask");
+		if (ip_mask(p + 1, (unsigned char *)msk))
+			print_error("Problem with the IP mask");
 	}
 	else
 		*msk = 0xFFFFFFFF;
 
-	i = undot_ip(address, (unsigned char *)addr);
-	if (i)
-		print_error("Problem with the ip address");
+	if (undot_ip(address, (unsigned char *)addr))
+		print_error("Problem with the IP address");
 	*addr = *addr & *msk;
 }
 
 // transform the ip mask into a string ready for output
-char *mask_to_dotted(__u32 mask)
+char *mask_to_dotted(uint32_t mask)
 {
 	int i;
 	static char buf[20];
-	__u32 maskaddr, bits;
+	uint32_t maskaddr, bits;
 
 	maskaddr = ntohl(mask);
 
 	// don't print /32
-	if (mask == 0xFFFFFFFFL)
-		return "";
+	if (mask == 0xFFFFFFFFL) {
+		*buf = '\0';
+		return buf;
+	}
 
 	i = 32;
 	bits = 0xFFFFFFFEL; // case 0xFFFFFFFF has just been dealt with
@@ -156,7 +154,7 @@
 {
 	struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)(*match)->data;
 	char *end;
-	int i;
+	long int i;
 
 	switch (c) {
 	case IP_SOURCE:
@@ -176,7 +174,7 @@
 		}
 
 		if (optind > argc)
-			print_error("Missing ip address argument");
+			print_error("Missing IP address argument");
 		if (c == IP_SOURCE)
 			parse_ip_address(argv[optind - 1], &ipinfo->saddr,
 			   &ipinfo->smsk);
@@ -191,10 +189,10 @@
 			ipinfo->invflags |= EBT_IP_TOS;
 
 		if (optind > argc)
-			print_error("Missing ip tos argument");
+			print_error("Missing IP tos argument");
 		i = strtol(argv[optind - 1], &end, 16);
 		if (i < 0 || i > 255 || *end != '\0')
-			print_error("Problem with specified ip tos");
+			print_error("Problem with specified IP tos");
 		ipinfo->tos = i;
 		ipinfo->bitmask |= EBT_IP_TOS;
 		break;
@@ -204,10 +202,10 @@
 		if (check_inverse(optarg))
 			ipinfo->invflags |= EBT_IP_PROTO;
 		if (optind > argc)
-			print_error("Missing ip protocol argument");
+			print_error("Missing IP protocol argument");
 		i = strtol(argv[optind - 1], &end, 10);
 		if (i < 0 || i > 255 || *end != '\0')
-			print_error("Problem with specified ip protocol");
+			print_error("Problem with specified IP protocol");
 		ipinfo->protocol = i;
 		ipinfo->bitmask |= EBT_IP_PROTO;
 		break;
@@ -219,10 +217,9 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_match *match, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
-	if (entry->bitmask & EBT_NOPROTO || entry->bitmask & EBT_802_3 ||
-	   entry->ethproto != ETH_P_IP)
+	if (entry->ethproto != ETH_P_IP || entry->invflags & EBT_IPROTO)
 		print_error("For IP filtering the protocol must be "
 		            "specified as IPv4");
 }
@@ -259,7 +256,7 @@
 	}
 	if (ipinfo->bitmask & EBT_IP_PROTO) {
 		printf("--ip-proto ");
-		if (ipinfo->invflags & EBT_IP_DEST)
+		if (ipinfo->invflags & EBT_IP_PROTO)
 			printf("! ");
 		printf("%d ", ipinfo->protocol);
 	}
@@ -308,7 +305,7 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
 static void _init(void) __attribute((constructor));
--- ebtables-v2.0-rc1/extensions/ebt_arp.c	Thu Jun 27 18:53:55 2002
+++ ebtables-v2.0-rc2/extensions/ebt_arp.c	Thu Aug 29 18:54:13 2002
@@ -1,8 +1,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
 #include <linux/netfilter_bridge/ebt_arp.h>
@@ -23,40 +21,38 @@
 	{ 0 }
 };
 
+#define NUMOPCODES 9
 // a few names
 static char *opcodes[] =
 {
 	"Request",
 	"Reply",
-	"Request Reverse",
-	"Reply Reverse",
-	"DRARP Request",
-	"DRARP Reply",
-	"DRARP Error",
-	"InARP Request",
-	"ARP NAK",
-	""
+	"Request_Reverse",
+	"Reply_Reverse",
+	"DRARP_Request",
+	"DRARP_Reply",
+	"DRARP_Error",
+	"InARP_Request",
+	"ARP_NAK",
 };
 
 static void print_help()
 {
-	int i = 0;
+	int i;
 
 	printf(
 "arp options:\n"
 "--arp-opcode opcode            : ARP opcode (integer or string)\n"
 "--arp-htype type               : ARP hardware type (integer or string)\n"
 "--arp-ptype type               : ARP protocol type (hexadecimal or string)\n"
-"--arp-ip-src [!] address[/mask]: ARP ip source specification\n"
-"--arp-ip-dst [!] address[/mask]: ARP ip target specification\n"
+"--arp-ip-src [!] address[/mask]: ARP IP source specification\n"
+"--arp-ip-dst [!] address[/mask]: ARP IP target specification\n"
 " opcode strings: \n");
-	while (strcmp(opcodes[i], "")) {
+	for (i = 0; i < NUMOPCODES; i++)
 		printf("%d = %s\n", i + 1, opcodes[i]);
-		i++;
-	}
 	printf(
-" hardware type string: \n 1 = Ethernet\n"
-" protocol type string: \n 0x0800 = IPv4\n");
+" hardware type string: 1 = Ethernet\n"
+" protocol type string: see /etc/ethertypes\n");
 }
 
 static void init(struct ebt_entry_match *match)
@@ -68,7 +64,7 @@
 }
 
 // defined in ebt_ip.c
-void parse_ip_address(char *address, __u32 *addr, __u32 *msk);
+void parse_ip_address(char *address, uint32_t *addr, uint32_t *msk);
 
 #define OPT_OPCODE 0x01
 #define OPT_HTYPE  0x02
@@ -79,10 +75,10 @@
    unsigned int *flags, struct ebt_entry_match **match)
 {
 	struct ebt_arp_info *arpinfo = (struct ebt_arp_info *)(*match)->data;
-	int i;
+	long int i;
 	char *end;
-	__u32 *addr;
-	__u32 *mask;
+	uint32_t *addr;
+	uint32_t *mask;
 
 	switch (c) {
 	case ARP_OPCODE:
@@ -91,18 +87,16 @@
 			arpinfo->invflags |= EBT_ARP_OPCODE;
 
 		if (optind > argc)
-			print_error("Missing arp opcode argument");
+			print_error("Missing ARP opcode argument");
 		i = strtol(argv[optind - 1], &end, 10);
 		if (i < 0 || i >= (0x1 << 16) || *end !='\0') {
-			i = 0;
-			while (strcmp(opcodes[i], "")) {
+			for (i = 0; i < NUMOPCODES; i++)
 				if (!strcasecmp(opcodes[i], optarg))
 					break;
-				i++;
-			}
-			if (!strcmp(opcodes[i], ""))
+			if (i == NUMOPCODES)
 				print_error("Problem with specified "
-				            "arp opcode");
+				            "ARP opcode");
+			i++;
 		}
 		arpinfo->opcode = htons(i);
 		arpinfo->bitmask |= EBT_ARP_OPCODE;
@@ -114,13 +108,13 @@
 			arpinfo->invflags |= EBT_ARP_HTYPE;
 
 		if (optind > argc)
-			print_error("Missing arp hardware type argument");
+			print_error("Missing ARP hardware type argument");
 		i = strtol(argv[optind - 1], &end, 10);
 		if (i < 0 || i >= (0x1 << 16) || *end !='\0') {
 			if (!strcasecmp("Ethernet", argv[optind - 1]))
 				i = 1;
 			else
-				print_error("Problem with specified arp "
+				print_error("Problem with specified ARP "
 				            "hardware type");
 		}
 		arpinfo->htype = htons(i);
@@ -128,23 +122,26 @@
 		break;
 
 	case ARP_PTYPE:
+	{
+		uint16_t proto;
+
 		check_option(flags, OPT_PTYPE);
 		if (check_inverse(optarg))
 			arpinfo->invflags |= EBT_ARP_PTYPE;
 
 		if (optind > argc)
-			print_error("Missing arp protocol type argument");
+			print_error("Missing ARP protocol type argument");
 		i = strtol(argv[optind - 1], &end, 16);
 		if (i < 0 || i >= (0x1 << 16) || *end !='\0') {
-			if (!strcasecmp("IPv4", argv[optind - 1]))
-				i = 0x0800;
-			else
-				print_error("Problem with specified arp "
+			if (name_to_number (argv[optind - 1], &proto) == -1)
+				print_error("Problem with specified ARP "
 				            "protocol type");
-		}
-		arpinfo->ptype = htons(i);
+		} else
+			proto = i;
+		arpinfo->ptype = htons(proto);
 		arpinfo->bitmask |= EBT_ARP_PTYPE;
 		break;
+	}
 
 	case ARP_IP_S:
 	case ARP_IP_D:
@@ -166,7 +163,7 @@
 				arpinfo->invflags |= EBT_ARP_DST_IP;
 		}
 		if (optind > argc)
-			print_error("Missing ip address argument");
+			print_error("Missing ARP IP address argument");
 		parse_ip_address(argv[optind - 1], addr, mask);
 		break;
 	default:
@@ -177,27 +174,33 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_match *match, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
-	if (entry->bitmask & EBT_NOPROTO || entry->bitmask & EBT_802_3 ||
-	   (entry->ethproto != ETH_P_ARP && entry->ethproto != ETH_P_RARP))
+	if ((entry->ethproto != ETH_P_ARP && entry->ethproto != ETH_P_RARP) ||
+	    entry->invflags & EBT_IPROTO)
 		print_error("For (R)ARP filtering the protocol must be "
 		            "specified as ARP or RARP");
 }
 
 // defined in the ebt_ip.c
-char *mask_to_dotted(__u32 mask);
+char *mask_to_dotted(uint32_t mask);
+
 static void print(const struct ebt_u_entry *entry,
    const struct ebt_entry_match *match)
 {
 	struct ebt_arp_info *arpinfo = (struct ebt_arp_info *)match->data;
 	int i;
+	char name[21];
 
 	if (arpinfo->bitmask & EBT_ARP_OPCODE) {
+		int opcode = ntohs(arpinfo->opcode);
 		printf("--arp-op ");
 		if (arpinfo->invflags & EBT_ARP_OPCODE)
 			printf("! ");
-		printf("%d ", ntohs(arpinfo->opcode));
+		if (opcode > 0 && opcode <= NUMOPCODES)
+			printf("%s ", opcodes[opcode - 1]);
+		else
+			printf("%d ", opcode);
 	}
 	if (arpinfo->bitmask & EBT_ARP_HTYPE) {
 		printf("--arp-htype ");
@@ -209,7 +212,10 @@
 		printf("--arp-ptype ");
 		if (arpinfo->invflags & EBT_ARP_PTYPE)
 			printf("! ");
-		printf("0x%x ", ntohs(arpinfo->ptype));
+		if (number_to_name(ntohs(arpinfo->ptype), name))
+			printf("0x%x ", ntohs(arpinfo->ptype));
+		else
+			printf("%s ", name);
 	}
 	if (arpinfo->bitmask & EBT_ARP_SRC_IP) {
 		printf("--arp-ip-src ");
@@ -278,7 +284,7 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
 static void _init(void) __attribute__ ((constructor));
--- ebtables-v2.0-rc1/extensions/ebt_vlan.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/extensions/ebt_vlan.c	Thu Aug 29 18:55:02 2002
@@ -32,8 +32,6 @@
 
 #include <stdio.h>
 #include <stdlib.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <string.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
@@ -106,7 +104,7 @@
 	    (struct ebt_vlan_info *) (*match)->data;
 	unsigned long i;
 	char *end;
-	__u16 encap;
+	uint16_t encap;
 	switch (c) {
 	case VLAN_ID:
 		/*
@@ -128,7 +126,7 @@
 		/*
 		 * Convert argv to long int,
 		 * set *end to end of argv string, 
-		 * base set 10 for decimal only 
+		 * base set 10 for decimal only
 		 */
 		(unsigned short) i = strtol (argv[optind - 1], &end, 10);
 		/*
@@ -217,15 +215,16 @@
 static void
 final_check (const struct ebt_u_entry *entry,
 	     const struct ebt_entry_match *match,
-	     const char *name, unsigned int hook, unsigned int time)
+	     const char *name, unsigned int hookmask, unsigned int time)
 {
 
 	struct ebt_vlan_info *vlaninfo =
 	    (struct ebt_vlan_info *) match->data;
 	/*
-	 * Is any proto param specified there? Or specified proto isn't 802.1Q?
+	 * Specified proto isn't 802.1Q?
 	 */
-	if (entry->bitmask & EBT_NOPROTO || entry->ethproto != ETH_P_8021Q)
+	if (entry->ethproto != ETH_P_8021Q ||
+	    entry->invflags & EBT_IPROTO)
 		print_error
 		    ("For use 802.1Q extension the protocol must be specified as 802_1Q");
 	/*
@@ -334,7 +333,7 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
 static void _init (void) __attribute__ ((constructor));
--- ebtables-v2.0-rc1/extensions/ebt_log.c	Thu Jun 27 18:53:55 2002
+++ ebtables-v2.0-rc2/extensions/ebt_log.c	Sat Aug 24 15:29:50 2002
@@ -1,7 +1,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/socket.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
 #include <linux/netfilter_bridge/ebt_log.h>
@@ -16,11 +15,12 @@
 #define	LOG_NOTICE	5 // normal but significant condition
 #define	LOG_INFO	6 // informational
 #define	LOG_DEBUG	7 // debug-level messages
+
 #define LOG_DEFAULT_LEVEL LOG_INFO
 
 typedef struct _code {
-	char	*c_name;
-	int	c_val;
+	char *c_name;
+	int c_val;
 } CODE;
 
 static CODE eight_priority[] = {
@@ -31,20 +31,16 @@
 	{ "warning", LOG_WARNING },
 	{ "notice", LOG_NOTICE },
 	{ "info", LOG_INFO },
-	{ "debug", LOG_DEBUG },
-	{ NULL, -1 }
+	{ "debug", LOG_DEBUG }
 };
 
 static int name_to_loglevel(char* arg)
 {
-	int i = 0, c_val = eight_priority[0].c_val;
+	int i;
 	
-	while (c_val != -1) {
+	for (i = 0; i < 8; i++)
 		if (!strcmp(arg, eight_priority[i].c_name))
-			return c_val;
-		i++;
-		c_val = eight_priority[i].c_val;
-	}
+			return eight_priority[i].c_val;
 	// return bad loglevel
 	return 9;
 }
@@ -100,7 +96,7 @@
    unsigned int *flags, struct ebt_entry_watcher **watcher)
 {
 	struct ebt_log_info *loginfo = (struct ebt_log_info *)(*watcher)->data;
-	int i;
+	long int i;
 	char *end;
 
 	switch (c) {
@@ -143,7 +139,7 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_watcher *watcher, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 	return;
 }
@@ -186,10 +182,9 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
-#undef _init
 static void _init(void) __attribute__ ((constructor));
 static void _init(void)
 {
--- ebtables-v2.0-rc1/extensions/ebt_standard.c	Thu Jun 27 18:53:55 2002
+++ ebtables-v2.0-rc2/extensions/ebt_standard.c	Sat Aug 24 15:31:50 2002
@@ -1,6 +1,5 @@
 #include <stdio.h>
 #include <stdlib.h>
-#include <sys/socket.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
 
@@ -11,7 +10,8 @@
 
 static void print_help()
 {
-	printf("Standard targets: DROP, ACCEPT and CONTINUE\n");
+	printf("Standard targets: DROP, ACCEPT, RETURN or CONTINUE;\n"
+	       "The target can also be a user defined chain.\n");
 }
 
 static void init(struct ebt_entry_target *t)
@@ -27,11 +27,12 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_target *target, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 }
 
 struct ebt_u_entries *nr_to_chain(int nr);
+
 static void print(const struct ebt_u_entry *entry,
    const struct ebt_entry_target *target)
 {
@@ -53,7 +54,7 @@
 	else if (verdict == EBT_RETURN)
 		printf("RETURN ");
 	else
-		print_error("BUG: Bad standard target"); // this is a bug
+		print_bug("Bad standard target");
 }
 
 static int compare(const struct ebt_entry_target *t1,
--- ebtables-v2.0-rc1/extensions/ebtable_filter.c	Thu Jun 27 18:53:55 2002
+++ ebtables-v2.0-rc2/extensions/ebtable_filter.c	Tue Aug 13 13:00:12 2002
@@ -1,6 +1,4 @@
 #include <stdio.h>
-#include <sys/socket.h>
-#include <linux/netfilter_bridge/ebtables.h>
 #include "../include/ebtables_u.h"
 
 #define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \
--- ebtables-v2.0-rc1/extensions/ebtable_nat.c	Thu Jun 27 18:53:55 2002
+++ ebtables-v2.0-rc2/extensions/ebtable_nat.c	Tue Aug 13 12:59:14 2002
@@ -1,5 +1,4 @@
 #include <stdio.h>
-#include <sys/socket.h>
 #include "../include/ebtables_u.h"
 
 #define NAT_VALID_HOOKS ((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT) | \
--- ebtables-v2.0-rc1/extensions/ebt_mark.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/extensions/ebt_mark.c	Sat Aug 24 15:30:09 2002
@@ -1,21 +1,17 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
 #include <linux/netfilter_bridge/ebt_mark_t.h>
 
-extern char *standard_targets[NUM_STANDARD_TARGETS];
+static int mark_supplied;
 
-int mark_supplied;
-
-#define MARK_TARGET '1'
+#define MARK_TARGET  '1'
 #define MARK_SETMARK '2'
 static struct option opts[] =
 {
-	{ "mark-target"    , required_argument, 0, MARK_TARGET },
+	{ "mark-target" , required_argument, 0, MARK_TARGET },
 	{ "set-mark"    , required_argument, 0, MARK_SETMARK },
 	{ 0 }
 };
@@ -24,8 +20,8 @@
 {
 	printf(
 	"mark target options:\n"
-	" --set-mark value   : Set nfmark value\n"
-	" --mark-target target   : ACCEPT, DROP, RETURN or CONTINUE\n");
+	" --set-mark value     : Set nfmark value\n"
+	" --mark-target target : ACCEPT, DROP, RETURN or CONTINUE\n");
 }
 
 static void init(struct ebt_entry_target *target)
@@ -36,16 +32,14 @@
 	markinfo->target = EBT_ACCEPT;
 	markinfo->mark = 0;
 	mark_supplied = 0;
-	return;
 }
 
-#define OPT_MARK_TARGET  0x01
+#define OPT_MARK_TARGET   0x01
 #define OPT_MARK_SETMARK  0x02
 static int parse(int c, char **argv, int argc,
    const struct ebt_u_entry *entry, unsigned int *flags,
    struct ebt_entry_target **target)
 {
-	int i;
 	struct ebt_mark_t_info *markinfo =
 	   (struct ebt_mark_t_info *)(*target)->data;
 	char *end;
@@ -53,12 +47,7 @@
 	switch (c) {
 	case MARK_TARGET:
 		check_option(flags, OPT_MARK_TARGET);
-		for (i = 0; i < NUM_STANDARD_TARGETS; i++)
-			if (!strcmp(optarg, standard_targets[i])) {
-				markinfo->target = -i - 1;
-				break;
-			}
-		if (i == NUM_STANDARD_TARGETS)
+		if (FILL_TARGET(optarg, markinfo->target))
 			print_error("Illegal --mark-target target");
 		break;
 	case MARK_SETMARK:
@@ -76,14 +65,14 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_target *target, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 	struct ebt_mark_t_info *markinfo =
 	   (struct ebt_mark_t_info *)target->data;
 
 	if (time == 0 && mark_supplied == 0)
 		print_error("No mark value supplied");
-	if ((hook_mask & (1 << NF_BR_NUMHOOKS)) && markinfo->target == EBT_RETURN)
+	if (BASE_CHAIN && markinfo->target == EBT_RETURN)
 		print_error("--mark-target RETURN not allowed on base chain");
 }
 
@@ -96,8 +85,7 @@
 	printf("--set-mark 0x%lx", markinfo->mark);
 	if (markinfo->target == EBT_ACCEPT)
 		return;
-	printf(" --mark-target %s",
-	   standard_targets[-markinfo->target - 1]);
+	printf(" --mark-target %s", TARGET_NAME(markinfo->target));
 }
 
 static int compare(const struct ebt_entry_target *t1,
@@ -122,7 +110,7 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
 static void _init(void) __attribute__ ((constructor));
--- ebtables-v2.0-rc1/extensions/ebt_mark_m.c	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/extensions/ebt_mark_m.c	Sat Aug 24 15:30:26 2002
@@ -1,6 +1,5 @@
 #include <stdio.h>
 #include <stdlib.h>
-#include <sys/socket.h>
 #include <string.h>
 #include <getopt.h>
 #include "../include/ebtables_u.h"
@@ -25,9 +24,9 @@
 {
 	struct ebt_mark_m_info *markinfo = (struct ebt_mark_m_info *)match->data;
 
-	markinfo->mark = 0;
-	markinfo->mask = 0;
-	markinfo->invert = 0;
+	markinfo->mark    = 0;
+	markinfo->mask    = 0;
+	markinfo->invert  = 0;
 	markinfo->bitmask = 0;
 }
 
@@ -65,7 +64,7 @@
 
 static void final_check(const struct ebt_u_entry *entry,
    const struct ebt_entry_match *match, const char *name,
-   unsigned int hook_mask, unsigned int time)
+   unsigned int hookmask, unsigned int time)
 {
 }
 
@@ -113,7 +112,7 @@
 	final_check,
 	print,
 	compare,
-	opts,
+	opts
 };
 
 static void _init(void) __attribute((constructor));
--- ebtables-v2.0-rc1/ChangeLog	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/ChangeLog	Fri Aug 30 22:40:11 2002
@@ -1,3 +1,10 @@
+20020830
+	* updated the kernel files for 2.4.20-pre5 and 2.5.32
+	* last big cleanup of kernel and userspace code just finished
+20020820
+	* ARP module bugfix
+	* IP module bugfix
+	* nat module bugfix
 20020730
 	* other things done before 2.0-rc1 that I can think of,
 	  including kernel:
--- ebtables-v2.0-rc1/ebtables.8	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/ebtables.8	Sun Aug 11 14:00:57 2002
@@ -1,4 +1,4 @@
-.TH EBTABLES 8  "23 July 2002"
+.TH EBTABLES 8  "11 August 2002"
 .\"
 .\" Man page written by Bart De Schuymer <bart.de.schuymer@pandora.be>
 .\" It is based on the iptables man page.
@@ -21,7 +21,7 @@
 .\"     
 .\"
 .SH NAME
-ebtables (v.2.0) \- Ethernet bridge packet table administration
+ebtables (v.2.0) \- Ethernet bridge frame table administration
 .SH SYNOPSIS
 .BR "ebtables -[ADI] " "chain rule-specification " [ options ]
 .br
@@ -33,10 +33,6 @@
 .br
 .BR "ebtables -E " "old-chain-name new-chain-name"
 .br
-.B "ebtables -L DB"
-.br
-.BR "ebtables -[b] [" "y/n" "]"
-.br
 .BR "ebtables --init-table"
 .br
 .BR "ebtables --atomic-init " file
@@ -147,18 +143,9 @@
 .TP
 .B "-L, --list"
 List all rules in the selected chain. If no chain is selected, all chains
-are listed. If the chainname equals 
-.BR DB ,
-.B ebtables
-will try to show the database. This database gives a survey of the kind of
-frames that pass the different bridge hooks. It uses the interfaces where
-the frame came in or will go out, the protocol field and the hook. This
-database is independent from the rest of
-.B ebtables
-and is in a different kernel module.
+are listed.
 .br
-The following three options change the output when not listing the
-database:
+The following three options change the output:
 .br
 .B "--Ln"
 .br
@@ -196,7 +183,8 @@
 .BR DROP .
 .TP
 .B "-N, --new-chain"
-Create a new user-defined chain by the given name.
+Create a new user-defined chain by the given name. The number of
+user-defined chains is unlimited. A chain name has max length of 31.
 .TP
 .B "-X, --delete-chain"
 Delete the specified user-defined chain. There must be no references to the
@@ -335,16 +323,15 @@
 .B ebtables
 will try to write help about those extensions. E.g. ebtables -h snat log ip arp.
 .TP
-.BR "-b --db " [ "y/n" ]
-Enable (y) or disable (n) the database.
-.TP
 .BR "-j, --jump " "\fItarget\fP"
 The target of the rule. This is one of the following values:
 .BR ACCEPT ,
 .BR DROP ,
 .BR CONTINUE ,
-or a target extension, see
-.BR "TARGET EXTENSIONS" .
+.BR RETURN ,
+a target extension (see
+.BR "TARGET EXTENSIONS" ")"
+or a user defined chain name.
 .TP
 .B --atomic file
 Let the command operate on the specified file. The data of the table to
--- ebtables-v2.0-rc1/ethertypes	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/ethertypes	Sun Aug 11 18:55:35 2002
@@ -5,28 +5,28 @@
 # always put tabs or spaces between the name and the protocol number
 # anything on a line after the protocol number is ignored
 # programs using this file should not be case sensitive
-IPv4 	0800
-X25	0805
-ARP	0806
-802_1Q	8100	802.1Q Virtual LAN tagged frame
-IPX	8137
-IPv6	86DD
-NetBEUI	8191
-BPQ	08FF	G8BPQ AX.25 Ethernet Packet
-DEC	6000	DEC Assigned proto
-DNA_DL	6001	DEC DNA Dump/Load
-DNA_RC	6002	DEC DNA Remote Console
-DNA_RT	6003	DEC DNA Routing
-LAT	6004	DEC LAT
-DIAG	6005	DEC Diagnostics
-CUST	6006	DEC Customer use
-SCA	6007	DEC Systems Comms Arch
-RARP	8035	Reverse Addr Res packet
-ATALK	809B	Appletalk DDP
-AARP	80F3	Appletalk AARP
-IPX	8137	IPX over DIX
+IPv4	 	0800
+X25		0805
+ARP		0806
+802_1Q		8100	802.1Q Virtual LAN tagged frame
+IPX		8137
+IPv6		86DD
+NetBEUI		8191
+BPQ		08FF	G8BPQ AX.25 Ethernet Packet
+DEC		6000	DEC Assigned proto
+DNA_DL		6001	DEC DNA Dump/Load
+DNA_RC		6002	DEC DNA Remote Console
+DNA_RT		6003	DEC DNA Routing
+LAT		6004	DEC LAT
+DIAG		6005	DEC Diagnostics
+CUST		6006	DEC Customer use
+SCA		6007	DEC Systems Comms Arch
+RARP		8035	Reverse Addr Res packet
+ATALK		809B	Appletalk DDP
+AARP		80F3	Appletalk AARP
+IPX		8137	IPX over DIX
 PPP_DISC	8863	PPPoE discovery messages
-PPP_SES	8864	PPPoE session messages
-ATMMPOA	884C	MultiProtocol over ATM
-ATMFATE	8884	Frame-based ATM Transport over Ethernet
-LOOP	9000
+PPP_SES		8864	PPPoE session messages
+ATMMPOA		884C	MultiProtocol over ATM
+ATMFATE		8884	Frame-based ATM Transport over Ethernet
+LOOP		9000
--- ebtables-v2.0-rc1/include/ebtables_u.h	Wed Jul 31 21:55:02 2002
+++ ebtables-v2.0-rc2/include/ebtables_u.h	Thu Aug 29 18:58:36 2002
@@ -23,8 +23,8 @@
 
 #ifndef EBTABLES_U_H
 #define EBTABLES_U_H
+#include <netinet/in.h>
 #include <linux/netfilter_bridge/ebtables.h>
-#include <linux/br_db.h>
 
 struct ebt_u_entries
 {
@@ -75,7 +75,7 @@
 struct ebt_u_table
 {
 	char name[EBT_TABLE_MAXNAMELEN];
-	int (*check)(struct ebt_u_replace *repl);
+	void (*check)(struct ebt_u_replace *repl);
 	void (*help)(char **);
 	struct ebt_u_table *next;
 };
@@ -96,7 +96,7 @@
 {
 	unsigned int bitmask;
 	unsigned int invflags;
-	__u16 ethproto;
+	uint16_t ethproto;
 	char in[IFNAMSIZ];
 	char logical_in[IFNAMSIZ];
 	char out[IFNAMSIZ];
@@ -114,7 +114,7 @@
 struct ebt_u_match
 {
 	char name[EBT_FUNCTION_MAXNAMELEN];
-	// size of the real match data + sizeof struct ebt_match
+	// size of the real match data
 	unsigned int size;
 	void (*help)(void);
 	void (*init)(struct ebt_entry_match *m);
@@ -123,7 +123,7 @@
 	        struct ebt_entry_match **match);
 	void (*final_check)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_match *match,
-	   const char *name, unsigned int hook_mask, unsigned int time);
+	   const char *name, unsigned int hookmask, unsigned int time);
 	void (*print)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_match *match);
 	int (*compare)(const struct ebt_entry_match *m1,
@@ -150,7 +150,7 @@
 	   struct ebt_entry_watcher **watcher);
 	void (*final_check)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_watcher *watch, const char *name,
-	   unsigned int hook_mask, unsigned int time);
+	   unsigned int hookmask, unsigned int time);
 	void (*print)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_watcher *watcher);
 	int (*compare)(const struct ebt_entry_watcher *w1,
@@ -174,7 +174,7 @@
 	   struct ebt_entry_target **target);
 	void (*final_check)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_target *target, const char *name,
-	   unsigned int hook_mask, unsigned int time);
+	   unsigned int hookmask, unsigned int time);
 	void (*print)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_target *target);
 	int (*compare)(const struct ebt_entry_target *t1,
@@ -198,21 +198,17 @@
 struct ebt_u_table *find_table(char *name);
 void deliver_counters(struct ebt_u_replace *repl);
 void deliver_table(struct ebt_u_replace *repl);
-void get_dbinfo(struct brdb_dbinfo *nr);
-void get_db(int len, struct brdb_dbentry *db);
-void deliver_allowdb(__u16 *decision);
-int name_to_number(char *name, __u16 *proto);
+int name_to_number(char *name, uint16_t *proto);
 int number_to_name(unsigned short proto, char *name);
 void check_option(unsigned int *flags, unsigned int mask);
 int check_inverse(const char option[]);
+void __print_bug(char *file, int line, char *format, ...);
 #define print_bug(format, args...) \
-   {printf("BUG: "format".\n", ##args); exit(-1);}
+   __print_bug(__FILE__, __LINE__, format, ##args)
 #define print_error(format, args...) {printf(format".\n", ##args); exit(-1);}
 #define print_memory() {printf("Ebtables: " __FILE__ " " __FUNCTION__ \
    " %d :Out of memory.\n", __LINE__); exit(-1);}
 
-
-
 // used for keeping the rule counters right during rule adds or deletes
 #define CNT_NORM 0
 #define CNT_DEL 1
@@ -220,4 +216,27 @@
 #define CNT_END 3
 #define CNT_ZERO 4
 
+extern char *standard_targets[NUM_STANDARD_TARGETS];
+// Transforms a target string into the right integer,
+// returns 0 on success.
+#define FILL_TARGET(_str, _pos) ({                        \
+	int _i, _ret = 0;                                 \
+	for (_i = 0; _i < NUM_STANDARD_TARGETS; _i++)     \
+		if (!strcmp(_str, standard_targets[_i])) {\
+			_pos = -_i - 1;                   \
+			break;                            \
+		}                                         \
+	if (_i == NUM_STANDARD_TARGETS)                   \
+		_ret = 1;                                 \
+	_ret;                                             \
+})
+
+// Transforms the target value to an index into standard_targets[]
+#define TARGET_INDEX(_value) (-_value - 1)
+// Returns a target string corresponding to the value
+#define TARGET_NAME(_value) (standard_targets[TARGET_INDEX(_value)])
+// True if the hook mask denotes that the rule is in a base chain
+#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
+// Clear the bit in the hook_mask that tells if the rule is on a base chain
+#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
 #endif /* EBTABLES_U_H */