src/libiptc/libiptc.c

   1 /* Library which manipulates firewall rules.  Version $Revision: 6665 $ */
   2
   3 /* Architecture of firewall rules is as follows:
   4  *
   5  * Chains go INPUT, FORWARD, OUTPUT then user chains.
   6  * Each user chain starts with an ERROR node.
   7  * Every chain ends with an unconditional jump: a RETURN for user chains,
   8  * and a POLICY for built-ins.
   9  */
  10
  11 /* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
  12  * COPYING for details).
  13  * (C) 2000-2004 by the Netfilter Core Team <coreteam@netfilter.org>
  14  *
  15  * 2003-Jun-20: Harald Welte <laforge@netfilter.org>:
  16  *      - Reimplementation of chain cache to use offsets instead of entries
  17  * 2003-Jun-23: Harald Welte <laforge@netfilter.org>:
  18  *      - performance optimization, sponsored by Astaro AG (http://www.astaro.com/)
  19  *        don't rebuild the chain cache after every operation, instead fix it
  20  *        up after a ruleset change.
  21  * 2004-Aug-18: Harald Welte <laforge@netfilter.org>:
  22  *      - futher performance work: total reimplementation of libiptc.
  23  *      - libiptc now has a real internal (linked-list) represntation of the
  24  *        ruleset and a parser/compiler from/to this internal representation
  25  *      - again sponsored by Astaro AG (http://www.astaro.com/)
  26  */
  27 #include <sys/types.h>
  28 #include <sys/socket.h>
  29
  30 #include "linux_list.h"
  31
  32 //#define IPTC_DEBUG2 1
  33
  34 #ifdef IPTC_DEBUG2
  35 #include <fcntl.h>
  36 #define DEBUGP(x, args...)      fprintf(stderr, "%s: " x, __FUNCTION__, ## args)
  37 #define DEBUGP_C(x, args...)    fprintf(stderr, x, ## args)
  38 #else
  39 #define DEBUGP(x, args...)
  40 #define DEBUGP_C(x, args...)
  41 #endif
  42
  43 #ifndef IPT_LIB_DIR
  44 #define IPT_LIB_DIR "/usr/local/lib/iptables"
  45 #endif
  46
  47 static int sockfd = -1;
  48 static int sockfd_use = 0;
  49 static void *iptc_fn = NULL;
  50
  51 static const char *hooknames[]
  52 = { [HOOK_PRE_ROUTING]  "PREROUTING",
  53     [HOOK_LOCAL_IN]     "INPUT",
  54     [HOOK_FORWARD]      "FORWARD",
  55     [HOOK_LOCAL_OUT]    "OUTPUT",
  56     [HOOK_POST_ROUTING] "POSTROUTING",
  57 #ifdef HOOK_DROPPING
  58     [HOOK_DROPPING]     "DROPPING"
  59 #endif
  60 };
  61
  62 /* Convenience structures */
  63 struct ipt_error_target
  64 {
  65         STRUCT_ENTRY_TARGET t;
  66         char error[TABLE_MAXNAMELEN];
  67 };
  68
  69 struct chain_head;
  70 struct rule_head;
  71
  72 struct counter_map
  73 {
  74         enum {
  75                 COUNTER_MAP_NOMAP,
  76                 COUNTER_MAP_NORMAL_MAP,
  77                 COUNTER_MAP_ZEROED,
  78                 COUNTER_MAP_SET
  79         } maptype;
  80         unsigned int mappos;
  81 };
  82
  83 enum iptcc_rule_type {
  84         IPTCC_R_STANDARD,               /* standard target (ACCEPT, ...) */
  85         IPTCC_R_MODULE,                 /* extension module (SNAT, ...) */
  86         IPTCC_R_FALLTHROUGH,            /* fallthrough rule */
  87         IPTCC_R_JUMP,                   /* jump to other chain */
  88 };
  89
  90 struct rule_head
  91 {
  92         struct list_head list;
  93         struct chain_head *chain;
  94         struct counter_map counter_map;
  95
  96         unsigned int index;             /* index (needed for counter_map) */
  97         unsigned int offset;            /* offset in rule blob */
  98
  99         enum iptcc_rule_type type;
 100         struct chain_head *jump;        /* jump target, if IPTCC_R_JUMP */
 101
 102         unsigned int size;              /* size of entry data */
 103         STRUCT_ENTRY entry[0];
 104 };
 105
 106 struct chain_head
 107 {
 108         struct list_head list;
 109         char name[TABLE_MAXNAMELEN];
 110         unsigned int hooknum;           /* hook number+1 if builtin */
 111         unsigned int references;        /* how many jumps reference us */
 112         int verdict;                    /* verdict if builtin */
 113
 114         STRUCT_COUNTERS counters;       /* per-chain counters */
 115         struct counter_map counter_map;
 116
 117         unsigned int num_rules;         /* number of rules in list */
 118         struct list_head rules;         /* list of rules */
 119
 120         unsigned int index;             /* index (needed for jump resolval) */
 121         unsigned int head_offset;       /* offset in rule blob */
 122         unsigned int foot_index;        /* index (needed for counter_map) */
 123         unsigned int foot_offset;       /* offset in rule blob */
 124 };
 125
 126 STRUCT_TC_HANDLE
 127 {
 128         int changed;                     /* Have changes been made? */
 129
 130         struct list_head chains;
 131
 132         struct chain_head *chain_iterator_cur;
 133         struct rule_head *rule_iterator_cur;
 134
 135         STRUCT_GETINFO info;
 136         STRUCT_GET_ENTRIES *entries;
 137 };
 138
 139 /* allocate a new chain head for the cache */
 140 static struct chain_head *iptcc_alloc_chain_head(const char *name, int hooknum)
 141 {
 142         struct chain_head *c = malloc(sizeof(*c));
 143         if (!c)
 144                 return NULL;
 145         memset(c, 0, sizeof(*c));
 146
 147         strncpy(c->name, name, TABLE_MAXNAMELEN);
 148         c->hooknum = hooknum;
 149         INIT_LIST_HEAD(&c->rules);
 150
 151         return c;
 152 }
 153
 154 /* allocate and initialize a new rule for the cache */
 155 static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size)
 156 {
 157         struct rule_head *r = malloc(sizeof(*r)+size);
 158         if (!r)
 159                 return NULL;
 160         memset(r, 0, sizeof(*r));
 161
 162         r->chain = c;
 163         r->size = size;
 164
 165         return r;
 166 }
 167
 168 /* notify us that the ruleset has been modified by the user */
 169 static void
 170 set_changed(TC_HANDLE_T h)
 171 {
 172         h->changed = 1;
 173 }
 174
 175 #ifdef IPTC_DEBUG
 176 static void do_check(TC_HANDLE_T h, unsigned int line);
 177 #define CHECK(h) do { if (!getenv("IPTC_NO_CHECK")) do_check((h), __LINE__); } while(0)
 178 #else
 179 #define CHECK(h)
 180 #endif
 181
 182
 183 /**********************************************************************
 184  * iptc blob utility functions (iptcb_*)
 185  **********************************************************************/
 186
 187 static inline int
 188 iptcb_get_number(const STRUCT_ENTRY *i,
 189            const STRUCT_ENTRY *seek,
 190            unsigned int *pos)
 191 {
 192         if (i == seek)
 193                 return 1;
 194         (*pos)++;
 195         return 0;
 196 }
 197
 198 static inline int
 199 iptcb_get_entry_n(STRUCT_ENTRY *i,
 200             unsigned int number,
 201             unsigned int *pos,
 202             STRUCT_ENTRY **pe)
 203 {
 204         if (*pos == number) {
 205                 *pe = i;
 206                 return 1;
 207         }
 208         (*pos)++;
 209         return 0;
 210 }
 211
 212 static inline STRUCT_ENTRY *
 213 iptcb_get_entry(TC_HANDLE_T h, unsigned int offset)
 214 {
 215         return (STRUCT_ENTRY *)((char *)h->entries->entrytable + offset);
 216 }
 217
 218 static unsigned int
 219 iptcb_entry2index(const TC_HANDLE_T h, const STRUCT_ENTRY *seek)
 220 {
 221         unsigned int pos = 0;
 222
 223         if (ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
 224                           iptcb_get_number, seek, &pos) == 0) {
 225                 fprintf(stderr, "ERROR: offset %u not an entry!\n",
 226                         (unsigned int)((char *)seek - (char *)h->entries->entrytable));
 227                 abort();
 228         }
 229         return pos;
 230 }
 231
 232 static inline STRUCT_ENTRY *
 233 iptcb_offset2entry(TC_HANDLE_T h, unsigned int offset)
 234 {
 235         return (STRUCT_ENTRY *) ((void *)h->entries->entrytable+offset);
 236 }
 237
 238
 239 static inline unsigned long
 240 iptcb_entry2offset(const TC_HANDLE_T h, const STRUCT_ENTRY *e)
 241 {
 242         return (void *)e - (void *)h->entries->entrytable;
 243 }
 244
 245 static inline unsigned int
 246 iptcb_offset2index(const TC_HANDLE_T h, unsigned int offset)
 247 {
 248         return iptcb_entry2index(h, iptcb_offset2entry(h, offset));
 249 }
 250
 251 /* Returns 0 if not hook entry, else hooknumber + 1 */
 252 static inline unsigned int
 253 iptcb_ent_is_hook_entry(STRUCT_ENTRY *e, TC_HANDLE_T h)
 254 {
 255         unsigned int i;
 256
 257         for (i = 0; i < NUMHOOKS; i++) {
 258                 if ((h->info.valid_hooks & (1 << i))
 259                     && iptcb_get_entry(h, h->info.hook_entry[i]) == e)
 260                         return i+1;
 261         }
 262         return 0;
 263 }
 264
 265
 266 /**********************************************************************
 267  * iptc cache utility functions (iptcc_*)
 268  **********************************************************************/
 269
 270 /* Is the given chain builtin (1) or user-defined (0) */
 271 static unsigned int iptcc_is_builtin(struct chain_head *c)
 272 {
 273         return (c->hooknum ? 1 : 0);
 274 }
 275
 276 /* Get a specific rule within a chain */
 277 static struct rule_head *iptcc_get_rule_num(struct chain_head *c,
 278                                             unsigned int rulenum)
 279 {
 280         struct rule_head *r;
 281         unsigned int num = 0;
 282
 283         list_for_each_entry(r, &c->rules, list) {
 284                 num++;
 285                 if (num == rulenum)
 286                         return r;
 287         }
 288         return NULL;
 289 }
 290
 291 /* Get a specific rule within a chain backwards */
 292 static struct rule_head *iptcc_get_rule_num_reverse(struct chain_head *c,
 293                                             unsigned int rulenum)
 294 {
 295         struct rule_head *r;
 296         unsigned int num = 0;
 297
 298         list_for_each_entry_reverse(r, &c->rules, list) {
 299                 num++;
 300                 if (num == rulenum)
 301                         return r;
 302         }
 303         return NULL;
 304 }
 305
 306 /* Returns chain head if found, otherwise NULL. */
 307 static struct chain_head *
 308 iptcc_find_chain_by_offset(TC_HANDLE_T handle, unsigned int offset)
 309 {
 310         struct list_head *pos;
 311
 312         if (list_empty(&handle->chains))
 313                 return NULL;
 314
 315         list_for_each(pos, &handle->chains) {
 316                 struct chain_head *c = list_entry(pos, struct chain_head, list);
 317                 if (offset >= c->head_offset && offset <= c->foot_offset)
 318                         return c;
 319         }
 320
 321         return NULL;
 322 }
 323 /* Returns chain head if found, otherwise NULL. */
 324 static struct chain_head *
 325 iptcc_find_label(const char *name, TC_HANDLE_T handle)
 326 {
 327         struct list_head *pos;
 328
 329         if (list_empty(&handle->chains))
 330                 return NULL;
 331
 332         list_for_each(pos, &handle->chains) {
 333                 struct chain_head *c = list_entry(pos, struct chain_head, list);
 334                 if (!strcmp(c->name, name))
 335                         return c;
 336         }
 337
 338         return NULL;
 339 }
 340
 341 /* called when rule is to be removed from cache */
 342 static void iptcc_delete_rule(struct rule_head *r)
 343 {
 344         DEBUGP("deleting rule %p (offset %u)\n", r, r->offset);
 345         /* clean up reference count of called chain */
 346         if (r->type == IPTCC_R_JUMP
 347             && r->jump)
 348                 r->jump->references--;
 349
 350         list_del(&r->list);
 351         free(r);
 352 }
 353
 354
 355 /**********************************************************************
 356  * RULESET PARSER (blob -> cache)
 357  **********************************************************************/
 358
 359 /* Delete policy rule of previous chain, since cache doesn't contain
 360  * chain policy rules.
 361  * WARNING: This function has ugly design and relies on a lot of context, only
 362  * to be called from specific places within the parser */
 363 static int __iptcc_p_del_policy(TC_HANDLE_T h, unsigned int num)
 364 {
 365         if (h->chain_iterator_cur) {
 366                 /* policy rule is last rule */
 367                 struct rule_head *pr = (struct rule_head *)
 368                         h->chain_iterator_cur->rules.prev;
 369
 370                 /* save verdict */
 371                 h->chain_iterator_cur->verdict =
 372                         *(int *)GET_TARGET(pr->entry)->data;
 373
 374                 /* save counter and counter_map information */
 375                 h->chain_iterator_cur->counter_map.maptype =
 376                                                 COUNTER_MAP_NORMAL_MAP;
 377                 h->chain_iterator_cur->counter_map.mappos = num-1;
 378                 memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters,
 379                         sizeof(h->chain_iterator_cur->counters));
 380
 381                 /* foot_offset points to verdict rule */
 382                 h->chain_iterator_cur->foot_index = num;
 383                 h->chain_iterator_cur->foot_offset = pr->offset;
 384
 385                 /* delete rule from cache */
 386                 iptcc_delete_rule(pr);
 387                 h->chain_iterator_cur->num_rules--;
 388
 389                 return 1;
 390         }
 391         return 0;
 392 }
 393
 394 /* alphabetically insert a chain into the list */
 395 static inline void iptc_insert_chain(TC_HANDLE_T h, struct chain_head *c)
 396 {
 397         struct chain_head *tmp;
 398
 399         /* sort only user defined chains */
 400         if (!c->hooknum) {
 401                 list_for_each_entry(tmp, &h->chains, list) {
 402                         if (!tmp->hooknum && strcmp(c->name, tmp->name) <= 0) {
 403                                 list_add(&c->list, tmp->list.prev);
 404                                 return;
 405                         }
 406                 }
 407         }
 408
 409         /* survived till end of list: add at tail */
 410         list_add_tail(&c->list, &h->chains);
 411 }
 412
 413 /* Another ugly helper function split out of cache_add_entry to make it less
 414  * spaghetti code */
 415 static void __iptcc_p_add_chain(TC_HANDLE_T h, struct chain_head *c,
 416                                 unsigned int offset, unsigned int *num)
 417 {
 418         __iptcc_p_del_policy(h, *num);
 419
 420         c->head_offset = offset;
 421         c->index = *num;
 422
 423         iptc_insert_chain(h, c);
 424
 425         h->chain_iterator_cur = c;
 426 }
 427
 428 /* main parser function: add an entry from the blob to the cache */
 429 static int cache_add_entry(STRUCT_ENTRY *e,
 430                            TC_HANDLE_T h,
 431                            STRUCT_ENTRY **prev,
 432                            unsigned int *num)
 433 {
 434         unsigned int builtin;
 435         unsigned int offset = (char *)e - (char *)h->entries->entrytable;
 436
 437         DEBUGP("entering...");
 438
 439         /* Last entry ("policy rule"). End it.*/
 440         if (iptcb_entry2offset(h,e) + e->next_offset == h->entries->size) {
 441                 /* This is the ERROR node at the end of the chain */
 442                 DEBUGP_C("%u:%u: end of table:\n", *num, offset);
 443
 444                 __iptcc_p_del_policy(h, *num);
 445
 446                 h->chain_iterator_cur = NULL;
 447                 goto out_inc;
 448         }
 449
 450         /* We know this is the start of a new chain if it's an ERROR
 451          * target, or a hook entry point */
 452
 453         if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) == 0) {
 454                 struct chain_head *c =
 455                         iptcc_alloc_chain_head((const char *)GET_TARGET(e)->data, 0);
 456                 DEBUGP_C("%u:%u:new userdefined chain %s: %p\n", *num, offset,
 457                         (char *)c->name, c);
 458                 if (!c) {
 459                         errno = -ENOMEM;
 460                         return -1;
 461                 }
 462
 463                 __iptcc_p_add_chain(h, c, offset, num);
 464
 465         } else if ((builtin = iptcb_ent_is_hook_entry(e, h)) != 0) {
 466                 struct chain_head *c =
 467                         iptcc_alloc_chain_head((char *)hooknames[builtin-1],
 468                                                 builtin);
 469                 DEBUGP_C("%u:%u new builtin chain: %p (rules=%p)\n",
 470                         *num, offset, c, &c->rules);
 471                 if (!c) {
 472                         errno = -ENOMEM;
 473                         return -1;
 474                 }
 475
 476                 c->hooknum = builtin;
 477
 478                 __iptcc_p_add_chain(h, c, offset, num);
 479
 480                 /* FIXME: this is ugly. */
 481                 goto new_rule;
 482         } else {
 483                 /* has to be normal rule */
 484                 struct rule_head *r;
 485 new_rule:
 486
 487                 if (!(r = iptcc_alloc_rule(h->chain_iterator_cur,
 488                                            e->next_offset))) {
 489                         errno = ENOMEM;
 490                         return -1;
 491                 }
 492                 DEBUGP_C("%u:%u normal rule: %p: ", *num, offset, r);
 493
 494                 r->index = *num;
 495                 r->offset = offset;
 496                 memcpy(r->entry, e, e->next_offset);
 497                 r->counter_map.maptype = COUNTER_MAP_NORMAL_MAP;
 498                 r->counter_map.mappos = r->index;
 499
 500                 /* handling of jumps, etc. */
 501                 if (!strcmp(GET_TARGET(e)->u.user.name, STANDARD_TARGET)) {
 502                         STRUCT_STANDARD_TARGET *t;
 503
 504                         t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
 505                         if (t->target.u.target_size
 506                             != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) {
 507                                 errno = EINVAL;
 508                                 return -1;
 509                         }
 510
 511                         if (t->verdict < 0) {
 512                                 DEBUGP_C("standard, verdict=%d\n", t->verdict);
 513                                 r->type = IPTCC_R_STANDARD;
 514                         } else if (t->verdict == r->offset+e->next_offset) {
 515                                 DEBUGP_C("fallthrough\n");
 516                                 r->type = IPTCC_R_FALLTHROUGH;
 517                         } else {
 518                                 DEBUGP_C("jump, target=%u\n", t->verdict);
 519                                 r->type = IPTCC_R_JUMP;
 520                                 /* Jump target fixup has to be deferred
 521                                  * until second pass, since we migh not
 522                                  * yet have parsed the target */
 523                         }
 524                 } else {
 525                         DEBUGP_C("module, target=%s\n", GET_TARGET(e)->u.user.name);
 526                         r->type = IPTCC_R_MODULE;
 527                 }
 528
 529                 list_add_tail(&r->list, &h->chain_iterator_cur->rules);
 530                 h->chain_iterator_cur->num_rules++;
 531         }
 532 out_inc:
 533         (*num)++;
 534         return 0;
 535 }
 536
 537
 538 /* parse an iptables blob into it's pieces */
 539 static int parse_table(TC_HANDLE_T h)
 540 {
 541         STRUCT_ENTRY *prev;
 542         unsigned int num = 0;
 543         struct chain_head *c;
 544
 545         /* First pass: over ruleset blob */
 546         ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
 547                         cache_add_entry, h, &prev, &num);
 548
 549         /* Second pass: fixup parsed data from first pass */
 550         list_for_each_entry(c, &h->chains, list) {
 551                 struct rule_head *r;
 552                 list_for_each_entry(r, &c->rules, list) {
 553                         struct chain_head *c;
 554                         STRUCT_STANDARD_TARGET *t;
 555
 556                         if (r->type != IPTCC_R_JUMP)
 557                                 continue;
 558
 559                         t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
 560                         c = iptcc_find_chain_by_offset(h, t->verdict);
 561                         if (!c)
 562                                 return -1;
 563                         r->jump = c;
 564                         c->references++;
 565                 }
 566         }
 567
 568         /* FIXME: sort chains */
 569
 570         return 1;
 571 }
 572
 573
 574 /**********************************************************************
 575  * RULESET COMPILATION (cache -> blob)
 576  **********************************************************************/
 577
 578 /* Convenience structures */
 579 struct iptcb_chain_start{
 580         STRUCT_ENTRY e;
 581         struct ipt_error_target name;
 582 };
 583 #define IPTCB_CHAIN_START_SIZE  (sizeof(STRUCT_ENTRY) +                 \
 584                                  ALIGN(sizeof(struct ipt_error_target)))
 585
 586 struct iptcb_chain_foot {
 587         STRUCT_ENTRY e;
 588         STRUCT_STANDARD_TARGET target;
 589 };
 590 #define IPTCB_CHAIN_FOOT_SIZE   (sizeof(STRUCT_ENTRY) +                 \
 591                                  ALIGN(sizeof(STRUCT_STANDARD_TARGET)))
 592
 593 struct iptcb_chain_error {
 594         STRUCT_ENTRY entry;
 595         struct ipt_error_target target;
 596 };
 597 #define IPTCB_CHAIN_ERROR_SIZE  (sizeof(STRUCT_ENTRY) +                 \
 598                                  ALIGN(sizeof(struct ipt_error_target)))
 599
 600
 601
 602 /* compile rule from cache into blob */
 603 static inline int iptcc_compile_rule (TC_HANDLE_T h, STRUCT_REPLACE *repl, struct rule_head *r)
 604 {
 605         /* handle jumps */
 606         if (r->type == IPTCC_R_JUMP) {
 607                 STRUCT_STANDARD_TARGET *t;
 608                 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
 609                 /* memset for memcmp convenience on delete/replace */
 610                 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN);
 611                 strcpy(t->target.u.user.name, STANDARD_TARGET);
 612                 /* Jumps can only happen to builtin chains, so we
 613                  * can safely assume that they always have a header */
 614                 t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE;
 615         } else if (r->type == IPTCC_R_FALLTHROUGH) {
 616                 STRUCT_STANDARD_TARGET *t;
 617                 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
 618                 t->verdict = r->offset + r->size;
 619         }
 620
 621         /* copy entry from cache to blob */
 622         memcpy((char *)repl->entries+r->offset, r->entry, r->size);
 623
 624         return 1;
 625 }
 626
 627 /* compile chain from cache into blob */
 628 static int iptcc_compile_chain(TC_HANDLE_T h, STRUCT_REPLACE *repl, struct chain_head *c)
 629 {
 630         int ret;
 631         struct rule_head *r;
 632         struct iptcb_chain_start *head;
 633         struct iptcb_chain_foot *foot;
 634
 635         /* only user-defined chains have heaer */
 636         if (!iptcc_is_builtin(c)) {
 637                 /* put chain header in place */
 638                 head = (void *)repl->entries + c->head_offset;
 639                 head->e.target_offset = sizeof(STRUCT_ENTRY);
 640                 head->e.next_offset = IPTCB_CHAIN_START_SIZE;
 641                 strcpy(head->name.t.u.user.name, ERROR_TARGET);
 642                 head->name.t.u.target_size =
 643                                 ALIGN(sizeof(struct ipt_error_target));
 644                 strcpy(head->name.error, c->name);
 645         } else {
 646                 repl->hook_entry[c->hooknum-1] = c->head_offset;
 647                 repl->underflow[c->hooknum-1] = c->foot_offset;
 648         }
 649
 650         /* iterate over rules */
 651         list_for_each_entry(r, &c->rules, list) {
 652                 ret = iptcc_compile_rule(h, repl, r);
 653                 if (ret < 0)
 654                         return ret;
 655         }
 656
 657         /* put chain footer in place */
 658         foot = (void *)repl->entries + c->foot_offset;
 659         foot->e.target_offset = sizeof(STRUCT_ENTRY);
 660         foot->e.next_offset = IPTCB_CHAIN_FOOT_SIZE;
 661         strcpy(foot->target.target.u.user.name, STANDARD_TARGET);
 662         foot->target.target.u.target_size =
 663                                 ALIGN(sizeof(STRUCT_STANDARD_TARGET));
 664         /* builtin targets have verdict, others return */
 665         if (iptcc_is_builtin(c))
 666                 foot->target.verdict = c->verdict;
 667         else
 668                 foot->target.verdict = RETURN;
 669         /* set policy-counters */
 670         memcpy(&foot->e.counters, &c->counters, sizeof(STRUCT_COUNTERS));
 671
 672         return 0;
 673 }
 674
 675 /* calculate offset and number for every rule in the cache */
 676 static int iptcc_compile_chain_offsets(TC_HANDLE_T h, struct chain_head *c,
 677                                        unsigned int *offset, unsigned int *num)
 678 {
 679         struct rule_head *r;
 680
 681         c->head_offset = *offset;
 682         DEBUGP("%s: chain_head %u, offset=%u\n", c->name, *num, *offset);
 683
 684         if (!iptcc_is_builtin(c))  {
 685                 /* Chain has header */
 686                 *offset += sizeof(STRUCT_ENTRY)
 687                              + ALIGN(sizeof(struct ipt_error_target));
 688                 (*num)++;
 689         }
 690
 691         list_for_each_entry(r, &c->rules, list) {
 692                 DEBUGP("rule %u, offset=%u, index=%u\n", *num, *offset, *num);
 693                 r->offset = *offset;
 694                 r->index = *num;
 695                 *offset += r->size;
 696                 (*num)++;
 697         }
 698
 699         DEBUGP("%s; chain_foot %u, offset=%u, index=%u\n", c->name, *num,
 700                 *offset, *num);
 701         c->foot_offset = *offset;
 702         c->foot_index = *num;
 703         *offset += sizeof(STRUCT_ENTRY)
 704                    + ALIGN(sizeof(STRUCT_STANDARD_TARGET));
 705         (*num)++;
 706
 707         return 1;
 708 }
 709
 710 /* put the pieces back together again */
 711 static int iptcc_compile_table_prep(TC_HANDLE_T h, unsigned int *size)
 712 {
 713         struct chain_head *c;
 714         unsigned int offset = 0, num = 0;
 715         int ret = 0;
 716
 717         /* First pass: calculate offset for every rule */
 718         list_for_each_entry(c, &h->chains, list) {
 719                 ret = iptcc_compile_chain_offsets(h, c, &offset, &num);
 720                 if (ret < 0)
 721                         return ret;
 722         }
 723
 724         /* Append one error rule at end of chain */
 725         num++;
 726         offset += sizeof(STRUCT_ENTRY)
 727                   + ALIGN(sizeof(struct ipt_error_target));
 728
 729         /* ruleset size is now in offset */
 730         *size = offset;
 731         return num;
 732 }
 733
 734 static int iptcc_compile_table(TC_HANDLE_T h, STRUCT_REPLACE *repl)
 735 {
 736         struct chain_head *c;
 737         struct iptcb_chain_error *error;
 738
 739         /* Second pass: copy from cache to offsets, fill in jumps */
 740         list_for_each_entry(c, &h->chains, list) {
 741                 int ret = iptcc_compile_chain(h, repl, c);
 742                 if (ret < 0)
 743                         return ret;
 744         }
 745
 746         /* Append error rule at end of chain */
 747         error = (void *)repl->entries + repl->size - IPTCB_CHAIN_ERROR_SIZE;
 748         error->entry.target_offset = sizeof(STRUCT_ENTRY);
 749         error->entry.next_offset = IPTCB_CHAIN_ERROR_SIZE;
 750         error->target.t.u.user.target_size =
 751                 ALIGN(sizeof(struct ipt_error_target));
 752         strcpy((char *)&error->target.t.u.user.name, ERROR_TARGET);
 753         strcpy((char *)&error->target.error, "ERROR");
 754
 755         return 1;
 756 }
 757
 758 /**********************************************************************
 759  * EXTERNAL API (operates on cache only)
 760  **********************************************************************/
 761
 762 /* Allocate handle of given size */
 763 static TC_HANDLE_T
 764 alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules)
 765 {
 766         size_t len;
 767         TC_HANDLE_T h;
 768
 769         len = sizeof(STRUCT_TC_HANDLE) + size;
 770
 771         h = malloc(sizeof(STRUCT_TC_HANDLE));
 772         if (!h) {
 773                 errno = ENOMEM;
 774                 return NULL;
 775         }
 776         memset(h, 0, sizeof(*h));
 777         INIT_LIST_HEAD(&h->chains);
 778         strcpy(h->info.name, tablename);
 779
 780         h->entries = malloc(sizeof(STRUCT_GET_ENTRIES) + size);
 781         if (!h->entries)
 782                 goto out_free_handle;
 783
 784         strcpy(h->entries->name, tablename);
 785         h->entries->size = size;
 786
 787         return h;
 788
 789 out_free_handle:
 790         free(h);
 791
 792         return NULL;
 793 }
 794
 795
 796 TC_HANDLE_T
 797 TC_INIT(const char *tablename)
 798 {
 799         TC_HANDLE_T h;
 800         STRUCT_GETINFO info;
 801         unsigned int tmp;
 802         socklen_t s;
 803
 804         iptc_fn = TC_INIT;
 805
 806         if (strlen(tablename) >= TABLE_MAXNAMELEN) {
 807                 errno = EINVAL;
 808                 return NULL;
 809         }
 810
 811         if (sockfd_use == 0) {
 812                 sockfd = socket(TC_AF, SOCK_RAW, IPPROTO_RAW);
 813                 if (sockfd < 0)
 814                         return NULL;
 815         }
 816         sockfd_use++;
 817
 818         s = sizeof(info);
 819
 820         strcpy(info.name, tablename);
 821         if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0) {
 822                 if (--sockfd_use == 0) {
 823                         close(sockfd);
 824                         sockfd = -1;
 825                 }
 826                 return NULL;
 827         }
 828
 829         DEBUGP("valid_hooks=0x%08x, num_entries=%u, size=%u\n",
 830                 info.valid_hooks, info.num_entries, info.size);
 831
 832         if ((h = alloc_handle(info.name, info.size, info.num_entries))
 833             == NULL) {
 834                 if (--sockfd_use == 0) {
 835                         close(sockfd);
 836                         sockfd = -1;
 837                 }
 838                 return NULL;
 839         }
 840
 841         /* Initialize current state */
 842         h->info = info;
 843
 844         h->entries->size = h->info.size;
 845
 846         tmp = sizeof(STRUCT_GET_ENTRIES) + h->info.size;
 847
 848         if (getsockopt(sockfd, TC_IPPROTO, SO_GET_ENTRIES, h->entries,
 849                        &tmp) < 0)
 850                 goto error;
 851
 852 #ifdef IPTC_DEBUG2
 853         {
 854                 int fd = open("/tmp/libiptc-so_get_entries.blob",
 855                                 O_CREAT|O_WRONLY);
 856                 if (fd >= 0) {
 857                         write(fd, h->entries, tmp);
 858                         close(fd);
 859                 }
 860         }
 861 #endif
 862
 863         if (parse_table(h) < 0)
 864                 goto error;
 865
 866         CHECK(h);
 867         return h;
 868 error:
 869         if (--sockfd_use == 0) {
 870                 close(sockfd);
 871                 sockfd = -1;
 872         }
 873         TC_FREE(&h);
 874         return NULL;
 875 }
 876
 877 void
 878 TC_FREE(TC_HANDLE_T *h)
 879 {
 880         struct chain_head *c, *tmp;
 881
 882         iptc_fn = TC_FREE;
 883         if (--sockfd_use == 0) {
 884                 close(sockfd);
 885                 sockfd = -1;
 886         }
 887
 888         list_for_each_entry_safe(c, tmp, &(*h)->chains, list) {
 889                 struct rule_head *r, *rtmp;
 890
 891                 list_for_each_entry_safe(r, rtmp, &c->rules, list) {
 892                         free(r);
 893                 }
 894
 895                 free(c);
 896         }
 897
 898         free((*h)->entries);
 899         free(*h);
 900
 901         *h = NULL;
 902 }
 903
 904 static inline int
 905 print_match(const STRUCT_ENTRY_MATCH *m)
 906 {
 907         printf("Match name: `%s'\n", m->u.user.name);
 908         return 0;
 909 }
 910
 911 static int dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle);
 912
 913 void
 914 TC_DUMP_ENTRIES(const TC_HANDLE_T handle)
 915 {
 916         iptc_fn = TC_DUMP_ENTRIES;
 917         CHECK(handle);
 918 #if 0
 919         printf("libiptc v%s. %u bytes.\n",
 920                IPTABLES_VERSION, handle->entries->size);
 921         printf("Table `%s'\n", handle->info.name);
 922         printf("Hooks: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n",
 923                handle->info.hook_entry[HOOK_PRE_ROUTING],
 924                handle->info.hook_entry[HOOK_LOCAL_IN],
 925                handle->info.hook_entry[HOOK_FORWARD],
 926                handle->info.hook_entry[HOOK_LOCAL_OUT],
 927                handle->info.hook_entry[HOOK_POST_ROUTING]);
 928         printf("Underflows: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n",
 929                handle->info.underflow[HOOK_PRE_ROUTING],
 930                handle->info.underflow[HOOK_LOCAL_IN],
 931                handle->info.underflow[HOOK_FORWARD],
 932                handle->info.underflow[HOOK_LOCAL_OUT],
 933                handle->info.underflow[HOOK_POST_ROUTING]);
 934
 935         ENTRY_ITERATE(handle->entries->entrytable, handle->entries->size,
 936                       dump_entry, handle);
 937 #endif
 938 }
 939
 940 /* Does this chain exist? */
 941 int TC_IS_CHAIN(const char *chain, const TC_HANDLE_T handle)
 942 {
 943         iptc_fn = TC_IS_CHAIN;
 944         return iptcc_find_label(chain, handle) != NULL;
 945 }
 946
 947 static void iptcc_chain_iterator_advance(TC_HANDLE_T handle)
 948 {
 949         struct chain_head *c = handle->chain_iterator_cur;
 950
 951         if (c->list.next == &handle->chains)
 952                 handle->chain_iterator_cur = NULL;
 953         else
 954                 handle->chain_iterator_cur =
 955                         list_entry(c->list.next, struct chain_head, list);
 956 }
 957
 958 /* Iterator functions to run through the chains. */
 959 const char *
 960 TC_FIRST_CHAIN(TC_HANDLE_T *handle)
 961 {
 962         struct chain_head *c = list_entry((*handle)->chains.next,
 963                                           struct chain_head, list);
 964
 965         iptc_fn = TC_FIRST_CHAIN;
 966
 967
 968         if (list_empty(&(*handle)->chains)) {
 969                 DEBUGP(": no chains\n");
 970                 return NULL;
 971         }
 972
 973         (*handle)->chain_iterator_cur = c;
 974         iptcc_chain_iterator_advance(*handle);
 975
 976         DEBUGP(": returning `%s'\n", c->name);
 977         return c->name;
 978 }
 979
 980 /* Iterator functions to run through the chains.  Returns NULL at end. */
 981 const char *
 982 TC_NEXT_CHAIN(TC_HANDLE_T *handle)
 983 {
 984         struct chain_head *c = (*handle)->chain_iterator_cur;
 985
 986         iptc_fn = TC_NEXT_CHAIN;
 987
 988         if (!c) {
 989                 DEBUGP(": no more chains\n");
 990                 return NULL;
 991         }
 992
 993         iptcc_chain_iterator_advance(*handle);
 994
 995         DEBUGP(": returning `%s'\n", c->name);
 996         return c->name;
 997 }
 998
 999 /* Get first rule in the given chain: NULL for empty chain. */
1000 const STRUCT_ENTRY *
1001 TC_FIRST_RULE(const char *chain, TC_HANDLE_T *handle)
1002 {
1003         struct chain_head *c;
1004         struct rule_head *r;
1005
1006         iptc_fn = TC_FIRST_RULE;
1007
1008         DEBUGP("first rule(%s): ", chain);
1009
1010         c = iptcc_find_label(chain, *handle);
1011         if (!c) {
1012                 errno = ENOENT;
1013                 return NULL;
1014         }
1015
1016         /* Empty chain: single return/policy rule */
1017         if (list_empty(&c->rules)) {
1018                 DEBUGP_C("no rules, returning NULL\n");
1019                 return NULL;
1020         }
1021
1022         r = list_entry(c->rules.next, struct rule_head, list);
1023         (*handle)->rule_iterator_cur = r;
1024         DEBUGP_C("%p\n", r);
1025
1026         return r->entry;
1027 }
1028
1029 /* Returns NULL when rules run out. */
1030 const STRUCT_ENTRY *
1031 TC_NEXT_RULE(const STRUCT_ENTRY *prev, TC_HANDLE_T *handle)
1032 {
1033         struct rule_head *r;
1034
1035         iptc_fn = TC_NEXT_RULE;
1036         DEBUGP("rule_iterator_cur=%p...", (*handle)->rule_iterator_cur);
1037
1038         if (!(*handle)->rule_iterator_cur) {
1039                 DEBUGP_C("returning NULL\n");
1040                 return NULL;
1041         }
1042
1043         r = list_entry((*handle)->rule_iterator_cur->list.next,
1044                         struct rule_head, list);
1045
1046         iptc_fn = TC_NEXT_RULE;
1047
1048         DEBUGP_C("next=%p, head=%p...", &r->list,
1049                 &(*handle)->rule_iterator_cur->chain->rules);
1050
1051         if (&r->list == &(*handle)->rule_iterator_cur->chain->rules) {
1052                 (*handle)->rule_iterator_cur = NULL;
1053                 DEBUGP_C("finished, returning NULL\n");
1054                 return NULL;
1055         }
1056
1057         (*handle)->rule_iterator_cur = r;
1058
1059         /* NOTE: prev is without any influence ! */
1060         DEBUGP_C("returning rule %p\n", r);
1061         return r->entry;
1062 }
1063
1064 /* How many rules in this chain? */
1065 unsigned int
1066 TC_NUM_RULES(const char *chain, TC_HANDLE_T *handle)
1067 {
1068         struct chain_head *c;
1069         iptc_fn = TC_NUM_RULES;
1070         CHECK(*handle);
1071
1072         c = iptcc_find_label(chain, *handle);
1073         if (!c) {
1074                 errno = ENOENT;
1075                 return (unsigned int)-1;
1076         }
1077
1078         return c->num_rules;
1079 }
1080
1081 const STRUCT_ENTRY *TC_GET_RULE(const char *chain,
1082                                 unsigned int n,
1083                                 TC_HANDLE_T *handle)
1084 {
1085         struct chain_head *c;
1086         struct rule_head *r;
1087
1088         iptc_fn = TC_GET_RULE;
1089
1090         CHECK(*handle);
1091
1092         c = iptcc_find_label(chain, *handle);
1093         if (!c) {
1094                 errno = ENOENT;
1095                 return NULL;
1096         }
1097
1098         r = iptcc_get_rule_num(c, n);
1099         if (!r)
1100                 return NULL;
1101         return r->entry;
1102 }
1103
1104 /* Returns a pointer to the target name of this position. */
1105 const char *standard_target_map(int verdict)
1106 {
1107         switch (verdict) {
1108                 case RETURN:
1109                         return LABEL_RETURN;
1110                         break;
1111                 case -NF_ACCEPT-1:
1112                         return LABEL_ACCEPT;
1113                         break;
1114                 case -NF_DROP-1:
1115                         return LABEL_DROP;
1116                         break;
1117                 case -NF_QUEUE-1:
1118                         return LABEL_QUEUE;
1119                         break;
1120                 default:
1121                         fprintf(stderr, "ERROR: %d not a valid target)\n",
1122                                 verdict);
1123                         abort();
1124                         break;
1125         }
1126         /* not reached */
1127         return NULL;
1128 }
1129
1130 /* Returns a pointer to the target name of this position. */
1131 const char *TC_GET_TARGET(const STRUCT_ENTRY *ce,
1132                           TC_HANDLE_T *handle)
1133 {
1134         STRUCT_ENTRY *e = (STRUCT_ENTRY *)ce;
1135         struct rule_head *r = container_of(e, struct rule_head, entry[0]);
1136
1137         iptc_fn = TC_GET_TARGET;
1138
1139         switch(r->type) {
1140                 int spos;
1141                 case IPTCC_R_FALLTHROUGH:
1142                         return "";
1143                         break;
1144                 case IPTCC_R_JUMP:
1145                         DEBUGP("r=%p, jump=%p, name=`%s'\n", r, r->jump, r->jump->name);
1146                         return r->jump->name;
1147                         break;
1148                 case IPTCC_R_STANDARD:
1149                         spos = *(int *)GET_TARGET(e)->data;
1150                         DEBUGP("r=%p, spos=%d'\n", r, spos);
1151                         return standard_target_map(spos);
1152                         break;
1153                 case IPTCC_R_MODULE:
1154                         return GET_TARGET(e)->u.user.name;
1155                         break;
1156         }
1157         return NULL;
1158 }
1159 /* Is this a built-in chain?  Actually returns hook + 1. */
1160 int
1161 TC_BUILTIN(const char *chain, const TC_HANDLE_T handle)
1162 {
1163         struct chain_head *c;
1164
1165         iptc_fn = TC_BUILTIN;
1166
1167         c = iptcc_find_label(chain, handle);
1168         if (!c) {
1169                 errno = ENOENT;
1170                 return 0;
1171         }
1172
1173         return iptcc_is_builtin(c);
1174 }
1175
1176 /* Get the policy of a given built-in chain */
1177 const char *
1178 TC_GET_POLICY(const char *chain,
1179               STRUCT_COUNTERS *counters,
1180               TC_HANDLE_T *handle)
1181 {
1182         struct chain_head *c;
1183
1184         iptc_fn = TC_GET_POLICY;
1185
1186         DEBUGP("called for chain %s\n", chain);
1187
1188         c = iptcc_find_label(chain, *handle);
1189         if (!c) {
1190                 errno = ENOENT;
1191                 return NULL;
1192         }
1193
1194         if (!iptcc_is_builtin(c))
1195                 return NULL;
1196
1197         *counters = c->counters;
1198
1199         return standard_target_map(c->verdict);
1200 }
1201
1202 static int
1203 iptcc_standard_map(struct rule_head *r, int verdict)
1204 {
1205         STRUCT_ENTRY *e = r->entry;
1206         STRUCT_STANDARD_TARGET *t;
1207
1208         t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
1209
1210         if (t->target.u.target_size
1211             != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) {
1212                 errno = EINVAL;
1213                 return 0;
1214         }
1215         /* memset for memcmp convenience on delete/replace */
1216         memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN);
1217         strcpy(t->target.u.user.name, STANDARD_TARGET);
1218         t->verdict = verdict;
1219
1220         r->type = IPTCC_R_STANDARD;
1221
1222         return 1;
1223 }
1224
1225 static int
1226 iptcc_map_target(const TC_HANDLE_T handle,
1227            struct rule_head *r)
1228 {
1229         STRUCT_ENTRY *e = r->entry;
1230         STRUCT_ENTRY_TARGET *t = GET_TARGET(e);
1231
1232         /* Maybe it's empty (=> fall through) */
1233         if (strcmp(t->u.user.name, "") == 0) {
1234                 r->type = IPTCC_R_FALLTHROUGH;
1235                 return 1;
1236         }
1237         /* Maybe it's a standard target name... */
1238         else if (strcmp(t->u.user.name, LABEL_ACCEPT) == 0)
1239                 return iptcc_standard_map(r, -NF_ACCEPT - 1);
1240         else if (strcmp(t->u.user.name, LABEL_DROP) == 0)
1241                 return iptcc_standard_map(r, -NF_DROP - 1);
1242         else if (strcmp(t->u.user.name, LABEL_QUEUE) == 0)
1243                 return iptcc_standard_map(r, -NF_QUEUE - 1);
1244         else if (strcmp(t->u.user.name, LABEL_RETURN) == 0)
1245                 return iptcc_standard_map(r, RETURN);
1246         else if (TC_BUILTIN(t->u.user.name, handle)) {
1247                 /* Can't jump to builtins. */
1248                 errno = EINVAL;
1249                 return 0;
1250         } else {
1251                 /* Maybe it's an existing chain name. */
1252                 struct chain_head *c;
1253                 DEBUGP("trying to find chain `%s': ", t->u.user.name);
1254
1255                 c = iptcc_find_label(t->u.user.name, handle);
1256                 if (c) {
1257                         DEBUGP_C("found!\n");
1258                         r->type = IPTCC_R_JUMP;
1259                         r->jump = c;
1260                         c->references++;
1261                         return 1;
1262                 }
1263                 DEBUGP_C("not found :(\n");
1264         }
1265
1266         /* Must be a module?  If not, kernel will reject... */
1267         /* memset to all 0 for your memcmp convenience: don't clear version */
1268         memset(t->u.user.name + strlen(t->u.user.name),
1269                0,
1270                FUNCTION_MAXNAMELEN - 1 - strlen(t->u.user.name));
1271         r->type = IPTCC_R_MODULE;
1272         set_changed(handle);
1273         return 1;
1274 }
1275
1276 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */
1277 int
1278 TC_INSERT_ENTRY(const IPT_CHAINLABEL chain,
1279                 const STRUCT_ENTRY *e,
1280                 unsigned int rulenum,
1281                 TC_HANDLE_T *handle)
1282 {
1283         struct chain_head *c;
1284         struct rule_head *r;
1285         struct list_head *prev;
1286
1287         iptc_fn = TC_INSERT_ENTRY;
1288
1289         if (!(c = iptcc_find_label(chain, *handle))) {
1290                 errno = ENOENT;
1291                 return 0;
1292         }
1293
1294         /* first rulenum index = 0
1295            first c->num_rules index = 1 */
1296         if (rulenum > c->num_rules) {
1297                 errno = E2BIG;
1298                 return 0;
1299         }
1300
1301         /* If we are inserting at the end just take advantage of the
1302            double linked list, insert will happen before the entry
1303            prev points to. */
1304         if (rulenum == c->num_rules) {
1305                 prev = &c->rules;
1306         } else if (rulenum + 1 <= c->num_rules/2) {
1307                 r = iptcc_get_rule_num(c, rulenum + 1);
1308                 prev = &r->list;
1309         } else {
1310                 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1311                 prev = &r->list;
1312         }
1313
1314         if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1315                 errno = ENOMEM;
1316                 return 0;
1317         }
1318
1319         memcpy(r->entry, e, e->next_offset);
1320         r->counter_map.maptype = COUNTER_MAP_SET;
1321
1322         if (!iptcc_map_target(*handle, r)) {
1323                 free(r);
1324                 return 0;
1325         }
1326
1327         list_add_tail(&r->list, prev);
1328         c->num_rules++;
1329
1330         set_changed(*handle);
1331
1332         return 1;
1333 }
1334
1335 /* Atomically replace rule `rulenum' in `chain' with `fw'. */
1336 int
1337 TC_REPLACE_ENTRY(const IPT_CHAINLABEL chain,
1338                  const STRUCT_ENTRY *e,
1339                  unsigned int rulenum,
1340                  TC_HANDLE_T *handle)
1341 {
1342         struct chain_head *c;
1343         struct rule_head *r, *old;
1344
1345         iptc_fn = TC_REPLACE_ENTRY;
1346
1347         if (!(c = iptcc_find_label(chain, *handle))) {
1348                 errno = ENOENT;
1349                 return 0;
1350         }
1351
1352         if (rulenum >= c->num_rules) {
1353                 errno = E2BIG;
1354                 return 0;
1355         }
1356
1357         /* Take advantage of the double linked list if possible. */
1358         if (rulenum + 1 <= c->num_rules/2) {
1359                 old = iptcc_get_rule_num(c, rulenum + 1);
1360         } else {
1361                 old = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1362         }
1363
1364         if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1365                 errno = ENOMEM;
1366                 return 0;
1367         }
1368
1369         memcpy(r->entry, e, e->next_offset);
1370         r->counter_map.maptype = COUNTER_MAP_SET;
1371
1372         if (!iptcc_map_target(*handle, r)) {
1373                 free(r);
1374                 return 0;
1375         }
1376
1377         list_add(&r->list, &old->list);
1378         iptcc_delete_rule(old);
1379
1380         set_changed(*handle);
1381
1382         return 1;
1383 }
1384
1385 /* Append entry `fw' to chain `chain'.  Equivalent to insert with
1386    rulenum = length of chain. */
1387 int
1388 TC_APPEND_ENTRY(const IPT_CHAINLABEL chain,
1389                 const STRUCT_ENTRY *e,
1390                 TC_HANDLE_T *handle)
1391 {
1392         struct chain_head *c;
1393         struct rule_head *r;
1394
1395         iptc_fn = TC_APPEND_ENTRY;
1396         if (!(c = iptcc_find_label(chain, *handle))) {
1397                 DEBUGP("unable to find chain `%s'\n", chain);
1398                 errno = ENOENT;
1399                 return 0;
1400         }
1401
1402         if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1403                 DEBUGP("unable to allocate rule for chain `%s'\n", chain);
1404                 errno = ENOMEM;
1405                 return 0;
1406         }
1407
1408         memcpy(r->entry, e, e->next_offset);
1409         r->counter_map.maptype = COUNTER_MAP_SET;
1410
1411         if (!iptcc_map_target(*handle, r)) {
1412                 DEBUGP("unable to map target of rule for chain `%s'\n", chain);
1413                 free(r);
1414                 return 0;
1415         }
1416
1417         list_add_tail(&r->list, &c->rules);
1418         c->num_rules++;
1419
1420         set_changed(*handle);
1421
1422         return 1;
1423 }
1424
1425 static inline int
1426 match_different(const STRUCT_ENTRY_MATCH *a,
1427                 const unsigned char *a_elems,
1428                 const unsigned char *b_elems,
1429                 unsigned char **maskptr)
1430 {
1431         const STRUCT_ENTRY_MATCH *b;
1432         unsigned int i;
1433
1434         /* Offset of b is the same as a. */
1435         b = (void *)b_elems + ((unsigned char *)a - a_elems);
1436
1437         if (a->u.match_size != b->u.match_size)
1438                 return 1;
1439
1440         if (strcmp(a->u.user.name, b->u.user.name) != 0)
1441                 return 1;
1442
1443         *maskptr += ALIGN(sizeof(*a));
1444
1445         for (i = 0; i < a->u.match_size - ALIGN(sizeof(*a)); i++)
1446                 if (((a->data[i] ^ b->data[i]) & (*maskptr)[i]) != 0)
1447                         return 1;
1448         *maskptr += i;
1449         return 0;
1450 }
1451
1452 static inline int
1453 target_same(struct rule_head *a, struct rule_head *b,const unsigned char *mask)
1454 {
1455         unsigned int i;
1456         STRUCT_ENTRY_TARGET *ta, *tb;
1457
1458         if (a->type != b->type)
1459                 return 0;
1460
1461         ta = GET_TARGET(a->entry);
1462         tb = GET_TARGET(b->entry);
1463
1464         switch (a->type) {
1465         case IPTCC_R_FALLTHROUGH:
1466                 return 1;
1467         case IPTCC_R_JUMP:
1468                 return a->jump == b->jump;
1469         case IPTCC_R_STANDARD:
1470                 return ((STRUCT_STANDARD_TARGET *)ta)->verdict
1471                         == ((STRUCT_STANDARD_TARGET *)tb)->verdict;
1472         case IPTCC_R_MODULE:
1473                 if (ta->u.target_size != tb->u.target_size)
1474                         return 0;
1475                 if (strcmp(ta->u.user.name, tb->u.user.name) != 0)
1476                         return 0;
1477
1478                 for (i = 0; i < ta->u.target_size - sizeof(*ta); i++)
1479                         if (((ta->data[i] ^ tb->data[i]) & mask[i]) != 0)
1480                                 return 0;
1481                 return 1;
1482         default:
1483                 fprintf(stderr, "ERROR: bad type %i\n", a->type);
1484                 abort();
1485         }
1486 }
1487
1488 static unsigned char *
1489 is_same(const STRUCT_ENTRY *a,
1490         const STRUCT_ENTRY *b,
1491         unsigned char *matchmask);
1492
1493 /* Delete the first rule in `chain' which matches `fw'. */
1494 int
1495 TC_DELETE_ENTRY(const IPT_CHAINLABEL chain,
1496                 const STRUCT_ENTRY *origfw,
1497                 unsigned char *matchmask,
1498                 TC_HANDLE_T *handle)
1499 {
1500         struct chain_head *c;
1501         struct rule_head *r, *i;
1502
1503         iptc_fn = TC_DELETE_ENTRY;
1504         if (!(c = iptcc_find_label(chain, *handle))) {
1505                 errno = ENOENT;
1506                 return 0;
1507         }
1508
1509         /* Create a rule_head from origfw. */
1510         r = iptcc_alloc_rule(c, origfw->next_offset);
1511         if (!r) {
1512                 errno = ENOMEM;
1513                 return 0;
1514         }
1515
1516         memcpy(r->entry, origfw, origfw->next_offset);
1517         r->counter_map.maptype = COUNTER_MAP_NOMAP;
1518         if (!iptcc_map_target(*handle, r)) {
1519                 DEBUGP("unable to map target of rule for chain `%s'\n", chain);
1520                 free(r);
1521                 return 0;
1522         } else {
1523                 /* iptcc_map_target increment target chain references
1524                  * since this is a fake rule only used for matching
1525                  * the chain references count is decremented again.
1526                  */
1527                 if (r->type == IPTCC_R_JUMP
1528                     && r->jump)
1529                         r->jump->references--;
1530         }
1531
1532         list_for_each_entry(i, &c->rules, list) {
1533                 unsigned char *mask;
1534
1535                 mask = is_same(r->entry, i->entry, matchmask);
1536                 if (!mask)
1537                         continue;
1538
1539                 if (!target_same(r, i, mask))
1540                         continue;
1541
1542                 /* If we are about to delete the rule that is the
1543                  * current iterator, move rule iterator back.  next
1544                  * pointer will then point to real next node */
1545                 if (i == (*handle)->rule_iterator_cur) {
1546                         (*handle)->rule_iterator_cur =
1547                                 list_entry((*handle)->rule_iterator_cur->list.prev,
1548                                            struct rule_head, list);
1549                 }
1550
1551                 c->num_rules--;
1552                 iptcc_delete_rule(i);
1553
1554                 set_changed(*handle);
1555                 free(r);
1556                 return 1;
1557         }
1558
1559         free(r);
1560         errno = ENOENT;
1561         return 0;
1562 }
1563
1564
1565 /* Delete the rule in position `rulenum' in `chain'. */
1566 int
1567 TC_DELETE_NUM_ENTRY(const IPT_CHAINLABEL chain,
1568                     unsigned int rulenum,
1569                     TC_HANDLE_T *handle)
1570 {
1571         struct chain_head *c;
1572         struct rule_head *r;
1573
1574         iptc_fn = TC_DELETE_NUM_ENTRY;
1575
1576         if (!(c = iptcc_find_label(chain, *handle))) {
1577                 errno = ENOENT;
1578                 return 0;
1579         }
1580
1581         if (rulenum >= c->num_rules) {
1582                 errno = E2BIG;
1583                 return 0;
1584         }
1585
1586         /* Take advantage of the double linked list if possible. */
1587         if (rulenum + 1 <= c->num_rules/2) {
1588                 r = iptcc_get_rule_num(c, rulenum + 1);
1589         } else {
1590                 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1591         }
1592
1593         /* If we are about to delete the rule that is the current
1594          * iterator, move rule iterator back.  next pointer will then
1595          * point to real next node */
1596         if (r == (*handle)->rule_iterator_cur) {
1597                 (*handle)->rule_iterator_cur =
1598                         list_entry((*handle)->rule_iterator_cur->list.prev,
1599                                    struct rule_head, list);
1600         }
1601
1602         c->num_rules--;
1603         iptcc_delete_rule(r);
1604
1605         set_changed(*handle);
1606
1607         return 1;
1608 }
1609
1610 /* Check the packet `fw' on chain `chain'.  Returns the verdict, or
1611    NULL and sets errno. */
1612 const char *
1613 TC_CHECK_PACKET(const IPT_CHAINLABEL chain,
1614                 STRUCT_ENTRY *entry,
1615                 TC_HANDLE_T *handle)
1616 {
1617         iptc_fn = TC_CHECK_PACKET;
1618         errno = ENOSYS;
1619         return NULL;
1620 }
1621
1622 /* Flushes the entries in the given chain (ie. empties chain). */
1623 int
1624 TC_FLUSH_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1625 {
1626         struct chain_head *c;
1627         struct rule_head *r, *tmp;
1628
1629         iptc_fn = TC_FLUSH_ENTRIES;
1630         if (!(c = iptcc_find_label(chain, *handle))) {
1631                 errno = ENOENT;
1632                 return 0;
1633         }
1634
1635         list_for_each_entry_safe(r, tmp, &c->rules, list) {
1636                 iptcc_delete_rule(r);
1637         }
1638
1639         c->num_rules = 0;
1640
1641         set_changed(*handle);
1642
1643         return 1;
1644 }
1645
1646 /* Zeroes the counters in a chain. */
1647 int
1648 TC_ZERO_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1649 {
1650         struct chain_head *c;
1651         struct rule_head *r;
1652
1653         iptc_fn = TC_ZERO_ENTRIES;
1654         if (!(c = iptcc_find_label(chain, *handle))) {
1655                 errno = ENOENT;
1656                 return 0;
1657         }
1658
1659         if (c->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
1660                 c->counter_map.maptype = COUNTER_MAP_ZEROED;
1661
1662         list_for_each_entry(r, &c->rules, list) {
1663                 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
1664                         r->counter_map.maptype = COUNTER_MAP_ZEROED;
1665         }
1666
1667         set_changed(*handle);
1668
1669         return 1;
1670 }
1671
1672 STRUCT_COUNTERS *
1673 TC_READ_COUNTER(const IPT_CHAINLABEL chain,
1674                 unsigned int rulenum,
1675                 TC_HANDLE_T *handle)
1676 {
1677         struct chain_head *c;
1678         struct rule_head *r;
1679
1680         iptc_fn = TC_READ_COUNTER;
1681         CHECK(*handle);
1682
1683         if (!(c = iptcc_find_label(chain, *handle))) {
1684                 errno = ENOENT;
1685                 return NULL;
1686         }
1687
1688         if (!(r = iptcc_get_rule_num(c, rulenum))) {
1689                 errno = E2BIG;
1690                 return NULL;
1691         }
1692
1693         return &r->entry[0].counters;
1694 }
1695
1696 int
1697 TC_ZERO_COUNTER(const IPT_CHAINLABEL chain,
1698                 unsigned int rulenum,
1699                 TC_HANDLE_T *handle)
1700 {
1701         struct chain_head *c;
1702         struct rule_head *r;
1703
1704         iptc_fn = TC_ZERO_COUNTER;
1705         CHECK(*handle);
1706
1707         if (!(c = iptcc_find_label(chain, *handle))) {
1708                 errno = ENOENT;
1709                 return 0;
1710         }
1711
1712         if (!(r = iptcc_get_rule_num(c, rulenum))) {
1713                 errno = E2BIG;
1714                 return 0;
1715         }
1716
1717         if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
1718                 r->counter_map.maptype = COUNTER_MAP_ZEROED;
1719
1720         set_changed(*handle);
1721
1722         return 1;
1723 }
1724
1725 int
1726 TC_SET_COUNTER(const IPT_CHAINLABEL chain,
1727                unsigned int rulenum,
1728                STRUCT_COUNTERS *counters,
1729                TC_HANDLE_T *handle)
1730 {
1731         struct chain_head *c;
1732         struct rule_head *r;
1733         STRUCT_ENTRY *e;
1734
1735         iptc_fn = TC_SET_COUNTER;
1736         CHECK(*handle);
1737
1738         if (!(c = iptcc_find_label(chain, *handle))) {
1739                 errno = ENOENT;
1740                 return 0;
1741         }
1742
1743         if (!(r = iptcc_get_rule_num(c, rulenum))) {
1744                 errno = E2BIG;
1745                 return 0;
1746         }
1747
1748         e = r->entry;
1749         r->counter_map.maptype = COUNTER_MAP_SET;
1750
1751         memcpy(&e->counters, counters, sizeof(STRUCT_COUNTERS));
1752
1753         set_changed(*handle);
1754
1755         return 1;
1756 }
1757
1758 /* Creates a new chain. */
1759 /* To create a chain, create two rules: error node and unconditional
1760  * return. */
1761 int
1762 TC_CREATE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1763 {
1764         static struct chain_head *c;
1765
1766         iptc_fn = TC_CREATE_CHAIN;
1767
1768         /* find_label doesn't cover built-in targets: DROP, ACCEPT,
1769            QUEUE, RETURN. */
1770         if (iptcc_find_label(chain, *handle)
1771             || strcmp(chain, LABEL_DROP) == 0
1772             || strcmp(chain, LABEL_ACCEPT) == 0
1773             || strcmp(chain, LABEL_QUEUE) == 0
1774             || strcmp(chain, LABEL_RETURN) == 0) {
1775                 DEBUGP("Chain `%s' already exists\n", chain);
1776                 errno = EEXIST;
1777                 return 0;
1778         }
1779
1780         if (strlen(chain)+1 > sizeof(IPT_CHAINLABEL)) {
1781                 DEBUGP("Chain name `%s' too long\n", chain);
1782                 errno = EINVAL;
1783                 return 0;
1784         }
1785
1786         c = iptcc_alloc_chain_head(chain, 0);
1787         if (!c) {
1788                 DEBUGP("Cannot allocate memory for chain `%s'\n", chain);
1789                 errno = ENOMEM;
1790                 return 0;
1791
1792         }
1793
1794         DEBUGP("Creating chain `%s'\n", chain);
1795         list_add_tail(&c->list, &(*handle)->chains);
1796
1797         set_changed(*handle);
1798
1799         return 1;
1800 }
1801
1802 /* Get the number of references to this chain. */
1803 int
1804 TC_GET_REFERENCES(unsigned int *ref, const IPT_CHAINLABEL chain,
1805                   TC_HANDLE_T *handle)
1806 {
1807         struct chain_head *c;
1808
1809         iptc_fn = TC_GET_REFERENCES;
1810         if (!(c = iptcc_find_label(chain, *handle))) {
1811                 errno = ENOENT;
1812                 return 0;
1813         }
1814
1815         *ref = c->references;
1816
1817         return 1;
1818 }
1819
1820 /* Deletes a chain. */
1821 int
1822 TC_DELETE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1823 {
1824         unsigned int references;
1825         struct chain_head *c;
1826
1827         iptc_fn = TC_DELETE_CHAIN;
1828
1829         if (!(c = iptcc_find_label(chain, *handle))) {
1830                 DEBUGP("cannot find chain `%s'\n", chain);
1831                 errno = ENOENT;
1832                 return 0;
1833         }
1834
1835         if (TC_BUILTIN(chain, *handle)) {
1836                 DEBUGP("cannot remove builtin chain `%s'\n", chain);
1837                 errno = EINVAL;
1838                 return 0;
1839         }
1840
1841         if (!TC_GET_REFERENCES(&references, chain, handle)) {
1842                 DEBUGP("cannot get references on chain `%s'\n", chain);
1843                 return 0;
1844         }
1845
1846         if (references > 0) {
1847                 DEBUGP("chain `%s' still has references\n", chain);
1848                 errno = EMLINK;
1849                 return 0;
1850         }
1851
1852         if (c->num_rules) {
1853                 DEBUGP("chain `%s' is not empty\n", chain);
1854                 errno = ENOTEMPTY;
1855                 return 0;
1856         }
1857
1858         /* If we are about to delete the chain that is the current
1859          * iterator, move chain iterator firward. */
1860         if (c == (*handle)->chain_iterator_cur)
1861                 iptcc_chain_iterator_advance(*handle);
1862
1863         list_del(&c->list);
1864         free(c);
1865
1866         DEBUGP("chain `%s' deleted\n", chain);
1867
1868         set_changed(*handle);
1869
1870         return 1;
1871 }
1872
1873 /* Renames a chain. */
1874 int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname,
1875                     const IPT_CHAINLABEL newname,
1876                     TC_HANDLE_T *handle)
1877 {
1878         struct chain_head *c;
1879         iptc_fn = TC_RENAME_CHAIN;
1880
1881         /* find_label doesn't cover built-in targets: DROP, ACCEPT,
1882            QUEUE, RETURN. */
1883         if (iptcc_find_label(newname, *handle)
1884             || strcmp(newname, LABEL_DROP) == 0
1885             || strcmp(newname, LABEL_ACCEPT) == 0
1886             || strcmp(newname, LABEL_QUEUE) == 0
1887             || strcmp(newname, LABEL_RETURN) == 0) {
1888                 errno = EEXIST;
1889                 return 0;
1890         }
1891
1892         if (!(c = iptcc_find_label(oldname, *handle))
1893             || TC_BUILTIN(oldname, *handle)) {
1894                 errno = ENOENT;
1895                 return 0;
1896         }
1897
1898         if (strlen(newname)+1 > sizeof(IPT_CHAINLABEL)) {
1899                 errno = EINVAL;
1900                 return 0;
1901         }
1902
1903         strncpy(c->name, newname, sizeof(IPT_CHAINLABEL));
1904
1905         set_changed(*handle);
1906
1907         return 1;
1908 }
1909
1910 /* Sets the policy on a built-in chain. */
1911 int
1912 TC_SET_POLICY(const IPT_CHAINLABEL chain,
1913               const IPT_CHAINLABEL policy,
1914               STRUCT_COUNTERS *counters,
1915               TC_HANDLE_T *handle)
1916 {
1917         struct chain_head *c;
1918
1919         iptc_fn = TC_SET_POLICY;
1920
1921         if (!(c = iptcc_find_label(chain, *handle))) {
1922                 DEBUGP("cannot find chain `%s'\n", chain);
1923                 errno = ENOENT;
1924                 return 0;
1925         }
1926
1927         if (!iptcc_is_builtin(c)) {
1928                 DEBUGP("cannot set policy of userdefinedchain `%s'\n", chain);
1929                 errno = ENOENT;
1930                 return 0;
1931         }
1932
1933         if (strcmp(policy, LABEL_ACCEPT) == 0)
1934                 c->verdict = -NF_ACCEPT - 1;
1935         else if (strcmp(policy, LABEL_DROP) == 0)
1936                 c->verdict = -NF_DROP - 1;
1937         else {
1938                 errno = EINVAL;
1939                 return 0;
1940         }
1941
1942         if (counters) {
1943                 /* set byte and packet counters */
1944                 memcpy(&c->counters, counters, sizeof(STRUCT_COUNTERS));
1945                 c->counter_map.maptype = COUNTER_MAP_SET;
1946         } else {
1947                 c->counter_map.maptype = COUNTER_MAP_NOMAP;
1948         }
1949
1950         set_changed(*handle);
1951
1952         return 1;
1953 }
1954
1955 /* Without this, on gcc 2.7.2.3, we get:
1956    libiptc.c: In function `TC_COMMIT':
1957    libiptc.c:833: fixed or forbidden register was spilled.
1958    This may be due to a compiler bug or to impossible asm
1959    statements or clauses.
1960 */
1961 static void
1962 subtract_counters(STRUCT_COUNTERS *answer,
1963                   const STRUCT_COUNTERS *a,
1964                   const STRUCT_COUNTERS *b)
1965 {
1966         answer->pcnt = a->pcnt - b->pcnt;
1967         answer->bcnt = a->bcnt - b->bcnt;
1968 }
1969
1970
1971 static void counters_nomap(STRUCT_COUNTERS_INFO *newcounters,
1972                            unsigned int index)
1973 {
1974         newcounters->counters[index] = ((STRUCT_COUNTERS) { 0, 0});
1975         DEBUGP_C("NOMAP => zero\n");
1976 }
1977
1978 static void counters_normal_map(STRUCT_COUNTERS_INFO *newcounters,
1979                                 STRUCT_REPLACE *repl,
1980                                 unsigned int index,
1981                                 unsigned int mappos)
1982 {
1983         /* Original read: X.
1984          * Atomic read on replacement: X + Y.
1985          * Currently in kernel: Z.
1986          * Want in kernel: X + Y + Z.
1987          * => Add in X + Y
1988          * => Add in replacement read.
1989          */
1990         newcounters->counters[index] = repl->counters[mappos];
1991         DEBUGP_C("NORMAL_MAP => mappos %u \n", mappos);
1992 }
1993
1994 static void counters_map_zeroed(STRUCT_COUNTERS_INFO *newcounters,
1995                                 STRUCT_REPLACE *repl,
1996                                 unsigned int index,
1997                                 unsigned int mappos,
1998                                 STRUCT_COUNTERS *counters)
1999 {
2000         /* Original read: X.
2001          * Atomic read on replacement: X + Y.
2002          * Currently in kernel: Z.
2003          * Want in kernel: Y + Z.
2004          * => Add in Y.
2005          * => Add in (replacement read - original read).
2006          */
2007         subtract_counters(&newcounters->counters[index],
2008                           &repl->counters[mappos],
2009                           counters);
2010         DEBUGP_C("ZEROED => mappos %u\n", mappos);
2011 }
2012
2013 static void counters_map_set(STRUCT_COUNTERS_INFO *newcounters,
2014                              unsigned int index,
2015                              STRUCT_COUNTERS *counters)
2016 {
2017         /* Want to set counter (iptables-restore) */
2018
2019         memcpy(&newcounters->counters[index], counters,
2020                 sizeof(STRUCT_COUNTERS));
2021
2022         DEBUGP_C("SET\n");
2023 }
2024
2025
2026 int
2027 TC_COMMIT(TC_HANDLE_T *handle)
2028 {
2029         /* Replace, then map back the counters. */
2030         STRUCT_REPLACE *repl;
2031         STRUCT_COUNTERS_INFO *newcounters;
2032         struct chain_head *c;
2033         int ret;
2034         size_t counterlen;
2035         int new_number;
2036         unsigned int new_size;
2037
2038         iptc_fn = TC_COMMIT;
2039         CHECK(*handle);
2040
2041         /* Don't commit if nothing changed. */
2042         if (!(*handle)->changed)
2043                 goto finished;
2044
2045         new_number = iptcc_compile_table_prep(*handle, &new_size);
2046         if (new_number < 0) {
2047                 errno = ENOMEM;
2048                 goto out_zero;
2049         }
2050
2051         repl = malloc(sizeof(*repl) + new_size);
2052         if (!repl) {
2053                 errno = ENOMEM;
2054                 goto out_zero;
2055         }
2056         memset(repl, 0, sizeof(*repl) + new_size);
2057
2058 #if 0
2059         TC_DUMP_ENTRIES(*handle);
2060 #endif
2061
2062         counterlen = sizeof(STRUCT_COUNTERS_INFO)
2063                         + sizeof(STRUCT_COUNTERS) * new_number;
2064
2065         /* These are the old counters we will get from kernel */
2066         repl->counters = malloc(sizeof(STRUCT_COUNTERS)
2067                                 * (*handle)->info.num_entries);
2068         if (!repl->counters) {
2069                 errno = ENOMEM;
2070                 goto out_free_repl;
2071         }
2072         /* These are the counters we're going to put back, later. */
2073         newcounters = malloc(counterlen);
2074         if (!newcounters) {
2075                 errno = ENOMEM;
2076                 goto out_free_repl_counters;
2077         }
2078         memset(newcounters, 0, counterlen);
2079
2080         strcpy(repl->name, (*handle)->info.name);
2081         repl->num_entries = new_number;
2082         repl->size = new_size;
2083
2084         repl->num_counters = (*handle)->info.num_entries;
2085         repl->valid_hooks = (*handle)->info.valid_hooks;
2086
2087         DEBUGP("num_entries=%u, size=%u, num_counters=%u\n",
2088                 repl->num_entries, repl->size, repl->num_counters);
2089
2090         ret = iptcc_compile_table(*handle, repl);
2091         if (ret < 0) {
2092                 errno = ret;
2093                 goto out_free_newcounters;
2094         }
2095
2096
2097 #ifdef IPTC_DEBUG2
2098         {
2099                 int fd = open("/tmp/libiptc-so_set_replace.blob",
2100                                 O_CREAT|O_WRONLY);
2101                 if (fd >= 0) {
2102                         write(fd, repl, sizeof(*repl) + repl->size);
2103                         close(fd);
2104                 }
2105         }
2106 #endif
2107
2108         ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_REPLACE, repl,
2109                          sizeof(*repl) + repl->size);
2110         if (ret < 0)
2111                 goto out_free_newcounters;
2112
2113         /* Put counters back. */
2114         strcpy(newcounters->name, (*handle)->info.name);
2115         newcounters->num_counters = new_number;
2116
2117         list_for_each_entry(c, &(*handle)->chains, list) {
2118                 struct rule_head *r;
2119
2120                 /* Builtin chains have their own counters */
2121                 if (iptcc_is_builtin(c)) {
2122                         DEBUGP("counter for chain-index %u: ", c->foot_index);
2123                         switch(c->counter_map.maptype) {
2124                         case COUNTER_MAP_NOMAP:
2125                                 counters_nomap(newcounters, c->foot_index);
2126                                 break;
2127                         case COUNTER_MAP_NORMAL_MAP:
2128                                 counters_normal_map(newcounters, repl,
2129                                                     c->foot_index,
2130                                                     c->counter_map.mappos);
2131                                 break;
2132                         case COUNTER_MAP_ZEROED:
2133                                 counters_map_zeroed(newcounters, repl,
2134                                                     c->foot_index,
2135                                                     c->counter_map.mappos,
2136                                                     &c->counters);
2137                                 break;
2138                         case COUNTER_MAP_SET:
2139                                 counters_map_set(newcounters, c->foot_index,
2140                                                  &c->counters);
2141                                 break;
2142                         }
2143                 }
2144
2145                 list_for_each_entry(r, &c->rules, list) {
2146                         DEBUGP("counter for index %u: ", r->index);
2147                         switch (r->counter_map.maptype) {
2148                         case COUNTER_MAP_NOMAP:
2149                                 counters_nomap(newcounters, r->index);
2150                                 break;
2151
2152                         case COUNTER_MAP_NORMAL_MAP:
2153                                 counters_normal_map(newcounters, repl,
2154                                                     r->index,
2155                                                     r->counter_map.mappos);
2156                                 break;
2157
2158                         case COUNTER_MAP_ZEROED:
2159                                 counters_map_zeroed(newcounters, repl,
2160                                                     r->index,
2161                                                     r->counter_map.mappos,
2162                                                     &r->entry->counters);
2163                                 break;
2164
2165                         case COUNTER_MAP_SET:
2166                                 counters_map_set(newcounters, r->index,
2167                                                  &r->entry->counters);
2168                                 break;
2169                         }
2170                 }
2171         }
2172
2173
2174 #ifdef KERNEL_64_USERSPACE_32
2175         {
2176                 /* Kernel will think that pointer should be 64-bits, and get
2177                    padding.  So we accomodate here (assumption: alignment of
2178                    `counters' is on 64-bit boundary). */
2179                 u_int64_t *kernptr = (u_int64_t *)&newcounters->counters;
2180                 if ((unsigned long)&newcounters->counters % 8 != 0) {
2181                         fprintf(stderr,
2182                                 "counters alignment incorrect! Mail rusty!\n");
2183                         abort();
2184                 }
2185                 *kernptr = newcounters->counters;
2186         }
2187 #endif /* KERNEL_64_USERSPACE_32 */
2188
2189 #ifdef IPTC_DEBUG2
2190         {
2191                 int fd = open("/tmp/libiptc-so_set_add_counters.blob",
2192                                 O_CREAT|O_WRONLY);
2193                 if (fd >= 0) {
2194                         write(fd, newcounters, counterlen);
2195                         close(fd);
2196                 }
2197         }
2198 #endif
2199
2200         ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_ADD_COUNTERS,
2201                          newcounters, counterlen);
2202         if (ret < 0)
2203                 goto out_free_newcounters;
2204
2205         free(repl->counters);
2206         free(repl);
2207         free(newcounters);
2208
2209 finished:
2210         TC_FREE(handle);
2211         return 1;
2212
2213 out_free_newcounters:
2214         free(newcounters);
2215 out_free_repl_counters:
2216         free(repl->counters);
2217 out_free_repl:
2218         free(repl);
2219 out_zero:
2220         return 0;
2221 }
2222
2223 /* Get raw socket. */
2224 int
2225 TC_GET_RAW_SOCKET()
2226 {
2227         return sockfd;
2228 }
2229
2230 /* Translates errno numbers into more human-readable form than strerror. */
2231 const char *
2232 TC_STRERROR(int err)
2233 {
2234         unsigned int i;
2235         struct table_struct {
2236                 void *fn;
2237                 int err;
2238                 const char *message;
2239         } table [] =
2240           { { TC_INIT, EPERM, "Permission denied (you must be root)" },
2241             { TC_INIT, EINVAL, "Module is wrong version" },
2242             { TC_INIT, ENOENT,
2243                     "Table does not exist (do you need to insmod?)" },
2244             { TC_DELETE_CHAIN, ENOTEMPTY, "Chain is not empty" },
2245             { TC_DELETE_CHAIN, EINVAL, "Can't delete built-in chain" },
2246             { TC_DELETE_CHAIN, EMLINK,
2247               "Can't delete chain with references left" },
2248             { TC_CREATE_CHAIN, EEXIST, "Chain already exists" },
2249             { TC_INSERT_ENTRY, E2BIG, "Index of insertion too big" },
2250             { TC_REPLACE_ENTRY, E2BIG, "Index of replacement too big" },
2251             { TC_DELETE_NUM_ENTRY, E2BIG, "Index of deletion too big" },
2252             { TC_READ_COUNTER, E2BIG, "Index of counter too big" },
2253             { TC_ZERO_COUNTER, E2BIG, "Index of counter too big" },
2254             { TC_INSERT_ENTRY, ELOOP, "Loop found in table" },
2255             { TC_INSERT_ENTRY, EINVAL, "Target problem" },
2256             /* EINVAL for CHECK probably means bad interface. */
2257             { TC_CHECK_PACKET, EINVAL,
2258               "Bad arguments (does that interface exist?)" },
2259             { TC_CHECK_PACKET, ENOSYS,
2260               "Checking will most likely never get implemented" },
2261             /* ENOENT for DELETE probably means no matching rule */
2262             { TC_DELETE_ENTRY, ENOENT,
2263               "Bad rule (does a matching rule exist in that chain?)" },
2264             { TC_SET_POLICY, ENOENT,
2265               "Bad built-in chain name" },
2266             { TC_SET_POLICY, EINVAL,
2267               "Bad policy name" },
2268
2269             { NULL, 0, "Incompatible with this kernel" },
2270             { NULL, ENOPROTOOPT, "iptables who? (do you need to insmod?)" },
2271             { NULL, ENOSYS, "Will be implemented real soon.  I promise ;)" },
2272             { NULL, ENOMEM, "Memory allocation problem" },
2273             { NULL, ENOENT, "No chain/target/match by that name" },
2274           };
2275
2276         for (i = 0; i < sizeof(table)/sizeof(struct table_struct); i++) {
2277                 if ((!table[i].fn || table[i].fn == iptc_fn)
2278                     && table[i].err == err)
2279                         return table[i].message;
2280         }
2281
2282         return strerror(err);
2283 }