/* Code to take an iptables-style command line and do it. */

/*

 * Author: Paul.Russell@rustcorp.com.au and mneuling@radlogic.com.au

 *

 * (C) 2000-2002 by the netfilter coreteam <coreteam@netfilter.org>:

 * 		    Paul 'Rusty' Russell <rusty@rustcorp.com.au>

 * 		    Marc Boucher <marc+nf@mbsi.ca>

 * 		    James Morris <jmorris@intercode.com.au>

 * 		    Harald Welte <laforge@gnumonks.org>

 * 		    Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>

 *

 *	This program is free software; you can redistribute it and/or modify

 *	it under the terms of the GNU General Public License as published by

 *	the Free Software Foundation; either version 2 of the License, or

 *	(at your option) any later version.

 *

 *	This program is distributed in the hope that it will be useful,

 *	but WITHOUT ANY WARRANTY; without even the implied warranty of

 *	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *	GNU General Public License for more details.

 *

 *	You should have received a copy of the GNU General Public License

 *	along with this program; if not, write to the Free Software

 *	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

 */

#include <getopt.h>

#include <string.h>

#include <netdb.h>

#include <errno.h>

#include <stdbool.h>

#include <stdio.h>

#include <stdlib.h>

#include <ctype.h>

#include <stdarg.h>

#include <limits.h>

#include <unistd.h>

#include <iptables.h>

#include <xtables.h>

#include <fcntl.h>

#include "xshared.h"

#ifndef TRUE

#define TRUE 1

#endif

#ifndef FALSE

#define FALSE 0

#endif

#define CMD_NONE		0x0000U

#define CMD_INSERT		0x0001U

#define CMD_DELETE		0x0002U

#define CMD_DELETE_NUM		0x0004U

#define CMD_REPLACE		0x0008U

#define CMD_APPEND		0x0010U

#define CMD_LIST		0x0020U

#define CMD_FLUSH		0x0040U

#define CMD_ZERO		0x0080U

#define CMD_NEW_CHAIN		0x0100U

#define CMD_DELETE_CHAIN	0x0200U

#define CMD_SET_POLICY		0x0400U

#define CMD_RENAME_CHAIN	0x0800U

#define CMD_LIST_RULES		0x1000U

#define CMD_ZERO_NUM		0x2000U

#define CMD_CHECK		0x4000U

#define NUMBER_OF_CMD	16

static const char cmdflags[] = { 'I', 'D', 'D', 'R', 'A', 'L', 'F', 'Z',

				 'N', 'X', 'P', 'E', 'S', 'Z', 'C' };

#define OPT_FRAGMENT    0x00800U

#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)

static const char optflags[]

= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};

static const char unsupported_rev[] = " [unsupported revision]";

static struct option original_opts[] = {

	{.name = "append",        .has_arg = 1, .val = 'A'},

	{.name = "delete",        .has_arg = 1, .val = 'D'},

	{.name = "check",         .has_arg = 1, .val = 'C'},

	{.name = "insert",        .has_arg = 1, .val = 'I'},

	{.name = "replace",       .has_arg = 1, .val = 'R'},

	{.name = "list",          .has_arg = 2, .val = 'L'},

	{.name = "list-rules",    .has_arg = 2, .val = 'S'},

	{.name = "flush",         .has_arg = 2, .val = 'F'},

	{.name = "zero",          .has_arg = 2, .val = 'Z'},

	{.name = "new-chain",     .has_arg = 1, .val = 'N'},

	{.name = "delete-chain",  .has_arg = 2, .val = 'X'},

	{.name = "rename-chain",  .has_arg = 1, .val = 'E'},

	{.name = "policy",        .has_arg = 1, .val = 'P'},

	{.name = "source",        .has_arg = 1, .val = 's'},

	{.name = "destination",   .has_arg = 1, .val = 'd'},

	{.name = "src",           .has_arg = 1, .val = 's'}, /* synonym */

	{.name = "dst",           .has_arg = 1, .val = 'd'}, /* synonym */

	{.name = "protocol",      .has_arg = 1, .val = 'p'},

	{.name = "in-interface",  .has_arg = 1, .val = 'i'},

	{.name = "jump",          .has_arg = 1, .val = 'j'},

	{.name = "table",         .has_arg = 1, .val = 't'},

	{.name = "match",         .has_arg = 1, .val = 'm'},

	{.name = "numeric",       .has_arg = 0, .val = 'n'},

	{.name = "out-interface", .has_arg = 1, .val = 'o'},

	{.name = "verbose",       .has_arg = 0, .val = 'v'},

	{.name = "wait",          .has_arg = 2, .val = 'w'},

	{.name = "wait-interval", .has_arg = 2, .val = 'W'},

	{.name = "exact",         .has_arg = 0, .val = 'x'},

	{.name = "fragments",     .has_arg = 0, .val = 'f'},

	{.name = "version",       .has_arg = 0, .val = 'V'},

	{.name = "help",          .has_arg = 2, .val = 'h'},

	{.name = "line-numbers",  .has_arg = 0, .val = '0'},

	{.name = "modprobe",      .has_arg = 1, .val = 'M'},

	{.name = "set-counters",  .has_arg = 1, .val = 'c'},

	{.name = "goto",          .has_arg = 1, .val = 'g'},

	{.name = "ipv4",          .has_arg = 0, .val = '4'},

	{.name = "ipv6",          .has_arg = 0, .val = '6'},

	{NULL},

};

void iptables_exit_error(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));

struct xtables_globals iptables_globals = {

	.option_offset = 0,

	.program_version = IPTABLES_VERSION,

	.orig_opts = original_opts,

	.exit_err = iptables_exit_error,

	.compat_rev = xtables_compatible_revision,

};

/* Table of legal combinations of commands and options.  If any of the

 * given commands make an option legal, that option is legal (applies to

 * CMD_LIST and CMD_ZERO only).

 * Key:

 *  +  compulsory

 *  x  illegal

 *     optional

 */

static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =

/* Well, it's better than "Re: Linux vs FreeBSD" */

{

	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f */

/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},

/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},

/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},

/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},

/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},

/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},

/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x'},

/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},

};

static const int inverse_for_options[NUMBER_OF_OPT] =

{

/* -n */ 0,

/* -s */ IPT_INV_SRCIP,

/* -d */ IPT_INV_DSTIP,

/* -p */ XT_INV_PROTO,

/* -j */ 0,

/* -v */ 0,

/* -x */ 0,

/* -i */ IPT_INV_VIA_IN,

/* -o */ IPT_INV_VIA_OUT,

/*--line*/ 0,

/* -c */ 0,

/* -f */ IPT_INV_FRAG,

};

#define opts iptables_globals.opts

#define prog_name iptables_globals.program_name

#define prog_vers iptables_globals.program_version

static void __attribute__((noreturn))

exit_tryhelp(int status)

{

	if (line != -1)

		fprintf(stderr, "Error occurred at line: %d\n", line);

	fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",

			prog_name, prog_name);

	xtables_free_opts(1);

	exit(status);

}

static void

exit_printhelp(const struct xtables_rule_match *matches)

{

	printf("%s v%s\n\n"

"Usage: %s -[ACD] chain rule-specification [options]\n"

"       %s -I chain [rulenum] rule-specification [options]\n"

"       %s -R chain rulenum rule-specification [options]\n"

"       %s -D chain rulenum [options]\n"

"       %s -[LS] [chain [rulenum]] [options]\n"

"       %s -[FZ] [chain] [options]\n"

"       %s -[NX] chain\n"

"       %s -E old-chain-name new-chain-name\n"

"       %s -P chain target [options]\n"

"       %s -h (print this help information)\n\n",

	       prog_name, prog_vers, prog_name, prog_name,

	       prog_name, prog_name, prog_name, prog_name,

	       prog_name, prog_name, prog_name, prog_name);

	printf(

"Commands:\n"

"Either long or short options are allowed.\n"

"  --append  -A chain		Append to chain\n"

"  --check   -C chain		Check for the existence of a rule\n"

"  --delete  -D chain		Delete matching rule from chain\n"

"  --delete  -D chain rulenum\n"

"				Delete rule rulenum (1 = first) from chain\n"

"  --insert  -I chain [rulenum]\n"

"				Insert in chain as rulenum (default 1=first)\n"

"  --replace -R chain rulenum\n"

"				Replace rule rulenum (1 = first) in chain\n"

"  --list    -L [chain [rulenum]]\n"

"				List the rules in a chain or all chains\n"

"  --list-rules -S [chain [rulenum]]\n"

"				Print the rules in a chain or all chains\n"

"  --flush   -F [chain]		Delete all rules in  chain or all chains\n"

"  --zero    -Z [chain [rulenum]]\n"

"				Zero counters in chain or all chains\n"

"  --new     -N chain		Create a new user-defined chain\n"

"  --delete-chain\n"

"            -X [chain]		Delete a user-defined chain\n"

"  --policy  -P chain target\n"

"				Change policy on chain to target\n"

"  --rename-chain\n"

"            -E old-chain new-chain\n"

"				Change chain name, (moving any references)\n"

"Options:\n"

"    --ipv4	-4		Nothing (line is ignored by ip6tables-restore)\n"

"    --ipv6	-6		Error (line is ignored by iptables-restore)\n"

"[!] --protocol	-p proto	protocol: by number or name, eg. `tcp'\n"

"[!] --source	-s address[/mask][...]\n"

"				source specification\n"

"[!] --destination -d address[/mask][...]\n"

"				destination specification\n"

"[!] --in-interface -i input name[+]\n"

"				network interface name ([+] for wildcard)\n"

" --jump	-j target\n"

"				target for rule (may load target extension)\n"

#ifdef IPT_F_GOTO

"  --goto      -g chain\n"

"                              jump to chain with no return\n"

#endif

"  --match	-m match\n"

"				extended match (may load extension)\n"

"  --numeric	-n		numeric output of addresses and ports\n"

"[!] --out-interface -o output name[+]\n"

"				network interface name ([+] for wildcard)\n"

"  --table	-t table	table to manipulate (default: `filter')\n"

"  --verbose	-v		verbose mode\n"

"  --wait	-w [seconds]	maximum wait to acquire xtables lock before give up\n"

"  --wait-interval -W [usecs]	wait time to try to acquire xtables lock\n"

"				default is 1 second\n"

"  --line-numbers		print line numbers when listing\n"

"  --exact	-x		expand numbers (display exact values)\n"

"[!] --fragment	-f		match second or further fragments only\n"

"  --modprobe=<command>		try to insert modules using this command\n"

"  --set-counters PKTS BYTES	set the counter during insert/append\n"

"[!] --version	-V		print package version.\n");

	print_extension_helps(xtables_targets, matches);

	exit(0);

}

void

iptables_exit_error(enum xtables_exittype status, const char *msg, ...)

{

	va_list args;

	va_start(args, msg);

	fprintf(stderr, "%s v%s (legacy): ", prog_name, prog_vers);

	vfprintf(stderr, msg, args);

	va_end(args);

	fprintf(stderr, "\n");

	if (status == PARAMETER_PROBLEM)

		exit_tryhelp(status);

	if (status == VERSION_PROBLEM)

		fprintf(stderr,

			"Perhaps iptables or your kernel needs to be upgraded.\n");

	/* On error paths, make sure that we don't leak memory */

	xtables_free_opts(1);

	exit(status);

}

static void

generic_opt_check(int command, int options)

{

	int i, j, legal = 0;

	/* Check that commands are valid with options.  Complicated by the

	 * fact that if an option is legal with *any* command given, it is

	 * legal overall (ie. -z and -l).

	 */

	for (i = 0; i < NUMBER_OF_OPT; i++) {

		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */

		for (j = 0; j < NUMBER_OF_CMD; j++) {

			if (!(command & (1<

				continue;

			if (!(options & (1<

				if (commands_v_options[j][i] == '+')

					xtables_error(PARAMETER_PROBLEM,

						   "You need to supply the `-%c' "

						   "option for this command\n",

						   optflags[i]);

			} else {

				if (commands_v_options[j][i] != 'x')

					legal = 1;

				else if (legal == 0)

					legal = -1;

			}

		}

		if (legal == -1)

			xtables_error(PARAMETER_PROBLEM,

				   "Illegal option `-%c' with this command\n",

				   optflags[i]);

	}

}

static char

opt2char(int option)

{

	const char *ptr;

	for (ptr = optflags; option > 1; option >>= 1, ptr++);

	return *ptr;

}

static char

cmd2char(int option)

{

	const char *ptr;

	for (ptr = cmdflags; option > 1; option >>= 1, ptr++);

	return *ptr;

}

static void

add_command(unsigned int *cmd, const int newcmd, const int othercmds, 

	    int invert)

{

	if (invert)

		xtables_error(PARAMETER_PROBLEM, "unexpected ! flag");

	if (*cmd & (~othercmds))

		xtables_error(PARAMETER_PROBLEM, "Cannot use -%c with -%c\n",

			   cmd2char(newcmd), cmd2char(*cmd & (~othercmds)));

	*cmd |= newcmd;

}

/*

 *	All functions starting with "parse" should succeed, otherwise

 *	the program fails.

 *	Most routines return pointers to static data that may change

 *	between calls to the same or other routines with a few exceptions:

 *	"host_to_addr", "parse_hostnetwork", and "parse_hostnetworkmask"

 *	return global static data.

*/

/* Christophe Burki wants `-p 6' to imply `-m tcp'.  */

/* Can't be zero. */

static int

parse_rulenumber(const char *rule)

{

	unsigned int rulenum;

	if (!xtables_strtoui(rule, NULL, &rulenum, 1, INT_MAX))

		xtables_error(PARAMETER_PROBLEM,

			   "Invalid rule number `%s'", rule);

	return rulenum;

}

static void

parse_chain(const char *chainname)

{

	const char *ptr;

	if (strlen(chainname) >= XT_EXTENSION_MAXNAMELEN)

		xtables_error(PARAMETER_PROBLEM,

			   "chain name `%s' too long (must be under %u chars)",

			   chainname, XT_EXTENSION_MAXNAMELEN);

	if (*chainname == '-' || *chainname == '!')

		xtables_error(PARAMETER_PROBLEM,

			   "chain name not allowed to start "

			   "with `%c'\n", *chainname);

	if (xtables_find_target(chainname, XTF_TRY_LOAD))

		xtables_error(PARAMETER_PROBLEM,

			   "chain name may not clash "

			   "with target name\n");

	for (ptr = chainname; *ptr; ptr++)

		if (isspace(*ptr))

			xtables_error(PARAMETER_PROBLEM,

				   "Invalid chain name `%s'", chainname);

}

static void

set_option(unsigned int *options, unsigned int option, uint8_t *invflg,

	   int invert)

{

	if (*options & option)

		xtables_error(PARAMETER_PROBLEM, "multiple -%c flags not allowed",

			   opt2char(option));

	*options |= option;

	if (invert) {

		unsigned int i;

		for (i = 0; 1 << i != option; i++);

		if (!inverse_for_options[i])

			xtables_error(PARAMETER_PROBLEM,

				   "cannot have ! before -%c",

				   opt2char(option));

		*invflg |= inverse_for_options[i];

	}

}

static void

print_header(unsigned int format, const char *chain, struct xtc_handle *handle)

{

	struct xt_counters counters;

	const char *pol = iptc_get_policy(chain, &counters, handle);

	printf("Chain %s", chain);

	if (pol) {

		printf(" (policy %s", pol);

		if (!(format & FMT_NOCOUNTS)) {

			fputc(' ', stdout);

			xtables_print_num(counters.pcnt, (format|FMT_NOTABLE));

			fputs("packets, ", stdout);

			xtables_print_num(counters.bcnt, (format|FMT_NOTABLE));

			fputs("bytes", stdout);

		}

		printf(")\n");

	} else {

		unsigned int refs;

		if (!iptc_get_references(&refs, chain, handle))

			printf(" (ERROR obtaining refs)\n");

		else

			printf(" (%u references)\n", refs);

	}

	if (format & FMT_LINENUMBERS)

		printf(FMT("%-4s ", "%s "), "num");

	if (!(format & FMT_NOCOUNTS)) {

		if (format & FMT_KILOMEGAGIGA) {

			printf(FMT("%5s ","%s "), "pkts");

			printf(FMT("%5s ","%s "), "bytes");

		} else {

			printf(FMT("%8s ","%s "), "pkts");

			printf(FMT("%10s ","%s "), "bytes");

		}

	}

	if (!(format & FMT_NOTARGET))

		printf(FMT("%-9s ","%s "), "target");

	fputs(" prot ", stdout);

	if (format & FMT_OPTIONS)

		fputs("opt", stdout);

	if (format & FMT_VIA) {

		printf(FMT(" %-6s ","%s "), "in");

		printf(FMT("%-6s ","%s "), "out");

	}

	printf(FMT(" %-19s ","%s "), "source");

	printf(FMT(" %-19s "," %s "), "destination");

	printf("\n");

}

static int

print_match(const struct xt_entry_match *m,

	    const struct ipt_ip *ip,

	    int numeric)

{

	const char *name = m->u.user.name;

	const int revision = m->u.user.revision;

	struct xtables_match *match, *mt;

	match = xtables_find_match(name, XTF_TRY_LOAD, NULL);

	if (match) {

		mt = xtables_find_match_revision(name, XTF_TRY_LOAD,

						 match, revision);

		if (mt && mt->print)

			mt->print(ip, m, numeric);

		else if (match->print)

			printf("%s%s ", match->name, unsupported_rev);

		else

			printf("%s ", match->name);

	} else {

		if (name[0])

			printf("UNKNOWN match `%s' ", name);

	}

	/* Don't stop iterating. */

	return 0;

}

/* e is called `fw' here for historical reasons */

static void

print_firewall(const struct ipt_entry *fw,

	       const char *targname,

	       unsigned int num,

	       unsigned int format,

	       struct xtc_handle *const handle)

{

	struct xtables_target *target, *tg;

	const struct xt_entry_target *t;

	uint8_t flags;

	if (!iptc_is_chain(targname, handle))

		target = xtables_find_target(targname, XTF_TRY_LOAD);

	else

		target = xtables_find_target(XT_STANDARD_TARGET,

		         XTF_LOAD_MUST_SUCCEED);

	t = ipt_get_target((struct ipt_entry *)fw);

	flags = fw->ip.flags;

	if (format & FMT_LINENUMBERS)

		printf(FMT("%-4u ", "%u "), num);

	if (!(format & FMT_NOCOUNTS)) {

		xtables_print_num(fw->counters.pcnt, format);

		xtables_print_num(fw->counters.bcnt, format);

	}

	if (!(format & FMT_NOTARGET))

		printf(FMT("%-9s ", "%s "), targname);

	fputc(fw->ip.invflags & XT_INV_PROTO ? '!' : ' ', stdout);

	{

		const char *pname = proto_to_name(fw->ip.proto, format&FMT_NUMERIC);

		if (pname)

			printf(FMT("%-5s", "%s "), pname);

		else

			printf(FMT("%-5hu", "%hu "), fw->ip.proto);

	}

	if (format & FMT_OPTIONS) {

		if (format & FMT_NOTABLE)

			fputs("opt ", stdout);

		fputc(fw->ip.invflags & IPT_INV_FRAG ? '!' : '-', stdout);

		fputc(flags & IPT_F_FRAG ? 'f' : '-', stdout);

		fputc(' ', stdout);

	}

	print_ifaces(fw->ip.iniface, fw->ip.outiface, fw->ip.invflags, format);

	print_ipv4_addresses(fw, format);

	if (format & FMT_NOTABLE)

		fputs("  ", stdout);

#ifdef IPT_F_GOTO

	if(fw->ip.flags & IPT_F_GOTO)

		printf("[goto] ");

#endif

	IPT_MATCH_ITERATE(fw, print_match, &fw->ip, format & FMT_NUMERIC);

	if (target) {

		const int revision = t->u.user.revision;

		tg = xtables_find_target_revision(targname, XTF_TRY_LOAD,

						  target, revision);

		if (tg && tg->print)

			/* Print the target information. */

			tg->print(&fw->ip, t, format & FMT_NUMERIC);

		else if (target->print)

			printf(" %s%s", target->name, unsupported_rev);

	} else if (t->u.target_size != sizeof(*t))

		printf("[%u bytes of unknown target data] ",

		       (unsigned int)(t->u.target_size - sizeof(*t)));

	if (!(format & FMT_NONEWLINE))

		fputc('\n', stdout);

}

static void

print_firewall_line(const struct ipt_entry *fw,

		    struct xtc_handle *const h)

{

	struct xt_entry_target *t;

	t = ipt_get_target((struct ipt_entry *)fw);

	print_firewall(fw, t->u.user.name, 0, FMT_PRINT_RULE, h);

}

static int

append_entry(const xt_chainlabel chain,

	     struct ipt_entry *fw,

	     unsigned int nsaddrs,

	     const struct in_addr saddrs[],

	     const struct in_addr smasks[],

	     unsigned int ndaddrs,

	     const struct in_addr daddrs[],

	     const struct in_addr dmasks[],

	     int verbose,

	     struct xtc_handle *handle)

{

	unsigned int i, j;

	int ret = 1;

	for (i = 0; i < nsaddrs; i++) {

		fw->ip.src.s_addr = saddrs[i].s_addr;

		fw->ip.smsk.s_addr = smasks[i].s_addr;

		for (j = 0; j < ndaddrs; j++) {

			fw->ip.dst.s_addr = daddrs[j].s_addr;

			fw->ip.dmsk.s_addr = dmasks[j].s_addr;

			if (verbose)

				print_firewall_line(fw, handle);

			ret &= iptc_append_entry(chain, fw, handle);

		}

	}

	return ret;

}

static int

replace_entry(const xt_chainlabel chain,

	      struct ipt_entry *fw,

	      unsigned int rulenum,

	      const struct in_addr *saddr, const struct in_addr *smask,

	      const struct in_addr *daddr, const struct in_addr *dmask,

	      int verbose,

	      struct xtc_handle *handle)

{

	fw->ip.src.s_addr = saddr->s_addr;

	fw->ip.dst.s_addr = daddr->s_addr;

	fw->ip.smsk.s_addr = smask->s_addr;

	fw->ip.dmsk.s_addr = dmask->s_addr;

	if (verbose)

		print_firewall_line(fw, handle);

	return iptc_replace_entry(chain, fw, rulenum, handle);

}

static int

insert_entry(const xt_chainlabel chain,

	     struct ipt_entry *fw,

	     unsigned int rulenum,

	     unsigned int nsaddrs,

	     const struct in_addr saddrs[],

	     const struct in_addr smasks[],

	     unsigned int ndaddrs,

	     const struct in_addr daddrs[],

	     const struct in_addr dmasks[],

	     int verbose,

	     struct xtc_handle *handle)

{

	unsigned int i, j;

	int ret = 1;

	for (i = 0; i < nsaddrs; i++) {

		fw->ip.src.s_addr = saddrs[i].s_addr;

		fw->ip.smsk.s_addr = smasks[i].s_addr;

		for (j = 0; j < ndaddrs; j++) {

			fw->ip.dst.s_addr = daddrs[j].s_addr;

			fw->ip.dmsk.s_addr = dmasks[j].s_addr;

			if (verbose)

				print_firewall_line(fw, handle);

			ret &= iptc_insert_entry(chain, fw, rulenum, handle);

		}

	}

	return ret;

}

static unsigned char *

make_delete_mask(const struct xtables_rule_match *matches,

		 const struct xtables_target *target)

{

	/* Establish mask for comparison */

	unsigned int size;

	const struct xtables_rule_match *matchp;

	unsigned char *mask, *mptr;

	size = sizeof(struct ipt_entry);

	for (matchp = matches; matchp; matchp = matchp->next)

		size += XT_ALIGN(sizeof(struct xt_entry_match)) + matchp->match->size;

	mask = xtables_calloc(1, size

			 + XT_ALIGN(sizeof(struct xt_entry_target))

			 + target->size);

	memset(mask, 0xFF, sizeof(struct ipt_entry));

	mptr = mask + sizeof(struct ipt_entry);

	for (matchp = matches; matchp; matchp = matchp->next) {

		memset(mptr, 0xFF,

		       XT_ALIGN(sizeof(struct xt_entry_match))

		       + matchp->match->userspacesize);

		mptr += XT_ALIGN(sizeof(struct xt_entry_match)) + matchp->match->size;

	}

	memset(mptr, 0xFF,

	       XT_ALIGN(sizeof(struct xt_entry_target))

	       + target->userspacesize);

	return mask;

}

static int

delete_entry(const xt_chainlabel chain,

	     struct ipt_entry *fw,

	     unsigned int nsaddrs,

	     const struct in_addr saddrs[],

	     const struct in_addr smasks[],

	     unsigned int ndaddrs,

	     const struct in_addr daddrs[],

	     const struct in_addr dmasks[],

	     int verbose,

	     struct xtc_handle *handle,

	     struct xtables_rule_match *matches,

	     const struct xtables_target *target)

{

	unsigned int i, j;

	int ret = 1;

	unsigned char *mask;

	mask = make_delete_mask(matches, target);

	for (i = 0; i < nsaddrs; i++) {

		fw->ip.src.s_addr = saddrs[i].s_addr;

		fw->ip.smsk.s_addr = smasks[i].s_addr;

		for (j = 0; j < ndaddrs; j++) {

			fw->ip.dst.s_addr = daddrs[j].s_addr;

			fw->ip.dmsk.s_addr = dmasks[j].s_addr;

			if (verbose)

				print_firewall_line(fw, handle);

			ret &= iptc_delete_entry(chain, fw, mask, handle);

		}

	}

	free(mask);

	return ret;

}

static int

check_entry(const xt_chainlabel chain, struct ipt_entry *fw,

	    unsigned int nsaddrs, const struct in_addr *saddrs,

	    const struct in_addr *smasks, unsigned int ndaddrs,

	    const struct in_addr *daddrs, const struct in_addr *dmasks,

	    bool verbose, struct xtc_handle *handle,

	    struct xtables_rule_match *matches,

	    const struct xtables_target *target)

{

	unsigned int i, j;

	int ret = 1;

	unsigned char *mask;

	mask = make_delete_mask(matches, target);

	for (i = 0; i < nsaddrs; i++) {

		fw->ip.src.s_addr = saddrs[i].s_addr;

		fw->ip.smsk.s_addr = smasks[i].s_addr;

		for (j = 0; j < ndaddrs; j++) {

			fw->ip.dst.s_addr = daddrs[j].s_addr;

			fw->ip.dmsk.s_addr = dmasks[j].s_addr;

			if (verbose)

				print_firewall_line(fw, handle);

			ret &= iptc_check_entry(chain, fw, mask, handle);

		}

	}

	free(mask);

	return ret;

}

int

for_each_chain4(int (*fn)(const xt_chainlabel, int, struct xtc_handle *),

	       int verbose, int builtinstoo, struct xtc_handle *handle)

{

        int ret = 1;

	const char *chain;

	char *chains;

	unsigned int i, chaincount = 0;

	chain = iptc_first_chain(handle);

	while (chain) {

		chaincount++;

		chain = iptc_next_chain(handle);

        }

	chains = xtables_malloc(sizeof(xt_chainlabel) * chaincount);

	i = 0;

	chain = iptc_first_chain(handle);

	while (chain) {

		strcpy(chains + i*sizeof(xt_chainlabel), chain);

		i++;

		chain = iptc_next_chain(handle);

        }

	for (i = 0; i < chaincount; i++) {

		if (!builtinstoo

		    && iptc_builtin(chains + i*sizeof(xt_chainlabel),

				    handle) == 1)

			continue;

	        ret &= fn(chains + i*sizeof(xt_chainlabel), verbose, handle);

	}

	free(chains);

        return ret;

}

int

flush_entries4(const xt_chainlabel chain, int verbose,

	      struct xtc_handle *handle)

{

	if (!chain)

		return for_each_chain4(flush_entries4, verbose, 1, handle);

	if (verbose)

		fprintf(stdout, "Flushing chain `%s'\n", chain);

	return iptc_flush_entries(chain, handle);

}

static int

zero_entries(const xt_chainlabel chain, int verbose,

	     struct xtc_handle *handle)

{

	if (!chain)

		return for_each_chain4(zero_entries, verbose, 1, handle);

	if (verbose)

		fprintf(stdout, "Zeroing chain `%s'\n", chain);

	return iptc_zero_entries(chain, handle);

}

int

delete_chain4(const xt_chainlabel chain, int verbose,

	     struct xtc_handle *handle)

{

	if (!chain)

		return for_each_chain4(delete_chain4, verbose, 0, handle);

	if (verbose)

		fprintf(stdout, "Deleting chain `%s'\n", chain);

	return iptc_delete_chain(chain, handle);

}

static int

list_entries(const xt_chainlabel chain, int rulenum, int verbose, int numeric,

	     int expanded, int linenumbers, struct xtc_handle *handle)

{

	int found = 0;

	unsigned int format;

	const char *this;

	format = FMT_OPTIONS;

	if (!verbose)

		format |= FMT_NOCOUNTS;

	else

		format |= FMT_VIA;

	if (numeric)

		format |= FMT_NUMERIC;

	if (!expanded)

		format |= FMT_KILOMEGAGIGA;

	if (linenumbers)

		format |= FMT_LINENUMBERS;

	for (this = iptc_first_chain(handle);

	     this;

	     this = iptc_next_chain(handle)) {

		const struct ipt_entry *i;

		unsigned int num;

		if (chain && strcmp(chain, this) != 0)

			continue;

		if (found) printf("\n");