/*

 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published

 * by the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This code has been sponsored by Sophos Astaro <http://www.sophos.com>

 */

#include <unistd.h>

#include <fcntl.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <stdbool.h>

#include <errno.h>

#include <netdb.h>	/* getprotobynumber */

#include <time.h>

#include <stdarg.h>

#include <inttypes.h>

#include <assert.h>

#include <xtables.h>

#include <libiptc/libxtc.h>

#include <libiptc/xtcshared.h>

#include <stdlib.h>

#include <string.h>

#include <linux/netfilter/x_tables.h>

#include <linux/netfilter_ipv4/ip_tables.h>

#include <linux/netfilter_ipv6/ip6_tables.h>

#include <netinet/ip6.h>

#include <linux/netlink.h>

#include <linux/netfilter/nfnetlink.h>

#include <linux/netfilter/nf_tables.h>

#include <linux/netfilter/nf_tables_compat.h>

#include <linux/netfilter/xt_limit.h>

#include <libmnl/libmnl.h>

#include <libnftnl/table.h>

#include <libnftnl/chain.h>

#include <libnftnl/rule.h>

#include <libnftnl/expr.h>

#include <libnftnl/set.h>

#include <libnftnl/udata.h>

#include <libnftnl/batch.h>

#include <netinet/in.h>	/* inet_ntoa */

#include <arpa/inet.h>

#include "nft.h"

#include "xshared.h" /* proto_to_name */

#include "nft-shared.h"

#include "xtables-config-parser.h"

static void *nft_fn;

int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,

	     int (*cb)(const struct nlmsghdr *nlh, void *data),

	     void *data)

{

	int ret;

	char buf[16536];

	if (mnl_socket_sendto(h->nl, nlh, nlh->nlmsg_len) < 0)

		return -1;

	ret = mnl_socket_recvfrom(h->nl, buf, sizeof(buf));

	while (ret > 0) {

		ret = mnl_cb_run(buf, ret, h->seq, h->portid, cb, data);

		if (ret <= 0)

			break;

		ret = mnl_socket_recvfrom(h->nl, buf, sizeof(buf));

	}

	if (ret == -1) {

		return -1;

	}

	return 0;

}

#define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize())

/* selected batch page is 256 Kbytes long to load ruleset of

 * half a million rules without hitting -EMSGSIZE due to large

 * iovec.

 */

#define BATCH_PAGE_SIZE getpagesize() * 32

static struct nftnl_batch *mnl_batch_init(void)

{

	struct nftnl_batch *batch;

	batch = nftnl_batch_alloc(BATCH_PAGE_SIZE, NFT_NLMSG_MAXSIZE);

	if (batch == NULL)

		return NULL;

	return batch;

}

static void mnl_nft_batch_continue(struct nftnl_batch *batch)

{

	assert(nftnl_batch_update(batch) >= 0);

}

static uint32_t mnl_batch_begin(struct nftnl_batch *batch, uint32_t seqnum)

{

	nftnl_batch_begin(nftnl_batch_buffer(batch), seqnum);

	mnl_nft_batch_continue(batch);

	return seqnum;

}

static void mnl_batch_end(struct nftnl_batch *batch, uint32_t seqnum)

{

	nftnl_batch_end(nftnl_batch_buffer(batch), seqnum);

	mnl_nft_batch_continue(batch);

}

static void mnl_batch_reset(struct nftnl_batch *batch)

{

	nftnl_batch_free(batch);

}

struct mnl_err {

	struct list_head	head;

	int			err;

	uint32_t		seqnum;

};

static void mnl_err_list_node_add(struct list_head *err_list, int error,

				  int seqnum)

{

	struct mnl_err *err = malloc(sizeof(struct mnl_err));

	err->seqnum = seqnum;

	err->err = error;

	list_add_tail(&err->head, err_list);

}

static void mnl_err_list_free(struct mnl_err *err)

{

	list_del(&err->head);

	free(err);

}

static int nlbuffsiz;

static void mnl_set_sndbuffer(const struct mnl_socket *nl,

			      struct nftnl_batch *batch)

{

	int newbuffsiz;

	if (nftnl_batch_iovec_len(batch) * BATCH_PAGE_SIZE <= nlbuffsiz)

		return;

	newbuffsiz = nftnl_batch_iovec_len(batch) * BATCH_PAGE_SIZE;

	/* Rise sender buffer length to avoid hitting -EMSGSIZE */

	if (setsockopt(mnl_socket_get_fd(nl), SOL_SOCKET, SO_SNDBUFFORCE,

		       &newbuffsiz, sizeof(socklen_t)) < 0)

		return;

	nlbuffsiz = newbuffsiz;

}

static ssize_t mnl_nft_socket_sendmsg(const struct mnl_socket *nf_sock,

				      struct nftnl_batch *batch)

{

	static const struct sockaddr_nl snl = {

		.nl_family = AF_NETLINK

	};

	uint32_t iov_len = nftnl_batch_iovec_len(batch);

	struct iovec iov[iov_len];

	struct msghdr msg = {

		.msg_name	= (struct sockaddr *) &snl,

		.msg_namelen	= sizeof(snl),

		.msg_iov	= iov,

		.msg_iovlen	= iov_len,

	};

	mnl_set_sndbuffer(nf_sock, batch);

	nftnl_batch_iovec(batch, iov, iov_len);

	return sendmsg(mnl_socket_get_fd(nf_sock), &msg, 0);

}

static int mnl_batch_talk(const struct mnl_socket *nf_sock,

			  struct nftnl_batch *batch, struct list_head *err_list)

{

	const struct mnl_socket *nl = nf_sock;

	int ret, fd = mnl_socket_get_fd(nl), portid = mnl_socket_get_portid(nl);

	char rcv_buf[MNL_SOCKET_BUFFER_SIZE];

	fd_set readfds;

	struct timeval tv = {

		.tv_sec		= 0,

		.tv_usec	= 0

	};

	int err = 0;

	ret = mnl_nft_socket_sendmsg(nf_sock, batch);

	if (ret == -1)

		return -1;

	FD_ZERO(&readfds);

	FD_SET(fd, &readfds);

	/* receive and digest all the acknowledgments from the kernel. */

	ret = select(fd+1, &readfds, NULL, NULL, &tv;;

	if (ret == -1)

		return -1;

	while (ret > 0 && FD_ISSET(fd, &readfds)) {

		struct nlmsghdr *nlh = (struct nlmsghdr *)rcv_buf;

		ret = mnl_socket_recvfrom(nl, rcv_buf, sizeof(rcv_buf));

		if (ret == -1)

			return -1;

		ret = mnl_cb_run(rcv_buf, ret, 0, portid, NULL, NULL);

		/* Continue on error, make sure we get all acknowledgments */

		if (ret == -1) {

			mnl_err_list_node_add(err_list, errno, nlh->nlmsg_seq);

			err = -1;

		}

		ret = select(fd+1, &readfds, NULL, NULL, &tv;;

		if (ret == -1)

			return -1;

		FD_ZERO(&readfds);

		FD_SET(fd, &readfds);

	}

	return err;

}

enum obj_update_type {

	NFT_COMPAT_TABLE_ADD,

	NFT_COMPAT_TABLE_FLUSH,

	NFT_COMPAT_CHAIN_ADD,

	NFT_COMPAT_CHAIN_USER_ADD,

	NFT_COMPAT_CHAIN_USER_DEL,

	NFT_COMPAT_CHAIN_USER_FLUSH,

	NFT_COMPAT_CHAIN_UPDATE,

	NFT_COMPAT_CHAIN_RENAME,

	NFT_COMPAT_CHAIN_ZERO,

	NFT_COMPAT_RULE_APPEND,

	NFT_COMPAT_RULE_INSERT,

	NFT_COMPAT_RULE_REPLACE,

	NFT_COMPAT_RULE_DELETE,

	NFT_COMPAT_RULE_FLUSH,

};

enum obj_action {

	NFT_COMPAT_COMMIT,

	NFT_COMPAT_ABORT,

};

struct obj_update {

	struct list_head	head;

	enum obj_update_type	type;

	unsigned int		seq;

	union {

		struct nftnl_table	*table;

		struct nftnl_chain	*chain;

		struct nftnl_rule	*rule;

		void			*ptr;

	};

	struct {

		unsigned int		lineno;

	} error;

};

static int mnl_append_error(const struct nft_handle *h,

			    const struct obj_update *o,

			    const struct mnl_err *err,

			    char *buf, unsigned int len)

{

	static const char *type_name[] = {

		[NFT_COMPAT_TABLE_ADD] = "TABLE_ADD",

		[NFT_COMPAT_TABLE_FLUSH] = "TABLE_FLUSH",

		[NFT_COMPAT_CHAIN_ADD] = "CHAIN_ADD",

		[NFT_COMPAT_CHAIN_USER_ADD] = "CHAIN_USER_ADD",

		[NFT_COMPAT_CHAIN_USER_DEL] = "CHAIN_USER_DEL",

		[NFT_COMPAT_CHAIN_USER_FLUSH] = "CHAIN_USER_FLUSH",

		[NFT_COMPAT_CHAIN_UPDATE] = "CHAIN_UPDATE",

		[NFT_COMPAT_CHAIN_RENAME] = "CHAIN_RENAME",

		[NFT_COMPAT_CHAIN_ZERO] = "CHAIN_ZERO",

		[NFT_COMPAT_RULE_APPEND] = "RULE_APPEND",

		[NFT_COMPAT_RULE_INSERT] = "RULE_INSERT",

		[NFT_COMPAT_RULE_REPLACE] = "RULE_REPLACE",

		[NFT_COMPAT_RULE_DELETE] = "RULE_DELETE",

		[NFT_COMPAT_RULE_FLUSH] = "RULE_FLUSH",

	};

	char errmsg[256];

	char tcr[128];

	if (o->error.lineno)

		snprintf(errmsg, sizeof(errmsg), "\nline %u: %s failed (%s)",

			 o->error.lineno, type_name[o->type], strerror(err->err));

	else

		snprintf(errmsg, sizeof(errmsg), " %s failed (%s)",

			 type_name[o->type], strerror(err->err));

	switch (o->type) {

	case NFT_COMPAT_TABLE_ADD:

	case NFT_COMPAT_TABLE_FLUSH:

		snprintf(tcr, sizeof(tcr), "table %s",

			 nftnl_table_get_str(o->table, NFTNL_TABLE_NAME));

		break;

	case NFT_COMPAT_CHAIN_ADD:

	case NFT_COMPAT_CHAIN_ZERO:

	case NFT_COMPAT_CHAIN_USER_ADD:

	case NFT_COMPAT_CHAIN_USER_DEL:

	case NFT_COMPAT_CHAIN_USER_FLUSH:

	case NFT_COMPAT_CHAIN_UPDATE:

	case NFT_COMPAT_CHAIN_RENAME:

		snprintf(tcr, sizeof(tcr), "chain %s",

			 nftnl_chain_get_str(o->chain, NFTNL_CHAIN_NAME));

		break;

	case NFT_COMPAT_RULE_APPEND:

	case NFT_COMPAT_RULE_INSERT:

	case NFT_COMPAT_RULE_REPLACE:

	case NFT_COMPAT_RULE_DELETE:

	case NFT_COMPAT_RULE_FLUSH:

		snprintf(tcr, sizeof(tcr), "rule in chain %s",

			 nftnl_rule_get_str(o->rule, NFTNL_RULE_CHAIN));

#if 0

		{

			nft_rule_print_save(o->rule, NFT_RULE_APPEND, FMT_NOCOUNTS);

		}

#endif

		break;

	}

	return snprintf(buf, len, "%s: %s", errmsg, tcr);

}

static int batch_add(struct nft_handle *h, enum obj_update_type type, void *ptr)

{

	struct obj_update *obj;

	obj = calloc(1, sizeof(struct obj_update));

	if (obj == NULL)

		return -1;

	obj->ptr = ptr;

	obj->error.lineno = h->error.lineno;

	obj->type = type;

	list_add_tail(&obj->head, &h->obj_list);

	h->obj_list_num++;

	return 0;

}

static int batch_table_add(struct nft_handle *h, enum obj_update_type type,

			   struct nftnl_table *t)

{

	return batch_add(h, type, t);

}

static int batch_chain_add(struct nft_handle *h, enum obj_update_type type,

			   struct nftnl_chain *c)

{

	return batch_add(h, type, c);

}

static int batch_rule_add(struct nft_handle *h, enum obj_update_type type,

			  struct nftnl_rule *r)

{

	return batch_add(h, type, r);

}

struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {

	[NFT_TABLE_RAW] = {

		.name	= "raw",

		.chains = {

			{

				.name	= "PREROUTING",

				.type	= "filter",

				.prio	= -300,	/* NF_IP_PRI_RAW */

				.hook	= NF_INET_PRE_ROUTING,

			},

			{

				.name	= "OUTPUT",

				.type	= "filter",

				.prio	= -300,	/* NF_IP_PRI_RAW */

				.hook	= NF_INET_LOCAL_OUT,

			},

		},

	},

	[NFT_TABLE_MANGLE] = {

		.name	= "mangle",

		.chains = {

			{

				.name	= "PREROUTING",

				.type	= "filter",

				.prio	= -150,	/* NF_IP_PRI_MANGLE */

				.hook	= NF_INET_PRE_ROUTING,

			},

			{

				.name	= "INPUT",

				.type	= "filter",

				.prio	= -150,	/* NF_IP_PRI_MANGLE */

				.hook	= NF_INET_LOCAL_IN,

			},

			{

				.name	= "FORWARD",

				.type	= "filter",

				.prio	= -150,	/* NF_IP_PRI_MANGLE */

				.hook	= NF_INET_FORWARD,

			},

			{

				.name	= "OUTPUT",

				.type	= "route",

				.prio	= -150,	/* NF_IP_PRI_MANGLE */

				.hook	= NF_INET_LOCAL_OUT,

			},

			{

				.name	= "POSTROUTING",

				.type	= "filter",

				.prio	= -150,	/* NF_IP_PRI_MANGLE */

				.hook	= NF_INET_POST_ROUTING,

			},

		},

	},

	[NFT_TABLE_FILTER] = {

		.name	= "filter",

		.chains = {

			{

				.name	= "INPUT",

				.type	= "filter",

				.prio	= 0,	/* NF_IP_PRI_FILTER */

				.hook	= NF_INET_LOCAL_IN,

			},

			{

				.name	= "FORWARD",

				.type	= "filter",

				.prio	= 0,	/* NF_IP_PRI_FILTER */

				.hook	= NF_INET_FORWARD,

			},

			{

				.name	= "OUTPUT",

				.type	= "filter",

				.prio	= 0,	/* NF_IP_PRI_FILTER */

				.hook	= NF_INET_LOCAL_OUT,

			},

		},

	},

	[NFT_TABLE_SECURITY] = {

		.name	= "security",

		.chains = {

			{

				.name	= "INPUT",

				.type	= "filter",

				.prio	= 150,	/* NF_IP_PRI_SECURITY */

				.hook	= NF_INET_LOCAL_IN,

			},

			{

				.name	= "FORWARD",

				.type	= "filter",

				.prio	= 150,	/* NF_IP_PRI_SECURITY */

				.hook	= NF_INET_FORWARD,

			},

			{

				.name	= "OUTPUT",

				.type	= "filter",

				.prio	= 150,	/* NF_IP_PRI_SECURITY */

				.hook	= NF_INET_LOCAL_OUT,

			},

		},

	},

	[NFT_TABLE_NAT] = {

		.name	= "nat",

		.chains = {

			{

				.name	= "PREROUTING",

				.type	= "nat",

				.prio	= -100, /* NF_IP_PRI_NAT_DST */

				.hook	= NF_INET_PRE_ROUTING,

			},

			{

				.name	= "INPUT",

				.type	= "nat",

				.prio	= 100, /* NF_IP_PRI_NAT_SRC */

				.hook	= NF_INET_LOCAL_IN,

			},

			{

				.name	= "POSTROUTING",

				.type	= "nat",

				.prio	= 100, /* NF_IP_PRI_NAT_SRC */

				.hook	= NF_INET_POST_ROUTING,

			},

			{

				.name	= "OUTPUT",

				.type	= "nat",

				.prio	= -100, /* NF_IP_PRI_NAT_DST */

				.hook	= NF_INET_LOCAL_OUT,

			},

		},

	},

};

#include <linux/netfilter_arp.h>

struct builtin_table xtables_arp[NFT_TABLE_MAX] = {

	[NFT_TABLE_FILTER] = {

	.name   = "filter",

	.chains = {

			{

				.name   = "INPUT",

				.type   = "filter",

				.prio   = NF_IP_PRI_FILTER,

				.hook   = NF_ARP_IN,

			},

			{

				.name   = "OUTPUT",

				.type   = "filter",

				.prio   = NF_IP_PRI_FILTER,

				.hook   = NF_ARP_OUT,

			},

		},

	},

};

#include <linux/netfilter_bridge.h>

struct builtin_table xtables_bridge[NFT_TABLE_MAX] = {

	[NFT_TABLE_FILTER] = {

		.name = "filter",

		.chains = {

			{

				.name   = "INPUT",

				.type   = "filter",

				.prio   = NF_BR_PRI_FILTER_BRIDGED,

				.hook   = NF_BR_LOCAL_IN,

			},

			{

				.name   = "FORWARD",

				.type   = "filter",

				.prio   = NF_BR_PRI_FILTER_BRIDGED,

				.hook   = NF_BR_FORWARD,

			},

			{

				.name   = "OUTPUT",

				.type   = "filter",

				.prio   = NF_BR_PRI_FILTER_BRIDGED,

				.hook   = NF_BR_LOCAL_OUT,

			},

		},

	},

	[NFT_TABLE_NAT] = {

		.name = "nat",

		.chains = {

			{

				.name   = "PREROUTING",

				.type   = "filter",

				.prio   = NF_BR_PRI_NAT_DST_BRIDGED,

				.hook   = NF_BR_PRE_ROUTING,

			},

			{

				.name   = "OUTPUT",

				.type   = "filter",

				.prio   = NF_BR_PRI_NAT_DST_OTHER,

				.hook   = NF_BR_LOCAL_OUT,

			},

			{

				.name   = "POSTROUTING",

				.type   = "filter",

				.prio   = NF_BR_PRI_NAT_SRC,

				.hook   = NF_BR_POST_ROUTING,

			},

		},

	},

};

static int nft_table_builtin_add(struct nft_handle *h,

				 struct builtin_table *_t)

{

	struct nftnl_table *t;

	int ret;

	if (_t->initialized)

		return 0;

	t = nftnl_table_alloc();

	if (t == NULL)

		return -1;

	nftnl_table_set(t, NFTNL_TABLE_NAME, (char *)_t->name);

	ret = batch_table_add(h, NFT_COMPAT_TABLE_ADD, t);

	return ret;

}

static struct nftnl_chain *

nft_chain_builtin_alloc(struct builtin_table *table,

			struct builtin_chain *chain, int policy)

{

	struct nftnl_chain *c;

	c = nftnl_chain_alloc();

	if (c == NULL)

		return NULL;

	nftnl_chain_set(c, NFTNL_CHAIN_TABLE, (char *)table->name);

	nftnl_chain_set(c, NFTNL_CHAIN_NAME, (char *)chain->name);

	nftnl_chain_set_u32(c, NFTNL_CHAIN_HOOKNUM, chain->hook);

	nftnl_chain_set_u32(c, NFTNL_CHAIN_PRIO, chain->prio);

	nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, policy);

	nftnl_chain_set(c, NFTNL_CHAIN_TYPE, (char *)chain->type);

	return c;

}

static void nft_chain_builtin_add(struct nft_handle *h,

				  struct builtin_table *table,

				  struct builtin_chain *chain)

{

	struct nftnl_chain *c;

	c = nft_chain_builtin_alloc(table, chain, NF_ACCEPT);

	if (c == NULL)

		return;

	batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, c);

}

/* find if built-in table already exists */

struct builtin_table *

nft_table_builtin_find(struct nft_handle *h, const char *table)

{

	int i;

	bool found = false;

	for (i = 0; i < NFT_TABLE_MAX; i++) {

		if (h->tables[i].name == NULL)

			continue;

		if (strcmp(h->tables[i].name, table) != 0)

			continue;

		found = true;

		break;

	}

	return found ? &h->tables[i] : NULL;

}

/* find if built-in chain already exists */

struct builtin_chain *

nft_chain_builtin_find(struct builtin_table *t, const char *chain)

{

	int i;

	bool found = false;

	for (i=0; i<NF_IP_NUMHOOKS && t->chains[i].name != NULL; i++) {

		if (strcmp(t->chains[i].name, chain) != 0)

			continue;

		found = true;

		break;

	}

	return found ? &t->chains[i] : NULL;

}

static void nft_chain_builtin_init(struct nft_handle *h,

				   struct builtin_table *table)

{

	struct nftnl_chain_list *list = nft_chain_list_get(h);

	struct nftnl_chain *c;

	int i;

	/* Initialize built-in chains if they don't exist yet */

	for (i=0; i < NF_INET_NUMHOOKS && table->chains[i].name != NULL; i++) {

		c = nft_chain_list_find(list, table->name,

					table->chains[i].name);

		if (c != NULL)

			continue;

		nft_chain_builtin_add(h, table, &table->chains[i]);

	}

}

static int nft_xt_builtin_init(struct nft_handle *h, const char *table)

{

	struct builtin_table *t;

	t = nft_table_builtin_find(h, table);

	if (t == NULL)

		return -1;

	if (t->initialized)

		return 0;

	if (nft_table_builtin_add(h, t) < 0)

		return -1;

	nft_chain_builtin_init(h, t);

	t->initialized = true;

	return 0;

}

static bool nft_chain_builtin(struct nftnl_chain *c)

{

	/* Check if this chain has hook number, in that case is built-in.

	 * Should we better export the flags to user-space via nf_tables?

	 */

	return nftnl_chain_get(c, NFTNL_CHAIN_HOOKNUM) != NULL;

}

static int nft_restart(struct nft_handle *h)

{

	mnl_socket_close(h->nl);

	h->nl = mnl_socket_open(NETLINK_NETFILTER);

	if (h->nl == NULL)

		return -1;

	if (mnl_socket_bind(h->nl, 0, MNL_SOCKET_AUTOPID) < 0)

		return -1;

	h->portid = mnl_socket_get_portid(h->nl);

	return 0;

}

int nft_init(struct nft_handle *h, struct builtin_table *t)

{

	h->nl = mnl_socket_open(NETLINK_NETFILTER);

	if (h->nl == NULL)

		return -1;

	if (mnl_socket_bind(h->nl, 0, MNL_SOCKET_AUTOPID) < 0) {

		mnl_socket_close(h->nl);

		return -1;

	}

	h->portid = mnl_socket_get_portid(h->nl);

	h->tables = t;

	INIT_LIST_HEAD(&h->obj_list);

	INIT_LIST_HEAD(&h->err_list);

	return 0;

}

static int __flush_rule_cache(struct nftnl_rule *r, void *data)

{

	const char *tablename = data;

	if (!strcmp(nftnl_rule_get_str(r, NFTNL_RULE_TABLE), tablename)) {

		nftnl_rule_list_del(r);

		nftnl_rule_free(r);

	}

	return 0;

}

static void flush_rule_cache(struct nft_handle *h, const char *tablename)

{

	if (!h->rule_cache)

		return;

	if (tablename) {

		nftnl_rule_list_foreach(h->rule_cache, __flush_rule_cache,

					(void *)tablename);

	} else {

		nftnl_rule_list_free(h->rule_cache);

		h->rule_cache = NULL;

	}

}

static int __flush_chain_cache(struct nftnl_chain *c, void *data)

{

	const char *tablename = data;

	if (!strcmp(nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), tablename)) {

		nftnl_chain_list_del(c);

		nftnl_chain_free(c);

	}

	return 0;

}

static void flush_chain_cache(struct nft_handle *h, const char *tablename)

{

	if (!h->chain_cache)

		return;

	if (tablename) {

		nftnl_chain_list_foreach(h->chain_cache, __flush_chain_cache,

					 (void *)tablename);

	} else {

		nftnl_chain_list_free(h->chain_cache);

		h->chain_cache = NULL;

	}

}

void nft_fini(struct nft_handle *h)

{

	flush_chain_cache(h, NULL);

	flush_rule_cache(h, NULL);

	mnl_socket_close(h->nl);

}

static void nft_chain_print_debug(struct nftnl_chain *c, struct nlmsghdr *nlh)

{

#ifdef NLDEBUG

	char tmp[1024];

	nftnl_chain_snprintf(tmp, sizeof(tmp), c, 0, 0);

	printf("DEBUG: chain: %s\n", tmp);

	mnl_nlmsg_fprintf(stdout, nlh, nlh->nlmsg_len, sizeof(struct nfgenmsg));

#endif

}

static struct nftnl_chain *nft_chain_new(struct nft_handle *h,

				       const char *table, const char *chain,

				       int policy,

				       const struct xt_counters *counters)

{

	struct nftnl_chain *c;

	struct builtin_table *_t;

	struct builtin_chain *_c;

	_t = nft_table_builtin_find(h, table);

	if (!_t) {

		errno = ENXIO;

		return NULL;

	}

	/* if this built-in table does not exists, create it */

	nft_table_builtin_add(h, _t);

	_c = nft_chain_builtin_find(_t, chain);

	if (_c != NULL) {

		/* This is a built-in chain */

		c = nft_chain_builtin_alloc(_t, _c, policy);

		if (c == NULL)

			return NULL;

	} else {

		errno = ENOENT;

		return NULL;

	}

	if (counters) {

		nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES,

					counters->bcnt);

		nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS,

					counters->pcnt);

	}

	return c;

}

int nft_chain_set(struct nft_handle *h, const char *table,

		  const char *chain, const char *policy,

		  const struct xt_counters *counters)

{

	struct nftnl_chain *c = NULL;

	int ret;

	nft_fn = nft_chain_set;

	if (strcmp(policy, "DROP") == 0)

		c = nft_chain_new(h, table, chain, NF_DROP, counters);

	else if (strcmp(policy, "ACCEPT") == 0)

		c = nft_chain_new(h, table, chain, NF_ACCEPT, counters);

	else

		errno = EINVAL;