/* Library which manipulates firewall rules.  Version $Revision$ */

/* Architecture of firewall rules is as follows:

 *

 * Chains go INPUT, FORWARD, OUTPUT then user chains.

 * Each user chain starts with an ERROR node.

 * Every chain ends with an unconditional jump: a RETURN for user chains,

 * and a POLICY for built-ins.

 */

/* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See

 * COPYING for details).

 * (C) 2000-2004 by the Netfilter Core Team <coreteam@netfilter.org>

 *

 * 2003-Jun-20: Harald Welte <laforge@netfilter.org>:

 *	- Reimplementation of chain cache to use offsets instead of entries

 * 2003-Jun-23: Harald Welte <laforge@netfilter.org>:

 * 	- performance optimization, sponsored by Astaro AG (http://www.astaro.com/)

 * 	  don't rebuild the chain cache after every operation, instead fix it

 * 	  up after a ruleset change.

 * 2004-Aug-18: Harald Welte <laforge@netfilter.org>:

 * 	- further performance work: total reimplementation of libiptc.

 * 	- libiptc now has a real internal (linked-list) represntation of the

 * 	  ruleset and a parser/compiler from/to this internal representation

 * 	- again sponsored by Astaro AG (http://www.astaro.com/)

 *

 * 2008-Jan+Jul: Jesper Dangaard Brouer <hawk@comx.dk>

 * 	- performance work: speedup chain list "name" searching.

 * 	- performance work: speedup initial ruleset parsing.

 * 	- sponsored by ComX Networks A/S (http://www.comx.dk/)

 */

#include <unistd.h>

#include <fcntl.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <stdbool.h>

#include <xtables.h>

#include <libiptc/xtcshared.h>

#include "linux_list.h"

//#define IPTC_DEBUG2 1

#ifdef IPTC_DEBUG2

#include <fcntl.h>

#define DEBUGP(x, args...)	fprintf(stderr, "%s: " x, __FUNCTION__, ## args)

#define DEBUGP_C(x, args...)	fprintf(stderr, x, ## args)

#else

#define DEBUGP(x, args...)

#define DEBUGP_C(x, args...)

#endif

#ifdef DEBUG

#define debug(x, args...)	fprintf(stderr, x, ## args)

#else

#define debug(x, args...)

#endif

static void *iptc_fn = NULL;

static const char *hooknames[] = {

	[HOOK_PRE_ROUTING]	= "PREROUTING",

	[HOOK_LOCAL_IN]		= "INPUT",

	[HOOK_FORWARD]		= "FORWARD",

	[HOOK_LOCAL_OUT]	= "OUTPUT",

	[HOOK_POST_ROUTING]	= "POSTROUTING",

};

/* Convenience structures */

struct chain_head;

struct rule_head;

struct counter_map

{

	enum {

		COUNTER_MAP_NOMAP,

		COUNTER_MAP_NORMAL_MAP,

		COUNTER_MAP_ZEROED,

		COUNTER_MAP_SET

	} maptype;

	unsigned int mappos;

};

enum iptcc_rule_type {

	IPTCC_R_STANDARD,		/* standard target (ACCEPT, ...) */

	IPTCC_R_MODULE,			/* extension module (SNAT, ...) */

	IPTCC_R_FALLTHROUGH,		/* fallthrough rule */

	IPTCC_R_JUMP,			/* jump to other chain */

};

struct rule_head

{

	struct list_head list;

	struct chain_head *chain;

	struct counter_map counter_map;

	unsigned int index;		/* index (needed for counter_map) */

	unsigned int offset;		/* offset in rule blob */

	enum iptcc_rule_type type;

	struct chain_head *jump;	/* jump target, if IPTCC_R_JUMP */

	unsigned int size;		/* size of entry data */

	STRUCT_ENTRY entry[0];

};

struct chain_head

{

	struct list_head list;

	char name[TABLE_MAXNAMELEN];

	unsigned int hooknum;		/* hook number+1 if builtin */

	unsigned int references;	/* how many jumps reference us */

	int verdict;			/* verdict if builtin */

	STRUCT_COUNTERS counters;	/* per-chain counters */

	struct counter_map counter_map;

	unsigned int num_rules;		/* number of rules in list */

	struct list_head rules;		/* list of rules */

	unsigned int index;		/* index (needed for jump resolval) */

	unsigned int head_offset;	/* offset in rule blob */

	unsigned int foot_index;	/* index (needed for counter_map) */

	unsigned int foot_offset;	/* offset in rule blob */

};

struct xtc_handle {

	int sockfd;

	int changed;			 /* Have changes been made? */

	struct list_head chains;

	struct chain_head *chain_iterator_cur;

	struct rule_head *rule_iterator_cur;

	unsigned int num_chains;         /* number of user defined chains */

	struct chain_head **chain_index;   /* array for fast chain list access*/

	unsigned int        chain_index_sz;/* size of chain index array */

	int sorted_offsets; /* if chains are received sorted from kernel,

			     * then the offsets are also sorted. Says if its

			     * possible to bsearch offsets using chain_index.

			     */

	STRUCT_GETINFO info;

	STRUCT_GET_ENTRIES *entries;

};

enum bsearch_type {

	BSEARCH_NAME,	/* Binary search after chain name */

	BSEARCH_OFFSET,	/* Binary search based on offset */

};

/* allocate a new chain head for the cache */

static struct chain_head *iptcc_alloc_chain_head(const char *name, int hooknum)

{

	struct chain_head *c = malloc(sizeof(*c));

	if (!c)

		return NULL;

	memset(c, 0, sizeof(*c));

	strncpy(c->name, name, TABLE_MAXNAMELEN - 1);

	c->hooknum = hooknum;

	INIT_LIST_HEAD(&c->rules);

	return c;

}

/* allocate and initialize a new rule for the cache */

static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size)

{

	struct rule_head *r = malloc(sizeof(*r)+size);

	if (!r)

		return NULL;

	memset(r, 0, sizeof(*r));

	r->chain = c;

	r->size = size;

	return r;

}

/* notify us that the ruleset has been modified by the user */

static inline void

set_changed(struct xtc_handle *h)

{

	h->changed = 1;

}

/**********************************************************************

 * iptc blob utility functions (iptcb_*)

 **********************************************************************/

static inline int

iptcb_get_number(const STRUCT_ENTRY *i,

	   const STRUCT_ENTRY *seek,

	   unsigned int *pos)

{

	if (i == seek)

		return 1;

	(*pos)++;

	return 0;

}

static inline int

iptcb_get_entry_n(STRUCT_ENTRY *i,

	    unsigned int number,

	    unsigned int *pos,

	    STRUCT_ENTRY **pe)

{

	if (*pos == number) {

		*pe = i;

		return 1;

	}

	(*pos)++;

	return 0;

}

static inline STRUCT_ENTRY *

iptcb_get_entry(struct xtc_handle *h, unsigned int offset)

{

	return (STRUCT_ENTRY *)((char *)h->entries->entrytable + offset);

}

static unsigned int

iptcb_entry2index(struct xtc_handle *const h, const STRUCT_ENTRY *seek)

{

	unsigned int pos = 0;

	if (ENTRY_ITERATE(h->entries->entrytable, h->entries->size,

			  iptcb_get_number, seek, &pos) == 0) {

		fprintf(stderr, "ERROR: offset %u not an entry!\n",

			(unsigned int)((char *)seek - (char *)h->entries->entrytable));

		abort();

	}

	return pos;

}

static inline STRUCT_ENTRY *

iptcb_offset2entry(struct xtc_handle *h, unsigned int offset)

{

	return (STRUCT_ENTRY *) ((void *)h->entries->entrytable+offset);

}

static inline unsigned long

iptcb_entry2offset(struct xtc_handle *const h, const STRUCT_ENTRY *e)

{

	return (void *)e - (void *)h->entries->entrytable;

}

static inline unsigned int

iptcb_offset2index(struct xtc_handle *const h, unsigned int offset)

{

	return iptcb_entry2index(h, iptcb_offset2entry(h, offset));

}

/* Returns 0 if not hook entry, else hooknumber + 1 */

static inline unsigned int

iptcb_ent_is_hook_entry(STRUCT_ENTRY *e, struct xtc_handle *h)

{

	unsigned int i;

	for (i = 0; i < NUMHOOKS; i++) {

		if ((h->info.valid_hooks & (1 << i))

		    && iptcb_get_entry(h, h->info.hook_entry[i]) == e)

			return i+1;

	}

	return 0;

}

/**********************************************************************

 * Chain index (cache utility) functions

 **********************************************************************

 * The chain index is an array with pointers into the chain list, with

 * CHAIN_INDEX_BUCKET_LEN spacing.  This facilitates the ability to

 * speedup chain list searching, by find a more optimal starting

 * points when searching the linked list.

 *

 * The starting point can be found fast by using a binary search of

 * the chain index. Thus, reducing the previous search complexity of

 * O(n) to O(log(n/k) + k) where k is CHAIN_INDEX_BUCKET_LEN.

 *

 * A nice property of the chain index, is that the "bucket" list

 * length is max CHAIN_INDEX_BUCKET_LEN (when just build, inserts will

 * change this). Oppose to hashing, where the "bucket" list length can

 * vary a lot.

 */

#ifndef CHAIN_INDEX_BUCKET_LEN

#define CHAIN_INDEX_BUCKET_LEN 40

#endif

/* Another nice property of the chain index is that inserting/creating

 * chains in chain list don't change the correctness of the chain

 * index, it only causes longer lists in the buckets.

 *

 * To mitigate the performance penalty of longer bucket lists and the

 * penalty of rebuilding, the chain index is rebuild only when

 * CHAIN_INDEX_INSERT_MAX chains has been added.

 */

#ifndef CHAIN_INDEX_INSERT_MAX

#define CHAIN_INDEX_INSERT_MAX 355

#endif

static inline unsigned int iptcc_is_builtin(struct chain_head *c);

/* Use binary search in the chain index array, to find a chain_head

 * pointer closest to the place of the searched name element.

 *

 * Notes that, binary search (obviously) requires that the chain list

 * is sorted by name.

 *

 * The not so obvious: The chain index array, is actually both sorted

 * by name and offset, at the same time!.  This is only true because,

 * chain are stored sorted in the kernel (as we pushed it in sorted).

 *

 */

static struct list_head *

__iptcc_bsearch_chain_index(const char *name, unsigned int offset,

			    unsigned int *idx, struct xtc_handle *handle,

			    enum bsearch_type type)

{

	unsigned int pos, end;

	int res;

	struct list_head *list_pos;

	list_pos=&handle->chains;

	/* Check for empty array, e.g. no user defined chains */

	if (handle->chain_index_sz == 0) {

		debug("WARNING: handle->chain_index_sz == 0\n");

		return list_pos;

	}

	/* Init */

	end = handle->chain_index_sz;

	pos = end / 2;

	debug("bsearch Find chain:%s (pos:%d end:%d) (offset:%d)\n",

	      name, pos, end, offset);

	/* Loop */

 loop:

	if (!handle->chain_index[pos]) {

		fprintf(stderr, "ERROR: NULL pointer chain_index[%d]\n", pos);

		return &handle->chains; /* Be safe, return orig start pos */

	}

	debug("bsearch Index[%d] name:%s ",

	      pos, handle->chain_index[pos]->name);

	/* Support for different compare functions */

	switch (type) {

	case BSEARCH_NAME:

		res = strcmp(name, handle->chain_index[pos]->name);

		break;

	case BSEARCH_OFFSET:

		debug("head_offset:[%d] foot_offset:[%d] ",

		      handle->chain_index[pos]->head_offset,

		      handle->chain_index[pos]->foot_offset);

		res = offset - handle->chain_index[pos]->head_offset;

		break;

	default:

		fprintf(stderr, "ERROR: %d not a valid bsearch type\n",

			type);

		abort();

		break;

	}

	debug("res:%d ", res);

	list_pos = &handle->chain_index[pos]->list;

	*idx = pos;

	if (res == 0) { /* Found element, by direct hit */

		debug("[found] Direct hit pos:%d end:%d\n", pos, end);

		return list_pos;

	} else if (res < 0) { /* Too far, jump back */

		end = pos;

		pos = pos / 2;

		/* Exit case: First element of array */

		if (end == 0) {

			debug("[found] Reached first array elem (end%d)\n",end);

			return list_pos;

		}

		debug("jump back to pos:%d (end:%d)\n", pos, end);

		goto loop;

	} else { /* res > 0; Not far enough, jump forward */

		/* Exit case: Last element of array */

		if (pos == handle->chain_index_sz-1) {

			debug("[found] Last array elem (end:%d)\n", end);

			return list_pos;

		}

		/* Exit case: Next index less, thus elem in this list section */

		switch (type) {

		case BSEARCH_NAME:

			res = strcmp(name, handle->chain_index[pos+1]->name);

			break;

		case BSEARCH_OFFSET:

			res = offset - handle->chain_index[pos+1]->head_offset;

			break;

		}

		if (res < 0) {

			debug("[found] closest list (end:%d)\n", end);

			return list_pos;

		}

		pos = (pos+end)/2;

		debug("jump forward to pos:%d (end:%d)\n", pos, end);

		goto loop;

	}

}

/* Wrapper for string chain name based bsearch */

static struct list_head *

iptcc_bsearch_chain_index(const char *name, unsigned int *idx,

			  struct xtc_handle *handle)

{

	return __iptcc_bsearch_chain_index(name, 0, idx, handle, BSEARCH_NAME);

}

/* Wrapper for offset chain based bsearch */

static struct list_head *

iptcc_bsearch_chain_offset(unsigned int offset, unsigned int *idx,

			  struct xtc_handle *handle)

{

	struct list_head *pos;

	/* If chains were not received sorted from kernel, then the

	 * offset bsearch is not possible.

	 */

	if (!handle->sorted_offsets)

		pos = handle->chains.next;

	else

		pos = __iptcc_bsearch_chain_index(NULL, offset, idx, handle,

						  BSEARCH_OFFSET);

	return pos;

}

#ifdef DEBUG

/* Trivial linear search of chain index. Function used for verifying

   the output of bsearch function */

static struct list_head *

iptcc_linearly_search_chain_index(const char *name, struct xtc_handle *handle)

{

	unsigned int i=0;

	int res=0;

	struct list_head *list_pos;

	list_pos = &handle->chains;

	if (handle->chain_index_sz)

		list_pos = &handle->chain_index[0]->list;

	/* Linearly walk of chain index array */

	for (i=0; i < handle->chain_index_sz; i++) {

		if (handle->chain_index[i]) {

			res = strcmp(handle->chain_index[i]->name, name);

			if (res > 0)

				break; // One step too far

			list_pos = &handle->chain_index[i]->list;

			if (res == 0)

				break; // Direct hit

		}

	}

	return list_pos;

}

#endif

static int iptcc_chain_index_alloc(struct xtc_handle *h)

{

	unsigned int list_length = CHAIN_INDEX_BUCKET_LEN;

	unsigned int array_elems;

	unsigned int array_mem;

	/* Allocate memory for the chain index array */

	array_elems = (h->num_chains / list_length) +

                      (h->num_chains % list_length ? 1 : 0);

	array_mem   = sizeof(h->chain_index) * array_elems;

	debug("Alloc Chain index, elems:%d mem:%d bytes\n",

	      array_elems, array_mem);

	h->chain_index = malloc(array_mem);

	if (h->chain_index == NULL && array_mem > 0) {

		h->chain_index_sz = 0;

		return -ENOMEM;

	}

	memset(h->chain_index, 0, array_mem);

	h->chain_index_sz = array_elems;

	return 1;

}

static void iptcc_chain_index_free(struct xtc_handle *h)

{

	h->chain_index_sz = 0;

	free(h->chain_index);

}

#ifdef DEBUG

static void iptcc_chain_index_dump(struct xtc_handle *h)

{

	unsigned int i = 0;

	/* Dump: contents of chain index array */

	for (i=0; i < h->chain_index_sz; i++) {

		if (h->chain_index[i]) {

			fprintf(stderr, "Chain index[%d].name: %s\n",

				i, h->chain_index[i]->name);

		}

	}

}

#endif

/* Build the chain index */

static int iptcc_chain_index_build(struct xtc_handle *h)

{

	unsigned int list_length = CHAIN_INDEX_BUCKET_LEN;

	unsigned int chains = 0;

	unsigned int cindex = 0;

	struct chain_head *c;

	/* Build up the chain index array here */

	debug("Building chain index\n");

	debug("Number of user defined chains:%d bucket_sz:%d array_sz:%d\n",

		h->num_chains, list_length, h->chain_index_sz);

	if (h->chain_index_sz == 0)

		return 0;

	list_for_each_entry(c, &h->chains, list) {

		/* Issue: The index array needs to start after the

		 * builtin chains, as they are not sorted */

		if (!iptcc_is_builtin(c)) {

			cindex=chains / list_length;

			/* Safe guard, break out on array limit, this

			 * is useful if chains are added and array is

			 * rebuild, without realloc of memory. */

			if (cindex >= h->chain_index_sz)

				break;

			if ((chains % list_length)== 0) {

				debug("\nIndex[%d] Chains:", cindex);

				h->chain_index[cindex] = c;

			}

			chains++;

		}

		debug("%s, ", c->name);

	}

	debug("\n");

	return 1;

}

static int iptcc_chain_index_rebuild(struct xtc_handle *h)

{

	debug("REBUILD chain index array\n");

	iptcc_chain_index_free(h);

	if ((iptcc_chain_index_alloc(h)) < 0)

		return -ENOMEM;

	iptcc_chain_index_build(h);

	return 1;

}

/* Delete chain (pointer) from index array.  Removing an element from

 * the chain list only affects the chain index array, if the chain

 * index points-to/uses that list pointer.

 *

 * There are different strategies, the simple and safe is to rebuild

 * the chain index every time.  The more advanced is to update the

 * array index to point to the next element, but that requires some

 * house keeping and boundary checks.  The advanced is implemented, as

 * the simple approach behaves badly when all chains are deleted

 * because list_for_each processing will always hit the first chain

 * index, thus causing a rebuild for every chain.

 */

static int iptcc_chain_index_delete_chain(struct chain_head *c, struct xtc_handle *h)

{

	struct list_head *index_ptr, *next;

	struct chain_head *c2;

	unsigned int idx, idx2;

	index_ptr = iptcc_bsearch_chain_index(c->name, &idx, h);

	debug("Del chain[%s] c->list:%p index_ptr:%p\n",

	      c->name, &c->list, index_ptr);

	/* Save the next pointer */

	next = c->list.next;

	list_del(&c->list);

	if (index_ptr == &c->list) { /* Chain used as index ptr */

		/* See if its possible to avoid a rebuild, by shifting

		 * to next pointer.  Its possible if the next pointer

		 * is located in the same index bucket.

		 */

		c2         = list_entry(next, struct chain_head, list);

		iptcc_bsearch_chain_index(c2->name, &idx2, h);

		if (idx != idx2) {

			/* Rebuild needed */

			return iptcc_chain_index_rebuild(h);

		} else {

			/* Avoiding rebuild */

			debug("Update cindex[%d] with next ptr name:[%s]\n",

			      idx, c2->name);

			h->chain_index[idx]=c2;

			return 0;

		}

	}

	return 0;

}

/**********************************************************************

 * iptc cache utility functions (iptcc_*)

 **********************************************************************/

/* Is the given chain builtin (1) or user-defined (0) */

static inline unsigned int iptcc_is_builtin(struct chain_head *c)

{

	return (c->hooknum ? 1 : 0);

}

/* Get a specific rule within a chain */

static struct rule_head *iptcc_get_rule_num(struct chain_head *c,

					    unsigned int rulenum)

{

	struct rule_head *r;

	unsigned int num = 0;

	list_for_each_entry(r, &c->rules, list) {

		num++;

		if (num == rulenum)

			return r;

	}

	return NULL;

}

/* Get a specific rule within a chain backwards */

static struct rule_head *iptcc_get_rule_num_reverse(struct chain_head *c,

					    unsigned int rulenum)

{

	struct rule_head *r;

	unsigned int num = 0;

	list_for_each_entry_reverse(r, &c->rules, list) {

		num++;

		if (num == rulenum)

			return r;

	}

	return NULL;

}

/* Returns chain head if found, otherwise NULL. */

static struct chain_head *

iptcc_find_chain_by_offset(struct xtc_handle *handle, unsigned int offset)

{

	struct list_head *pos;

	struct list_head *list_start_pos;

	unsigned int i;

	if (list_empty(&handle->chains))

		return NULL;

	/* Find a smart place to start the search */

  	list_start_pos = iptcc_bsearch_chain_offset(offset, &i, handle);

	/* Note that iptcc_bsearch_chain_offset() skips builtin

	 * chains, but this function is only used for finding jump

	 * targets, and a buildin chain is not a valid jump target */

	debug("Offset:[%u] starting search at index:[%u]\n", offset, i);

//	list_for_each(pos, &handle->chains) {

	list_for_each(pos, list_start_pos->prev) {

		struct chain_head *c = list_entry(pos, struct chain_head, list);

		debug(".");

		if (offset >= c->head_offset && offset <= c->foot_offset) {

			debug("Offset search found chain:[%s]\n", c->name);

			return c;

		}

	}

	return NULL;

}

/* Returns chain head if found, otherwise NULL. */

static struct chain_head *

iptcc_find_label(const char *name, struct xtc_handle *handle)

{

	struct list_head *pos;

	struct list_head *list_start_pos;

	unsigned int i=0;

	int res;

	if (list_empty(&handle->chains))

		return NULL;

	/* First look at builtin chains */

	list_for_each(pos, &handle->chains) {

		struct chain_head *c = list_entry(pos, struct chain_head, list);

		if (!iptcc_is_builtin(c))

			break;

		if (!strcmp(c->name, name))

			return c;

	}

	/* Find a smart place to start the search via chain index */

  	//list_start_pos = iptcc_linearly_search_chain_index(name, handle);

  	list_start_pos = iptcc_bsearch_chain_index(name, &i, handle);

	/* Handel if bsearch bails out early */

	if (list_start_pos == &handle->chains) {

		list_start_pos = pos;

	}

#ifdef DEBUG

	else {

		/* Verify result of bsearch against linearly index search */

		struct list_head *test_pos;

		struct chain_head *test_c, *tmp_c;

		test_pos = iptcc_linearly_search_chain_index(name, handle);

		if (list_start_pos != test_pos) {

			debug("BUG in chain_index search\n");

			test_c=list_entry(test_pos,      struct chain_head,list);

			tmp_c =list_entry(list_start_pos,struct chain_head,list);

			debug("Verify search found:\n");

			debug(" Chain:%s\n", test_c->name);

			debug("BSearch found:\n");

			debug(" Chain:%s\n", tmp_c->name);

			exit(42);

		}

	}

#endif

	/* Initial/special case, no user defined chains */

	if (handle->num_chains == 0)

		return NULL;

	/* Start searching through the chain list */

	list_for_each(pos, list_start_pos->prev) {

		struct chain_head *c = list_entry(pos, struct chain_head, list);

		res = strcmp(c->name, name);

		debug("List search name:%s == %s res:%d\n", name, c->name, res);

		if (res==0)

			return c;

		/* We can stop earlier as we know list is sorted */

		if (res>0 && !iptcc_is_builtin(c)) { /* Walked too far*/

			debug(" Not in list, walked too far, sorted list\n");

			return NULL;

		}

		/* Stop on wrap around, if list head is reached */

		if (pos == &handle->chains) {

			debug("Stop, list head reached\n");

			return NULL;

		}

	}

	debug("List search NOT found name:%s\n", name);

	return NULL;

}

/* called when rule is to be removed from cache */

static void iptcc_delete_rule(struct rule_head *r)

{

	DEBUGP("deleting rule %p (offset %u)\n", r, r->offset);

	/* clean up reference count of called chain */

	if (r->type == IPTCC_R_JUMP

	    && r->jump)

		r->jump->references--;

	list_del(&r->list);

	free(r);

}

/**********************************************************************

 * RULESET PARSER (blob -> cache)

 **********************************************************************/

/* Delete policy rule of previous chain, since cache doesn't contain

 * chain policy rules.

 * WARNING: This function has ugly design and relies on a lot of context, only

 * to be called from specific places within the parser */

static int __iptcc_p_del_policy(struct xtc_handle *h, unsigned int num)

{

	const unsigned char *data;

	if (h->chain_iterator_cur) {

		/* policy rule is last rule */

		struct rule_head *pr = (struct rule_head *)

			h->chain_iterator_cur->rules.prev;

		/* save verdict */

		data = GET_TARGET(pr->entry)->data;

		h->chain_iterator_cur->verdict = *(const int *)data;

		/* save counter and counter_map information */

		h->chain_iterator_cur->counter_map.maptype =

						COUNTER_MAP_ZEROED;

		h->chain_iterator_cur->counter_map.mappos = num-1;

		memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters,

			sizeof(h->chain_iterator_cur->counters));

		/* foot_offset points to verdict rule */

		h->chain_iterator_cur->foot_index = num;

		h->chain_iterator_cur->foot_offset = pr->offset;

		/* delete rule from cache */

		iptcc_delete_rule(pr);

		h->chain_iterator_cur->num_rules--;

		return 1;

	}

	return 0;

}

/* alphabetically insert a chain into the list */

static void iptc_insert_chain(struct xtc_handle *h, struct chain_head *c)

{

	struct chain_head *tmp;

	struct list_head  *list_start_pos;

	unsigned int i=1;

	/* Find a smart place to start the insert search */

  	list_start_pos = iptcc_bsearch_chain_index(c->name, &i, h);

	/* Handle the case, where chain.name is smaller than index[0] */

	if (i==0 && strcmp(c->name, h->chain_index[0]->name) <= 0) {

		h->chain_index[0] = c; /* Update chain index head */

		list_start_pos = h->chains.next;

		debug("Update chain_index[0] with %s\n", c->name);

	}

	/* Handel if bsearch bails out early */

	if (list_start_pos == &h->chains) {

		list_start_pos = h->chains.next;

	}

	/* sort only user defined chains */

	if (!c->hooknum) {

		list_for_each_entry(tmp, list_start_pos->prev, list) {

			if (!tmp->hooknum && strcmp(c->name, tmp->name) <= 0) {

				list_add(&c->list, tmp->list.prev);

				return;

			}

			/* Stop if list head is reached */

			if (&tmp->list == &h->chains) {

				debug("Insert, list head reached add to tail\n");

				break;

			}

		}

	}

	/* survived till end of list: add at tail */

	list_add_tail(&c->list, &h->chains);

}

/* Another ugly helper function split out of cache_add_entry to make it less

 * spaghetti code */

static void __iptcc_p_add_chain(struct xtc_handle *h, struct chain_head *c,

				unsigned int offset, unsigned int *num)

{