vserver 1.9.3

[linux-2.6.git] / net / ipv4 / netfilter / ipchains_core.c

#warning ipchains is obsolete, and will be removed soon.

/* Minor modifications to fit on compatibility framework:
   Rusty.Russell@rustcorp.com.au
*/

/*
 * This code is heavily based on the code on the old ip_fw.c code; see below for
 * copyrights and attributions of the old code.  This code is basically GPL.
 *
 * 15-Aug-1997: Major changes to allow graphs for firewall rules.
 *              Paul Russell <Paul.Russell@rustcorp.com.au> and
 *              Michael Neuling <Michael.Neuling@rustcorp.com.au>
 * 24-Aug-1997: Generalised protocol handling (not just TCP/UDP/ICMP).
 *              Added explicit RETURN from chains.
 *              Removed TOS mangling (done in ipchains 1.0.1).
 *              Fixed read & reset bug by reworking proc handling.
 *              Paul Russell <Paul.Russell@rustcorp.com.au>
 * 28-Sep-1997: Added packet marking for net sched code.
 *              Removed fw_via comparisons: all done on device name now,
 *              similar to changes in ip_fw.c in DaveM's CVS970924 tree.
 *              Paul Russell <Paul.Russell@rustcorp.com.au>
 * 2-Nov-1997:  Moved types across to __u16, etc.
 *              Added inverse flags.
 *              Fixed fragment bug (in args to port_match).
 *              Changed mark to only one flag (MARKABS).
 * 21-Nov-1997: Added ability to test ICMP code.
 * 19-Jan-1998: Added wildcard interfaces.
 * 6-Feb-1998:  Merged 2.0 and 2.1 versions.
 *              Initialised ip_masq for 2.0.x version.
 *              Added explicit NETLINK option for 2.1.x version.
 *              Added packet and byte counters for policy matches.
 * 26-Feb-1998: Fixed race conditions, added SMP support.
 * 18-Mar-1998: Fix SMP, fix race condition fix.
 * 1-May-1998:  Remove caching of device pointer.
 * 12-May-1998: Allow tiny fragment case for TCP/UDP.
 * 15-May-1998: Treat short packets as fragments, don't just block.
 * 3-Jan-1999:  Fixed serious procfs security hole -- users should never
 *              be allowed to view the chains!
 *              Marc Santoro <ultima@snicker.emoti.com>
 * 29-Jan-1999: Locally generated bogus IPs dealt with, rather than crash
 *              during dump_packet. --RR.
 * 19-May-1999: Star Wars: The Phantom Menace opened.  Rule num
 *              printed in log (modified from Michael Hasenstein's patch).
 *              Added SYN in log message. --RR
 * 23-Jul-1999: Fixed small fragment security exposure opened on 15-May-1998.
 *              John McDonald <jm@dataprotect.com>
 *              Thomas Lopatic <tl@dataprotect.com>
 */

/*
 *
 * The origina Linux port was done Alan Cox, with changes/fixes from
 * Pauline Middlelink, Jos Vos, Thomas Quinot, Wouter Gadeyne, Juan
 * Jose Ciarlante, Bernd Eckenfels, Keith Owens and others.
 *
 * Copyright from the original FreeBSD version follows:
 *
 * Copyright (c) 1993 Daniel Boulet
 * Copyright (c) 1994 Ugen J.S.Antsilevich
 *
 * Redistribution and use in source forms, with and without modification,
 * are permitted provided that this entire comment appears intact.
 *
 * Redistribution in binary form may occur without any restrictions.
 * Obviously, it would be nice if you gave credit where credit is due
 * but requiring it would be too onerous.
 *
 * This software is provided ``AS IS'' without any warranties of any kind.  */

#include <linux/config.h>

#include <asm/uaccess.h>
#include <asm/system.h>
#include <linux/types.h>
#include <linux/sched.h>
#include <linux/string.h>
#include <linux/errno.h>
#include <linux/module.h>

#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/icmp.h>
#include <linux/udp.h>
#include <net/ip.h>
#include <net/protocol.h>
#include <net/route.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <net/sock.h>
#include <net/icmp.h>
#include <linux/netlink.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4/compat_firewall.h>
#include <linux/netfilter_ipv4/ipchains_core.h>
#include <linux/netfilter_ipv4/ip_nat_core.h>

#include <net/checksum.h>
#include <linux/proc_fs.h>
#include <linux/stat.h>

MODULE_LICENSE("Dual BSD/GPL");
MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
MODULE_DESCRIPTION("ipchains backwards compatibility layer");

/* Understanding locking in this code: (thanks to Alan Cox for using
 * little words to explain this to me). -- PR
 *
 * In UP, there can be two packets traversing the chains:
 * 1) A packet from the current userspace context
 * 2) A packet off the bh handlers (timer or net).
 *
 * For SMP (kernel v2.1+), multiply this by # CPUs.
 *
 * [Note that this in not correct for 2.2 - because the socket code always
 *  uses lock_kernel() to serialize, and bottom halves (timers and net_bhs)
 *  only run on one CPU at a time.  This will probably change for 2.3.
 *  It is still good to use spinlocks because that avoids the global cli()
 *  for updating the tables, which is rather costly in SMP kernels -AK]
 *
 * This means counters and backchains can get corrupted if no precautions
 * are taken.
 *
 * To actually alter a chain on UP, we need only do a cli(), as this will
 * stop a bh handler firing, as we are in the current userspace context
 * (coming from a setsockopt()).
 *
 * On SMP, we need a write_lock_irqsave(), which is a simple cli() in
 * UP.
 *
 * For backchains and counters, we use an array, indexed by
 * [smp_processor_id()*2 + !in_interrupt()]; the array is of
 * size [NR_CPUS*2].  For v2.0, NR_CPUS is effectively 1.  So,
 * confident of uniqueness, we modify counters even though we only
 * have a read lock (to read the counters, you need a write lock,
 * though).  */

/* Why I didn't use straight locking... -- PR
 *
 * The backchains can be separated out of the ip_chains structure, and
 * allocated as needed inside ip_fw_check().
 *
 * The counters, however, can't.  Trying to lock these means blocking
 * interrupts every time we want to access them.  This would suck HARD
 * performance-wise.  Not locking them leads to possible corruption,
 * made worse on 32-bit machines (counters are 64-bit).  */

/*#define DEBUG_IP_FIREWALL*/
/*#define DEBUG_ALLOW_ALL*/ /* Useful for remote debugging */
/*#define DEBUG_IP_FIREWALL_USER*/
/*#define DEBUG_IP_FIREWALL_LOCKING*/

#if defined(CONFIG_NETLINK_DEV) || defined(CONFIG_NETLINK_DEV_MODULE)
static struct sock *ipfwsk;
#endif

#ifdef CONFIG_SMP
#define SLOT_NUMBER() (smp_processor_id()*2 + !in_interrupt())
#else /* !SMP */
#define SLOT_NUMBER() (!in_interrupt())
#endif /* CONFIG_SMP */
#define NUM_SLOTS (NR_CPUS*2)

#define SIZEOF_STRUCT_IP_CHAIN (sizeof(struct ip_chain) \
                                + NUM_SLOTS*sizeof(struct ip_reent))
#define SIZEOF_STRUCT_IP_FW_KERNEL (sizeof(struct ip_fwkernel) \
                                    + NUM_SLOTS*sizeof(struct ip_counters))

#ifdef DEBUG_IP_FIREWALL_LOCKING
static unsigned int fwc_rlocks, fwc_wlocks;
#define FWC_DEBUG_LOCK(d)                       \
do {                                            \
        FWC_DONT_HAVE_LOCK(d);                  \
        d |= (1 << SLOT_NUMBER());              \
} while (0)

#define FWC_DEBUG_UNLOCK(d)                     \
do {                                            \
        FWC_HAVE_LOCK(d);                       \
        d &= ~(1 << SLOT_NUMBER());             \
} while (0)

#define FWC_DONT_HAVE_LOCK(d)                                   \
do {                                                            \
        if ((d) & (1 << SLOT_NUMBER()))                         \
                printk("%s:%i: Got lock on %i already!\n",      \
                       __FILE__, __LINE__, SLOT_NUMBER());      \
} while(0)

#define FWC_HAVE_LOCK(d)                                \
do {                                                    \
        if (!((d) & (1 << SLOT_NUMBER())))              \
        printk("%s:%i:No lock on %i!\n",                \
               __FILE__, __LINE__, SLOT_NUMBER());      \
} while (0)

#else
#define FWC_DEBUG_LOCK(d) do { } while(0)
#define FWC_DEBUG_UNLOCK(d) do { } while(0)
#define FWC_DONT_HAVE_LOCK(d) do { } while(0)
#define FWC_HAVE_LOCK(d) do { } while(0)
#endif /*DEBUG_IP_FIRWALL_LOCKING*/

#define FWC_READ_LOCK(l) do { FWC_DEBUG_LOCK(fwc_rlocks); read_lock(l); } while (0)
#define FWC_WRITE_LOCK(l) do { FWC_DEBUG_LOCK(fwc_wlocks); write_lock(l); } while (0)
#define FWC_READ_LOCK_IRQ(l,f) do { FWC_DEBUG_LOCK(fwc_rlocks); read_lock_irqsave(l,f); } while (0)
#define FWC_WRITE_LOCK_IRQ(l,f) do { FWC_DEBUG_LOCK(fwc_wlocks); write_lock_irqsave(l,f); } while (0)
#define FWC_READ_UNLOCK(l) do { FWC_DEBUG_UNLOCK(fwc_rlocks); read_unlock(l); } while (0)
#define FWC_WRITE_UNLOCK(l) do { FWC_DEBUG_UNLOCK(fwc_wlocks); write_unlock(l); } while (0)
#define FWC_READ_UNLOCK_IRQ(l,f) do { FWC_DEBUG_UNLOCK(fwc_rlocks); read_unlock_irqrestore(l,f); } while (0)
#define FWC_WRITE_UNLOCK_IRQ(l,f) do { FWC_DEBUG_UNLOCK(fwc_wlocks); write_unlock_irqrestore(l,f); } while (0)

struct ip_chain;

struct ip_counters
{
        __u64 pcnt, bcnt;                       /* Packet and byte counters */
};

struct ip_fwkernel
{
        struct ip_fw ipfw;
        struct ip_fwkernel *next;       /* where to go next if current
                                         * rule doesn't match */
        struct ip_chain *branch;        /* which branch to jump to if
                                         * current rule matches */
        int simplebranch;               /* Use this if branch == NULL */
        struct ip_counters counters[0]; /* Actually several of these */
};

struct ip_reent
{
        struct ip_chain *prevchain;     /* Pointer to referencing chain */
        struct ip_fwkernel *prevrule;   /* Pointer to referencing rule */
        struct ip_counters counters;
};

struct ip_chain
{
        ip_chainlabel label;        /* Defines the label for each block */
        struct ip_chain *next;      /* Pointer to next block */
        struct ip_fwkernel *chain;  /* Pointer to first rule in block */
        __u32 refcount;             /* Number of refernces to block */
        int policy;                 /* Default rule for chain.  Only *
                                     * used in built in chains */
        struct ip_reent reent[0];   /* Actually several of these */
};

/*
 *      Implement IP packet firewall
 */

#ifdef DEBUG_IP_FIREWALL
#define dprintf(format, args...)  printk(format , ## args)
#else
#define dprintf(format, args...)
#endif

#ifdef DEBUG_IP_FIREWALL_USER
#define duprintf(format, args...) printk(format , ## args)
#else
#define duprintf(format, args...)
#endif

/* Lock around ip_fw_chains linked list structure */
rwlock_t ip_fw_lock = RW_LOCK_UNLOCKED;

/* Head of linked list of fw rules */
static struct ip_chain *ip_fw_chains;

#define IP_FW_INPUT_CHAIN ip_fw_chains
#define IP_FW_FORWARD_CHAIN (ip_fw_chains->next)
#define IP_FW_OUTPUT_CHAIN (ip_fw_chains->next->next)

/* Returns 1 if the port is matched by the range, 0 otherwise */
extern inline int port_match(__u16 min, __u16 max, __u16 port,
                             int frag, int invert)
{
        if (frag) /* Fragments fail ANY port test. */
                return (min == 0 && max == 0xFFFF);
        else return (port >= min && port <= max) ^ invert;
}

/* Returns whether matches rule or not. */
static int ip_rule_match(struct ip_fwkernel *f,
                         const char *ifname,
                         struct sk_buff **pskb,
                         char tcpsyn,
                         __u16 src_port, __u16 dst_port,
                         char isfrag)
{
        struct iphdr *ip = (*pskb)->nh.iph;

#define FWINV(bool,invflg) ((bool) ^ !!(f->ipfw.fw_invflg & invflg))
        /*
         *      This is a bit simpler as we don't have to walk
         *      an interface chain as you do in BSD - same logic
         *      however.
         */

        if (FWINV((ip->saddr&f->ipfw.fw_smsk.s_addr) != f->ipfw.fw_src.s_addr,
                  IP_FW_INV_SRCIP)
            || FWINV((ip->daddr&f->ipfw.fw_dmsk.s_addr)!=f->ipfw.fw_dst.s_addr,
                     IP_FW_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");

                dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
                        f->ipfw.fw_smsk.s_addr, f->ipfw.fw_src.s_addr,
                        f->ipfw.fw_invflg & IP_FW_INV_SRCIP ? " (INV)" : "");
                dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
                        f->ipfw.fw_dmsk.s_addr, f->ipfw.fw_dst.s_addr,
                        f->ipfw.fw_invflg & IP_FW_INV_DSTIP ? " (INV)" : "");
                return 0;
        }

        /*
         *      Look for a VIA device match
         */
        if (f->ipfw.fw_flg & IP_FW_F_WILDIF) {
            if (FWINV(strncmp(ifname, f->ipfw.fw_vianame,
                              strlen(f->ipfw.fw_vianame)) != 0,
                      IP_FW_INV_VIA)) {
                dprintf("Wildcard interface mismatch.%s\n",
                        f->ipfw.fw_invflg & IP_FW_INV_VIA ? " (INV)" : "");
                return 0;       /* Mismatch */
            }
        }
        else if (FWINV(strcmp(ifname, f->ipfw.fw_vianame) != 0,
                       IP_FW_INV_VIA)) {
            dprintf("Interface name does not match.%s\n",
                    f->ipfw.fw_invflg & IP_FW_INV_VIA
                    ? " (INV)" : "");
            return 0;   /* Mismatch */
        }

        /*
         *      Ok the chain addresses match.
         */

        /* If we have a fragment rule but the packet is not a fragment
         * the we return zero */
        if (FWINV((f->ipfw.fw_flg&IP_FW_F_FRAG) && !isfrag, IP_FW_INV_FRAG)) {
                dprintf("Fragment rule but not fragment.%s\n",
                        f->ipfw.fw_invflg & IP_FW_INV_FRAG ? " (INV)" : "");
                return 0;
        }

        /* Fragment NEVER passes a SYN test, even an inverted one. */
        if (FWINV((f->ipfw.fw_flg&IP_FW_F_TCPSYN) && !tcpsyn, IP_FW_INV_SYN)
            || (isfrag && (f->ipfw.fw_flg&IP_FW_F_TCPSYN))) {
                dprintf("Rule requires SYN and packet has no SYN.%s\n",
                        f->ipfw.fw_invflg & IP_FW_INV_SYN ? " (INV)" : "");
                return 0;
        }

        if (f->ipfw.fw_proto) {
                /*
                 *      Specific firewall - packet's protocol
                 *      must match firewall's.
                 */

                if (FWINV(ip->protocol!=f->ipfw.fw_proto, IP_FW_INV_PROTO)) {
                        dprintf("Packet protocol %hi does not match %hi.%s\n",
                                ip->protocol, f->ipfw.fw_proto,
                                f->ipfw.fw_invflg&IP_FW_INV_PROTO ? " (INV)":"");
                        return 0;
                }

                /* For non TCP/UDP/ICMP, port range is max anyway. */
                if (!port_match(f->ipfw.fw_spts[0],
                                f->ipfw.fw_spts[1],
                                src_port, isfrag,
                                !!(f->ipfw.fw_invflg&IP_FW_INV_SRCPT))
                    || !port_match(f->ipfw.fw_dpts[0],
                                   f->ipfw.fw_dpts[1],
                                   dst_port, isfrag,
                                   !!(f->ipfw.fw_invflg
                                      &IP_FW_INV_DSTPT))) {
                    dprintf("Port match failed.\n");
                    return 0;
                }
        }

        dprintf("Match succeeded.\n");
        return 1;
}

static const char *branchname(struct ip_chain *branch,int simplebranch)
{
        if (branch)
                return branch->label;
        switch (simplebranch)
        {
        case FW_BLOCK: return IP_FW_LABEL_BLOCK;
        case FW_ACCEPT: return IP_FW_LABEL_ACCEPT;
        case FW_REJECT: return IP_FW_LABEL_REJECT;
        case FW_REDIRECT: return IP_FW_LABEL_REDIRECT;
        case FW_MASQUERADE: return IP_FW_LABEL_MASQUERADE;
        case FW_SKIP: return "-";
        case FW_SKIP+1: return IP_FW_LABEL_RETURN;
        default:
                return "UNKNOWN";
        }
}

/*
 * VERY ugly piece of code which actually
 * makes kernel printf for matching packets...
 */
static void dump_packet(struct sk_buff **pskb,
                        const char *ifname,
                        struct ip_fwkernel *f,
                        const ip_chainlabel chainlabel,
                        __u16 src_port,
                        __u16 dst_port,
                        unsigned int count,
                        int syn)
{
        __u32 *opt = (__u32 *) ((*pskb)->nh.iph + 1);
        int opti;

        if (f) {
                printk(KERN_INFO "Packet log: %s ",chainlabel);
                printk("%s ",branchname(f->branch,f->simplebranch));
                if (f->simplebranch==FW_REDIRECT)
                        printk("%d ",f->ipfw.fw_redirpt);
        }

        printk("%s PROTO=%d %u.%u.%u.%u:%hu %u.%u.%u.%u:%hu"
               " L=%hu S=0x%2.2hX I=%hu F=0x%4.4hX T=%hu",
               ifname, (*pskb)->nh.iph->protocol,
               NIPQUAD((*pskb)->nh.iph->saddr),
               src_port,
               NIPQUAD((*pskb)->nh.iph->daddr),
               dst_port,
               ntohs((*pskb)->nh.iph->tot_len),
               (*pskb)->nh.iph->tos,
               ntohs((*pskb)->nh.iph->id),
               ntohs((*pskb)->nh.iph->frag_off),
               (*pskb)->nh.iph->ttl);

        for (opti = 0; opti < ((*pskb)->nh.iph->ihl - sizeof(struct iphdr) / 4); opti++)
                printk(" O=0x%8.8X", *opt++);
        printk(" %s(#%d)\n", syn ? "SYN " : /* "PENANCE" */ "", count);
}

/* function for checking chain labels for user space. */
static int check_label(ip_chainlabel label)
{
        unsigned int i;
        /* strlen must be < IP_FW_MAX_LABEL_LENGTH. */
        for (i = 0; i < IP_FW_MAX_LABEL_LENGTH + 1; i++)
                if (label[i] == '\0') return 1;

        return 0;
}

/*      This function returns a pointer to the first chain with a label
 *      that matches the one given. */
static struct ip_chain *find_label(ip_chainlabel label)
{
        struct ip_chain *tmp;
        FWC_HAVE_LOCK(fwc_rlocks | fwc_wlocks);
        for (tmp = ip_fw_chains; tmp; tmp = tmp->next)
                if (strcmp(tmp->label,label) == 0)
                        break;
        return tmp;
}

/* This function returns a boolean which when true sets answer to one
   of the FW_*. */
static int find_special(ip_chainlabel label, int *answer)
{
        if (label[0] == '\0') {
                *answer = FW_SKIP; /* => pass-through rule */
                return 1;
        } else if (strcmp(label,IP_FW_LABEL_ACCEPT) == 0) {
                *answer = FW_ACCEPT;
                return 1;
        } else if (strcmp(label,IP_FW_LABEL_BLOCK) == 0) {
                *answer = FW_BLOCK;
                return 1;
        } else if (strcmp(label,IP_FW_LABEL_REJECT) == 0) {
                *answer = FW_REJECT;
                return 1;
        } else if (strcmp(label,IP_FW_LABEL_REDIRECT) == 0) {
                *answer = FW_REDIRECT;
                return 1;
        } else if (strcmp(label,IP_FW_LABEL_MASQUERADE) == 0) {
                *answer = FW_MASQUERADE;
                return 1;
        } else if (strcmp(label, IP_FW_LABEL_RETURN) == 0) {
                *answer = FW_SKIP+1;
                return 1;
        } else {
                return 0;
        }
}

/* This function cleans up the prevchain and prevrule.  If the verbose
 * flag is set then he names of the chains will be printed as it
 * cleans up.  */
static void cleanup(struct ip_chain *chain,
                    const int verbose,
                    unsigned int slot)
{
        struct ip_chain *tmpchain = chain->reent[slot].prevchain;
        if (verbose)
                printk(KERN_ERR "Chain backtrace: ");
        while (tmpchain) {
                if (verbose)
                        printk("%s<-",chain->label);
                chain->reent[slot].prevchain = NULL;
                chain = tmpchain;
                tmpchain = chain->reent[slot].prevchain;
        }
        if (verbose)
                printk("%s\n",chain->label);
}

static inline int
ip_fw_domatch(struct ip_fwkernel *f,
              const char *rif,
              const ip_chainlabel label,
              struct sk_buff **pskb,
              unsigned int slot,
              __u16 src_port, __u16 dst_port,
              unsigned int count,
              int tcpsyn,
              unsigned char *tos)
{
        f->counters[slot].bcnt+=ntohs((*pskb)->nh.iph->tot_len);
        f->counters[slot].pcnt++;
        if (f->ipfw.fw_flg & IP_FW_F_PRN) {
                dump_packet(pskb,rif,f,label,src_port,dst_port,count,tcpsyn);
        }

        *tos = (*tos & f->ipfw.fw_tosand) ^ f->ipfw.fw_tosxor;

/* This functionality is useless in stock 2.0.x series, but we don't
 * discard the mark thing altogether, to avoid breaking ipchains (and,
 * more importantly, the ipfwadm wrapper) --PR */
        if (f->ipfw.fw_flg & IP_FW_F_MARKABS) {
                (*pskb)->nfmark = f->ipfw.fw_mark;
        } else {
                (*pskb)->nfmark += f->ipfw.fw_mark;
        }
        if (f->ipfw.fw_flg & IP_FW_F_NETLINK) {
#if defined(CONFIG_NETLINK_DEV) || defined(CONFIG_NETLINK_DEV_MODULE)
                size_t len = min_t(unsigned int, f->ipfw.fw_outputsize, ntohs((*pskb)->nh.iph->tot_len))
                        + sizeof(__u32) + sizeof((*pskb)->nfmark) + IFNAMSIZ;
                struct sk_buff *outskb=alloc_skb(len, GFP_ATOMIC);

                duprintf("Sending packet out NETLINK (length = %u).\n",
                         (unsigned int)len);
                if (outskb) {
                        /* Prepend length, mark & interface */
                        skb_put(outskb, len);
                        *((__u32 *)outskb->data) = (__u32)len;
                        *((__u32 *)(outskb->data+sizeof(__u32))) =
                                (*pskb)->nfmark;
                        strcpy(outskb->data+sizeof(__u32)*2, rif);
                        skb_copy_bits(*pskb,
                                ((char *)(*pskb)->nh.iph - (char *)(*pskb)->data),
                                outskb->data+sizeof(__u32)*2+IFNAMSIZ,
                                len-(sizeof(__u32)*2+IFNAMSIZ));
                        netlink_broadcast(ipfwsk, outskb, 0, ~0, GFP_ATOMIC);
                }
                else {
#endif
                        if (net_ratelimit())
                                printk(KERN_WARNING "ip_fw: packet drop due to "
                                       "netlink failure\n");
                        return 0;
#if defined(CONFIG_NETLINK_DEV) || defined(CONFIG_NETLINK_DEV_MODULE)
                }
#endif
        }
        return 1;
}

/*
 *      Returns one of the generic firewall policies, like FW_ACCEPT.
 *
 *      The testing is either false for normal firewall mode or true for
 *      user checking mode (counters are not updated, TOS & mark not done).
 */
static int
ip_fw_check(const char *rif,
            __u16 *redirport,
            struct ip_chain *chain,
            struct sk_buff **pskb,
            unsigned int slot,
            int testing)
{
        __u32                   src, dst;
        __u16                   src_port = 0xFFFF, dst_port = 0xFFFF;
        char                    tcpsyn=0;
        __u16                   offset;
        unsigned char           tos;
        struct ip_fwkernel      *f;
        int                     ret = FW_SKIP+2;
        unsigned int            count;

        /* We handle fragments by dealing with the first fragment as
         * if it was a normal packet.  All other fragments are treated
         * normally, except that they will NEVER match rules that ask
         * things we don't know, ie. tcp syn flag or ports).  If the
         * rule is also a fragment-specific rule, non-fragments won't
         * match it. */

        offset = ntohs((*pskb)->nh.iph->frag_off) & IP_OFFSET;

        /*
         *      Don't allow a fragment of TCP 8 bytes in. Nobody
         *      normal causes this. Its a cracker trying to break
         *      in by doing a flag overwrite to pass the direction
         *      checks.
         */
        if (offset == 1 && (*pskb)->nh.iph->protocol == IPPROTO_TCP) {
                if (!testing && net_ratelimit()) {
                        printk("Suspect TCP fragment.\n");
                        dump_packet(pskb,rif,NULL,NULL,0,0,0,0);
                }
                return FW_BLOCK;
        }

        /* If we can't investigate ports, treat as fragment.  It's
         * either a trucated whole packet, or a truncated first
         * fragment, or a TCP first fragment of length 8-15, in which
         * case the above rule stops reassembly.
         */
        if (offset == 0) {
                unsigned int size_req;
                switch ((*pskb)->nh.iph->protocol) {
                case IPPROTO_TCP:
                        /* Don't care about things past flags word */
                        size_req = 16;
                        break;

                case IPPROTO_UDP:
                case IPPROTO_ICMP:
                        size_req = 8;
                        break;

                default:
                        size_req = 0;
                }

                /* If it is a truncated first fragment then it can be
                 * used to rewrite port information, and thus should
                 * be blocked.
                 */
                if (ntohs((*pskb)->nh.iph->tot_len) <
                    ((*pskb)->nh.iph->ihl<<2)+size_req) {
                        if (!testing && net_ratelimit()) {
                                printk("Suspect short first fragment.\n");
                                dump_packet(pskb,rif,NULL,NULL,0,0,0,0);
                        }
                        return FW_BLOCK;
                }
        }

        src = (*pskb)->nh.iph->saddr;
        dst = (*pskb)->nh.iph->daddr;
        tos = (*pskb)->nh.iph->tos;

        /*
         *      If we got interface from which packet came
         *      we can use the address directly. Linux 2.1 now uses address
         *      chains per device too, but unlike BSD we first check if the
         *      incoming packet matches a device address and the routing
         *      table before calling the firewall.
         */

        dprintf("Packet ");
        switch ((*pskb)->nh.iph->protocol) {
                case IPPROTO_TCP:
                        dprintf("TCP ");
                        if (!offset) {
                                struct tcphdr _tcph, *th;

                                th = skb_header_pointer(*pskb,
                                                        (*pskb)->nh.iph->ihl*4,
                                                        sizeof(_tcph), &_tcph);
                                if (th == NULL)
                                        return FW_BLOCK;

                                src_port = ntohs(th->source);
                                dst_port = ntohs(th->dest);

                                /* Connection initilisation can only
                                 * be made when the syn bit is set and
                                 * neither of the ack or reset is
                                 * set. */
                                if (th->syn && !(th->ack || th->rst))
                                        tcpsyn = 1;
                        }
                        break;
                case IPPROTO_UDP:
                        dprintf("UDP ");
                        if (!offset) {
                                struct udphdr _udph, *uh;

                                uh = skb_header_pointer(*pskb,
                                                        (*pskb)->nh.iph->ihl*4,
                                                        sizeof(_udph), &_udph);
                                if (uh == NULL)
                                        return FW_BLOCK;

                                src_port = ntohs(uh->source);
                                dst_port = ntohs(uh->dest);
                        }
                        break;
                case IPPROTO_ICMP:
                        if (!offset) {
                                struct icmphdr _icmph, *ic;

                                ic = skb_header_pointer(*pskb,
                                                        (*pskb)->nh.iph->ihl*4,
                                                        sizeof(_icmph),
                                                        &_icmph);
                                if (ic == NULL)
                                        return FW_BLOCK;

                                src_port = (__u16) ic->type;
                                dst_port = (__u16) ic->code;
                        }
                        dprintf("ICMP ");
                        break;
                default:
                        dprintf("p=%d ", (*pskb)->nh.iph->protocol);
                        break;
        }
#ifdef DEBUG_IP_FIREWALL
        print_ip((*pskb)->nh.iph->saddr);

        if (offset)
                dprintf(":fragment (%i) ", ((int)offset)<<2);
        else if ((*pskb)->nh.iph->protocol == IPPROTO_TCP ||
                 (*pskb)->nh.iph->protocol == IPPROTO_UDP ||
                 (*pskb)->nh.iph->protocol == IPPROTO_ICMP)
                dprintf(":%hu:%hu", src_port, dst_port);
        dprintf("\n");
#endif

        if (!testing) FWC_READ_LOCK(&ip_fw_lock);
        else FWC_HAVE_LOCK(fwc_rlocks);

        f = chain->chain;
        do {
                count = 0;
                for (; f; f = f->next) {
                        count++;
                        if (ip_rule_match(f, rif, pskb,
                                          tcpsyn, src_port, dst_port,
                                          offset)) {
                                if (!testing
                                    && !ip_fw_domatch(f, rif, chain->label,
                                                      pskb, slot,
                                                      src_port, dst_port,
                                                      count, tcpsyn, &tos)) {
                                        ret = FW_BLOCK;
                                        cleanup(chain, 0, slot);
                                        goto out;
                                }
                                break;
                        }
                }
                if (f) {
                        if (f->branch) {
                                /* Do sanity check to see if we have
                                 * already set prevchain and if so we
                                 * must be in a loop */
                                if (f->branch->reent[slot].prevchain) {
                                        if (!testing) {
                                                printk(KERN_ERR
                                                       "IP firewall: "
                                                       "Loop detected "
                                                       "at `%s'.\n",
                                                       f->branch->label);
                                                cleanup(chain, 1, slot);
                                                ret = FW_BLOCK;
                                        } else {
                                                cleanup(chain, 0, slot);
                                                ret = FW_SKIP+1;
                                        }
                                }
                                else {
                                        f->branch->reent[slot].prevchain
                                                = chain;
                                        f->branch->reent[slot].prevrule
                                                = f->next;
                                        chain = f->branch;
                                        f = chain->chain;
                                }
                        }
                        else if (f->simplebranch == FW_SKIP)
                                f = f->next;
                        else if (f->simplebranch == FW_SKIP+1) {
                                /* Just like falling off the chain */
                                goto fall_off_chain;
                        } else {
                                cleanup(chain, 0, slot);
                                ret = f->simplebranch;
                        }
                } /* f == NULL */
                else {
                fall_off_chain:
                        if (chain->reent[slot].prevchain) {
                                struct ip_chain *tmp = chain;
                                f = chain->reent[slot].prevrule;
                                chain = chain->reent[slot].prevchain;
                                tmp->reent[slot].prevchain = NULL;
                        }
                        else {
                                ret = chain->policy;
                                if (!testing) {
                                        chain->reent[slot].counters.pcnt++;
                                        chain->reent[slot].counters.bcnt
                                                += ntohs((*pskb)->nh.iph->tot_len);
                                }
                        }
                }
        } while (ret == FW_SKIP+2);

 out:
        if (!testing) FWC_READ_UNLOCK(&ip_fw_lock);

        /* Recalculate checksum if not going to reject, and TOS changed. */
        if ((*pskb)->nh.iph->tos != tos
            && ret != FW_REJECT && ret != FW_BLOCK
            && !testing) {
                if (!skb_ip_make_writable(pskb, offsetof(struct iphdr, tos)+1))
                        ret = FW_BLOCK;
                else {
                        (*pskb)->nh.iph->tos = tos;
                        ip_send_check((*pskb)->nh.iph);
                }
        }

        if (ret == FW_REDIRECT && redirport) {
                if ((*redirport = htons(f->ipfw.fw_redirpt)) == 0) {
                        /* Wildcard redirection.
                         * Note that redirport will become
                         * 0xFFFF for non-TCP/UDP packets.
                         */
                        *redirport = htons(dst_port);
                }
        }

#ifdef DEBUG_ALLOW_ALL
        return (testing ? ret : FW_ACCEPT);
#else
        return ret;
#endif
}

/* Must have write lock & interrupts off for any of these */

/* This function sets all the byte counters in a chain to zero.  The
 * input is a pointer to the chain required for zeroing */
static int zero_fw_chain(struct ip_chain *chainptr)
{
        struct ip_fwkernel *i;

        FWC_HAVE_LOCK(fwc_wlocks);
        for (i = chainptr->chain; i; i = i->next)
                memset(i->counters, 0, sizeof(struct ip_counters)*NUM_SLOTS);
        return 0;
}

static int clear_fw_chain(struct ip_chain *chainptr)
{
        struct ip_fwkernel *i= chainptr->chain;

        FWC_HAVE_LOCK(fwc_wlocks);
        chainptr->chain=NULL;

        while (i) {
                struct ip_fwkernel *tmp = i->next;
                if (i->branch)
                        i->branch->refcount--;
                kfree(i);
                i = tmp;
                /* We will block in cleanup's unregister sockopt if unloaded,
                   so this is safe. */
                module_put(THIS_MODULE);
        }
        return 0;
}

static int replace_in_chain(struct ip_chain *chainptr,
                            struct ip_fwkernel *frwl,
                            __u32 position)
{
        struct ip_fwkernel *f = chainptr->chain;

        FWC_HAVE_LOCK(fwc_wlocks);

        while (--position && f != NULL) f = f->next;
        if (f == NULL)
                return EINVAL;

        if (f->branch) f->branch->refcount--;
        if (frwl->branch) frwl->branch->refcount++;

        frwl->next = f->next;
        memcpy(f,frwl,sizeof(struct ip_fwkernel));
        kfree(frwl);
        return 0;
}

static int append_to_chain(struct ip_chain *chainptr, struct ip_fwkernel *rule)
{
        struct ip_fwkernel *i;

        FWC_HAVE_LOCK(fwc_wlocks);

        /* Are we unloading now?  We will block on nf_unregister_sockopt */
        if (!try_module_get(THIS_MODULE))
                return ENOPROTOOPT;

        /* Special case if no rules already present */
        if (chainptr->chain == NULL) {

                /* If pointer writes are atomic then turning off
                 * interrupts is not necessary. */
                chainptr->chain = rule;
                if (rule->branch) rule->branch->refcount++;
                goto append_successful;
        }

        /* Find the rule before the end of the chain */
        for (i = chainptr->chain; i->next; i = i->next);
        i->next = rule;
        if (rule->branch) rule->branch->refcount++;

append_successful:
        return 0;
}

/* This function inserts a rule at the position of position in the
 * chain refenced by chainptr.  If position is 1 then this rule will
 * become the new rule one. */
static int insert_in_chain(struct ip_chain *chainptr,
                           struct ip_fwkernel *frwl,
                           __u32 position)
{
        struct ip_fwkernel *f = chainptr->chain;

        FWC_HAVE_LOCK(fwc_wlocks);

        /* Are we unloading now?  We will block on nf_unregister_sockopt */
        if (!try_module_get(THIS_MODULE))
                return ENOPROTOOPT;

        /* special case if the position is number 1 */
        if (position == 1) {
                frwl->next = chainptr->chain;
                if (frwl->branch) frwl->branch->refcount++;
                chainptr->chain = frwl;
                goto insert_successful;
        }
        position--;
        while (--position && f != NULL) f = f->next;
        if (f == NULL)
                return EINVAL;
        if (frwl->branch) frwl->branch->refcount++;
        frwl->next = f->next;

        f->next = frwl;

insert_successful:
        return 0;
}

/* This function deletes the a rule from a given rulenum and chain.
 * With rulenum = 1 is the first rule is deleted. */

static int del_num_from_chain(struct ip_chain *chainptr, __u32 rulenum)
{
        struct ip_fwkernel *i=chainptr->chain,*tmp;

        FWC_HAVE_LOCK(fwc_wlocks);

        if (!chainptr->chain)
                return ENOENT;

        /* Need a special case for the first rule */
        if (rulenum == 1) {
                /* store temp to allow for freeing up of memory */
                tmp = chainptr->chain;
                if (chainptr->chain->branch) chainptr->chain->branch->refcount--;
                chainptr->chain = chainptr->chain->next;
                kfree(tmp); /* free memory that is now unused */
        } else {
                rulenum--;
                while (--rulenum && i->next ) i = i->next;
                if (!i->next)
                        return ENOENT;
                tmp = i->next;
                if (i->next->branch)
                        i->next->branch->refcount--;
                i->next = i->next->next;
                kfree(tmp);
        }

        /* We will block in cleanup's unregister sockopt if unloaded,
           so this is safe. */
        module_put(THIS_MODULE);
        return 0;
}


/* This function deletes the a rule from a given rule and chain.
 * The rule that is deleted is the first occursance of that rule. */
static int del_rule_from_chain(struct ip_chain *chainptr,
                               struct ip_fwkernel *frwl)
{
        struct ip_fwkernel *ltmp,*ftmp = chainptr->chain ;
        int was_found;

        FWC_HAVE_LOCK(fwc_wlocks);

        /* Sure, we should compare marks, but since the `ipfwadm'
         * script uses it for an unholy hack... well, life is easier
         * this way.  We also mask it out of the flags word. --PR */
        for (ltmp=NULL, was_found=0;
             !was_found && ftmp != NULL;
             ltmp = ftmp,ftmp = ftmp->next) {
                if (ftmp->ipfw.fw_src.s_addr!=frwl->ipfw.fw_src.s_addr
                    || ftmp->ipfw.fw_dst.s_addr!=frwl->ipfw.fw_dst.s_addr
                    || ftmp->ipfw.fw_smsk.s_addr!=frwl->ipfw.fw_smsk.s_addr
                    || ftmp->ipfw.fw_dmsk.s_addr!=frwl->ipfw.fw_dmsk.s_addr
#if 0
                    || ftmp->ipfw.fw_flg!=frwl->ipfw.fw_flg
#else
                    || ((ftmp->ipfw.fw_flg & ~IP_FW_F_MARKABS)
                        != (frwl->ipfw.fw_flg & ~IP_FW_F_MARKABS))
#endif
                    || ftmp->ipfw.fw_invflg!=frwl->ipfw.fw_invflg
                    || ftmp->ipfw.fw_proto!=frwl->ipfw.fw_proto
#if 0
                    || ftmp->ipfw.fw_mark!=frwl->ipfw.fw_mark
#endif
                    || ftmp->ipfw.fw_redirpt!=frwl->ipfw.fw_redirpt
                    || ftmp->ipfw.fw_spts[0]!=frwl->ipfw.fw_spts[0]
                    || ftmp->ipfw.fw_spts[1]!=frwl->ipfw.fw_spts[1]
                    || ftmp->ipfw.fw_dpts[0]!=frwl->ipfw.fw_dpts[0]
                    || ftmp->ipfw.fw_dpts[1]!=frwl->ipfw.fw_dpts[1]
                    || ftmp->ipfw.fw_outputsize!=frwl->ipfw.fw_outputsize) {
                        duprintf("del_rule_from_chain: mismatch:"
                                 "src:%u/%u dst:%u/%u smsk:%u/%u dmsk:%u/%u "
                                 "flg:%hX/%hX invflg:%hX/%hX proto:%u/%u "
                                 "mark:%u/%u "
                                 "ports:%hu-%hu/%hu-%hu %hu-%hu/%hu-%hu "
                                 "outputsize:%hu-%hu\n",
                                 ftmp->ipfw.fw_src.s_addr,
                                 frwl->ipfw.fw_src.s_addr,
                                 ftmp->ipfw.fw_dst.s_addr,
                                 frwl->ipfw.fw_dst.s_addr,
                                 ftmp->ipfw.fw_smsk.s_addr,
                                 frwl->ipfw.fw_smsk.s_addr,
                                 ftmp->ipfw.fw_dmsk.s_addr,
                                 frwl->ipfw.fw_dmsk.s_addr,
                                 ftmp->ipfw.fw_flg,
                                 frwl->ipfw.fw_flg,
                                 ftmp->ipfw.fw_invflg,
                                 frwl->ipfw.fw_invflg,
                                 ftmp->ipfw.fw_proto,
                                 frwl->ipfw.fw_proto,
                                 ftmp->ipfw.fw_mark,
                                 frwl->ipfw.fw_mark,
                                 ftmp->ipfw.fw_spts[0],
                                 frwl->ipfw.fw_spts[0],
                                 ftmp->ipfw.fw_spts[1],
                                 frwl->ipfw.fw_spts[1],
                                 ftmp->ipfw.fw_dpts[0],
                                 frwl->ipfw.fw_dpts[0],
                                 ftmp->ipfw.fw_dpts[1],
                                 frwl->ipfw.fw_dpts[1],
                                 ftmp->ipfw.fw_outputsize,
                                 frwl->ipfw.fw_outputsize);
                        continue;
                }

                if (strncmp(ftmp->ipfw.fw_vianame,
                            frwl->ipfw.fw_vianame,
                            IFNAMSIZ)) {
                        duprintf("del_rule_from_chain: if mismatch: %s/%s\n",
                                 ftmp->ipfw.fw_vianame,
                                 frwl->ipfw.fw_vianame);
                        continue;
                }
                if (ftmp->branch != frwl->branch) {
                        duprintf("del_rule_from_chain: branch mismatch: "
                                 "%s/%s\n",
                                 ftmp->branch?ftmp->branch->label:"(null)",
                                 frwl->branch?frwl->branch->label:"(null)");
                        continue;
                }
                if (ftmp->branch == NULL
                    && ftmp->simplebranch != frwl->simplebranch) {
                        duprintf("del_rule_from_chain: simplebranch mismatch: "
                                 "%i/%i\n",
                                 ftmp->simplebranch, frwl->simplebranch);
                        continue;
                }
                was_found = 1;
                if (ftmp->branch)
                        ftmp->branch->refcount--;
                if (ltmp)
                        ltmp->next = ftmp->next;
                else
                        chainptr->chain = ftmp->next;
                kfree(ftmp);
                /* We will block in cleanup's unregister sockopt if unloaded,
                   so this is safe. */
                module_put(THIS_MODULE);
                break;
        }

        if (was_found)
                return 0;
        else {
                duprintf("del_rule_from_chain: no matching rule found\n");
                return EINVAL;
        }
}

/* This function takes the label of a chain and deletes the first
 * chain with that name.  No special cases required for the built in
 * chains as they have their refcount initilised to 1 so that they are
 * never deleted.  */
static int del_chain(ip_chainlabel label)
{
        struct ip_chain *tmp,*tmp2;

        FWC_HAVE_LOCK(fwc_wlocks);
        /* Corner case: return EBUSY not ENOENT for first elem ("input") */
        if (strcmp(label, ip_fw_chains->label) == 0)
                return EBUSY;

        for (tmp = ip_fw_chains; tmp->next; tmp = tmp->next)
                if(strcmp(tmp->next->label,label) == 0)
                        break;

        tmp2 = tmp->next;
        if (!tmp2)
                return ENOENT;

        if (tmp2->refcount)
                return EBUSY;

        if (tmp2->chain)
                return ENOTEMPTY;

        tmp->next = tmp2->next;
        kfree(tmp2);

        /* We will block in cleanup's unregister sockopt if unloaded,
           so this is safe. */
        module_put(THIS_MODULE);
        return 0;
}

/* This is a function to initilise a chain.  Built in rules start with
 * refcount = 1 so that they cannot be deleted.  User defined rules
 * start with refcount = 0 so they can be deleted. */
static struct ip_chain *ip_init_chain(ip_chainlabel name,
                                      __u32 ref,
                                      int policy)
{
        unsigned int i;
        struct ip_chain *label
                = kmalloc(SIZEOF_STRUCT_IP_CHAIN, GFP_KERNEL);
        if (label == NULL)
                panic("Can't kmalloc for firewall chains.\n");
        strcpy(label->label,name);
        label->next = NULL;
        label->chain = NULL;
        label->refcount = ref;
        label->policy = policy;
        for (i = 0; i < NUM_SLOTS; i++) {
                label->reent[i].counters.pcnt = label->reent[i].counters.bcnt
                        = 0;
                label->reent[i].prevchain = NULL;
                label->reent[i].prevrule = NULL;
        }

        return label;
}

/* This is a function for reating a new chain.  The chains is not
 * created if a chain of the same name already exists */
static int create_chain(ip_chainlabel label)
{
        struct ip_chain *tmp;

        if (!check_label(label))
                return EINVAL;

        FWC_HAVE_LOCK(fwc_wlocks);
        for (tmp = ip_fw_chains; tmp->next; tmp = tmp->next)
                if (strcmp(tmp->label,label) == 0)
                        return EEXIST;

        if (strcmp(tmp->label,label) == 0)
                return EEXIST;

        /* Are we unloading now?  We will block on nf_unregister_sockopt */
        if (!try_module_get(THIS_MODULE))
                return ENOPROTOOPT;

        tmp->next = ip_init_chain(label, 0, FW_SKIP); /* refcount is
                                              * zero since this is a
                                              * user defined chain *
                                              * and therefore can be
                                              * deleted */
        return 0;
}

/* This function simply changes the policy on one of the built in
 * chains.  checking must be done before this is call to ensure that
 * chainptr is pointing to one of the three possible chains */
static int change_policy(struct ip_chain *chainptr, int policy)
{
        FWC_HAVE_LOCK(fwc_wlocks);
        chainptr->policy = policy;
        return 0;
}

/* This function takes an ip_fwuser and converts it to a ip_fwkernel.  It also
 * performs some checks in the structure. */
static struct ip_fwkernel *convert_ipfw(struct ip_fwuser *fwuser, int *errno)
{
        struct ip_fwkernel *fwkern;

        if ( (fwuser->ipfw.fw_flg & ~IP_FW_F_MASK) != 0 ) {
                duprintf("convert_ipfw: undefined flag bits set (flags=%x)\n",
                         fwuser->ipfw.fw_flg);
                *errno = EINVAL;
                return NULL;
        }

#ifdef DEBUG_IP_FIREWALL_USER
        /* These are sanity checks that don't really matter.
         * We can get rid of these once testing is complete.
         */
        if ((fwuser->ipfw.fw_flg & IP_FW_F_TCPSYN)
            && ((fwuser->ipfw.fw_invflg & IP_FW_INV_PROTO)
                || fwuser->ipfw.fw_proto != IPPROTO_TCP)) {
                duprintf("convert_ipfw: TCP SYN flag set but proto != TCP!\n");
                *errno = EINVAL;
                return NULL;
        }

        if (strcmp(fwuser->label, IP_FW_LABEL_REDIRECT) != 0
            && fwuser->ipfw.fw_redirpt != 0) {
                duprintf("convert_ipfw: Target not REDIR but redirpt != 0!\n");
                *errno = EINVAL;
                return NULL;
        }

        if ((!(fwuser->ipfw.fw_flg & IP_FW_F_FRAG)
             && (fwuser->ipfw.fw_invflg & IP_FW_INV_FRAG))
            || (!(fwuser->ipfw.fw_flg & IP_FW_F_TCPSYN)
                && (fwuser->ipfw.fw_invflg & IP_FW_INV_SYN))) {
                duprintf("convert_ipfw: Can't have INV flag if flag unset!\n");
                *errno = EINVAL;
                return NULL;
        }

        if (((fwuser->ipfw.fw_invflg & IP_FW_INV_SRCPT)
             && fwuser->ipfw.fw_spts[0] == 0
             && fwuser->ipfw.fw_spts[1] == 0xFFFF)
            || ((fwuser->ipfw.fw_invflg & IP_FW_INV_DSTPT)
                && fwuser->ipfw.fw_dpts[0] == 0
                && fwuser->ipfw.fw_dpts[1] == 0xFFFF)
            || ((fwuser->ipfw.fw_invflg & IP_FW_INV_VIA)
                && (fwuser->ipfw.fw_vianame)[0] == '\0')
            || ((fwuser->ipfw.fw_invflg & IP_FW_INV_SRCIP)
                && fwuser->ipfw.fw_smsk.s_addr == 0)
            || ((fwuser->ipfw.fw_invflg & IP_FW_INV_DSTIP)
                && fwuser->ipfw.fw_dmsk.s_addr == 0)) {
                duprintf("convert_ipfw: INV flag makes rule unmatchable!\n");
                *errno = EINVAL;
                return NULL;
        }

        if ((fwuser->ipfw.fw_flg & IP_FW_F_FRAG)
            && !(fwuser->ipfw.fw_invflg & IP_FW_INV_FRAG)
            && (fwuser->ipfw.fw_spts[0] != 0
                || fwuser->ipfw.fw_spts[1] != 0xFFFF
                || fwuser->ipfw.fw_dpts[0] != 0
                || fwuser->ipfw.fw_dpts[1] != 0xFFFF
                || (fwuser->ipfw.fw_flg & IP_FW_F_TCPSYN))) {
                duprintf("convert_ipfw: Can't test ports or SYN with frag!\n");
                *errno = EINVAL;
                return NULL;
        }
#endif

        if ((fwuser->ipfw.fw_spts[0] != 0
             || fwuser->ipfw.fw_spts[1] != 0xFFFF
             || fwuser->ipfw.fw_dpts[0] != 0
             || fwuser->ipfw.fw_dpts[1] != 0xFFFF)
            && ((fwuser->ipfw.fw_invflg & IP_FW_INV_PROTO)
                || (fwuser->ipfw.fw_proto != IPPROTO_TCP
                    && fwuser->ipfw.fw_proto != IPPROTO_UDP
                    && fwuser->ipfw.fw_proto != IPPROTO_ICMP))) {
                duprintf("convert_ipfw: Can only test ports for TCP/UDP/ICMP!\n");
                *errno = EINVAL;
                return NULL;
        }

        fwkern = kmalloc(SIZEOF_STRUCT_IP_FW_KERNEL, GFP_ATOMIC);
        if (!fwkern) {
                duprintf("convert_ipfw: kmalloc failed!\n");
                *errno = ENOMEM;
                return NULL;
        }
        memcpy(&fwkern->ipfw,&fwuser->ipfw,sizeof(struct ip_fw));

        if (!find_special(fwuser->label, &fwkern->simplebranch)) {
                fwkern->branch = find_label(fwuser->label);
                if (!fwkern->branch) {
                        duprintf("convert_ipfw: chain doesn't exist `%s'.\n",
                                 fwuser->label);
                        kfree(fwkern);
                        *errno = ENOENT;
                        return NULL;
                } else if (fwkern->branch == IP_FW_INPUT_CHAIN
                           || fwkern->branch == IP_FW_FORWARD_CHAIN
                           || fwkern->branch == IP_FW_OUTPUT_CHAIN) {
                        duprintf("convert_ipfw: Can't branch to builtin chain `%s'.\n",
                                 fwuser->label);
                        kfree(fwkern);
                        *errno = ENOENT;
                        return NULL;
                }
        } else
                fwkern->branch = NULL;
        memset(fwkern->counters, 0, sizeof(struct ip_counters)*NUM_SLOTS);

        /* Handle empty vianame by making it a wildcard */
        if ((fwkern->ipfw.fw_vianame)[0] == '\0')
            fwkern->ipfw.fw_flg |= IP_FW_F_WILDIF;

        fwkern->next = NULL;
        return fwkern;
}

int ip_fw_ctl(int cmd, void *m, int len)
{
        int ret;
        struct ip_chain *chain;
        unsigned long flags;

        FWC_WRITE_LOCK_IRQ(&ip_fw_lock, flags);

        switch (cmd) {
        case IP_FW_FLUSH:
                if (len != sizeof(ip_chainlabel) || !check_label(m))
                        ret = EINVAL;
                else if ((chain = find_label(m)) == NULL)
                        ret = ENOENT;
                else ret = clear_fw_chain(chain);
                break;

        case IP_FW_ZERO:
                if (len != sizeof(ip_chainlabel) || !check_label(m))
                        ret = EINVAL;
                else if ((chain = find_label(m)) == NULL)
                        ret = ENOENT;
                else ret = zero_fw_chain(chain);
                break;

        case IP_FW_CHECK: {
                struct ip_fwtest *new = m;
                struct iphdr *ip;

                /* Don't need write lock. */
                FWC_WRITE_UNLOCK_IRQ(&ip_fw_lock, flags);

                if (len != sizeof(struct ip_fwtest) || !check_label(m))
                        return EINVAL;

                /* Need readlock to do find_label */
                FWC_READ_LOCK(&ip_fw_lock);

                if ((chain = find_label(new->fwt_label)) == NULL)
                        ret = ENOENT;
                else {
                        struct sk_buff *tmp_skb;
                        int hdrlen;

                        hdrlen = sizeof(struct ip_fwpkt) -
                                sizeof(struct in_addr) -
                                IFNAMSIZ;

                        ip = &(new->fwt_packet.fwp_iph);

                        /* Fix this one up by hand, who knows how many
                         * tools will break if we start to barf on this.
                         */
                        if (ntohs(ip->tot_len) > hdrlen)
                                ip->tot_len = htons(hdrlen);

                        if (ip->ihl != sizeof(struct iphdr) / sizeof(u32)) {
                                duprintf("ip_fw_ctl: ip->ihl=%d, want %d\n",
                                         ip->ihl,
                                         sizeof(struct iphdr) / sizeof(u32));
                                ret = EINVAL;
                        } else if ((tmp_skb = alloc_skb(hdrlen,
                                                        GFP_ATOMIC)) == NULL) {
                                duprintf("ip_fw_ctl: tmp_skb alloc failure\n");
                                ret = EFAULT;
                        } else {
                                skb_reserve(tmp_skb, hdrlen);
                                skb_push(tmp_skb, hdrlen);
                                memcpy(tmp_skb->data, ip, hdrlen);
                                tmp_skb->nh.raw =
                                        (unsigned char *) tmp_skb->data;
                                ret = ip_fw_check(new->fwt_packet.fwp_vianame,
                                                  NULL, chain,
                                                  &tmp_skb, SLOT_NUMBER(), 1);
                                kfree_skb(tmp_skb);
                                switch (ret) {
                                case FW_ACCEPT:
                                        ret = 0; break;
                                case FW_REDIRECT:
                                        ret = ECONNABORTED; break;
                                case FW_MASQUERADE:
                                        ret = ECONNRESET; break;
                                case FW_REJECT:
                                        ret = ECONNREFUSED; break;
                                        /* Hack to help diag; these only get
                                           returned when testing. */
                                case FW_SKIP+1:
                                        ret = ELOOP; break;
                                case FW_SKIP:
                                        ret = ENFILE; break;
                                default: /* FW_BLOCK */
                                        ret = ETIMEDOUT; break;
                                }
                        }
                }
                FWC_READ_UNLOCK(&ip_fw_lock);
                return ret;
        }

        case IP_FW_MASQ_TIMEOUTS: {
                ret = ip_fw_masq_timeouts(m, len);
        }
        break;

        case IP_FW_REPLACE: {
                struct ip_fwkernel *ip_fwkern;
                struct ip_fwnew *new = m;

                if (len != sizeof(struct ip_fwnew)
                    || !check_label(new->fwn_label))
                        ret = EINVAL;
                else if ((chain = find_label(new->fwn_label)) == NULL)
                        ret = ENOENT;
                else if ((ip_fwkern = convert_ipfw(&new->fwn_rule, &ret))
                         != NULL)
                        ret = replace_in_chain(chain, ip_fwkern,
                                               new->fwn_rulenum);
        }
        break;

        case IP_FW_APPEND: {
                struct ip_fwchange *new = m;
                struct ip_fwkernel *ip_fwkern;

                if (len != sizeof(struct ip_fwchange)
                    || !check_label(new->fwc_label))
                        ret = EINVAL;
                else if ((chain = find_label(new->fwc_label)) == NULL)
                        ret = ENOENT;
                else if ((ip_fwkern = convert_ipfw(&new->fwc_rule, &ret))
                         != NULL)
                        ret = append_to_chain(chain, ip_fwkern);
        }
        break;

        case IP_FW_INSERT: {
                struct ip_fwkernel *ip_fwkern;
                struct ip_fwnew *new = m;

                if (len != sizeof(struct ip_fwnew)
                    || !check_label(new->fwn_label))
                        ret = EINVAL;
                else if ((chain = find_label(new->fwn_label)) == NULL)
                        ret = ENOENT;
                else if ((ip_fwkern = convert_ipfw(&new->fwn_rule, &ret))
                         != NULL)
                        ret = insert_in_chain(chain, ip_fwkern,
                                              new->fwn_rulenum);
        }
        break;

        case IP_FW_DELETE: {
                struct ip_fwchange *new = m;
                struct ip_fwkernel *ip_fwkern;

                if (len != sizeof(struct ip_fwchange)
                    || !check_label(new->fwc_label))
                        ret = EINVAL;
                else if ((chain = find_label(new->fwc_label)) == NULL)
                        ret = ENOENT;
                else if ((ip_fwkern = convert_ipfw(&new->fwc_rule, &ret))
                         != NULL) {
                        ret = del_rule_from_chain(chain, ip_fwkern);
                        kfree(ip_fwkern);
                }
        }
        break;

        case IP_FW_DELETE_NUM: {
                struct ip_fwdelnum *new = m;

                if (len != sizeof(struct ip_fwdelnum)
                    || !check_label(new->fwd_label))
                        ret = EINVAL;
                else if ((chain = find_label(new->fwd_label)) == NULL)
                        ret = ENOENT;
                else ret = del_num_from_chain(chain, new->fwd_rulenum);
        }
        break;

        case IP_FW_CREATECHAIN: {
                if (len != sizeof(ip_chainlabel)) {
                        duprintf("create_chain: bad size %i\n", len);
                        ret = EINVAL;
                }
                else ret = create_chain(m);
        }
        break;

        case IP_FW_DELETECHAIN: {
                if (len != sizeof(ip_chainlabel)) {
                        duprintf("delete_chain: bad size %i\n", len);
                        ret = EINVAL;
                }
                else ret = del_chain(m);
        }
        break;

        case IP_FW_POLICY: {
                struct ip_fwpolicy *new = m;

                if (len != sizeof(struct ip_fwpolicy)
                    || !check_label(new->fwp_label))
                        ret = EINVAL;
                else if ((chain = find_label(new->fwp_label)) == NULL)
                        ret = ENOENT;
                else if (chain != IP_FW_INPUT_CHAIN
                         && chain != IP_FW_FORWARD_CHAIN
                         && chain != IP_FW_OUTPUT_CHAIN) {
                        duprintf("change_policy: can't change policy on user"
                                 " defined chain.\n");
                        ret = EINVAL;
                }
                else {
                        int pol = FW_SKIP;
                        find_special(new->fwp_policy, &pol);

                        switch(pol) {
                        case FW_MASQUERADE:
                                if (chain != IP_FW_FORWARD_CHAIN) {
                                        ret = EINVAL;
                                        break;
                                }
                                /* Fall thru... */
                        case FW_BLOCK:
                        case FW_ACCEPT:
                        case FW_REJECT:
                                ret = change_policy(chain, pol);
                                break;
                        default:
                                duprintf("change_policy: bad policy `%s'\n",
                                         new->fwp_policy);
                                ret = EINVAL;
                        }
                }
                break;
        }
        default:
                duprintf("ip_fw_ctl:  unknown request %d\n",cmd);
                ret = ENOPROTOOPT;
        }

        FWC_WRITE_UNLOCK_IRQ(&ip_fw_lock, flags);
        return ret;
}

/* Returns bytes used - doesn't NUL terminate */
static int dump_rule(char *buffer,
                     const char *chainlabel,
                     const struct ip_fwkernel *rule)
{
        int len;
        unsigned int i;
        __u64 packets = 0, bytes = 0;

        FWC_HAVE_LOCK(fwc_wlocks);
        for (i = 0; i < NUM_SLOTS; i++) {
                packets += rule->counters[i].pcnt;
                bytes += rule->counters[i].bcnt;
        }

        len=sprintf(buffer,
                    "%9s "                      /* Chain name */
                    "%08X/%08X->%08X/%08X "     /* Source & Destination IPs */
                    "%.16s "                    /* Interface */
                    "%X %X "                    /* fw_flg and fw_invflg fields */
                    "%u "                       /* Protocol */
                    "%-9u %-9u %-9u %-9u "      /* Packet & byte counters */
                    "%u-%u %u-%u "              /* Source & Dest port ranges */
                    "A%02X X%02X "              /* TOS and and xor masks */
                    "%08X "                     /* Redirection port */
                    "%u "                       /* fw_mark field */
                    "%u "                       /* output size */
                    "%9s\n",                    /* Target */
                    chainlabel,
                    ntohl(rule->ipfw.fw_src.s_addr),
                    ntohl(rule->ipfw.fw_smsk.s_addr),
                    ntohl(rule->ipfw.fw_dst.s_addr),
                    ntohl(rule->ipfw.fw_dmsk.s_addr),
                    (rule->ipfw.fw_vianame)[0] ? rule->ipfw.fw_vianame : "-",
                    rule->ipfw.fw_flg,
                    rule->ipfw.fw_invflg,
                    rule->ipfw.fw_proto,
                    (__u32)(packets >> 32), (__u32)packets,
                    (__u32)(bytes >> 32), (__u32)bytes,
                    rule->ipfw.fw_spts[0], rule->ipfw.fw_spts[1],
                    rule->ipfw.fw_dpts[0], rule->ipfw.fw_dpts[1],
                    rule->ipfw.fw_tosand, rule->ipfw.fw_tosxor,
                    rule->ipfw.fw_redirpt,
                    rule->ipfw.fw_mark,
                    rule->ipfw.fw_outputsize,
                    branchname(rule->branch,rule->simplebranch));

        duprintf("dump_rule: %i bytes done.\n", len);
        return len;
}

/* File offset is actually in records, not bytes. */
static int ip_chain_procinfo(char *buffer, char **start,
                             off_t offset, int length)
{
        struct ip_chain *i;
        struct ip_fwkernel *j = ip_fw_chains->chain;
        unsigned long flags;
        int len = 0;
        int last_len = 0;
        off_t upto = 0;

        duprintf("Offset starts at %lu\n", offset);
        duprintf("ip_fw_chains is 0x%0lX\n", (unsigned long int)ip_fw_chains);

        /* Need a write lock to lock out ``readers'' which update counters. */
        FWC_WRITE_LOCK_IRQ(&ip_fw_lock, flags);

        for (i = ip_fw_chains; i; i = i->next) {
            for (j = i->chain; j; j = j->next) {
                if (upto == offset) break;
                duprintf("Skipping rule in chain `%s'\n",
                         i->label);
                upto++;
            }
            if (upto == offset) break;
        }

        /* Don't init j first time, or once i = NULL */
        for (; i; (void)((i = i->next) && (j = i->chain))) {
                duprintf("Dumping chain `%s'\n", i->label);
                for (; j; j = j->next, upto++, last_len = len)
                {
                        len += dump_rule(buffer+len, i->label, j);
                        if (len > length) {
                                duprintf("Dumped to %i (past %i).  "
                                         "Moving back to %i.\n",
                                         len, length, last_len);
                                len = last_len;
                                goto outside;
                        }
                }
        }
outside:
        FWC_WRITE_UNLOCK_IRQ(&ip_fw_lock, flags);
        buffer[len] = '\0';

        duprintf("ip_chain_procinfo: Length = %i (of %i).  Offset = %li.\n",
                 len, length, upto);
        /* `start' hack - see fs/proc/generic.c line ~165 */
        *start=(char *)((unsigned int)upto-offset);
        return len;
}

static int ip_chain_name_procinfo(char *buffer, char **start,
                                  off_t offset, int length)
{
        struct ip_chain *i;
        int len = 0,last_len = 0;
        off_t pos = 0,begin = 0;
        unsigned long flags;

        /* Need a write lock to lock out ``readers'' which update counters. */
        FWC_WRITE_LOCK_IRQ(&ip_fw_lock, flags);

        for (i = ip_fw_chains; i; i = i->next)
        {
                unsigned int j;
                __u32 packetsHi = 0, packetsLo = 0, bytesHi = 0, bytesLo = 0;

                for (j = 0; j < NUM_SLOTS; j++) {
                        packetsLo += i->reent[j].counters.pcnt & 0xFFFFFFFF;
                        packetsHi += ((i->reent[j].counters.pcnt >> 32)
                                      & 0xFFFFFFFF);
                        bytesLo += i->reent[j].counters.bcnt & 0xFFFFFFFF;
                        bytesHi += ((i->reent[j].counters.bcnt >> 32)
                                    & 0xFFFFFFFF);
                }

                /* print the label and the policy */
                len+=sprintf(buffer+len,"%s %s %i %u %u %u %u\n",
                             i->label,branchname(NULL, i->policy),i->refcount,
                             packetsHi, packetsLo, bytesHi, bytesLo);
                pos=begin+len;
                if(pos<offset) {
                        len=0;
                        begin=pos;
                }
                else if(pos>offset+length) {
                        len = last_len;
                        break;
                }

                last_len = len;
        }
        FWC_WRITE_UNLOCK_IRQ(&ip_fw_lock, flags);

        *start = buffer+(offset-begin);
        len-=(offset-begin);
        if(len>length)
                len=length;
        return len;
}

/*
 *      Interface to the generic firewall chains.
 */
int ipfw_input_check(struct firewall_ops *this, int pf,
                     struct net_device *dev, void *arg,
                     struct sk_buff **pskb)
{
        return ip_fw_check(dev->name,
                           arg, IP_FW_INPUT_CHAIN, pskb, SLOT_NUMBER(), 0);
}

int ipfw_output_check(struct firewall_ops *this, int pf,
                      struct net_device *dev, void *arg,
                      struct sk_buff **pskb)
{
        /* Locally generated bogus packets by root. <SIGH>. */
        if ((*pskb)->len < sizeof(struct iphdr) ||
            (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr))
                return FW_ACCEPT;
        return ip_fw_check(dev->name,
                           arg, IP_FW_OUTPUT_CHAIN, pskb, SLOT_NUMBER(), 0);
}

int ipfw_forward_check(struct firewall_ops *this, int pf,
                       struct net_device *dev, void *arg,
                       struct sk_buff **pskb)
{
        return ip_fw_check(dev->name,
                           arg, IP_FW_FORWARD_CHAIN, pskb, SLOT_NUMBER(), 0);
}

struct firewall_ops ipfw_ops = {
        .fw_forward     =       ipfw_forward_check,
        .fw_input       =       ipfw_input_check,
        .fw_output      =       ipfw_output_check,
};

int ipfw_init_or_cleanup(int init)
{
        struct proc_dir_entry *proc;
        int ret = 0;
        unsigned long flags;

        if (!init) goto cleanup;

#ifdef DEBUG_IP_FIREWALL_LOCKING
        fwc_wlocks = fwc_rlocks = 0;
#endif

#if defined(CONFIG_NETLINK_DEV) || defined(CONFIG_NETLINK_DEV_MODULE)
        ipfwsk = netlink_kernel_create(NETLINK_FIREWALL, NULL);
        if (ipfwsk == NULL)
                goto cleanup_nothing;
#endif

        ret = register_firewall(PF_INET, &ipfw_ops);
        if (ret < 0)
                goto cleanup_netlink;

        proc = proc_net_create(IP_FW_PROC_CHAINS, S_IFREG | S_IRUSR | S_IWUSR,
                               ip_chain_procinfo);
        if (proc) proc->owner = THIS_MODULE;
        proc = proc_net_create(IP_FW_PROC_CHAIN_NAMES,
                               S_IFREG | S_IRUSR | S_IWUSR,
                               ip_chain_name_procinfo);
        if (proc) proc->owner = THIS_MODULE;

        IP_FW_INPUT_CHAIN = ip_init_chain(IP_FW_LABEL_INPUT, 1, FW_ACCEPT);
        IP_FW_FORWARD_CHAIN = ip_init_chain(IP_FW_LABEL_FORWARD, 1, FW_ACCEPT);
        IP_FW_OUTPUT_CHAIN = ip_init_chain(IP_FW_LABEL_OUTPUT, 1, FW_ACCEPT);

        return ret;

 cleanup:
        unregister_firewall(PF_INET, &ipfw_ops);

        FWC_WRITE_LOCK_IRQ(&ip_fw_lock, flags);
        while (ip_fw_chains) {
                struct ip_chain *next = ip_fw_chains->next;

                clear_fw_chain(ip_fw_chains);
                kfree(ip_fw_chains);
                ip_fw_chains = next;
        }
        FWC_WRITE_UNLOCK_IRQ(&ip_fw_lock, flags);

        proc_net_remove(IP_FW_PROC_CHAINS);
        proc_net_remove(IP_FW_PROC_CHAIN_NAMES);

 cleanup_netlink:
#if defined(CONFIG_NETLINK_DEV) || defined(CONFIG_NETLINK_DEV_MODULE)
        sock_release(ipfwsk->sk_socket);

 cleanup_nothing:
#endif
        return ret;
}