luci/contrib/fwd/src/fwd_rules.c

/*
 * fwd - OpenWrt firewall daemon - iptables rule set
 *
 *   Copyright (C) 2009 Jo-Philipp Wich <xm@subsignal.org>
 *
 * The fwd program is free software: you can redistribute it and/or
 * modify it under the terms of the GNU General Public License version 2
 * as published by the Free Software Foundation.
 *
 * The fwd program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with the fwd program. If not, see http://www.gnu.org/licenses/.
 */


#include "fwd.h"
#include "fwd_addr.h"
#include "fwd_rules.h"
#include "fwd_xtables.h"
#include "fwd_utils.h"


/* -P <chain> <policy> */
static void fwd_r_set_policy(
	struct iptc_handle *h, const char *chain, const char *policy
) {
	iptc_set_policy(chain, policy, NULL, h);
}

/* -N <chain> */
static void fwd_r_new_chain(struct iptc_handle *h, const char *chain)
{
	iptc_create_chain(chain, h);
}

/* -A <chain1> -j <chain2> */
static void fwd_r_jump_chain(
	struct iptc_handle *h, const char *chain1, const char *chain2
) {
	struct fwd_xt_rule *r;

	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		fwd_xt_get_target(r, chain2);
		fwd_xt_append_rule(r, chain1);
	}
}

/* -A <chain> -m state --state INVALID -j DROP */
static void fwd_r_drop_invalid(struct iptc_handle *h, const char *chain)
{
	struct fwd_xt_rule *r;
	struct xtables_match *m;

	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		if( (m = fwd_xt_get_match(r, "state")) != NULL )
		{
			fwd_xt_parse_match(r, m, "--state", "INVALID");
			fwd_xt_get_target(r, "DROP");
			fwd_xt_append_rule(r, chain);
		}
	}
}

/* -A <chain> -m state --state RELATED,ESTABLISHED -j ACCEPT */
static void fwd_r_accept_related(struct iptc_handle *h, const char *chain)
{
	struct fwd_xt_rule *r;
	struct xtables_match *m;

	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		if( (m = fwd_xt_get_match(r, "state")) != NULL )
		{
			fwd_xt_parse_match(r, m, "--state", "RELATED,ESTABLISHED");
			fwd_xt_get_target(r, "ACCEPT");
			fwd_xt_append_rule(r, chain);
		}
	}
}

/* -A INPUT -i lo -j ACCEPT; -A OUTPUT -o lo -j ACCEPT */
static void fwd_r_accept_lo(struct iptc_handle *h)
{
	struct fwd_network n;
	struct fwd_xt_rule *r;

	n.ifname = "lo";

	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		fwd_xt_parse_in(r, &n, 0);
		fwd_xt_get_target(r, "ACCEPT");
		fwd_xt_append_rule(r, "INPUT");
	}

	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		fwd_xt_parse_out(r, &n, 0);
		fwd_xt_get_target(r, "ACCEPT");
		fwd_xt_append_rule(r, "OUTPUT");
	}
}

/* build syn_flood chain and jump rule */
static void fwd_r_add_synflood(struct iptc_handle *h, struct fwd_defaults *def)
{
	struct fwd_proto p;
	struct fwd_xt_rule *r;
	struct xtables_match *m;
	char buf[32];

	/* -N syn_flood */
	fwd_r_new_chain(h, "syn_flood");

	/* return rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		/* -p tcp */
		p.type = FWD_PR_TCP;
		fwd_xt_parse_proto(r, &p, 0);

		/* -m tcp --syn */
		if( (m = fwd_xt_get_match(r, "tcp")) != NULL )
		{
			fwd_xt_parse_match(r, m, "--syn");
		}

		/* -m limit --limit x/second --limit-burst y */
		if( (m = fwd_xt_get_match(r, "limit")) != NULL )
		{
			sprintf(buf, "%i/second", def->syn_rate);
			fwd_xt_parse_match(r, m, "--limit", buf);

			sprintf(buf, "%i", def->syn_burst);
			fwd_xt_parse_match(r, m, "--limit-burst", buf);
		}

		/* -j RETURN; -A syn_flood */
		fwd_xt_get_target(r, "RETURN");
		fwd_xt_append_rule(r, "syn_flood");
	}

	/* drop rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{	
		/* -j DROP; -A syn_flood */
		fwd_xt_get_target(r, "DROP");
		fwd_xt_append_rule(r, "syn_flood");
	}

	/* jump to syn_flood rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{	
		/* -p tcp */
		p.type = FWD_PR_TCP;
		fwd_xt_parse_proto(r, &p, 0);

		/* -m tcp --syn */
		if( (m = fwd_xt_get_match(r, "tcp")) != NULL )
		{
			fwd_xt_parse_match(r, m, "--syn");
		}

		/* -j syn_flood; -A INPUT */
		fwd_xt_get_target(r, "syn_flood");
		fwd_xt_append_rule(r, "INPUT");
	}
}

/* build reject target chain */
static void fwd_r_handle_reject(struct iptc_handle *h)
{
	struct fwd_proto p;
	struct fwd_xt_rule *r;
	struct xtables_target *t;

	/* -N handle_reject */
	fwd_r_new_chain(h, "handle_reject");

	/* tcp reject rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		/* -p tcp */
		p.type = FWD_PR_TCP;
		fwd_xt_parse_proto(r, &p, 0);

		/* -j REJECT --reject-with tcp-reset */
		if( (t = fwd_xt_get_target(r, "REJECT")) != NULL )
		{
			fwd_xt_parse_target(r, t, "--reject-with", "tcp-reset");
		}

		/* -A handle_reject */
		fwd_xt_append_rule(r, "handle_reject");
	}

	/* common reject rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		/* -j REJECT --reject-with icmp-port-unreachable */
		if( (t = fwd_xt_get_target(r, "REJECT")) != NULL )
		{
			fwd_xt_parse_target(r, t, "--reject-with",
				"icmp-port-unreachable");
		}

		/* -A handle_reject */
		fwd_xt_append_rule(r, "handle_reject");
	}
}

/* build drop target chain */
static void fwd_r_handle_drop(struct iptc_handle *h)
{
	struct fwd_xt_rule *r;

	/* -N handle_drop */
	fwd_r_new_chain(h, "handle_drop");

	/* common drop rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		/* -j DROP; -A handle_drop */
		fwd_xt_get_target(r, "DROP");
		fwd_xt_append_rule(r, "handle_drop");
	}
}

/* build accept target chain */
static void fwd_r_handle_accept(struct iptc_handle *h)
{
	struct fwd_xt_rule *r;

	/* -N handle_accept */
	fwd_r_new_chain(h, "handle_accept");

	/* common accept rule */
	if( (r = fwd_xt_init_rule(h)) != NULL )
	{
		/* -j ACCEPT; -A handle_accept */
		fwd_xt_get_target(r, "ACCEPT");
		fwd_xt_append_rule(r, "handle_accept");
	}
}

/* add comment match */
static void fwd_r_add_comment(
	struct fwd_xt_rule *r, const char *t, struct fwd_zone *z,
	struct fwd_network *n
) {
	struct xtables_match *m;
	char buf[256];

	if( (m = fwd_xt_get_match(r, "comment")) != NULL )
	{
		snprintf(buf, sizeof(buf), "%s:net=%s zone=%s", t, n->name, z->name);
		fwd_xt_parse_match(r, m, "--comment", buf);
	}
}

/* add --sport (if applicable) */
static void fwd_r_add_sport(
	struct fwd_xt_rule *r, struct fwd_portrange *p
) {
	int proto = r->entry->ip.proto;
	char buf[12];
	struct xtables_match *m;

	/* have portrange and proto is tcp or udp ... */
	if( (p != NULL) && ((proto == 6) || (proto == 17)) )
	{
		/* get match ... */
		if( (m = fwd_xt_get_match(r, (proto == 6) ? "tcp" : "udp")) != NULL )
		{
			snprintf(buf, sizeof(buf), "%u:%u", p->min, p->max);
			fwd_xt_parse_match(r, m, "--sport", buf);
		}
	}
}

/* add --dport (if applicable) */
static void fwd_r_add_dport(
	struct fwd_xt_rule *r, struct fwd_portrange *p
) {
	int proto = r->entry->ip.proto;
	char buf[12];
	struct xtables_match *m;

	/* have portrange and proto is tcp or udp ... */
	if( (p != NULL) && ((proto == 6) || (proto == 17)) )
	{
		/* get match ... */
		if( (m = fwd_xt_get_match(r, (proto == 6) ? "tcp" : "udp")) != NULL )
		{
			snprintf(buf, sizeof(buf), "%u:%u", p->min, p->max);
			fwd_xt_parse_match(r, m, "--dport", buf);
		}
	}
}

/* add --icmp-type (of applicable) */
static void fwd_r_add_icmptype(
	struct fwd_xt_rule *r, struct fwd_icmptype *i
) {
	int proto = r->entry->ip.proto;
	struct xtables_match *m;
	char buf[32];

	/* have icmp-type and proto is icmp ... */
	if( (i != NULL) && (proto == 1) )
	{
		/* get match ... */
		if( (m = fwd_xt_get_match(r, "icmp")) != NULL )
		{
			if( i->name[0] )
				snprintf(buf, sizeof(buf), "%s", i->name);
			else
				snprintf(buf, sizeof(buf), "%u/%u", i->type, i->code);

			fwd_xt_parse_match(r, m, "--icmp-type", buf);
		}
	}
}

/* add -m mac --mac-source ... */
static void fwd_r_add_srcmac(
	struct fwd_xt_rule *r, struct fwd_mac *mac
) {
	struct xtables_match *m;
	char buf[18];

	if( mac != NULL )
	{
		if( (m = fwd_xt_get_match(r, "mac")) != NULL )
		{
			snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
				mac->mac[0], mac->mac[1], mac->mac[2],
				mac->mac[3], mac->mac[4], mac->mac[5]);

			fwd_xt_parse_match(r, m, "--mac-source", buf);
		}
	}
}

/* add policy target */
static void fwd_r_add_policytarget(
	struct fwd_xt_rule *r, enum fwd_policy pol
) {
	switch(pol)
	{
		case FWD_P_ACCEPT:
			fwd_xt_get_target(r, "handle_accept");
			break;

		case FWD_P_REJECT:
			fwd_xt_get_target(r, "handle_reject");
			break;

		case FWD_P_DROP:
		case FWD_P_UNSPEC:
			fwd_xt_get_target(r, "handle_drop");
			break;
	}
}

/* add dnat target */
static void fwd_r_add_dnattarget(
	struct fwd_xt_rule *r, struct fwd_cidr *c, struct fwd_portrange *p
) {
	struct xtables_target *t;
	char buf[32];

	if( c != NULL )
	{
		if( (t = fwd_xt_get_target(r, "DNAT")) != NULL )
		{
			if( p != NULL )
				snprintf(buf, sizeof(buf), "%s:%u-%u",
					inet_ntoa(c->addr), p->min, p->max);
			else
				snprintf(buf, sizeof(buf), "%s", inet_ntoa(c->addr));

			fwd_xt_parse_target(r, t, "--to-destination", buf);
		}
	}
}

/* parse comment string and look for match */
static int fwd_r_cmp(const char *what, const char *cmt, const char *cmp)
{
	char *match;

	if( (match = strstr(cmt, what)) == NULL )
		return 0;

	match += strlen(what);

	if( strncmp(match, cmp, strlen(cmp)) != 0 )
		return 0;

	if( (match[strlen(cmp)] != ' ') && (match[strlen(cmp)] != '\0') )
		return 0;

	return 1;
}


static void fwd_ipt_defaults_create(struct fwd_data *d)
{
	struct fwd_defaults *def = &d->section.defaults;
	struct iptc_handle *h_filter, *h_nat;

	if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
		fwd_fatal("Unable to obtain libiptc handle");

	/* policies */
	fwd_r_set_policy(h_filter, "INPUT",
		def->input == FWD_P_ACCEPT ? "ACCEPT" : "DROP");
	fwd_r_set_policy(h_filter, "OUTPUT",
		def->output == FWD_P_ACCEPT ? "ACCEPT" : "DROP");
	fwd_r_set_policy(h_filter, "FORWARD",
		def->forward == FWD_P_ACCEPT ? "ACCEPT" : "DROP");

	/* invalid state drop */
	if( def->drop_invalid )
	{
		fwd_r_drop_invalid(h_filter, "INPUT");
		fwd_r_drop_invalid(h_filter, "OUTPUT");
		fwd_r_drop_invalid(h_filter, "FORWARD");
	}

	/* default accept related */
	fwd_r_accept_related(h_filter, "INPUT");
	fwd_r_accept_related(h_filter, "OUTPUT");
	fwd_r_accept_related(h_filter, "FORWARD");

	/* default accept on lo */
	fwd_r_accept_lo(h_filter);

	/* syn flood protection */
	if( def->syn_flood )
	{
		fwd_r_add_synflood(h_filter, def);
	}

	/* rule container chains */
	fwd_r_new_chain(h_filter, "mssfix");
	fwd_r_new_chain(h_filter, "zones");
	fwd_r_new_chain(h_filter, "rules");
	fwd_r_new_chain(h_filter, "redirects");
	fwd_r_new_chain(h_filter, "forwardings");
	fwd_r_jump_chain(h_filter, "INPUT", "rules");
	fwd_r_jump_chain(h_filter, "FORWARD", "mssfix");
	fwd_r_jump_chain(h_filter, "FORWARD", "zones");
	fwd_r_jump_chain(h_filter, "FORWARD", "rules");
	fwd_r_jump_chain(h_filter, "FORWARD", "redirects");
	fwd_r_jump_chain(h_filter, "FORWARD", "forwardings");
	fwd_r_new_chain(h_nat, "zonemasq");
	fwd_r_new_chain(h_nat, "redirects");
	fwd_r_new_chain(h_nat, "loopback");
	fwd_r_jump_chain(h_nat, "POSTROUTING", "zonemasq");
	fwd_r_jump_chain(h_nat, "PREROUTING", "redirects");
	fwd_r_jump_chain(h_nat, "POSTROUTING", "loopback");

	/* standard drop, accept, reject chain */
	fwd_r_handle_drop(h_filter);
	fwd_r_handle_accept(h_filter);
	fwd_r_handle_reject(h_filter);


	if( !iptc_commit(h_nat) )
		fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));

	if( !iptc_commit(h_filter) )
		fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));

	iptc_free(h_nat);
	iptc_free(h_filter);
}


void fwd_ipt_build_ruleset(struct fwd_handle *h)
{
	struct fwd_data *e;

	fwd_xt_init();

	for( e = h->conf; e; e = e->next )
	{
		switch(e->type)
		{
			case FWD_S_DEFAULTS:
				fwd_log_info("Loading defaults");
				fwd_ipt_defaults_create(e);
				break;

			case FWD_S_INCLUDE:
				fwd_log_info("Loading include: %s",
					e->section.include.path);
				break;

			case FWD_S_ZONE:
			case FWD_S_FORWARD:
			case FWD_S_REDIRECT:
			case FWD_S_RULE:
				/* Make gcc happy */
				break;
		}
	}
}


static struct fwd_zone *
fwd_lookup_zone(struct fwd_handle *h, const char *net)
{
	struct fwd_data *e;
	struct fwd_network *n;

	for( e = h->conf; e; e = e->next )
		if( e->type == FWD_S_ZONE )
			for( n = e->section.zone.networks; n; n = n->next )
				if( !strcmp(n->name, net) )
					return &e->section.zone;

	return NULL;
}

static struct fwd_network *
fwd_lookup_network(struct fwd_zone *z, const char *net)
{
	struct fwd_network *n;

	for( n = z->networks; n; n = n->next )
		if( !strcmp(n->name, net) )
			return n;

	return NULL;
}

void fwd_ipt_addif(struct fwd_handle *h, const char *net)
{
	struct fwd_data *e;
	struct fwd_zone *z;
	struct fwd_rule *c;
	struct fwd_redirect *r;
	struct fwd_forwarding *f;
	struct fwd_cidr *a, *a2;
	struct fwd_network *n, *n2;
	struct fwd_proto p;

	struct fwd_xt_rule *x;
	struct xtables_match *m;
	struct xtables_target *t;

	struct iptc_handle *h_filter, *h_nat;

	if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
		fwd_fatal("Unable to obtain libiptc handle");


	if( !(z = fwd_lookup_zone(h, net)) )
		return;

	if( !(n = fwd_lookup_network(z, net)) )
		return;

	if( !(a = n->addr) || fwd_empty_cidr(a) )
		return;


	fwd_log_info("Adding network %s (interface %s)",
		n->name, n->ifname);

	/* Build masquerading rule */
	if( z->masq )
	{
		if( (x = fwd_xt_init_rule(h_nat)) != NULL )
		{
			fwd_xt_parse_out(x, n, 0);				/* -o ... */
			fwd_xt_get_target(x, "MASQUERADE");		/* -j MASQUERADE */
			fwd_r_add_comment(x, "masq", z, n);		/* -m comment ... */
			fwd_xt_append_rule(x, "zonemasq");		/* -A zonemasq */
		}
	}

	/* Build MSS fix rule */
	if( z->mtu_fix )
	{
		if( (x = fwd_xt_init_rule(h_filter)) != NULL )
		{
			p.type = FWD_PR_TCP;
			fwd_xt_parse_out(x, n, 0);					/* -o ... */
			fwd_xt_parse_proto(x, &p, 0);				/* -p tcp */

			/* -m tcp --tcp-flags SYN,RST SYN */
			if( (m = fwd_xt_get_match(x, "tcp")) != NULL )
				fwd_xt_parse_match(x, m, "--tcp-flags", "SYN,RST", "SYN");

			/* -j TCPMSS --clamp-mss-to-pmtu */
			if( (t = fwd_xt_get_target(x, "TCPMSS")) != NULL )
				fwd_xt_parse_target(x, t, "--clamp-mss-to-pmtu");

			/* -m comment ... */
			fwd_r_add_comment(x, "mssfix", z, n);

			/* -A mssfix */
			fwd_xt_append_rule(x, "mssfix");
		}
	}

	/* Build intra-zone forwarding rules */
	for( n2 = z->networks; n2; n2 = n2->next )
	{
		if( (a2 = n2->addr) != NULL )
		{
			if( (x = fwd_xt_init_rule(h_filter)) != NULL )
			{
				fwd_xt_parse_in(x, n, 0);				/* -i ... */
				fwd_xt_parse_out(x, n2, 0);				/* -o ... */
				fwd_r_add_policytarget(x, z->forward);	/* -j handle_... */
				fwd_r_add_comment(x, "zone", z, n);		/* -m comment ... */
				fwd_xt_append_rule(x, "zones");			/* -A zones */
			}
		}
	}

	/* Build inter-zone forwarding rules */
	for( e = z->forwardings; e && (f = &e->section.forwarding); e = e->next )
	{
		for( n2 = f->dest->networks; n2; n2 = n2->next )
		{
			/* Build forwarding rule */
			if( (x = fwd_xt_init_rule(h_filter)) != NULL )
			{
				fwd_xt_parse_in(x, n, 0);					/* -i ... */
				fwd_xt_parse_out(x, n2, 0);					/* -o ... */
				fwd_r_add_policytarget(x, FWD_P_ACCEPT);	/* -j handle_... */
				fwd_r_add_comment(x, "forward", z, n);		/* -m comment ... */
				fwd_xt_append_rule(x, "forwardings");		/* -A forwardings */
			}
		}
	}

	/* Build DNAT rules */
	for( e = z->redirects; e && (r = &e->section.redirect); e = e->next )
	{
		/* DNAT */
		if( (x = fwd_xt_init_rule(h_nat)) != NULL )
		{
			fwd_xt_parse_in(x, n, 0);					/* -i ... */
			fwd_xt_parse_src(x, r->src_ip, 0);			/* -s ... */
			fwd_xt_parse_dest(x, a, 0);					/* -d ... */
			fwd_xt_parse_proto(x, r->proto, 0);			/* -p ... */
			fwd_r_add_sport(x, r->src_port);			/* --sport ... */
			fwd_r_add_dport(x, r->src_dport);			/* --dport ... */
			fwd_r_add_srcmac(x, r->src_mac);			/* -m mac --mac-source ... */
			fwd_r_add_dnattarget(x, r->dest_ip, r->dest_port);	/* -j DNAT ... */
			fwd_r_add_comment(x, "redir", z, n);		/* -m comment ... */
			fwd_xt_append_rule(x, "redirects");			/* -A redirects */
		}

		/* Forward */
		if( (x = fwd_xt_init_rule(h_filter)) != NULL )
		{
			fwd_xt_parse_in(x, n, 0);					/* -i ... */
			fwd_xt_parse_src(x, r->src_ip, 0);			/* -s ... */
			fwd_xt_parse_dest(x, r->dest_ip, 0);		/* -d ... */
			fwd_xt_parse_proto(x, r->proto, 0);			/* -p ... */
			fwd_r_add_srcmac(x, r->src_mac);			/* -m mac --mac-source ... */
			fwd_r_add_sport(x, r->src_port);			/* --sport ... */
			fwd_r_add_dport(x, r->dest_port);			/* --dport ... */
			fwd_r_add_policytarget(x, FWD_P_ACCEPT);	/* -j handle_accept */
			fwd_r_add_comment(x, "redir", z, n);		/* -m comment ... */
			fwd_xt_append_rule(x, "redirects");			/* -A redirects */
		}

		/* Add loopback rule if neither src_ip nor src_mac are defined */
		if( !r->src_ip && !r->src_mac )
		{
			if( (x = fwd_xt_init_rule(h_nat)) != NULL )
			{
				fwd_xt_parse_in(x, n, 1);				/* -i ! ... */
				fwd_xt_parse_dest(x, r->dest_ip, 0);	/* -d ... */
				fwd_xt_parse_proto(x, r->proto, 0);		/* -p ... */
				fwd_r_add_sport(x, r->src_port);		/* --sport ... */
				fwd_r_add_dport(x, r->src_dport);		/* --dport ... */
				fwd_xt_get_target(x, "MASQUERADE");		/* -j MASQUERADE */
				fwd_r_add_comment(x, "redir", z, n);	/* -m comment ... */
				fwd_xt_append_rule(x, "loopback");		/* -A loopback */
			}
		}
	}

	/* Build rules */
	for( e = z->rules; e && (c = &e->section.rule); e = e->next )
	{
		/* Has destination, add forward rule for each network in target zone */
		if( c->dest )
		{
			for( n2 = c->dest->networks; n2; n2 = n2->next )
			{
				if( (x = fwd_xt_init_rule(h_filter)) != NULL )
				{
					fwd_xt_parse_in(x, n, 0);				/* -i ... */
					fwd_xt_parse_out(x, n2, 0);				/* -o ... */
					fwd_xt_parse_src(x, c->src_ip, 0);		/* -s ... */
					fwd_xt_parse_dest(x, c->dest_ip, 0);	/* -d ... */
					fwd_xt_parse_proto(x, c->proto, 0);		/* -p ... */
					fwd_r_add_icmptype(x, c->icmp_type);	/* --icmp-type ... */
					fwd_r_add_srcmac(x, c->src_mac);		/* --mac-source ... */
					fwd_r_add_sport(x, c->src_port);		/* --sport ... */
					fwd_r_add_dport(x, c->dest_port);		/* --dport ... */
					fwd_r_add_policytarget(x, c->target);	/* -j handle_... */
					fwd_r_add_comment(x, "rule", z, n);		/* -m comment ... */
					fwd_xt_append_rule(x, "rules");			/* -A rules */
				}
			}
		}

		/* No destination specified, treat it as input rule */
		else
		{
			if( (x = fwd_xt_init_rule(h_filter)) != NULL )
			{
				fwd_xt_parse_in(x, n, 0);				/* -i ... */
				fwd_xt_parse_src(x, c->src_ip, 0);		/* -s ... */
				fwd_xt_parse_dest(x, c->dest_ip, 0);	/* -d ... */
				fwd_xt_parse_proto(x, c->proto, 0);		/* -p ... */
				fwd_r_add_icmptype(x, c->icmp_type);	/* --icmp-type ... */
				fwd_r_add_srcmac(x, c->src_mac);		/* --mac-source ... */
				fwd_r_add_sport(x, c->src_port);		/* --sport ... */
				fwd_r_add_dport(x, c->dest_port);		/* --dport ... */
				fwd_r_add_policytarget(x, c->target);	/* -j handle_... */
				fwd_r_add_comment(x, "rule", z, n);		/* -m comment ... */
				fwd_xt_append_rule(x, "rules");			/* -A rules */
			}
		}
	}

	if( !iptc_commit(h_nat) )
		fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));

	if( !iptc_commit(h_filter) )
		fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));

	iptc_free(h_nat);
	iptc_free(h_filter);
}


static void fwd_ipt_delif_table(struct iptc_handle *h, const char *net)
{
	const struct xt_entry_match *m;
	const struct ipt_entry *e;
	const char *chain, *comment;
	size_t off = 0, num = 0;

	/* iterate chains */
	for( chain = iptc_first_chain(h); chain;
	     chain = iptc_next_chain(h)
	) {
		/* iterate rules */
		for( e = iptc_first_rule(chain, h), num = 0; e;
		     e = iptc_next_rule(e, h), num++
		) {
			repeat_rule:

			/* skip entries w/o matches */
			if( ! e->target_offset )
				continue;

			/* iterate matches */
			for( off = sizeof(struct ipt_entry);
			     off < e->target_offset;
			     off += m->u.match_size
			) {
				m = (void *)e + off;

				/* yay */
				if( ! strcmp(m->u.user.name, "comment") )
				{
					/* better use struct_xt_comment_info but well... */
					comment = (void *)m + sizeof(struct xt_entry_match);

					if( fwd_r_cmp("net=", comment, net) )
					{
						e = iptc_next_rule(e, h);
						iptc_delete_num_entry(chain, num, h);

						if( e != NULL )
							goto repeat_rule;
						else
							break;
					}
				}
			}
		}
	}
}

void fwd_ipt_delif(struct fwd_handle *h, const char *net)
{
	struct iptc_handle *h_filter, *h_nat;

	if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
		fwd_fatal("Unable to obtain libiptc handle");


	fwd_log_info("Removing network %s", net);

	/* delete network related rules */
	fwd_ipt_delif_table(h_nat, net);
	fwd_ipt_delif_table(h_filter, net);


	if( !iptc_commit(h_nat) )
		fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));

	if( !iptc_commit(h_filter) )
		fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));

	iptc_free(h_nat);
	iptc_free(h_filter);
}

void fwd_ipt_chgif(struct fwd_handle *h, const char *net)
{
	/* XXX: should alter rules in-place, tbd */
	fwd_ipt_delif(h, net);
	fwd_ipt_addif(h, net);
}


static void fwd_ipt_clear_ruleset_table(struct iptc_handle *h)
{
	const char *chain;

	/* pass 1: flush all chains */
	for( chain = iptc_first_chain(h); chain;
	     chain = iptc_next_chain(h)
	) {
		iptc_flush_entries(chain, h);
	}

	/* pass 2: remove user defined chains */
	for( chain = iptc_first_chain(h); chain;
	     chain = iptc_next_chain(h)
	) {
		if( ! iptc_builtin(chain, h) )
			iptc_delete_chain(chain, h);
	}
}

void fwd_ipt_clear_ruleset(struct fwd_handle *h)
{
	struct iptc_handle *h_filter, *h_nat;

	if( !(h_filter = iptc_init("filter")) || !(h_nat = iptc_init("nat")) )
		fwd_fatal("Unable to obtain libiptc handle");

	/* flush tables */
	fwd_ipt_clear_ruleset_table(h_nat);
	fwd_ipt_clear_ruleset_table(h_filter);

	/* revert policies */
	fwd_r_set_policy(h_filter, "INPUT", "ACCEPT");
	fwd_r_set_policy(h_filter, "OUTPUT", "ACCEPT");
	fwd_r_set_policy(h_filter, "FORWARD", "ACCEPT");	


	if( !iptc_commit(h_nat) )
		fwd_fatal("Cannot commit nat table: %s", iptc_strerror(errno));

	if( !iptc_commit(h_filter) )
		fwd_fatal("Cannot commit filter table: %s", iptc_strerror(errno));

	iptc_free(h_nat);
	iptc_free(h_filter);
}