/*
 * Copyright (c) 1993 Daniel Boulet
 * Copyright (c) 1994 Ugen J.S.Antsilevich
 * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
 * Copyright (c) 2014 - 2018 The DragonFly Project.  All rights reserved.
 *
 * This code is derived from software contributed to The DragonFly Project
 * by Bill Yuan <bycn82@dragonflybsd.org>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 3. Neither the name of The DragonFly Project nor the names of its
 *    contributors may be used to endorse or promote products derived
 *    from this software without specific, prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 */

#include "opt_ipfw.h"
#include "opt_inet.h"
#ifndef INET
#error IPFIREWALL3 requires INET.
#endif /* INET */

#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/socketvar.h>
#include <sys/sysctl.h>
#include <sys/systimer.h>
#include <sys/in_cksum.h>
#include <sys/systm.h>
#include <sys/proc.h>
#include <sys/socket.h>
#include <sys/syslog.h>
#include <sys/ucred.h>
#include <sys/lock.h>

#include <net/if.h>
#include <net/radix.h>
#include <net/route.h>
#include <net/pfil.h>
#include <net/netmsg2.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/in_var.h>
#include <netinet/in_pcb.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/ip_icmp.h>
#include <netinet/tcp.h>
#include <netinet/tcp_timer.h>
#include <netinet/tcp_var.h>
#include <netinet/tcpip.h>
#include <netinet/udp.h>
#include <netinet/udp_var.h>
#include <netinet/ip_divert.h>
#include <netinet/if_ether.h>

#include <net/ipfw3/ip_fw.h>
#include <net/ipfw3/ip_fw3_set.h>
#include <net/ipfw3_basic/ip_fw3_log.h>
#include <net/ipfw3_basic/ip_fw3_table.h>
#include <net/ipfw3_basic/ip_fw3_sync.h>
#include <net/ipfw3_basic/ip_fw3_basic.h>
#include <net/ipfw3_basic/ip_fw3_state.h>
#include <net/ipfw3_nat/ip_fw3_nat.h>
#include <net/dummynet3/ip_dummynet3.h>

MALLOC_DEFINE(M_IPFW3, "IPFW3", "ipfw3 module");

#define MAX_MODULE		10
#define MAX_OPCODE_PER_MODULE	100

#define IPFW_AUTOINC_STEP_MIN	1
#define IPFW_AUTOINC_STEP_MAX	1000
#define IPFW_AUTOINC_STEP_DEF	100


struct netmsg_ipfw {
	struct netmsg_base base;
	const struct ipfw_ioc_rule *ioc_rule;
	struct ip_fw	*rule;
	struct ip_fw	*next_rule;
	struct ip_fw	*prev_rule;
	struct ip_fw	*sibling;	/* sibling in prevous CPU */
};

struct netmsg_del {
	struct netmsg_base base;
	struct ip_fw	*rule;
	struct ip_fw	*start_rule;
	struct ip_fw	*prev_rule;
	struct ipfw_ioc_state *ioc_state;
	uint16_t	rulenum;
	uint8_t		set_from;
	uint8_t		set_to;
	int		kill_default;
};

struct netmsg_zent {
	struct netmsg_base base;
	struct ip_fw	*start_rule;
	uint16_t	rulenum;
	uint16_t	log_only;
};

ip_fw_ctl_t	*ip_fw3_ctl_nat_ptr = NULL;
ip_fw_ctl_t	*ip_fw3_ctl_state_ptr = NULL;
ip_fw_ctl_t	*ip_fw3_ctl_table_ptr = NULL;
ip_fw_ctl_t	*ip_fw3_ctl_sync_ptr = NULL;
ip_fw_log_t	*ip_fw3_log_ptr = NULL;

extern int ip_fw_loaded;
extern struct ipfw3_state_context 	*fw3_state_ctx[MAXCPU];
int 			sysctl_var_fw3_enable = 1;
int 			sysctl_var_fw3_one_pass = 1;
int 			sysctl_var_fw3_verbose = 0;
static int 		sysctl_var_fw3_flushing;
static int 		sysctl_var_fw3_debug;
static int 		sysctl_var_autoinc_step = IPFW_AUTOINC_STEP_DEF;

int	ip_fw3_sysctl_enable(SYSCTL_HANDLER_ARGS);
int	ip_fw3_sysctl_autoinc_step(SYSCTL_HANDLER_ARGS);

SYSCTL_NODE(_net_inet_ip, OID_AUTO, fw3, CTLFLAG_RW, 0, "Firewall");
SYSCTL_PROC(_net_inet_ip_fw3, OID_AUTO, enable, CTLTYPE_INT | CTLFLAG_RW,
	&sysctl_var_fw3_enable, 0, ip_fw3_sysctl_enable, "I", "Enable ipfw");
SYSCTL_PROC(_net_inet_ip_fw3, OID_AUTO, sysctl_var_autoinc_step,
	CTLTYPE_INT | CTLFLAG_RW, &sysctl_var_autoinc_step, 0,
	ip_fw3_sysctl_autoinc_step, "I", "Rule number autincrement step");
SYSCTL_INT(_net_inet_ip_fw3, OID_AUTO,one_pass,CTLFLAG_RW,
	&sysctl_var_fw3_one_pass, 0,
	"Only do a single pass through ipfw3 when using dummynet(4)");
SYSCTL_INT(_net_inet_ip_fw3, OID_AUTO, debug, CTLFLAG_RW,
	&sysctl_var_fw3_debug, 0, "Enable printing of debug ip_fw statements");
SYSCTL_INT(_net_inet_ip_fw3, OID_AUTO, verbose, CTLFLAG_RW,
	&sysctl_var_fw3_verbose, 0, "Log matches to ipfw3 rules");


filter_func 			filter_funcs[MAX_MODULE][MAX_OPCODE_PER_MODULE];
struct ipfw3_module 		fw3_modules[MAX_MODULE];
struct ipfw3_context 		*fw3_ctx[MAXCPU];
struct ipfw3_sync_context 	fw3_sync_ctx;


void
ip_fw3_register_module(int module_id,char *module_name)
{
	struct ipfw3_module *tmp;
	int i;

	tmp = fw3_modules;
	for (i=0; i < MAX_MODULE; i++) {
		if (tmp->type == 0) {
			tmp->type = 1;
			tmp->id = module_id;
			strncpy(tmp->name, module_name, strlen(module_name));
			break;
		}
		tmp++;
	}
	kprintf("ipfw3 module %s loaded\n", module_name);
}

int
ip_fw3_unregister_module(int module_id)
{
	struct ipfw3_module *tmp;
	struct ip_fw *fw;
	ipfw_insn *cmd;
	int i, len, cmdlen, found;

	found = 0;
	tmp = fw3_modules;
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	fw = ctx->rules;
	for (; fw; fw = fw->next) {
		for (len = fw->cmd_len, cmd = fw->cmd; len > 0;
			len -= cmdlen,
			cmd = (ipfw_insn *)((uint32_t *)cmd + cmdlen)) {
			cmdlen = F_LEN(cmd);
			if (cmd->module == 0 &&
				(cmd->opcode == 0 || cmd->opcode == 1)) {
				//action accept or deny
			} else if (cmd->module == module_id) {
				found = 1;
				goto decide;
			}
		}
	}
decide:
	if (found) {
		return 1;
	} else {
		for (i = 0; i < MAX_MODULE; i++) {
			if (tmp->type == 1 && tmp->id == module_id) {
				tmp->type = 0;
				kprintf("ipfw3 module %s unloaded\n",
						tmp->name);
				break;
			}
			tmp++;
		}

		for (i = 0; i < MAX_OPCODE_PER_MODULE; i++) {
			if (module_id == 0) {
				if (i ==0 || i == 1) {
					continue;
				}
			}
			filter_funcs[module_id][i] = NULL;
		}
		return 0;
	}
}

void
ip_fw3_register_filter_funcs(int module, int opcode, filter_func func)
{
	filter_funcs[module][opcode] = func;
}

void
check_accept(int *cmd_ctl, int *cmd_val, struct ip_fw_args **args,
		struct ip_fw **f, ipfw_insn *cmd, uint16_t ip_len)
{
	*cmd_val = IP_FW_PASS;
	*cmd_ctl = IP_FW_CTL_DONE;
	if (cmd->arg3 && ip_fw3_log_ptr != NULL) {
		ip_fw3_log_ptr((*args)->m, (*args)->eh, cmd->arg1);
	}
}

void
check_deny(int *cmd_ctl, int *cmd_val, struct ip_fw_args **args,
		struct ip_fw **f, ipfw_insn *cmd, uint16_t ip_len)
{
	*cmd_val = IP_FW_DENY;
	*cmd_ctl = IP_FW_CTL_DONE;
	if (cmd->arg3 && ip_fw3_log_ptr != NULL) {
		ip_fw3_log_ptr((*args)->m, (*args)->eh, cmd->arg1);
	}
}

void
init_module(void)
{
	memset(fw3_modules, 0, sizeof(struct ipfw3_module) * MAX_MODULE);
	memset(filter_funcs, 0, sizeof(filter_func) *
			MAX_OPCODE_PER_MODULE * MAX_MODULE);
	ip_fw3_register_filter_funcs(0, O_BASIC_ACCEPT,
			(filter_func)check_accept);
	ip_fw3_register_filter_funcs(0, O_BASIC_DENY, (filter_func)check_deny);
}

int
ip_fw3_free_rule(struct ip_fw *rule)
{
	kfree(rule, M_IPFW3);
	rule = NULL;
	return 1;
}

static struct ip_fw *
lookup_next_rule(struct ip_fw *me)
{
	struct ip_fw *rule = NULL;
	ipfw_insn *cmd;

	/* look for action, in case it is a skipto */
	cmd = ACTION_PTR(me);
	if ((int)cmd->module == MODULE_BASIC_ID &&
		(int)cmd->opcode == O_BASIC_SKIPTO) {
		for (rule = me->next; rule; rule = rule->next) {
			if (rule->rulenum >= cmd->arg1)
				break;
		}
	}
	if (rule == NULL) {	/* failure or not a skipto */
		rule = me->next;
	}
	me->next_rule = rule;
	return rule;
}

/*
 * rules are stored in ctx->ipfw_rule_chain.
 * and each rule is combination of multiple cmds.(ipfw_insn)
 * in each rule, it begin with filter cmds. and end with action cmds.
 * 'outer/inner loop' are looping the rules/cmds.
 * it will invoke the cmds relatived function according to the cmd's
 * module id and opcode id. and process according to return value.
 */
int
ip_fw3_chk(struct ip_fw_args *args)
{
	struct tcphdr *tcp;
	struct udphdr *udp;
	struct icmp *icmp;

	struct mbuf *m = args->m;
	struct ip *ip = mtod(m, struct ip *);
	struct ip_fw *f = NULL;		/* matching rule */
	int cmd_val = IP_FW_PASS;
	struct m_tag *mtag;
	struct divert_info *divinfo;

	/*
	 * hlen	The length of the IPv4 header.
	 *	hlen >0 means we have an IPv4 packet.
	 */
	u_int hlen = 0;		/* hlen >0 means we have an IP pkt */

	/*
	 * offset	The offset of a fragment. offset != 0 means that
	 *	we have a fragment at this offset of an IPv4 packet.
	 *	offset == 0 means that (if this is an IPv4 packet)
	 *	this is the first or only fragment.
	 */
	u_short offset = 0;

	uint8_t proto;
	uint16_t src_port = 0, dst_port = 0;	/* NOTE: host format	*/
	struct in_addr src_ip, dst_ip;		/* NOTE: network format	*/
	uint16_t ip_len = 0;
	uint8_t prev_module = -1, prev_opcode = -1; /* previous module & opcode */
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];

	if (m->m_pkthdr.fw_flags & IPFW_MBUF_GENERATED)
		return IP_FW_PASS;	/* accept */

	if (args->eh == NULL ||		/* layer 3 packet */
		(m->m_pkthdr.len >= sizeof(struct ip) &&
		 ntohs(args->eh->ether_type) == ETHERTYPE_IP))
		hlen = ip->ip_hl << 2;

	/*
	 * Collect parameters into local variables for faster matching.
	 */
	if (hlen == 0) {	/* do not grab addresses for non-ip pkts */
		proto = args->f_id.proto = 0;	/* mark f_id invalid */
		goto after_ip_checks;
	}

	proto = args->f_id.proto = ip->ip_p;
	src_ip = ip->ip_src;
	dst_ip = ip->ip_dst;
	offset = ntohs(ip->ip_off) & IP_OFFMASK;
	ip_len = ntohs(ip->ip_len);

#define PULLUP_TO(len)					\
do {							\
	if (m->m_len < (len)) {				\
		args->m = m = m_pullup(m, (len));	\
			if (m == NULL)			\
				goto pullup_failed;	\
		ip = mtod(m, struct ip *);		\
	}						\
} while (0)

	if (offset == 0) {
		switch (proto) {
			case IPPROTO_TCP:
				PULLUP_TO(hlen + sizeof(struct tcphdr));
				tcp = L3HDR(struct tcphdr, ip);
				dst_port = tcp->th_dport;
				src_port = tcp->th_sport;
				args->f_id.flags = tcp->th_flags;
				break;
			case IPPROTO_UDP:
				PULLUP_TO(hlen + sizeof(struct udphdr));
				udp = L3HDR(struct udphdr, ip);
				dst_port = udp->uh_dport;
				src_port = udp->uh_sport;
				break;
			case IPPROTO_ICMP:
				PULLUP_TO(hlen + 4);
				icmp = L3HDR(struct icmp, ip);
  				args->f_id.flags = icmp->icmp_type;
				dst_port = icmp->icmp_id;
				src_port = dst_port;
				break;
			default:
				break;
		}
	}

#undef PULLUP_TO

	args->f_id.src_ip = ntohl(src_ip.s_addr);
	args->f_id.dst_ip = ntohl(dst_ip.s_addr);
	args->f_id.src_port = src_port = ntohs(src_port);
	args->f_id.dst_port = dst_port = ntohs(dst_port);

after_ip_checks:
	if (args->rule) {
		/*
		 * Packet has already been tagged. Look for the next rule
		 * to restart processing.
		 *
		 * If sysctl_var_fw3_one_pass != 0 then just accept it.
		 * XXX should not happen here, but optimized out in
		 * the caller.
		 */
		if (sysctl_var_fw3_one_pass)
			return IP_FW_PASS;

		/* This rule is being/has been flushed */
		if (sysctl_var_fw3_flushing)
			return IP_FW_DENY;

		f = args->rule->next_rule;
		if (f == NULL)
			f = lookup_next_rule(args->rule);
	} else {
		/*
		 * Find the starting rule. It can be either the first
		 * one, or the one after divert_rule if asked so.
		 */
		int skipto;

		mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL);
		if (mtag != NULL) {
			divinfo = m_tag_data(mtag);
			skipto = divinfo->skipto;
		} else {
			skipto = 0;
		}

		f = ctx->rules;
		if (args->eh == NULL && skipto != 0) {
			/* No skipto during rule flushing */
			if (sysctl_var_fw3_flushing) {
				return IP_FW_DENY;
			}
			if (skipto >= IPFW_DEFAULT_RULE) {
				return IP_FW_DENY; /* invalid */
			}
			while (f && f->rulenum <= skipto) {
				f = f->next;
			}
			if (f == NULL) {	/* drop packet */
				return IP_FW_DENY;
			}
		} else if (sysctl_var_fw3_flushing) {
			/* Rules are being flushed; skip to default rule */
			f = ctx->default_rule;
		}
	}
	if ((mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL)) != NULL) {
		m_tag_delete(m, mtag);
	}

	/*
	 * Now scan the rules, and parse microinstructions for each rule.
	 */
	int prev_val;	/*  previous result of 'or' filter */
	int l, cmdlen;
	ipfw_insn *cmd;
	int cmd_ctl;
	/* foreach rule in chain */
	for (; f; f = f->next) {
again:  /* check the rule again*/
		if (ctx->sets & (1 << f->set)) {
			continue;
		}

		prev_val = -1;
		 /* foreach cmd in rule */
		for (l = f->cmd_len, cmd = f->cmd; l > 0; l -= cmdlen,
			cmd = (ipfw_insn *)((uint32_t *)cmd+ cmdlen)) {
			cmdlen = F_LEN(cmd);

			/* skip 'or' filter when already match */
			if (cmd->len & F_OR &&
				cmd->module == prev_module &&
				cmd->opcode == prev_opcode &&
				prev_val == 1) {
				goto next_cmd;
			}

check_body: /* check the body of the rule again.*/
			(filter_funcs[cmd->module][cmd->opcode])
				(&cmd_ctl, &cmd_val, &args, &f, cmd, ip_len);
			switch(cmd_ctl) {
				case IP_FW_CTL_DONE:
					if (prev_val == 0) /* but 'or' failed */
						goto next_rule;
					goto done;
				case IP_FW_CTL_AGAIN:
					goto again;
				case IP_FW_CTL_NEXT:
					goto next_rule;
				case IP_FW_CTL_NAT:
					args->rule=f;
					goto done;
				case IP_FW_CTL_CHK_STATE:
					/* update the cmd and l */
					cmd = ACTION_PTR(f);
					l = f->cmd_len - f->act_ofs;
					goto check_body;
			}
			if (cmd->len & F_NOT)
				cmd_val= !cmd_val;

			if (cmd->len & F_OR) {	/* has 'or' */
				if (!cmd_val) {	/* not matched */
					if(prev_val == -1){	/* first 'or' */
						prev_val = 0;
						prev_module = cmd->module;
						prev_opcode = cmd->opcode;
					} else if (prev_module == cmd->module &&
						prev_opcode == cmd->opcode) {
						/* continuous 'or' filter */
					} else if (prev_module != cmd->module ||
						prev_opcode != cmd->opcode) {
						/* 'or' filter changed */
						if(prev_val == 0){
							goto next_rule;
						} else {
							prev_val = 0;
							prev_module = cmd->module;
							prev_opcode = cmd->opcode;
						}
					}
				} else { /* has 'or' and matched */
					prev_val = 1;
					prev_module = cmd->module;
					prev_opcode = cmd->opcode;
				}
			} else { /* no or */
				if (!cmd_val) {	/* not matched */
					goto next_rule;
				} else {
					if (prev_val == 0) {
						/* previous 'or' not matched */
						goto next_rule;
					} else {
						prev_val = -1;
					}
				}
			}
next_cmd:;
		}	/* end of inner for, scan opcodes */
next_rule:;		/* try next rule		*/
	}		/* end of outer for, scan rules */
	kprintf("+++ ipfw: ouch!, skip past end of rules, denying packet\n");
	return IP_FW_DENY;

done:
	/* Update statistics */
	f->pcnt++;
	f->bcnt += ip_len;
	f->timestamp = time_second;
	return cmd_val;

pullup_failed:
	if (sysctl_var_fw3_verbose)
		kprintf("pullup failed\n");
	return IP_FW_DENY;
}

struct mbuf *
ip_fw3_dummynet_io(struct mbuf *m, int pipe_nr, int dir, struct ip_fw_args *fwa)
{
	struct m_tag *mtag;
	struct dn_pkt *pkt;
	ipfw_insn *cmd;
	const struct ipfw_flow_id *id;
	struct dn_flow_id *fid;

	M_ASSERTPKTHDR(m);

	mtag = m_tag_get(PACKET_TAG_DUMMYNET, sizeof(*pkt),
	    M_INTWAIT | M_NULLOK);
	if (mtag == NULL) {
		m_freem(m);
		return (NULL);
	}
	m_tag_prepend(m, mtag);

	pkt = m_tag_data(mtag);
	bzero(pkt, sizeof(*pkt));

	cmd = (ipfw_insn *)((uint32_t *)fwa->rule->cmd + fwa->rule->act_ofs);
	KASSERT(cmd->opcode == O_DUMMYNET_PIPE ||
			cmd->opcode == O_DUMMYNET_QUEUE,
			("Rule is not PIPE or QUEUE, opcode %d", cmd->opcode));

	pkt->dn_m = m;
	pkt->dn_flags = (dir & DN_FLAGS_DIR_MASK);
	pkt->ifp = fwa->oif;
	pkt->pipe_nr = pipe_nr;

	pkt->cpuid = mycpuid;
	pkt->msgport = netisr_curport();

	id = &fwa->f_id;
	fid = &pkt->id;
	fid->fid_dst_ip = id->dst_ip;
	fid->fid_src_ip = id->src_ip;
	fid->fid_dst_port = id->dst_port;
	fid->fid_src_port = id->src_port;
	fid->fid_proto = id->proto;
	fid->fid_flags = id->flags;

	pkt->dn_priv = fwa->rule;

	if ((int)cmd->opcode == O_DUMMYNET_PIPE)
		pkt->dn_flags |= DN_FLAGS_IS_PIPE;

	m->m_pkthdr.fw_flags |= DUMMYNET_MBUF_TAGGED;
	return (m);
}


void
add_rule_dispatch(netmsg_t nmsg)
{
	struct netmsg_ipfw *fwmsg = (struct netmsg_ipfw *)nmsg;
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	struct ip_fw *rule, *prev,*next;
	const struct ipfw_ioc_rule *ioc_rule;

	ioc_rule = fwmsg->ioc_rule;
	 // create rule by ioc_rule
	rule = kmalloc(RULESIZE(ioc_rule), M_IPFW3, M_WAITOK | M_ZERO);
	rule->act_ofs = ioc_rule->act_ofs;
	rule->cmd_len = ioc_rule->cmd_len;
	rule->rulenum = ioc_rule->rulenum;
	rule->set = ioc_rule->set;
	bcopy(ioc_rule->cmd, rule->cmd, rule->cmd_len * 4);

	for (prev = NULL, next = ctx->rules;
		next; prev = next, next = next->next) {
		if (ioc_rule->insert) {
			if (next->rulenum >= ioc_rule->rulenum) {
				break;
			}
		} else {
			if (next->rulenum > ioc_rule->rulenum) {
				break;
			}
		}
	}
	KASSERT(next != NULL, ("no default rule?!"));

	/*
	 * Insert rule into the pre-determined position
	 */
	if (prev != NULL) {
		rule->next = next;
		prev->next = rule;
	} else {
		rule->next = ctx->rules;
		ctx->rules = rule;
	}

	/*
	 * if sibiling in last CPU is exists,
	 * then it's sibling should be current rule
	 */
	if (fwmsg->sibling != NULL) {
		fwmsg->sibling->sibling = rule;
	}
	/* prepare for next CPU */
	fwmsg->sibling = rule;

	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
}

/*
 * confirm the rulenumber
 * call dispatch function to add rule into the list
 * Update the statistic
 */
void
ip_fw3_add_rule(struct ipfw_ioc_rule *ioc_rule)
{
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	struct netmsg_ipfw fwmsg;
	struct netmsg_base *nmsg;
	struct ip_fw *f;

	IPFW_ASSERT_CFGPORT(&curthread->td_msgport);

	/*
	 * If rulenum is 0, find highest numbered rule before the
	 * default rule, and add rule number incremental step.
	 */
	if (ioc_rule->rulenum == 0) {
		int step = sysctl_var_autoinc_step;

		KKASSERT(step >= IPFW_AUTOINC_STEP_MIN &&
				step <= IPFW_AUTOINC_STEP_MAX);

		/*
		 * Locate the highest numbered rule before default
		 */
		for (f = ctx->rules; f; f = f->next) {
			if (f->rulenum == IPFW_DEFAULT_RULE)
				break;
			ioc_rule->rulenum = f->rulenum;
		}
		if (ioc_rule->rulenum < IPFW_DEFAULT_RULE - step)
			ioc_rule->rulenum += step;
	}
	KASSERT(ioc_rule->rulenum != IPFW_DEFAULT_RULE &&
			ioc_rule->rulenum != 0,
			("invalid rule num %d", ioc_rule->rulenum));

	bzero(&fwmsg, sizeof(fwmsg));
	nmsg = &fwmsg.base;
	netmsg_init(nmsg, NULL, &curthread->td_msgport,
			0, add_rule_dispatch);
	fwmsg.ioc_rule = ioc_rule;

	netisr_domsg(nmsg, 0);

	IPFW3_DEBUG("++ installed rule %d, static count now %d\n",
			ioc_rule->rulenum, static_count);
}

/**
 * Free storage associated with a static rule (including derived
 * dynamic rules).
 * The caller is in charge of clearing rule pointers to avoid
 * dangling pointers.
 * @return a pointer to the next entry.
 * Arguments are not checked, so they better be correct.
 * Must be called at splimp().
 */
struct ip_fw *
ip_fw3_delete_rule(struct ipfw3_context *ctx,
		 struct ip_fw *prev, struct ip_fw *rule)
{
	if (prev == NULL)
		ctx->rules = rule->next;
	else
		prev->next = rule->next;

	kfree(rule, M_IPFW3);
	rule = NULL;
	return NULL;
}

void
flush_rule_dispatch(netmsg_t nmsg)
{
	struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	struct ip_fw *rule, *the_rule;
	int kill_default = dmsg->kill_default;

	rule = ctx->rules;
	while (rule != NULL) {
		if (rule->rulenum == IPFW_DEFAULT_RULE && kill_default == 0) {
			ctx->rules = rule;
			break;
		}
		the_rule = rule;
		rule = rule->next;

		kfree(the_rule, M_IPFW3);
	}

	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
}


/*
 * Deletes all rules from a chain (including the default rule
 * if the second argument is set).
 * Must be called at splimp().
 */
void
ip_fw3_ctl_flush_rule(int kill_default)
{
	struct netmsg_del dmsg;

	IPFW_ASSERT_CFGPORT(&curthread->td_msgport);

	if (!kill_default) {
		sysctl_var_fw3_flushing = 1;
		netmsg_service_sync();
	}
	/*
	 * Press the 'flush' button
	 */
	bzero(&dmsg, sizeof(dmsg));
	netmsg_init(&dmsg.base, NULL, &curthread->td_msgport,
			0, flush_rule_dispatch);
	dmsg.kill_default = kill_default;
	netisr_domsg(&dmsg.base, 0);

	/* Flush is done */
	sysctl_var_fw3_flushing = 0;
}

void
delete_rule_dispatch(netmsg_t nmsg)
{
	struct netmsg_del *dmsg = (struct netmsg_del *)nmsg;
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	struct ip_fw *rule, *prev = NULL;

	rule = ctx->rules;
	while (rule!=NULL) {
		if (rule->rulenum == dmsg->rulenum) {
			ip_fw3_delete_rule(ctx, prev, rule);
			break;
		}
		prev = rule;
		rule = rule->next;
	}

	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
}

int
ip_fw3_ctl_delete_rule(struct sockopt *sopt)
{
	struct netmsg_del dmsg;
	struct netmsg_base *nmsg;
	int *rulenum;

	rulenum = (int *) sopt->sopt_val;


	/*
	 * Get rid of the rule duplications on all CPUs
	 */
	bzero(&dmsg, sizeof(dmsg));
	nmsg = &dmsg.base;
	netmsg_init(nmsg, NULL, &curthread->td_msgport,
			0, delete_rule_dispatch);
	dmsg.rulenum = *rulenum;
	netisr_domsg(nmsg, 0);
	return 0;
}

/*
 * Clear counters for a specific rule.
 */
void
ip_fw3_clear_counters(struct ip_fw *rule)
{
	rule->bcnt = rule->pcnt = 0;
	rule->timestamp = 0;
}

void
ip_fw3_zero_entry_dispatch(netmsg_t nmsg)
{
	struct netmsg_zent *zmsg = (struct netmsg_zent *)nmsg;
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	struct ip_fw *rule;

	if (zmsg->rulenum == 0) {
		for (rule = ctx->rules; rule; rule = rule->next) {
			ip_fw3_clear_counters(rule);
		}
	} else {
		for (rule = ctx->rules; rule; rule = rule->next) {
			if (rule->rulenum == zmsg->rulenum) {
				ip_fw3_clear_counters(rule);
			}
		}
	}
	ip_fw3_clear_counters(ctx->default_rule);
	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
}

/**
 * Reset some or all counters on firewall rules.
 * @arg frwl is null to clear all entries, or contains a specific
 * rule number.
 * @arg log_only is 1 if we only want to reset logs, zero otherwise.
 */
int
ip_fw3_ctl_zero_entry(int rulenum, int log_only)
{
	struct netmsg_zent zmsg;
	struct netmsg_base *nmsg;
	const char *msg;
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];

	bzero(&zmsg, sizeof(zmsg));
	nmsg = &zmsg.base;
	netmsg_init(nmsg, NULL, &curthread->td_msgport,
			0, ip_fw3_zero_entry_dispatch);
	zmsg.log_only = log_only;

	if (rulenum == 0) {
		msg = log_only ? "ipfw: All logging counts reset.\n"
				   : "ipfw: Accounting cleared.\n";
	} else {
		struct ip_fw *rule;

		/*
		 * Locate the first rule with 'rulenum'
		 */
		for (rule = ctx->rules; rule; rule = rule->next) {
			if (rule->rulenum == rulenum)
				break;
		}
		if (rule == NULL) /* we did not find any matching rules */
			return (EINVAL);
		zmsg.start_rule = rule;
		zmsg.rulenum = rulenum;

		msg = log_only ? "ipfw: Entry %d logging count reset.\n"
				   : "ipfw: Entry %d cleared.\n";
	}
	netisr_domsg(nmsg, 0);
	KKASSERT(zmsg.start_rule == NULL);

	if (sysctl_var_fw3_verbose)
		log(LOG_SECURITY | LOG_NOTICE, msg, rulenum);
	return (0);
}

/*
 * Get the ioc_rule from the sopt
 * call ip_fw3_add_rule to add the rule
 */
int
ip_fw3_ctl_add_rule(struct sockopt *sopt)
{
	struct ipfw_ioc_rule *ioc_rule;
	size_t size;

	size = sopt->sopt_valsize;
	if (size > (sizeof(uint32_t) * IPFW_RULE_SIZE_MAX) ||
			size < sizeof(*ioc_rule) - sizeof(ipfw_insn)) {
		return EINVAL;
	}
	if (size != (sizeof(uint32_t) * IPFW_RULE_SIZE_MAX)) {
		sopt->sopt_val = krealloc(sopt->sopt_val, sizeof(uint32_t) *
				IPFW_RULE_SIZE_MAX, M_TEMP, M_WAITOK);
	}
	ioc_rule = sopt->sopt_val;

	ip_fw3_add_rule(ioc_rule);
	return 0;
}

int
ip_fw3_ctl_get_modules(struct sockopt *sopt)
{
	int i;
	struct ipfw3_module *mod;
	char module_str[1024];
	memset(module_str,0,1024);
	for (i = 0, mod = fw3_modules; i < MAX_MODULE; i++, mod++) {
		if (mod->type != 0) {
			if (i > 0)
				strcat(module_str,",");
			strcat(module_str,mod->name);
		}
	}
	bzero(sopt->sopt_val, sopt->sopt_valsize);
	bcopy(module_str, sopt->sopt_val, strlen(module_str));
	sopt->sopt_valsize = strlen(module_str);
	return 0;
}

/*
 * Copy all static rules and states on all CPU
 */
int
ip_fw3_ctl_get_rules(struct sockopt *sopt)
{
	struct ipfw3_context *ctx = fw3_ctx[mycpuid];
	struct ip_fw *rule;
	struct ipfw_ioc_rule *ioc;
	const struct ip_fw *sibling;
	int total_len = 0;

	ioc = (struct ipfw_ioc_rule *)sopt->sopt_val;

	for (rule = ctx->rules; rule; rule = rule->next) {
		total_len += IOC_RULESIZE(rule);
		if (total_len > sopt->sopt_valsize) {
			bzero(sopt->sopt_val, sopt->sopt_valsize);
			return 0;
		}
		ioc->act_ofs = rule->act_ofs;
		ioc->cmd_len = rule->cmd_len;
		ioc->rulenum = rule->rulenum;
		ioc->set = rule->set;

		ioc->sets = fw3_ctx[mycpuid]->sets;
		ioc->pcnt = 0;
		ioc->bcnt = 0;
		ioc->timestamp = 0;
		for (sibling = rule; sibling != NULL; sibling = sibling->sibling) {
			ioc->pcnt += sibling->pcnt;
			ioc->bcnt += sibling->bcnt;
			if (sibling->timestamp > ioc->timestamp)
				ioc->timestamp = sibling->timestamp;
		}
		bcopy(rule->cmd, ioc->cmd, ioc->cmd_len * 4);
		ioc = (struct ipfw_ioc_rule *)((uint8_t *)ioc + IOC_RULESIZE(ioc));
	}
	sopt->sopt_valsize = total_len;
	return 0;
}


/*
 * ip_fw3_ctl_x - extended version of ip_fw3_ctl
 * remove the x_header, and adjust the sopt_name, sopt_val and sopt_valsize.
 */
int
ip_fw3_ctl_x(struct sockopt *sopt)
{
	ip_fw_x_header *x_header;
	x_header = (ip_fw_x_header *)(sopt->sopt_val);
	sopt->sopt_name = x_header->opcode;
	sopt->sopt_valsize -= sizeof(ip_fw_x_header);
	bcopy(++x_header, sopt->sopt_val, sopt->sopt_valsize);
	return ip_fw3_ctl(sopt);
}


/**
 * {set|get}sockopt parser.
 */
int
ip_fw3_ctl(struct sockopt *sopt)
{
	int error = 0;
	switch (sopt->sopt_name) {
		case IP_FW_X:
			ip_fw3_ctl_x(sopt);
			break;
		case IP_FW_GET:
		case IP_FW_MODULE:
		case IP_FW_FLUSH:
		case IP_FW_ADD:
		case IP_FW_DEL:
		case IP_FW_ZERO:
		case IP_FW_RESETLOG:
			error = ip_fw3_ctl_sockopt(sopt);
			break;
		case IP_FW_SET_GET:
		case IP_FW_SET_MOVE_RULE:
		case IP_FW_SET_MOVE_SET:
		case IP_FW_SET_SWAP:
		case IP_FW_SET_TOGGLE:
			error = ip_fw3_ctl_set_sockopt(sopt);
			break;
		case IP_FW_NAT_ADD:
		case IP_FW_NAT_DEL:
		case IP_FW_NAT_FLUSH:
		case IP_FW_NAT_GET:
		case IP_FW_NAT_GET_RECORD:
			if (ip_fw3_ctl_nat_ptr != NULL) {
				error = ip_fw3_ctl_nat_ptr(sopt);
			}
			break;
		case IP_DUMMYNET_GET:
		case IP_DUMMYNET_CONFIGURE:
		case IP_DUMMYNET_DEL:
		case IP_DUMMYNET_FLUSH:
			error = ip_dn_sockopt(sopt);
			break;
		case IP_FW_STATE_ADD:
		case IP_FW_STATE_DEL:
		case IP_FW_STATE_FLUSH:
		case IP_FW_STATE_GET:
			if (ip_fw3_ctl_state_ptr != NULL) {
				error = ip_fw3_ctl_state_ptr(sopt);
			}
			break;
		case IP_FW_TABLE_CREATE:
		case IP_FW_TABLE_DELETE:
		case IP_FW_TABLE_APPEND:
		case IP_FW_TABLE_REMOVE:
		case IP_FW_TABLE_LIST:
		case IP_FW_TABLE_FLUSH:
		case IP_FW_TABLE_SHOW:
		case IP_FW_TABLE_TEST:
		case IP_FW_TABLE_RENAME:
			if (ip_fw3_ctl_table_ptr != NULL) {
				error = ip_fw3_ctl_table_ptr(sopt);
			}
			break;
		case IP_FW_SYNC_SHOW_CONF:
		case IP_FW_SYNC_SHOW_STATUS:
		case IP_FW_SYNC_EDGE_CONF:
		case IP_FW_SYNC_EDGE_START:
		case IP_FW_SYNC_EDGE_STOP:
		case IP_FW_SYNC_EDGE_TEST:
		case IP_FW_SYNC_EDGE_CLEAR:
		case IP_FW_SYNC_CENTRE_CONF:
		case IP_FW_SYNC_CENTRE_START:
		case IP_FW_SYNC_CENTRE_STOP:
		case IP_FW_SYNC_CENTRE_TEST:
		case IP_FW_SYNC_CENTRE_CLEAR:
			if (ip_fw3_ctl_sync_ptr != NULL) {
				error = ip_fw3_ctl_sync_ptr(sopt);
			}
			break;
		default:
			kprintf("ip_fw3_ctl invalid option %d\n",
				sopt->sopt_name);
			error = EINVAL;
	}
	return error;
}

int
ip_fw3_ctl_sockopt(struct sockopt *sopt)
{
	int error = 0, rulenum;

	switch (sopt->sopt_name) {
		case IP_FW_GET:
			error = ip_fw3_ctl_get_rules(sopt);
			break;
		case IP_FW_MODULE:
			error = ip_fw3_ctl_get_modules(sopt);
			break;
		case IP_FW_FLUSH:
			ip_fw3_ctl_flush_rule(0);
			break;
		case IP_FW_ADD:
			error = ip_fw3_ctl_add_rule(sopt);
			break;
		case IP_FW_DEL:
			error = ip_fw3_ctl_delete_rule(sopt);
			break;
		case IP_FW_ZERO:
		case IP_FW_RESETLOG: /* argument is an int, the rule number */
			rulenum = 0;
			if (sopt->sopt_valsize != 0) {
				error = soopt_to_kbuf(sopt, &rulenum,
						sizeof(int), sizeof(int));
				if (error) {
					break;
				}
			}
			error = ip_fw3_ctl_zero_entry(rulenum,
					sopt->sopt_name == IP_FW_RESETLOG);
			break;
		default:
			kprintf("ip_fw3_ctl invalid option %d\n",
				sopt->sopt_name);
			error = EINVAL;
	}
	return error;
}

int
ip_fw3_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
{
	struct ip_fw_args args;
	struct mbuf *m = *m0;
	struct m_tag *mtag;
	int tee = 0, error = 0, ret;
	// again:
	if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
		/* Extract info from dummynet tag */
		mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
		KKASSERT(mtag != NULL);
		args.rule = ((struct dn_pkt *)m_tag_data(mtag))->dn_priv;
		KKASSERT(args.rule != NULL);

		m_tag_delete(m, mtag);
		m->m_pkthdr.fw_flags &= ~DUMMYNET_MBUF_TAGGED;
	} else {
		args.rule = NULL;
	}

	args.eh = NULL;
	args.oif = NULL;
	args.m = m;
	ret = ip_fw3_chk(&args);
	m = args.m;

	if (m == NULL) {
		error = EACCES;
		goto back;
	}
	switch (ret) {
		case IP_FW_PASS:
			break;

		case IP_FW_DENY:
			m_freem(m);
			m = NULL;
			error = EACCES;
			break;

		case IP_FW_DUMMYNET:
			/* Send packet to the appropriate pipe */
			m = ip_fw3_dummynet_io(m, args.cookie, DN_TO_IP_IN,
			    &args);
			break;
		case IP_FW_TEE:
			tee = 1;
			/* FALL THROUGH */
		case IP_FW_DIVERT:
			/*
			 * Must clear bridge tag when changing
			 */
			m->m_pkthdr.fw_flags &= ~BRIDGE_MBUF_TAGGED;
			if (ip_divert_p != NULL) {
				m = ip_divert_p(m, tee, 1);
			} else {
				m_freem(m);
				m = NULL;
				/* not sure this is the right error msg */
				error = EACCES;
			}
			break;
		case IP_FW_NAT:
			break;
		case IP_FW_ROUTE:
			break;
		default:
			panic("unknown ipfw3 return value: %d", ret);
	}
back:
	*m0 = m;
	return error;
}

int
ip_fw3_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
{
	struct ip_fw_args args;
	struct mbuf *m = *m0;
	struct m_tag *mtag;
	int tee = 0, error = 0, ret;
	// again:
	if (m->m_pkthdr.fw_flags & DUMMYNET_MBUF_TAGGED) {
		/* Extract info from dummynet tag */
		mtag = m_tag_find(m, PACKET_TAG_DUMMYNET, NULL);
		KKASSERT(mtag != NULL);
		args.rule = ((struct dn_pkt *)m_tag_data(mtag))->dn_priv;
		KKASSERT(args.rule != NULL);

		m_tag_delete(m, mtag);
		m->m_pkthdr.fw_flags &= ~DUMMYNET_MBUF_TAGGED;
	} else {
		args.rule = NULL;
	}

	args.eh = NULL;
	args.m = m;
	args.oif = ifp;
	ret = ip_fw3_chk(&args);
	m = args.m;

	if (m == NULL) {
		error = EACCES;
		goto back;
	}

	switch (ret) {
		case IP_FW_PASS:
			break;

		case IP_FW_DENY:
			m_freem(m);
			m = NULL;
			error = EACCES;
			break;

		case IP_FW_DUMMYNET:
			m = ip_fw3_dummynet_io(m, args.cookie, DN_TO_IP_OUT,
			    &args);
			break;

		case IP_FW_TEE:
			tee = 1;
			/* FALL THROUGH */

		case IP_FW_DIVERT:
			if (ip_divert_p != NULL) {
				m = ip_divert_p(m, tee, 0);
			} else {
				m_freem(m);
				m = NULL;
				/* not sure this is the right error msg */
				error = EACCES;
			}
			break;

		case IP_FW_NAT:
			break;
		case IP_FW_ROUTE:
			break;
		default:
			panic("unknown ipfw3 return value: %d", ret);
	}
back:
	*m0 = m;
	return error;
}

void
ip_fw3_hook(void)
{
	struct pfil_head *pfh;
	IPFW_ASSERT_CFGPORT(&curthread->td_msgport);

	pfh = pfil_head_get(PFIL_TYPE_AF, AF_INET);
	if (pfh == NULL)
		return;

	pfil_add_hook(ip_fw3_check_in, NULL, PFIL_IN, pfh);
	pfil_add_hook(ip_fw3_check_out, NULL, PFIL_OUT, pfh);
}

void
ip_fw3_dehook(void)
{
	struct pfil_head *pfh;

	IPFW_ASSERT_CFGPORT(&curthread->td_msgport);

	pfh = pfil_head_get(PFIL_TYPE_AF, AF_INET);
	if (pfh == NULL)
		return;

	pfil_remove_hook(ip_fw3_check_in, NULL, PFIL_IN, pfh);
	pfil_remove_hook(ip_fw3_check_out, NULL, PFIL_OUT, pfh);
}

void
ip_fw3_sysctl_enable_dispatch(netmsg_t nmsg)
{
	struct lwkt_msg *lmsg = &nmsg->lmsg;
	int enable = lmsg->u.ms_result;

	if (sysctl_var_fw3_enable == enable)
		goto reply;

	sysctl_var_fw3_enable = enable;
	if (sysctl_var_fw3_enable)
		ip_fw3_hook();
	else
		ip_fw3_dehook();

reply:
	lwkt_replymsg(lmsg, 0);
}

int
ip_fw3_sysctl_enable(SYSCTL_HANDLER_ARGS)
{
	struct netmsg_base nmsg;
	struct lwkt_msg *lmsg;
	int enable, error;

	enable = sysctl_var_fw3_enable;
	error = sysctl_handle_int(oidp, &enable, 0, req);
	if (error || req->newptr == NULL)
		return error;

	netmsg_init(&nmsg, NULL, &curthread->td_msgport,
			0, ip_fw3_sysctl_enable_dispatch);
	lmsg = &nmsg.lmsg;
	lmsg->u.ms_result = enable;

	return lwkt_domsg(IPFW_CFGPORT, lmsg, 0);
}

int
ip_fw3_sysctl_autoinc_step(SYSCTL_HANDLER_ARGS)
{
	return sysctl_int_range(oidp, arg1, arg2, req,
			IPFW_AUTOINC_STEP_MIN, IPFW_AUTOINC_STEP_MAX);
}

void
ctx_init_dispatch(netmsg_t nmsg)
{
	struct netmsg_ipfw *fwmsg = (struct netmsg_ipfw *)nmsg;
	struct ipfw3_context *ctx;
	struct ip_fw *def_rule;

	ctx = kmalloc(LEN_FW3_CTX, M_IPFW3, M_WAITOK | M_ZERO);
	fw3_ctx[mycpuid] = ctx;
	ctx->sets = IPFW_ALL_SETS;

	def_rule = kmalloc(LEN_FW3, M_IPFW3, M_WAITOK | M_ZERO);
	def_rule->act_ofs = 0;
	def_rule->rulenum = IPFW_DEFAULT_RULE;
	def_rule->cmd_len = 2;
	def_rule->set = IPFW_DEFAULT_SET;

	def_rule->cmd[0].len = LEN_OF_IPFWINSN;
	def_rule->cmd[0].module = MODULE_BASIC_ID;
#ifdef IPFIREWALL_DEFAULT_TO_ACCEPT
	def_rule->cmd[0].opcode = O_BASIC_ACCEPT;
#else
	if (filters_default_to_accept)
		def_rule->cmd[0].opcode = O_BASIC_ACCEPT;
	else
		def_rule->cmd[0].opcode = O_BASIC_DENY;
#endif

	/* Install the default rule */
	ctx->default_rule = def_rule;
	ctx->rules = def_rule;

	/*
	 * if sibiling in last CPU is exists,
	 * then it's sibling should be current rule
	 */
	if (fwmsg->sibling != NULL) {
		fwmsg->sibling->sibling = def_rule;
	}
	/* prepare for next CPU */
	fwmsg->sibling = def_rule;

	netisr_forwardmsg_all(&nmsg->base, mycpuid + 1);
}

void
init_dispatch(netmsg_t nmsg)
{
	struct netmsg_ipfw fwmsg;
	int error = 0;
	if (IPFW3_LOADED) {
		kprintf("ipfw3 already loaded\n");
		error = EEXIST;
		goto reply;
	}

	bzero(&fwmsg, sizeof(fwmsg));
	netmsg_init(&fwmsg.base, NULL, &curthread->td_msgport,
			0, ctx_init_dispatch);
	netisr_domsg(&fwmsg.base, 0);

	ip_fw_chk_ptr = ip_fw3_chk;
	ip_fw_ctl_x_ptr = ip_fw3_ctl_x;
	ip_fw_dn_io_ptr = ip_fw3_dummynet_io;

	kprintf("ipfw3 initialized, default to %s\n",
			filters_default_to_accept ? "accept" : "deny");

	ip_fw3_loaded = 1;
	if (sysctl_var_fw3_enable)
		ip_fw3_hook();
reply:
	lwkt_replymsg(&nmsg->lmsg, error);
}

int
ip_fw3_init(void)
{
	struct netmsg_base smsg;
	int error;

	init_module();
	netmsg_init(&smsg, NULL, &curthread->td_msgport,
			0, init_dispatch);
	error = lwkt_domsg(IPFW_CFGPORT, &smsg.lmsg, 0);
	return error;
}

#ifdef KLD_MODULE

void
fini_dispatch(netmsg_t nmsg)
{
	int error = 0, cpu;

	ip_fw3_loaded = 0;

	ip_fw3_dehook();
	netmsg_service_sync();
	ip_fw_chk_ptr = NULL;
	ip_fw_ctl_x_ptr = NULL;
	ip_fw_dn_io_ptr = NULL;
	ip_fw3_ctl_flush_rule(1);
	/* Free pre-cpu context */
	for (cpu = 0; cpu < ncpus; ++cpu) {
		if (fw3_ctx[cpu] != NULL) {
			kfree(fw3_ctx[cpu], M_IPFW3);
			fw3_ctx[cpu] = NULL;
		}
	}
	kprintf("ipfw3 unloaded\n");

	lwkt_replymsg(&nmsg->lmsg, error);
}

int
ip_fw3_fini(void)
{
	struct netmsg_base smsg;

	netmsg_init(&smsg, NULL, &curthread->td_msgport,
			0, fini_dispatch);
	return lwkt_domsg(IPFW_CFGPORT, &smsg.lmsg, 0);
}

#endif	/* KLD_MODULE */

static int
ip_fw3_modevent(module_t mod, int type, void *unused)
{
	int err = 0;

	switch (type) {
		case MOD_LOAD:
			err = ip_fw3_init();
			break;

		case MOD_UNLOAD:

#ifndef KLD_MODULE
			kprintf("ipfw3 statically compiled, cannot unload\n");
			err = EBUSY;
#else
			err = ip_fw3_fini();
#endif
			break;
		default:
			break;
	}
	return err;
}

static moduledata_t ipfw3mod = {
	"ipfw3",
	ip_fw3_modevent,
	0
};
/* ipfw3 must init before ipfw3_basic */
DECLARE_MODULE(ipfw3, ipfw3mod, SI_SUB_PROTO_END, SI_ORDER_FIRST);
MODULE_VERSION(ipfw3, 1);