X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=main.c;h=9afeb701edf1b1c3564dcea82da8e9ad248382a2;hb=3624c3786601699b6e7f9d18209fad0d7c6fe4e9;hp=5888ab50285a6e416d3434ea28f9e16901d7106a;hpb=0a7d36d8cf56f160b531f3db9f045e3f9315dd15;p=project%2Ffirewall3.git

diff --git a/main.c b/main.c
index 5888ab5..9afeb70 100644
--- a/main.c
+++ b/main.c
@@ -30,6 +30,7 @@
 #include "includes.h"
 #include "ubus.h"
 #include "iptables.h"
+#include "helpers.h"
 
 
 static enum fw3_family print_family = FW3_FAMILY_ANY;
@@ -101,13 +102,14 @@ build_state(bool runtime)
 	fw3_ubus_rules(&b);
 
 	fw3_load_defaults(state, p);
-	fw3_load_ipsets(state, p);
+	fw3_load_cthelpers(state, p);
+	fw3_load_ipsets(state, p, b.head);
 	fw3_load_zones(state, p);
 	fw3_load_rules(state, p, b.head);
 	fw3_load_redirects(state, p, b.head);
 	fw3_load_snats(state, p, b.head);
-	fw3_load_forwards(state, p);
-	fw3_load_includes(state, p);
+	fw3_load_forwards(state, p, b.head);
+	fw3_load_includes(state, p, b.head);
 
 	return true;
 }
@@ -138,6 +140,9 @@ free_state(struct fw3_state *state)
 	list_for_each_safe(cur, tmp, &state->includes)
 		fw3_free_include((struct fw3_include *)cur);
 
+	list_for_each_safe(cur, tmp, &state->cthelpers)
+		fw3_free_cthelper((struct fw3_cthelper *)cur);
+
 	uci_free_context(state->uci);
 
 	free(state);
@@ -219,8 +224,10 @@ stop(bool complete)
 		rv = 0;
 	}
 
-	if (run_state)
-		fw3_destroy_ipsets(run_state);
+	if (run_state) {
+		for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+			fw3_destroy_ipsets(run_state, family, false);
+	}
 
 	if (complete)
 		fw3_flush_conntrack(NULL);
@@ -239,11 +246,11 @@ start(void)
 	enum fw3_table table;
 	struct fw3_ipt_handle *handle;
 
-	if (!print_family)
-		fw3_create_ipsets(cfg_state);
-
 	for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 	{
+		if (!print_family)
+			fw3_create_ipsets(cfg_state, family, false);
+
 		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
 			continue;
 
@@ -259,6 +266,17 @@ start(void)
 			continue;
 		}
 
+		/* Linux 5.15+: make sure the tables are loaded and
+		 * /proc/net/ip{,6}_tables_names are thus populated.
+		 */
+		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
+		{
+			if (!(handle = fw3_ipt_open(family, table)))
+				continue;
+
+			fw3_ipt_close(handle);
+		}
+
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
 			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
@@ -347,6 +365,9 @@ reload(void)
 			fw3_ipt_close(handle);
 		}
 
+		fw3_ipsets_update_run_state(family, run_state, cfg_state);
+		fw3_destroy_ipsets(run_state, family, true);
+
 		family_set(run_state, family, false);
 		family_set(cfg_state, family, false);
 
@@ -354,6 +375,8 @@ start:
 		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
 			continue;
 
+		fw3_create_ipsets(cfg_state, family, true);
+
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
 			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))