X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=main.c;h=9afeb701edf1b1c3564dcea82da8e9ad248382a2;hb=3624c3786601699b6e7f9d18209fad0d7c6fe4e9;hp=71463aec6a3840b547291de8fbae5ece5f9939c3;hpb=2807cc26b8e46eef5f23c06534a853dd48183331;p=project%2Ffirewall3.git

diff --git a/main.c b/main.c
index 71463ae..9afeb70 100644
--- a/main.c
+++ b/main.c
@@ -1,7 +1,7 @@
 /*
  * firewall3 - 3rd OpenWrt UCI firewall implementation
  *
- *   Copyright (C) 2013-2014 Jo-Philipp Wich <jow@openwrt.org>
+ *   Copyright (C) 2013-2014 Jo-Philipp Wich <jo@mein.io>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -30,6 +30,7 @@
 #include "includes.h"
 #include "ubus.h"
 #include "iptables.h"
+#include "helpers.h"
 
 
 static enum fw3_family print_family = FW3_FAMILY_ANY;
@@ -79,7 +80,7 @@ build_state(bool runtime)
 	else
 	{
 		if (!fw3_ubus_connect())
-			error("Failed to connect to ubus");
+			warn("Failed to connect to ubus");
 
 		if (uci_load(state->uci, "firewall", &p))
 		{
@@ -101,13 +102,14 @@ build_state(bool runtime)
 	fw3_ubus_rules(&b);
 
 	fw3_load_defaults(state, p);
-	fw3_load_ipsets(state, p);
+	fw3_load_cthelpers(state, p);
+	fw3_load_ipsets(state, p, b.head);
 	fw3_load_zones(state, p);
 	fw3_load_rules(state, p, b.head);
-	fw3_load_redirects(state, p);
+	fw3_load_redirects(state, p, b.head);
 	fw3_load_snats(state, p, b.head);
-	fw3_load_forwards(state, p);
-	fw3_load_includes(state, p);
+	fw3_load_forwards(state, p, b.head);
+	fw3_load_includes(state, p, b.head);
 
 	return true;
 }
@@ -138,6 +140,9 @@ free_state(struct fw3_state *state)
 	list_for_each_safe(cur, tmp, &state->includes)
 		fw3_free_include((struct fw3_include *)cur);
 
+	list_for_each_safe(cur, tmp, &state->cthelpers)
+		fw3_free_cthelper((struct fw3_cthelper *)cur);
+
 	uci_free_context(state->uci);
 
 	free(state);
@@ -219,8 +224,10 @@ stop(bool complete)
 		rv = 0;
 	}
 
-	if (run_state)
-		fw3_destroy_ipsets(run_state);
+	if (run_state) {
+		for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+			fw3_destroy_ipsets(run_state, family, false);
+	}
 
 	if (complete)
 		fw3_flush_conntrack(NULL);
@@ -239,11 +246,11 @@ start(void)
 	enum fw3_table table;
 	struct fw3_ipt_handle *handle;
 
-	if (!print_family)
-		fw3_create_ipsets(cfg_state);
-
 	for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 	{
+		if (!print_family)
+			fw3_create_ipsets(cfg_state, family, false);
+
 		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
 			continue;
 
@@ -259,6 +266,17 @@ start(void)
 			continue;
 		}
 
+		/* Linux 5.15+: make sure the tables are loaded and
+		 * /proc/net/ip{,6}_tables_names are thus populated.
+		 */
+		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
+		{
+			if (!(handle = fw3_ipt_open(family, table)))
+				continue;
+
+			fw3_ipt_close(handle);
+		}
+
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
 			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
@@ -347,6 +365,9 @@ reload(void)
 			fw3_ipt_close(handle);
 		}
 
+		fw3_ipsets_update_run_state(family, run_state, cfg_state);
+		fw3_destroy_ipsets(run_state, family, true);
+
 		family_set(run_state, family, false);
 		family_set(cfg_state, family, false);
 
@@ -354,6 +375,8 @@ start:
 		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
 			continue;
 
+		fw3_create_ipsets(cfg_state, family, true);
+
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
 			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
@@ -400,6 +423,35 @@ start:
 	return rv;
 }
 
+static int
+gc(void)
+{
+	enum fw3_family family;
+	enum fw3_table table;
+	struct fw3_ipt_handle *handle;
+
+	for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+	{
+		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
+			continue;
+
+		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
+		{
+			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
+				continue;
+
+			if (!(handle = fw3_ipt_open(family, table)))
+				continue;
+
+			fw3_ipt_gc(handle);
+			fw3_ipt_commit(handle);
+			fw3_ipt_close(handle);
+		}
+	}
+
+	return 0;
+}
+
 static int
 lookup_network(const char *net)
 {
@@ -517,7 +569,6 @@ int main(int argc, char **argv)
 	}
 
 	build_state(false);
-	build_state(true);
 	defs = &cfg_state->defaults;
 
 	if (optind >= argc)
@@ -548,12 +599,18 @@ int main(int argc, char **argv)
 		print_family = family;
 		fw3_pr_debug = true;
 
-		rv = start();
+		if (fw3_lock())
+		{
+			build_state(true);
+			rv = start();
+			fw3_unlock();
+		}
 	}
 	else if (!strcmp(argv[optind], "start"))
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = start();
 			fw3_unlock();
 		}
@@ -562,6 +619,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = stop(false);
 			fw3_unlock();
 		}
@@ -570,6 +628,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = stop(true);
 			fw3_unlock();
 		}
@@ -578,6 +637,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			stop(true);
 			rv = start();
 			fw3_unlock();
@@ -587,10 +647,19 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = reload();
 			fw3_unlock();
 		}
 	}
+	else if (!strcmp(argv[optind], "gc"))
+	{
+		if (fw3_lock())
+		{
+			rv = gc();
+			fw3_unlock();
+		}
+	}
 	else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 	{
 		rv = lookup_network(argv[optind + 1]);