add debug flag to monitor fw3_pr() calls, set policies to drop during reload

diff --git a/defaults.c b/defaults.c
index 7f41c83711573e902c3ae85bb2e824445a27e955..7f3272857548f95c21c6f0aa847dcc7ecd861917 100644 (file)
--- a/defaults.c
+++ b/defaults.c
@@ -318,19 +318,19 @@ fw3_set_defaults(struct fw3_state *state)
 }
 
 static void
-reset_policy(enum fw3_table table)
+reset_policy(enum fw3_table table, enum fw3_target policy)
 {
        if (table != FW3_TABLE_FILTER)
                return;
 
-       fw3_pr(":INPUT ACCEPT [0:0]\n");
-       fw3_pr(":OUTPUT ACCEPT [0:0]\n");
-       fw3_pr(":FORWARD ACCEPT [0:0]\n");
+       fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
+       fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
+       fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
 }
 
 void
 fw3_flush_rules(enum fw3_table table, enum fw3_family family,
-                bool pass2, struct fw3_state *state)
+                bool pass2, struct fw3_state *state, enum fw3_target policy)
 {
        struct fw3_defaults *d = &state->running_defaults;
        uint16_t mask = ~0;
@@ -343,7 +343,7 @@ fw3_flush_rules(enum fw3_table table, enum fw3_family family,
 
        if (!pass2)
        {
-               reset_policy(table);
+               reset_policy(table, policy);
 
                print_chains(table, family, "-D %s\n", d->flags & mask,
                                         toplevel_rules, ARRAY_SIZE(toplevel_rules));
@@ -363,7 +363,7 @@ fw3_flush_rules(enum fw3_table table, enum fw3_family family,
 void
 fw3_flush_all(enum fw3_table table)
 {
-       reset_policy(table);
+       reset_policy(table, FW3_TARGET_ACCEPT);
 
        fw3_pr("-F\n");
        fw3_pr("-X\n");

diff --git a/defaults.h b/defaults.h
index 29babd8f644d5c34e4e73a8c26cde47ad135b355..9547acec0d10d7aebefa62806b01a6e4023a6d35 100644 (file)
--- a/defaults.h
+++ b/defaults.h
@@ -37,7 +37,8 @@ void fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
 void fw3_set_defaults(struct fw3_state *state);
 
 void fw3_flush_rules(enum fw3_table table, enum fw3_family family,
-                     bool pass2, struct fw3_state *state);
+                     bool pass2, struct fw3_state *state,
+                     enum fw3_target policy);
 
 void fw3_flush_all(enum fw3_table table);
 

diff --git a/main.c b/main.c
index 65de9f5537b2bbc16e5495cd8a9d7011adf243eb..1135c50c758e045d904de073bc86041866934141 100644 (file)
--- a/main.c
+++ b/main.c
@@ -160,15 +160,16 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set)
 }
 
 static int
-stop(struct fw3_state *state, bool complete, bool restart)
+stop(struct fw3_state *state, bool complete, bool reload)
 {
        int rv = 1;
        enum fw3_family family;
        enum fw3_table table;
+       enum fw3_target policy = reload ? FW3_TARGET_DROP : FW3_TARGET_ACCEPT;
 
        if (!complete && !state->statefile)
        {
-               if (!restart)
+               if (!reload)
                        warn("The firewall appears to be stopped. "
                                 "Use the 'flush' command to forcefully purge all rules.");
 
@@ -202,11 +203,11 @@ stop(struct fw3_state *state, bool complete, bool restart)
                        else
                        {
                                /* pass 1 */
-                               fw3_flush_rules(table, family, false, state);
+                               fw3_flush_rules(table, family, false, state, policy);
                                fw3_flush_zones(table, family, false, state);
 
                                /* pass 2 */
-                               fw3_flush_rules(table, family, true, state);
+                               fw3_flush_rules(table, family, true, state, policy);
                                fw3_flush_zones(table, family, true, state);
                        }
 
@@ -215,13 +216,13 @@ stop(struct fw3_state *state, bool complete, bool restart)
 
                fw3_command_close();
 
-               if (!restart)
+               if (!reload)
                        family_set(state, family, false);
 
                rv = 0;
        }
 
-       if (!restart && fw3_command_pipe(false, "ipset", "-exist", "-"))
+       if (!reload && fw3_command_pipe(false, "ipset", "-exist", "-"))
        {
                fw3_destroy_ipsets(state);
                fw3_command_close();
@@ -366,7 +367,7 @@ int main(int argc, char **argv)
        struct fw3_state *state = NULL;
        struct fw3_defaults *defs = NULL;
 
-       while ((ch = getopt(argc, argv, "46qh")) != -1)
+       while ((ch = getopt(argc, argv, "46dqh")) != -1)
        {
                switch (ch)
                {
@@ -378,6 +379,10 @@ int main(int argc, char **argv)
                        use_family = FW3_FAMILY_V6;
                        break;
 
+               case 'd':
+                       fw3_pr_debug = true;
+                       break;
+
                case 'q':
                        freopen("/dev/null", "w", stderr);
                        break;

diff --git a/utils.c b/utils.c
index 34464ee638c1e04c028a337469cd32b125c3f335..1b9d6722b406b1144804331ff9d8572e7e0de555 100644 (file)
--- a/utils.c
+++ b/utils.c
@@ -27,6 +27,9 @@ static int lock_fd = -1;
 static pid_t pipe_pid = -1;
 static FILE *pipe_fd = NULL;
 
+bool fw3_pr_debug = false;
+
+
 static void
 warn_elem_section_name(struct uci_section *s, bool find_name)
 {
@@ -250,10 +253,18 @@ __fw3_command_pipe(bool silent, const char *command, ...)
 void
 fw3_pr(const char *fmt, ...)
 {
-    va_list args;
-    va_start(args, fmt);
-    vfprintf(pipe_fd, fmt, args);
-    va_end(args);
+       va_list args;
+
+       if (fw3_pr_debug && pipe_fd != stdout)
+       {
+               va_start(args, fmt);
+               vfprintf(stderr, fmt, args);
+               va_end(args);
+       }
+
+       va_start(args, fmt);
+       vfprintf(pipe_fd, fmt, args);
+       va_end(args);
 }
 
 void

diff --git a/utils.h b/utils.h
index baba9df62b6556bf136bce340190df7e3f3d2a6d..43f30f46480de0a8ab546b98798813fdeed47c8f 100644 (file)
--- a/utils.h
+++ b/utils.h
@@ -35,6 +35,8 @@
 #define FW3_STATEFILE  "/var/run/fw3.state"
 #define FW3_LOCKFILE   "/var/run/fw3.lock"
 
+extern bool fw3_pr_debug;
+
 void warn_elem(struct uci_element *e, const char *format, ...);
 void warn(const char *format, ...);
 void error(const char *format, ...);