ubus: store rule origin as comment

[project/firewall3.git] / defaults.c

diff --git a/defaults.c b/defaults.c
index d1c5e2c..396cbf7 100644 (file)
--- a/defaults.c
+++ b/defaults.c
@@ -40,7 +40,7 @@ static const struct fw3_chain_spec default_chains[] = {
        C(ANY, MANGLE, UNSPEC,        "mssfix"),
        C(ANY, MANGLE, UNSPEC,        "fwmark"),
 
-       C(ANY, RAW,    UNSPEC,        "notrack"),
+       C(ANY, RAW,    UNSPEC,        "delegate_notrack"),
 
        { }
 };
@@ -58,7 +58,7 @@ const struct fw3_option fw3_flag_opts[] = {
        FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
 
        FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
-       FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
+       FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
        FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
 
        FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
@@ -208,7 +208,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
                { FW3_TABLE_MANGLE, "FORWARD",     "mssfix" },
                { FW3_TABLE_MANGLE, "PREROUTING",  "fwmark" },
 
-               { FW3_TABLE_RAW,    "PREROUTING",  "notrack" },
+               { FW3_TABLE_RAW,    "PREROUTING",  "delegate_notrack" },
 
                { 0, NULL },
        };
@@ -220,7 +220,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 
                r = fw3_ipt_rule_new(handle);
                fw3_ipt_rule_target(r, tr->target);
-               fw3_ipt_rule_append(r, tr->chain);
+               fw3_ipt_rule_replace(r, tr->chain);
        }
 
        switch (handle->table)
@@ -243,7 +243,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
                        {
                                r = fw3_ipt_rule_new(handle);
                                fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
-                               fw3_ipt_rule_target(r, chains[i+1]);
+                               fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
                                fw3_ipt_rule_append(r, chains[i]);
                        }
                }
@@ -359,7 +359,7 @@ fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
 }
 
 static void
-set_default(const char *name, bool set)
+set_default(const char *name, int set)
 {
        FILE *f;
        char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
@@ -416,11 +416,16 @@ fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
                if (c->table != handle->table)
                        continue;
 
-               if (c->flag &&
-                   !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
+               if (c->flag && !has(defs->flags, handle->family, c->flag))
+                       continue;
+
+               fw3_ipt_flush_chain(handle, c->format);
+
+               /* keep certain basic chains that do not depend on any settings to
+                  avoid purging unrelated user rules pointing to them */
+               if (reload && !c->flag)
                        continue;
 
-               fw3_ipt_delete_rules(handle, c->format);
                fw3_ipt_delete_chain(handle, c->format);
        }