Fix processing of negated options

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index dbf682f..fc6d11e 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -222,12 +222,12 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
                }
 
                setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
+               setbit(zone->flags[0], fw3_to_src_target(zone->policy_forward));
                setbit(zone->flags[0], zone->policy_output);
-               setbit(zone->flags[0], zone->policy_forward);
 
                setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
+               setbit(zone->flags[1], fw3_to_src_target(zone->policy_forward));
                setbit(zone->flags[1], zone->policy_output);
-               setbit(zone->flags[1], zone->policy_forward);
 
                list_add_tail(&zone->list, &state->zones);
        }
@@ -476,7 +476,7 @@ print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
 
                r = fw3_ipt_rule_new(handle);
-               fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
+               fw3_ipt_rule_target(r, "zone_%s_src_%s", zone->name,
                                     fw3_flag_names[zone->policy_forward]);
                fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
 
@@ -595,7 +595,13 @@ fw3_flush_zones(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                continue;
 
                        snprintf(chain, sizeof(chain), c->format, z->name);
-                       fw3_ipt_delete_rules(handle, chain);
+                       fw3_ipt_flush_chain(handle, chain);
+
+                       /* keep certain basic chains that do not depend on any settings to
+                          avoid purging unrelated user rules pointing to them */
+                       if (reload && !c->flag)
+                               continue;
+
                        fw3_ipt_delete_chain(handle, chain);
                }
 
@@ -687,23 +693,3 @@ fw3_resolve_zone_addresses(struct fw3_zone *zone)
 
        return all;
 }
-
-void
-fw3_free_zone(struct fw3_zone *zone)
-{
-       struct fw3_device *dev, *tmp;
-
-       list_for_each_entry_safe(dev, tmp, &zone->devices, list)
-       {
-               list_del(&dev->list);
-               free(dev);
-       }
-
-       list_for_each_entry_safe(dev, tmp, &zone->networks, list)
-       {
-               list_del(&dev->list);
-               free(dev);
-       }
-
-       fw3_free_object(zone, fw3_zone_opts);
-}