X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=defaults.c;h=2cfb426cda14f02c28c6c4b35cd51c2d46d7e066;hp=3ed6cfaad9b62615149f1b441e7c19d8e115dd88;hb=c114b1e380849d8377bc122687eee02831c59aeb;hpb=6b27a6665c288937eb5028063064e3350dcab545

diff --git a/defaults.c b/defaults.c
index 3ed6cfa..2cfb426 100644
--- a/defaults.c
+++ b/defaults.c
@@ -22,7 +22,7 @@
 #define C(f, tbl, def, fmt) \
 	{ FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
 
-static const struct fw3_rule_spec default_chains[] = {
+static const struct fw3_chain_spec default_chains[] = {
 	C(ANY, FILTER, UNSPEC,        "delegate_input"),
 	C(ANY, FILTER, UNSPEC,        "delegate_output"),
 	C(ANY, FILTER, UNSPEC,        "delegate_forward"),
@@ -40,7 +40,7 @@ static const struct fw3_rule_spec default_chains[] = {
 	C(ANY, MANGLE, UNSPEC,        "mssfix"),
 	C(ANY, MANGLE, UNSPEC,        "fwmark"),
 
-	C(ANY, RAW,    UNSPEC,        "notrack"),
+	C(ANY, RAW,    UNSPEC,        "delegate_notrack"),
 
 	{ }
 };
@@ -58,7 +58,7 @@ const struct fw3_option fw3_flag_opts[] = {
 	FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
 
 	FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
-	FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
+	FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
 	FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
 
 	FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
@@ -130,7 +130,7 @@ fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
                          bool reload)
 {
 	struct fw3_defaults *defs = &state->defaults;
-	const struct fw3_rule_spec *c;
+	const struct fw3_chain_spec *c;
 
 #define policy(t) \
 	((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
@@ -208,7 +208,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 		{ FW3_TABLE_MANGLE, "FORWARD",     "mssfix" },
 		{ FW3_TABLE_MANGLE, "PREROUTING",  "fwmark" },
 
-		{ FW3_TABLE_RAW,    "PREROUTING",  "notrack" },
+		{ FW3_TABLE_RAW,    "PREROUTING",  "delegate_notrack" },
 
 		{ 0, NULL },
 	};
@@ -220,7 +220,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 
 		r = fw3_ipt_rule_new(handle);
 		fw3_ipt_rule_target(r, tr->target);
-		fw3_ipt_rule_append(r, tr->chain);
+		fw3_ipt_rule_replace(r, tr->chain);
 	}
 
 	switch (handle->table)
@@ -243,7 +243,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 			{
 				r = fw3_ipt_rule_new(handle);
 				fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
-				fw3_ipt_rule_target(r, chains[i+1]);
+				fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
 				fw3_ipt_rule_append(r, chains[i]);
 			}
 		}
@@ -392,7 +392,7 @@ fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 {
 	enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
 	struct fw3_defaults *defs = &state->defaults;
-	const struct fw3_rule_spec *c;
+	const struct fw3_chain_spec *c;
 
 	if (!has(defs->flags, handle->family, handle->table))
 		return;
@@ -416,11 +416,16 @@ fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 		if (c->table != handle->table)
 			continue;
 
-		if (c->flag &&
-		    !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
+		if (c->flag && !has(defs->flags, handle->family, c->flag))
+			continue;
+
+		fw3_ipt_flush_chain(handle, c->format);
+
+		/* keep certain basic chains that do not depend on any settings to
+		   avoid purging unrelated user rules pointing to them */
+		if (reload && !c->flag)
 			continue;
 
-		fw3_ipt_delete_rules(handle, c->format);
 		fw3_ipt_delete_chain(handle, c->format);
 	}