X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=main.c;h=5888ab50285a6e416d3434ea28f9e16901d7106a;hp=455c049cbb6a5678e286b4d605cd6c4cc810b9ef;hb=0a7d36d8cf56f160b531f3db9f045e3f9315dd15;hpb=a9c694d5b6ea026a0c745e5b650993bf0f1c13dc

diff --git a/main.c b/main.c
index 455c049..5888ab5 100644
--- a/main.c
+++ b/main.c
@@ -1,7 +1,7 @@
 /*
  * firewall3 - 3rd OpenWrt UCI firewall implementation
  *
- *   Copyright (C) 2013-2014 Jo-Philipp Wich <jow@openwrt.org>
+ *   Copyright (C) 2013-2014 Jo-Philipp Wich <jo@mein.io>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -79,7 +79,7 @@ build_state(bool runtime)
 	else
 	{
 		if (!fw3_ubus_connect())
-			error("Failed to connect to ubus");
+			warn("Failed to connect to ubus");
 
 		if (uci_load(state->uci, "firewall", &p))
 		{
@@ -104,7 +104,7 @@ build_state(bool runtime)
 	fw3_load_ipsets(state, p);
 	fw3_load_zones(state, p);
 	fw3_load_rules(state, p, b.head);
-	fw3_load_redirects(state, p);
+	fw3_load_redirects(state, p, b.head);
 	fw3_load_snats(state, p, b.head);
 	fw3_load_forwards(state, p);
 	fw3_load_includes(state, p);
@@ -167,8 +167,6 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set)
 static int
 stop(bool complete)
 {
-	FILE *ct;
-
 	int rv = 1;
 	enum fw3_family family;
 	enum fw3_table table;
@@ -224,13 +222,8 @@ stop(bool complete)
 	if (run_state)
 		fw3_destroy_ipsets(run_state);
 
-	if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL)
-	{
-		info(" * Flushing conntrack table ...");
-
-		fwrite("f\n", 2, 1, ct);
-		fclose(ct);
-	}
+	if (complete)
+		fw3_flush_conntrack(NULL);
 
 	if (!rv && run_state)
 		fw3_write_statefile(run_state);
@@ -304,6 +297,7 @@ start(void)
 
 	if (!rv)
 	{
+		fw3_flush_conntrack(run_state);
 		fw3_set_defaults(cfg_state);
 
 		if (!print_family)
@@ -395,6 +389,8 @@ start:
 
 	if (!rv)
 	{
+		fw3_flush_conntrack(run_state);
+
 		fw3_set_defaults(cfg_state);
 		fw3_run_includes(cfg_state, true);
 		fw3_hotplug_zones(cfg_state, true);
@@ -405,6 +401,35 @@ start:
 }
 
 static int
+gc(void)
+{
+	enum fw3_family family;
+	enum fw3_table table;
+	struct fw3_ipt_handle *handle;
+
+	for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+	{
+		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
+			continue;
+
+		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
+		{
+			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
+				continue;
+
+			if (!(handle = fw3_ipt_open(family, table)))
+				continue;
+
+			fw3_ipt_gc(handle);
+			fw3_ipt_commit(handle);
+			fw3_ipt_close(handle);
+		}
+	}
+
+	return 0;
+}
+
+static int
 lookup_network(const char *net)
 {
 	struct fw3_zone *z;
@@ -521,7 +546,6 @@ int main(int argc, char **argv)
 	}
 
 	build_state(false);
-	build_state(true);
 	defs = &cfg_state->defaults;
 
 	if (optind >= argc)
@@ -552,12 +576,18 @@ int main(int argc, char **argv)
 		print_family = family;
 		fw3_pr_debug = true;
 
-		rv = start();
+		if (fw3_lock())
+		{
+			build_state(true);
+			rv = start();
+			fw3_unlock();
+		}
 	}
 	else if (!strcmp(argv[optind], "start"))
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = start();
 			fw3_unlock();
 		}
@@ -566,6 +596,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = stop(false);
 			fw3_unlock();
 		}
@@ -574,6 +605,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = stop(true);
 			fw3_unlock();
 		}
@@ -582,6 +614,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			stop(true);
 			rv = start();
 			fw3_unlock();
@@ -591,10 +624,19 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = reload();
 			fw3_unlock();
 		}
 	}
+	else if (!strcmp(argv[optind], "gc"))
+	{
+		if (fw3_lock())
+		{
+			rv = gc();
+			fw3_unlock();
+		}
+	}
 	else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 	{
 		rv = lookup_network(argv[optind + 1]);