iptables: fix regression with unintended free in need_protomatch

[project/firewall3.git] / defaults.c

diff --git a/defaults.c b/defaults.c
index 0580bfccccf0e5d4fb9b7704b2f405374cae015d..8a9a9295f00500ca7ba655de111acc643d41b214 100644 (file)
--- a/defaults.c
+++ b/defaults.c
@@ -91,8 +91,8 @@ check_target(struct uci_element *e, bool *available, const char *target, const b
        if (!b)
        {
                warn_elem(e, "requires unavailable target extension %s, disabling", target);
+               *available = false;
        }
-       *available = b;
 }
 
 static void
@@ -126,7 +126,6 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
        struct uci_element *e;
        struct fw3_defaults *defs = &state->defaults;
 
-       bool flow_offload_avaliable = false;
        bool seen = false;
 
        defs->tcp_reject_code      = FW3_REJECT_CODE_TCP_RESET;
@@ -151,6 +150,8 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
                        continue;
                }
 
+               seen = true;
+
                if(!fw3_parse_options(&state->defaults, fw3_flag_opts, s))
                        warn_elem(e, "has invalid options");
 
@@ -161,10 +162,7 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
                check_any_reject_code(e, &defs->any_reject_code);
 
                /* exists in both ipv4 and ipv6, if at all, so only check ipv4 */
-               check_target(e, &flow_offload_avaliable, "FLOWOFFLOAD", false);
-
-               if (!flow_offload_avaliable)
-                       defs->flow_offloading = false;
+               check_target(e, &defs->flow_offloading, "FLOWOFFLOAD", false);
        }
 }
 
@@ -280,8 +278,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 
                if (defs->syn_flood)
                {
-                       r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
-                       fw3_ipt_rule_extra(r, "--syn");
+                       r = fw3_ipt_rule_create(handle, NULL, NULL, NULL, NULL, NULL);
                        fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
                        fw3_ipt_rule_target(r, "RETURN");
                        fw3_ipt_rule_append(r, "syn_flood");