iptables: fix regression with unintended free in need_protomatch

[project/firewall3.git] / defaults.c

diff --git a/defaults.c b/defaults.c
index 44fe6299a6bffa46474be0c7829e994d461f4426..8a9a9295f00500ca7ba655de111acc643d41b214 100644 (file)
--- a/defaults.c
+++ b/defaults.c
@@ -85,26 +85,14 @@ check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
 }
 
 static void
-check_kmod(struct uci_element *e, bool *module, const char *name)
+check_target(struct uci_element *e, bool *available, const char *target, const bool ipv6)
 {
-       FILE *f;
-       char buf[128];
-
-       if (!*module)
-               return;
-
-       snprintf(buf, sizeof(buf), "/sys/module/%s/refcnt", name);
-
-       f = fopen(buf, "r");
-
-       if (f)
+       const bool b = fw3_has_target(ipv6, target);
+       if (!b)
        {
-               fclose(f);
-               return;
+               warn_elem(e, "requires unavailable target extension %s, disabling", target);
+               *available = false;
        }
-
-       warn_elem(e, sprintf("requires module %s but missing kernel support, disabling", name));
-       *module = false;
 }
 
 static void
@@ -162,6 +150,8 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
                        continue;
                }
 
+               seen = true;
+
                if(!fw3_parse_options(&state->defaults, fw3_flag_opts, s))
                        warn_elem(e, "has invalid options");
 
@@ -171,7 +161,8 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 
                check_any_reject_code(e, &defs->any_reject_code);
 
-               check_kmod(e, &defs->flow_offloading, "xt_FLOWOFFLOAD");
+               /* exists in both ipv4 and ipv6, if at all, so only check ipv4 */
+               check_target(e, &defs->flow_offloading, "FLOWOFFLOAD", false);
        }
 }
 
@@ -203,10 +194,6 @@ fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
 
        for (c = default_chains; c->format; c++)
        {
-               /* don't touch user chains on selective stop */
-               if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
-                       continue;
-
                if (!fw3_is_family(c, handle->family))
                        continue;
 
@@ -217,7 +204,7 @@ fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
                    !fw3_hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
                        continue;
 
-               fw3_ipt_create_chain(handle, c->format);
+               fw3_ipt_create_chain(handle, reload, c->format);
        }
 
        set(defs->flags, handle->family, handle->table);
@@ -229,7 +216,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 {
        int i;
        struct fw3_defaults *defs = &state->defaults;
-       struct fw3_device lodev = { .set = true };
+       struct fw3_device lodev = { .set = true, .name = "lo" };
        struct fw3_protocol tcp = { .protocol = 6 };
        struct fw3_ipt_rule *r;
 
@@ -243,8 +230,6 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
        {
        case FW3_TABLE_FILTER:
 
-               sprintf(lodev.name, "lo");
-
                r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
                fw3_ipt_rule_target(r, "ACCEPT");
                fw3_ipt_rule_append(r, "INPUT");
@@ -293,8 +278,7 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 
                if (defs->syn_flood)
                {
-                       r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
-                       fw3_ipt_rule_extra(r, "--syn");
+                       r = fw3_ipt_rule_create(handle, NULL, NULL, NULL, NULL, NULL);
                        fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
                        fw3_ipt_rule_target(r, "RETURN");
                        fw3_ipt_rule_append(r, "syn_flood");
@@ -389,11 +373,11 @@ static void
 set_default(const char *name, int set)
 {
        FILE *f;
-       char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
+       char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling")];
 
        snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 
-       info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
+       info(" * Set tcp_%s to %s", name, set ? "on" : "off");
 
        if (!(f = fopen(path, "w")))
        {
@@ -437,6 +421,7 @@ fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
        fw3_ipt_delete_id_rules(handle, "PREROUTING");
        fw3_ipt_delete_id_rules(handle, "POSTROUTING");
 
+       /* first flush all the rules ... */
        for (c = default_chains; c->format; c++)
        {
                /* don't touch user chains on selective stop */
@@ -453,13 +438,21 @@ fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        continue;
 
                fw3_ipt_flush_chain(handle, c->format);
+       }
 
-               /* keep certain basic chains that do not depend on any settings to
-                  avoid purging unrelated user rules pointing to them */
-               if (reload && !c->flag)
+       /* ... then remove the chains */
+       for (c = default_chains; c->format; c++)
+       {
+               if (!fw3_is_family(c, handle->family))
+                       continue;
+
+               if (c->table != handle->table)
+                       continue;
+
+               if (c->flag && !has(defs->flags, handle->family, c->flag))
                        continue;
 
-               fw3_ipt_delete_chain(handle, c->format);
+               fw3_ipt_delete_chain(handle, reload, c->format);
        }
 
        del(defs->flags, handle->family, handle->table);