iptables: fix regression with unintended free in need_protomatch

[project/firewall3.git] / main.c

diff --git a/main.c b/main.c
index 1410fef31f3c477363b01f7bf9537b4e80e089f8..7deb6361287f1d3e3d091b29c2c276c6889311ad 100644 (file)
--- a/main.c
+++ b/main.c
@@ -195,9 +195,6 @@ stop(bool complete)
 
                for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
                {
-                       if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-                               continue;
-
                        if (!(handle = fw3_ipt_open(family, table)))
                                continue;
 
@@ -224,8 +221,10 @@ stop(bool complete)
                rv = 0;
        }
 
-       if (run_state)
-               fw3_destroy_ipsets(run_state);
+       if (run_state) {
+               for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+                       fw3_destroy_ipsets(run_state, family, false);
+       }
 
        if (complete)
                fw3_flush_conntrack(NULL);
@@ -244,11 +243,11 @@ start(void)
        enum fw3_table table;
        struct fw3_ipt_handle *handle;
 
-       if (!print_family)
-               fw3_create_ipsets(cfg_state);
-
        for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
        {
+               if (!print_family)
+                       fw3_create_ipsets(cfg_state, family, false);
+
                if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
                        continue;
 
@@ -266,9 +265,6 @@ start(void)
 
                for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
                {
-                       if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-                               continue;
-
                        if (!(handle = fw3_ipt_open(family, table)))
                                continue;
 
@@ -337,9 +333,6 @@ reload(void)
 
                for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
                {
-                       if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-                               continue;
-
                        if (!(handle = fw3_ipt_open(family, table)))
                                continue;
 
@@ -352,6 +345,9 @@ reload(void)
                        fw3_ipt_close(handle);
                }
 
+               fw3_ipsets_update_run_state(family, run_state, cfg_state);
+               fw3_destroy_ipsets(run_state, family, true);
+
                family_set(run_state, family, false);
                family_set(cfg_state, family, false);
 
@@ -359,11 +355,10 @@ start:
                if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
                        continue;
 
+               fw3_create_ipsets(cfg_state, family, true);
+
                for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
                {
-                       if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-                               continue;
-
                        if (!(handle = fw3_ipt_open(family, table)))
                                continue;
 
@@ -419,9 +414,6 @@ gc(void)
 
                for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
                {
-                       if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-                               continue;
-
                        if (!(handle = fw3_ipt_open(family, table)))
                                continue;