diff mbox series

[03/12] rules.pl: Move flush of LOCATIONBLOCK into main flush() function.

Message ID 20220214184257.2406-3-stefan.schantl@ipfire.org
State Accepted
Commit bbeb2a5067f72d0f4073a7a183ed6f1f3477765c
Headers
Series [01/12] location-functions.pl: Rename and set the location for exported databases to "/var/lib/location/ipset/". |

Commit Message

Stefan Schantl Feb. 14, 2022, 6:42 p.m. UTC 
  It is required to get rid of all ipset based rules before all of
the loaded ipset lists can be destroyed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 config/firewall/rules.pl | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Peter Müller Feb. 14, 2022, 9:02 p.m. UTC | #1 
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>

> It is required to get rid of all ipset based rules before all of
> the loaded ipset lists can be destroyed.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
>  config/firewall/rules.pl | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 9d280045a..f685d08a7 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -186,6 +186,9 @@ sub flush {
>  	run("$IPTABLES -t nat -F $CHAIN_NAT_SOURCE");
>  	run("$IPTABLES -t nat -F $CHAIN_NAT_DESTINATION");
>  	run("$IPTABLES -t mangle -F $CHAIN_MANGLE_NAT_DESTINATION_FIX");
> +
> +	# Flush LOCATIONBLOCK chain.
> +	run("$IPTABLES -F LOCATIONBLOCK");
>  }
>  
>  sub buildrules {
> @@ -638,8 +641,7 @@ sub p2pblock {
>  }
>  
>  sub locationblock {
> -	# Flush iptables chain.
> -	run("$IPTABLES -F LOCATIONBLOCK");
> +	# The LOCATIONBLOCK chain now gets flushed by the flush() function.
>  
>  	# If location blocking is not enabled, we are finished here.
>  	if ($locationsettings{'LOCATIONBLOCK_ENABLED'} ne "on") {
Michael Tremer Feb. 15, 2022, 12:42 p.m. UTC | #2 
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

> On 14 Feb 2022, at 18:42, Stefan Schantl <stefan.schantl@ipfire.org> wrote:
> 
> It is required to get rid of all ipset based rules before all of
> the loaded ipset lists can be destroyed.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
> ---
> config/firewall/rules.pl | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
> index 9d280045a..f685d08a7 100644
> --- a/config/firewall/rules.pl
> +++ b/config/firewall/rules.pl
> @@ -186,6 +186,9 @@ sub flush {
> 	run("$IPTABLES -t nat -F $CHAIN_NAT_SOURCE");
> 	run("$IPTABLES -t nat -F $CHAIN_NAT_DESTINATION");
> 	run("$IPTABLES -t mangle -F $CHAIN_MANGLE_NAT_DESTINATION_FIX");
> +
> +	# Flush LOCATIONBLOCK chain.
> +	run("$IPTABLES -F LOCATIONBLOCK");
> }
> 
> sub buildrules {
> @@ -638,8 +641,7 @@ sub p2pblock {
> }
> 
> sub locationblock {
> -	# Flush iptables chain.
> -	run("$IPTABLES -F LOCATIONBLOCK");
> +	# The LOCATIONBLOCK chain now gets flushed by the flush() function.
> 
> 	# If location blocking is not enabled, we are finished here.
> 	if ($locationsettings{'LOCATIONBLOCK_ENABLED'} ne "on") {
> -- 
> 2.30.2
>
diff mbox series

Patch

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 9d280045a..f685d08a7 100644
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -186,6 +186,9 @@  sub flush {
 	run("$IPTABLES -t nat -F $CHAIN_NAT_SOURCE");
 	run("$IPTABLES -t nat -F $CHAIN_NAT_DESTINATION");
 	run("$IPTABLES -t mangle -F $CHAIN_MANGLE_NAT_DESTINATION_FIX");
+
+	# Flush LOCATIONBLOCK chain.
+	run("$IPTABLES -F LOCATIONBLOCK");
 }
 
 sub buildrules {
@@ -638,8 +641,7 @@  sub p2pblock {
 }
 
 sub locationblock {
-	# Flush iptables chain.
-	run("$IPTABLES -F LOCATIONBLOCK");
+	# The LOCATIONBLOCK chain now gets flushed by the flush() function.
 
 	# If location blocking is not enabled, we are finished here.
 	if ($locationsettings{'LOCATIONBLOCK_ENABLED'} ne "on") {