Flush chain with noflush when it is redefined (Charlie Brady <charlieb-netfilter...

diff --git a/ip6tables-restore.c b/ip6tables-restore.c
index 6909c8d7abd43a472563f7094ab929a28fcb9260..cf69a6c7b299af855f4d1029295a93688c52b556 100644 (file)
--- a/ip6tables-restore.c
+++ b/ip6tables-restore.c
@@ -233,12 +233,21 @@ int main(int argc, char *argv[])
                        }
 
                        if (ip6tc_builtin(chain, handle) <= 0) {
-                               DEBUGP("Creating new chain '%s'\n", chain);
-                               if (!ip6tc_create_chain(chain, &handle))
-                                       exit_error(PARAMETER_PROBLEM,
-                                                  "error creating chain "
-                                                  "'%s':%s\n", chain,
-                                                  strerror(errno));
+                               if (noflush && ip6tc_is_chain(chain, handle)) {
+                                       DEBUGP("Flushing existing user defined chain '%s'\n", chain);
+                                       if (!ip6tc_flush_entries(chain, &handle))
+                                               exit_error(PARAMETER_PROBLEM,
+                                                          "error flushing chain "
+                                                          "'%s':%s\n", chain,
+                                                          strerror(errno));
+                               } else {
+                                       DEBUGP("Creating new chain '%s'\n", chain);
+                                       if (!ip6tc_create_chain(chain, &handle))
+                                               exit_error(PARAMETER_PROBLEM,
+                                                          "error creating chain "
+                                                          "'%s':%s\n", chain,
+                                                          strerror(errno));
+                               }
                        }
 
                        policy = strtok(NULL, " \t\n");

diff --git a/iptables-restore.c b/iptables-restore.c
index 42aa2a27b5f1c0fec6ad635a88b261693389b98c..e2872cde80488bd36ea9bb42bd955b3334a51a22 100644 (file)
--- a/iptables-restore.c
+++ b/iptables-restore.c
@@ -236,12 +236,21 @@ main(int argc, char *argv[])
                        }
 
                        if (iptc_builtin(chain, handle) <= 0) {
-                               DEBUGP("Creating new chain '%s'\n", chain);
-                               if (!iptc_create_chain(chain, &handle)) 
-                                       exit_error(PARAMETER_PROBLEM, 
-                                                  "error creating chain "
-                                                  "'%s':%s\n", chain, 
-                                                  strerror(errno));
+                               if (noflush && iptc_is_chain(chain, handle)) {
+                                       DEBUGP("Flushing existing user defined chain '%s'\n", chain);
+                                       if (!iptc_flush_entries(chain, &handle))
+                                               exit_error(PARAMETER_PROBLEM,
+                                                          "error flushing chain "
+                                                          "'%s':%s\n", chain,
+                                                          strerror(errno));
+                               } else {
+                                       DEBUGP("Creating new chain '%s'\n", chain);
+                                       if (!iptc_create_chain(chain, &handle))
+                                               exit_error(PARAMETER_PROBLEM,
+                                                          "error creating chain "
+                                                          "'%s':%s\n", chain,
+                                                          strerror(errno));
+                               }
                        }
 
                        policy = strtok(NULL, " \t\n");