svn commit: r338244 - stable/11/sbin/ipfw

[Andrey V. Elsukov]

Author: ae
Date: Thu Aug 23 13:07:22 2018
New Revision: 338244
URL: https://svnweb.freebsd.org/changeset/base/338244

Log:
  MFC r337536:
    If -q flag is specified, do not complain when we are trying to delete
    nonexistent NAT instance or nonexistent rule.
  
    This allows execute batched `delete` commands and do not fail when
    found nonexistent rule.
  
  MFC r337574:
    Restore the behaviour changed in r337536, when bad `ipfw delete` command
    returns error.
  
    Now -q option only makes it quiet. And when -f flag is specified, the
    command will ignore errors and continue executing with next batched
    command.
  
  Obtained from:	Yandex LLC
  Sponsored by:	Yandex LLC

Modified:
  stable/11/sbin/ipfw/ipfw.8
  stable/11/sbin/ipfw/ipfw2.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sbin/ipfw/ipfw.8
==============================================================================
--- stable/11/sbin/ipfw/ipfw.8	Thu Aug 23 10:38:59 2018	(r338243)
+++ stable/11/sbin/ipfw/ipfw.8	Thu Aug 23 13:07:22 2018	(r338244)
@@ -1,7 +1,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd July 9, 2018
+.Dd August 10, 2018
 .Dt IPFW 8
 .Os
 .Sh NAME
@@ -315,10 +315,15 @@ When listing and
 .Fl d
 is specified, also show expired dynamic rules.
 .It Fl f
-Do not ask for confirmation for commands that can cause problems
-if misused, i.e.,
+Run without prompting for confirmation for commands that can cause problems if misused,
+i.e.,
 .Cm flush .
 If there is no tty associated with the process, this is implied.
+The
+.Cm delete
+command with this flag ignores possible errors,
+i.e., nonexistent rule number.
+And for batched commands execution continues with the next command.
 .It Fl i
 When listing a table (see the
 .Sx LOOKUP TABLES

Modified: stable/11/sbin/ipfw/ipfw2.c
==============================================================================
--- stable/11/sbin/ipfw/ipfw2.c	Thu Aug 23 10:38:59 2018	(r338243)
+++ stable/11/sbin/ipfw/ipfw2.c	Thu Aug 23 13:07:22 2018	(r338244)
@@ -3271,9 +3271,11 @@ ipfw_delete(char *av[])
 			exitval = do_cmd(IP_FW_NAT_DEL, &i, sizeof i);
 			if (exitval) {
 				exitval = EX_UNAVAILABLE;
-				warn("rule %u not available", i);
+				if (co.do_quiet)
+					continue;
+				warn("nat %u not available", i);
 			}
- 		} else if (co.do_pipe) {
+		} else if (co.do_pipe) {
 			exitval = ipfw_delete_pipe(co.do_pipe, i);
 		} else {
 			memset(&rt, 0, sizeof(rt));
@@ -3295,10 +3297,14 @@ ipfw_delete(char *av[])
 			i = do_range_cmd(IP_FW_XDEL, &rt);
 			if (i != 0) {
 				exitval = EX_UNAVAILABLE;
+				if (co.do_quiet)
+					continue;
 				warn("rule %u: setsockopt(IP_FW_XDEL)",
 				    rt.start_rule);
 			} else if (rt.new_set == 0 && do_set == 0) {
 				exitval = EX_UNAVAILABLE;
+				if (co.do_quiet)
+					continue;
 				if (rt.start_rule != rt.end_rule)
 					warnx("no rules rules in %u-%u range",
 					    rt.start_rule, rt.end_rule);
@@ -3308,7 +3314,7 @@ ipfw_delete(char *av[])
 			}
 		}
 	}
-	if (exitval != EX_OK)
+	if (exitval != EX_OK && co.do_force == 0)
 		exit(exitval);
 }