From 32874b687f69aa6d57beaa95f8c74af89c25ab91 Mon Sep 17 00:00:00 2001
From: Richard Fuchs <rfuchs@sipwise.com>
Date: Thu, 16 Jul 2026 08:48:21 -0400
Subject: [PATCH] MT#55283 split up startup-shutdown

Change-Id: I005e720b3583d98f48ca2ea225497bac49d1b9a5
---
 daemon/kernel.c   | 14 ++------------
 daemon/main.c     | 36 +++++++++++++++++++++++++++++++++++-
 daemon/nftables.c |  4 +---
 include/kernel.h  |  2 ++
 4 files changed, 40 insertions(+), 16 deletions(-)

diff --git a/daemon/kernel.c b/daemon/kernel.c
index 9ff821de7..16c50a060 100644
--- a/daemon/kernel.c
+++ b/daemon/kernel.c
@@ -51,11 +51,11 @@ fail:
 	return false;
 }
 
-static bool kernel_create_table(unsigned int id) {
+bool kernel_create_table(unsigned int id) {
 	return kernel_action_table("add", id);
 }
 
-static bool kernel_delete_table(unsigned int id) {
+bool kernel_delete_table(unsigned int id) {
 	for (unsigned int i = 0; i < 5; i++) {
 		bool ok = kernel_action_table("del", id);
 		if (ok)
@@ -178,16 +178,6 @@ bool kernel_setup_table(unsigned int id) {
 
 	kernel.is_wanted = true;
 
-	if (!kernel_delete_table(id) && errno != ENOENT) {
-		ilog(LOG_ERR, "FAILED TO DELETE KERNEL TABLE %i (%s), KERNEL FORWARDING DISABLED",
-				id, strerror(errno));
-		return false;
-	}
-	if (!kernel_create_table(id)) {
-		ilog(LOG_ERR, "FAILED TO CREATE KERNEL TABLE %i (%s), KERNEL FORWARDING DISABLED",
-				id, strerror(errno));
-		return false;
-	}
 	int fd = kernel_open_table(id);
 	if (fd == -1) {
 		ilog(LOG_ERR, "FAILED TO OPEN KERNEL TABLE %i (%s), KERNEL FORWARDING DISABLED",
diff --git a/daemon/main.c b/daemon/main.c
index 6842619dc..813fb55aa 100644
--- a/daemon/main.c
+++ b/daemon/main.c
@@ -1082,7 +1082,12 @@ static void options(int *argc, char ***argv, charp_ht templates) {
 					});
 			exit(xv);
 		}
-		if (nftables_start)
+		if (nftables_start) {
+			nftables_shutdown(rtpe_config.nftables_chain, rtpe_config.nftables_base_chain,
+					(nftables_args) {
+						.table = rtpe_config.kernel_table,
+						.family = rtpe_config.nftables_family,
+					});
 			err = nftables_setup(rtpe_config.nftables_chain, rtpe_config.nftables_base_chain,
 					(nftables_args) {
 						.table = rtpe_config.kernel_table,
@@ -1090,6 +1095,7 @@ static void options(int *argc, char ***argv, charp_ht templates) {
 						.family = rtpe_config.nftables_family,
 						.xtables = rtpe_config.xtables,
 					});
+		}
 		else // nftables_stop
 			err = nftables_shutdown(rtpe_config.nftables_chain, rtpe_config.nftables_base_chain,
 					(nftables_args) {
@@ -1721,8 +1727,27 @@ static void clib_loop(void) {
 
 static void kernel_setup(void) {
 	g_autoptr(char) err = NULL;
+
 	if (rtpe_config.kernel_table < 0)
 		goto fallback;
+
+#ifndef WITHOUT_NFTABLES
+	// ignore errors
+	nftables_shutdown(rtpe_config.nftables_chain, rtpe_config.nftables_base_chain,
+			(nftables_args) {
+				.table = rtpe_config.kernel_table,
+				.family = rtpe_config.nftables_family,
+			});
+#endif
+
+	if (!kernel_delete_table(rtpe_config.kernel_table) && errno != ENOENT) {
+		ilog(LOG_ERR, "FAILED TO DELETE KERNEL TABLE %i (%s), KERNEL FORWARDING DISABLED",
+				rtpe_config.kernel_table, strerror(errno));
+		if (rtpe_config.no_fallback)
+			die("Userspace fallback disallowed - exiting");
+		goto fallback;
+	}
+
 #ifndef WITHOUT_NFTABLES
 	err = nftables_setup(rtpe_config.nftables_chain, rtpe_config.nftables_base_chain,
 			(nftables_args) {.table = rtpe_config.kernel_table,
@@ -1736,6 +1761,15 @@ static void kernel_setup(void) {
 				"%s", err);
 	}
 #endif
+
+	if (!kernel_create_table(rtpe_config.kernel_table)) {
+		ilog(LOG_ERR, "FAILED TO CREATE KERNEL TABLE %i (%s), KERNEL FORWARDING DISABLED",
+				rtpe_config.kernel_table, strerror(errno));
+		if (rtpe_config.no_fallback)
+			die("Userspace fallback disallowed - exiting");
+		goto fallback;
+	}
+
 	if (!kernel_setup_table(rtpe_config.kernel_table)) {
 		if (rtpe_config.no_fallback)
 			die("Userspace fallback disallowed - exiting");
diff --git a/daemon/nftables.c b/daemon/nftables.c
index 0c8295926..e200dc938 100644
--- a/daemon/nftables.c
+++ b/daemon/nftables.c
@@ -735,9 +735,7 @@ static char *add_table(nfapi_socket *nl, int family) {
 static char *nftables_setup_family(nfapi_socket *nl, int family,
 		const char *chain, const char *base_chain, nftables_args *args)
 {
-	char *err = nftables_shutdown_family(nl, family, chain, base_chain, args);
-	if (err)
-		return err;
+	char *err;
 
 	// create the table in case it doesn't exist
 	err = add_table(nl, family);
diff --git a/include/kernel.h b/include/kernel.h
index 9373fa1e3..88ad9ac16 100644
--- a/include/kernel.h
+++ b/include/kernel.h
@@ -47,6 +47,8 @@ struct kernel_ring_buf {
 
 
 bool kernel_setup_table(unsigned int);
+bool kernel_create_table(unsigned int);
+bool kernel_delete_table(unsigned int);
 bool kernel_init_table(void);
 void kernel_shutdown_table(void);