Merge branch 'current' into lithiumlithium

Conflicts:
	debian/changelog

34 files changed, 247 insertions, 73 deletions

diff --git a/debian/changelog b/debian/changelog
index c51a0ce..c0b54d9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,18 @@
-vyatta-cfg-firewall (0.14.0+vyos2+lithium17) unstable; urgency=low
+vyatta-cfg-firewall (0.14.0+vyos2+lithium17) UNRELEASED; urgency=medium
 
-  * Remove dead code from the IPset module.
+  * Sync with current.
 
- -- Daniil Baturin <daniil@baturin.org>  Tue, 22 Dec 2015 21:38:37 +0100
+ -- Daniil Baturin <daniil@baturin.org>  Sun, 24 Jun 2018 12:31:12 +0200
+
+vyatta-cfg-firewall (0.14.0+vyos2+current1) unstable; urgency=medium
+
+  [ Thomas Jepp ]
+  * Fix build depends.
+  * Fix runtime depends.
+
+  [ Kim Hagen ]
+
+ -- Kim Hagen <kim.sidney@gmail.com>  Sun, 24 Jan 2016 15:00:40 -0500
 
 vyatta-cfg-firewall (0.14.0+vyos2+lithium16) unstable; urgency=low
 
diff --git a/debian/control b/debian/control
index 335bd13..7e6cadd 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: vyatta-cfg-firewall
 Section: contrib/net
 Priority: extra
 Maintainer: VyOS Package Maintainers <maintainers@vyos.net>
-Build-Depends: debhelper (>= 5), autotools-dev
+Build-Depends: debhelper (>= 5), autotools-dev, autoconf, automake, cpio
 Standards-Version: 3.9.1
 
 Package: vyatta-cfg-firewall
@@ -23,7 +23,9 @@ Depends: sed (>= 4.1.5),
  sudo,
  snmpd,
  ipset,
- iptables
+ iptables,
+ libswitch-perl,
+ libsnmp-perl
 Replaces: vyatta-cfg-system,
  vyatta-openvpn,
  vyatta-wirelessmodem
diff --git a/gen-interface-policy-templates.pl b/gen-interface-policy-templates.pl
index afea8cf..a86c5d6 100755
--- a/gen-interface-policy-templates.pl
+++ b/gen-interface-policy-templates.pl
@@ -107,16 +107,12 @@ sub gen_firewall_template {
 #
 my %table_help_hash = (
     "route"      => "IPv4 policy route",
-    "local-route" => "IPv4 policy route of local traffic",
     "ipv6-route" => "IPv6 policy route",
-    "ipv6-local-route" => "IPv6 policy route of local traffic",
 );
 
 my %config_association_hash = (
     "route"      => "\"policy route\"",
-    "local-route" => "\"policy local-route\"",
     "ipv6-route" => "\"policy ipv6-route\"",
-    "ipv6-local-route" => "\"policy ipv6-local-route\"",
 );
 
 # Generate the template file at the leaf of the per-interface firewall tree.
@@ -124,10 +120,10 @@ my %config_association_hash = (
 # ruleset on an interface for a particular ruleset type and direction.
 #
 sub gen_template {
-    my ( $if_tree, $direction, $table, $if_name ) = @_;
+    my ( $if_tree, $table, $if_name ) = @_;
 
     if ($debug) {
-        print "debug: table=$table direction=$direction\n";
+        print "debug: table=$table\n";
     }
 
     my $template_dir =
@@ -151,16 +147,16 @@ allowed: local -a params
 	echo -n "\${params[@]}"
 create: ifname=$if_name
 	sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\
-		update \$ifname $direction \$VAR(@) $config_association_hash{$table}
+		update \$ifname in \$VAR(@) $config_association_hash{$table}
 
 update:	ifname=$if_name
 	sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\
-		update \$ifname $direction \$VAR(@) $config_association_hash{$table}
+		update \$ifname in \$VAR(@) $config_association_hash{$table}
 
 
 delete:	ifname=$if_name
 	sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-interfaces \\
-		delete \$ifname $direction \$VAR(@) $config_association_hash{$table}
+		delete \$ifname in \$VAR(@) $config_association_hash{$table}
 EOF
 
     close $tp
@@ -177,10 +173,8 @@ foreach my $if_tree ( keys %interface_hash ) {
     }
 
     gen_firewall_template($if_tree);
-    gen_template( $if_tree, "in", "route", $if_name );
-    gen_template( $if_tree, "out", "local-route", $if_name );
-    gen_template( $if_tree, "in", "ipv6-route", $if_name );
-    gen_template( $if_tree, "out", "ipv6-local-route", $if_name );
+    gen_template( $if_tree, "route", $if_name );
+    gen_template( $if_tree, "ipv6-route", $if_name );
 }
 
 print "Done.\n";
diff --git a/lib/Vyatta/IpTables/AddressFilter.pm b/lib/Vyatta/IpTables/AddressFilter.pm
index 9100c24..9b3be53 100755
--- a/lib/Vyatta/IpTables/AddressFilter.pm
+++ b/lib/Vyatta/IpTables/AddressFilter.pm
@@ -238,31 +238,25 @@ sub rule {
     my ($port_str, $port_err)= getPortRuleString($self->{_port}, $can_use_port,($self->{_srcdst} eq "source") ? "s" : "d",$self->{_protocol});
     return (undef, $port_err) if (!defined($port_str));
     $rule .= $port_str;
-
     # Handle groups last so we can check $group_ok
-    if ($self->{_ip_version} eq "ipv4") {
-
-        # so far ipset only supports IPv4
-        my %group_used = ('address' => 0, 'network' => 0);
-        foreach my $group_type ('address', 'network', 'port') {
-            my $var_name = '_' . $group_type . '_group';
-            if (defined($self->{$var_name})) {
-                $group_used{$group_type} = 1;
-                my $name = $self->{$var_name};
-                if (!$group_ok{$group_type}) {
-                    return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
-                }
-                my $group = new Vyatta::IpTables::IpSet($name, $group_type);
-                my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
-                return ($err_str,) if !defined $set_rule;
-                $rule .= $set_rule;
+    my %group_used = ('address' => 0, 'network' => 0);
+    foreach my $group_type ('address', 'network', 'port') {
+        my $var_name = '_' . $group_type . '_group';
+        if (defined($self->{$var_name})) {
+            $group_used{$group_type} = 1;
+            my $name = $self->{$var_name};
+            if (!$group_ok{$group_type}) {
+                return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
             }
-        }
-        if ($group_used{address} and $group_used{network}) {
-            return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+            my $group = new Vyatta::IpTables::IpSet($name, $group_type);
+            my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
+            return ($err_str,) if !defined $set_rule;
+            $rule .= $set_rule;
         }
     }
-
+    if ($group_used{address} and $group_used{network}) {
+        return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+    }
     return ($rule, undef);
 }
 
diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm
index d6a1d31..dafdf4b 100755
--- a/lib/Vyatta/IpTables/IpSet.pm
+++ b/lib/Vyatta/IpTables/IpSet.pm
@@ -35,6 +35,7 @@ use warnings;
 my %fields = (
     _name   => undef,
     _type   => undef,  # vyatta group type, not ipset type
+    _family => undef,
     _exists => undef,
     _negate => undef,
     _debug  => undef,
@@ -66,7 +67,7 @@ sub INT_handler {
 $SIG{'INT'} = 'INT_handler';
 
 sub new {
-    my ($that, $name, $type) = @_;
+    my ($that, $name, $type, $family) = @_;
 
     my $class = ref($that) || $that;
     my $self = {%fields,};
@@ -76,6 +77,7 @@ sub new {
     }
     $self->{_name} = $name;
     $self->{_type} = $type;
+    $self->{_family} = $family;
 
     bless $self, $class;
     return $self;
@@ -136,6 +138,25 @@ sub get_type {
     return $self->{_type};
 }
 
+sub get_family {
+    my ($self) = @_;
+    return $self->{_family} if defined $self->{_family};
+    return if !$self->exists();
+    my @lines = `ipset -L $self->{_name}`;
+    my $family;
+    foreach my $line (@lines) {
+        if ($line =~ /^Header: family (\w+) hashsize/) {
+            $family = $1;
+            $self->{_family} = $family;
+            last;
+        } elsif ($line =~ /^Type: bitmap:port$/){
+            $self->{_family} = "inet";
+            last;
+        }
+    }
+    return $self->{_family};
+}
+
 sub alphanum_split {
     my ($str) = @_;
     my @list = split m/(?=(?<=\D)\d|(?<=\d)\D)/, $str;
@@ -189,11 +210,13 @@ sub create {
     my $ipset_param = $grouptype_hash{$self->{_type}};
     return "Error: invalid group type\n" if !defined $ipset_param;
 
+    my $cmd = "ipset -N $self->{_name} $ipset_param family $self->{_family}";
+
     if ($self->{_type} eq 'port') {
         $ipset_param .= ' --from 1 --to 65535';
+        $cmd = "ipset -N $self->{_name} $ipset_param";
     }
 
-    my $cmd = "ipset -N $self->{_name} $ipset_param";
     my $rc = $self->run_cmd($cmd);
     return "Error: call to ipset failed [$rc]" if $rc;
     return; # undef
@@ -398,7 +421,7 @@ sub get_firewall_references {
     my @fw_refs = ();
     return @fw_refs if !$self->exists();
     my $config = new Vyatta::Config;
-    foreach my $tree ('name', 'modify') {
+    foreach my $tree ('name', 'ipv6-name', 'modify') {
         my $path = "firewall $tree ";
         $config->setLevel($path);
         my @names = $config->$lfunc();
diff --git a/scripts/firewall/firewall.init.in b/scripts/firewall/firewall.init.in
index 30614bf..98ed54a 100644
--- a/scripts/firewall/firewall.init.in
+++ b/scripts/firewall/firewall.init.in
@@ -62,9 +62,9 @@ start () {
     # user space helpers chain, enables helpers using iptables --helper. 
     # FTP, sip and h323 to use this chain later on.
     iptables -t raw -N VYATTA_CT_HELPER
-    /usr/sbin/nfct add helper rpc inet tcp 
-    /usr/sbin/nfct add helper rpc inet udp 
-    /usr/sbin/nfct add helper tns inet tcp 
+    /usr/sbin/nfct helper add rpc inet tcp 
+    /usr/sbin/nfct helper add rpc inet udp 
+    /usr/sbin/nfct helper add tns inet tcp 
     iptables -t raw -I VYATTA_CT_HELPER -p tcp --dport 111 -j CT --helper rpc
     iptables -t raw -I VYATTA_CT_HELPER -p udp --dport 111 -j CT --helper rpc
     iptables -t raw -I VYATTA_CT_HELPER -p tcp --dport 1521 -j CT --helper tns 
diff --git a/scripts/firewall/vyatta-firewall-trap.pl b/scripts/firewall/vyatta-firewall-trap.pl
index 5a19f7d..159feea 100755
--- a/scripts/firewall/vyatta-firewall-trap.pl
+++ b/scripts/firewall/vyatta-firewall-trap.pl
@@ -280,7 +280,7 @@ my $config = new Vyatta::Config;
 exit 0 if ! is_trap_enabled($config);
 
 # Detect system startup  (i.e., no snmpd running) and just exit.
-my $snmpd_service = `/usr/sbin/invoke-rc.d snmpd status 2> /dev/null`;
+my $snmpd_service = `systemctl status snmpd.service 2> /dev/null`;
 exit 0 if (! $snmpd_service =~ m/snmpd is running/);
 
 # If no trap-targets configured just exit.
diff --git a/scripts/firewall/vyatta-firewall.pl b/scripts/firewall/vyatta-firewall.pl
index c2727cc..f770719 100755
--- a/scripts/firewall/vyatta-firewall.pl
+++ b/scripts/firewall/vyatta-firewall.pl
@@ -553,12 +553,6 @@ sub update_rules {
                 Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: $err_str\n");
                 exit 1;
             }
-        } elsif ("$test_rule_hash{$test_rule}" eq 'deleted') {
-            if (Vyatta::IpTables::Mgr::chain_referenced($table, $name, $iptables_cmd)) {
-                # Disallow deleting a chain if it's still referenced
-                Vyatta::Config::outputError([$tree,$name],"Firewall configuration error: Cannot delete rule set \"$name\" (still in use)\n");
-                exit 1;
-            }
         }
     }
 
diff --git a/scripts/firewall/vyatta-ipset.pl b/scripts/firewall/vyatta-ipset.pl
index 1fa432b..0b7b365 100755
--- a/scripts/firewall/vyatta-ipset.pl
+++ b/scripts/firewall/vyatta-ipset.pl
@@ -67,9 +67,9 @@ sub ipset_reset {
 }
 
 sub ipset_create {
-    my ($set_name, $set_type) = @_;
+    my ($set_name, $set_type, $set_family) = @_;
 
-    my $group = new Vyatta::IpTables::IpSet($set_name, $set_type);
+    my $group = new Vyatta::IpTables::IpSet($set_name, $set_type, $set_family);
 
     return $group->create();
 }
@@ -235,11 +235,30 @@ sub ipset_is_group_used {
     exit 1;
 }
 
+sub ipset_is_group_defined {
+    my ($set_name, $set_type, $set_family) = @_;
+    my $cfg = new Vyatta::Config;
+
+    die "Error: undefined set_name\n" if ! defined $set_name;
+    die "Error: undefined set_type\n" if ! defined $set_type;
+    die "Error: undefined set_family\n" if ! defined $set_family;
+    
+    my $gpath = ($set_family eq 'inet') ? "firewall group ipv6-$set_type-group" : "firewall group $set_type-group";
+    my @groups = $cfg->listOrigNodes($gpath);
+    my $group;
+    foreach $group (@groups) {
+      if ($set_name eq $group) {
+         exit 1;
+      }
+    }
+    exit 0;
+}
+
 sub update_set {
-  my ($set_name, $set_type) = @_;
+  my ($set_name, $set_type, $set_family) = @_;
   my $cfg = new Vyatta::Config;
   my ($rc, $newset);
-  my $cpath = "firewall group $set_type-group $set_name";
+  my $cpath = ($set_family eq 'inet') ? "firewall group $set_type-group $set_name" : "firewall group ipv6-$set_type-group $set_name";
   if ($cfg->existsOrig($cpath)) {
     if (!$cfg->exists($cpath)) {
       # deleted
@@ -249,7 +268,7 @@ sub update_set {
   } else {
     if ($cfg->exists($cpath)) {
       # added
-      return $rc if (($rc = ipset_create($set_name, $set_type)));
+      return $rc if (($rc = ipset_create($set_name, $set_type, $set_family)));
       $newset = 1;
     } else {
       # doesn't exist! should not happen
@@ -322,7 +341,8 @@ sub prune_deleted_sets {
     # only try groups with no references
     if ($group->exists() && ($group->references() == 0)) {
       my $type = $group->get_type();
-      $cfg->setLevel("firewall group $type-group");
+      my $family = $group->get_family();
+      ($family eq 'inet') ? $cfg->setLevel("firewall group $type-group") : $cfg->setLevel("firewall group ipv6-$type-group");
       next if ($cfg->isEffective($set)); # don't prune if still in config
       my $rc;
       $rc = ipset_delete($set);
@@ -358,11 +378,12 @@ sub show_port_groups {
 #
 # main
 #
-my ($action, $set_name, $set_type, $member, $set_copy, $alias);
+my ($action, $set_name, $set_type, $set_family, $member, $set_copy, $alias);
 
 GetOptions("action=s"   => \$action,
            "set-name=s" => \$set_name,
            "set-type=s" => \$set_type,
+           "set-family=s" => \$set_family,
            "member=s"   => \$member,
            "alias=s"    => \$alias,
            "set-copy=s" => \$set_copy,
@@ -377,7 +398,7 @@ show_network_groups() if $action eq 'show-network-groups';
 
 $rc = ipset_reset($set_name, $set_type) if $action eq 'reset-set';
 
-$rc = ipset_create($set_name, $set_type) if $action eq 'create-set';
+$rc = ipset_create($set_name, $set_type, $set_family) if $action eq 'create-set';
 
 $rc = ipset_delete($set_name) if $action eq 'delete-set';
 
@@ -399,8 +420,9 @@ $rc = ipset_is_group_deleted($set_name, $set_type)
     if $action eq 'is-group-deleted';
 
 $rc = ipset_is_group_used($set_name, $set_type) if $action eq 'is-group-used';
+$rc = ipset_is_group_defined($set_name, $set_type, $set_family) if $action eq 'is-group-defined';
 
-$rc = update_set($set_name, $set_type) if $action eq 'update-set';
+$rc = update_set($set_name, $set_type, $set_family) if $action eq 'update-set';
 $rc = prune_deleted_sets() if $action eq 'prune-deleted-sets';
 
 if (defined $rc) {
diff --git a/templates/firewall/group/address-group/node.def b/templates/firewall/group/address-group/node.def
index 13b2e72..d89233d 100644
--- a/templates/firewall/group/address-group/node.def
+++ b/templates/firewall/group/address-group/node.def
@@ -15,7 +15,11 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
 syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
        "Firewall group name cannot contain shell punctuation"
 
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+        --set-type=address --set-family=inet"; \
+      "Firewall group name already used as Ipv6 group address"       
+
 end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
-        --set-name="$VAR(@)" --set-type=address; then
+        --set-name="$VAR(@)" --set-type=address --set-family=inet; then
        ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group address-group $VAR(@)"
      fi
diff --git a/templates/firewall/group/ipv6-address-group/node.def b/templates/firewall/group/ipv6-address-group/node.def
new file mode 100644
index 0000000..20e4430
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.def
@@ -0,0 +1,25 @@
+tag:
+priority: 200
+type: txt
+help: Firewall ipv6-address-group
+
+syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \
+       "Firewall group name must be 31 characters or less"
+
+syntax:expression: pattern $VAR(@) "^[^-]" ; \
+       "Firewall group name cannot start with \"-\""
+
+syntax:expression: pattern $VAR(@) "^[^!]" ; \
+       "Firewall group name cannot start with \"!\""
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
+       "Firewall group name cannot contain shell punctuation"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+        --set-type=address --set-family=inet6"; \
+      "Firewall group name already used as Ipv4 group address"
+
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=address --set-family=inet6; then
+       ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-address-group $VAR(@)"
+     fi
diff --git a/templates/firewall/group/ipv6-address-group/node.tag/address/node.def b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def
new file mode 100644
index 0000000..5bd948b
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.tag/address/node.def
@@ -0,0 +1,9 @@
+multi:
+type: txt
+help: Address-group member
+val_help: ipv6; IPv6 address to match
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>/]*$" ; \
+       "Error [$VAR(@)] isn't valid IPv6 host address"
+       
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)"
diff --git a/templates/firewall/group/ipv6-address-group/node.tag/description/node.def b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def
new file mode 100644
index 0000000..f630483
--- /dev/null
+++ b/templates/firewall/group/ipv6-address-group/node.tag/description/node.def
@@ -0,0 +1,2 @@
+type: txt
+help: IPv6 Address-group description
\ No newline at end of file
diff --git a/templates/firewall/group/ipv6-network-group/node.def b/templates/firewall/group/ipv6-network-group/node.def
new file mode 100644
index 0000000..084fdb0
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.def
@@ -0,0 +1,25 @@
+tag:
+priority: 200
+type: txt
+help: Firewall ipv6-network-group
+
+syntax:expression: pattern $VAR(@) "^[[:graph:]]{1,31}$" ; \
+       "Firewall group name must be 31 characters or less"
+
+syntax:expression: pattern $VAR(@) "^[^-]" ; \
+       "Firewall group name cannot start with \"-\""
+
+syntax:expression: pattern $VAR(@) "^[^!]" ; \
+       "Firewall group name cannot start with \"!\""
+
+syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
+       "Firewall group name cannot contain shell punctuation"
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+        --set-type=network --set-family=inet6"; \
+      "Firewall group name already used as Ipv4 group address"    
+
+end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
+        --set-name="$VAR(@)" --set-type=network --set-family=inet6; then
+        ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group ipv6-network-group $VAR(@)"
+     fi
diff --git a/templates/firewall/group/ipv6-network-group/node.tag/description/node.def b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def
new file mode 100644
index 0000000..cc905df
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.tag/description/node.def
@@ -0,0 +1,2 @@
+type: txt
+help: IPv6-network-group description
diff --git a/templates/firewall/group/ipv6-network-group/node.tag/network/node.def b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def
new file mode 100644
index 0000000..879a164
--- /dev/null
+++ b/templates/firewall/group/ipv6-network-group/node.tag/network/node.def
@@ -0,0 +1,8 @@
+multi:
+type: ipv6net
+help: Network-group member
+val_help: ipv6net; IPv6 Subnet to match
+
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type ipv6_addr_param $VAR(@)"
+
+syntax:expression: exec "/opt/vyatta/sbin/check_prefix_boundary $VAR(@)"
diff --git a/templates/firewall/group/network-group/node.def b/templates/firewall/group/network-group/node.def
index 263a772..14b8366 100644
--- a/templates/firewall/group/network-group/node.def
+++ b/templates/firewall/group/network-group/node.def
@@ -15,8 +15,12 @@ syntax:expression: pattern $VAR(@) "^[^!]" ; \
 syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
        "Firewall group name cannot contain shell punctuation"
 
+syntax:expression: exec "/opt/vyatta/sbin/vyatta-ipset.pl --action=is-group-defined --set-name=$VAR(@) \
+        --set-type=network --set-family=inet"; \
+      "Firewall group name already used as Ipv6 group address"
+
 end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
-        --set-name="$VAR(@)" --set-type=network; then
+        --set-name="$VAR(@)" --set-type=network --set-family=inet; then
         ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group network-group $VAR(@)"
      fi
 
diff --git a/templates/firewall/group/port-group/node.def b/templates/firewall/group/port-group/node.def
index 1484be2..729165f 100644
--- a/templates/firewall/group/port-group/node.def
+++ b/templates/firewall/group/port-group/node.def
@@ -16,6 +16,6 @@ syntax:expression: pattern $VAR(@) "^[^|;&$<>]*$" ; \
        "Firewall group name cannot contain shell punctuation"
 
 end: if sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=update-set \
-        --set-name="$VAR(@)" --set-type=port; then
+        --set-name="$VAR(@)" --set-type=port --set-family=inet; then
         ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall group port-group $VAR(@)"
      fi
diff --git a/templates/firewall/ipv6-name/node.def b/templates/firewall/ipv6-name/node.def
index e7e1167..2e20b9a 100644
--- a/templates/firewall/ipv6-name/node.def
+++ b/templates/firewall/ipv6-name/node.def
@@ -14,17 +14,21 @@ syntax:expression: ! pattern $VAR(@) "^VZONE" ; \
 
 end: if sudo /opt/vyatta/sbin/vyatta-firewall.pl --update-rules "firewall ipv6-name" "$VAR(@)" ;
      then
-       if [ ${COMMIT_ACTION} = 'DELETE' ] ; 
+       if [ ${COMMIT_ACTION} = 'DELETE' ] ;
        then
           if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown-ok "firewall ipv6-name" ;
           then
-             sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall ipv6-name"
+             if sudo /opt/vyatta/sbin/vyatta-firewall.pl --teardown "firewall ipv6-name"; then
+                ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
+             fi
           fi
+       else
+          ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
        fi
      else
        exit 1;
      fi
-     ${vyatta_sbindir}/vyatta-firewall-trap.pl --level="firewall ipv6-name $VAR(@)"
+     sudo /opt/vyatta/sbin/vyatta-ipset.pl --action=prune-deleted-sets
 
 create: sudo /opt/vyatta/sbin/vyatta-firewall.pl --setup ip6tables "firewall ipv6-name"
 
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def
new file mode 100644
index 0000000..961663c
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/address-group/node.def
@@ -0,0 +1,9 @@
+type: txt
+help: Group of addresses
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+                           --action=check-set-type        \
+                           --set-name=$VAR(@)             \
+                           --set-type=address;"
+
+allowed: cli-shell-api listNodes firewall group ipv6-address-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def
new file mode 100644
index 0000000..262c4dd
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/network-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of networks
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+                           --action=check-set-type        \
+                           --set-name=$VAR(@)             \
+                           --set-type=network;"
+allowed: cli-shell-api listNodes firewall group ipv6-network-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def
new file mode 100644
index 0000000..bb11dae
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/node.def
@@ -0,0 +1 @@
+help: Destination group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def
new file mode 100644
index 0000000..985302b
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/destination/group/port-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of ports
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+                           --action=check-set-type        \
+                           --set-name=$VAR(@)             \
+                           --set-type=port;"
+allowed: cli-shell-api listNodes firewall group port-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def
new file mode 100644
index 0000000..9323938
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/address-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of addresses
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+                           --action=check-set-type        \
+                           --set-name=$VAR(@)             \
+                           --set-type=address;"
+allowed: cli-shell-api listNodes firewall group ipv6-address-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def
new file mode 100644
index 0000000..262c4dd
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/network-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of networks
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+                           --action=check-set-type        \
+                           --set-name=$VAR(@)             \
+                           --set-type=network;"
+allowed: cli-shell-api listNodes firewall group ipv6-network-group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def
new file mode 100644
index 0000000..7b36071
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/node.def
@@ -0,0 +1 @@
+help: Source group
diff --git a/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def
new file mode 100644
index 0000000..985302b
--- /dev/null
+++ b/templates/firewall/ipv6-name/node.tag/rule/node.tag/source/group/port-group/node.def
@@ -0,0 +1,8 @@
+type: txt
+help: Group of ports
+
+commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
+                           --action=check-set-type        \
+                           --set-name=$VAR(@)             \
+                           --set-type=port;"
+allowed: cli-shell-api listNodes firewall group port-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def
index 07e791c..272149b 100644
--- a/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/address-group/node.def
@@ -6,4 +6,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
                            --set-name=$VAR(@)             \
                            --set-type=address;"
 
-allowed: cli-shell-api listActiveNodes firewall group address-group
+allowed: cli-shell-api listNodes firewall group address-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def
index bf018a0..54604da 100644
--- a/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/network-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
                            --action=check-set-type        \
                            --set-name=$VAR(@)             \
                            --set-type=network;"
-allowed: cli-shell-api listActiveNodes firewall group network-group
+allowed: cli-shell-api listNodes firewall group network-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def b/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def
index 865d2c5..985302b 100644
--- a/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/destination/group/port-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
                            --action=check-set-type        \
                            --set-name=$VAR(@)             \
                            --set-type=port;"
-allowed: cli-shell-api listActiveNodes firewall group port-group
+allowed: cli-shell-api listNodes firewall group port-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/set/table/node.def b/templates/policy/route/node.tag/rule/node.tag/set/table/node.def
index bb97649..632ed54 100644
--- a/templates/policy/route/node.tag/rule/node.tag/set/table/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/set/table/node.def
@@ -2,6 +2,7 @@ type: txt
 help: Routing table to forward packet with
 val_help: u32:1-200 ; Table number
 val_help: main ; Main table
+allowed: echo main `cli-shell-api listNodes protocols static table`
 syntax:expression: exec "
   if [[ $VAR(@) =~ ^-?[0-9]+$ ]] ; then 
     if [ $VAR(@) -lt 1 -o $VAR(@) -gt 200 ] ; then
diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def
index 97c748d..8506b28 100644
--- a/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/source/group/address-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
                            --action=check-set-type        \
                            --set-name=$VAR(@)             \
                            --set-type=address;"
-allowed: cli-shell-api listActiveNodes firewall group address-group
+allowed: cli-shell-api listNodes firewall group address-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def
index bf018a0..54604da 100644
--- a/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/source/group/network-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
                            --action=check-set-type        \
                            --set-name=$VAR(@)             \
                            --set-type=network;"
-allowed: cli-shell-api listActiveNodes firewall group network-group
+allowed: cli-shell-api listNodes firewall group network-group
diff --git a/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def b/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def
index 865d2c5..985302b 100644
--- a/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def
+++ b/templates/policy/route/node.tag/rule/node.tag/source/group/port-group/node.def
@@ -5,4 +5,4 @@ commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \
                            --action=check-set-type        \
                            --set-name=$VAR(@)             \
                            --set-type=port;"
-allowed: cli-shell-api listActiveNodes firewall group port-group
+allowed: cli-shell-api listNodes firewall group port-group