Bugfix 7613: cleanup firewall groups correctly

1 files changed, 23 insertions, 0 deletions

diff --git a/scripts/firewall/vyatta-ipset.pl b/scripts/firewall/vyatta-ipset.pl
index ef964f3..0070fb4 100755
--- a/scripts/firewall/vyatta-ipset.pl
+++ b/scripts/firewall/vyatta-ipset.pl
@@ -36,6 +36,16 @@ use Sort::Versions;
 use warnings;
 use strict;
 
+sub get_sys_sets {
+    my @sets = ();
+    my @lines = `ipset -L`;
+    foreach my $line (@lines) {
+        if ($line =~ /^Name:\s+(\w+)$/) {
+            push @sets, $1;
+        }
+    }
+    return @sets;
+}
 
 sub ipset_create {
     my ($set_name, $set_type) = @_;
@@ -291,6 +301,19 @@ sub prune_deleted_sets {
       return $rc if (($rc = ipset_delete($g)));
     }
   }
+  # fixup system sets
+  my @sys_sets = get_sys_sets();
+  foreach my $set (@sys_sets) {
+    my $group = new Vyatta::IpTables::IpSet($set);
+    # only try groups with no references
+    if ($group->exists() && ($group->references() == 0)) {
+      my $type = $group->get_type();
+      $cfg->setLevel("firewall group $type-group");
+      next if ($cfg->isEffective($set)); # don't prune if still in config
+      my $rc;
+      return $rc if (($rc = ipset_delete($set)));
+    }
+  }
   exit 0;
 }