Merge branch 'current' into lithiumlithium

Conflicts:
	debian/changelog

2 files changed, 41 insertions, 24 deletions

diff --git a/lib/Vyatta/IpTables/AddressFilter.pm b/lib/Vyatta/IpTables/AddressFilter.pm
index 9100c24..9b3be53 100755
--- a/lib/Vyatta/IpTables/AddressFilter.pm
+++ b/lib/Vyatta/IpTables/AddressFilter.pm
@@ -238,31 +238,25 @@ sub rule {
     my ($port_str, $port_err)= getPortRuleString($self->{_port}, $can_use_port,($self->{_srcdst} eq "source") ? "s" : "d",$self->{_protocol});
     return (undef, $port_err) if (!defined($port_str));
     $rule .= $port_str;
-
     # Handle groups last so we can check $group_ok
-    if ($self->{_ip_version} eq "ipv4") {
-
-        # so far ipset only supports IPv4
-        my %group_used = ('address' => 0, 'network' => 0);
-        foreach my $group_type ('address', 'network', 'port') {
-            my $var_name = '_' . $group_type . '_group';
-            if (defined($self->{$var_name})) {
-                $group_used{$group_type} = 1;
-                my $name = $self->{$var_name};
-                if (!$group_ok{$group_type}) {
-                    return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
-                }
-                my $group = new Vyatta::IpTables::IpSet($name, $group_type);
-                my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
-                return ($err_str,) if !defined $set_rule;
-                $rule .= $set_rule;
+    my %group_used = ('address' => 0, 'network' => 0);
+    foreach my $group_type ('address', 'network', 'port') {
+        my $var_name = '_' . $group_type . '_group';
+        if (defined($self->{$var_name})) {
+            $group_used{$group_type} = 1;
+            my $name = $self->{$var_name};
+            if (!$group_ok{$group_type}) {
+                return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
             }
-        }
-        if ($group_used{address} and $group_used{network}) {
-            return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+            my $group = new Vyatta::IpTables::IpSet($name, $group_type);
+            my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
+            return ($err_str,) if !defined $set_rule;
+            $rule .= $set_rule;
         }
     }
-
+    if ($group_used{address} and $group_used{network}) {
+        return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+    }
     return ($rule, undef);
 }
 
diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm
index d6a1d31..dafdf4b 100755
--- a/lib/Vyatta/IpTables/IpSet.pm
+++ b/lib/Vyatta/IpTables/IpSet.pm
@@ -35,6 +35,7 @@ use warnings;
 my %fields = (
     _name   => undef,
     _type   => undef,  # vyatta group type, not ipset type
+    _family => undef,
     _exists => undef,
     _negate => undef,
     _debug  => undef,
@@ -66,7 +67,7 @@ sub INT_handler {
 $SIG{'INT'} = 'INT_handler';
 
 sub new {
-    my ($that, $name, $type) = @_;
+    my ($that, $name, $type, $family) = @_;
 
     my $class = ref($that) || $that;
     my $self = {%fields,};
@@ -76,6 +77,7 @@ sub new {
     }
     $self->{_name} = $name;
     $self->{_type} = $type;
+    $self->{_family} = $family;
 
     bless $self, $class;
     return $self;
@@ -136,6 +138,25 @@ sub get_type {
     return $self->{_type};
 }
 
+sub get_family {
+    my ($self) = @_;
+    return $self->{_family} if defined $self->{_family};
+    return if !$self->exists();
+    my @lines = `ipset -L $self->{_name}`;
+    my $family;
+    foreach my $line (@lines) {
+        if ($line =~ /^Header: family (\w+) hashsize/) {
+            $family = $1;
+            $self->{_family} = $family;
+            last;
+        } elsif ($line =~ /^Type: bitmap:port$/){
+            $self->{_family} = "inet";
+            last;
+        }
+    }
+    return $self->{_family};
+}
+
 sub alphanum_split {
     my ($str) = @_;
     my @list = split m/(?=(?<=\D)\d|(?<=\d)\D)/, $str;
@@ -189,11 +210,13 @@ sub create {
     my $ipset_param = $grouptype_hash{$self->{_type}};
     return "Error: invalid group type\n" if !defined $ipset_param;
 
+    my $cmd = "ipset -N $self->{_name} $ipset_param family $self->{_family}";
+
     if ($self->{_type} eq 'port') {
         $ipset_param .= ' --from 1 --to 65535';
+        $cmd = "ipset -N $self->{_name} $ipset_param";
     }
 
-    my $cmd = "ipset -N $self->{_name} $ipset_param";
     my $rc = $self->run_cmd($cmd);
     return "Error: call to ipset failed [$rc]" if $rc;
     return; # undef
@@ -398,7 +421,7 @@ sub get_firewall_references {
     my @fw_refs = ();
     return @fw_refs if !$self->exists();
     my $config = new Vyatta::Config;
-    foreach my $tree ('name', 'modify') {
+    foreach my $tree ('name', 'ipv6-name', 'modify') {
         my $path = "firewall $tree ";
         $config->setLevel($path);
         my @names = $config->$lfunc();