summaryrefslogtreecommitdiff
path: root/scripts/firewall/vyatta-ipset.pl
diff options
context:
space:
mode:
Diffstat (limited to 'scripts/firewall/vyatta-ipset.pl')
-rwxr-xr-xscripts/firewall/vyatta-ipset.pl24
1 files changed, 24 insertions, 0 deletions
diff --git a/scripts/firewall/vyatta-ipset.pl b/scripts/firewall/vyatta-ipset.pl
index ddac0b9..0627381 100755
--- a/scripts/firewall/vyatta-ipset.pl
+++ b/scripts/firewall/vyatta-ipset.pl
@@ -37,6 +37,16 @@ use IO::Prompt;
use warnings;
use strict;
+sub get_sys_sets {
+ my @sets = ();
+ my @lines = `ipset -L`;
+ foreach my $line (@lines) {
+ if ($line =~ /^Name:\s+(\w+)$/) {
+ push @sets, $1;
+ }
+ }
+ return @sets;
+}
sub warn_before_reset {
if (prompt("This can be temporarily disruptive: Proceed with reset? (Yes/No) [No] ", -ynd=>"n")) {
@@ -310,6 +320,20 @@ sub prune_deleted_sets {
return $rc if (($rc = ipset_delete($g)));
}
}
+
+ # fixup system sets
+ my @sys_sets = get_sys_sets();
+ foreach my $set (@sys_sets) {
+ my $group = new Vyatta::IpTables::IpSet($set);
+ # only try groups with no references
+ if ($group->exists() && ($group->references() == 0)) {
+ my $type = $group->get_type();
+ $cfg->setLevel("firewall group $type-group");
+ next if ($cfg->isEffective($set)); # don't prune if still in config
+ my $rc;
+ return $rc if (($rc = ipset_delete($set)));
+ }
+ }
exit 0;
}