conntrack: T4145: Remove `vyatta-cfg-firewall` dependency

10 files changed, 2025 insertions, 17 deletions

diff --git a/Makefile.am b/Makefile.am
index d35ad8e..f0bbd54 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,6 +1,7 @@
 cfgdir = $(datadir)/vyatta-cfg/templates
 opdir = $(datadir)/vyatta-op/templates
 share_perl5dir	  = $(datarootdir)/perl5/Vyatta/Conntrack
+ipt_share_perl5dir	  = $(datarootdir)/perl5/Vyatta/IpTables
 modprobedir = /etc/modprobe.d
 
 vprefix = /opt/vyatta
@@ -18,6 +19,11 @@ share_perl5_DATA  += lib/Vyatta/Conntrack/ConntrackUtil.pm
 share_perl5_DATA  += lib/Vyatta/Conntrack/RuleCT.pm
 share_perl5_DATA  += lib/Vyatta/Conntrack/RuleIgnore.pm
 
+ipt_share_perl5_DATA = lib/Vyatta/IpTables/Rule.pm
+ipt_share_perl5_DATA  += lib/Vyatta/IpTables/AddressFilter.pm
+ipt_share_perl5_DATA  += lib/Vyatta/IpTables/IpSet.pm
+ipt_share_perl5_DATA  += lib/Vyatta/IpTables/Mgr.pm
+
 sbin_SCRIPTS = scripts/vyatta-update-conntrack-log.pl
 bin_sudo_usersdir = $(bindir)/sudo-users
 bin_sudo_users_SCRIPTS = scripts/vyatta-show-conntrack.pl
diff --git a/debian/control b/debian/control
index 27d56f1..86f79b9 100644
--- a/debian/control
+++ b/debian/control
@@ -12,6 +12,7 @@ Depends: vyatta-cfg-system,
  vyatta-op,
  conntrack,
  conntrackd,
+ libswitch-perl,
  libxml-namespacesupport-perl,
  libxml-sax-base-perl,
  libxml-sax-perl,
diff --git a/lib/Vyatta/Conntrack/ConntrackUtil.pm b/lib/Vyatta/Conntrack/ConntrackUtil.pm
index 0ded3ef..daed392 100644
--- a/lib/Vyatta/Conntrack/ConntrackUtil.pm
+++ b/lib/Vyatta/Conntrack/ConntrackUtil.pm
@@ -50,7 +50,7 @@ our @EXPORT = qw(check_for_conntrack_hooks, process_protocols, check_and_add_hel
 #returns one if any hook is present
 
 sub check_for_conntrack_hooks {
-    my @output = `sudo iptables -L -t raw`; 
+    my @output = `sudo iptables-nft -L -t raw`; 
     foreach(@output) {
         if (($_ =~ m/WEBPROXY_CONNTRACK/)) {
             return 1;
@@ -68,7 +68,7 @@ sub check_for_conntrack_hooks {
 sub
 check_ct_helper_rules {
   my $index;
-  my $cthelper_chain = "VYATTA_CT_HELPER";
+  my $cthelper_chain = "VYOS_CT_HELPER";
     foreach my $label ('PREROUTING', 'OUTPUT') {
       $index = ipt_find_chain_rule($iptables_cmd, 'raw', $label, $cthelper_chain);
       if (!defined($index)) {
diff --git a/lib/Vyatta/IpTables/AddressFilter.pm b/lib/Vyatta/IpTables/AddressFilter.pm
new file mode 100644
index 0000000..9b3be53
--- /dev/null
+++ b/lib/Vyatta/IpTables/AddressFilter.pm
@@ -0,0 +1,289 @@
+# Author: Vyatta <eng@vyatta.com>
+# Date: 2007
+# Description: IP tables address filter
+
+# **** License ****
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# This code was originally developed by Vyatta, Inc.
+# Portions created by Vyatta are Copyright (C) 2006-2009 Vyatta, Inc.
+# All Rights Reserved.
+# **** End License ****
+
+package Vyatta::IpTables::AddressFilter;
+
+require Vyatta::Config;
+require Vyatta::IpTables::IpSet;
+use Vyatta::Misc qw(getPortRuleString);
+use Vyatta::TypeChecker;
+
+use strict;
+use warnings;
+
+my %_protocolswithports = (
+    tcp_udp => 1,
+
+    # 'tcp_udp' is to be allowed for nat and firewall rules only.
+    # features should have syntax checks for allowing or forbiding
+    # the use of 'tcp_udp' as protocol. to allow tcp_udp see syntax check
+    # in protocol/node.def for NAT rules and to forbid tcp_udp see syntax
+    # check in protocol/node.def for load-balancing rules
+    # when allowed : tcp_udp creates 2 iptable rules - one for tcp, other for udp
+    tcp => 1,
+    udp => 1,
+    6   => 1,
+    17  => 1,
+);
+
+my %fields = (
+    _srcdst        => undef,
+    _range_start   => undef,
+    _range_stop    => undef,
+    _network       => undef,
+    _address       => undef,
+    _port          => undef,
+    _protocol      => undef,
+    _src_mac       => undef,
+    _ip_version    => undef,
+    _address_group => undef,
+    _network_group => undef,
+    _port_group    => undef,
+);
+
+sub new {
+    my $that = shift;
+    my $class = ref($that) || $that;
+    my $self = {%fields,};
+
+    bless $self, $class;
+    return $self;
+}
+
+sub set_ip_version {
+    my ($self, $ip_version) = @_;
+
+    $self->{_ip_version} = $ip_version;
+}
+
+sub setup_base {
+    my ($self, $level, $func) = @_;
+    my $config = new Vyatta::Config;
+
+    $config->setLevel("$level");
+
+    # Default to IPv4.
+    $self->{_ip_version} = "ipv4";
+
+    # setup needed parent nodes
+    $self->{_srcdst} = $config->returnParent("..");
+    $self->{_protocol} = $config->$func(".. protocol");
+
+    # setup address filter nodes
+    $self->{_address} = $config->$func("address");
+    $self->{_network} = undef;
+    $self->{_range_start} = undef;
+    $self->{_range_stop} = undef;
+    if (defined($self->{_address})) {
+        if ($self->{_address} =~ /\//) {
+            $self->{_network} = $self->{_address};
+            $self->{_address} = undef;
+        } elsif ($self->{_address} =~ /^([^-]+)-([^-]+)$/) {
+            $self->{_range_start} = $1;
+            $self->{_range_stop} = $2;
+            $self->{_address} = undef;
+        }
+    }
+
+    $self->{_port} = $config->$func("port");
+    $self->{_src_mac} = $config->$func("mac-address");
+    $self->{_address_group} = $config->$func("group address-group");
+    $self->{_network_group} = $config->$func("group network-group");
+    $self->{_port_group} = $config->$func("group port-group");
+
+    return 0;
+}
+
+sub setup {
+    my ($self, $level) = @_;
+
+    $self->setup_base($level, 'returnValue');
+    return 0;
+}
+
+sub setupOrig {
+    my ($self, $level) = @_;
+
+    $self->setup_base($level, 'returnOrigValue');
+    return 0;
+}
+
+sub print {
+    my ($self) = @_;
+
+    print "srcdst: $self->{_srcdst}\n"            if defined $self->{_srcdst};
+    print "range start: $self->{_range_start}\n"  if defined $self->{_range_start};
+    print "range stop: $self->{_range_stop}\n"    if defined $self->{_range_stop};
+    print "network: $self->{_network}\n"          if defined $self->{_network};
+    print "address: $self->{_address}\n"          if defined $self->{_address};
+    print "port: $self->{_port}\n"                if defined $self->{_port};
+    print "protocol: $self->{_protocol}\n"        if defined $self->{_protocol};
+    print "src-mac: $self->{_src_mac}\n"          if defined $self->{_src_mac};
+
+    return 0;
+}
+
+sub rule {
+    my ($self) = @_;
+    my $rule = "";
+    my $can_use_port = 1;
+
+    my $addr_checker;
+    my $prefix_checker;
+    my $pure_addr_checker;
+    my $ip_term;
+    my $prefix_term;
+
+    if ($self->{_ip_version} eq "ipv4") {
+        # This is an IPv4 rule
+        $addr_checker = 'ipv4_negate';
+        $prefix_checker = 'ipv4net_negate';
+        $pure_addr_checker = 'ipv4';
+        $ip_term = "IPv4";
+        $prefix_term = "subnet";
+    } elsif ($self->{_ip_version} eq "ipv6") {
+        # This is an IPv6 rule
+        $addr_checker = 'ipv6_negate';
+        $prefix_checker = 'ipv6net_negate';
+        $pure_addr_checker = 'ipv6';
+        $ip_term = "IPv6";
+        $prefix_term = "prefix";
+    } else {
+        return (undef, "Invalid IP version: $self->{_ip_version}");
+    }
+
+    if (   !defined($self->{_protocol})
+        || !defined($_protocolswithports{$self->{_protocol}}))
+    {
+        $can_use_port = 0;
+    }
+
+    if (($self->{_srcdst} eq "source") && (defined($self->{_src_mac}))) {
+
+        # handle src mac
+        my $str = $self->{_src_mac};
+        my $negate = '';
+        if ($str =~ /^\!(.*)$/) {
+            $str = $1;
+            $negate = '! ';
+        }
+        $rule .= "-m mac $negate --mac-source $str ";
+    }
+
+    my %group_ok;
+    foreach my $group_type ('address', 'network', 'port') {
+        $group_ok{$group_type} = 1;
+    }
+
+    # set the address filter parameters
+    if (defined($self->{_network})) {
+        my $str = $self->{_network};
+        return (undef, "\"$str\" is not a valid $ip_term $prefix_term")
+            if (!Vyatta::TypeChecker::validateType($prefix_checker, $str, 1));
+        my $negate = '';
+        if ($str =~ /^\!(.*)$/) {
+            $str = $1;
+            $negate = '! ';
+        }
+        $rule .= "$negate --$self->{_srcdst} $str ";
+        $group_ok{network} = 0;
+    } elsif (defined($self->{_address})) {
+        my $str = $self->{_address};
+        return (undef, "\"$str\" is not a valid $ip_term address")
+            if (!Vyatta::TypeChecker::validateType($addr_checker, $str, 1));
+        my $negate = '';
+        if ($str =~ /^\!(.*)$/) {
+            $str = $1;
+            $negate = '! ';
+        }
+        $rule .= "$negate --$self->{_srcdst} $str ";
+        $group_ok{address} = 0;
+    } elsif ((defined $self->{_range_start}) && (defined $self->{_range_stop})) {
+        my $start = $self->{_range_start};
+        my $stop = $self->{_range_stop};
+        return (undef, "\"$start-$stop\" is not a valid IP range")
+            if (   !Vyatta::TypeChecker::validateType($addr_checker, $start, 1)
+                || !Vyatta::TypeChecker::validateType($pure_addr_checker, $stop, 1));
+        my $negate = '';
+        if ($self->{_range_start} =~ /^!(.*)$/) {
+            $start  = $1;
+            $negate = '! ';
+        }
+        if ("$self->{_srcdst}" eq "source") {
+            $rule .= ("-m iprange $negate --src-range $start-$self->{_range_stop} ");
+        }elsif ("$self->{_srcdst}" eq "destination") {
+            $rule .= ("-m iprange $negate --dst-range $start-$self->{_range_stop} ");
+        }
+        $group_ok{address} = 0;
+        $group_ok{network} = 0;
+    }
+
+    $group_ok{port} = 0 if defined $self->{_port};
+    my ($port_str, $port_err)= getPortRuleString($self->{_port}, $can_use_port,($self->{_srcdst} eq "source") ? "s" : "d",$self->{_protocol});
+    return (undef, $port_err) if (!defined($port_str));
+    $rule .= $port_str;
+    # Handle groups last so we can check $group_ok
+    my %group_used = ('address' => 0, 'network' => 0);
+    foreach my $group_type ('address', 'network', 'port') {
+        my $var_name = '_' . $group_type . '_group';
+        if (defined($self->{$var_name})) {
+            $group_used{$group_type} = 1;
+            my $name = $self->{$var_name};
+            if (!$group_ok{$group_type}) {
+                return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type");
+            }
+            my $group = new Vyatta::IpTables::IpSet($name, $group_type);
+            my ($set_rule, $err_str) = $group->rule($self->{_srcdst});
+            return ($err_str,) if !defined $set_rule;
+            $rule .= $set_rule;
+        }
+    }
+    if ($group_used{address} and $group_used{network}) {
+        return (undef,"Can't combine network and address group for $self->{_srcdst}\n");
+    }
+    return ($rule, undef);
+}
+
+sub outputXmlElem {
+    my ($name, $value, $fh) = @_;
+    return if !defined $value;
+    print $fh "    <$name>$value</$name>\n";
+}
+
+sub outputXml {
+    my ($self, $prefix, $fh) = @_;
+    if (   !defined($self->{_address})
+        && !defined($self->{_network})
+        && !defined($self->{_range_start})
+        && !defined($self->{_range_stop}))
+    {
+        if (($self->{_ip_version} eq "ipv4")) {
+            $self->{_address} = "0.0.0.0/0";
+        } else {
+            $self->{_address} = "::/0";
+        }
+    }
+    outputXmlElem("${prefix}_addr", $self->{_address}, $fh);
+    outputXmlElem("${prefix}_net", $self->{_network}, $fh);
+    outputXmlElem("${prefix}_addr_start", $self->{_range_start}, $fh);
+    outputXmlElem("${prefix}_addr_stop", $self->{_range_stop}, $fh);
+    outputXmlElem("${prefix}_port", $self->{_port}, $fh);
+}
+
+1;
diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm
new file mode 100644
index 0000000..d7a014a
--- /dev/null
+++ b/lib/Vyatta/IpTables/IpSet.pm
@@ -0,0 +1,554 @@
+#
+# Module: IpSet.pm
+#
+# **** License ****
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# This code was originally developed by Vyatta, Inc.
+# Portions created by Vyatta are Copyright (C) 2009-2010 Vyatta, Inc.
+# All Rights Reserved.
+#
+# Author: Stig Thormodsrud
+# Date: January 2009
+# Description: vyatta interface to ipset
+#
+# **** End License ****
+#
+
+package Vyatta::IpTables::IpSet;
+
+use Vyatta::Config;
+use Vyatta::TypeChecker;
+use Vyatta::Misc;
+use NetAddr::IP;
+
+use strict;
+use warnings;
+
+my %fields = (
+    _name   => undef,
+    _type   => undef,  # vyatta group type, not ipset type
+    _family => undef,
+    _exists => undef,
+    _negate => undef,
+    _debug  => undef,
+);
+
+our %grouptype_hash = (
+    'address' => 'hash:ip',
+    'network' => 'hash:net',
+    'port'    => 'bitmap:port'
+);
+
+my $logger = 'logger -t IpSet.pm -p local0.warn --';
+
+# Currently we restrict an address range to a /24 even
+# though ipset would support a /16.  The main reason is
+# due to the long time it takes to make that many calls
+# to add each individual member to the set.
+my $addr_range_mask = 24;
+my $lockfile = "/opt/vyatta/config/.lock";
+
+# remove lock file to avoid commit blockade on interrupt
+# like CTRL+C.
+sub INT_handler {
+    my $rc = system("sudo rm -f $lockfile >>/dev/null");
+    exit(0);
+}
+
+$SIG{'INT'} = 'INT_handler';
+
+sub new {
+    my ($that, $name, $type, $family) = @_;
+
+    my $class = ref($that) || $that;
+    my $self = {%fields,};
+    if ($name =~ m/^!/) {
+        $self->{_negate} = 1;
+        $name =~ s/^!(.*)$/$1/;
+    }
+    $self->{_name} = $name;
+    $self->{_type} = $type;
+    $self->{_family} = $family;
+
+    bless $self, $class;
+    return $self;
+}
+
+sub debug {
+    my ($self, $onoff) = @_;
+
+    $self->{_debug} = undef;
+    $self->{_debug} = 1 if $onoff eq "on";
+}
+
+sub run_cmd {
+    my ($self, $cmd) = @_;
+
+    my $rc = system("sudo $cmd");
+    if (defined $self->{_debug}) {
+        my $func = (caller(1))[3];
+        system("$logger [$func] [$cmd] = [$rc]");
+    }
+    return $rc;
+}
+
+sub exists {
+    my ($self) = @_;
+
+    return 1 if   defined $self->{_exists};
+    return 0 if !defined $self->{_name};
+    my $cmd = "ipset -L $self->{_name} > /dev/null 2>&1";
+    my $rc = $self->run_cmd($cmd);
+    if ($rc eq 0) {
+        $self->{_exists} = 1;
+        $self->get_type() if !defined $self->{_type};
+    }
+    return $rc ? 0 : 1;
+}
+
+sub get_type {
+    my ($self) = @_;
+
+    return $self->{_type} if defined $self->{_type};
+    return if !$self->exists();
+    my @lines = `ipset -L $self->{_name}`;
+    my $type;
+    foreach my $line (@lines) {
+        if ($line =~ /^Type:\s+([\w:]+)$/) {
+            $type = $1;
+            last;
+        }
+    }
+    return if !defined $type;
+    foreach my $vtype (keys(%grouptype_hash)) {
+        if ($grouptype_hash{$vtype} eq $type) {
+            $self->{_type} = $vtype;
+            last;
+        }
+    }
+    return $self->{_type};
+}
+
+sub get_family {
+    my ($self) = @_;
+    return $self->{_family} if defined $self->{_family};
+    return if !$self->exists();
+    my @lines = `ipset -L $self->{_name}`;
+    my $family;
+    foreach my $line (@lines) {
+        if ($line =~ /^Header: family (\w+) hashsize/) {
+            $family = $1;
+            $self->{_family} = $family;
+            last;
+        } elsif ($line =~ /^Type: bitmap:port$/){
+            $self->{_family} = "inet";
+            last;
+        }
+    }
+    return $self->{_family};
+}
+
+sub alphanum_split {
+    my ($str) = @_;
+    my @list = split m/(?=(?<=\D)\d|(?<=\d)\D)/, $str;
+    return @list;
+}
+
+sub natural_order {
+    my ($a, $b) = @_;
+    my @a = alphanum_split($a);
+    my @b = alphanum_split($b);
+
+    while (@a && @b) {
+        my $a_seg = shift @a;
+        my $b_seg = shift @b;
+        my $val;
+        if (($a_seg =~ /\d/) && ($b_seg =~ /\d/)) {
+            $val = $a_seg <=> $b_seg;
+        } else {
+            $val = $a_seg cmp $b_seg;
+        }
+        if ($val != 0) {
+            return $val;
+        }
+    }
+    return @a <=> @b;
+}
+
+sub get_members {
+    my ($self) = @_;
+
+    my @members = ();
+    return @members if !$self->exists();
+
+    my @lines = `ipset -L $self->{_name} -s`;
+    foreach my $line (@lines) {
+        push @members, $line if $line =~ /^\d/;
+    }
+    if ($self->{_type} ne 'port') {
+        @members = sort {natural_order($a,$b)} @members;
+    }
+    return @members;
+}
+
+sub create {
+    my ($self) = @_;
+
+    return "Error: undefined group name" if !defined $self->{_name};
+    return "Error: undefined group type" if !defined $self->{_type};
+    return if $self->exists(); # treat as nop if already exists
+
+    my $ipset_param = $grouptype_hash{$self->{_type}};
+    return "Error: invalid group type\n" if !defined $ipset_param;
+
+    my $cmd = "ipset -N $self->{_name} $ipset_param family $self->{_family}";
+
+    if ($self->{_type} eq 'port') {
+        $ipset_param .= ' --from 1 --to 65535';
+        $cmd = "ipset -N $self->{_name} $ipset_param";
+    }
+
+    my $rc = $self->run_cmd($cmd);
+    return "Error: call to ipset failed [$rc]" if $rc;
+    return; # undef
+}
+
+sub references {
+    my ($self) = @_;
+
+    return 0 if !$self->exists();
+    my @lines = `ipset -L $self->{_name}`;
+    foreach my $line (@lines) {
+        if ($line =~ /^References:\s+(\d+)$/) {
+            return $1;
+        }
+    }
+    return 0;
+}
+
+sub flush {
+    my ($self) = @_;
+    my $cmd = "ipset flush $self->{_name}";
+    my $rc = $self->run_cmd($cmd);
+    return "Error: call to ipset failed [$rc]" if $rc;
+    return;
+}
+
+sub rebuild_ipset() {
+    my ($self) = @_;
+    my $name = $self->{_name};
+    my $type = $self->{_type};
+    my $config = new Vyatta::Config;
+
+    my @members = $config->returnOrigValues("firewall group $type-group $name $type");
+
+    # go through the firewall group config with this name,
+    my $member;
+    foreach $member (@members) {
+        $self->add_member($member, $name);
+    }
+}
+
+sub reset_ipset_named {
+    my ($self) = @_;
+    my $name = $self->{_name};
+
+    # flush the ipset group first, then re-build the group from configuration
+    $self->flush();
+
+    $self->rebuild_ipset();
+}
+
+sub reset_ipset_all {
+    my $config = new Vyatta::Config;
+    my @pgroups = $config->listOrigNodes("firewall group port-group");
+    my @adgroups = $config->listOrigNodes("firewall group address-group");
+    my @nwgroups = $config->listOrigNodes("firewall group network-group");
+    my $group;
+
+    foreach $group (@pgroups) {
+        my $grp = new Vyatta::IpTables::IpSet($group, "port");
+        $grp->reset_ipset_named();
+    }
+    foreach $group (@adgroups) {
+        my $grp = new Vyatta::IpTables::IpSet($group, "address");
+        $grp->reset_ipset_named();
+    }
+    foreach $group (@nwgroups) {
+        my $grp = new Vyatta::IpTables::IpSet($group, "network");
+        $grp->reset_ipset_named();
+    }
+}
+
+sub reset_ipset {
+
+    # main function to do the reset operation
+    my ($self) = @_;
+    my $name = $self->{_name};
+
+    my $lockcmd = "touch $lockfile";
+    my $unlockcmd = "rm -f $lockfile";
+    $self->run_cmd($lockcmd);
+
+    # reset one rule or all?
+    if ($name eq 'all') {
+        $self->reset_ipset_all();
+    } else {
+        $self->reset_ipset_named();
+    }
+    my $rc = $self->run_cmd($unlockcmd);
+    return "Error: call to ipset failed [$rc]" if $rc;
+    return; # undef
+}
+
+sub delete {
+    my ($self) = @_;
+
+    return "Error: undefined group name" if !defined $self->{_name};
+    return "Error: group [$self->{_name}] doesn't exists\n" if !$self->exists();
+
+    my $refs = $self->references();
+    if ($refs > 0) {
+
+        # still in use
+        if (scalar($self->get_firewall_references(1)) > 0) {
+
+            # still referenced by config
+            return "Error: group [$self->{_name}] still in use.\n";
+        }
+
+        # not referenced by config => simultaneous deletes. just do flush.
+        return $self->flush();
+    }
+
+    my $cmd = "ipset -X $self->{_name}";
+    my $rc = $self->run_cmd($cmd);
+    return "Error: call to ipset failed [$rc]" if $rc;
+    return; # undef
+}
+
+sub check_member_address {
+    my $member = shift;
+
+    if (!Vyatta::TypeChecker::validateType('ipv4', $member, 1)) {
+        return "Error: [$member] isn't valid IPv4 address\n";
+    }
+    if ($member eq '0.0.0.0') {
+        return "Error: zero IP address not valid in address-group\n";
+    }
+    return;
+}
+
+sub check_member {
+    my ($self, $member) = @_;
+
+    return "Error: undefined group name" if !defined $self->{_name};
+    return "Error: undefined group type" if !defined $self->{_type};
+
+    # We can't call $self->member_exists() here since this is a
+    # syntax check and the group may not have been created yet
+    # if there hasn't been a commit yet on this group.  Move the
+    # exists check to $self->add_member().
+
+    if ($self->{_type} eq 'address') {
+        if ($member =~ /^([^-]+)-([^-]+)$/) {
+            foreach my $address ($1, $2) {
+                my $rc = check_member_address($address);
+                return $rc if defined $rc;
+            }
+            my $start_ip = new NetAddr::IP($1);
+            my $stop_ip  = new NetAddr::IP($2);
+            if ($stop_ip <= $start_ip) {
+                return "Error: $1 must be less than $2\n";
+            }
+            my $start_net = new NetAddr::IP("$1/$addr_range_mask");
+            if (!$start_net->contains($stop_ip)) {
+                return "Error: address range must be within /$addr_range_mask\n";
+            }
+
+        } else {
+            my $rc = check_member_address($member);
+            return $rc if defined $rc;
+        }
+    } elsif ($self->{_type} eq 'network') {
+        if (!Vyatta::TypeChecker::validateType('ipv4net', $member, 1)) {
+            return "Error: [$member] isn't a valid IPv4 network\n";
+        }
+        if ($member =~ /([\d.]+)\/(\d+)/) {
+            my ($net, $mask) = ($1, $2);
+            return "Error: 0.0.0.0/0 invalid in network-group\n"
+                if (($net eq '0.0.0.0') and ($mask == 0));
+            return "Error: invalid mask [$mask] - must be between 1-31\n"
+                if (($mask < 1) or ($mask > 31));
+        } else {
+            return "Error: Invalid network group [$member]\n";
+        }
+    } elsif ($self->{_type} eq 'port') {
+        my ($success, $err) = (undef, "invalid port [$member]");
+        if ($member =~ /^(\d+)-(\d+)$/) {
+            ($success, $err) = Vyatta::Misc::isValidPortRange($member, '-');
+        } elsif ($member =~ /^\d/) {
+            ($success, $err) = Vyatta::Misc::isValidPortNumber($member);
+        } else {
+            ($success, $err) = Vyatta::Misc::isValidPortName($member);
+        }
+        return "Error: $err\n" if defined $err;
+    } else {
+        return "Error: invalid set type [$self->{_type}]";
+    }
+    return; #undef
+}
+
+sub member_exists {
+    my ($self, $member) = @_;
+
+    # check if a member is a port range and roll through all members it is
+    if ($member =~ /([\d]+)-([\d]+)/) {
+        foreach my $port ($1..$2) {
+            # test port with ipset
+            my $cmd = "ipset -T $self->{_name} $port -q";
+            my $rc = $self->run_cmd($cmd);
+            # return true if port was found
+            return 1 if !$rc;
+        }
+        # return false if ports was not found in set
+        return 0;
+    } else {
+        my $cmd = "ipset -T $self->{_name} $member -q";
+        my $rc = $self->run_cmd($cmd);
+        return $rc ? 0 : 1;
+    }
+}
+
+
+sub add_member {
+    my ($self, $member, $alias, $hyphenated_port) = @_;
+
+    return "Error: undefined group name" if !defined $self->{_name};
+    return "Error: group [$self->{_name}] doesn't exists\n" if !$self->exists();
+
+    if ($self->member_exists($member)) {
+        my $set_name = $alias;
+        $set_name = $self->{_name} if !defined $set_name;
+        return "Error: member [$member] already exists in [$set_name]\n";
+    }
+    my $cmd = "ipset -A $self->{_name} $member";
+    my $rc = $self->run_cmd($cmd);
+    return "Error: call to ipset failed [$rc]" if $rc;
+    return; # undef
+}
+
+sub delete_member_range {
+    my ($self, $start, $stop) = @_;
+
+    if ($self->{_type} eq 'port') {
+        foreach my $member ($start .. $stop) {
+            my $rc = $self->delete_member($member);
+            return $rc if defined $rc;
+        }
+    } elsif ($self->{_type} eq 'address') {
+        my $start_ip = new NetAddr::IP("$start/$addr_range_mask");
+        my $stop_ip  = new NetAddr::IP("$stop/$addr_range_mask");
+        for (; $start_ip <= $stop_ip; $start_ip++) {
+            my $rc = $self->delete_member($start_ip->addr());
+            return $rc if defined $rc;
+            last if $start_ip->cidr() eq $start_ip->broadcast();
+        }
+    }
+    return;
+}
+
+sub delete_member {
+    my ($self, $member, $hyphenated_port) = @_;
+
+    return "Error: undefined group name" if !defined $self->{_name};
+    return "Error: group [$self->{_name}] doesn't exists\n" if !$self->exists();
+
+    # service name or port name may contain a hyphen, which needs to be escaped
+    # using square brackets in ipset, to avoid confusion with port ranges
+    if (($member =~ /^([^-]+)-([^-]+)$/) and ((defined($hyphenated_port)) and ($hyphenated_port eq 'false'))) {
+        return $self->delete_member_range($1, $2);
+    }
+
+    if (!$self->member_exists($member)) {
+        return "Error: member [$member] doesn't exists in [$self->{_name}]\n";
+    }
+    my $cmd = "ipset -D $self->{_name} $member";
+    my $rc = $self->run_cmd($cmd);
+    return "Error: call to ipset failed [$rc]" if $rc;
+    return; # undef
+}
+
+sub get_description {
+    my ($self) = @_;
+
+    return if !$self->exists();
+    my $config = new Vyatta::Config;
+    my $group_type = "$self->{_type}-group";
+    $config->setLevel("firewall group $group_type $self->{_name}");
+    return $config->returnOrigValue('description');
+}
+
+sub get_firewall_references {
+    my ($self, $working) = @_;
+    my ($lfunc, $vfunc) = qw(listOrigNodes returnOrigValue);
+    if ($working) {
+        ($lfunc, $vfunc) = qw(listNodes returnValue);
+    }
+    my @fw_refs = ();
+    return @fw_refs if !$self->exists();
+    my $config = new Vyatta::Config;
+    foreach my $tree ('name', 'ipv6-name', 'modify') {
+        my $path = "firewall $tree ";
+        $config->setLevel($path);
+        my @names = $config->$lfunc();
+        foreach my $name (@names) {
+            my $name_path = "$path $name rule ";
+            $config->setLevel($name_path);
+            my @rules = $config->$lfunc();
+            foreach my $rule (@rules) {
+                foreach my $dir ('source', 'destination') {
+                    my $rule_path = "$name_path $rule $dir group";
+                    $config->setLevel($rule_path);
+                    my $group_type = "$self->{_type}-group";
+                    my $value =  $config->$vfunc($group_type);
+                    $value =~ s/^!(.*)$/$1/ if defined $value;
+                    if (defined $value and $self->{_name} eq $value) {
+                        push @fw_refs, "$name-$rule-$dir";
+                    }
+                } # foreach $dir
+            } # foreach $rule
+        } # foreach $name
+    } # foreach $tree
+    return @fw_refs;
+}
+
+sub rule {
+    my ($self, $direction) = @_;
+
+    if (!$self->exists()) {
+        my $name = $self->{_name};
+        $name = 'undefined' if !defined $name;
+        return (undef, "Undefined group [$name]");
+    }
+
+    my $srcdst;
+    my $grp = $self->{_name};
+    $srcdst = 'src' if $direction eq 'source';
+    $srcdst = 'dst' if $direction eq 'destination';
+
+    return (undef, "Invalid direction [$direction]") if !defined $srcdst;
+    my $opt = '';
+    $opt = '!' if $self->{_negate};
+    return (" -m set $opt --match-set $grp $srcdst ",);
+}
+
+1;
diff --git a/lib/Vyatta/IpTables/Mgr.pm b/lib/Vyatta/IpTables/Mgr.pm
new file mode 100644
index 0000000..39a03f1
--- /dev/null
+++ b/lib/Vyatta/IpTables/Mgr.pm
@@ -0,0 +1,341 @@
+#
+# Module: Vyatta::IpTables::Mgr.pm
+#
+# **** License ****
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# This code was originally developed by Vyatta, Inc.
+# Portions created by Vyatta are Copyright (C) 2010 Vyatta, Inc.
+# All Rights Reserved.
+#
+# Author: Stig Thormodsrud
+# Date: June 2010
+# Description: common iptables routines
+#
+# **** End License ****
+#
+
+package Vyatta::IpTables::Mgr;
+
+use strict;
+use warnings;
+
+use base 'Exporter';
+our @EXPORT = qw(ipt_find_chain_rule ipt_enable_conntrack
+    ipt_disable_conntrack count_iptables_rules
+    chain_referenced ipt_get_queue_target
+    run_ipt_cmd create_ipt_chain delete_ipt_chain
+    flush_ipt_chain insert_ipt_rule append_ipt_rule
+    delete_ipt_rule delete_ipt_rulenum ipt_find_comment_rule);
+
+## TODO - in future, we could use perl's libiptc module instead of
+## running system commands in the following function for iptables.
+## However, that would need integrating the libiptc module into the system
+## and also adding other functionality to it, including IPv6 support.
+sub run_ipt_cmd {
+    my ($cmd) = shift;
+    my $error = system("$cmd");
+
+    my $debug = "false";
+    my $syslog = "false";
+    my $logger = "sudo logger -t Vyatta::IPTables::Mgr -p local0.warn --";
+
+    if ($syslog eq "true") {
+        my $func = (caller(1))[3];
+        system("$logger [$func] [$cmd] = [$error]");
+    }
+    if ($debug eq "true") {
+        my $func = (caller(1))[3];
+        print "\n[$func] [$cmd] = [$error]";
+    }
+    return $error;
+}
+
+sub create_ipt_chain {
+    my ($ipt_cmd, $table, $chain) = @_;
+    my ($cmd, $error);
+
+    $cmd = "sudo $ipt_cmd -t $table -N $chain";
+    $error = run_ipt_cmd($cmd);
+    return "create_ipt_chain [$ipt_cmd -t $table -N $chain] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+sub flush_ipt_chain {
+    my ($ipt_cmd, $table, $chain) = @_;
+    my ($cmd, $error);
+
+    $cmd = "sudo $ipt_cmd -t $table -F $chain";
+    $error = run_ipt_cmd($cmd);
+    return "flush_ipt_chain [$ipt_cmd -t $table -F $chain] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+sub delete_ipt_chain {
+    my ($ipt_cmd, $table, $chain) = @_;
+    my ($cmd, $error);
+
+    $cmd = "sudo $ipt_cmd -t $table -X $chain";
+    $error = run_ipt_cmd($cmd);
+    return "delete_ipt_chain [$ipt_cmd -t $table -X $chain] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+sub insert_ipt_rule {
+    my ($ipt_cmd, $table, $chain, $jump_target, $insert_num, $append_options) = @_;
+    my ($cmd, $error);
+
+    $insert_num = 1 if (!defined $insert_num);
+    $cmd = "sudo $ipt_cmd -t $table -I $chain $insert_num -j $jump_target ";
+    $cmd .= $append_options if defined $append_options;
+    $error = run_ipt_cmd($cmd);
+    return "insert_ipt_rule [$ipt_cmd -t $table -I $chain $insert_num -j $jump_target] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+sub append_ipt_rule {
+    my ($ipt_cmd, $table, $chain, $jump_target, $append_options) = @_;
+    my ($cmd, $error);
+
+    $cmd = "sudo $ipt_cmd -t $table -A $chain -j $jump_target ";
+    $cmd .= $append_options if defined $append_options;
+    $error = run_ipt_cmd($cmd);
+    return "append_ipt_rule [$ipt_cmd -t $table -A $chain -j $jump_target] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+# delete rule based on jump target. should only be used if jump_target is unique in that chain
+sub delete_ipt_rule {
+    my ($ipt_cmd, $table, $chain, $jump_target) = @_;
+    my ($cmd, $error);
+
+    $cmd = "sudo $ipt_cmd -t $table -D $chain -j $jump_target";
+    $error = run_ipt_cmd($cmd);
+    return "delete_ipt_rule [$ipt_cmd -t $table -D $chain -j $jump_target] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+# delete rule based on rule number
+sub delete_ipt_rulenum {
+    my ($ipt_cmd, $table, $chain, $delete_num) = @_;
+    my ($cmd, $error);
+
+    $cmd = "sudo $ipt_cmd -t $table -D $chain $delete_num";
+    $error = run_ipt_cmd($cmd);
+    return "delete_ipt_rulenum [$ipt_cmd -t $table -D $chain $delete_num] failed: [error code - $error]" if $error;
+
+    return;
+}
+
+# searches and returns first found rule based on jump target
+sub ipt_find_chain_rule {
+    my ($iptables_cmd, $table, $chain, $search) = @_;
+
+    my ($num, $chain2) = (undef, undef);
+    my $cmd = "$iptables_cmd -t $table -L $chain -vn --line";
+    my @lines = `sudo $cmd 2> /dev/null | egrep ^[0-9]`;
+    if (scalar(@lines) < 1) {
+        return;
+    }
+    foreach my $line (@lines) {
+        ($num, undef, undef, $chain2) = split /\s+/, $line;
+        last if $chain2 eq $search;
+        ($num, $chain2) = (undef, undef);
+    }
+
+    return $num if defined $num;
+    return;
+}
+
+# searches and returns first found rule based on matching text in rule comment
+sub ipt_find_comment_rule {
+    my ($iptables_cmd, $table, $chain, $search) = @_;
+
+    my $cmd = "$iptables_cmd -t $table -L $chain -vn --line";
+    my @lines = `sudo $cmd 2> /dev/null | egrep ^[0-9]`;
+    if (scalar(@lines) < 1) {
+        return;
+    }
+
+    my ($num, $rule_txt, $comment) = (undef, undef);
+    foreach my $line (@lines) {
+        ($rule_txt, $comment) = split /\/\*/, $line;
+
+        #print "rule_txt : $rule_txt, comment : $comment\n";
+        if (defined $comment && $comment =~ m/$search/) {
+
+            #print "found $search in $comment \n";
+            ($num) = split /\s+/, $rule_txt if defined $rule_txt;
+            return $num;
+        }
+        ($rule_txt, $comment) = (undef, undef);
+    }
+    return;
+}
+my %conntrack_hook_hash =(
+    'PREROUTING' => 'VYATTA_CT_PREROUTING_HOOK',
+    'OUTPUT'     => 'VYATTA_CT_OUTPUT_HOOK',
+);
+
+sub ipt_enable_conntrack {
+    my ($iptables_cmd, $chain) = @_;
+    my $hookCtHelper = 'false';
+
+    if (($chain eq 'FW_CONNTRACK') or ($chain eq 'NAT_CONNTRACK')) {
+        $hookCtHelper = 'true';
+    }
+
+    system("sudo $iptables_cmd -t raw -L $chain -n >& /dev/null");
+    if ($? >> 8) {
+
+        # chain does not exist yet. set up conntrack.
+        system("sudo $iptables_cmd -t raw -N $chain");
+        system("sudo $iptables_cmd -t raw -A $chain -j ACCEPT");
+
+        foreach my $label ('PREROUTING', 'OUTPUT') {
+            my $index;
+            my $conntrack_hook = $conntrack_hook_hash{$label};
+            $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, $conntrack_hook);
+            if (!defined($index)) {
+                print "Error: unable to find [$label] [$conntrack_hook]\n";
+                return 1;
+            }
+            $index++;
+            system("sudo $iptables_cmd -t raw -I $label $index -j $chain");
+
+            if ($hookCtHelper eq 'true') {
+
+                # we want helper hook only for Firewall / NAT.
+                $conntrack_hook = "VYATTA_CT_HELPER";
+                $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, $conntrack_hook);
+                if (!defined($index)) {
+
+                    # this index does not change now but maybe later we change it, so being defensive.
+                    my $cttimeout_index = ipt_find_chain_rule($iptables_cmd, 'raw', $label, "VYATTA_CT_TIMEOUT");
+                    if (defined($cttimeout_index)) {
+
+                        # $cttimeout_index++; fixing 8173
+                        # currently we have cttimeout at 1 index, it might change in future.
+                        # helper chain should be before timeout chain
+                        system("sudo $iptables_cmd -t raw -I $label $cttimeout_index -j VYATTA_CT_HELPER");
+                    }
+                }
+            }
+        }
+    }
+    return 0;
+}
+
+sub remove_cthelper_hook {
+    my ($iptables_cmd, $label, $chain) =@_;
+
+    #label is PREROUTING / OUTPUT, chain is FW_CONNTRACK/NAT_CONNTRACK etc.
+    my $index;
+
+    # find if we need to remove VYATTA_CT_HELPER
+    my $cthelper_index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, 'VYATTA_CT_HELPER');
+    if(!defined($cthelper_index)) {
+
+        # not an error: this hook is only for FW / NAT
+        return 0;
+    }
+
+    # if this chain is FW_CONNTRACK, look if NAT is using it, else remove
+    if ($chain eq 'FW_CONNTRACK') {
+        $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, 'NAT_CONNTRACK');
+        if (!defined($index)) {
+
+            # NAT, only other user of helpers, not enabled, can remove VYATTA_CT_HELPER
+            system("sudo $iptables_cmd -t raw -D $label $cthelper_index");
+            return 0;
+        }
+    } elsif ($chain eq 'NAT_CONNTRACK') {
+        $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, 'FW_CONNTRACK');
+        if (!defined($index)) {
+
+            # Firewall, only other user of helpers, not enabled, can remove VYATTA_CT_HELPER
+            system("sudo $iptables_cmd -t raw -D $label $cthelper_index");
+            return 0;
+        }
+    }
+}
+
+sub ipt_disable_conntrack {
+    my ($iptables_cmd, $chain) = @_;
+
+    my $debug = 0;
+    my @lines;
+    foreach my $label ('PREROUTING', 'OUTPUT') {
+        my $index;
+        my $conntrack_hook = $conntrack_hook_hash{$label};
+        $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, $chain);
+        if (!defined($index)) {
+            if ($debug > 0) {
+                print "Error: ipt_disable_conntrack failed to find ". "[$label][$chain]\n";
+            }
+            return 1;
+        }
+        system("sudo $iptables_cmd -t raw -D $label $index");
+
+        remove_cthelper_hook($iptables_cmd, $label, $chain);
+    }
+
+    system("sudo $iptables_cmd -t raw -F $chain >& /dev/null");
+    system("sudo $iptables_cmd -t raw -X $chain >& /dev/null");
+
+    return 0;
+}
+
+my %queue_target_hash =(
+    'SNORT'     => 'NFQUEUE',
+    'VG_HTTPS'  => 'NFQUEUE --queue-num 1',
+);
+
+sub ipt_get_queue_target {
+    my ($app) = @_;
+
+    my $target = $queue_target_hash{$app};
+    return $target;
+}
+
+sub count_iptables_rules {
+    my ($iptables_cmd, $table, $chain) = @_;
+
+    my $cmd = "$iptables_cmd -t $table -L $chain -n --line";
+    my @lines = `sudo $cmd 2> /dev/null`;
+    my $cnt = 0;
+    foreach my $line (@lines) {
+        $cnt++ if $line =~ /^\d/;
+    }
+    return $cnt;
+}
+
+sub chain_referenced {
+    my ($table, $chain, $iptables_cmd) = @_;
+
+    my $cmd  = "$iptables_cmd -t $table -n -L $chain";
+    my $line = `sudo $cmd 2>/dev/null |head -n1`;
+    chomp $line;
+    my $found = 0;
+    if ($line =~ m/^Chain $chain \((\d+) references\)$/) {
+        if ($1 > 0) {
+            $found = 1;
+        }
+    }
+    return $found;
+}
+
+1;
diff --git a/lib/Vyatta/IpTables/Rule.pm b/lib/Vyatta/IpTables/Rule.pm
new file mode 100644
index 0000000..5f1e0a4
--- /dev/null
+++ b/lib/Vyatta/IpTables/Rule.pm
@@ -0,0 +1,818 @@
+package Vyatta::IpTables::Rule;
+
+use strict;
+use Vyatta::Config;
+use Vyatta::IpTables::Mgr;
+require Vyatta::IpTables::AddressFilter;
+
+my $src = new Vyatta::IpTables::AddressFilter;
+my $dst = new Vyatta::IpTables::AddressFilter;
+
+my %fields = (
+    _name	       => undef,
+    _rule_number => undef,
+    _protocol    => undef,
+    _state       => {
+        _established => undef,
+        _new         => undef,
+        _related     => undef,
+        _invalid     => undef,
+    },
+    _action      => undef,
+    _log         => undef,
+    _tcp_flags   => undef,
+    _icmp_code   => undef,
+    _icmp_type   => undef,
+    _icmp_name   => undef,
+    _icmpv6_type => undef,
+    _mod_mark    => undef,
+    _mod_table   => undef,
+    _mod_dscp    => undef,
+    _mod_tcpmss  => undef,
+    _ipsec       => undef,
+    _non_ipsec   => undef,
+    _frag        => undef,
+    _non_frag    => undef,
+    _recent_time => undef,
+    _recent_cnt  => undef,
+    _p2p         => {
+        _all   => undef,
+        _apple => undef,
+        _bit   => undef,
+        _dc    => undef,
+        _edk   => undef,
+        _gnu   => undef,
+        _kazaa => undef,
+    },
+    _time        => {
+        _startdate => undef,
+        _stopdate  => undef,
+        _starttime => undef,
+        _stoptime  => undef,
+        _monthdays => undef,
+        _weekdays  => undef,
+        _utc       => undef,
+    },
+    _limit       => {
+        _rate     => undef,
+        _burst    => undef,
+    },
+    _disable     => undef,
+    _ip_version  => undef,
+    _comment     => undef,
+    _hop_limit  => {
+        _eq      => undef,
+        _lt      => undef,
+        _gt      => undef,
+    }
+);
+
+my %dummy_rule = (
+    _rule_number => 10000,
+    _protocol    => "all",
+    _state       => {
+        _established => undef,
+        _new         => undef,
+        _related     => undef,
+        _invalid     => undef,
+    },
+    _action      => "DROP",
+    _log         => undef,
+    _tcp_flags   => undef,
+    _icmp_code   => undef,
+    _icmp_type   => undef,
+    _icmp_name   => undef,
+    _icmpv6_type => undef,
+    _mod_mark    => undef,
+    _mod_table   => undef,
+    _mod_dscp    => undef,
+    _mod_tcpmss  => undef,
+    _ipsec       => undef,
+    _non_ipsec   => undef,
+    _frag        => undef,
+    _non_frag    => undef,
+    _recent_time => undef,
+    _recent_cnt  => undef,
+    _p2p         => {
+        _all   => undef,
+        _apple => undef,
+        _bit   => undef,
+        _dc    => undef,
+        _edk   => undef,
+        _gnu   => undef,
+        _kazaa => undef,
+    },
+    _time        => {
+        _startdate => undef,
+        _stopdate  => undef,
+        _starttime => undef,
+        _stoptime  => undef,
+        _monthdays => undef,
+        _weekdays  => undef,
+        _utc       => undef,
+    },
+    _limit       => {
+        _rate     => undef,
+        _burst    => undef,
+    },
+    _disable     => undef,
+    _ip_version  => undef,
+    _comment     => undef,
+    _hop_limit  => {
+        _eq      => undef,
+        _lt      => undef,
+        _gt      => undef,
+    }
+);
+
+my $DEBUG = 'false';
+
+sub new {
+    my $that = shift;
+    my $class = ref($that) || $that;
+    my $self = {%fields,};
+
+    bless $self, $class;
+    return $self;
+}
+
+sub setupDummy {
+    my ($self, $level) = @_;
+
+    %{$self} = %dummy_rule;
+    $src = new Vyatta::IpTables::AddressFilter;
+    $dst = new Vyatta::IpTables::AddressFilter;
+
+    # set the default policy
+    my $config = new Vyatta::Config;
+    $config->setLevel("$level");
+    my $policy = $config->returnOrigValue('default-action');
+    $policy = 'drop' if !defined $policy;
+    $self->{_action} = $policy;
+    my $log = $config->existsOrig('enable-default-log');
+    $log = 'enable' if defined $log;
+    $self->{_log} = $log;
+}
+
+sub setup_base {
+    my ($self, $level, $val_func, $exists_func, $addr_setup) = @_;
+    my $config = new Vyatta::Config;
+
+    $self->{_comment} = $level;
+    $config->setLevel("$level");
+
+    # for documentation sake.  nodes returns an array so must transform
+    # and ".. .. .." means go up three levels in the current hierarchy
+    $self->{_name}        = $config->returnParent(".. .. ..");
+    $self->{_rule_number} = $config->returnParent("..");
+
+    $self->{_protocol}    = $config->$val_func("protocol");
+
+    $self->{_state}->{_established} = $config->$val_func("state established");
+    $self->{_state}->{_new}         = $config->$val_func("state new");
+    $self->{_state}->{_related}     = $config->$val_func("state related");
+    $self->{_state}->{_invalid}     = $config->$val_func("state invalid");
+
+    $self->{_action}      = $config->$val_func("action");
+    $self->{_log}         = $config->$val_func("log");
+    $self->{_tcp_flags}   = $config->$val_func("tcp flags");
+    $self->{_icmp_code}   = $config->$val_func("icmp code");
+    $self->{_icmp_type}   = $config->$val_func("icmp type");
+    $self->{_icmp_name}   = $config->$val_func("icmp type-name");
+    $self->{_icmpv6_type} = $config->$val_func("icmpv6 type");
+    $self->{_mod_mark}    = $config->$val_func("set mark");
+    $self->{_mod_table}   = $config->$val_func("set table");
+
+    if ($self->{_mod_table} eq 'main') {
+        $self->{_mod_table} = 254;
+    }
+    $self->{_mod_dscp}    = $config->$val_func("set dscp");
+    $self->{_mod_tcpmss}  = $config->$val_func("set tcp-mss");
+    $self->{_ipsec}       = $config->$exists_func("ipsec match-ipsec");
+    $self->{_non_ipsec}   = $config->$exists_func("ipsec match-none");
+    $self->{_frag}        = $config->$exists_func("fragment match-frag");
+    $self->{_non_frag}    = $config->$exists_func("fragment match-non-frag");
+    $self->{_recent_time} = $config->$val_func('recent time');
+    $self->{_recent_cnt}  = $config->$val_func('recent count');
+
+    $self->{_p2p}->{_all}   = $config->$exists_func("p2p all");
+    $self->{_p2p}->{_apple} = $config->$exists_func("p2p applejuice");
+    $self->{_p2p}->{_bit}   = $config->$exists_func("p2p bittorrent");
+    $self->{_p2p}->{_dc}    = $config->$exists_func("p2p directconnect");
+    $self->{_p2p}->{_edk}   = $config->$exists_func("p2p edonkey");
+    $self->{_p2p}->{_gnu}   = $config->$exists_func("p2p gnutella");
+    $self->{_p2p}->{_kazaa} = $config->$exists_func("p2p kazaa");
+
+    $self->{_time}->{_startdate} = $config->$val_func("time startdate");
+    $self->{_time}->{_stopdate}  = $config->$val_func("time stopdate");
+    $self->{_time}->{_starttime} = $config->$val_func("time starttime");
+    $self->{_time}->{_stoptime}  = $config->$val_func("time stoptime");
+    $self->{_time}->{_monthdays} = $config->$val_func("time monthdays");
+    $self->{_time}->{_weekdays}  = $config->$val_func("time weekdays");
+    $self->{_time}->{_utc}       = $config->$exists_func("time utc");
+
+    $self->{_limit}->{_rate}  = $config->$val_func("limit rate");
+    $self->{_limit}->{_burst} = $config->$val_func("limit burst");
+
+    $self->{_disable} = $config->$exists_func("disable");
+
+    $self->{_hop_limit}->{_eq} = $config->$val_func("hop-limit eq");
+    $self->{_hop_limit}->{_lt} = $config->$val_func("hop-limit lt");
+    $self->{_hop_limit}->{_gt} = $config->$val_func("hop-limit gt");
+
+    # TODO: need $config->exists("$level source") in Vyatta::Config.pm
+    $src->$addr_setup("$level source");
+    $dst->$addr_setup("$level destination");
+
+    # Default to IPv4
+    $self->{_ip_version} = "ipv4";
+    return 0;
+}
+
+sub setup {
+    my ($self, $level) = @_;
+
+    $self->setup_base($level, 'returnValue', 'exists', 'setup');
+    return 0;
+}
+
+sub setupOrig {
+    my ($self, $level) = @_;
+
+    $self->setup_base($level, 'returnOrigValue', 'existsOrig', 'setupOrig');
+
+    $self->{_ip_version} = "ipv4";
+    return 0;
+}
+
+sub set_ip_version {
+    my ($self, $ip_version) = @_;
+
+    $self->{_ip_version} = $ip_version;
+    $src->set_ip_version($ip_version);
+    $dst->set_ip_version($ip_version);
+}
+
+sub print {
+    my ($self) = @_;
+
+    print "name: $self->{_name}\n"               if defined $self->{_name};
+    print "rulenum: $self->{_rule_number}\n"     if defined $self->{_rule_number};
+    print "protocol: $self->{_protocol}\n"       if defined $self->{_protocol};
+    print "state: $self->{_state}\n"             if defined $self->{_state};
+    print "action: $self->{_action}\n"           if defined $self->{_action};
+    print "log: $self->{_log}\n"                 if defined $self->{_log};
+    print "icmp code: $self->{_icmp_code}\n"     if defined $self->{_icmp_code};
+    print "icmp type: $self->{_icmp_type}\n"     if defined $self->{_icmp_type};
+    print "icmpv6 type: $self->{_icmpv6_type}\n" if defined $self->{_icmpv6_type};
+    print "mod mark: $self->{_mod_mark}\n"       if defined $self->{_mod_mark};
+    print "mod table: $self->{_mod_table}\n"     if defined $self->{_mod_table};
+    print "mod dscp: $self->{_mod_dscp}\n"       if defined $self->{_mod_dscp};
+    print "mod tcp-mss: $self->{_mod_tcpmss}\n"  if defined $self->{_mod_tcpmss};
+    print "hop-limit: $self->{_hop_limit}\n"     if defined $self->{_hop_limit};
+
+    $src->print();
+    $dst->print();
+
+}
+
+sub is_stateful {
+    my $self = shift;
+    return 0 if defined $self->{_disable};
+    my @states = qw(established new related invalid);
+    foreach (@states) {
+        if (   defined($self->{_state}->{"_$_"})
+            && $self->{_state}->{"_$_"} eq "enable") {
+            return 1;
+        }
+    }
+    return 0;
+}
+
+sub is_disabled {
+    my $self = shift;
+    return 1 if defined $self->{_disable};
+    return 0;
+}
+
+sub is_route_table {
+    my $self = shift;
+    return $self->{_mod_table};
+}
+
+sub get_state_str {
+    my $self = shift;
+    my @states = qw(established new related invalid);
+    my @add_states = ();
+    foreach (@states) {
+        if (   defined($self->{_state}->{"_$_"})
+            && $self->{_state}->{"_$_"} eq "enable") {
+            push @add_states, $_;
+        }
+    }
+    if ($#add_states >= 0) {
+        my $str = join ',', @add_states;
+        return $str;
+    } else {
+        return "";
+    }
+}
+
+sub get_log_prefix {
+    my ($chain, $rule_num, $action) = @_;
+
+    # In iptables it allows a 29 character log_prefix, but we ideally
+    # want to include "[$chain-$rule_num-$action] " but that would require
+    #                  1   29 1   4     1  1    11 = 39
+    # so truncate the chain name so that it'll all fit.
+    my $action_char = uc(substr($action, 0, 1));
+    if (length($chain) > 19) {
+        $chain = substr($chain, 0, 19);
+        printf STDERR "Firewall config warning: rule $rule_num logging prefix will be truncated to [$chain-$rule_num-$action_char]\n";
+    }
+    my $log_prefix  = "[$chain-$rule_num-$action_char] ";
+    return $log_prefix;
+}
+
+sub get_num_ipt_rules {
+    my $self = shift;
+    my $ipt_rules = 1;
+    return 0 if defined $self->{_disable};
+    my $protocol_tcpudp = 0;
+    if (defined $self->{_protocol} && $self->{_protocol} eq 'tcp_udp') {
+        $ipt_rules++;
+        $protocol_tcpudp = 1;
+    }
+
+    if ((  "$self->{_log}" eq "enable")
+         && (  ("$self->{_action}" eq "drop")
+             ||("$self->{_action}" eq "accept")
+             ||("$self->{_action}" eq "reject")
+             ||("$self->{_action}" eq "inspect")
+             ||("$self->{_action}" eq "modify"))){
+        $ipt_rules += 1;
+        $ipt_rules++ if $protocol_tcpudp == 1;
+    }
+    if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) {
+        $ipt_rules += 1;
+        $ipt_rules++ if $protocol_tcpudp == 1;
+    }
+    return $ipt_rules;
+}
+
+sub rule {
+    my ($self) = @_;
+    my ($rule, $srcrule, $dstrule, $err_str);
+    my $tcp_and_udp = 0;
+
+    # set CLI rule num as comment
+    my @level_nodes = split(' ', $self->{_comment});
+    $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[4]\" ";
+
+    # set the protocol
+    if (defined($self->{_protocol})) {
+        my $str    = $self->{_protocol};
+        my $negate = '';
+        if ($str =~ /^\!(.*)$/) {
+            $str    = $1;
+            $negate = '! ';
+        }
+        if ($str eq 'tcp_udp') {
+            $tcp_and_udp = 1;
+            $rule .= " $negate -p tcp "; # we'll add the '-p udp' to 2nd rule later
+        } else {
+            $rule .= " $negate -p $str ";
+        }
+    }
+
+    my $state_str = uc(get_state_str($self));
+    if ($state_str ne "") {
+        $rule .= "-m state --state $state_str ";
+    }
+
+    # set tcp flags if applicable
+    my $tcp_flags = undef;
+    if (defined $self->{_tcp_flags}) {
+        if (($self->{_protocol} eq "tcp") || ($self->{_protocol} eq "6")) {
+            $tcp_flags = get_tcp_flags_string($self->{_tcp_flags});
+        } else {
+            return ("TCP flags can only be set if protocol is set to TCP",);
+        }
+    }
+    if (defined($tcp_flags)) {
+        $rule .= " -m tcp --tcp-flags $tcp_flags ";
+    }
+
+    # set the icmp code and type if applicable
+    if (($self->{_protocol} eq "icmp") || ($self->{_protocol} eq "1")) {
+        if (defined $self->{_icmp_name}) {
+            if (defined($self->{_icmp_type}) || defined($self->{_icmp_code})){
+                return ("Cannot use ICMP type/code with ICMP type-name",);
+            }
+            $rule .= "--icmp-type $self->{_icmp_name} ";
+        } elsif (defined $self->{_icmp_type}) {
+            $rule .= "--icmp-type $self->{_icmp_type}";
+            if (defined $self->{_icmp_code}) {
+                $rule .= "/$self->{_icmp_code}";
+            }
+            $rule .= " ";
+        } elsif (defined $self->{_icmp_code}) {
+            return ("ICMP code can only be defined if ICMP type is defined",);
+        }
+    } elsif (defined($self->{_icmp_type})
+        || defined($self->{_icmp_code})
+        || defined($self->{_icmp_name}))
+    {
+        return ("ICMP type/code or type-name can only be defined if protocol is ICMP",);
+    }
+
+    # Setup ICMPv6 rule if configured
+    # ICMPv6 parameters are only valid if the rule is matching on the
+    # ICMPv6 protocol ID.
+    #
+    if (  ($self->{_protocol} eq "icmpv6")
+        ||($self->{_protocol} eq "ipv6-icmp")
+        ||($self->{_protocol} eq "58")) {
+        if (defined($self->{_icmpv6_type})) {
+            $rule .= "-m icmpv6 --icmpv6-type $self->{_icmpv6_type}";
+        }
+    }
+
+    # Setup HL rule if configured
+    #
+    if ( defined($self->{_hop_limit}->{_eq}) ) {
+        $rule .= " -m hl --hl-eq $self->{_hop_limit}->{_eq}";
+    } elsif ( defined($self->{_hop_limit}->{_lt}) ) {
+        $rule .= " -m hl --hl-lt $self->{_hop_limit}->{_lt}";
+    } elsif ( defined($self->{_hop_limit}->{_gt}) ) {
+        $rule .= " -m hl --hl-gt $self->{_hop_limit}->{_gt}";
+    }
+
+    # add the source and destination rules
+    ($srcrule, $err_str) = $src->rule();
+    return ($err_str,) if (!defined($srcrule));
+    ($dstrule, $err_str) = $dst->rule();
+    return ($err_str,) if (!defined($dstrule));
+
+    # make sure multiport is always behind single port option
+    if ((grep /multiport/, $srcrule)) {
+        $rule .= " $dstrule $srcrule ";
+    } elsif ((grep /multiport/, $dstrule)) {
+        $rule .= " $srcrule $dstrule ";
+    } else {
+        $rule .= " $srcrule $dstrule ";
+    }
+
+    return ('Cannot specify both "match-frag" and "match-non-frag"',)
+        if (defined($self->{_frag}) && defined($self->{_non_frag}));
+    if (defined($self->{_frag})) {
+        $rule .= ' -f ';
+    } elsif (defined($self->{_non_frag})) {
+        $rule .= ' ! -f ';
+    }
+
+    # note: "out" is not valid in the INPUT chain.
+    return ('Cannot specify both "match-ipsec" and "match-none"',)
+        if (defined($self->{_ipsec}) && defined($self->{_non_ipsec}));
+    if (defined($self->{_ipsec})) {
+        $rule .= ' -m policy --pol ipsec --dir in ';
+    } elsif (defined($self->{_non_ipsec})) {
+        $rule .= ' -m policy --pol none --dir in ';
+    }
+
+    my $p2p = undef;
+    if (defined($self->{_p2p}->{_all})) {
+        $p2p = '--apple --bit --dc --edk --gnu --kazaa ';
+    } else {
+        my @apps = qw(apple bit dc edk gnu kazaa);
+        foreach (@apps) {
+            if (defined($self->{_p2p}->{"_$_"})) {
+                $p2p .= "--$_ ";
+            }
+        }
+    }
+    if (defined($p2p)) {
+        $rule .= " -m ipp2p $p2p ";
+    }
+
+    my $time = undef;
+    if (defined($self->{_time}->{_utc})) {
+        $time .= " --utc ";
+    }
+    if (defined($self->{_time}->{_startdate})) {
+        my $check_date = validate_date($self->{_time}->{_startdate}, "startdate");
+        if (!($check_date eq "")) {
+            return ($check_date,);
+        }
+        $time .= " --datestart $self->{_time}->{_startdate} ";
+    }
+    if (defined($self->{_time}->{_stopdate})) {
+        my $check_date = validate_date($self->{_time}->{_stopdate}, "stopdate");
+        if (!($check_date eq "")) {
+            return ($check_date,);
+        }
+        $time .= " --datestop $self->{_time}->{_stopdate} ";
+    }
+    if (defined($self->{_time}->{_starttime})) {
+        return ("Invalid starttime $self->{_time}->{_starttime}. Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", )
+            if (!validate_timevalues($self->{_time}->{_starttime}, "time"));
+        $time .= " --timestart $self->{_time}->{_starttime} ";
+    }
+    if (defined($self->{_time}->{_stoptime})) {
+        return ("Invalid stoptime $self->{_time}->{_stoptime}. Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", )
+            if (!validate_timevalues($self->{_time}->{_stoptime}, "time"));
+        $time .= " --timestop $self->{_time}->{_stoptime} ";
+    }
+    if (defined($self->{_time}->{_monthdays})) {
+        my $negate = " ";
+        if ($self->{_time}->{_monthdays} =~ m/^!/) {
+            $negate = "! ";
+            $self->{_time}->{_monthdays} = substr $self->{_time}->{_monthdays}, 1;
+        }
+        return ("Invalid monthdays value $self->{_time}->{_monthdays}. Monthdays should have values between 1 and 31 with multiple days separated by commas eg. 2,12,21 For negation, add ! in front eg. !2,12,21", )
+            if (!validate_timevalues($self->{_time}->{_monthdays}, "monthdays"));
+        $time .= " $negate --monthdays $self->{_time}->{_monthdays} ";
+    }
+    if (defined($self->{_time}->{_weekdays})) {
+        my $negate = " ";
+        if ($self->{_time}->{_weekdays} =~ m/^!/) {
+            $negate = "! ";
+            $self->{_time}->{_weekdays} = substr $self->{_time}->{_weekdays}, 1;
+        }
+        return ("Invalid weekdays value $self->{_time}->{_weekdays}. Weekdays should be specified using the first three characters of the day with the
+first character capitalized eg. Mon,Thu,Sat For negation, add ! in front eg. !Mon,Thu,Sat", )
+            if (!validate_timevalues($self->{_time}->{_weekdays}, "weekdays"));
+        $time .= " $negate --weekdays $self->{_time}->{_weekdays} ";
+    }
+    if (defined($time)) {
+        $rule .= " -m time $time ";
+    }
+
+    my $limit = undef;
+    if (defined $self->{_limit}->{_rate}) {
+        my $rate_integer = $self->{_limit}->{_rate};
+        $rate_integer =~ s/\/(second|minute|hour|day)//;
+        if ($rate_integer < 1) {
+            return ("integer value in rate cannot be less than 1",);
+        }
+        $limit = "--limit $self->{_limit}->{_rate} --limit-burst $self->{_limit}->{_burst}";
+    }
+    $rule .= " -m limit $limit " if defined $limit;
+
+    # recent match condition SHOULD BE DONE IN THE LAST so
+    # all options in $rule are copied to $recent_rule below
+    my $recent_rule = undef;
+    if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) {
+        my $recent_rule1 = undef;
+        my $recent_rule2 = undef;
+        $recent_rule1 .= ' -m recent --update ';
+        $recent_rule2 .= ' -m recent --set ';
+        if (defined($self->{_recent_time})) {
+            $recent_rule1 .= " --seconds $self->{_recent_time} ";
+        }
+        if (defined($self->{_recent_cnt})) {
+            $recent_rule1 .= " --hitcount $self->{_recent_cnt} ";
+        }
+
+        $recent_rule1 .= " --name $self->{_name}-$self->{_rule_number} ";
+        $recent_rule2 .= " --name $self->{_name}-$self->{_rule_number} ";
+
+        $recent_rule = $rule;
+
+        if ($rule =~ m/\-m\s+set\s+\-\-match\-set/) {
+
+            # firewall group being used in this rule. iptables complains if recent
+            # match condition is placed after group match conditions [see bug 5744]
+            # so instead of appending recent match place it before group match
+            my @split_rules = ();
+
+            @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $rule, 2);
+            $rule =   $split_rules[0] . $recent_rule1 .$split_rules[1] . $split_rules[2];
+
+            @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $recent_rule, 2);
+            $recent_rule =    $split_rules[0] . $recent_rule2 .$split_rules[1] . $split_rules[2];
+        } else {
+
+            # append recent match conditions to the two rules needed for recent match
+            $rule .= $recent_rule1;
+            $recent_rule .= $recent_rule2;
+        }
+    }
+
+    my $chain = $self->{_name};
+    my $rule_num = $self->{_rule_number};
+    my $rule2 = undef;
+
+    # set the jump target.  Depends on action and log
+    if ("$self->{_log}" eq "enable") {
+        $rule2 = $rule;
+        my $log_prefix = get_log_prefix($chain, $rule_num, $self->{_action});
+        $rule2 .= "-j LOG --log-prefix \"$log_prefix\" ";
+    }
+    if ("$self->{_action}" eq "drop") {
+        $rule .= "-j DROP ";
+    } elsif ("$self->{_action}" eq "accept") {
+        $rule .= "-j RETURN ";
+    } elsif ("$self->{_action}" eq "reject") {
+        $rule .= "-j REJECT ";
+    } elsif ("$self->{_action}" eq 'inspect') {
+        my $target = ipt_get_queue_target('SNORT');
+        return ('Undefined target for inspect',) if !defined $target;
+        $rule .= "-j $target ";
+    } elsif ($self->{_comment} =~ m/^policy/) {
+
+        # mangle actions
+        my $count = 0;
+        if (defined($self->{_mod_mark})) {
+            # MARK
+            $rule .= "-j MARK --set-mark $self->{_mod_mark} ";
+            $count++;
+        }
+        if (defined($self->{_mod_table})) {
+            # Route table
+            $rule .= "-j VYATTA_PBR_$self->{_mod_table} ";
+            $count++;
+        }
+        if (defined($self->{_mod_dscp})) {
+            # DSCP
+            $rule .= "-j DSCP --set-dscp $self->{_mod_dscp} ";
+            $count++;
+        }
+        if (defined($self->{_mod_tcpmss})) {
+            # TCP-MSS
+            # check for SYN flag
+            if (  !defined $self->{_tcp_flags}
+                ||!(($self->{_tcp_flags} =~ m/SYN/) && !($self->{_tcp_flags} =~ m/!SYN/)))
+            {
+                return ('need to set TCP SYN flag to modify TCP MSS',);
+            }
+
+            if ($self->{_mod_tcpmss} =~ m/\d/) {
+                $rule .= "-j TCPMSS --set-mss $self->{_mod_tcpmss} ";
+            } else {
+                $rule .= "-j TCPMSS --clamp-mss-to-pmtu ";
+            }
+            $count++;
+        }
+
+        # others
+        if ($count == 0) {
+            return ('Policy route requires "action drop" or "set" parameters be defined.');
+        } elsif ($count > 1) {
+            return ('Can not define more than one "set" parameter per policy route');
+        }
+    } else {
+        return ("\"action\" must be defined in rule $rule_num",);
+    }
+    if (defined($rule2)) {
+        my $tmp = $rule2;
+        $rule2 = $rule;
+        $rule = $tmp;
+    } elsif (defined($recent_rule)) {
+        $rule2 = $recent_rule;
+        $recent_rule = undef;
+    }
+
+    return (undef, undef) if defined $self->{_disable};
+
+    my ($udp_rule, $udp_rule2, $udp_recent_rule) = (undef, undef, undef);
+    if ($tcp_and_udp == 1) {
+
+        # create udp rules
+        $udp_rule = $rule;
+        $udp_rule2 = $rule2 if defined $rule2;
+        $udp_recent_rule = $recent_rule if defined $recent_rule;
+        foreach my $each_udprule ($udp_rule, $udp_rule2, $udp_recent_rule) {
+            $each_udprule =~ s/ \-p tcp / -p udp / if defined $each_udprule;
+        }
+    }
+
+    if ($DEBUG eq 'true') {
+
+        # print all potential iptables rules that could be formed for
+        # a single CLI rule. see get_num_ipt_rules to see exact count
+        print "rule :\n$rule\n" if defined $rule;
+        print "rule2 :\n$rule2\n" if defined $rule2;
+        print "recent rule :\n$recent_rule\n" if defined $recent_rule;
+        print "udp rule :\n$udp_rule\n" if defined $udp_rule;
+        print "udp rule2 :\n$udp_rule2\n" if defined $udp_rule2;
+        print "udp recent rule :\n$udp_recent_rule\n" if defined $udp_recent_rule;
+    }
+
+    return (undef, $rule, $rule2, $recent_rule, $udp_rule, $udp_rule2, $udp_recent_rule);
+}
+
+sub outputXmlElem {
+    my ($name, $value, $fh) = @_;
+    print $fh "    <$name>$value</$name>\n";
+}
+
+sub outputXml {
+    my ($self, $fh) = @_;
+    if (!defined($self->{_protocol})) {
+        $self->{_protocol} = "all";
+    }
+    outputXmlElem("protocol", $self->{_protocol}, $fh);
+    my $state_str = get_state_str($self);
+    if ($state_str ne "") {
+        $state_str =~ s/,/%2C/g;
+        $state_str .= "+";
+    }
+    outputXmlElem("state", $state_str, $fh);
+    outputXmlElem("action", uc($self->{_action}), $fh);
+    outputXmlElem("log", $self->{_log}, $fh);
+    outputXmlElem("icmp_type", $self->{_icmp_type}, $fh);
+    outputXmlElem("icmp_code", $self->{_icmp_code}, $fh);
+
+    $src->outputXml("src", $fh);
+    $dst->outputXml("dst", $fh);
+}
+
+sub validate_timevalues {
+    my ($string, $type) = @_;
+    use Switch;
+    use Time::Local;
+    switch ($type) {
+        case "date" {
+            $string =~ s/-//g;
+            my ($year, $month, $day) = unpack "A4 A2 A2", $string;
+            eval {
+                timelocal(0,0,0,$day, $month-1, $year);
+                1;
+            } or return 0;
+        }
+
+        case "time" {
+            $string =~ s/://g;
+            my ($hour, $min, $sec) = unpack "A2 A2 A2", $string;
+            eval {
+                timelocal($sec,$min,$hour, 1, 0, 1970);
+                1;
+            } or return 0;
+        }
+
+        case "monthdays" {
+            while($string =~ m/(\d+)/g) {
+                if ($1 < 1 || $1 > 31) {
+                    return 0;
+                }
+            }
+        }
+
+        case "weekdays" {
+            my @weekdays = ("Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun");
+            while($string =~ m/(\w+)/g) {
+                if (!grep(/$1/,@weekdays)) {
+                    return 0;
+                }
+            }
+        }
+
+        else {
+            print"Invalid type '$type' passed to sub validate_timevalues()\n";
+            return 0;
+        }
+    }
+    return 1;
+}
+
+sub validate_date {
+
+    my ($date, $string) = @_;
+    if ($date =~ m/T/) {
+        my $actualdate = substr $date, 0, 10;
+        my $datetime = substr $date, 11;
+        return ("Invalid  $string $actualdate. Date should use yyyy-mm-dd format and lie in between 1970-01-01 and 2038-01-19")
+            if (!validate_timevalues($actualdate, "date"));
+        return ("Invalid time $datetime for $string $actualdate. Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59")
+            if (!validate_timevalues($datetime, "time"));
+    } else {
+        return ("Invalid $string $date. Date should use yyyy-mm-dd format and lie in between 1970-01-01 and 2038-01-19")
+            if (!validate_timevalues($date, "date"));
+    }
+    return ("");
+}
+
+sub get_tcp_flags_string {
+
+    my $string = shift;
+    my @list_of_flags = (); # list of tcp flags to be examined
+    my @list_of_set_flags = (); # list of flags which must be set
+
+    my @string_list = split(/,/, $string);
+    while(@string_list) {
+        if (!grep(/!/,$string_list[0])) {
+            push @list_of_flags, $string_list[0];
+            push @list_of_set_flags, $string_list[0];
+        } else {
+            $string_list[0] =~ s/!//g;
+            push @list_of_flags, $string_list[0];
+        }
+        shift(@string_list);
+    }
+
+    push @list_of_set_flags, 'NONE' if @list_of_set_flags == ();
+    return join(",",@list_of_flags) . " " . join(",",@list_of_set_flags);
+}
+
+1;
diff --git a/scripts/vyatta-conntrack-ignore.pl b/scripts/vyatta-conntrack-ignore.pl
index 7d07604..a103173 100644
--- a/scripts/vyatta-conntrack-ignore.pl
+++ b/scripts/vyatta-conntrack-ignore.pl
@@ -10,12 +10,11 @@ use Vyatta::Conntrack::RuleIgnore;
 use Vyatta::IpTables::AddressFilter;
 use Vyatta::Conntrack::ConntrackUtil;
 use Getopt::Long;
-use Vyatta::Zone;
 use Sys::Syslog qw(:standard :macros);
 
 #for future use when v6 ignore s need to be set
-my %cmd_hash = ( 'ipv4'        => 'iptables',
-		 'ipv6'   => 'ip6tables');
+my %cmd_hash = ( 'ipv4'        => 'iptables-nft',
+		 'ipv6'   => 'ip6tables-nft');
 # Enable printing debug output to stdout.
 my $debug_flag = 0;
 
@@ -35,8 +34,8 @@ openlog("vyatta-conntrack", "pid", "local0");
 
 sub remove_ignore_policy {
     my ($rule_string) = @_;
-    my $iptables_cmd1 = "iptables -D VYATTA_CT_IGNORE -t raw $rule_string -j CT --notrack";
-    my $iptables_cmd2 = "iptables -D VYATTA_CT_IGNORE -t raw $rule_string -j RETURN";
+    my $iptables_cmd1 = "iptables-nft -D VYOS_CT_IGNORE -t raw $rule_string -j CT --notrack";
+    my $iptables_cmd2 = "iptables-nft -D VYOS_CT_IGNORE -t raw $rule_string -j RETURN";
     run_cmd($iptables_cmd2);
     if ($? >> 8) {
      print "$CTERROR failed to run $iptables_cmd2\n";    
@@ -51,9 +50,9 @@ sub remove_ignore_policy {
 sub apply_ignore_policy {
    my ($rule_string, $rule, $num_rules) = @_;
    # insert at num_rules + 1 as there are so many rules already. 
-   my $iptables_cmd1 = "iptables -I VYATTA_CT_IGNORE $num_rules -t raw $rule_string -j CT --notrack";
+   my $iptables_cmd1 = "iptables-nft -I VYOS_CT_IGNORE $num_rules -t raw $rule_string -j CT --notrack";
    $num_rules +=1;
-   my $iptables_cmd2 = "iptables -I VYATTA_CT_IGNORE $num_rules -t raw $rule_string -j RETURN";
+   my $iptables_cmd2 = "iptables-nft -I VYOS_CT_IGNORE $num_rules -t raw $rule_string -j RETURN";
    run_cmd($iptables_cmd1);
     if ($? >> 8) {
      print "$CTERROR failed to run $iptables_cmd1\n";    
diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl
index 557f4eb..7394945 100644
--- a/scripts/vyatta-conntrack-timeouts.pl
+++ b/scripts/vyatta-conntrack-timeouts.pl
@@ -13,8 +13,8 @@ use Vyatta::Zone;
 use Sys::Syslog qw(:standard :macros);
 
 #for future use when v6 timeouts need to be set
-my %cmd_hash = ( 'ipv4'        => 'iptables',
-		 'ipv6'   => 'ip6tables');
+my %cmd_hash = ( 'ipv4'        => 'iptables-nft',
+		 'ipv6'   => 'ip6tables-nft');
 # Enable printing debug output to stdout.
 my $debug_flag = 0;
 
@@ -36,8 +36,8 @@ sub remove_timeout_policy {
     my ($rule_string, $timeout_policy) = @_;
     my @tokens = split (' ', $timeout_policy);
     # First remove the iptables rules before removing policy.
-    my $iptables_cmd1 = "iptables -D VYATTA_CT_TIMEOUT -t raw $rule_string -j CT --timeout $tokens[0]";
-    my $iptables_cmd2 = "iptables -D VYATTA_CT_TIMEOUT -t raw $rule_string -j RETURN";
+    my $iptables_cmd1 = "iptables-nft -D VYOS_CT_TIMEOUT -t raw $rule_string -j CT --timeout $tokens[0]";
+    my $iptables_cmd2 = "iptables-nft -D VYOS_CT_TIMEOUT -t raw $rule_string -j RETURN";
     my $nfct_timeout_cmd = "$nfct timeout delete $timeout_policy"; 
     run_cmd($iptables_cmd2);
     if ($? >> 8) {
@@ -66,9 +66,9 @@ sub apply_timeout_policy {
     my $nfct_timeout_cmd = "$nfct timeout add $timeout_policy"; 
     my @tokens = split (' ', $timeout_policy);
     # insert at num_rules + 1 as there are so many rules already. 
-    my $iptables_cmd1 = "iptables -I VYATTA_CT_TIMEOUT $num_rules -t raw $rule_string -j CT --timeout $tokens[0]";
+    my $iptables_cmd1 = "iptables-nft -I VYATTA_CT_TIMEOUT $num_rules -t raw $rule_string -j CT --timeout $tokens[0]";
     $num_rules +=1;
-    my $iptables_cmd2 = "iptables -I VYATTA_CT_TIMEOUT $num_rules -t raw $rule_string -j RETURN";
+    my $iptables_cmd2 = "iptables-nft -I VYATTA_CT_TIMEOUT $num_rules -t raw $rule_string -j RETURN";
     run_cmd($nfct_timeout_cmd);
     if ($? >> 8) {
       print "$CTERROR failed to run $nfct_timeout_cmd\n";    
@@ -84,7 +84,7 @@ sub apply_timeout_policy {
     run_cmd($iptables_cmd2);
     if ($? >> 8) {
       run_cmd("nfct timeout delete policy_timeout_$rule");   
-      run_cmd("iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]");   
+      run_cmd("iptables-nft -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]");   
       print "$CTERROR failed to run $iptables_cmd2\n";    
       exit 1;
     }
diff --git a/scripts/vyatta-show-ignore.pl b/scripts/vyatta-show-ignore.pl
index 40efa8f..e650bf1 100644
--- a/scripts/vyatta-show-ignore.pl
+++ b/scripts/vyatta-show-ignore.pl
@@ -43,7 +43,7 @@ sub print_ignore_rules {
   $config->setLevel("system conntrack ignore rule");
   my @rules = sort numerically $config->listOrigNodes(); 
 
-  my @rules_in_chain = `sudo iptables -L VYATTA_CT_IGNORE -t raw -nv`;
+  my @rules_in_chain = `sudo iptables-nft -L VYOS_CT_IGNORE -t raw -nv`;
   if (!(@rules_in_chain)){
     die "Error: no ignore rules configured\n";
   }