firewall: Use cleanup_ipsets() function from ipset-functions library

Asking the kernel for all known sets and unloading unused ones is a much
smarter approach than the old one.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index a47c260a152647ab9c740578d4e3c0f27beb0d0a..bc254d98aa01b7203754ebe502d693c23e5d5d5d 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -27,6 +27,7 @@ require "${General::swroot}/lang.pl";
 require "/usr/lib/firewall/firewall-lib.pl";
 require "${General::swroot}/location-functions.pl";
 require "${General::swroot}/ipblocklist-functions.pl";
+require "${General::swroot}/ipset-functions.pl";
 
 # Set to one to enable debugging mode.
 my $DEBUG = 0;
@@ -137,9 +138,6 @@ undef (@dummy);
 &main();
 
 sub main {
-       # Get currently used ipset sets.
-       @ipset_used_sets = &ipset_get_sets();
-
        # Flush all chains.
        &flush();
 
@@ -167,7 +165,7 @@ sub main {
        run("/usr/sbin/firewall-policy");
 
        # Cleanup not longer needed ipset sets.
-       &ipset_cleanup();
+       &IPSet::Functions::cleanup_ipsets();
 
        #Reload firewall.local if present
        if ( -f '/etc/sysconfig/firewall.local'){
@@ -1109,20 +1107,3 @@ sub ipset_call_restore ($) {
                run("$IPSET restore -f $file");
        }
 }
-
-sub ipset_cleanup () {
-       # Reload the array of used sets.
-       @ipset_used_sets = &ipset_get_sets();
-
-       # Loop through the array of used sets.
-       foreach my $set (@ipset_used_sets) {
-               # Check if this set is still in use.
-               #
-               # In this case an entry in the loaded sets hash exists.
-               unless($ipset_loaded_sets{$set}) {
-                       # Entry does not exist, so this set is not longer
-                       # used and can be destroyed.
-                       run("$IPSET destroy $set");
-               }
-       }
-}