rules.pl: Extend firewall.local to use also IPSet set.

Fixes Bug: #13563

Since rules.pl does not load potential IPSet set in firewall.local, the clean up function
in rules.pl tries to destroy them while an firewall restart.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 7edb910e2d6e649396c38071380f796112d9e013..de5cb971f320e8f9368720166999db94aad2a576 100644 (file)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -89,6 +89,7 @@ my $locationfile              = "${General::swroot}/firewall/locationblock";
 my $configgrp          = "${General::swroot}/fwhosts/customgroups";
 my $netsettings                = "${General::swroot}/ethernet/settings";
 my $blocklistfile   = "${General::swroot}/ipblocklist/settings";
+my $fwlocal                    = "/etc/sysconfig/firewall.local";
 
 &General::readhash("${General::swroot}/firewall/settings", \%fwdfwsettings);
 &General::readhash("${General::swroot}/optionsfw/settings", \%fwoptions);
@@ -163,6 +164,9 @@ sub main {
        # Handle ipblocklist.
        &ipblocklist();
 
+       # Handle firewall.local.
+       &fwlocal_sets();
+
        # Reload firewall policy.
        run("/usr/sbin/firewall-policy");
 
@@ -788,6 +792,34 @@ sub ipblocklist () {
        }
 }
 
++# Check if firewall.local uses IPSet sets and if so, load the set names.
+sub fwlocal_sets {
+       # Open firewall.local to loop through it.
+       open(my $FWL, "<", $fwlocal) or die "can not open $fwlocal:";
+
+       # Variable to store potential set names.
+       my %fwlocalsets;
+
+       # If firewall.local includes IPSet set, search for the set names.
+       while (my $fwlsets = <$FWL>) {
+               chomp $fwlsets;
+               while ($fwlsets =~ /--match-set\s+(\S+)/g) {
+                       my $fwlsetnames = $1;
+                       $fwlocalsets{$fwlsetnames} = 1;
+               }
+       }
+
+       # Close firewall.local.
+       close($FWL);
+
+       # Include firewall.local IPSet sets to load them.
+       foreach my $fwlsetnames (keys %fwlocalsets) {
+
+               # Call function to restore/local the set.
+               &ipset_restore($fwlsetnames);
+       }
+}
+
 sub get_protocols {
        my $hash = shift;
        my $key = shift;