From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefan Schantl <stefan.schantl@ipfire.org>
To: development@lists.ipfire.org
Subject:
 [PATCH 2/4] rules.pl: Adjust code to use sets generated by libloc 0.9.11
Date: Wed, 09 Mar 2022 15:12:30 +0100
Message-ID: <20220309141232.2401848-2-stefan.schantl@ipfire.org>
In-Reply-To: <20220309141232.2401848-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============4614141374181148489=="
List-Id: <development.lists.ipfire.org>

--===============4614141374181148489==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 config/firewall/rules.pl | 44 +++++++++++++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 10 deletions(-)

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index b8c602538..83216e78a 100644
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -957,20 +957,44 @@ sub ipset_restore ($) {
=20
 	# Check if the given set name is a country code.
 	if($set ~~ @locations) {
-		# Libloc adds "ipset4" as prefix to all exported IPv4 data.
-		my $file_prefix =3D "ipset4";
+		# Libloc adds the IP type (v4 or v6) as part of the set and file name.
+		my $loc_set =3D "$set" . "v4";
=20
-		# Generate full path and filename for the ipset db file to restore.
-		$db_file =3D "$Location::Functions::ipset_db_directory/$set.$file_prefix";
+		# The bare filename equals the set name.
+		my $filename =3D $loc_set;
+
+		# Libloc uses "ipset" as file extension.
+		my $file_extension =3D "ipset";
+
+		# Generate full path and filename for the ipset db file.
+		my $db_file =3D "$Location::Functions::ipset_db_directory/$filename.$file_=
extension";
+
+		# Call function to restore/load the set.
+		&ipset_call_restore($db_file);
+
+		# Check if the set is already loaded (has been used before).
+		if ($set ~~ @ipset_used_sets) {
+			# The sets contains the IP type (v4 or v6) as part of the name.
+			# The firewall rules matches against sets without that extension. So we s=
afely
+			# can swap or rename the sets to use the new ones.
+			run("$IPSET swap $loc_set $set");
+		} else {
+			# If the set is not loaded, we have to rename it to proper use it.
+			run("$IPSET rename $loc_set $set");
+		}
 	}
=20
-	# Check if the generated file exists.
-	if (-f $db_file) {
-		# Run ipset and restore the given set.
-		run("$IPSET restore < $db_file");
+	# Store the restored set to the hash to prevent from loading it again.
+	$ipset_loaded_sets{$set} =3D "1";
+}
=20
-		# Store the restored set to the hash to prevent from loading it again.
-		$ipset_loaded_sets{$set} =3D "1";
+sub ipset_call_restore ($) {
+	my ($file) =3D @_;
+
+	# Check if the requested file exists.
+	if (-f $file) {
+		# Run ipset and restore the given set.
+		run("$IPSET restore -f $file");
 	}
 }
=20
--=20
2.30.2


--===============4614141374181148489==--