From bc20e6699904172e98fba25c65e7d6cd816baddd Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 26 Jul 2017 13:39:44 +0000 Subject: [PATCH 01/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index bbbd780..6dd35a2 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 6.29 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -146,6 +146,9 @@ fi %changelog +* Wed Jul 26 2017 Fedora Release Engineering - 6.29-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Fri Apr 07 2017 Nicolas Chauvet - 6.29-3 - Userspace needs kernel-headers - rhbz#1420864 From b033adb0b2ee78f8f538c350259290a973ffb209 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 31 Jul 2017 14:55:54 +0200 Subject: [PATCH 02/55] Update to 6.32 --- .gitignore | 13 +------------ ipset.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 15 deletions(-) diff --git a/.gitignore b/.gitignore index 2eea6d1..79a1288 100644 --- a/.gitignore +++ b/.gitignore @@ -1,12 +1 @@ -/ipset-6.9.1.tar.bz2 -/ipset-6.11.tar.bz2 -/ipset-6.13.tar.bz2 -/ipset-6.14.tar.bz2 -/ipset-6.16.1.tar.bz2 -/ipset-6.19.tar.bz2 -/ipset-6.20.1.tar.bz2 -/ipset-6.21.1.tar.bz2 -/ipset-6.22.tar.bz2 -/ipset-6.26.tar.bz2 -/ipset-6.27.tar.bz2 -/ipset-6.29.tar.bz2 +ipset-*.tar.bz2 diff --git a/ipset.spec b/ipset.spec index 6dd35a2..69b4be4 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 6.29 -Release: 4%{?dist} +Version: 6.32 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -146,6 +146,9 @@ fi %changelog +* Mon Jul 31 2017 Nicolas Chauvet - 6.32-1 +- Update to 6.32 + * Wed Jul 26 2017 Fedora Release Engineering - 6.29-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild diff --git a/sources b/sources index 5f9c0bc..7103351 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -fd8ea35997115c5c630eee22f0beecec ipset-6.29.tar.bz2 +SHA512 (ipset-6.32.tar.bz2) = 7b0f5e7ef1a777ab70872aa52f658ff9516cb5de4c67c56d7f596eb88db03467d39b10ffc098441b4bfa4bb21a15f3c5f7f7f825300ce8efbacd767369ad43c7 From 608536df36f007c5d3de01bd8ba7ff44a49d485a Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 8 Jan 2018 22:33:55 +0100 Subject: [PATCH 03/55] Update to 6.35 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index 69b4be4..15bd7c5 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 6.32 +Version: 6.35 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -146,6 +146,9 @@ fi %changelog +* Mon Jan 08 2018 Nicolas Chauvet - 6.35-1 +- Update to 6.35 + * Mon Jul 31 2017 Nicolas Chauvet - 6.32-1 - Update to 6.32 diff --git a/sources b/sources index 7103351..47ffa7b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-6.32.tar.bz2) = 7b0f5e7ef1a777ab70872aa52f658ff9516cb5de4c67c56d7f596eb88db03467d39b10ffc098441b4bfa4bb21a15f3c5f7f7f825300ce8efbacd767369ad43c7 +SHA512 (ipset-6.35.tar.bz2) = f58da34a1d32ff8f8de7e19384b4c6f4b9da5c73e7680a185cb23d4aa3682736b5692eb09348f4fa5dec89f9f20884371a34f30b879144183e37671617b64cb1 From c03b2902c2d7aa93842966e023a9bca3ed9bb2b9 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 8 Jan 2018 22:40:33 +0100 Subject: [PATCH 04/55] Bump soname (no downstream users so far) --- ipset.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 15bd7c5..fd71812 100644 --- a/ipset.spec +++ b/ipset.spec @@ -131,7 +131,7 @@ fi %files libs %doc COPYING -%{_libdir}/lib%{name}.so.3* +%{_libdir}/lib%{name}.so.11* %files devel %{_includedir}/lib%{name} From 54e38f567a5c3907c43998b34251816bd6793707 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 7 Feb 2018 17:36:49 +0000 Subject: [PATCH 05/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index fd71812..d9ce877 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 6.35 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -146,6 +146,9 @@ fi %changelog +* Wed Feb 07 2018 Fedora Release Engineering - 6.35-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Mon Jan 08 2018 Nicolas Chauvet - 6.35-1 - Update to 6.35 From cee010372f4e3d3a028031d8eb8f7f37429bb793 Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Mon, 12 Feb 2018 10:57:12 -0500 Subject: [PATCH 06/55] Patch for missing header file (RHBZ#1543596) --- 0001-build-do-install-libipset-args.h.patch | 28 +++++++++++++++++++++ ipset.spec | 13 ++++++++-- 2 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 0001-build-do-install-libipset-args.h.patch diff --git a/0001-build-do-install-libipset-args.h.patch b/0001-build-do-install-libipset-args.h.patch new file mode 100644 index 0000000..c2f8edf --- /dev/null +++ b/0001-build-do-install-libipset-args.h.patch @@ -0,0 +1,28 @@ +From 39fde1381f0ba9101f65c08f2abda5426a46f8b1 Mon Sep 17 00:00:00 2001 +From: Jan Engelhardt +Date: Mon, 22 Jan 2018 22:50:33 +0100 +Subject: [PATCH] build: do install libipset/args.h + +libipset/types.h includes args.h, therefore args.h must be installed +too. + +Signed-off-by: Jan Engelhardt +Signed-off-by: Jozsef Kadlecsik +--- + include/libipset/Makefile.am | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/libipset/Makefile.am b/include/libipset/Makefile.am +index 3b47518..79a1357 100644 +--- a/include/libipset/Makefile.am ++++ b/include/libipset/Makefile.am +@@ -1,5 +1,6 @@ + pkgincludedir = ${includedir}/libipset + pkginclude_HEADERS = \ ++ args.h \ + data.h \ + errcode.h \ + linux_ip_set_bitmap.h \ +-- +2.11.0 + diff --git a/ipset.spec b/ipset.spec index d9ce877..4902a59 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 6.35 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -8,8 +8,13 @@ URL: http://ipset.netfilter.org/ Source0: http://ipset.netfilter.org/%{name}-%{version}.tar.bz2 Source1: %{name}.service Source2: %{name}.start-stop +Patch1: 0001-build-do-install-libipset-args.h.patch BuildRequires: libmnl-devel +BuildRequires: automake +BuildRequires: autoconf +BuildRequires: libtool +BuildRequires: libtool-ltdl-devel # An explicit requirement is needed here, to avoid cases where a user would # explicitly update only one of the two (e.g 'yum update ipset') @@ -65,10 +70,11 @@ out of the base package since it is not active by default. %prep -%setup -q +%autosetup -p1 %build +./autogen.sh %configure --enable-static=no --with-kmod=no # Just to make absolutely sure we are not building the bundled kernel module @@ -146,6 +152,9 @@ fi %changelog +* Mon Feb 12 2018 Eric Garver - 6.35-3 +- Patch for missing header file (RHBZ#1543596) + * Wed Feb 07 2018 Fedora Release Engineering - 6.35-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 4f5f54a6f725438f2cfb045b2c83df819f86f909 Mon Sep 17 00:00:00 2001 From: Susant Sahani Date: Sun, 24 Jun 2018 16:38:43 +0530 Subject: [PATCH 07/55] Adds tests according to the CI justification Adds tests according to the CI wiki specifically the standard test interface in the spec. The playbook includes Tier1 level test cases that have been tested in the following contexts and is passing reliably: Classic. Test logs are stored in the artifacts directory. The following steps are used to execute the tests using the standard test interface: Test enveronment Make sure you have installed packages from the spec ``` ansible-2.4.1.0-2.fc28.noarch python2-dnf-2.7.5-1.fc28.noarch libselinux-python-2.7-2.fc28.x86_64 standard-test-roles-2.5-1.fc28.noarch Run tests for Classic ``` Snip of the example test run for Classic tests: ``` test_ipset_add_bitmap_ip (__main__.IpsetTests) ... 192.168.11.12 is in set testnet. 192.168.11.13 is in set testnet. 192.168.11.14 is in set testnet. 192.168.11.15 is in set testnet. ok test_ipset_bitmap_ip_netfilter (__main__.IpsetTests) ... 192.168.225.32 is in set testnetiperf. 192.168.225.33 is in set testnetiperf. Connecting to host 192.168.225.32, port 55555 [ 5] local 192.168.225.32 port 54652 connected to 192.168.225.32 port 55555 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 7.79 GBytes 66.9 Gbits/sec 0 895 KBytes [ 5] 1.00-2.00 sec 7.99 GBytes 68.6 Gbits/sec 0 895 KBytes [ 5] 2.00-3.00 sec 7.99 GBytes 68.6 Gbits/sec 0 1.75 MBytes [ 5] 3.00-4.00 sec 7.79 GBytes 66.9 Gbits/sec 0 1.75 MBytes [ 5] 4.00-5.00 sec 8.03 GBytes 69.0 Gbits/sec 0 1.75 MBytes [ 5] 5.00-6.00 sec 7.94 GBytes 68.2 Gbits/sec 0 2.25 MBytes [ 5] 6.00-7.00 sec 7.88 GBytes 67.7 Gbits/sec 0 2.25 MBytes [ 5] 7.00-8.00 sec 8.06 GBytes 69.2 Gbits/sec 0 2.25 MBytes [ 5] 8.00-9.00 sec 7.89 GBytes 67.8 Gbits/sec 0 2.25 MBytes [ 5] 9.00-10.00 sec 7.85 GBytes 67.4 Gbits/sec 0 2.25 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 79.2 GBytes 68.0 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 79.2 GBytes 67.8 Gbits/sec receiver iperf Done. iperf3: error - unable to connect to server: Connection timed out ok test_ipset_delete_bitmap_ip (__main__.IpsetTests) ... 192.168.11.12 is in set testnet. 192.168.11.13 is in set testnet. 192.168.11.12 is NOT in set testnet. ok test_ipset_hash_bitmap_ipport (__main__.IpsetTests) ... 192.168.1.1,udp:53 is in set testipport. 192.168.1.1,tcp:5555 is in set testipport. 192.168.1.1,tcp:5555 is NOT in set testipport. ok test_ipset_hash_bitmap_ipportip (__main__.IpsetTests) ... 192.168.1.1,tcp:80,10.0.0.1 is in set testipportip. 192.168.1.1,tcp:80,10.0.0.1 is in set testipportip. 192.168.1.1,tcp:80,10.0.0.1 is NOT in set testipportip. ok 192.168.1.1,tcp:80,10.0.0.1 is NOT in set testipportip. ok test_ipset_hash_bitmap_mac (__main__.IpsetTests) ... 02:01:02:03:04:09 is in set testmac. 02:01:02:03:04:09 is NOT in set testmac. ok test_ipset_hash_bitmap_netiface (__main__.IpsetTests) ... 192.168.0.0/24,veth-test is in set testnetiface. 192.167.0.0/24,veth-peer is in set testnetiface. 192.168.0.0/24,veth-test is NOT in set testnetiface. ok ---------------------------------------------------------------------- Ran 7 tests in 15.545s OK :: [ 16:37:57 ] :: [ PASS ] :: Command '/usr/bin/python3 /usr/bin/ipset-tests.py' (Expected 0, got 0) :: [ 16:37:57 ] :: [ PASS ] :: Command '/usr/bin/python3 /usr/bin/ipset-tests.py' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 15s :: Duration: 15s :: Assertions: 1 good, 0 bad :: Assertions: 1 good, 0 bad :: RESULT: PASS :: RESULT: PASS ``` --- tests/sanity-tests/Makefile | 36 +++++ tests/sanity-tests/iperf3d.service | 10 ++ tests/sanity-tests/ipset-tests.py | 228 +++++++++++++++++++++++++++++ tests/sanity-tests/runtest.sh | 50 +++++++ tests/tests.yml | 15 ++ 5 files changed, 339 insertions(+) create mode 100644 tests/sanity-tests/Makefile create mode 100644 tests/sanity-tests/iperf3d.service create mode 100755 tests/sanity-tests/ipset-tests.py create mode 100755 tests/sanity-tests/runtest.sh create mode 100644 tests/tests.yml diff --git a/tests/sanity-tests/Makefile b/tests/sanity-tests/Makefile new file mode 100644 index 0000000..b11121b --- /dev/null +++ b/tests/sanity-tests/Makefile @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/ipset +# Description: Test if ipset working ok +# Author: Susant Sahani +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +export TEST=/CoreOS/ipset +export TESTVERSION=1.0 +BUILT_FILES= +FILES=$(METADATA) runtest.sh Makefile +.PHONY: all install download clean +run: $(FILES) build + ./runtest.sh +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh +clean: + rm -f *~ $(BUILT_FILES) +include /usr/share/rhts/lib/rhts-make.include +$(METADATA): Makefile + @echo "Owner: Susant Sahani" > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test ipset sanity" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: ipset " >> $(METADATA) + @echo "Requires: ipset iperf3 python3 systemd python3-pyroute2 iptables" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -Fedora 29" >> $(METADATA) + rhts-lint $(METADATA) diff --git a/tests/sanity-tests/iperf3d.service b/tests/sanity-tests/iperf3d.service new file mode 100644 index 0000000..179f317 --- /dev/null +++ b/tests/sanity-tests/iperf3d.service @@ -0,0 +1,10 @@ +[Unit] +Description=iperf3d tests for ipset +After=multi-user.target network.target + +[Service] +Type=simple +ExecStart=/usr/bin/iperf3 -s -d --bind 192.168.225.32 --port 55555 -V + +[Install] +WantedBy=multi-user.target diff --git a/tests/sanity-tests/ipset-tests.py b/tests/sanity-tests/ipset-tests.py new file mode 100755 index 0000000..9eccd06 --- /dev/null +++ b/tests/sanity-tests/ipset-tests.py @@ -0,0 +1,228 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# Description: Tests for ipset +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +import errno +import os +import sys +import time +import unittest +import subprocess +import signal +import shutil +import socket +from pyroute2 import IPRoute + +def setUpModule(): + + if shutil.which('ipset') is None: + raise OSError(errno.ENOENT, 'ipset not found') + + if shutil.which('iperf3') is None: + raise OSError(errno.ENOENT, 'iperf3 not found') + +def tearDownModule(): + pass + +class GenericUtilities(): + + def SetupVethInterface(self): + + ip = IPRoute() + + ip.link('add', ifname='veth-test', peer='veth-peer', kind='veth') + idx_veth_test = ip.link_lookup(ifname='veth-test')[0] + idx_veth_peer = ip.link_lookup(ifname='veth-peer')[0] + + ip.link('set', index=idx_veth_test, address='02:01:02:03:04:08') + ip.link('set', index=idx_veth_peer, address='02:01:02:03:04:09') + + ip.addr('add', index=idx_veth_test, address='192.168.225.32', mask=24) + ip.addr('add', index=idx_veth_peer, address='192.168.225.33', mask=24) + + ip.link('set', index=idx_veth_test, state='up') + ip.link('set', index=idx_veth_peer, state='up') + + ip.close() + + def TearDownVethInterface(self): + + ip = IPRoute() + ip.link('del', index=ip.link_lookup(ifname='veth-test')[0]) + ip.close() + + def AddAddress(self, interface, address): + ip = IPRoute() + + idx_veth_peer = ip.link_lookup(ifname=interface)[0] + ip.close() + + def IPSetAdd(self, hashset, address): + subprocess.check_output(['ipset', 'add', hashset, address]) + + def IPSetRemove(self, hashset, address): + subprocess.check_output(['ipset', 'del', hashset, address]) + + def IPSetCreateHashSet(self, hashset, hashtype): + subprocess.check_output(['ipset', 'create', hashset, hashtype]) + + def IPSetDestroyHashSet(self, hashset): + subprocess.check_output(['ipset', 'destroy', hashset]) + +class IpsetTests(unittest.TestCase, GenericUtilities): + + def setUp(self): + self.SetupVethInterface() + + def tearDown(self): + self.TearDownVethInterface() + + def test_ipset_bitmap_ip_netfilter(self): + + self.IPSetCreateHashSet('testnetiperf', 'hash:ip') + + self.IPSetAdd('testnetiperf', '192.168.225.32') + self.IPSetAdd('testnetiperf', '192.168.225.33') + + subprocess.check_output(['ipset', 'test','testnetiperf','192.168.225.32']) + subprocess.check_output(['ipset', 'test','testnetiperf','192.168.225.33']) + + subprocess.check_output(['systemctl', 'start', 'iperf3d.service']) + time.sleep(5) + + r = subprocess.call("iperf3" + " -c 192.168.225.32 -p 55555 --connect-timeout 5", shell=True) + self.assertEqual(r, 0) + + r = subprocess.call("iptables" + " -I INPUT -m set --match-set testnetiperf src -j DROP", shell=True) + self.assertEqual(r, 0) + + r = subprocess.call("iperf3" + " -c 192.168.225.32 -p 55555 --connect-timeout 5", shell=True) + self.assertNotEqual(r, 0) + + subprocess.check_output(['systemctl', 'stop', 'iperf3d.service']) + + subprocess.call("iptables" + " --delete INPUT -m set --match-set testnetiperf src -j DROP" , shell=True) + + self.IPSetDestroyHashSet('testnetiperf') + + def test_ipset_add_bitmap_ip(self): + + self.IPSetCreateHashSet('testnet', 'hash:ip') + + self.IPSetAdd('testnet', '192.168.11.12') + self.IPSetAdd('testnet', '192.168.11.13') + self.IPSetAdd('testnet', '192.168.11.14') + self.IPSetAdd('testnet', '192.168.11.15') + + subprocess.check_output(['ipset', 'test','testnet','192.168.11.12']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.13']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.14']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.15']) + + self.IPSetDestroyHashSet('testnet') + + def test_ipset_delete_bitmap_ip(self): + + self.IPSetCreateHashSet('testnet', 'hash:ip') + + self.IPSetAdd('testnet', '192.168.11.12') + self.IPSetAdd('testnet', '192.168.11.13') + + subprocess.check_output(['ipset', 'test','testnet','192.168.11.12']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.13']) + + self.IPSetRemove('testnet', '192.168.11.12') + + r = subprocess.call("ipset" + " test testnet 192.168.11.12", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testnet') + + def test_ipset_hash_bitmap_mac(self): + + self.IPSetCreateHashSet('testmac', 'hash:mac') + + self.IPSetAdd('testmac', '02:01:02:03:04:09') + + subprocess.check_output(['ipset', 'test','testmac','02:01:02:03:04:09']) + + self.IPSetRemove('testmac', '02:01:02:03:04:09') + + r = subprocess.call("ipset" + " test testmac 02:01:02:03:04:09", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testmac') + + def test_ipset_hash_bitmap_ipport(self): + + self.IPSetCreateHashSet('testipport', 'hash:ip,mac') + + self.IPSetAdd('testipport', '1.1.1.1,02:01:02:03:04:09') + + subprocess.check_output(['ipset', 'test','testipport','1.1.1.1,02:01:02:03:04:09']) + + self.IPSetRemove('testipport', '1.1.1.1,02:01:02:03:04:09') + + r = subprocess.call("ipset" + " test testipport 1.1.1.1,02:01:02:03:04:09", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testipport') + + def test_ipset_hash_bitmap_ipport(self): + + self.IPSetCreateHashSet('testipport', 'hash:ip,port') + + self.IPSetAdd('testipport', '192.168.1.1,udp:53') + self.IPSetAdd('testipport', '192.168.1.1,5555') + + subprocess.check_output(['ipset', 'test','testipport','192.168.1.1,udp:53']) + subprocess.check_output(['ipset', 'test','testipport','192.168.1.1,5555']) + + self.IPSetRemove('testipport', '192.168.1.1,5555') + + r = subprocess.call("ipset" + " test testipport 192.168.1.1,5555", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testipport') + + def test_ipset_hash_bitmap_ipportip(self): + + self.IPSetCreateHashSet('testipportip', 'hash:ip,port,ip') + + self.IPSetAdd('testipportip', '192.168.1.1,80,10.0.0.1') + self.IPSetAdd('testipportip', '192.168.1.2,80,10.0.0.2') + + subprocess.check_output(['ipset', 'test','testipportip','192.168.1.1,80,10.0.0.1']) + subprocess.check_output(['ipset', 'test','testipportip','192.168.1.1,80,10.0.0.1']) + + self.IPSetRemove('testipportip', '192.168.1.1,80,10.0.0.1') + + r = subprocess.call("ipset" + " test testipportip 192.168.1.1,80,10.0.0.1", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testipportip') + + def test_ipset_hash_bitmap_netiface(self): + + self.IPSetCreateHashSet('testnetiface', 'hash:net,iface') + + self.IPSetAdd('testnetiface', '192.168.0/24,veth-test') + self.IPSetAdd('testnetiface', '192.167.0/24,veth-peer') + + subprocess.check_output(['ipset', 'test','testnetiface','192.168.0/24,veth-test']) + subprocess.check_output(['ipset', 'test','testnetiface','192.167.0/24,veth-peer']) + + self.IPSetRemove('testnetiface', '192.168.0/24,veth-test') + + r = subprocess.call("ipset" + " test testnetiface 192.168.0/24,veth-test", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testnetiface') + +if __name__ == '__main__': + unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, verbosity=3)) diff --git a/tests/sanity-tests/runtest.sh b/tests/sanity-tests/runtest.sh new file mode 100755 index 0000000..78f525d --- /dev/null +++ b/tests/sanity-tests/runtest.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# runtest.sh of ipset +# Description: ipset tests. +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="ipset" + +SERVICE_UNITDIR="/var/run/systemd/system" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "systemctl stop firewalld" 0,5 + rlRun "setenforce 0" 0,1 + + rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1 + + rlRun "cp iperf3d.service $SERVICE_UNITDIR" + rlRun "cp ipset-tests.py /usr/bin/" + + rlRun "systemctl daemon-reload" + rlPhaseEnd + + rlPhaseStartTest + rlLog "Starting ipset tests ..." + rlRun "/usr/bin/python3 /usr/bin/ipset-tests.py" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm /usr/bin/ipset-tests.py" + rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1 + + rlRun "rm $SERVICE_UNITDIR/iperf3d.service" + rlRun "systemctl daemon-reload" + + rlRun "setenforce 1" 0,1 + rlLog "ipset tests done" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + +rlGetTestState diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..17d20d6 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,15 @@ +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - sanity-tests + required_packages: + - ipset + - iptables + - python3 + - systemd + - iproute + - iperf3 + - python3-pyroute2 From 81db011686a1c53b8881faf6b3f92aae6ae3aac3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 13 Jul 2018 05:48:46 +0000 Subject: [PATCH 08/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 4902a59..893d8e5 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 6.35 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -152,6 +152,9 @@ fi %changelog +* Fri Jul 13 2018 Fedora Release Engineering - 6.35-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Mon Feb 12 2018 Eric Garver - 6.35-3 - Patch for missing header file (RHBZ#1543596) From 593bb710a2d21d6f6774eab232359d3e3671a874 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 13 Aug 2018 14:02:27 +0200 Subject: [PATCH 09/55] Update to 6.38 --- ipset.spec | 22 ++++++++++++---------- sources | 2 +- 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/ipset.spec b/ipset.spec index 893d8e5..db8c054 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 6.35 -Release: 4%{?dist} +Version: 6.38 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -8,7 +8,6 @@ URL: http://ipset.netfilter.org/ Source0: http://ipset.netfilter.org/%{name}-%{version}.tar.bz2 Source1: %{name}.service Source2: %{name}.start-stop -Patch1: 0001-build-do-install-libipset-args.h.patch BuildRequires: libmnl-devel BuildRequires: automake @@ -85,11 +84,11 @@ rm -fr kernel sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool -make %{?_smp_mflags} +%make_build %install -make install DESTDIR=%{buildroot} +%make_install find %{buildroot} -name '*.la' -exec rm -f '{}' \; # install systemd unit file @@ -111,9 +110,7 @@ if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then fi -%post libs -p /sbin/ldconfig - -%postun libs -p /sbin/ldconfig +%ldconfig_scriptlets libs %post service @@ -131,12 +128,13 @@ fi %files -%doc COPYING ChangeLog +%doc ChangeLog +%license COPYING %doc %{_mandir}/man8/%{name}.8.gz %{_sbindir}/%{name} %files libs -%doc COPYING +%license COPYING %{_libdir}/lib%{name}.so.11* %files devel @@ -152,6 +150,10 @@ fi %changelog +* Mon Aug 13 2018 Nicolas Chauvet - 6.38-1 +- Update to 6.38 +- Clean-up spec + * Fri Jul 13 2018 Fedora Release Engineering - 6.35-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild diff --git a/sources b/sources index 47ffa7b..7926983 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-6.35.tar.bz2) = f58da34a1d32ff8f8de7e19384b4c6f4b9da5c73e7680a185cb23d4aa3682736b5692eb09348f4fa5dec89f9f20884371a34f30b879144183e37671617b64cb1 +SHA512 (ipset-6.38.tar.bz2) = ba8c45fa6b4df1b4af848d8c0c218fb449a50c79c48b1d1550dd3a188f82d320956bc483874730f917249d8650e50c3eedff66c24a68a136246fdbf6e1127d60 From 701b47134b782fb2b790c927185883da2618c2e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 1 Feb 2019 03:30:14 +0000 Subject: [PATCH 10/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index db8c054..216c00a 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 6.38 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -150,6 +150,9 @@ fi %changelog +* Fri Feb 01 2019 Fedora Release Engineering - 6.38-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Mon Aug 13 2018 Nicolas Chauvet - 6.38-1 - Update to 6.38 - Clean-up spec From 7ae4b9eb67478f40416149c9c1d9b614a238ba9e Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Thu, 11 Jul 2019 16:58:55 +0200 Subject: [PATCH 11/55] Update to 7.2 --- ipset.spec | 9 ++++++--- sources | 2 +- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/ipset.spec b/ipset.spec index 216c00a..d6ab19e 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,11 +1,11 @@ Name: ipset -Version: 6.38 -Release: 2%{?dist} +Version: 7.2 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 URL: http://ipset.netfilter.org/ -Source0: http://ipset.netfilter.org/%{name}-%{version}.tar.bz2 +Source0: %{url}/%{name}-%{version}.tar.bz2 Source1: %{name}.service Source2: %{name}.start-stop @@ -150,6 +150,9 @@ fi %changelog +* Thu Jul 11 2019 Nicolas Chauvet - 7.2-1 +- Update to 7.2 + * Fri Feb 01 2019 Fedora Release Engineering - 6.38-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/sources b/sources index 7926983..6b7ba8b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-6.38.tar.bz2) = ba8c45fa6b4df1b4af848d8c0c218fb449a50c79c48b1d1550dd3a188f82d320956bc483874730f917249d8650e50c3eedff66c24a68a136246fdbf6e1127d60 +SHA512 (ipset-7.2.tar.bz2) = b97321d8da5e9df04bab1d1250039a522f0349d929c61e9c51d0ce6a6b0c3b297715fe1d403e1e0b65ebed379612c95d3997684efe786b614f72930031eda4e2 From dfbb15cf5bf2bff73d868073d6ba6ee4291c75b4 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Thu, 11 Jul 2019 18:16:38 +0200 Subject: [PATCH 12/55] Bump abi - but no users --- ipset.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index d6ab19e..894f3fe 100644 --- a/ipset.spec +++ b/ipset.spec @@ -135,7 +135,7 @@ fi %files libs %license COPYING -%{_libdir}/lib%{name}.so.11* +%{_libdir}/lib%{name}.so.13* %files devel %{_includedir}/lib%{name} From 74a8b03f913ddb2a3e12a06d64383c0636c8c4e9 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Thu, 11 Jul 2019 18:23:42 +0200 Subject: [PATCH 13/55] Add missing man --- ipset.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 894f3fe..2447593 100644 --- a/ipset.spec +++ b/ipset.spec @@ -130,7 +130,7 @@ fi %files %doc ChangeLog %license COPYING -%doc %{_mandir}/man8/%{name}.8.gz +%{_mandir}/man8/%{name}.8.* %{_sbindir}/%{name} %files libs @@ -141,6 +141,7 @@ fi %{_includedir}/lib%{name} %{_libdir}/lib%{name}.so %{_libdir}/pkgconfig/lib%{name}.pc +%{_mandir}/man3/libipset.3.* %files service %{_unitdir}/%{name}.service From 7ad1b36931b3d2afd6270ad90b9ec09c8665bd94 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jul 2019 09:39:58 +0000 Subject: [PATCH 14/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 2447593..68c349c 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -151,6 +151,9 @@ fi %changelog +* Thu Jul 25 2019 Fedora Release Engineering - 7.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Thu Jul 11 2019 Nicolas Chauvet - 7.2-1 - Update to 7.2 From eb982c915467d211536961329c5f8fbd6981e2ee Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 19 Aug 2019 12:15:41 +0200 Subject: [PATCH 15/55] Update to 7.3 --- ipset.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ipset.spec b/ipset.spec index 68c349c..e46e4d5 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.2 -Release: 2%{?dist} +Version: 7.3 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -151,6 +151,9 @@ fi %changelog +* Mon Aug 19 2019 Nicolas Chauvet - 7.3-1 +- Update to 7.3 + * Thu Jul 25 2019 Fedora Release Engineering - 7.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 6b7ba8b..12429a5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.2.tar.bz2) = b97321d8da5e9df04bab1d1250039a522f0349d929c61e9c51d0ce6a6b0c3b297715fe1d403e1e0b65ebed379612c95d3997684efe786b614f72930031eda4e2 +SHA512 (ipset-7.3.tar.bz2) = 8ad532c370a738e8bd70f118f109ba95683f781d754b9001980e7151fd15ee05da913a8e08ce597ba7173124d650ad4bb0936d6528f8dd657aaa28e27ab472c4 From cd2727ae8f7be045cdceeb9a689630895f5177ba Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Mon, 4 Nov 2019 15:09:00 -0500 Subject: [PATCH 16/55] Update to 7.4 Resolves: rhbz 1767905 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index e46e4d5..9f35cc2 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.3 +Version: 7.4 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -151,6 +151,9 @@ fi %changelog +* Mon Nov 04 2019 Eric Garver - 7.4-1 +- Update to 7.4 + * Mon Aug 19 2019 Nicolas Chauvet - 7.3-1 - Update to 7.3 diff --git a/sources b/sources index 12429a5..318de09 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.3.tar.bz2) = 8ad532c370a738e8bd70f118f109ba95683f781d754b9001980e7151fd15ee05da913a8e08ce597ba7173124d650ad4bb0936d6528f8dd657aaa28e27ab472c4 +SHA512 (ipset-7.4.tar.bz2) = b155ced6be88aabd38c2402604bac37ba898aeae50c2d5a7d888d1b33b536b4551387826a4f76878ebb10e97ffaca08245b5ed8a5e3c431cc224b23cbb86a196 From 98c998783555c01d495268ddc4f6f5c307e22b95 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Fri, 10 Jan 2020 09:42:40 +0100 Subject: [PATCH 17/55] Update to 7.5 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index 9f35cc2..6956aa9 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.4 +Version: 7.5 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -151,6 +151,9 @@ fi %changelog +* Fri Jan 10 2020 Nicolas Chauvet - 7.5-1 +- Update to 7.5 + * Mon Nov 04 2019 Eric Garver - 7.4-1 - Update to 7.4 diff --git a/sources b/sources index 318de09..21f929d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.4.tar.bz2) = b155ced6be88aabd38c2402604bac37ba898aeae50c2d5a7d888d1b33b536b4551387826a4f76878ebb10e97ffaca08245b5ed8a5e3c431cc224b23cbb86a196 +SHA512 (ipset-7.5.tar.bz2) = 97e2a42bb33dfd2d9c5d258595e4be670d961ce3f5fa537ffb32b748168324f4e572047f026096c142e3a1f5a88caa26da455cbc067121dc9140f79321f272aa From e48e9a1dd23a88dd79965a045bd9bad335f7ba9e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 05:36:09 +0000 Subject: [PATCH 18/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 6956aa9..de8407a 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -151,6 +151,9 @@ fi %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 7.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Fri Jan 10 2020 Nicolas Chauvet - 7.5-1 - Update to 7.5 From 64e0be575c2923333fe67f3c27949d94a85c0fb4 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 24 Feb 2020 11:27:16 +0100 Subject: [PATCH 19/55] Update to 7.6 --- ipset.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ipset.spec b/ipset.spec index de8407a..7e510b1 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.5 -Release: 2%{?dist} +Version: 7.6 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -151,6 +151,9 @@ fi %changelog +* Mon Feb 24 2020 Nicolas Chauvet - 7.6-1 +- Update to 7.6 + * Wed Jan 29 2020 Fedora Release Engineering - 7.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index 21f929d..e4f1392 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.5.tar.bz2) = 97e2a42bb33dfd2d9c5d258595e4be670d961ce3f5fa537ffb32b748168324f4e572047f026096c142e3a1f5a88caa26da455cbc067121dc9140f79321f272aa +SHA512 (ipset-7.6.tar.bz2) = c4d9c65895335dec8f855fca6c940d2ee19e7b8d2292325778a1608e795e2e35caa787cbcdeb8e2877f3695c641ac348b23ac43f73bdc1a8242e8d04f4944084 From c937e6ad0a272b39d0535b69057ba5d9eac9441d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 01:55:43 +0000 Subject: [PATCH 20/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 7e510b1..58c3bbc 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -151,6 +151,9 @@ fi %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 7.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Mon Feb 24 2020 Nicolas Chauvet - 7.6-1 - Update to 7.6 From 99a4095dd78aaf8fb3b57b4b595ff33b6dc9310b Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Wed, 16 Dec 2020 09:26:29 +0100 Subject: [PATCH 21/55] Update to 7.9 --- ipset.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ipset.spec b/ipset.spec index 58c3bbc..601de17 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.6 -Release: 2%{?dist} +Version: 7.9 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -151,6 +151,9 @@ fi %changelog +* Wed Dec 16 2020 Nicolas Chauvet - 7.9-1 +- Update to 7.9 + * Tue Jul 28 2020 Fedora Release Engineering - 7.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index e4f1392..9ba50a2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.6.tar.bz2) = c4d9c65895335dec8f855fca6c940d2ee19e7b8d2292325778a1608e795e2e35caa787cbcdeb8e2877f3695c641ac348b23ac43f73bdc1a8242e8d04f4944084 +SHA512 (ipset-7.9.tar.bz2) = 53d52aa9c0aba728fd620a7b9e232e5366fa45322d3d23150192b53e311877c61175577b6a0fbde95eaa1fb12deca3251a682fd74c3443558e34a1fe2247309e From 80410c56f5e92fa5c3cd2491f86adf3883b7de52 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 19 Dec 2020 00:54:20 +0000 Subject: [PATCH 22/55] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- ipset.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/ipset.spec b/ipset.spec index 601de17..0e95c7b 100644 --- a/ipset.spec +++ b/ipset.spec @@ -57,6 +57,7 @@ libraries. Summary: %{name} service for %{name}s Requires: %{name} = %{version}-%{release} BuildRequires: systemd +BuildRequires: make Requires: iptables-services Requires(post): systemd Requires(preun): systemd From 69dd0662469fc5658756692bad16ae66cc6b236e Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 21 Dec 2020 10:23:43 +0100 Subject: [PATCH 23/55] Fixup make BR --- ipset.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 0e95c7b..b39c6d0 100644 --- a/ipset.spec +++ b/ipset.spec @@ -12,6 +12,7 @@ Source2: %{name}.start-stop BuildRequires: libmnl-devel BuildRequires: automake BuildRequires: autoconf +BuildRequires: make BuildRequires: libtool BuildRequires: libtool-ltdl-devel @@ -57,7 +58,6 @@ libraries. Summary: %{name} service for %{name}s Requires: %{name} = %{version}-%{release} BuildRequires: systemd -BuildRequires: make Requires: iptables-services Requires(post): systemd Requires(preun): systemd From b9164d90d8cbfc2ee6f5c95e317bf7d3cb419031 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 21 Dec 2020 10:24:46 +0100 Subject: [PATCH 24/55] Update to 7.10 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index b39c6d0..f6be47b 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.9 +Version: 7.10 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -152,6 +152,9 @@ fi %changelog +* Mon Dec 21 2020 Nicolas Chauvet - 7.10-1 +- Update to 7.10 + * Wed Dec 16 2020 Nicolas Chauvet - 7.9-1 - Update to 7.9 diff --git a/sources b/sources index 9ba50a2..41df4b1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.9.tar.bz2) = 53d52aa9c0aba728fd620a7b9e232e5366fa45322d3d23150192b53e311877c61175577b6a0fbde95eaa1fb12deca3251a682fd74c3443558e34a1fe2247309e +SHA512 (ipset-7.10.tar.bz2) = 7f45c46f8c158600b1e64354500f31e7fb3c8ee844d55eab9f7eec298eecc27c9cb89e24a8ec6c180665dd0cc29776a9e42ada796b3e87d034cc39cdd4665807 From 0742e37439016677862662a3421aadf91059c5b3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 14:27:56 +0000 Subject: [PATCH 25/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index f6be47b..cf8f446 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.10 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -152,6 +152,9 @@ fi %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 7.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Mon Dec 21 2020 Nicolas Chauvet - 7.10-1 - Update to 7.10 From 522137356f2f27d0e817b406bd140893c4f86cc8 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 1 Mar 2021 21:35:10 +0100 Subject: [PATCH 26/55] Update to 7.11 --- ipset.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ipset.spec b/ipset.spec index cf8f446..103b7cd 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.10 -Release: 2%{?dist} +Version: 7.11 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -152,6 +152,9 @@ fi %changelog +* Mon Mar 01 2021 Nicolas Chauvet - 7.11-1 +- Update to 7.11 + * Tue Jan 26 2021 Fedora Release Engineering - 7.10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 41df4b1..4ee5b0d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.10.tar.bz2) = 7f45c46f8c158600b1e64354500f31e7fb3c8ee844d55eab9f7eec298eecc27c9cb89e24a8ec6c180665dd0cc29776a9e42ada796b3e87d034cc39cdd4665807 +SHA512 (ipset-7.11.tar.bz2) = 20890de32c17c04d9d3ae42fff64acfe21a252974bee5843ae39bdda707fcef55fde11cffccab9f987bf7e18f5445443c46c50eb854fb6f93f172f7bad07f922 From 24f8d4962229e9a69a55533bcbd465e46395f78c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:36 +0100 Subject: [PATCH 27/55] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- ipset.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 103b7cd..2cfc6b3 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.11 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -152,6 +152,10 @@ fi %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 7.11-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Mon Mar 01 2021 Nicolas Chauvet - 7.11-1 - Update to 7.11 From 6bf608f3aac7420c027e6f28b85b6d793d472c59 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 08:42:09 +0000 Subject: [PATCH 28/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 2cfc6b3..fddd1fb 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.11 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -152,6 +152,9 @@ fi %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 7.11-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 7.11-2 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From 3cb6e9311313e7c4936b709fdbcd0f544a1e90e7 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Wed, 28 Jul 2021 20:02:37 +0200 Subject: [PATCH 29/55] Update to 7.14 --- ipset.spec | 10 +++++++--- sources | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/ipset.spec b/ipset.spec index fddd1fb..cd59b6f 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.11 -Release: 3%{?dist} +Version: 7.14 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -131,8 +131,9 @@ fi %files %doc ChangeLog %license COPYING -%{_mandir}/man8/%{name}.8.* +%{_mandir}/man8/%{name}*.8.* %{_sbindir}/%{name} +%{_sbindir}/%{name}-translate %files libs %license COPYING @@ -152,6 +153,9 @@ fi %changelog +* Wed Jul 28 2021 Nicolas Chauvet - 7.14-1 +- Update to 7.14 + * Thu Jul 22 2021 Fedora Release Engineering - 7.11-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/sources b/sources index 4ee5b0d..3c7f3e2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.11.tar.bz2) = 20890de32c17c04d9d3ae42fff64acfe21a252974bee5843ae39bdda707fcef55fde11cffccab9f987bf7e18f5445443c46c50eb854fb6f93f172f7bad07f922 +SHA512 (ipset-7.14.tar.bz2) = 860f63122eabfc4490fa61068d8ea637d9c3b47d9a77a266d2792b083c079eb2999f67d2c732ce156905559c28754bc74fc9175cf8ed0bc58a2802295dcf807e From 000dbd0940e5dba805f5e22296dd600059ba7bc2 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 16 Aug 2021 15:56:09 +0200 Subject: [PATCH 30/55] Update to 7.15 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index cd59b6f..5a0c070 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.14 +Version: 7.15 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -153,6 +153,9 @@ fi %changelog +* Mon Aug 16 2021 Nicolas Chauvet - 7.15-1 +- Update to 7.15 + * Wed Jul 28 2021 Nicolas Chauvet - 7.14-1 - Update to 7.14 diff --git a/sources b/sources index 3c7f3e2..f2cddcc 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.14.tar.bz2) = 860f63122eabfc4490fa61068d8ea637d9c3b47d9a77a266d2792b083c079eb2999f67d2c732ce156905559c28754bc74fc9175cf8ed0bc58a2802295dcf807e +SHA512 (ipset-7.15.tar.bz2) = 0fc936d971c30a0925c585d506c8840e782fdaeec09bc8fd249e874fe838fa55a4dbb697f6e1423a6769abf07a1ce2195abc37cb641e8e4ad70f1b4c7130916a From 11d86e40ecef300cbda24e3c6cbde1a3afa41217 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 13:25:14 +0000 Subject: [PATCH 31/55] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 5a0c070..0467c5a 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.15 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -153,6 +153,9 @@ fi %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 7.15-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Mon Aug 16 2021 Nicolas Chauvet - 7.15-1 - Update to 7.15 From 2c76e0d4d85066a8ab98a0cd506e88f172c702df Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 15 Mar 2022 18:34:19 +0100 Subject: [PATCH 32/55] ipset-7.15-3 - Use the advanced init script from Centos9Stream Resolves: rhbz#2052926 --- ipset-config | 5 + ipset.service | 7 +- ipset.spec | 25 ++- ipset.start-stop | 500 ++++++++++++++++++++++++++++++----------------- 4 files changed, 357 insertions(+), 180 deletions(-) create mode 100644 ipset-config diff --git a/ipset-config b/ipset-config new file mode 100644 index 0000000..758f40b --- /dev/null +++ b/ipset-config @@ -0,0 +1,5 @@ +# Save current ipsets on stop. +# Value: yes|no, default: no +# Saves all ipsets to /etc/sysconfig/ipset.d/ if service gets stopped +# (e.g. on system shutdown). +IPSET_SAVE_ON_STOP="no" diff --git a/ipset.service b/ipset.service index f4a0802..65c3121 100644 --- a/ipset.service +++ b/ipset.service @@ -9,10 +9,11 @@ RemainAfterExit=yes ExecStart=/usr/libexec/ipset/ipset.start-stop start ExecStop=/usr/libexec/ipset/ipset.start-stop stop ExecReload=/usr/libexec/ipset/ipset.start-stop reload -# Save current ipset entries on stop/restart. +# Save current ipset entries on stop. # Value: yes|no, default: no -# Saves all ipsets to /etc/ipset/ipset if ipset gets stopped -Environment=IPSET_SAVE_ON_STOP=no IPSET_SAVE_ON_RESTART=no +# Saves all ipsets to /etc/sysconfig/ipset if ipset gets stopped +Environment=IPSET_SAVE_ON_STOP=no +EnvironmentFile=-/etc/sysconfig/ipset-config [Install] WantedBy=basic.target diff --git a/ipset.spec b/ipset.spec index 0467c5a..1ae7362 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.15 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -8,6 +8,7 @@ URL: http://ipset.netfilter.org/ Source0: %{url}/%{name}-%{version}.tar.bz2 Source1: %{name}.service Source2: %{name}.start-stop +Source3: %{name}-config BuildRequires: libmnl-devel BuildRequires: automake @@ -100,6 +101,10 @@ install -c -m 644 %{SOURCE1} %{buildroot}/%{_unitdir} install -d -m 755 %{buildroot}%{_libexecdir}/%{name} install -c -m 755 %{SOURCE2} %{buildroot}%{_libexecdir}/%{name} +# install ipset-config +install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig +install -c -m 600 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/%{name}-config + # Create directory for configuration mkdir -p %{buildroot}%{_sysconfdir}/%{name} @@ -116,6 +121,18 @@ fi %post service %systemd_post %{name}.service +if [[ -f /etc/ipset/ipset ]] && [[ ! -f /etc/sysconfig/ipset ]]; then + mv /etc/ipset/ipset /etc/sysconfig/ipset + ln -s /etc/sysconfig/ipset /etc/ipset/ipset + echo "Warning: ipset save location has moved to /etc/sysconfig" +fi +[[ -f /etc/sysconfig/iptables-config ]] && . /etc/sysconfig/iptables-config +[[ -f /etc/sysconfig/ip6tables-config ]] && . /etc/sysconfig/ip6tables-config +if [[ ${IPTABLES_SAVE_ON_STOP} == yes ]] || \ + [[ ${IP6TABLES_SAVE_ON_STOP} == yes ]]; then + echo "Warning: ipset no longer saves automatically when iptables does" + echo " must enable explicitly in /etc/sysconfig/ipset-config" +fi %preun service if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then @@ -148,11 +165,15 @@ fi %files service %{_unitdir}/%{name}.service %dir %{_libexecdir}/%{name} +%config(noreplace) %attr(0600,root,root) %{_sysconfdir}/sysconfig/ipset-config +%ghost %config(noreplace) %attr(0600,root,root) %{_sysconfdir}/sysconfig/ipset %attr(0755,root,root) %{_libexecdir}/%{name}/%{name}.start-stop -%dir %{_sysconfdir}/%{name} %changelog +* Tue Mar 15 2022 Phil Sutter - 7.15-3 +- Use the advanced init script from Centos9Stream + * Thu Jan 20 2022 Fedora Release Engineering - 7.15-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild diff --git a/ipset.start-stop b/ipset.start-stop index da21890..377beed 100644 --- a/ipset.start-stop +++ b/ipset.start-stop @@ -1,209 +1,359 @@ -#!/bin/bash +#!/bin/sh # # ipset Start and stop ipset firewall sets # -# config: /etc/ipset/ipset -# +# config: /etc/sysconfig/ipset-config -IPSET=ipset -IPSET_BIN=/usr/sbin/${IPSET} -IPSET_DATA=/etc/${IPSET}/${IPSET} +IPSET_BIN=/usr/sbin/ipset +IPSET_CONFIG=/etc/sysconfig/ipset-config +IPSET_DATA_COMPAT=/etc/sysconfig/ipset +IPSET_DATA_COMPAT_BACKUP=${IPSET_DATA_COMPAT}.save +IPSET_DATA_DIR=/etc/sysconfig/ipset.d +IPSET_DATA_DIR_BACKUP=${IPSET_DATA_DIR}.save +IPSET_DATA_SAVED_FLAG=${IPSET_DATA_DIR}/.saved +IPSET_LOCK=/run/ipset.lock +IPSET_RUN=/run/ipset.run +CLEAN_FILES="" -IPTABLES_CONFIG=/etc/sysconfig/iptables-config -IP6TABLES_CONFIG=${IPTABLES_CONFIG/iptables/ip6tables} +trap "rm -rf \${CLEAN_FILES}" EXIT -TMP_FIFO=/tmp/${IPSET}.$$ - -if [[ ! -x ${IPSET_BIN} ]]; then - echo "${IPSET_BIN} does not exist." - exit 5 -fi - -CLEAN_FILES=TMP_FIFO -trap "rm -f \$CLEAN_FILES" EXIT - -# Default ipset configuration: -[[ -z $IPSET_SAVE_ON_STOP ]] && IPSET_SAVE_ON_STOP=no # Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_STOP -[[ -z $IPSET_SAVE_ON_RESTART ]] && IPSET_SAVE_ON_RESTART=no # Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_RESTART - -# Load iptables configuration(s) -[[ -f "$IPTABLES_CONFIG" ]] && . "$IPTABLES_CONFIG" -[[ -f "$IP6TABLES_CONFIG" ]] && . "$IP6TABLES_CONFIG" - -# It doesn't make sense to save iptables config and not our config -[[ ${IPTABLES_SAVE_ON_STOP} = yes || ${IP6TABLES_SAVE_ON_STOP} = yes ]] && IPSET_SAVE_ON_STOP=yes -[[ ${IPTABLES_SAVE_ON_RESTART} = yes || ${IP6TABLES_SAVE_ON_RESTART} = yes ]] && IPSET_SAVE_ON_RESTART=yes - -check_can_unload() { - # If the xt_set module is loaded and can't be unloaded, then iptables is - # using ipsets, so refuse to stop the service. - if [[ -n $(lsmod | grep "^xt_set ") ]]; then - rmmod xt_set 2>/dev/null - [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && return 1 - fi - - return 0 +info() { + echo "ipset: ${*}" >&2 } -flush_n_delete() { - local ret=0 set - - # Flush sets - ${IPSET_BIN} flush - let ret+=$? - - # Delete ipset sets. If we don't do them individually, then none - # will be deleted unless they all can be. - for set in $(${IPSET_BIN} list -name); do - ${IPSET_BIN} destroy 2>/dev/null - [[ $? -ne 0 ]] && ret=1 - done - - return $ret +warn() { + echo "<4>ipset: ${*}" >&2 } -start_clean() -{ - mkfifo -m go= "${TMP_FIFO}" - [[ $? -ne 0 ]] && return 1 - - # Get the lists of sets in current(old) config and new config - old_sets="$(${IPSET_BIN} list -name | sort -u)" - new_sets="$(grep ^create "${IPSET_DATA}" | cut -d " " -f 2 | sort -u)" - - # List of sets no longer wanted - drop_sets="$( printf "%s\n" "${old_sets}" > "${TMP_FIFO}" & - printf "%s\n" "${new_sets}" | comm -23 "${TMP_FIFO}" - - )" - - # Get rid of sets no longer needed - # Unfortunately -! doesn't work for destroy, so we have to do it a command at a time - for dset in $drop_sets; do - ipset destroy $dset 2>/dev/null - # If it won't go - ? in use by iptables, just clear it - [[ $? -ne 0 ]] && ipset flush $dset - done - - # Now delete the set members no longer required - ${IPSET_BIN} save | grep "^add " | sort >${TMP_FIFO} & - grep "^add " ${IPSET_DATA} | sort | comm -23 ${TMP_FIFO} - | sed -e "s/^add /del /" \ - | ${IPSET_BIN} restore -! - - # At last we can add the set members we haven't got - ipset restore -! <${IPSET_DATA} - - rm ${TMP_FIFO} - - return 0 +err() { + echo "<3>ipset: ${*}" >&2 } -start() { - # Do not start if there is no config file. - [[ ! -f "$IPSET_DATA" ]] && echo "Loaded with no configuration" && return 0 +[ -x ${IPSET_BIN} ] || { err "Cannot execute ${IPSET_BIN}"; exit 1; } - # We can skip the first bit and do a simple load if - # there is no current ipset configuration - res=1 - if [[ -n $(${IPSET_BIN} list -name) ]]; then - # The following may fail for some bizarre reason - start_clean - res=$? +# Source ipset configuration +# shellcheck source=ipset-config +[ -f ${IPSET_CONFIG} ] && . ${IPSET_CONFIG} - [[ $res -ne 0 ]] && echo "Some old configuration may remain" - fi +set -f - # res -ne 0 => either start_clean failed, or we didn't need to run it - if [[ $res -ne 0 ]]; then - # This is the easy way to start but would leave any old - # entries still configured. Still, better than nothing - - # but fine if we had no config - ${IPSET_BIN} restore -! <${IPSET_DATA} - res=$? - fi - - if [[ $res -ne 0 ]]; then - return 1 - fi - - return 0 -} - -stop() { - # Nothing to stop if ip_set module is not loaded. - lsmod | grep -q "^ip_set " - [[ $? -ne 0 ]] && return 6 - - flush_n_delete - [[ $? -ne 0 ]] && echo Warning: Not all sets were flushed/deleted - - return 0 +lock() { + CLEAN_FILES="${CLEAN_FILES} ${IPSET_LOCK}" + until mkdir ${IPSET_LOCK} 2>/dev/null; do :; done } save() { - # Do not save if ip_set module is not loaded. - lsmod | grep -q "^ip_set " - [[ $? -ne 0 ]] && return 6 + fail=0 - [[ -z $(${IPSET_BIN} list -name) ]] && return 0 + # Make backups of existing configuration first, if any + [ -d ${IPSET_DATA_DIR} ] && mv -Tf ${IPSET_DATA_DIR} ${IPSET_DATA_DIR_BACKUP} + [ -f ${IPSET_DATA_COMPAT} ] && mv -Tf ${IPSET_DATA_COMPAT} ${IPSET_DATA_COMPAT_BACKUP} - ret=0 - TMP_FILE=$(/bin/mktemp -q /tmp/$IPSET.XXXXXX) \ - && CLEAN_FILES+=" $TMP_FILE" \ - && chmod 600 "$TMP_FILE" \ - && ${IPSET_BIN} save > $TMP_FILE 2>/dev/null \ - && [[ -s $TMP_FILE ]] \ - || ret=1 + rm -f ${IPSET_DATA_SAVED_FLAG} - if [[ $ret -eq 0 ]]; then - # No need to do anything if the files are the same - if [[ ! -f $IPSET_DATA ]]; then - mv $TMP_FILE $IPSET_DATA && chmod 600 $IPSET_DATA || ret=1 - else - diff -q $TMP_FILE $IPSET_DATA >/dev/null - - if [[ $? -ne 0 ]]; then - if [[ -f $IPSET_DATA ]]; then - cp -f --preserve=timestamps $IPSET_DATA $IPSET_DATA.save \ - && chmod 600 $IPSET_DATA.save \ - || ret=1 + # Save each set in a separate file + mkdir -p ${IPSET_DATA_DIR} + chmod 0700 ${IPSET_DATA_DIR} + IFS=" +" + for set in $(${IPSET_BIN} list -n -t); do + # Empty name allowed, use ".set" as suffix. 'ipset save' doesn't + # quote set names with spaces: if we have a space in the name, + # work around this by quoting it ourselves in the output. + # shellcheck disable=SC2003 # No POSIX equivalent to expr index + if expr index "${set}" " " >/dev/null; then + :> "${IPSET_DATA_DIR}/${set}.set" + for line in $(${IPSET_BIN} save "${set}"); do + create=0 + echo "${line}" | grep -q "^create " && create=1 + if [ $create -eq 1 ]; then + line=${line#create *} + else + line=${line#add *} + fi + line=${line#${set} *} + set="$(echo "${set}" | sed 's/"/\\"/g')" + if [ $create -eq 1 ]; then + echo "create \"${set}\" ${line}" >> "${IPSET_DATA_DIR}/${set}.set" + else + echo "add \"${set}\" ${line}" >> "${IPSET_DATA_DIR}/${set}.set" + fi + done + else + ${IPSET_BIN} save "${set}" > "${IPSET_DATA_DIR}/${set}.set" || fail=1 fi - if [[ $ret -eq 0 ]]; then - cp -f --preserve=timestamps $TMP_FILE $IPSET_DATA \ - && chmod 600 $IPSET_DATA \ - || ret=1 - fi - fi - fi - fi + [ -f "${IPSET_DATA_DIR}/${set}.set" ] && chmod 600 "${IPSET_DATA_DIR}/${set}.set" + [ $fail -eq 1 ] && err "Cannot save set ${set}" && unset IFS && return 1 + done + touch ${IPSET_DATA_SAVED_FLAG} || { unset IFS; return 1; } + unset IFS - rm -f $TMP_FILE - return $ret + # Done: remove backups + rm -rf ${IPSET_DATA_DIR_BACKUP} + rm -rf ${IPSET_DATA_COMPAT_BACKUP} + + return 0 } +# Generate a grep regexp matching abbreviated command forms. E.g., for create: +# \(c\|cr\|cre\|crea\|creat\|create\) +cmd_short_expr() { + out= + cmd_len=1 + while [ "${cmd_len}" -le "${#1}" ]; do + [ -z "${out}" ] && out='\(' || out="${out}"'\|' + # shellcheck disable=SC2003 # No POSIX equivalent to expr substr + out="${out}$(expr substr "${1}" 1 "${cmd_len}")" + cmd_len=$((cmd_len + 1)) + done + echo "${out}"'\)' +} +ipset_restore() { + file="${1}" + + retfile="$(mktemp -q /tmp/ipset.XXXXXX)" + CLEAN_FILES="${CLEAN_FILES} ${retfile}" + + # If restore fails due to invalid lines, remove them and retry + while ! restore_err="$( (${IPSET_BIN} -f "${file}" -! restore 2>&1; echo $? >"${retfile}") | head -n1; exit "$(cat "${retfile}")" )"; do + warn "${restore_err}" + case ${restore_err#*: } in + "No command specified"*) + line="$(grep -m1 -n "^${restore_err##* }" "${file}")" + line="${line%:*}" + ;; + "Missing second mandatory argument to command "*) + cmd="${restore_err##* }" + cmd_expr="$(cmd_short_expr "${cmd}")" + line="$(grep -n '^'"${cmd_expr}" "${file}" | grep -m1 -v '^[0-9]\+\:'"${cmd_expr}"'[[:blank:]]\+[^[:blank:]]\+[[:blank:]]\+[^[:blank:]]\+')" + line="${line%:*}" + ;; + "Missing mandatory argument to command "*) + cmd="${restore_err##* }" + cmd_expr="$(cmd_short_expr "${cmd}")" + line="$(grep -n '^'"${cmd_expr}" "${file}" | grep -m1 -v '^[0-9]\+\:'"${cmd_expr}"'[[:blank:]]\+[^[:blank:]]\+')" + line="${line%:*}" + ;; + "Command "*"is invalid in restore mode"*) + restore_err_cmd="${restore_err#*: }" + restore_err_cmd="${restore_err_cmd#*\`}" + restore_err_cmd="${restore_err_cmd%%\'*}" + cmd="${restore_err_cmd##* }" + cmd_expr="$(cmd_short_expr "${cmd}")" + line="$(grep -m1 -ne '^'"${cmd_expr}"'[[:blank:]]\+' -e '^'"${restore_err_cmd}"'$' "${file}")" + line="${line%:*}" + ;; + "Error in line "*) + line="${restore_err%: *}" + line="${line##* }" + ;; + *) + rm "${retfile}" + CLEAN_FILES="${CLEAN_FILES%* ${retfile}}" + return 1 + ;; + esac + + [ -z "${line}" ] && return 1 + + warn "Skipped invalid entry: $(sed "${line}q;d" "${file}")" + sed -i -e "${line}d" "${file}" + + [ -s "${file}" ] || return 1 + done + + rm "${retfile}" + CLEAN_FILES="${CLEAN_FILES%* ${retfile}}" +} + +load() { + if [ -f ${IPSET_DATA_SAVED_FLAG} ]; then + # If we have a cleanly saved directory with all sets, we can + # delete any left-overs and use it + rm -rf ${IPSET_DATA_DIR_BACKUP} + rm -f ${IPSET_DATA_COMPAT_BACKUP} + else + # If sets weren't cleanly saved, restore from backups + [ -d ${IPSET_DATA_DIR_BACKUP} ] && rm -rf ${IPSET_DATA_DIR} && mv -Tf ${IPSET_DATA_DIR_BACKUP} ${IPSET_DATA_DIR} + [ -f ${IPSET_DATA_COMPAT_BACKUP} ] && rm -f ${IPSET_DATA_COMPAT} && mv -Tf ${IPSET_DATA_COMPAT_BACKUP} ${IPSET_DATA_COMPAT} + fi + + if [ ! -d ${IPSET_DATA_DIR} ] && [ ! -f ${IPSET_DATA_COMPAT} ]; then + info "No existing configuration available, none loaded" + touch ${IPSET_RUN} + return + fi + + # Merge all sets into temporary file + merged="$(mktemp -q /tmp/ipset.XXXXXX)" + CLEAN_FILES="${CLEAN_FILES} ${merged}" + chmod 600 "${merged}" + set +f + if [ -d ${IPSET_DATA_DIR} ]; then + # Copy create commands from each saved set first, then the rest: + # list:set entries depend on other sets, so make sure they all + # get created first + for f in "${IPSET_DATA_DIR}"/*; do + [ "${f}" = "${IPSET_DATA_DIR}/*" ] && break + [ -f "${f}" ] || continue + grep '^c' "${f}" >> "${merged}" + done + for f in "${IPSET_DATA_DIR}"/*; do + [ "${f}" = "${IPSET_DATA_DIR}/*" ] && break + [ -f "${f}" ] || continue + grep -v '^c' "${f}" >> "${merged}" + done + fi + set -f + [ -f ${IPSET_DATA_COMPAT} ] && cat ${IPSET_DATA_COMPAT} >> "${merged}" + + # Drop sets that aren't in saved data, mark conflicts with existing sets + conflicts="" + IFS=" +" + for set in $(${IPSET_BIN} list -n -t); do + grep -q "^create ${set} " "${merged}" && conflicts="${conflicts}|${set}" && continue + + # We can't destroy the set if it's in use, flush it instead + if ! ${IPSET_BIN} destroy "${set}" 2>/dev/null; then + ${IPSET_BIN} flush "${set}" + fi + done + unset IFS + conflicts="${conflicts#|*}" + + # Common case: if we have no conflicts, just restore in one shot + if [ -z "${conflicts}" ]; then + if ! ipset_restore "${merged}"; then + err "Failed to restore configured sets" + exit 1 + fi + rm "${merged}" + CLEAN_FILES="${CLEAN_FILES%* ${merged}}" + touch ${IPSET_RUN} + return + fi + + # Find a salt for md5sum that makes names of saved sets unique + salt=0 + while true; do + unique=1 + IFS=" +" + for set in $(${IPSET_BIN} list -n -t); do + if grep -q "^create $(echo "${salt}${set}" | md5sum | head -c31) " "${merged}"; then + unique=0 + break + fi + done + unset IFS + [ ${unique} -eq 1 ] && break + salt=$((salt + 1)) + done + + # Add sets, mangling names for conflicting sets + mangled="$(mktemp -q /tmp/ipset.XXXXXX)" + CLEAN_FILES="${CLEAN_FILES} ${mangled}" + chmod 600 "${mangled}" + + cat "${merged}" > "${mangled}" + IFS='|' + for set in ${conflicts}; do + new_name=$(echo "${salt}${set}" | md5sum | head -c31) + echo "s/^(add|create) $set /\1 $new_name /" + done | sed -i -r -f - "${mangled}" + unset IFS + if ! ipset_restore "${mangled}"; then + err "Failed to restore configured sets" + exit 1 + fi + + rm "${mangled}" + CLEAN_FILES="${CLEAN_FILES%* ${mangled}}" + + # Swap and delete old sets + IFS='|' + for set in ${conflicts}; do + mangled="$(echo "${salt}${set}" | md5sum | head -c31)" + if ! ${IPSET_BIN} swap "${set}" "${mangled}" 2>/dev/null; then + # This fails if set types are different: try to destroy + # existing set + if ! ${IPSET_BIN} destroy "${set}" 2>/dev/null; then + # Conflicting set is in use, we can only warn + # and flush the existing set + err "Cannot load set \"${set}\", set with same name and conflicting type in use" + ${IPSET_BIN} flush "${set}" + ${IPSET_BIN} destroy "${mangled}" + else + ${IPSET_BIN} rename "${mangled}" "${set}" + fi + else + ${IPSET_BIN} destroy "${mangled}" + fi + done + unset IFS + + rm "${merged}" + CLEAN_FILES="${CLEAN_FILES%* ${merged}}" + touch ${IPSET_RUN} +} + +cleanup() { + ${IPSET_BIN} flush || err "Failed to flush sets" + + # Try to destroy all sets at once. This will fail if some are in use, + # destroy all the other ones in that case + ${IPSET_BIN} destroy 2>/dev/null && return + IFS=" +" + for set in $(${IPSET_BIN} list -n -t); do + if ! ${IPSET_BIN} destroy "${set}"; then + err "Failed to destroy set ${set}" + fi + done + unset IFS +} + +stop() { + [ -f ${IPSET_RUN} ] || { info "Not running"; return 0; } + [ "${IPSET_SAVE_ON_STOP}" = "yes" ] && { save || err "Failed to save sets"; } + + # Nothing to stop if the ip_set module is not loaded + lsmod | grep -q "^ip_set " || { info "Not running"; rm ${IPSET_RUN}; return 0; } + + # If the xt_set module is in use, then iptables is using ipset, so + # refuse to stop the service + if mod="$(lsmod | grep ^xt_set)"; then + if [ "$(echo "${mod}" | tr -s ' ' | cut -d' ' -f3)" != "0" ]; then + err "Current iptables configuration requires ipset" && return 1 + fi + fi + + cleanup + + rm ${IPSET_RUN} + return 0 +} + +lock case "$1" in - start) - start - RETVAL=$? +start) + load ;; - stop) - check_can_unload || exit 1 - [[ $IPSET_SAVE_ON_STOP = yes ]] && save +stop) stop - RETVAL=$? - [[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0 ;; - reload) - [[ $IPSET_SAVE_ON_RESTART = yes ]] && save - stop - RETVAL=$? - [[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0 - start - RETVAL=$? +reload) + cleanup + load ;; - *) - echo "Usage: $IPSET {start|stop|reload}" >&2 +save) + save + ;; +*) + info "Usage: $0 {start|stop|reload|save}" exit 1 esac -exit $RETVAL +exit $? From 80a30e48f5fa64ae27c41af73172828115d82d60 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 14:48:58 +0000 Subject: [PATCH 33/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 1ae7362..a6e8414 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.15 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -171,6 +171,9 @@ fi %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 7.15-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Mar 15 2022 Phil Sutter - 7.15-3 - Use the advanced init script from Centos9Stream From 9b6e51ae7bb3947c2c3e282040d7940a0e14a47b Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Tue, 23 Aug 2022 09:07:51 +0200 Subject: [PATCH 34/55] Add upstream patches --- ...Fix-typo-in-ipset-translate-man-page.patch | 31 +++++++ 0002-Fix-IPv6-sets-nftables-translation.patch | 91 +++++++++++++++++++ ...late-allow-invoking-with-a-path-name.patch | 46 ++++++++++ 3 files changed, 168 insertions(+) create mode 100644 0001-Fix-typo-in-ipset-translate-man-page.patch create mode 100644 0002-Fix-IPv6-sets-nftables-translation.patch create mode 100644 0003-ipset-translate-allow-invoking-with-a-path-name.patch diff --git a/0001-Fix-typo-in-ipset-translate-man-page.patch b/0001-Fix-typo-in-ipset-translate-man-page.patch new file mode 100644 index 0000000..5c841e0 --- /dev/null +++ b/0001-Fix-typo-in-ipset-translate-man-page.patch @@ -0,0 +1,31 @@ +From c74a420471fd693f89e0b0e19f93c88af22fb7de Mon Sep 17 00:00:00 2001 +From: "Bernhard M. Wiedemann" +Date: Wed, 29 Sep 2021 09:55:43 +0200 +Subject: [PATCH] Fix typo in ipset-translate man page + +originally reported in +https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZIXKNQHSSCQ4ZLEGYYKLAXQ4PQ5EYFGZ/ +by Larry Len Rainey + +Signed-off-by: Bernhard M. Wiedemann +Signed-off-by: Pablo Neira Ayuso +--- + src/ipset-translate.8 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/ipset-translate.8 b/src/ipset-translate.8 +index bb4e737e1480..55ce2a99f2cf 100644 +--- a/src/ipset-translate.8 ++++ b/src/ipset-translate.8 +@@ -33,7 +33,7 @@ to \fBnftables(8)\fP. + The only available command is: + + .IP \[bu] 2 +-ipset-translate restores < file.ipt ++ipset-translate restore < file.ipt + + .SH USAGE + The \fBipset-translate\fP tool reads an IP sets file in the syntax produced by +-- +2.37.2 + diff --git a/0002-Fix-IPv6-sets-nftables-translation.patch b/0002-Fix-IPv6-sets-nftables-translation.patch new file mode 100644 index 0000000..f2756e8 --- /dev/null +++ b/0002-Fix-IPv6-sets-nftables-translation.patch @@ -0,0 +1,91 @@ +From be7f6099feb7b5d34715b06f9308877cdcdc404a Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Mon, 28 Feb 2022 19:52:57 +0100 +Subject: [PATCH] Fix IPv6 sets nftables translation + +The parser assumes the set is an IPv4 ipset because IPSET_OPT_FAMILY is +not set. + + # ipset-translate restore < ./ipset-mwan3_set_connected_ipv6.dump + add table inet global + add set inet global mwan3_connected_v6 { type ipv6_addr; flags interval; } + flush set inet global mwan3_connected_v6 + ipset v7.15: Error in line 4: Syntax error: '64' is out of range 0-32 + +Remove ipset_xlate_type_get(), call ipset_xlate_set_get() instead to +obtain the set type and family. + +Reported-by: Florian Eckert +Fixes: 325af556cd3a ("add ipset to nftables translation infrastructure") +Signed-off-by: Pablo Neira Ayuso +--- + lib/ipset.c | 24 ++++++++++-------------- + tests/xlate/xlate.t | 2 ++ + tests/xlate/xlate.t.nft | 2 ++ + 3 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/lib/ipset.c b/lib/ipset.c +index 73e67db88e0d..50f86aee045b 100644 +--- a/lib/ipset.c ++++ b/lib/ipset.c +@@ -949,18 +949,6 @@ ipset_xlate_set_get(struct ipset *ipset, const char *name) + return NULL; + } + +-static const struct ipset_type *ipset_xlate_type_get(struct ipset *ipset, +- const char *name) +-{ +- const struct ipset_xlate_set *set; +- +- set = ipset_xlate_set_get(ipset, name); +- if (!set) +- return NULL; +- +- return set->type; +-} +- + static int + ipset_parser(struct ipset *ipset, int oargc, char *oargv[]) + { +@@ -1282,8 +1270,16 @@ ipset_parser(struct ipset *ipset, int oargc, char *oargv[]) + if (!ipset->xlate) { + type = ipset_type_get(session, cmd); + } else { +- type = ipset_xlate_type_get(ipset, arg0); +- ipset_session_data_set(session, IPSET_OPT_TYPE, type); ++ const struct ipset_xlate_set *xlate_set; ++ ++ xlate_set = ipset_xlate_set_get(ipset, arg0); ++ if (xlate_set) { ++ ipset_session_data_set(session, IPSET_OPT_TYPE, ++ xlate_set->type); ++ ipset_session_data_set(session, IPSET_OPT_FAMILY, ++ &xlate_set->family); ++ type = xlate_set->type; ++ } + } + if (type == NULL) + return ipset->standard_error(ipset, p); +diff --git a/tests/xlate/xlate.t b/tests/xlate/xlate.t +index b1e7d288e2a9..f09cb202bb6c 100644 +--- a/tests/xlate/xlate.t ++++ b/tests/xlate/xlate.t +@@ -53,3 +53,5 @@ create bp1 bitmap:port range 1-1024 + add bp1 22 + create bim1 bitmap:ip,mac range 1.1.1.0/24 + add bim1 1.1.1.1,aa:bb:cc:dd:ee:ff ++create hn6 hash:net family inet6 ++add hn6 fe80::/64 +diff --git a/tests/xlate/xlate.t.nft b/tests/xlate/xlate.t.nft +index 96eba3b0175e..0152a3081125 100644 +--- a/tests/xlate/xlate.t.nft ++++ b/tests/xlate/xlate.t.nft +@@ -54,3 +54,5 @@ add set inet global bp1 { type inet_service; } + add element inet global bp1 { 22 } + add set inet global bim1 { type ipv4_addr . ether_addr; } + add element inet global bim1 { 1.1.1.1 . aa:bb:cc:dd:ee:ff } ++add set inet global hn6 { type ipv6_addr; flags interval; } ++add element inet global hn6 { fe80::/64 } +-- +2.37.2 + diff --git a/0003-ipset-translate-allow-invoking-with-a-path-name.patch b/0003-ipset-translate-allow-invoking-with-a-path-name.patch new file mode 100644 index 0000000..b6e21de --- /dev/null +++ b/0003-ipset-translate-allow-invoking-with-a-path-name.patch @@ -0,0 +1,46 @@ +From e1b60b2a93356c313cccb2abfdae4b58d530e02b Mon Sep 17 00:00:00 2001 +From: Quentin Armitage +Date: Thu, 11 Aug 2022 17:52:18 +0100 +Subject: [PATCH] ipset-translate: allow invoking with a path name + +Executing /usr/sbin/ipset-translate results in the ipset functionality being run, rather than the ipset-translate functionality. + + # ipset-translate destroy fred + This command is not supported, use `ipset-translate restore < file' + + # /usr/sbin/ipset-translate destroy fred + ipset v7.15: The set with the given name does not exist + +use basename() to resolve the issue. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1626 +Signed-off-by: Quentin Armitage +Signed-off-by: Pablo Neira Ayuso +--- + src/ipset.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/ipset.c b/src/ipset.c +index 6d42b60d2fe9..162f477d49cd 100644 +--- a/src/ipset.c ++++ b/src/ipset.c +@@ -6,6 +6,7 @@ + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ ++#define _GNU_SOURCE + #include /* assert */ + #include /* fprintf */ + #include /* exit */ +@@ -31,7 +32,7 @@ main(int argc, char *argv[]) + exit(1); + } + +- if (!strcmp(argv[0], "ipset-translate")) { ++ if (!strcmp(basename(argv[0]), "ipset-translate")) { + ret = ipset_xlate_argv(ipset, argc, argv); + } else { + ret = ipset_parse_argv(ipset, argc, argv); +-- +2.37.2 + From 6e97b0dc610477ad9784c6fc6872bb9476b2ce2e Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Tue, 23 Aug 2022 09:08:46 +0200 Subject: [PATCH 35/55] Apply upstream patches --- ipset.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ipset.spec b/ipset.spec index a6e8414..7b14051 100644 --- a/ipset.spec +++ b/ipset.spec @@ -9,6 +9,9 @@ Source0: %{url}/%{name}-%{version}.tar.bz2 Source1: %{name}.service Source2: %{name}.start-stop Source3: %{name}-config +Patch0: 0001-Fix-typo-in-ipset-translate-man-page.patch +Patch1: 0002-Fix-IPv6-sets-nftables-translation.patch +Patch2: 0003-ipset-translate-allow-invoking-with-a-path-name.patch BuildRequires: libmnl-devel BuildRequires: automake From 9c8c2ff4ef852d89b83e7f6f39eda6b8bbbb9167 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Tue, 23 Aug 2022 09:09:56 +0200 Subject: [PATCH 36/55] Update changelog --- ipset.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 7b14051..5766288 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.15 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -174,6 +174,10 @@ fi %changelog +* Tue Aug 23 2022 Nicolas Chauvet - 7.15-5 +- Backport upstream patches - rhbz#2117654 + ipset-translate does not work with IPv6 sets + * Thu Jul 21 2022 Fedora Release Engineering - 7.15-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From ea2bf802716251d81fb53c360a66899f402b3177 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Fri, 2 Dec 2022 15:55:31 +0100 Subject: [PATCH 37/55] Update to 7.16 --- ipset.spec | 10 +++++----- sources | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ipset.spec b/ipset.spec index 5766288..7d45a64 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.15 -Release: 5%{?dist} +Version: 7.16 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -9,9 +9,6 @@ Source0: %{url}/%{name}-%{version}.tar.bz2 Source1: %{name}.service Source2: %{name}.start-stop Source3: %{name}-config -Patch0: 0001-Fix-typo-in-ipset-translate-man-page.patch -Patch1: 0002-Fix-IPv6-sets-nftables-translation.patch -Patch2: 0003-ipset-translate-allow-invoking-with-a-path-name.patch BuildRequires: libmnl-devel BuildRequires: automake @@ -174,6 +171,9 @@ fi %changelog +* Fri Dec 02 2022 Nicolas Chauvet - 7.16-1 +- Update to 7.16 + * Tue Aug 23 2022 Nicolas Chauvet - 7.15-5 - Backport upstream patches - rhbz#2117654 ipset-translate does not work with IPv6 sets diff --git a/sources b/sources index f2cddcc..e6d91a7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.15.tar.bz2) = 0fc936d971c30a0925c585d506c8840e782fdaeec09bc8fd249e874fe838fa55a4dbb697f6e1423a6769abf07a1ce2195abc37cb641e8e4ad70f1b4c7130916a +SHA512 (ipset-7.16.tar.bz2) = e69ddee956f0922c8e08e7e5d358d6b5b24178a9f08151b20957cc3465baaba9ecd6aa938ae157f2cd286ccd7f0b7a279cfd89cec2393a00b43e4d945c275307 From 22c1fd017f7af75afe41843f57e2f5202b98c001 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 2 Jan 2023 11:14:59 +0100 Subject: [PATCH 38/55] Update to 7.17 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index 7d45a64..e784cfd 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.16 +Version: 7.17 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -171,6 +171,9 @@ fi %changelog +* Mon Jan 02 2023 Nicolas Chauvet - 7.17-1 +- Update to 7.17 + * Fri Dec 02 2022 Nicolas Chauvet - 7.16-1 - Update to 7.16 diff --git a/sources b/sources index e6d91a7..602f1fb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.16.tar.bz2) = e69ddee956f0922c8e08e7e5d358d6b5b24178a9f08151b20957cc3465baaba9ecd6aa938ae157f2cd286ccd7f0b7a279cfd89cec2393a00b43e4d945c275307 +SHA512 (ipset-7.17.tar.bz2) = e308a0d7707ccf7d0cb06a32cf9a822f97862e007abdbab8a91a5a0d5bfbd9f2fb9a3f5e8f36b250ec0d565438c8648a31e8e5b45d8205a76558e90f46e6e597 From cbda24853d2e4f3b0caee24d0345a81c1923fcec Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:18:58 +0000 Subject: [PATCH 39/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index e784cfd..4aa0cba 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.17 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -171,6 +171,9 @@ fi %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 7.17-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Mon Jan 02 2023 Nicolas Chauvet - 7.17-1 - Update to 7.17 From 3ea856c0e04c86339a93bba0605ebb097f4c0c82 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 07:35:10 +0000 Subject: [PATCH 40/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 4aa0cba..73ccd76 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.17 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -171,6 +171,9 @@ fi %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 7.17-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Thu Jan 19 2023 Fedora Release Engineering - 7.17-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From e39a6f6c547bfad8b1aed9a91d43af1ab0f890bd Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 11 Aug 2023 21:13:50 +0200 Subject: [PATCH 41/55] Convert license to SPDX format Signed-off-by: Phil Sutter --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 73ccd76..eeae4ab 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.17 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -171,6 +171,9 @@ fi %changelog +* Fri Aug 11 2023 Phil Sutter - 7.17-4 +- Convert license to SPDX format + * Thu Jul 20 2023 Fedora Release Engineering - 7.17-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 3b8395e7e676a8eec4045286172c42b20a3e5bac Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 11 Aug 2023 21:13:57 +0200 Subject: [PATCH 42/55] Convert license to SPDX format Signed-off-by: Phil Sutter --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index eeae4ab..5f9152d 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.17 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -171,6 +171,9 @@ fi %changelog +* Fri Aug 11 2023 Phil Sutter - 7.17-5 +- Convert license to SPDX format + * Fri Aug 11 2023 Phil Sutter - 7.17-4 - Convert license to SPDX format From ff45e749b21d9e3838ecfab581dc367380551f4f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 11 Aug 2023 21:14:14 +0200 Subject: [PATCH 43/55] Convert license to SPDX format Signed-off-by: Phil Sutter --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 5f9152d..6ed9e26 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.17 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Manage Linux IP sets License: GPLv2 @@ -171,6 +171,9 @@ fi %changelog +* Fri Aug 11 2023 Phil Sutter - 7.17-6 +- Convert license to SPDX format + * Fri Aug 11 2023 Phil Sutter - 7.17-5 - Convert license to SPDX format From 904bbed4ddb8ee3bfa98d1928ad30fb948f244ac Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 11 Aug 2023 21:14:56 +0200 Subject: [PATCH 44/55] Convert license to SPDX format Signed-off-by: Phil Sutter --- ipset.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index 6ed9e26..9af674c 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,9 +1,9 @@ Name: ipset Version: 7.17 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Manage Linux IP sets -License: GPLv2 +License: GPL-2.0-only URL: http://ipset.netfilter.org/ Source0: %{url}/%{name}-%{version}.tar.bz2 Source1: %{name}.service @@ -171,6 +171,9 @@ fi %changelog +* Fri Aug 11 2023 Phil Sutter - 7.17-7 +- Convert license to SPDX format + * Fri Aug 11 2023 Phil Sutter - 7.17-6 - Convert license to SPDX format From 1d4434c8b293e6d4c9d0d68afe0b6cb279a0be37 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 23 Oct 2023 13:53:29 +0200 Subject: [PATCH 45/55] Update to 7.19 --- ipset.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ipset.spec b/ipset.spec index 9af674c..6949b49 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.17 -Release: 7%{?dist} +Version: 7.19 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -171,6 +171,9 @@ fi %changelog +* Mon Oct 23 2023 Nicolas Chauvet - 7.19-1 +- Update to 7.19 + * Fri Aug 11 2023 Phil Sutter - 7.17-7 - Convert license to SPDX format diff --git a/sources b/sources index 602f1fb..3f5e652 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.17.tar.bz2) = e308a0d7707ccf7d0cb06a32cf9a822f97862e007abdbab8a91a5a0d5bfbd9f2fb9a3f5e8f36b250ec0d565438c8648a31e8e5b45d8205a76558e90f46e6e597 +SHA512 (ipset-7.19.tar.bz2) = 0f4252e6d967b0f130a2c7a0307b17c6b7d48336e86b2f838ea176f5faaa0c9bbbf273060906b43d91e9b38a9f33c18918e33d02292839a6bc321181d5d7f84e From 10bf621d6db1c5478cb4782049c34e35da8804c3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:14:58 +0000 Subject: [PATCH 46/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 6949b49..0c7862f 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.19 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -171,6 +171,9 @@ fi %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 7.19-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Oct 23 2023 Nicolas Chauvet - 7.19-1 - Update to 7.19 From a657c361cb6d07c4d388d22cbd60e1a892667846 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 22:53:46 +0000 Subject: [PATCH 47/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 0c7862f..a5687a5 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.19 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -171,6 +171,9 @@ fi %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 7.19-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 7.19-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d87bd16c2c84a448940705512165126deba45721 Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Thu, 1 Feb 2024 14:20:15 +0100 Subject: [PATCH 48/55] Update to 7.20 --- ipset.spec | 7 +++++-- sources | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/ipset.spec b/ipset.spec index a5687a5..3400789 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.19 -Release: 3%{?dist} +Version: 7.20 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -171,6 +171,9 @@ fi %changelog +* Thu Feb 01 2024 Nicolas Chauvet - 7.20-1 +- Update to 7.20 + * Wed Jan 24 2024 Fedora Release Engineering - 7.19-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 3f5e652..4e000ad 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.19.tar.bz2) = 0f4252e6d967b0f130a2c7a0307b17c6b7d48336e86b2f838ea176f5faaa0c9bbbf273060906b43d91e9b38a9f33c18918e33d02292839a6bc321181d5d7f84e +SHA512 (ipset-7.20.tar.bz2) = d0b87ab889987a3febeaf3d73099a262aca86160878258b3bd1be064e52b55baa90601804b30ad3bbb363066c9fc1bbdfe8bc100414f801729215a892e186fc6 From 411d25f4a63f95ff24dd654e1ee8624f5434644d Mon Sep 17 00:00:00 2001 From: Nicolas Chauvet Date: Mon, 12 Feb 2024 13:17:00 +0100 Subject: [PATCH 49/55] Update to 7.21 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index 3400789..ae31410 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.20 +Version: 7.21 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -171,6 +171,9 @@ fi %changelog +* Mon Feb 12 2024 Nicolas Chauvet - 7.21-1 +- Update to 7.21 + * Thu Feb 01 2024 Nicolas Chauvet - 7.20-1 - Update to 7.20 diff --git a/sources b/sources index 4e000ad..588e6be 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.20.tar.bz2) = d0b87ab889987a3febeaf3d73099a262aca86160878258b3bd1be064e52b55baa90601804b30ad3bbb363066c9fc1bbdfe8bc100414f801729215a892e186fc6 +SHA512 (ipset-7.21.tar.bz2) = 175c6516c2091c57738a0324678d8d016e4d7f18fa03cb0dcc502391cac4caf4db1e757f61ad2fe312c1dbe431ec9cfabbc8e15a64a94ebd2fa903155b27c88f From 5cff36f4547eb6ff85eec8288e4918bbae848d00 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 10:33:14 +0000 Subject: [PATCH 50/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index ae31410..e366c38 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.21 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -171,6 +171,9 @@ fi %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 7.21-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Mon Feb 12 2024 Nicolas Chauvet - 7.21-1 - Update to 7.21 From 044838f10facbd6b7b175f1eab3675f526d32a38 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 1 Aug 2024 14:16:05 +0200 Subject: [PATCH 51/55] ipset-7.22-1 - Turn absolute ipset-translate symlink into a relative one - Rebase onto v7.22 plus fixes --- ...Fix-typo-in-ipset-translate-man-page.patch | 31 -- ...ith-WARN_ON_ONCE-according-to-usage-.patch | 23 ++ 0001-build-do-install-libipset-args.h.patch | 28 -- 0002-Fix-IPv6-sets-nftables-translation.patch | 91 ----- ...-global-buffer-overflow-warning-by-A.patch | 54 +++ ...late-allow-invoking-with-a-path-name.patch | 46 --- ...-ipset-Avoid-argv-array-overstepping.patch | 38 ++ 0004-tests-Reduce-testsuite-run-time.patch | 354 ++++++++++++++++++ ipset.spec | 16 +- sources | 2 +- 10 files changed, 484 insertions(+), 199 deletions(-) delete mode 100644 0001-Fix-typo-in-ipset-translate-man-page.patch create mode 100644 0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch delete mode 100644 0001-build-do-install-libipset-args.h.patch delete mode 100644 0002-Fix-IPv6-sets-nftables-translation.patch create mode 100644 0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch delete mode 100644 0003-ipset-translate-allow-invoking-with-a-path-name.patch create mode 100644 0003-lib-ipset-Avoid-argv-array-overstepping.patch create mode 100644 0004-tests-Reduce-testsuite-run-time.patch diff --git a/0001-Fix-typo-in-ipset-translate-man-page.patch b/0001-Fix-typo-in-ipset-translate-man-page.patch deleted file mode 100644 index 5c841e0..0000000 --- a/0001-Fix-typo-in-ipset-translate-man-page.patch +++ /dev/null @@ -1,31 +0,0 @@ -From c74a420471fd693f89e0b0e19f93c88af22fb7de Mon Sep 17 00:00:00 2001 -From: "Bernhard M. Wiedemann" -Date: Wed, 29 Sep 2021 09:55:43 +0200 -Subject: [PATCH] Fix typo in ipset-translate man page - -originally reported in -https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZIXKNQHSSCQ4ZLEGYYKLAXQ4PQ5EYFGZ/ -by Larry Len Rainey - -Signed-off-by: Bernhard M. Wiedemann -Signed-off-by: Pablo Neira Ayuso ---- - src/ipset-translate.8 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/ipset-translate.8 b/src/ipset-translate.8 -index bb4e737e1480..55ce2a99f2cf 100644 ---- a/src/ipset-translate.8 -+++ b/src/ipset-translate.8 -@@ -33,7 +33,7 @@ to \fBnftables(8)\fP. - The only available command is: - - .IP \[bu] 2 --ipset-translate restores < file.ipt -+ipset-translate restore < file.ipt - - .SH USAGE - The \fBipset-translate\fP tool reads an IP sets file in the syntax produced by --- -2.37.2 - diff --git a/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch b/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch new file mode 100644 index 0000000..7acff72 --- /dev/null +++ b/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch @@ -0,0 +1,23 @@ +From 21080dc79c4e9244149aa78f6a8f7fbb6f4b8e81 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Thu, 6 Jun 2024 08:57:11 +0200 +Subject: [PATCH] Replace BUG_ON() with WARN_ON_ONCE() according to usage + policy. + +--- + kernel/net/netfilter/ipset/ip_set_list_set.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/net/netfilter/ipset/ip_set_list_set.c b/kernel/net/netfilter/ipset/ip_set_list_set.c +index fd78e2db06e4f..0d3e5a7331f26 100644 +--- a/kernel/net/netfilter/ipset/ip_set_list_set.c ++++ b/kernel/net/netfilter/ipset/ip_set_list_set.c +@@ -432,7 +432,7 @@ list_set_destroy(struct ip_set *set) + { + struct list_set *map = set->data; + +- BUG_ON(!list_empty(&map->members)); ++ WARN_ON_ONCE(!list_empty(&map->members)); + kfree(map); + + set->data = NULL; diff --git a/0001-build-do-install-libipset-args.h.patch b/0001-build-do-install-libipset-args.h.patch deleted file mode 100644 index c2f8edf..0000000 --- a/0001-build-do-install-libipset-args.h.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 39fde1381f0ba9101f65c08f2abda5426a46f8b1 Mon Sep 17 00:00:00 2001 -From: Jan Engelhardt -Date: Mon, 22 Jan 2018 22:50:33 +0100 -Subject: [PATCH] build: do install libipset/args.h - -libipset/types.h includes args.h, therefore args.h must be installed -too. - -Signed-off-by: Jan Engelhardt -Signed-off-by: Jozsef Kadlecsik ---- - include/libipset/Makefile.am | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/include/libipset/Makefile.am b/include/libipset/Makefile.am -index 3b47518..79a1357 100644 ---- a/include/libipset/Makefile.am -+++ b/include/libipset/Makefile.am -@@ -1,5 +1,6 @@ - pkgincludedir = ${includedir}/libipset - pkginclude_HEADERS = \ -+ args.h \ - data.h \ - errcode.h \ - linux_ip_set_bitmap.h \ --- -2.11.0 - diff --git a/0002-Fix-IPv6-sets-nftables-translation.patch b/0002-Fix-IPv6-sets-nftables-translation.patch deleted file mode 100644 index f2756e8..0000000 --- a/0002-Fix-IPv6-sets-nftables-translation.patch +++ /dev/null @@ -1,91 +0,0 @@ -From be7f6099feb7b5d34715b06f9308877cdcdc404a Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Mon, 28 Feb 2022 19:52:57 +0100 -Subject: [PATCH] Fix IPv6 sets nftables translation - -The parser assumes the set is an IPv4 ipset because IPSET_OPT_FAMILY is -not set. - - # ipset-translate restore < ./ipset-mwan3_set_connected_ipv6.dump - add table inet global - add set inet global mwan3_connected_v6 { type ipv6_addr; flags interval; } - flush set inet global mwan3_connected_v6 - ipset v7.15: Error in line 4: Syntax error: '64' is out of range 0-32 - -Remove ipset_xlate_type_get(), call ipset_xlate_set_get() instead to -obtain the set type and family. - -Reported-by: Florian Eckert -Fixes: 325af556cd3a ("add ipset to nftables translation infrastructure") -Signed-off-by: Pablo Neira Ayuso ---- - lib/ipset.c | 24 ++++++++++-------------- - tests/xlate/xlate.t | 2 ++ - tests/xlate/xlate.t.nft | 2 ++ - 3 files changed, 14 insertions(+), 14 deletions(-) - -diff --git a/lib/ipset.c b/lib/ipset.c -index 73e67db88e0d..50f86aee045b 100644 ---- a/lib/ipset.c -+++ b/lib/ipset.c -@@ -949,18 +949,6 @@ ipset_xlate_set_get(struct ipset *ipset, const char *name) - return NULL; - } - --static const struct ipset_type *ipset_xlate_type_get(struct ipset *ipset, -- const char *name) --{ -- const struct ipset_xlate_set *set; -- -- set = ipset_xlate_set_get(ipset, name); -- if (!set) -- return NULL; -- -- return set->type; --} -- - static int - ipset_parser(struct ipset *ipset, int oargc, char *oargv[]) - { -@@ -1282,8 +1270,16 @@ ipset_parser(struct ipset *ipset, int oargc, char *oargv[]) - if (!ipset->xlate) { - type = ipset_type_get(session, cmd); - } else { -- type = ipset_xlate_type_get(ipset, arg0); -- ipset_session_data_set(session, IPSET_OPT_TYPE, type); -+ const struct ipset_xlate_set *xlate_set; -+ -+ xlate_set = ipset_xlate_set_get(ipset, arg0); -+ if (xlate_set) { -+ ipset_session_data_set(session, IPSET_OPT_TYPE, -+ xlate_set->type); -+ ipset_session_data_set(session, IPSET_OPT_FAMILY, -+ &xlate_set->family); -+ type = xlate_set->type; -+ } - } - if (type == NULL) - return ipset->standard_error(ipset, p); -diff --git a/tests/xlate/xlate.t b/tests/xlate/xlate.t -index b1e7d288e2a9..f09cb202bb6c 100644 ---- a/tests/xlate/xlate.t -+++ b/tests/xlate/xlate.t -@@ -53,3 +53,5 @@ create bp1 bitmap:port range 1-1024 - add bp1 22 - create bim1 bitmap:ip,mac range 1.1.1.0/24 - add bim1 1.1.1.1,aa:bb:cc:dd:ee:ff -+create hn6 hash:net family inet6 -+add hn6 fe80::/64 -diff --git a/tests/xlate/xlate.t.nft b/tests/xlate/xlate.t.nft -index 96eba3b0175e..0152a3081125 100644 ---- a/tests/xlate/xlate.t.nft -+++ b/tests/xlate/xlate.t.nft -@@ -54,3 +54,5 @@ add set inet global bp1 { type inet_service; } - add element inet global bp1 { 22 } - add set inet global bim1 { type ipv4_addr . ether_addr; } - add element inet global bim1 { 1.1.1.1 . aa:bb:cc:dd:ee:ff } -+add set inet global hn6 { type ipv6_addr; flags interval; } -+add element inet global hn6 { fe80::/64 } --- -2.37.2 - diff --git a/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch b/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch new file mode 100644 index 0000000..115b5fc --- /dev/null +++ b/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch @@ -0,0 +1,54 @@ +From f1bcacf5eeb8620ea684524e1ce9c3951a77f1f9 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 27 Jun 2024 10:18:16 +0200 +Subject: [PATCH] lib: data: Fix for global-buffer-overflow warning by ASAN + +After compiling with CFLAGS="-fsanitize=address -g", running the +testsuite triggers the following warning: + +| ipmap: Range: Check syntax error: missing range/from-to: FAILED +| Failed test: ../src/ipset 2>.foo.err -N test ipmap +| ================================================================= +| ==4204==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a21e77172a at pc 0x7f1ef246f2a6 bp 0x7fffed8f4f40 sp 0x7fffed8f46e8 +| READ of size 32 at 0x55a21e77172a thread T0 +| #0 0x7f1ef246f2a5 in __interceptor_memcpy /var/tmp/portage/sys-devel/gcc-13.2.1_p20231014/work/gcc-13-20231014/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:899 +| #1 0x55a21e758bf6 in ipset_strlcpy /home/n0-1/git/ipset/lib/data.c:119 +| #2 0x55a21e758bf6 in ipset_data_set /home/n0-1/git/ipset/lib/data.c:349 +| #3 0x55a21e75ee2f in ipset_parse_typename /home/n0-1/git/ipset/lib/parse.c:1819 +| #4 0x55a21e754119 in ipset_parser /home/n0-1/git/ipset/lib/ipset.c:1205 +| #5 0x55a21e752cef in ipset_parse_argv /home/n0-1/git/ipset/lib/ipset.c:1344 +| #6 0x55a21e74ea45 in main /home/n0-1/git/ipset/src/ipset.c:38 +| #7 0x7f1ef224cf09 (/lib64/libc.so.6+0x23f09) +| #8 0x7f1ef224cfc4 in __libc_start_main (/lib64/libc.so.6+0x23fc4) +| #9 0x55a21e74f040 in _start (/home/n0-1/git/ipset/src/ipset+0x1d040) +| +| 0x55a21e77172a is located 54 bytes before global variable '*.LC1' defined in 'ipset_bitmap_ip.c' (0x55a21e771760) of size 19 +| '*.LC1' is ascii string 'IP|IP/CIDR|FROM-TO' +| 0x55a21e77172a is located 0 bytes after global variable '*.LC0' defined in 'ipset_bitmap_ip.c' (0x55a21e771720) of size 10 +| '*.LC0' is ascii string 'bitmap:ip' + +Fix this by avoiding 'src' array overstep in ipset_strlcpy(): In +contrast to strncpy(), memcpy() does not respect NUL-chars in input but +stubbornly reads as many bytes as specified. + +Fixes: a7432ba786ca4 ("Workaround misleading -Wstringop-truncation warning") +Signed-off-by: Phil Sutter +Signed-off-by: Jozsef Kadlecsik +--- + lib/data.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/lib/data.c b/lib/data.c +index c05b20144cdad..64cad7a377302 100644 +--- a/lib/data.c ++++ b/lib/data.c +@@ -111,6 +111,9 @@ ipset_strlcpy(char *dst, const char *src, size_t len) + assert(dst); + assert(src); + ++ if (strlen(src) < len) ++ len = strlen(src) + 1; ++ + memcpy(dst, src, len); + dst[len - 1] = '\0'; + } diff --git a/0003-ipset-translate-allow-invoking-with-a-path-name.patch b/0003-ipset-translate-allow-invoking-with-a-path-name.patch deleted file mode 100644 index b6e21de..0000000 --- a/0003-ipset-translate-allow-invoking-with-a-path-name.patch +++ /dev/null @@ -1,46 +0,0 @@ -From e1b60b2a93356c313cccb2abfdae4b58d530e02b Mon Sep 17 00:00:00 2001 -From: Quentin Armitage -Date: Thu, 11 Aug 2022 17:52:18 +0100 -Subject: [PATCH] ipset-translate: allow invoking with a path name - -Executing /usr/sbin/ipset-translate results in the ipset functionality being run, rather than the ipset-translate functionality. - - # ipset-translate destroy fred - This command is not supported, use `ipset-translate restore < file' - - # /usr/sbin/ipset-translate destroy fred - ipset v7.15: The set with the given name does not exist - -use basename() to resolve the issue. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1626 -Signed-off-by: Quentin Armitage -Signed-off-by: Pablo Neira Ayuso ---- - src/ipset.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/ipset.c b/src/ipset.c -index 6d42b60d2fe9..162f477d49cd 100644 ---- a/src/ipset.c -+++ b/src/ipset.c -@@ -6,6 +6,7 @@ - * it under the terms of the GNU General Public License version 2 as - * published by the Free Software Foundation. - */ -+#define _GNU_SOURCE - #include /* assert */ - #include /* fprintf */ - #include /* exit */ -@@ -31,7 +32,7 @@ main(int argc, char *argv[]) - exit(1); - } - -- if (!strcmp(argv[0], "ipset-translate")) { -+ if (!strcmp(basename(argv[0]), "ipset-translate")) { - ret = ipset_xlate_argv(ipset, argc, argv); - } else { - ret = ipset_parse_argv(ipset, argc, argv); --- -2.37.2 - diff --git a/0003-lib-ipset-Avoid-argv-array-overstepping.patch b/0003-lib-ipset-Avoid-argv-array-overstepping.patch new file mode 100644 index 0000000..99dfdca --- /dev/null +++ b/0003-lib-ipset-Avoid-argv-array-overstepping.patch @@ -0,0 +1,38 @@ +From 851cb04ffee5040f1e0063f77c3fe9bc6245e0fb Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 27 Jun 2024 10:18:17 +0200 +Subject: [PATCH] lib: ipset: Avoid 'argv' array overstepping + +The maximum accepted value for 'argc' is MAX_ARGS which matches 'argv' +array size. The maximum allowed array index is therefore argc-1. + +This fix will leave items in argv non-NULL-terminated, so explicitly +NULL the formerly last entry after shifting. + +Looks like a day-1 bug. Interestingly, this neither triggered ASAN nor +valgrind. Yet adding debug output printing argv entries being copied +did. + +Fixes: 1e6e8bd9a62aa ("Third stage to ipset-5") +Signed-off-by: Phil Sutter +Signed-off-by: Jozsef Kadlecsik +--- + lib/ipset.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/ipset.c b/lib/ipset.c +index c910d88805c28..3bf1c5fcdbc59 100644 +--- a/lib/ipset.c ++++ b/lib/ipset.c +@@ -343,9 +343,9 @@ ipset_shift_argv(int *argc, char *argv[], int from) + + assert(*argc >= from + 1); + +- for (i = from + 1; i <= *argc; i++) ++ for (i = from + 1; i < *argc; i++) + argv[i-1] = argv[i]; +- (*argc)--; ++ argv[--(*argc)] = NULL; + return; + } + diff --git a/0004-tests-Reduce-testsuite-run-time.patch b/0004-tests-Reduce-testsuite-run-time.patch new file mode 100644 index 0000000..499d356 --- /dev/null +++ b/0004-tests-Reduce-testsuite-run-time.patch @@ -0,0 +1,354 @@ +From 5c9ef9016d2781f6e07a544e34ec9f4a8d65d0e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 27 Jun 2024 10:18:18 +0200 +Subject: [PATCH] tests: Reduce testsuite run-time + +Where acceptable, batch add set element calls to avoid overhead of +excessive 'ipset' program spawns. On my (slow) testing VM, this patch +reduces a full run of tests/runtest.sh from ~70min down to ~11min. + +This might eliminate the situation being tested: resize.sh might be such +a case so batch only 255 'ipset add' calls and continue to repeat these +batched calls 32 times in hopes that it still qualifies as the resizing +stress test tests/hash:ip.t calls it. + +Signed-off-by: Phil Sutter +Signed-off-by: Jozsef Kadlecsik +--- + tests/resize.sh | 4 ++-- + tests/resizec.sh | 32 +++++++++++++-------------- + tests/resizen.sh | 49 ++++++++++++++++++++--------------------- + tests/resizet.sh | 40 ++++++++++++++++----------------- + tests/setlist_resize.sh | 4 ++-- + 5 files changed, 64 insertions(+), 65 deletions(-) + +diff --git a/tests/resize.sh b/tests/resize.sh +index 19b93fb01876c..9069b4970e92d 100755 +--- a/tests/resize.sh ++++ b/tests/resize.sh +@@ -9,6 +9,6 @@ set -e + $ipset n resize-test hash:ip hashsize 64 + for x in `seq 1 32`; do + for y in `seq 1 255`; do +- $ipset a resize-test 192.168.$x.$y +- done ++ echo "a resize-test 192.168.$x.$y" ++ done | $ipset restore + done +diff --git a/tests/resizec.sh b/tests/resizec.sh +index 28d674769f76f..781acf74c38dd 100755 +--- a/tests/resizec.sh ++++ b/tests/resizec.sh +@@ -25,65 +25,65 @@ case "$2" in + $ipset n test hash:ip $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y comment "text $ip$x$sep$y" ++ echo "a test $ip$x$sep$y comment \"text $ip$x$sep$y\"" + done +- done ++ done | $ipset restore + ;; + ipport) + $ipset n test hash:ip,port $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023 "text $ip$x$sep$y,1023" ++ echo "a test $ip$x$sep$y,1023 \"text $ip$x$sep$y,1023\"" + done +- done ++ done | $ipset restore + ;; + ipportip) + $ipset n test hash:ip,port,ip $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023,$ip2 comment "text $ip$x$sep$y,1023,$ip2" ++ echo "a test $ip$x$sep$y,1023,$ip2 comment \"text $ip$x$sep$y,1023,$ip2\"" + done +- done ++ done | $ipset restore + ;; + ipportnet) + $ipset n test hash:ip,port,net $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023,$ip2/$net comment "text $ip$x$sep$y,1023,$ip2/$net" ++ echo "a test $ip$x$sep$y,1023,$ip2/$net comment \"text $ip$x$sep$y,1023,$ip2/$net\"" + done +- done ++ done | $ipset restore + ;; + net) + $ipset n test hash:net $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net comment "text $ip$x$sep$y/$net" ++ echo "a test $ip$x$sep$y/$net comment \"text $ip$x$sep$y/$net\"" + done +- done ++ done | $ipset restore + ;; + netnet) + $ipset n test hash:net,net $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment "text $ip$x$sep$y/$net,$ip$y$sep$x/$net" ++ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment \"text $ip$x$sep$y/$net,$ip$y$sep$x/$net\"" + done +- done ++ done | $ipset restore + ;; + netport) + $ipset n test hash:net,port $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,1023 comment "text $ip$x$sep$y/$net,1023" ++ echo "a test $ip$x$sep$y/$net,1023 comment \"text $ip$x$sep$y/$net,1023\"" + done +- done ++ done | $ipset restore + ;; + netiface) + $ipset n test hash:net,iface $1 hashsize 64 comment + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,eth0 comment "text $ip$x$sep$y/$net,eth0" ++ echo "$ipset a test $ip$x$sep$y/$net,eth0 comment \"text $ip$x$sep$y/$net,eth0\"" + done +- done ++ done | $ipset restore + ;; + esac + $ipset l test | grep ^$ip | while read x y z; do +diff --git a/tests/resizen.sh b/tests/resizen.sh +index 9322bd2a2cfce..13221f7b0894a 100755 +--- a/tests/resizen.sh ++++ b/tests/resizen.sh +@@ -25,80 +25,79 @@ case "$2" in + $ipset n test hash:ip,port,net $1 hashsize 64 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch ++ echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch" + done +- done ++ done | $ipset restore + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null ++ echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch" + done +- done ++ done | $ipset restore 2>/dev/null + ;; + netportnet) + $ipset n test hash:net,port,net $1 hashsize 64 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch ++ echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch" + done +- done ++ done | $ipset restore + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null ++ echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch" + done +- done ++ done | $ipset restore 2>/dev/null + ;; + net) + $ipset n test hash:net $1 hashsize 64 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net nomatch ++ echo "a test $ip$x$sep$y/$net nomatch" + done +- done ++ done | $ipset restore + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset t test $ip$x$sep$y/$net nomatch 2>/dev/null ++ echo "t test $ip$x$sep$y/$net nomatch" + done +- done ++ done | $ipset restore 2>/dev/null + ;; + netnet) + $ipset n test hash:net,net $1 hashsize 64 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch ++ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch" + done +- done ++ done | $ipset restore + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch \ +- 2>/dev/null ++ echo "t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch" + done +- done ++ done | $ipset restore 2>/dev/null + ;; + netport) + $ipset n test hash:net,port $1 hashsize 64 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,1023 nomatch ++ echo "a test $ip$x$sep$y/$net,1023 nomatch" + done +- done ++ done | $ipset restore + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset t test $ip$x$sep$y/$net,1023 nomatch 2>/dev/null ++ echo "t test $ip$x$sep$y/$net,1023 nomatch" + done +- done ++ done | $ipset restore 2>/dev/null + ;; + netiface) + $ipset n test hash:net,iface $1 hashsize 64 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,eth0 nomatch ++ echo "a test $ip$x$sep$y/$net,eth0 nomatch" + done +- done ++ done | $ipset restore + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset t test $ip$x$sep$y/$net,eth0 nomatch 2>/dev/null ++ echo "t test $ip$x$sep$y/$net,eth0 nomatch" + done +- done ++ done | $ipset restore 2>/dev/null + ;; + esac + $ipset x +diff --git a/tests/resizet.sh b/tests/resizet.sh +index eed4abf2bd86e..e8fdd732435ab 100755 +--- a/tests/resizet.sh ++++ b/tests/resizet.sh +@@ -25,81 +25,81 @@ case "$2" in + $ipset n test hash:ip $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y ++ echo "a test $ip$x$sep$y" + done +- done ++ done | $ipset restore + ;; + ipmark) + $ipset n test hash:ip,mark $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023 ++ echo "a test $ip$x$sep$y,1023" + done +- done ++ done | $ipset restore + ;; + ipport) + $ipset n test hash:ip,port $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023 ++ echo "a test $ip$x$sep$y,1023" + done +- done ++ done | $ipset restore + ;; + ipportip) + $ipset n test hash:ip,port,ip $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023,$ip2 ++ echo "a test $ip$x$sep$y,1023,$ip2" + done +- done ++ done | $ipset restore + ;; + ipportnet) + $ipset n test hash:ip,port,net $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y,1023,$ip2/$net ++ echo "a test $ip$x$sep$y,1023,$ip2/$net" + done +- done ++ done | $ipset restore + ;; + netportnet) + $ipset n test hash:net,port,net $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 128`; do +- $ipset a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net ++ echo "a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net" + done +- done ++ done | $ipset restore + ;; + net) + $ipset n test hash:net $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net ++ echo "a test $ip$x$sep$y/$net" + done +- done ++ done | $ipset restore + ;; + netnet) + $ipset n test hash:net,net $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net ++ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net" + done +- done ++ done | $ipset restore + ;; + netport) + $ipset n test hash:net,port $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,1023 ++ echo "a test $ip$x$sep$y/$net,1023" + done +- done ++ done | $ipset restore + ;; + netiface) + $ipset n test hash:net,iface $1 hashsize 64 timeout 100 + for x in `seq 0 16`; do + for y in `seq 0 255`; do +- $ipset a test $ip$x$sep$y/$net,eth0 ++ echo "a test $ip$x$sep$y/$net,eth0" + done +- done ++ done | $ipset restore + ;; + esac + $ipset l test | grep ^$ip | while read x y z; do +diff --git a/tests/setlist_resize.sh b/tests/setlist_resize.sh +index 1c2be327b841a..acb33e3ba0f08 100755 +--- a/tests/setlist_resize.sh ++++ b/tests/setlist_resize.sh +@@ -25,9 +25,9 @@ rmmod ip_set >/dev/null 2>&1 + create() { + n=$1 + while [ $n -le 1024 ]; do +- $ipset c test$n hash:ip ++ echo "c test$n hash:ip" + n=$((n+2)) +- done ++ done | $ipset restore + } + + for x in `seq 1 $loop`; do diff --git a/ipset.spec b/ipset.spec index e366c38..c10dd01 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.21 -Release: 2%{?dist} +Version: 7.22 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -10,6 +10,11 @@ Source1: %{name}.service Source2: %{name}.start-stop Source3: %{name}-config +Patch001: 0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch +Patch002: 0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch +Patch003: 0003-lib-ipset-Avoid-argv-array-overstepping.patch +Patch004: 0004-tests-Reduce-testsuite-run-time.patch + BuildRequires: libmnl-devel BuildRequires: automake BuildRequires: autoconf @@ -108,6 +113,9 @@ install -c -m 600 %{SOURCE3} %{buildroot}%{_sysconfdir}/sysconfig/%{name}-config # Create directory for configuration mkdir -p %{buildroot}%{_sysconfdir}/%{name} +# Turn absolute symlink into a relative one +ln -sf %{name} %{buildroot}/%{_sbindir}/%{name}-translate + %preun if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then @@ -171,6 +179,10 @@ fi %changelog +* Thu Aug 01 2024 Phil Sutter - 7.22-1 +- Turn absolute ipset-translate symlink into a relative one +- Rebase onto v7.22 plus fixes + * Thu Jul 18 2024 Fedora Release Engineering - 7.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 588e6be..f0c0e6f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.21.tar.bz2) = 175c6516c2091c57738a0324678d8d016e4d7f18fa03cb0dcc502391cac4caf4db1e757f61ad2fe312c1dbe431ec9cfabbc8e15a64a94ebd2fa903155b27c88f +SHA512 (ipset-7.22.tar.bz2) = e375a9110eb7974480147c57eb2cff4bdd03c7704cdae006a3d254cc80fada587aa8aee25a86f7cab29db83f5e283c5f9a47a314297317660ebba5097f623d79 From e6e33e65e2d096d6bee17c8d4baaec61b257e187 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 07:21:42 +0000 Subject: [PATCH 52/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index c10dd01..9f235d0 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.22 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -179,6 +179,9 @@ fi %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 7.22-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Thu Aug 01 2024 Phil Sutter - 7.22-1 - Turn absolute ipset-translate symlink into a relative one - Rebase onto v7.22 plus fixes From 506847bd396e005f3e686a84be16b9263f62344e Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 7 May 2025 16:39:33 +0200 Subject: [PATCH 53/55] New version 7.23 --- ...ith-WARN_ON_ONCE-according-to-usage-.patch | 23 -- ...-global-buffer-overflow-warning-by-A.patch | 54 --- ...-ipset-Avoid-argv-array-overstepping.patch | 38 -- 0004-tests-Reduce-testsuite-run-time.patch | 354 ------------------ ipset.spec | 12 +- sources | 2 +- 6 files changed, 6 insertions(+), 477 deletions(-) delete mode 100644 0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch delete mode 100644 0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch delete mode 100644 0003-lib-ipset-Avoid-argv-array-overstepping.patch delete mode 100644 0004-tests-Reduce-testsuite-run-time.patch diff --git a/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch b/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch deleted file mode 100644 index 7acff72..0000000 --- a/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch +++ /dev/null @@ -1,23 +0,0 @@ -From 21080dc79c4e9244149aa78f6a8f7fbb6f4b8e81 Mon Sep 17 00:00:00 2001 -From: Jozsef Kadlecsik -Date: Thu, 6 Jun 2024 08:57:11 +0200 -Subject: [PATCH] Replace BUG_ON() with WARN_ON_ONCE() according to usage - policy. - ---- - kernel/net/netfilter/ipset/ip_set_list_set.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/kernel/net/netfilter/ipset/ip_set_list_set.c b/kernel/net/netfilter/ipset/ip_set_list_set.c -index fd78e2db06e4f..0d3e5a7331f26 100644 ---- a/kernel/net/netfilter/ipset/ip_set_list_set.c -+++ b/kernel/net/netfilter/ipset/ip_set_list_set.c -@@ -432,7 +432,7 @@ list_set_destroy(struct ip_set *set) - { - struct list_set *map = set->data; - -- BUG_ON(!list_empty(&map->members)); -+ WARN_ON_ONCE(!list_empty(&map->members)); - kfree(map); - - set->data = NULL; diff --git a/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch b/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch deleted file mode 100644 index 115b5fc..0000000 --- a/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch +++ /dev/null @@ -1,54 +0,0 @@ -From f1bcacf5eeb8620ea684524e1ce9c3951a77f1f9 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 27 Jun 2024 10:18:16 +0200 -Subject: [PATCH] lib: data: Fix for global-buffer-overflow warning by ASAN - -After compiling with CFLAGS="-fsanitize=address -g", running the -testsuite triggers the following warning: - -| ipmap: Range: Check syntax error: missing range/from-to: FAILED -| Failed test: ../src/ipset 2>.foo.err -N test ipmap -| ================================================================= -| ==4204==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a21e77172a at pc 0x7f1ef246f2a6 bp 0x7fffed8f4f40 sp 0x7fffed8f46e8 -| READ of size 32 at 0x55a21e77172a thread T0 -| #0 0x7f1ef246f2a5 in __interceptor_memcpy /var/tmp/portage/sys-devel/gcc-13.2.1_p20231014/work/gcc-13-20231014/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:899 -| #1 0x55a21e758bf6 in ipset_strlcpy /home/n0-1/git/ipset/lib/data.c:119 -| #2 0x55a21e758bf6 in ipset_data_set /home/n0-1/git/ipset/lib/data.c:349 -| #3 0x55a21e75ee2f in ipset_parse_typename /home/n0-1/git/ipset/lib/parse.c:1819 -| #4 0x55a21e754119 in ipset_parser /home/n0-1/git/ipset/lib/ipset.c:1205 -| #5 0x55a21e752cef in ipset_parse_argv /home/n0-1/git/ipset/lib/ipset.c:1344 -| #6 0x55a21e74ea45 in main /home/n0-1/git/ipset/src/ipset.c:38 -| #7 0x7f1ef224cf09 (/lib64/libc.so.6+0x23f09) -| #8 0x7f1ef224cfc4 in __libc_start_main (/lib64/libc.so.6+0x23fc4) -| #9 0x55a21e74f040 in _start (/home/n0-1/git/ipset/src/ipset+0x1d040) -| -| 0x55a21e77172a is located 54 bytes before global variable '*.LC1' defined in 'ipset_bitmap_ip.c' (0x55a21e771760) of size 19 -| '*.LC1' is ascii string 'IP|IP/CIDR|FROM-TO' -| 0x55a21e77172a is located 0 bytes after global variable '*.LC0' defined in 'ipset_bitmap_ip.c' (0x55a21e771720) of size 10 -| '*.LC0' is ascii string 'bitmap:ip' - -Fix this by avoiding 'src' array overstep in ipset_strlcpy(): In -contrast to strncpy(), memcpy() does not respect NUL-chars in input but -stubbornly reads as many bytes as specified. - -Fixes: a7432ba786ca4 ("Workaround misleading -Wstringop-truncation warning") -Signed-off-by: Phil Sutter -Signed-off-by: Jozsef Kadlecsik ---- - lib/data.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/lib/data.c b/lib/data.c -index c05b20144cdad..64cad7a377302 100644 ---- a/lib/data.c -+++ b/lib/data.c -@@ -111,6 +111,9 @@ ipset_strlcpy(char *dst, const char *src, size_t len) - assert(dst); - assert(src); - -+ if (strlen(src) < len) -+ len = strlen(src) + 1; -+ - memcpy(dst, src, len); - dst[len - 1] = '\0'; - } diff --git a/0003-lib-ipset-Avoid-argv-array-overstepping.patch b/0003-lib-ipset-Avoid-argv-array-overstepping.patch deleted file mode 100644 index 99dfdca..0000000 --- a/0003-lib-ipset-Avoid-argv-array-overstepping.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 851cb04ffee5040f1e0063f77c3fe9bc6245e0fb Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 27 Jun 2024 10:18:17 +0200 -Subject: [PATCH] lib: ipset: Avoid 'argv' array overstepping - -The maximum accepted value for 'argc' is MAX_ARGS which matches 'argv' -array size. The maximum allowed array index is therefore argc-1. - -This fix will leave items in argv non-NULL-terminated, so explicitly -NULL the formerly last entry after shifting. - -Looks like a day-1 bug. Interestingly, this neither triggered ASAN nor -valgrind. Yet adding debug output printing argv entries being copied -did. - -Fixes: 1e6e8bd9a62aa ("Third stage to ipset-5") -Signed-off-by: Phil Sutter -Signed-off-by: Jozsef Kadlecsik ---- - lib/ipset.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/ipset.c b/lib/ipset.c -index c910d88805c28..3bf1c5fcdbc59 100644 ---- a/lib/ipset.c -+++ b/lib/ipset.c -@@ -343,9 +343,9 @@ ipset_shift_argv(int *argc, char *argv[], int from) - - assert(*argc >= from + 1); - -- for (i = from + 1; i <= *argc; i++) -+ for (i = from + 1; i < *argc; i++) - argv[i-1] = argv[i]; -- (*argc)--; -+ argv[--(*argc)] = NULL; - return; - } - diff --git a/0004-tests-Reduce-testsuite-run-time.patch b/0004-tests-Reduce-testsuite-run-time.patch deleted file mode 100644 index 499d356..0000000 --- a/0004-tests-Reduce-testsuite-run-time.patch +++ /dev/null @@ -1,354 +0,0 @@ -From 5c9ef9016d2781f6e07a544e34ec9f4a8d65d0e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 27 Jun 2024 10:18:18 +0200 -Subject: [PATCH] tests: Reduce testsuite run-time - -Where acceptable, batch add set element calls to avoid overhead of -excessive 'ipset' program spawns. On my (slow) testing VM, this patch -reduces a full run of tests/runtest.sh from ~70min down to ~11min. - -This might eliminate the situation being tested: resize.sh might be such -a case so batch only 255 'ipset add' calls and continue to repeat these -batched calls 32 times in hopes that it still qualifies as the resizing -stress test tests/hash:ip.t calls it. - -Signed-off-by: Phil Sutter -Signed-off-by: Jozsef Kadlecsik ---- - tests/resize.sh | 4 ++-- - tests/resizec.sh | 32 +++++++++++++-------------- - tests/resizen.sh | 49 ++++++++++++++++++++--------------------- - tests/resizet.sh | 40 ++++++++++++++++----------------- - tests/setlist_resize.sh | 4 ++-- - 5 files changed, 64 insertions(+), 65 deletions(-) - -diff --git a/tests/resize.sh b/tests/resize.sh -index 19b93fb01876c..9069b4970e92d 100755 ---- a/tests/resize.sh -+++ b/tests/resize.sh -@@ -9,6 +9,6 @@ set -e - $ipset n resize-test hash:ip hashsize 64 - for x in `seq 1 32`; do - for y in `seq 1 255`; do -- $ipset a resize-test 192.168.$x.$y -- done -+ echo "a resize-test 192.168.$x.$y" -+ done | $ipset restore - done -diff --git a/tests/resizec.sh b/tests/resizec.sh -index 28d674769f76f..781acf74c38dd 100755 ---- a/tests/resizec.sh -+++ b/tests/resizec.sh -@@ -25,65 +25,65 @@ case "$2" in - $ipset n test hash:ip $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y comment "text $ip$x$sep$y" -+ echo "a test $ip$x$sep$y comment \"text $ip$x$sep$y\"" - done -- done -+ done | $ipset restore - ;; - ipport) - $ipset n test hash:ip,port $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023 "text $ip$x$sep$y,1023" -+ echo "a test $ip$x$sep$y,1023 \"text $ip$x$sep$y,1023\"" - done -- done -+ done | $ipset restore - ;; - ipportip) - $ipset n test hash:ip,port,ip $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023,$ip2 comment "text $ip$x$sep$y,1023,$ip2" -+ echo "a test $ip$x$sep$y,1023,$ip2 comment \"text $ip$x$sep$y,1023,$ip2\"" - done -- done -+ done | $ipset restore - ;; - ipportnet) - $ipset n test hash:ip,port,net $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023,$ip2/$net comment "text $ip$x$sep$y,1023,$ip2/$net" -+ echo "a test $ip$x$sep$y,1023,$ip2/$net comment \"text $ip$x$sep$y,1023,$ip2/$net\"" - done -- done -+ done | $ipset restore - ;; - net) - $ipset n test hash:net $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net comment "text $ip$x$sep$y/$net" -+ echo "a test $ip$x$sep$y/$net comment \"text $ip$x$sep$y/$net\"" - done -- done -+ done | $ipset restore - ;; - netnet) - $ipset n test hash:net,net $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment "text $ip$x$sep$y/$net,$ip$y$sep$x/$net" -+ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment \"text $ip$x$sep$y/$net,$ip$y$sep$x/$net\"" - done -- done -+ done | $ipset restore - ;; - netport) - $ipset n test hash:net,port $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,1023 comment "text $ip$x$sep$y/$net,1023" -+ echo "a test $ip$x$sep$y/$net,1023 comment \"text $ip$x$sep$y/$net,1023\"" - done -- done -+ done | $ipset restore - ;; - netiface) - $ipset n test hash:net,iface $1 hashsize 64 comment - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,eth0 comment "text $ip$x$sep$y/$net,eth0" -+ echo "$ipset a test $ip$x$sep$y/$net,eth0 comment \"text $ip$x$sep$y/$net,eth0\"" - done -- done -+ done | $ipset restore - ;; - esac - $ipset l test | grep ^$ip | while read x y z; do -diff --git a/tests/resizen.sh b/tests/resizen.sh -index 9322bd2a2cfce..13221f7b0894a 100755 ---- a/tests/resizen.sh -+++ b/tests/resizen.sh -@@ -25,80 +25,79 @@ case "$2" in - $ipset n test hash:ip,port,net $1 hashsize 64 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch -+ echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch" - done -- done -+ done | $ipset restore - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null -+ echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch" - done -- done -+ done | $ipset restore 2>/dev/null - ;; - netportnet) - $ipset n test hash:net,port,net $1 hashsize 64 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch -+ echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch" - done -- done -+ done | $ipset restore - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null -+ echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch" - done -- done -+ done | $ipset restore 2>/dev/null - ;; - net) - $ipset n test hash:net $1 hashsize 64 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net nomatch -+ echo "a test $ip$x$sep$y/$net nomatch" - done -- done -+ done | $ipset restore - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset t test $ip$x$sep$y/$net nomatch 2>/dev/null -+ echo "t test $ip$x$sep$y/$net nomatch" - done -- done -+ done | $ipset restore 2>/dev/null - ;; - netnet) - $ipset n test hash:net,net $1 hashsize 64 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch -+ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch" - done -- done -+ done | $ipset restore - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch \ -- 2>/dev/null -+ echo "t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch" - done -- done -+ done | $ipset restore 2>/dev/null - ;; - netport) - $ipset n test hash:net,port $1 hashsize 64 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,1023 nomatch -+ echo "a test $ip$x$sep$y/$net,1023 nomatch" - done -- done -+ done | $ipset restore - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset t test $ip$x$sep$y/$net,1023 nomatch 2>/dev/null -+ echo "t test $ip$x$sep$y/$net,1023 nomatch" - done -- done -+ done | $ipset restore 2>/dev/null - ;; - netiface) - $ipset n test hash:net,iface $1 hashsize 64 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,eth0 nomatch -+ echo "a test $ip$x$sep$y/$net,eth0 nomatch" - done -- done -+ done | $ipset restore - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset t test $ip$x$sep$y/$net,eth0 nomatch 2>/dev/null -+ echo "t test $ip$x$sep$y/$net,eth0 nomatch" - done -- done -+ done | $ipset restore 2>/dev/null - ;; - esac - $ipset x -diff --git a/tests/resizet.sh b/tests/resizet.sh -index eed4abf2bd86e..e8fdd732435ab 100755 ---- a/tests/resizet.sh -+++ b/tests/resizet.sh -@@ -25,81 +25,81 @@ case "$2" in - $ipset n test hash:ip $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y -+ echo "a test $ip$x$sep$y" - done -- done -+ done | $ipset restore - ;; - ipmark) - $ipset n test hash:ip,mark $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023 -+ echo "a test $ip$x$sep$y,1023" - done -- done -+ done | $ipset restore - ;; - ipport) - $ipset n test hash:ip,port $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023 -+ echo "a test $ip$x$sep$y,1023" - done -- done -+ done | $ipset restore - ;; - ipportip) - $ipset n test hash:ip,port,ip $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023,$ip2 -+ echo "a test $ip$x$sep$y,1023,$ip2" - done -- done -+ done | $ipset restore - ;; - ipportnet) - $ipset n test hash:ip,port,net $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y,1023,$ip2/$net -+ echo "a test $ip$x$sep$y,1023,$ip2/$net" - done -- done -+ done | $ipset restore - ;; - netportnet) - $ipset n test hash:net,port,net $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 128`; do -- $ipset a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net -+ echo "a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net" - done -- done -+ done | $ipset restore - ;; - net) - $ipset n test hash:net $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net -+ echo "a test $ip$x$sep$y/$net" - done -- done -+ done | $ipset restore - ;; - netnet) - $ipset n test hash:net,net $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net -+ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net" - done -- done -+ done | $ipset restore - ;; - netport) - $ipset n test hash:net,port $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,1023 -+ echo "a test $ip$x$sep$y/$net,1023" - done -- done -+ done | $ipset restore - ;; - netiface) - $ipset n test hash:net,iface $1 hashsize 64 timeout 100 - for x in `seq 0 16`; do - for y in `seq 0 255`; do -- $ipset a test $ip$x$sep$y/$net,eth0 -+ echo "a test $ip$x$sep$y/$net,eth0" - done -- done -+ done | $ipset restore - ;; - esac - $ipset l test | grep ^$ip | while read x y z; do -diff --git a/tests/setlist_resize.sh b/tests/setlist_resize.sh -index 1c2be327b841a..acb33e3ba0f08 100755 ---- a/tests/setlist_resize.sh -+++ b/tests/setlist_resize.sh -@@ -25,9 +25,9 @@ rmmod ip_set >/dev/null 2>&1 - create() { - n=$1 - while [ $n -le 1024 ]; do -- $ipset c test$n hash:ip -+ echo "c test$n hash:ip" - n=$((n+2)) -- done -+ done | $ipset restore - } - - for x in `seq 1 $loop`; do diff --git a/ipset.spec b/ipset.spec index 9f235d0..fed78c5 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset -Version: 7.22 -Release: 2%{?dist} +Version: 7.23 +Release: 1%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -10,11 +10,6 @@ Source1: %{name}.service Source2: %{name}.start-stop Source3: %{name}-config -Patch001: 0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch -Patch002: 0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch -Patch003: 0003-lib-ipset-Avoid-argv-array-overstepping.patch -Patch004: 0004-tests-Reduce-testsuite-run-time.patch - BuildRequires: libmnl-devel BuildRequires: automake BuildRequires: autoconf @@ -179,6 +174,9 @@ fi %changelog +* Wed May 07 2025 Phil Sutter - 7.23-1 +- new version + * Fri Jan 17 2025 Fedora Release Engineering - 7.22-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index f0c0e6f..be758ae 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.22.tar.bz2) = e375a9110eb7974480147c57eb2cff4bdd03c7704cdae006a3d254cc80fada587aa8aee25a86f7cab29db83f5e283c5f9a47a314297317660ebba5097f623d79 +SHA512 (ipset-7.23.tar.bz2) = 5a43c790abf157a55db5a9a22cb5f28a225f5c7969beda81566a2259aa82c9d852979eb805b11b4347f47c6a0c2cc4de6f14e4733bee5b562844422a45fb9dab From 3dd0bb47016d83d57e8f7fcfa5a620a4f8bd3921 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 20 May 2025 13:32:16 +0200 Subject: [PATCH 54/55] New version 7.24 --- ipset.spec | 5 ++++- sources | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/ipset.spec b/ipset.spec index fed78c5..81df147 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,5 +1,5 @@ Name: ipset -Version: 7.23 +Version: 7.24 Release: 1%{?dist} Summary: Manage Linux IP sets @@ -174,6 +174,9 @@ fi %changelog +* Tue May 20 2025 Phil Sutter - 7.24-1 +- new version + * Wed May 07 2025 Phil Sutter - 7.23-1 - new version diff --git a/sources b/sources index be758ae..66b03f3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ipset-7.23.tar.bz2) = 5a43c790abf157a55db5a9a22cb5f28a225f5c7969beda81566a2259aa82c9d852979eb805b11b4347f47c6a0c2cc4de6f14e4733bee5b562844422a45fb9dab +SHA512 (ipset-7.24.tar.bz2) = 18ccb49bd38083f0556b11e1d17f43791c52a2b094c9a500b6f770796b17e8e70c3860a628eac2252eb672b1fc9de734d3a0e0823d61dd9be7b4188adc6dd214 From 08a38ea64a84f22de26e42e70dd5010518e7f065 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:45:50 +0000 Subject: [PATCH 55/55] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- ipset.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipset.spec b/ipset.spec index 81df147..8fa6607 100644 --- a/ipset.spec +++ b/ipset.spec @@ -1,6 +1,6 @@ Name: ipset Version: 7.24 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Manage Linux IP sets License: GPL-2.0-only @@ -174,6 +174,9 @@ fi %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 7.24-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Phil Sutter - 7.24-1 - new version