diff --git a/.gitignore b/.gitignore index e69de29..79a1288 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1 @@ +ipset-*.tar.bz2 diff --git a/0001-build-do-install-libipset-args.h.patch b/0001-build-do-install-libipset-args.h.patch new file mode 100644 index 0000000..c2f8edf --- /dev/null +++ b/0001-build-do-install-libipset-args.h.patch @@ -0,0 +1,28 @@ +From 39fde1381f0ba9101f65c08f2abda5426a46f8b1 Mon Sep 17 00:00:00 2001 +From: Jan Engelhardt +Date: Mon, 22 Jan 2018 22:50:33 +0100 +Subject: [PATCH] build: do install libipset/args.h + +libipset/types.h includes args.h, therefore args.h must be installed +too. + +Signed-off-by: Jan Engelhardt +Signed-off-by: Jozsef Kadlecsik +--- + include/libipset/Makefile.am | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/libipset/Makefile.am b/include/libipset/Makefile.am +index 3b47518..79a1357 100644 +--- a/include/libipset/Makefile.am ++++ b/include/libipset/Makefile.am +@@ -1,5 +1,6 @@ + pkgincludedir = ${includedir}/libipset + pkginclude_HEADERS = \ ++ args.h \ + data.h \ + errcode.h \ + linux_ip_set_bitmap.h \ +-- +2.11.0 + diff --git a/ipset.service b/ipset.service new file mode 100644 index 0000000..f4a0802 --- /dev/null +++ b/ipset.service @@ -0,0 +1,18 @@ +[Unit] +Description=IP sets for iptables +Before=iptables.service +Before=ip6tables.service + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ipset/ipset.start-stop start +ExecStop=/usr/libexec/ipset/ipset.start-stop stop +ExecReload=/usr/libexec/ipset/ipset.start-stop reload +# Save current ipset entries on stop/restart. +# Value: yes|no, default: no +# Saves all ipsets to /etc/ipset/ipset if ipset gets stopped +Environment=IPSET_SAVE_ON_STOP=no IPSET_SAVE_ON_RESTART=no + +[Install] +WantedBy=basic.target diff --git a/ipset.spec b/ipset.spec new file mode 100644 index 0000000..58c3bbc --- /dev/null +++ b/ipset.spec @@ -0,0 +1,290 @@ +Name: ipset +Version: 7.6 +Release: 2%{?dist} +Summary: Manage Linux IP sets + +License: GPLv2 +URL: http://ipset.netfilter.org/ +Source0: %{url}/%{name}-%{version}.tar.bz2 +Source1: %{name}.service +Source2: %{name}.start-stop + +BuildRequires: libmnl-devel +BuildRequires: automake +BuildRequires: autoconf +BuildRequires: libtool +BuildRequires: libtool-ltdl-devel + +# An explicit requirement is needed here, to avoid cases where a user would +# explicitly update only one of the two (e.g 'yum update ipset') +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description +IP sets are a framework inside the Linux kernel since version 2.4.x, which can +be administered by the ipset utility. Depending on the type, currently an IP +set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC +addresses in a way, which ensures lightning speed when matching an entry +against a set. + +If you want to: + - store multiple IP addresses or port numbers and match against the collection + by iptables at one swoop; + - dynamically update iptables rules against IP addresses or ports without + performance penalty; + - express complex IP address and ports based rulesets with one single iptables + rule and benefit from the speed of IP sets +then ipset may be the proper tool for you. + + +%package libs +Summary: Shared library providing the IP sets functionality + +%description libs +This package contains the libraries which provide the IP sets funcionality. + + +%package devel +Summary: Development files for %{name} +Requires: %{name}-libs%{?_isa} == %{version}-%{release} +Requires: kernel-headers + +%description devel +This package contains the files required to develop software using the %{name} +libraries. + + +%package service +Summary: %{name} service for %{name}s +Requires: %{name} = %{version}-%{release} +BuildRequires: systemd +Requires: iptables-services +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +BuildArch: noarch + +%description service +This package provides the service %{name} that is split +out of the base package since it is not active by default. + + +%prep +%autosetup -p1 + + +%build +./autogen.sh +%configure --enable-static=no --with-kmod=no + +# Just to make absolutely sure we are not building the bundled kernel module +# I have to do it after the configure run unfortunately +rm -fr kernel + +# Prevent libtool from defining rpath +sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool +sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool + +%make_build + + +%install +%make_install +find %{buildroot} -name '*.la' -exec rm -f '{}' \; + +# install systemd unit file +install -d -m 755 %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE1} %{buildroot}/%{_unitdir} + +# install supporting script +install -d -m 755 %{buildroot}%{_libexecdir}/%{name} +install -c -m 755 %{SOURCE2} %{buildroot}%{_libexecdir}/%{name} + +# Create directory for configuration +mkdir -p %{buildroot}%{_sysconfdir}/%{name} + + +%preun +if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then + rmmod xt_set 2>/dev/null + [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && exit 1 +fi + + +%ldconfig_scriptlets libs + + +%post service +%systemd_post %{name}.service + +%preun service +if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then + rmmod xt_set 2>/dev/null + [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && exit 1 +fi +%systemd_preun %{name}.service + +%postun service +%systemd_postun_with_restart %{name}.service + + +%files +%doc ChangeLog +%license COPYING +%{_mandir}/man8/%{name}.8.* +%{_sbindir}/%{name} + +%files libs +%license COPYING +%{_libdir}/lib%{name}.so.13* + +%files devel +%{_includedir}/lib%{name} +%{_libdir}/lib%{name}.so +%{_libdir}/pkgconfig/lib%{name}.pc +%{_mandir}/man3/libipset.3.* + +%files service +%{_unitdir}/%{name}.service +%dir %{_libexecdir}/%{name} +%attr(0755,root,root) %{_libexecdir}/%{name}/%{name}.start-stop +%dir %{_sysconfdir}/%{name} + + +%changelog +* Tue Jul 28 2020 Fedora Release Engineering - 7.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Feb 24 2020 Nicolas Chauvet - 7.6-1 +- Update to 7.6 + +* Wed Jan 29 2020 Fedora Release Engineering - 7.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Jan 10 2020 Nicolas Chauvet - 7.5-1 +- Update to 7.5 + +* Mon Nov 04 2019 Eric Garver - 7.4-1 +- Update to 7.4 + +* Mon Aug 19 2019 Nicolas Chauvet - 7.3-1 +- Update to 7.3 + +* Thu Jul 25 2019 Fedora Release Engineering - 7.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu Jul 11 2019 Nicolas Chauvet - 7.2-1 +- Update to 7.2 + +* Fri Feb 01 2019 Fedora Release Engineering - 6.38-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Aug 13 2018 Nicolas Chauvet - 6.38-1 +- Update to 6.38 +- Clean-up spec + +* Fri Jul 13 2018 Fedora Release Engineering - 6.35-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Mon Feb 12 2018 Eric Garver - 6.35-3 +- Patch for missing header file (RHBZ#1543596) + +* Wed Feb 07 2018 Fedora Release Engineering - 6.35-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Jan 08 2018 Nicolas Chauvet - 6.35-1 +- Update to 6.35 + +* Mon Jul 31 2017 Nicolas Chauvet - 6.32-1 +- Update to 6.32 + +* Wed Jul 26 2017 Fedora Release Engineering - 6.29-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Apr 07 2017 Nicolas Chauvet - 6.29-3 +- Userspace needs kernel-headers - rhbz#1420864 + +* Fri Feb 10 2017 Fedora Release Engineering - 6.29-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Mon Apr 18 2016 Thomas Woerner - 6.29-1 +- New upstream version 6.29 (RHBZ#1317208) + - Suppress unnecessary stderr in command loop for resize and list + - Correction in comment test + - Support chroot buildroots (reported by Jan Engelhardt) + - Fix "configure" breakage due to pkg-config related changes + (reported by Jan Engelhardt) + - Support older pkg-config packages + - Add bash completion to the install routine (Mart Frauenlob) + - Fix misleading error message with comment extension + - Test added to check 0.0.0.0/0,iface to be matched in hash:net,iface type + - Fix link with libtool >= 2.4.4 (Olivier Blin) + +* Thu Feb 04 2016 Fedora Release Engineering - 6.27-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Tue Nov 10 2015 Thomas Woerner - 6.27-1 +- New upstream version 6.27 (RHBZ#1145913) + +* Sat Oct 10 2015 Haïkel Guémar - 6.26-1 +- Upstream 6.26 (RHBZ#1145913) + +* Wed Jun 17 2015 Fedora Release Engineering - 6.22-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Thu Sep 18 2014 Mathieu Bridon - 6.22-1 +- New upstream release. + +* Sat Aug 16 2014 Fedora Release Engineering - 6.21.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sat Jun 07 2014 Fedora Release Engineering - 6.21.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Tue Mar 11 2014 Mathieu Bridon - 6.21.1-2 +- Remove runtime requirement on the kernel. + https://lists.fedoraproject.org/pipermail/devel/2014-March/196565.html + +* Tue Oct 29 2013 Mathieu Bridon - 6.20.1-1 +- New upstream release. + +* Tue Aug 27 2013 Quentin Armitage 6.19-2 +- Add service pkg - adds save and reload functionality on shutdown/startup +- Add requires dependency of ipset on matching ipset-libs + +* Thu Aug 15 2013 Mathieu Bridon - 6.19-1 +- New upstream release. + +* Sat Aug 03 2013 Fedora Release Engineering - 6.16.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Thu Feb 14 2013 Fedora Release Engineering - 6.16.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Wed Sep 26 2012 Mathieu Bridon - 6.16.1-1 +- New upstream release. +- Fix a requirement. + +* Wed Sep 26 2012 Mathieu Bridon - 6.14-1 +- New upstream release. +- Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one. + +* Mon Jul 30 2012 Mathieu Bridon - 6.13-1 +- New upstream release. +- Split out the library in its own subpackage. + +* Thu Jul 19 2012 Fedora Release Engineering - 6.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Mon Feb 06 2012 Mathieu Bridon - 6.11-1 +- New upstream release. +- Removed our patch, it has been integrated upstream. As such, we also don't + need to re-run autoreconf any more. + +* Fri Jan 13 2012 Fedora Release Engineering - 6.9.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Fri Sep 16 2011 Mathieu Bridon - 6.9.1-2 +- Some fixes based on Pierre-Yves' review feedback. + +* Wed Sep 14 2011 Mathieu Bridon - 6.9.1-1 +- Initial packaging. diff --git a/ipset.start-stop b/ipset.start-stop new file mode 100644 index 0000000..da21890 --- /dev/null +++ b/ipset.start-stop @@ -0,0 +1,209 @@ +#!/bin/bash +# +# ipset Start and stop ipset firewall sets +# +# config: /etc/ipset/ipset +# + +IPSET=ipset +IPSET_BIN=/usr/sbin/${IPSET} +IPSET_DATA=/etc/${IPSET}/${IPSET} + +IPTABLES_CONFIG=/etc/sysconfig/iptables-config +IP6TABLES_CONFIG=${IPTABLES_CONFIG/iptables/ip6tables} + +TMP_FIFO=/tmp/${IPSET}.$$ + +if [[ ! -x ${IPSET_BIN} ]]; then + echo "${IPSET_BIN} does not exist." + exit 5 +fi + +CLEAN_FILES=TMP_FIFO +trap "rm -f \$CLEAN_FILES" EXIT + +# Default ipset configuration: +[[ -z $IPSET_SAVE_ON_STOP ]] && IPSET_SAVE_ON_STOP=no # Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_STOP +[[ -z $IPSET_SAVE_ON_RESTART ]] && IPSET_SAVE_ON_RESTART=no # Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_RESTART + +# Load iptables configuration(s) +[[ -f "$IPTABLES_CONFIG" ]] && . "$IPTABLES_CONFIG" +[[ -f "$IP6TABLES_CONFIG" ]] && . "$IP6TABLES_CONFIG" + +# It doesn't make sense to save iptables config and not our config +[[ ${IPTABLES_SAVE_ON_STOP} = yes || ${IP6TABLES_SAVE_ON_STOP} = yes ]] && IPSET_SAVE_ON_STOP=yes +[[ ${IPTABLES_SAVE_ON_RESTART} = yes || ${IP6TABLES_SAVE_ON_RESTART} = yes ]] && IPSET_SAVE_ON_RESTART=yes + +check_can_unload() { + # If the xt_set module is loaded and can't be unloaded, then iptables is + # using ipsets, so refuse to stop the service. + if [[ -n $(lsmod | grep "^xt_set ") ]]; then + rmmod xt_set 2>/dev/null + [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && return 1 + fi + + return 0 +} + +flush_n_delete() { + local ret=0 set + + # Flush sets + ${IPSET_BIN} flush + let ret+=$? + + # Delete ipset sets. If we don't do them individually, then none + # will be deleted unless they all can be. + for set in $(${IPSET_BIN} list -name); do + ${IPSET_BIN} destroy 2>/dev/null + [[ $? -ne 0 ]] && ret=1 + done + + return $ret +} + +start_clean() +{ + mkfifo -m go= "${TMP_FIFO}" + [[ $? -ne 0 ]] && return 1 + + # Get the lists of sets in current(old) config and new config + old_sets="$(${IPSET_BIN} list -name | sort -u)" + new_sets="$(grep ^create "${IPSET_DATA}" | cut -d " " -f 2 | sort -u)" + + # List of sets no longer wanted + drop_sets="$( printf "%s\n" "${old_sets}" > "${TMP_FIFO}" & + printf "%s\n" "${new_sets}" | comm -23 "${TMP_FIFO}" - + )" + + # Get rid of sets no longer needed + # Unfortunately -! doesn't work for destroy, so we have to do it a command at a time + for dset in $drop_sets; do + ipset destroy $dset 2>/dev/null + # If it won't go - ? in use by iptables, just clear it + [[ $? -ne 0 ]] && ipset flush $dset + done + + # Now delete the set members no longer required + ${IPSET_BIN} save | grep "^add " | sort >${TMP_FIFO} & + grep "^add " ${IPSET_DATA} | sort | comm -23 ${TMP_FIFO} - | sed -e "s/^add /del /" \ + | ${IPSET_BIN} restore -! + + # At last we can add the set members we haven't got + ipset restore -! <${IPSET_DATA} + + rm ${TMP_FIFO} + + return 0 +} + +start() { + # Do not start if there is no config file. + [[ ! -f "$IPSET_DATA" ]] && echo "Loaded with no configuration" && return 0 + + # We can skip the first bit and do a simple load if + # there is no current ipset configuration + res=1 + if [[ -n $(${IPSET_BIN} list -name) ]]; then + # The following may fail for some bizarre reason + start_clean + res=$? + + [[ $res -ne 0 ]] && echo "Some old configuration may remain" + fi + + # res -ne 0 => either start_clean failed, or we didn't need to run it + if [[ $res -ne 0 ]]; then + # This is the easy way to start but would leave any old + # entries still configured. Still, better than nothing - + # but fine if we had no config + ${IPSET_BIN} restore -! <${IPSET_DATA} + res=$? + fi + + if [[ $res -ne 0 ]]; then + return 1 + fi + + return 0 +} + +stop() { + # Nothing to stop if ip_set module is not loaded. + lsmod | grep -q "^ip_set " + [[ $? -ne 0 ]] && return 6 + + flush_n_delete + [[ $? -ne 0 ]] && echo Warning: Not all sets were flushed/deleted + + return 0 +} + +save() { + # Do not save if ip_set module is not loaded. + lsmod | grep -q "^ip_set " + [[ $? -ne 0 ]] && return 6 + + [[ -z $(${IPSET_BIN} list -name) ]] && return 0 + + ret=0 + TMP_FILE=$(/bin/mktemp -q /tmp/$IPSET.XXXXXX) \ + && CLEAN_FILES+=" $TMP_FILE" \ + && chmod 600 "$TMP_FILE" \ + && ${IPSET_BIN} save > $TMP_FILE 2>/dev/null \ + && [[ -s $TMP_FILE ]] \ + || ret=1 + + if [[ $ret -eq 0 ]]; then + # No need to do anything if the files are the same + if [[ ! -f $IPSET_DATA ]]; then + mv $TMP_FILE $IPSET_DATA && chmod 600 $IPSET_DATA || ret=1 + else + diff -q $TMP_FILE $IPSET_DATA >/dev/null + + if [[ $? -ne 0 ]]; then + if [[ -f $IPSET_DATA ]]; then + cp -f --preserve=timestamps $IPSET_DATA $IPSET_DATA.save \ + && chmod 600 $IPSET_DATA.save \ + || ret=1 + fi + if [[ $ret -eq 0 ]]; then + cp -f --preserve=timestamps $TMP_FILE $IPSET_DATA \ + && chmod 600 $IPSET_DATA \ + || ret=1 + fi + fi + fi + fi + + rm -f $TMP_FILE + return $ret +} + + +case "$1" in + start) + start + RETVAL=$? + ;; + stop) + check_can_unload || exit 1 + [[ $IPSET_SAVE_ON_STOP = yes ]] && save + stop + RETVAL=$? + [[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0 + ;; + reload) + [[ $IPSET_SAVE_ON_RESTART = yes ]] && save + stop + RETVAL=$? + [[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0 + start + RETVAL=$? + ;; + *) + echo "Usage: $IPSET {start|stop|reload}" >&2 + exit 1 +esac + +exit $RETVAL diff --git a/sources b/sources new file mode 100644 index 0000000..e4f1392 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (ipset-7.6.tar.bz2) = c4d9c65895335dec8f855fca6c940d2ee19e7b8d2292325778a1608e795e2e35caa787cbcdeb8e2877f3695c641ac348b23ac43f73bdc1a8242e8d04f4944084 diff --git a/tests/sanity-tests/Makefile b/tests/sanity-tests/Makefile new file mode 100644 index 0000000..b11121b --- /dev/null +++ b/tests/sanity-tests/Makefile @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/ipset +# Description: Test if ipset working ok +# Author: Susant Sahani +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +export TEST=/CoreOS/ipset +export TESTVERSION=1.0 +BUILT_FILES= +FILES=$(METADATA) runtest.sh Makefile +.PHONY: all install download clean +run: $(FILES) build + ./runtest.sh +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh +clean: + rm -f *~ $(BUILT_FILES) +include /usr/share/rhts/lib/rhts-make.include +$(METADATA): Makefile + @echo "Owner: Susant Sahani" > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test ipset sanity" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: ipset " >> $(METADATA) + @echo "Requires: ipset iperf3 python3 systemd python3-pyroute2 iptables" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -Fedora 29" >> $(METADATA) + rhts-lint $(METADATA) diff --git a/tests/sanity-tests/iperf3d.service b/tests/sanity-tests/iperf3d.service new file mode 100644 index 0000000..179f317 --- /dev/null +++ b/tests/sanity-tests/iperf3d.service @@ -0,0 +1,10 @@ +[Unit] +Description=iperf3d tests for ipset +After=multi-user.target network.target + +[Service] +Type=simple +ExecStart=/usr/bin/iperf3 -s -d --bind 192.168.225.32 --port 55555 -V + +[Install] +WantedBy=multi-user.target diff --git a/tests/sanity-tests/ipset-tests.py b/tests/sanity-tests/ipset-tests.py new file mode 100755 index 0000000..9eccd06 --- /dev/null +++ b/tests/sanity-tests/ipset-tests.py @@ -0,0 +1,228 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# Description: Tests for ipset +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +import errno +import os +import sys +import time +import unittest +import subprocess +import signal +import shutil +import socket +from pyroute2 import IPRoute + +def setUpModule(): + + if shutil.which('ipset') is None: + raise OSError(errno.ENOENT, 'ipset not found') + + if shutil.which('iperf3') is None: + raise OSError(errno.ENOENT, 'iperf3 not found') + +def tearDownModule(): + pass + +class GenericUtilities(): + + def SetupVethInterface(self): + + ip = IPRoute() + + ip.link('add', ifname='veth-test', peer='veth-peer', kind='veth') + idx_veth_test = ip.link_lookup(ifname='veth-test')[0] + idx_veth_peer = ip.link_lookup(ifname='veth-peer')[0] + + ip.link('set', index=idx_veth_test, address='02:01:02:03:04:08') + ip.link('set', index=idx_veth_peer, address='02:01:02:03:04:09') + + ip.addr('add', index=idx_veth_test, address='192.168.225.32', mask=24) + ip.addr('add', index=idx_veth_peer, address='192.168.225.33', mask=24) + + ip.link('set', index=idx_veth_test, state='up') + ip.link('set', index=idx_veth_peer, state='up') + + ip.close() + + def TearDownVethInterface(self): + + ip = IPRoute() + ip.link('del', index=ip.link_lookup(ifname='veth-test')[0]) + ip.close() + + def AddAddress(self, interface, address): + ip = IPRoute() + + idx_veth_peer = ip.link_lookup(ifname=interface)[0] + ip.close() + + def IPSetAdd(self, hashset, address): + subprocess.check_output(['ipset', 'add', hashset, address]) + + def IPSetRemove(self, hashset, address): + subprocess.check_output(['ipset', 'del', hashset, address]) + + def IPSetCreateHashSet(self, hashset, hashtype): + subprocess.check_output(['ipset', 'create', hashset, hashtype]) + + def IPSetDestroyHashSet(self, hashset): + subprocess.check_output(['ipset', 'destroy', hashset]) + +class IpsetTests(unittest.TestCase, GenericUtilities): + + def setUp(self): + self.SetupVethInterface() + + def tearDown(self): + self.TearDownVethInterface() + + def test_ipset_bitmap_ip_netfilter(self): + + self.IPSetCreateHashSet('testnetiperf', 'hash:ip') + + self.IPSetAdd('testnetiperf', '192.168.225.32') + self.IPSetAdd('testnetiperf', '192.168.225.33') + + subprocess.check_output(['ipset', 'test','testnetiperf','192.168.225.32']) + subprocess.check_output(['ipset', 'test','testnetiperf','192.168.225.33']) + + subprocess.check_output(['systemctl', 'start', 'iperf3d.service']) + time.sleep(5) + + r = subprocess.call("iperf3" + " -c 192.168.225.32 -p 55555 --connect-timeout 5", shell=True) + self.assertEqual(r, 0) + + r = subprocess.call("iptables" + " -I INPUT -m set --match-set testnetiperf src -j DROP", shell=True) + self.assertEqual(r, 0) + + r = subprocess.call("iperf3" + " -c 192.168.225.32 -p 55555 --connect-timeout 5", shell=True) + self.assertNotEqual(r, 0) + + subprocess.check_output(['systemctl', 'stop', 'iperf3d.service']) + + subprocess.call("iptables" + " --delete INPUT -m set --match-set testnetiperf src -j DROP" , shell=True) + + self.IPSetDestroyHashSet('testnetiperf') + + def test_ipset_add_bitmap_ip(self): + + self.IPSetCreateHashSet('testnet', 'hash:ip') + + self.IPSetAdd('testnet', '192.168.11.12') + self.IPSetAdd('testnet', '192.168.11.13') + self.IPSetAdd('testnet', '192.168.11.14') + self.IPSetAdd('testnet', '192.168.11.15') + + subprocess.check_output(['ipset', 'test','testnet','192.168.11.12']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.13']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.14']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.15']) + + self.IPSetDestroyHashSet('testnet') + + def test_ipset_delete_bitmap_ip(self): + + self.IPSetCreateHashSet('testnet', 'hash:ip') + + self.IPSetAdd('testnet', '192.168.11.12') + self.IPSetAdd('testnet', '192.168.11.13') + + subprocess.check_output(['ipset', 'test','testnet','192.168.11.12']) + subprocess.check_output(['ipset', 'test','testnet','192.168.11.13']) + + self.IPSetRemove('testnet', '192.168.11.12') + + r = subprocess.call("ipset" + " test testnet 192.168.11.12", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testnet') + + def test_ipset_hash_bitmap_mac(self): + + self.IPSetCreateHashSet('testmac', 'hash:mac') + + self.IPSetAdd('testmac', '02:01:02:03:04:09') + + subprocess.check_output(['ipset', 'test','testmac','02:01:02:03:04:09']) + + self.IPSetRemove('testmac', '02:01:02:03:04:09') + + r = subprocess.call("ipset" + " test testmac 02:01:02:03:04:09", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testmac') + + def test_ipset_hash_bitmap_ipport(self): + + self.IPSetCreateHashSet('testipport', 'hash:ip,mac') + + self.IPSetAdd('testipport', '1.1.1.1,02:01:02:03:04:09') + + subprocess.check_output(['ipset', 'test','testipport','1.1.1.1,02:01:02:03:04:09']) + + self.IPSetRemove('testipport', '1.1.1.1,02:01:02:03:04:09') + + r = subprocess.call("ipset" + " test testipport 1.1.1.1,02:01:02:03:04:09", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testipport') + + def test_ipset_hash_bitmap_ipport(self): + + self.IPSetCreateHashSet('testipport', 'hash:ip,port') + + self.IPSetAdd('testipport', '192.168.1.1,udp:53') + self.IPSetAdd('testipport', '192.168.1.1,5555') + + subprocess.check_output(['ipset', 'test','testipport','192.168.1.1,udp:53']) + subprocess.check_output(['ipset', 'test','testipport','192.168.1.1,5555']) + + self.IPSetRemove('testipport', '192.168.1.1,5555') + + r = subprocess.call("ipset" + " test testipport 192.168.1.1,5555", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testipport') + + def test_ipset_hash_bitmap_ipportip(self): + + self.IPSetCreateHashSet('testipportip', 'hash:ip,port,ip') + + self.IPSetAdd('testipportip', '192.168.1.1,80,10.0.0.1') + self.IPSetAdd('testipportip', '192.168.1.2,80,10.0.0.2') + + subprocess.check_output(['ipset', 'test','testipportip','192.168.1.1,80,10.0.0.1']) + subprocess.check_output(['ipset', 'test','testipportip','192.168.1.1,80,10.0.0.1']) + + self.IPSetRemove('testipportip', '192.168.1.1,80,10.0.0.1') + + r = subprocess.call("ipset" + " test testipportip 192.168.1.1,80,10.0.0.1", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testipportip') + + def test_ipset_hash_bitmap_netiface(self): + + self.IPSetCreateHashSet('testnetiface', 'hash:net,iface') + + self.IPSetAdd('testnetiface', '192.168.0/24,veth-test') + self.IPSetAdd('testnetiface', '192.167.0/24,veth-peer') + + subprocess.check_output(['ipset', 'test','testnetiface','192.168.0/24,veth-test']) + subprocess.check_output(['ipset', 'test','testnetiface','192.167.0/24,veth-peer']) + + self.IPSetRemove('testnetiface', '192.168.0/24,veth-test') + + r = subprocess.call("ipset" + " test testnetiface 192.168.0/24,veth-test", shell=True) + self.assertEqual(r, 1) + + self.IPSetDestroyHashSet('testnetiface') + +if __name__ == '__main__': + unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, verbosity=3)) diff --git a/tests/sanity-tests/runtest.sh b/tests/sanity-tests/runtest.sh new file mode 100755 index 0000000..78f525d --- /dev/null +++ b/tests/sanity-tests/runtest.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# runtest.sh of ipset +# Description: ipset tests. +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="ipset" + +SERVICE_UNITDIR="/var/run/systemd/system" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "systemctl stop firewalld" 0,5 + rlRun "setenforce 0" 0,1 + + rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1 + + rlRun "cp iperf3d.service $SERVICE_UNITDIR" + rlRun "cp ipset-tests.py /usr/bin/" + + rlRun "systemctl daemon-reload" + rlPhaseEnd + + rlPhaseStartTest + rlLog "Starting ipset tests ..." + rlRun "/usr/bin/python3 /usr/bin/ipset-tests.py" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm /usr/bin/ipset-tests.py" + rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1 + + rlRun "rm $SERVICE_UNITDIR/iperf3d.service" + rlRun "systemctl daemon-reload" + + rlRun "setenforce 1" 0,1 + rlLog "ipset tests done" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + +rlGetTestState diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..17d20d6 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,15 @@ +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - sanity-tests + required_packages: + - ipset + - iptables + - python3 + - systemd + - iproute + - iperf3 + - python3-pyroute2