RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/ipset#c937e6ad0a272b39d0535b69057ba5d9eac9441d
2020-10-15 13:43:51 +02:00 · 2020-10-15 13:43:51 +02:00 · f1cb09a2d3
commit f1cb09a2d3
parent ce12015f7c
11 changed files with 886 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
+ipset-*.tar.bz2
--- a/0001-build-do-install-libipset-args.h.patch
+++ b/0001-build-do-install-libipset-args.h.patch
@ -0,0 +1,28 @@
+From 39fde1381f0ba9101f65c08f2abda5426a46f8b1 Mon Sep 17 00:00:00 2001
+From: Jan Engelhardt <jengelh@inai.de>
+Date: Mon, 22 Jan 2018 22:50:33 +0100
+Subject: [PATCH] build: do install libipset/args.h
+
+libipset/types.h includes args.h, therefore args.h must be installed
+too.
+
+Signed-off-by: Jan Engelhardt <jengelh@inai.de>
+Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+---
+ include/libipset/Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/include/libipset/Makefile.am b/include/libipset/Makefile.am
+index 3b47518..79a1357 100644
+--- a/include/libipset/Makefile.am
+++ b/include/libipset/Makefile.am
+@@ -1,5 +1,6 @@
+ pkgincludedir = ${includedir}/libipset
+ pkginclude_HEADERS = \
+	args.h \
+ 	data.h \
+ 	errcode.h \
+ 	linux_ip_set_bitmap.h \
+-- 
+2.11.0
+
--- a/ipset.service
+++ b/ipset.service
@ -0,0 +1,18 @@
+[Unit]
+Description=IP sets for iptables
+Before=iptables.service
+Before=ip6tables.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/ipset/ipset.start-stop start
+ExecStop=/usr/libexec/ipset/ipset.start-stop stop
+ExecReload=/usr/libexec/ipset/ipset.start-stop reload
+# Save current ipset entries on stop/restart.
+#   Value: yes|no,  default: no
+# Saves all ipsets to /etc/ipset/ipset if ipset gets stopped
+Environment=IPSET_SAVE_ON_STOP=no IPSET_SAVE_ON_RESTART=no
+
+[Install]
+WantedBy=basic.target
--- a/ipset.spec
+++ b/ipset.spec
@ -0,0 +1,290 @@
+Name:             ipset
+Version:          7.6
+Release:          2%{?dist}
+Summary:          Manage Linux IP sets
+
+License:          GPLv2
+URL:              http://ipset.netfilter.org/
+Source0:          %{url}/%{name}-%{version}.tar.bz2
+Source1:          %{name}.service
+Source2:          %{name}.start-stop
+
+BuildRequires:    libmnl-devel
+BuildRequires:    automake
+BuildRequires:    autoconf
+BuildRequires:    libtool
+BuildRequires:    libtool-ltdl-devel
+
+# An explicit requirement is needed here, to avoid cases where a user would
+# explicitly update only one of the two (e.g 'yum update ipset')
+Requires:         %{name}-libs%{?_isa} = %{version}-%{release}
+
+%description
+IP sets are a framework inside the Linux kernel since version 2.4.x, which can
+be administered by the ipset utility. Depending on the type, currently an IP
+set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC
+addresses in a way, which ensures lightning speed when matching an entry
+against a set.
+
+If you want to:
+ - store multiple IP addresses or port numbers and match against the collection
+   by iptables at one swoop;
+ - dynamically update iptables rules against IP addresses or ports without
+   performance penalty;
+ - express complex IP address and ports based rulesets with one single iptables
+   rule and benefit from the speed of IP sets
+then ipset may be the proper tool for you.
+
+
+%package libs
+Summary:       Shared library providing the IP sets functionality
+
+%description libs
+This package contains the libraries which provide the IP sets funcionality.
+
+
+%package devel
+Summary:       Development files for %{name}
+Requires:      %{name}-libs%{?_isa} == %{version}-%{release}
+Requires:      kernel-headers
+
+%description devel
+This package contains the files required to develop software using the %{name}
+libraries.
+
+
+%package service
+Summary:          %{name} service for %{name}s
+Requires:         %{name} = %{version}-%{release}
+BuildRequires:    systemd
+Requires:         iptables-services
+Requires(post):   systemd
+Requires(preun):  systemd
+Requires(postun): systemd
+BuildArch:        noarch
+
+%description service
+This package provides the service %{name} that is split
+out of the base package since it is not active by default.
+
+
+%prep
+%autosetup -p1
+
+
+%build
+./autogen.sh
+%configure --enable-static=no --with-kmod=no
+
+# Just to make absolutely sure we are not building the bundled kernel module
+# I have to do it after the configure run unfortunately
+rm -fr kernel
+
+# Prevent libtool from defining rpath
+sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+
+%make_build
+
+
+%install
+%make_install
+find %{buildroot} -name '*.la' -exec rm -f '{}' \;
+
+# install systemd unit file
+install -d -m 755 %{buildroot}/%{_unitdir}
+install -c -m 644 %{SOURCE1} %{buildroot}/%{_unitdir}
+
+# install supporting script
+install -d -m 755 %{buildroot}%{_libexecdir}/%{name}
+install -c -m 755 %{SOURCE2} %{buildroot}%{_libexecdir}/%{name}
+
+# Create directory for configuration
+mkdir -p %{buildroot}%{_sysconfdir}/%{name}
+
+
+%preun
+if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
+    rmmod xt_set 2>/dev/null
+    [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && exit 1
+fi
+
+
+%ldconfig_scriptlets libs
+
+
+%post service
+%systemd_post %{name}.service
+
+%preun service
+if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
+    rmmod xt_set 2>/dev/null
+    [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && exit 1
+fi
+%systemd_preun %{name}.service
+
+%postun service
+%systemd_postun_with_restart %{name}.service
+
+
+%files
+%doc ChangeLog
+%license COPYING
+%{_mandir}/man8/%{name}.8.*
+%{_sbindir}/%{name}
+
+%files libs
+%license COPYING
+%{_libdir}/lib%{name}.so.13*
+
+%files devel
+%{_includedir}/lib%{name}
+%{_libdir}/lib%{name}.so
+%{_libdir}/pkgconfig/lib%{name}.pc
+%{_mandir}/man3/libipset.3.*
+
+%files service
+%{_unitdir}/%{name}.service
+%dir %{_libexecdir}/%{name}
+%attr(0755,root,root) %{_libexecdir}/%{name}/%{name}.start-stop
+%dir %{_sysconfdir}/%{name}
+
+
+%changelog
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Feb 24 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.6-1
+- Update to 7.6
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Jan 10 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.5-1
+- Update to 7.5
+
+* Mon Nov 04 2019 Eric Garver <eric@garver.life> - 7.4-1
+- Update to 7.4
+
+* Mon Aug 19 2019 Nicolas Chauvet <kwizart@gmail.com> - 7.3-1
+- Update to 7.3
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jul 11 2019 Nicolas Chauvet <kwizart@gmail.com> - 7.2-1
+- Update to 7.2
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.38-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Aug 13 2018 Nicolas Chauvet <kwizart@gmail.com> - 6.38-1
+- Update to 6.38
+- Clean-up spec
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.35-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Feb 12 2018 Eric Garver <egarver@redhat.com> - 6.35-3
+- Patch for missing header file (RHBZ#1543596)
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.35-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Mon Jan 08 2018 Nicolas Chauvet <kwizart@gmail.com> - 6.35-1
+- Update to 6.35
+
+* Mon Jul 31 2017 Nicolas Chauvet <kwizart@gmail.com> - 6.32-1
+- Update to 6.32
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 6.29-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Apr 07 2017 Nicolas Chauvet <kwizart@gmail.com> - 6.29-3
+- Userspace needs kernel-headers - rhbz#1420864
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 6.29-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Mon Apr 18 2016 Thomas Woerner <twoerner@redhat.com> - 6.29-1
+- New upstream version 6.29 (RHBZ#1317208)
+  - Suppress unnecessary stderr in command loop for resize and list
+  - Correction in comment test
+  - Support chroot buildroots (reported by Jan Engelhardt)
+  - Fix "configure" breakage due to pkg-config related changes
+    (reported by Jan Engelhardt)
+  - Support older pkg-config packages
+  - Add bash completion to the install routine (Mart Frauenlob)
+  - Fix misleading error message with comment extension
+  - Test added to check 0.0.0.0/0,iface to be matched in hash:net,iface type
+  - Fix link with libtool >= 2.4.4 (Olivier Blin)
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 6.27-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Tue Nov 10 2015 Thomas Woerner <twoerner@redhat.com> - 6.27-1
+- New upstream version 6.27 (RHBZ#1145913)
+
+* Sat Oct 10 2015 Haïkel Guémar <hguemar@fedoraproject.org> - 6.26-1
+- Upstream 6.26 (RHBZ#1145913)
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.22-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Thu Sep 18 2014 Mathieu Bridon <bochecha@fedoraproject.org> - 6.22-1
+- New upstream release.
+
+* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.21.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.21.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Tue Mar 11 2014 Mathieu Bridon <bochecha@fedoraproject.org> - 6.21.1-2
+- Remove runtime requirement on the kernel.
+  https://lists.fedoraproject.org/pipermail/devel/2014-March/196565.html
+
+* Tue Oct 29 2013 Mathieu Bridon <bochecha@fedoraproject.org> - 6.20.1-1
+- New upstream release.
+
+* Tue Aug 27 2013 Quentin Armitage <quentin@armitage.org.uk> 6.19-2
+- Add service pkg - adds save and reload functionality on shutdown/startup
+- Add requires dependency of ipset on matching ipset-libs
+
+* Thu Aug 15 2013 Mathieu Bridon <bochecha@fedoraproject.org> - 6.19-1
+- New upstream release.
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.16.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.16.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Wed Sep 26 2012 Mathieu Bridon <bochecha@fedoraproject.org> - 6.16.1-1
+- New upstream release.
+- Fix a requirement.
+
+* Wed Sep 26 2012 Mathieu Bridon <bochecha@fedoraproject.org> - 6.14-1
+- New upstream release.
+- Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one.
+
+* Mon Jul 30 2012 Mathieu Bridon <bochecha@fedoraproject.org> - 6.13-1
+- New upstream release.
+- Split out the library in its own subpackage.
+
+* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.11-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Mon Feb 06 2012 Mathieu Bridon <bochecha@fedoraproject.org> - 6.11-1
+- New upstream release.
+- Removed our patch, it has been integrated upstream. As such, we also don't
+  need to re-run autoreconf any more.
+
+* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.9.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Fri Sep 16 2011 Mathieu Bridon <bochecha@fedoraproject.org> - 6.9.1-2
+- Some fixes based on Pierre-Yves' review feedback.
+
+* Wed Sep 14 2011 Mathieu Bridon <bochecha@fedoraproject.org> - 6.9.1-1
+- Initial packaging.
--- a/ipset.start-stop
+++ b/ipset.start-stop
@ -0,0 +1,209 @@
+#!/bin/bash
+#
+# ipset      Start and stop ipset firewall sets
+#
+# config: /etc/ipset/ipset
+#
+
+IPSET=ipset
+IPSET_BIN=/usr/sbin/${IPSET}
+IPSET_DATA=/etc/${IPSET}/${IPSET}
+
+IPTABLES_CONFIG=/etc/sysconfig/iptables-config
+IP6TABLES_CONFIG=${IPTABLES_CONFIG/iptables/ip6tables}
+
+TMP_FIFO=/tmp/${IPSET}.$$
+
+if [[ ! -x ${IPSET_BIN} ]]; then
+	echo "${IPSET_BIN} does not exist."
+	exit 5
+fi
+
+CLEAN_FILES=TMP_FIFO
+trap "rm -f \$CLEAN_FILES" EXIT
+
+# Default ipset configuration:
+[[ -z $IPSET_SAVE_ON_STOP ]] && IPSET_SAVE_ON_STOP=no		# Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_STOP
+[[ -z $IPSET_SAVE_ON_RESTART ]] && IPSET_SAVE_ON_RESTART=no	# Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_RESTART
+
+# Load iptables configuration(s)
+[[ -f "$IPTABLES_CONFIG" ]] && . "$IPTABLES_CONFIG"
+[[ -f "$IP6TABLES_CONFIG" ]] && . "$IP6TABLES_CONFIG"
+
+# It doesn't make sense to save iptables config and not our config
+[[ ${IPTABLES_SAVE_ON_STOP} = yes || ${IP6TABLES_SAVE_ON_STOP} = yes ]] && IPSET_SAVE_ON_STOP=yes
+[[ ${IPTABLES_SAVE_ON_RESTART} = yes || ${IP6TABLES_SAVE_ON_RESTART} = yes ]] && IPSET_SAVE_ON_RESTART=yes
+
+check_can_unload() {
+    # If the xt_set module is loaded and can't be unloaded, then iptables is
+    # using ipsets, so refuse to stop the service.
+    if [[ -n $(lsmod | grep "^xt_set ") ]]; then
+	rmmod xt_set 2>/dev/null
+	[[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && return 1
+    fi
+
+    return 0
+}
+
+flush_n_delete() {
+    local ret=0 set
+
+    # Flush sets
+    ${IPSET_BIN} flush
+    let ret+=$?
+
+    # Delete ipset sets. If we don't do them individually, then none
+    # will be deleted unless they all can be.
+    for set in $(${IPSET_BIN} list -name); do
+	    ${IPSET_BIN} destroy 2>/dev/null
+	    [[ $? -ne 0 ]] && ret=1
+    done
+
+    return $ret
+}
+
+start_clean()
+{
+    mkfifo -m go= "${TMP_FIFO}"
+    [[ $? -ne 0 ]] && return 1
+
+    # Get the lists of sets in current(old) config and new config
+    old_sets="$(${IPSET_BIN} list -name | sort -u)"
+    new_sets="$(grep ^create "${IPSET_DATA}" | cut -d " " -f 2 | sort -u)"
+
+    # List of sets no longer wanted
+    drop_sets="$( printf "%s\n" "${old_sets}" > "${TMP_FIFO}"  &
+		  printf "%s\n" "${new_sets}" | comm -23 "${TMP_FIFO}" -
+		)"
+
+    # Get rid of sets no longer needed
+    # Unfortunately -! doesn't work for destroy, so we have to do it a command at a time
+    for dset in $drop_sets; do
+	ipset destroy $dset 2>/dev/null
+	# If it won't go - ? in use by iptables, just clear it
+	[[ $? -ne 0 ]] && ipset flush $dset
+    done
+
+    # Now delete the set members no longer required
+    ${IPSET_BIN} save | grep "^add " | sort >${TMP_FIFO} &
+      grep "^add " ${IPSET_DATA} | sort | comm -23 ${TMP_FIFO} - | sed -e "s/^add /del /" \
+      | ${IPSET_BIN} restore -!
+
+    # At last we can add the set members we haven't got
+    ipset restore -! <${IPSET_DATA}
+
+    rm ${TMP_FIFO}
+
+    return 0
+}
+
+start() {
+    # Do not start if there is no config file.
+    [[ ! -f "$IPSET_DATA" ]] && echo "Loaded with no configuration" && return 0
+
+    # We can skip the first bit and do a simple load if
+    # there is no current ipset configuration
+    res=1
+    if [[ -n $(${IPSET_BIN} list -name) ]]; then
+	# The following may fail for some bizarre reason
+	start_clean
+	res=$?
+
+	[[ $res -ne 0 ]] && echo "Some old configuration may remain"
+    fi
+
+    # res -ne 0 => either start_clean failed, or we didn't need to run it
+    if [[ $res -ne 0 ]]; then
+	# This is the easy way to start but would leave any old
+	# entries still configured. Still, better than nothing -
+	# but fine if we had no config
+	${IPSET_BIN} restore -! <${IPSET_DATA}
+	res=$?
+    fi
+
+    if [[ $res -ne 0 ]]; then
+	return 1
+    fi
+
+    return 0
+}
+
+stop() {
+    # Nothing to stop if ip_set module is not loaded.
+    lsmod | grep -q "^ip_set "
+    [[ $? -ne 0 ]] && return 6
+
+    flush_n_delete
+    [[ $? -ne 0 ]] && echo Warning: Not all sets were flushed/deleted
+
+    return 0
+}
+
+save() {
+    # Do not save if ip_set module is not loaded.
+    lsmod | grep -q "^ip_set "
+    [[ $? -ne 0 ]] && return 6
+
+    [[ -z $(${IPSET_BIN} list -name) ]] && return 0
+
+    ret=0
+    TMP_FILE=$(/bin/mktemp -q /tmp/$IPSET.XXXXXX) \
+	&& CLEAN_FILES+=" $TMP_FILE" \
+	&& chmod 600 "$TMP_FILE" \
+	&& ${IPSET_BIN} save > $TMP_FILE 2>/dev/null \
+	&& [[ -s $TMP_FILE ]] \
+	|| ret=1
+
+    if [[ $ret -eq 0 ]]; then
+	# No need to do anything if the files are the same
+	if [[ ! -f $IPSET_DATA ]]; then
+	    mv $TMP_FILE $IPSET_DATA && chmod 600 $IPSET_DATA || ret=1
+	else
+	    diff -q $TMP_FILE $IPSET_DATA >/dev/null
+	
+	    if [[ $? -ne 0 ]]; then
+		if [[ -f $IPSET_DATA ]]; then
+		    cp -f --preserve=timestamps $IPSET_DATA $IPSET_DATA.save \
+			&& chmod 600 $IPSET_DATA.save \
+			|| ret=1
+		fi
+		if [[ $ret -eq 0 ]]; then
+		    cp -f --preserve=timestamps $TMP_FILE $IPSET_DATA \
+			&& chmod 600 $IPSET_DATA \
+			|| ret=1
+		fi
+	    fi
+	fi
+    fi
+
+    rm -f $TMP_FILE
+    return $ret
+}
+
+
+case "$1" in
+    start)
+	start
+	RETVAL=$?
+	;;
+    stop)
+	check_can_unload || exit 1
+	[[ $IPSET_SAVE_ON_STOP = yes ]] && save
+	stop
+	RETVAL=$?
+	[[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0
+	;;
+    reload)
+	[[ $IPSET_SAVE_ON_RESTART = yes ]] && save
+	stop
+	RETVAL=$?
+	[[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0
+	start
+	RETVAL=$?
+	;;
+    *)
+	echo "Usage: $IPSET {start|stop|reload}" >&2
+	exit 1
+esac
+
+exit $RETVAL
--- a/1
+++ b/1
@ -0,0 +1 @@
+SHA512 (ipset-7.6.tar.bz2) = c4d9c65895335dec8f855fca6c940d2ee19e7b8d2292325778a1608e795e2e35caa787cbcdeb8e2877f3695c641ac348b23ac43f73bdc1a8242e8d04f4944084
--- a/tests/sanity-tests/Makefile
+++ b/tests/sanity-tests/Makefile
@ -0,0 +1,36 @@
+# SPDX-License-Identifier: LGPL-2.1+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/ipset
+#   Description: Test if ipset working ok
+#   Author: Susant Sahani<susant@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+export TEST=/CoreOS/ipset
+export TESTVERSION=1.0
+BUILT_FILES=
+FILES=$(METADATA) runtest.sh Makefile
+.PHONY: all install download clean
+run: $(FILES) build
+	./runtest.sh
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+clean:
+	rm -f *~ $(BUILT_FILES)
+include /usr/share/rhts/lib/rhts-make.include
+$(METADATA): Makefile
+	@echo "Owner:           Susant Sahani<susant@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Test ipset sanity" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          ipset " >> $(METADATA)
+	@echo "Requires:        ipset iperf3 python3 systemd python3-pyroute2 iptables" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -Fedora 29" >> $(METADATA)
+	rhts-lint $(METADATA)
--- a/tests/sanity-tests/iperf3d.service
+++ b/tests/sanity-tests/iperf3d.service
@ -0,0 +1,10 @@
+[Unit]
+Description=iperf3d tests for ipset
+After=multi-user.target network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/iperf3 -s -d --bind 192.168.225.32 --port 55555 -V
+
+[Install]
+WantedBy=multi-user.target
--- a/tests/sanity-tests/ipset-tests.py
+++ b/tests/sanity-tests/ipset-tests.py
@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: LGPL-2.1+
+# ~~~
+#   Description: Tests for ipset
+#
+#   Author: Susant Sahani <susant@redhat.com>
+#   Copyright (c) 2018 Red Hat, Inc.
+# ~~~
+
+import errno
+import os
+import sys
+import time
+import unittest
+import subprocess
+import signal
+import shutil
+import socket
+from pyroute2 import IPRoute
+
+def setUpModule():
+
+    if shutil.which('ipset') is None:
+        raise OSError(errno.ENOENT, 'ipset not found')
+
+    if shutil.which('iperf3') is None:
+        raise OSError(errno.ENOENT, 'iperf3 not found')
+
+def tearDownModule():
+    pass
+
+class GenericUtilities():
+
+    def SetupVethInterface(self):
+
+        ip = IPRoute()
+
+        ip.link('add', ifname='veth-test', peer='veth-peer', kind='veth')
+        idx_veth_test = ip.link_lookup(ifname='veth-test')[0]
+        idx_veth_peer = ip.link_lookup(ifname='veth-peer')[0]
+
+        ip.link('set', index=idx_veth_test, address='02:01:02:03:04:08')
+        ip.link('set', index=idx_veth_peer, address='02:01:02:03:04:09')
+
+        ip.addr('add', index=idx_veth_test, address='192.168.225.32', mask=24)
+        ip.addr('add', index=idx_veth_peer, address='192.168.225.33', mask=24)
+
+        ip.link('set', index=idx_veth_test, state='up')
+        ip.link('set', index=idx_veth_peer, state='up')
+
+        ip.close()
+
+    def TearDownVethInterface(self):
+
+        ip = IPRoute()
+        ip.link('del', index=ip.link_lookup(ifname='veth-test')[0])
+        ip.close()
+
+    def AddAddress(self, interface, address):
+        ip = IPRoute()
+
+        idx_veth_peer = ip.link_lookup(ifname=interface)[0]
+        ip.close()
+
+    def IPSetAdd(self, hashset, address):
+        subprocess.check_output(['ipset', 'add', hashset, address])
+
+    def IPSetRemove(self, hashset, address):
+        subprocess.check_output(['ipset', 'del', hashset, address])
+
+    def IPSetCreateHashSet(self, hashset, hashtype):
+        subprocess.check_output(['ipset', 'create', hashset, hashtype])
+
+    def IPSetDestroyHashSet(self, hashset):
+        subprocess.check_output(['ipset', 'destroy', hashset])
+
+class IpsetTests(unittest.TestCase, GenericUtilities):
+
+    def setUp(self):
+        self.SetupVethInterface()
+
+    def tearDown(self):
+        self.TearDownVethInterface()
+
+    def test_ipset_bitmap_ip_netfilter(self):
+
+        self.IPSetCreateHashSet('testnetiperf', 'hash:ip')
+
+        self.IPSetAdd('testnetiperf', '192.168.225.32')
+        self.IPSetAdd('testnetiperf', '192.168.225.33')
+
+        subprocess.check_output(['ipset', 'test','testnetiperf','192.168.225.32'])
+        subprocess.check_output(['ipset', 'test','testnetiperf','192.168.225.33'])
+
+        subprocess.check_output(['systemctl', 'start', 'iperf3d.service'])
+        time.sleep(5)
+
+        r = subprocess.call("iperf3" + " -c 192.168.225.32 -p 55555 --connect-timeout 5", shell=True)
+        self.assertEqual(r, 0)
+
+        r = subprocess.call("iptables" +  " -I INPUT -m set --match-set testnetiperf src -j DROP", shell=True)
+        self.assertEqual(r, 0)
+
+        r = subprocess.call("iperf3" + " -c 192.168.225.32 -p 55555 --connect-timeout 5", shell=True)
+        self.assertNotEqual(r, 0)
+
+        subprocess.check_output(['systemctl', 'stop', 'iperf3d.service'])
+
+        subprocess.call("iptables" + " --delete INPUT -m set --match-set testnetiperf src -j DROP" , shell=True)
+
+        self.IPSetDestroyHashSet('testnetiperf')
+
+    def test_ipset_add_bitmap_ip(self):
+
+        self.IPSetCreateHashSet('testnet', 'hash:ip')
+
+        self.IPSetAdd('testnet', '192.168.11.12')
+        self.IPSetAdd('testnet', '192.168.11.13')
+        self.IPSetAdd('testnet', '192.168.11.14')
+        self.IPSetAdd('testnet', '192.168.11.15')
+
+        subprocess.check_output(['ipset', 'test','testnet','192.168.11.12'])
+        subprocess.check_output(['ipset', 'test','testnet','192.168.11.13'])
+        subprocess.check_output(['ipset', 'test','testnet','192.168.11.14'])
+        subprocess.check_output(['ipset', 'test','testnet','192.168.11.15'])
+
+        self.IPSetDestroyHashSet('testnet')
+
+    def test_ipset_delete_bitmap_ip(self):
+
+        self.IPSetCreateHashSet('testnet', 'hash:ip')
+
+        self.IPSetAdd('testnet', '192.168.11.12')
+        self.IPSetAdd('testnet', '192.168.11.13')
+
+        subprocess.check_output(['ipset', 'test','testnet','192.168.11.12'])
+        subprocess.check_output(['ipset', 'test','testnet','192.168.11.13'])
+
+        self.IPSetRemove('testnet', '192.168.11.12')
+
+        r = subprocess.call("ipset" + " test testnet 192.168.11.12", shell=True)
+        self.assertEqual(r, 1)
+
+        self.IPSetDestroyHashSet('testnet')
+
+    def test_ipset_hash_bitmap_mac(self):
+
+        self.IPSetCreateHashSet('testmac', 'hash:mac')
+
+        self.IPSetAdd('testmac', '02:01:02:03:04:09')
+
+        subprocess.check_output(['ipset', 'test','testmac','02:01:02:03:04:09'])
+
+        self.IPSetRemove('testmac', '02:01:02:03:04:09')
+
+        r = subprocess.call("ipset" + " test testmac 02:01:02:03:04:09", shell=True)
+        self.assertEqual(r, 1)
+
+        self.IPSetDestroyHashSet('testmac')
+
+    def test_ipset_hash_bitmap_ipport(self):
+
+        self.IPSetCreateHashSet('testipport', 'hash:ip,mac')
+
+        self.IPSetAdd('testipport', '1.1.1.1,02:01:02:03:04:09')
+
+        subprocess.check_output(['ipset', 'test','testipport','1.1.1.1,02:01:02:03:04:09'])
+
+        self.IPSetRemove('testipport', '1.1.1.1,02:01:02:03:04:09')
+
+        r = subprocess.call("ipset" + " test testipport 1.1.1.1,02:01:02:03:04:09", shell=True)
+        self.assertEqual(r, 1)
+
+        self.IPSetDestroyHashSet('testipport')
+
+    def test_ipset_hash_bitmap_ipport(self):
+
+        self.IPSetCreateHashSet('testipport', 'hash:ip,port')
+
+        self.IPSetAdd('testipport', '192.168.1.1,udp:53')
+        self.IPSetAdd('testipport', '192.168.1.1,5555')
+
+        subprocess.check_output(['ipset', 'test','testipport','192.168.1.1,udp:53'])
+        subprocess.check_output(['ipset', 'test','testipport','192.168.1.1,5555'])
+
+        self.IPSetRemove('testipport', '192.168.1.1,5555')
+
+        r = subprocess.call("ipset" + " test testipport 192.168.1.1,5555", shell=True)
+        self.assertEqual(r, 1)
+
+        self.IPSetDestroyHashSet('testipport')
+
+    def test_ipset_hash_bitmap_ipportip(self):
+
+        self.IPSetCreateHashSet('testipportip', 'hash:ip,port,ip')
+
+        self.IPSetAdd('testipportip', '192.168.1.1,80,10.0.0.1')
+        self.IPSetAdd('testipportip', '192.168.1.2,80,10.0.0.2')
+
+        subprocess.check_output(['ipset', 'test','testipportip','192.168.1.1,80,10.0.0.1'])
+        subprocess.check_output(['ipset', 'test','testipportip','192.168.1.1,80,10.0.0.1'])
+
+        self.IPSetRemove('testipportip', '192.168.1.1,80,10.0.0.1')
+
+        r = subprocess.call("ipset" + " test testipportip 192.168.1.1,80,10.0.0.1", shell=True)
+        self.assertEqual(r, 1)
+
+        self.IPSetDestroyHashSet('testipportip')
+
+    def test_ipset_hash_bitmap_netiface(self):
+
+        self.IPSetCreateHashSet('testnetiface', 'hash:net,iface')
+
+        self.IPSetAdd('testnetiface', '192.168.0/24,veth-test')
+        self.IPSetAdd('testnetiface', '192.167.0/24,veth-peer')
+
+        subprocess.check_output(['ipset', 'test','testnetiface','192.168.0/24,veth-test'])
+        subprocess.check_output(['ipset', 'test','testnetiface','192.167.0/24,veth-peer'])
+
+        self.IPSetRemove('testnetiface', '192.168.0/24,veth-test')
+
+        r = subprocess.call("ipset" + " test testnetiface 192.168.0/24,veth-test", shell=True)
+        self.assertEqual(r, 1)
+
+        self.IPSetDestroyHashSet('testnetiface')
+
+if __name__ == '__main__':
+        unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, verbosity=3))
--- a/tests/sanity-tests/runtest.sh
+++ b/tests/sanity-tests/runtest.sh
@ -0,0 +1,50 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1+
+# ~~~
+#   runtest.sh of ipset
+#   Description: ipset tests.
+#
+#   Author: Susant Sahani <susant@redhat.com>
+#   Copyright (c) 2018 Red Hat, Inc.
+# ~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="ipset"
+
+SERVICE_UNITDIR="/var/run/systemd/system"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "systemctl stop firewalld" 0,5
+        rlRun "setenforce 0" 0,1
+
+        rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1
+
+        rlRun "cp iperf3d.service $SERVICE_UNITDIR"
+        rlRun "cp ipset-tests.py /usr/bin/"
+
+        rlRun "systemctl daemon-reload"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlLog "Starting ipset tests ..."
+        rlRun "/usr/bin/python3 /usr/bin/ipset-tests.py"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm /usr/bin/ipset-tests.py"
+        rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1
+
+        rlRun "rm $SERVICE_UNITDIR/iperf3d.service"
+        rlRun "systemctl daemon-reload"
+
+        rlRun "setenforce 1" 0,1
+        rlLog "ipset tests done"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
+rlGetTestState
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -0,0 +1,15 @@
+- hosts: localhost
+  roles:
+    - role: standard-test-beakerlib
+      tags:
+        - classic
+      tests:
+        - sanity-tests
+      required_packages:
+        - ipset
+        - iptables
+        - python3
+        - systemd
+        - iproute
+        - iperf3
+        - python3-pyroute2
				`@ -0,0 +1 @@`
				`SHA512 (ipset-7.6.tar.bz2) = c4d9c65895335dec8f855fca6c940d2ee19e7b8d2292325778a1608e795e2e35caa787cbcdeb8e2877f3695c641ac348b23ac43f73bdc1a8242e8d04f4944084`