10 changed files with 78 additions and 661 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,2 @@
-ipset-7.22.tar.bz2
+SOURCES/ipset-7.1.tar.bz2
+/ipset-7.1.tar.bz2
--- a/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch
+++ b/0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch
@ -1,23 +0,0 @@
-From 21080dc79c4e9244149aa78f6a8f7fbb6f4b8e81 Mon Sep 17 00:00:00 2001
-From: Jozsef Kadlecsik <kadlec@netfilter.org>
-Date: Thu, 6 Jun 2024 08:57:11 +0200
-Subject: [PATCH] Replace BUG_ON() with WARN_ON_ONCE() according to usage
- policy.
-
---
- kernel/net/netfilter/ipset/ip_set_list_set.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/kernel/net/netfilter/ipset/ip_set_list_set.c b/kernel/net/netfilter/ipset/ip_set_list_set.c
-index fd78e2db06e4f..0d3e5a7331f26 100644
--- a/kernel/net/netfilter/ipset/ip_set_list_set.c
-+++ b/kernel/net/netfilter/ipset/ip_set_list_set.c
-@@ -432,7 +432,7 @@ list_set_destroy(struct ip_set *set)
- {
- 	struct list_set *map = set->data;
- 
-	BUG_ON(!list_empty(&map->members));
-+	WARN_ON_ONCE(!list_empty(&map->members));
- 	kfree(map);
- 
- 	set->data = NULL;
--- a/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch
+++ b/0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch
@ -1,54 +0,0 @@
-From f1bcacf5eeb8620ea684524e1ce9c3951a77f1f9 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 27 Jun 2024 10:18:16 +0200
-Subject: [PATCH] lib: data: Fix for global-buffer-overflow warning by ASAN
-
-After compiling with CFLAGS="-fsanitize=address -g", running the
-testsuite triggers the following warning:
-
-| ipmap: Range: Check syntax error: missing range/from-to: FAILED
-| Failed test: ../src/ipset 2>.foo.err -N test ipmap
-| =================================================================
-| ==4204==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a21e77172a at pc 0x7f1ef246f2a6 bp 0x7fffed8f4f40 sp 0x7fffed8f46e8
-| READ of size 32 at 0x55a21e77172a thread T0
-|     #0 0x7f1ef246f2a5 in __interceptor_memcpy /var/tmp/portage/sys-devel/gcc-13.2.1_p20231014/work/gcc-13-20231014/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:899
-|     #1 0x55a21e758bf6 in ipset_strlcpy /home/n0-1/git/ipset/lib/data.c:119
-|     #2 0x55a21e758bf6 in ipset_data_set /home/n0-1/git/ipset/lib/data.c:349
-|     #3 0x55a21e75ee2f in ipset_parse_typename /home/n0-1/git/ipset/lib/parse.c:1819
-|     #4 0x55a21e754119 in ipset_parser /home/n0-1/git/ipset/lib/ipset.c:1205
-|     #5 0x55a21e752cef in ipset_parse_argv /home/n0-1/git/ipset/lib/ipset.c:1344
-|     #6 0x55a21e74ea45 in main /home/n0-1/git/ipset/src/ipset.c:38
-|     #7 0x7f1ef224cf09  (/lib64/libc.so.6+0x23f09)
-|     #8 0x7f1ef224cfc4 in __libc_start_main (/lib64/libc.so.6+0x23fc4)
-|     #9 0x55a21e74f040 in _start (/home/n0-1/git/ipset/src/ipset+0x1d040)
-|
-| 0x55a21e77172a is located 54 bytes before global variable '*.LC1' defined in 'ipset_bitmap_ip.c' (0x55a21e771760) of size 19
-|   '*.LC1' is ascii string 'IP|IP/CIDR|FROM-TO'
-| 0x55a21e77172a is located 0 bytes after global variable '*.LC0' defined in 'ipset_bitmap_ip.c' (0x55a21e771720) of size 10
-|   '*.LC0' is ascii string 'bitmap:ip'
-
-Fix this by avoiding 'src' array overstep in ipset_strlcpy(): In
-contrast to strncpy(), memcpy() does not respect NUL-chars in input but
-stubbornly reads as many bytes as specified.
-
-Fixes: a7432ba786ca4 ("Workaround misleading -Wstringop-truncation warning")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
- lib/data.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/lib/data.c b/lib/data.c
-index c05b20144cdad..64cad7a377302 100644
--- a/lib/data.c
-+++ b/lib/data.c
-@@ -111,6 +111,9 @@ ipset_strlcpy(char *dst, const char *src, size_t len)
- 	assert(dst);
- 	assert(src);
- 
-+	if (strlen(src) < len)
-+		len = strlen(src) + 1;
-+
- 	memcpy(dst, src, len);
- 	dst[len - 1] = '\0';
- }
--- a/0003-lib-ipset-Avoid-argv-array-overstepping.patch
+++ b/0003-lib-ipset-Avoid-argv-array-overstepping.patch
@ -1,38 +0,0 @@
-From 851cb04ffee5040f1e0063f77c3fe9bc6245e0fb Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 27 Jun 2024 10:18:17 +0200
-Subject: [PATCH] lib: ipset: Avoid 'argv' array overstepping
-
-The maximum accepted value for 'argc' is MAX_ARGS which matches 'argv'
-array size. The maximum allowed array index is therefore argc-1.
-
-This fix will leave items in argv non-NULL-terminated, so explicitly
-NULL the formerly last entry after shifting.
-
-Looks like a day-1 bug. Interestingly, this neither triggered ASAN nor
-valgrind. Yet adding debug output printing argv entries being copied
-did.
-
-Fixes: 1e6e8bd9a62aa ("Third stage to ipset-5")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
- lib/ipset.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/lib/ipset.c b/lib/ipset.c
-index c910d88805c28..3bf1c5fcdbc59 100644
--- a/lib/ipset.c
-+++ b/lib/ipset.c
-@@ -343,9 +343,9 @@ ipset_shift_argv(int *argc, char *argv[], int from)
- 
- 	assert(*argc >= from + 1);
- 
-	for (i = from + 1; i <= *argc; i++)
-+	for (i = from + 1; i < *argc; i++)
- 		argv[i-1] = argv[i];
-	(*argc)--;
-+	argv[--(*argc)] = NULL;
- 	return;
- }
- 
--- a/0004-tests-Reduce-testsuite-run-time.patch
+++ b/0004-tests-Reduce-testsuite-run-time.patch
@ -1,354 +0,0 @@
-From 5c9ef9016d2781f6e07a544e34ec9f4a8d65d0e2 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 27 Jun 2024 10:18:18 +0200
-Subject: [PATCH] tests: Reduce testsuite run-time
-
-Where acceptable, batch add set element calls to avoid overhead of
-excessive 'ipset' program spawns. On my (slow) testing VM, this patch
-reduces a full run of tests/runtest.sh from ~70min down to ~11min.
-
-This might eliminate the situation being tested: resize.sh might be such
-a case so batch only 255 'ipset add' calls and continue to repeat these
-batched calls 32 times in hopes that it still qualifies as the resizing
-stress test tests/hash:ip.t calls it.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
- tests/resize.sh         |  4 ++--
- tests/resizec.sh        | 32 +++++++++++++--------------
- tests/resizen.sh        | 49 ++++++++++++++++++++---------------------
- tests/resizet.sh        | 40 ++++++++++++++++-----------------
- tests/setlist_resize.sh |  4 ++--
- 5 files changed, 64 insertions(+), 65 deletions(-)
-
-diff --git a/tests/resize.sh b/tests/resize.sh
-index 19b93fb01876c..9069b4970e92d 100755
--- a/tests/resize.sh
-+++ b/tests/resize.sh
-@@ -9,6 +9,6 @@ set -e
- $ipset n resize-test hash:ip hashsize 64
- for x in `seq 1 32`; do
-    for y in `seq 1 255`; do
-      $ipset a resize-test 192.168.$x.$y
-   done
-+      echo "a resize-test 192.168.$x.$y"
-+   done | $ipset restore
- done
-diff --git a/tests/resizec.sh b/tests/resizec.sh
-index 28d674769f76f..781acf74c38dd 100755
--- a/tests/resizec.sh
-+++ b/tests/resizec.sh
-@@ -25,65 +25,65 @@ case "$2" in
-     	$ipset n test hash:ip $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y comment "text $ip$x$sep$y"
-+    	    	echo "a test $ip$x$sep$y comment \"text $ip$x$sep$y\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipport)
-     	$ipset n test hash:ip,port $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023 "text $ip$x$sep$y,1023"
-+    	    	echo "a test $ip$x$sep$y,1023 \"text $ip$x$sep$y,1023\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipportip)
-     	$ipset n test hash:ip,port,ip $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023,$ip2 comment "text $ip$x$sep$y,1023,$ip2"
-+    	    	echo "a test $ip$x$sep$y,1023,$ip2 comment \"text $ip$x$sep$y,1023,$ip2\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipportnet)
-     	$ipset n test hash:ip,port,net $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023,$ip2/$net comment "text $ip$x$sep$y,1023,$ip2/$net"
-+    	    	echo "a test $ip$x$sep$y,1023,$ip2/$net comment \"text $ip$x$sep$y,1023,$ip2/$net\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     net)
-     	$ipset n test hash:net $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net comment "text $ip$x$sep$y/$net"
-+    	    	echo "a test $ip$x$sep$y/$net comment \"text $ip$x$sep$y/$net\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     netnet)
- 	$ipset n test hash:net,net $1 hashsize 64 comment
- 	for x in `seq 0 16`; do
- 	    for y in `seq 0 255`; do
-		$ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment "text $ip$x$sep$y/$net,$ip$y$sep$x/$net"
-+		echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment \"text $ip$x$sep$y/$net,$ip$y$sep$x/$net\""
- 	    done
-	done
-+    	done | $ipset restore
- 	;;
-     netport)
-     	$ipset n test hash:net,port $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net,1023 comment "text $ip$x$sep$y/$net,1023"
-+    	    	echo "a test $ip$x$sep$y/$net,1023 comment \"text $ip$x$sep$y/$net,1023\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     netiface)
-     	$ipset n test hash:net,iface $1 hashsize 64 comment
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net,eth0 comment "text $ip$x$sep$y/$net,eth0"
-+    	    	echo "$ipset a test $ip$x$sep$y/$net,eth0 comment \"text $ip$x$sep$y/$net,eth0\""
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
- esac
- $ipset l test | grep ^$ip | while read x y z; do
-diff --git a/tests/resizen.sh b/tests/resizen.sh
-index 9322bd2a2cfce..13221f7b0894a 100755
--- a/tests/resizen.sh
-+++ b/tests/resizen.sh
-@@ -25,80 +25,79 @@ case "$2" in
-     	$ipset n test hash:ip,port,net $1 hashsize 64
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch
-+    	    	echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch"
-     	    done
-    	done
-+    	done | $ipset restore
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null
-+    	    	echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch"
-     	    done
-    	done
-+    	done | $ipset restore 2>/dev/null
-     	;;
-     netportnet)
-     	$ipset n test hash:net,port,net $1 hashsize 64
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch
-+    	    	echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch"
-     	    done
-    	done
-+    	done | $ipset restore
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null
-+    	    	echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch"
-     	    done
-    	done
-+    	done | $ipset restore 2>/dev/null
-     	;;
-     net)
-     	$ipset n test hash:net $1 hashsize 64
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net nomatch
-+    	    	echo "a test $ip$x$sep$y/$net nomatch"
-     	    done
-    	done
-+    	done | $ipset restore
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset t test $ip$x$sep$y/$net nomatch 2>/dev/null
-+    	    	echo "t test $ip$x$sep$y/$net nomatch"
-     	    done
-    	done
-+    	done | $ipset restore 2>/dev/null
-     	;;
-     netnet)
- 	$ipset n test hash:net,net $1 hashsize 64
- 	for x in `seq 0 16`; do
- 	    for y in `seq 0 255`; do
-		$ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch
-+		echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch"
- 	    done
-	done
-+	done | $ipset restore
- 	for x in `seq 0 16`; do
- 	    for y in `seq 0 255`; do
-		$ipset t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch \
-		2>/dev/null
-+		echo "t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch"
- 	    done
-	done
-+	done | $ipset restore 2>/dev/null
- 	;;
-     netport)
-     	$ipset n test hash:net,port $1 hashsize 64
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net,1023 nomatch
-+    	    	echo "a test $ip$x$sep$y/$net,1023 nomatch"
-     	    done
-    	done
-+    	done | $ipset restore
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset t test $ip$x$sep$y/$net,1023 nomatch 2>/dev/null
-+    	    	echo "t test $ip$x$sep$y/$net,1023 nomatch"
-     	    done
-    	done
-+    	done | $ipset restore 2>/dev/null
-     	;;
-     netiface)
-     	$ipset n test hash:net,iface $1 hashsize 64
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net,eth0 nomatch
-+    	    	echo "a test $ip$x$sep$y/$net,eth0 nomatch"
-     	    done
-    	done
-+    	done | $ipset restore
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset t test $ip$x$sep$y/$net,eth0 nomatch 2>/dev/null
-+    	    	echo "t test $ip$x$sep$y/$net,eth0 nomatch"
-     	    done
-    	done
-+    	done | $ipset restore 2>/dev/null
-     	;;
- esac
- $ipset x
-diff --git a/tests/resizet.sh b/tests/resizet.sh
-index eed4abf2bd86e..e8fdd732435ab 100755
--- a/tests/resizet.sh
-+++ b/tests/resizet.sh
-@@ -25,81 +25,81 @@ case "$2" in
-     	$ipset n test hash:ip $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y
-+    	    	echo "a test $ip$x$sep$y"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipmark)
-     	$ipset n test hash:ip,mark $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023
-+    	    	echo "a test $ip$x$sep$y,1023"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipport)
-     	$ipset n test hash:ip,port $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023
-+    	    	echo "a test $ip$x$sep$y,1023"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipportip)
-     	$ipset n test hash:ip,port,ip $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023,$ip2
-+    	    	echo "a test $ip$x$sep$y,1023,$ip2"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     ipportnet)
-     	$ipset n test hash:ip,port,net $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y,1023,$ip2/$net
-+    	    	echo "a test $ip$x$sep$y,1023,$ip2/$net"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     netportnet)
-     	$ipset n test hash:net,port,net $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 128`; do
-    	    	$ipset a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net
-+    	    	echo "a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     net)
-     	$ipset n test hash:net $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net
-+    	    	echo "a test $ip$x$sep$y/$net"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     netnet)
- 	$ipset n test hash:net,net $1 hashsize 64 timeout 100
- 	for x in `seq 0 16`; do
- 	    for y in `seq 0 255`; do
-		$ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net
-+		echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net"
- 	    done
-	done
-+	done | $ipset restore
- 	;;
-     netport)
-     	$ipset n test hash:net,port $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net,1023
-+    	    	echo "a test $ip$x$sep$y/$net,1023"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
-     netiface)
-     	$ipset n test hash:net,iface $1 hashsize 64 timeout 100
-     	for x in `seq 0 16`; do
-     	    for y in `seq 0 255`; do
-    	    	$ipset a test $ip$x$sep$y/$net,eth0
-+    	    	echo "a test $ip$x$sep$y/$net,eth0"
-     	    done
-    	done
-+    	done | $ipset restore
-     	;;
- esac
- $ipset l test | grep ^$ip | while read x y z; do
-diff --git a/tests/setlist_resize.sh b/tests/setlist_resize.sh
-index 1c2be327b841a..acb33e3ba0f08 100755
--- a/tests/setlist_resize.sh
-+++ b/tests/setlist_resize.sh
-@@ -25,9 +25,9 @@ rmmod ip_set >/dev/null 2>&1
- create() {
-     n=$1
-     while [ $n -le 1024 ]; do
-      $ipset c test$n hash:ip
-+      echo "c test$n hash:ip"
-     	n=$((n+2))
-    done
-+    done | $ipset restore
- }
- 
- for x in `seq 1 $loop`; do
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,7 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+#  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1-gating.functional}
--- a/2
+++ b/2
@ -1,5 +1,5 @@
 # Save current ipsets on stop.
 #   Value: yes|no,  default: no
-# Saves all ipsets to /etc/sysconfig/ipset.d/ if service gets stopped
+# Saves all ipsets to /etc/ipset/ipset if service gets stopped
 # (e.g. on system shutdown).
 IPSET_SAVE_ON_STOP="no"
--- a/ipset.spec
+++ b/ipset.spec
@ -2,35 +2,23 @@
 %define legacy_actions %{_libexecdir}/initscripts/legacy-actions

 Name:             ipset
-Version:          7.22
-Release:          8%{?dist}
+Version:          7.1
+Release:          1%{?dist}
 Summary:          Manage Linux IP sets

-License:          GPL-2.0-only
+License:          GPLv2
 URL:              http://ipset.netfilter.org/
-Source0:          %{url}/%{name}-%{version}.tar.bz2
+Source0:          http://ipset.netfilter.org/%{name}-%{version}.tar.bz2
 Source1:          %{name}.service
 Source2:          %{name}.start-stop
 Source3:          %{name}-config
 Source4:          %{name}.save-legacy

-Patch001:         0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch
-Patch002:         0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch
-Patch003:         0003-lib-ipset-Avoid-argv-array-overstepping.patch
-Patch004:         0004-tests-Reduce-testsuite-run-time.patch
-
 BuildRequires:    libmnl-devel
-BuildRequires:    automake
-BuildRequires:    autoconf
-BuildRequires:    make
-BuildRequires:    libtool
-BuildRequires:    libtool-ltdl-devel

 # An explicit requirement is needed here, to avoid cases where a user would
 # explicitly update only one of the two (e.g 'yum update ipset')
 Requires:         %{name}-libs%{?_isa} = %{version}-%{release}
-# RHEL10 moved ipset-specific kernel modules into extra package
-Requires:         kernel-modules-extra-matched

 %description
 IP sets are a framework inside the Linux kernel since version 2.4.x, which can
@ -59,7 +47,6 @@ This package contains the libraries which provide the IP sets funcionality.
 %package devel
 Summary:       Development files for %{name}
 Requires:      %{name}-libs%{?_isa} == %{version}-%{release}
-Requires:      kernel-headers

 %description devel
 This package contains the files required to develop software using the %{name}
@ -70,7 +57,7 @@ libraries.
 Summary:          %{name} service for %{name}s
 Requires:         %{name} = %{version}-%{release}
 BuildRequires:    systemd
-Requires:         iptables-nft-services
+Requires:         iptables-services
 Requires(post):   systemd
 Requires(preun):  systemd
 Requires(postun): systemd
@ -82,11 +69,10 @@ out of the base package since it is not active by default.


 %prep
-%autosetup -p1
+%setup -q


 %build
-./autogen.sh
 %configure --enable-static=no --with-kmod=no

 # Just to make absolutely sure we are not building the bundled kernel module
@ -97,11 +83,11 @@ rm -fr kernel
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool

-%make_build
+make %{?_smp_mflags}


 %install
-%make_install
+make install DESTDIR=%{buildroot}
 find %{buildroot} -name '*.la' -exec rm -f '{}' \;

 # install systemd unit file
@ -123,9 +109,6 @@ install -c -m 755 %{SOURCE4} %{buildroot}/%{legacy_actions}/ipset/save
 # Create directory for configuration
 mkdir -p %{buildroot}%{_sysconfdir}/%{name}

-# Turn absolute symlink into a relative one
-ln -sf %{name} %{buildroot}/%{_sbindir}/%{name}-translate
-

 %preun
 if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
@ -134,23 +117,13 @@ if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
 fi


-%ldconfig_scriptlets libs
+%post libs -p /sbin/ldconfig
+
+%postun libs -p /sbin/ldconfig


 %post service
 %systemd_post %{name}.service
-if [[ -f /etc/ipset/ipset ]] && [[ ! -f /etc/sysconfig/ipset ]]; then
-	mv /etc/ipset/ipset /etc/sysconfig/ipset
-	ln -s /etc/sysconfig/ipset /etc/ipset/ipset
-	echo "Warning: ipset save location has moved to /etc/sysconfig"
-fi
-[[ -f /etc/sysconfig/iptables-config ]] && . /etc/sysconfig/iptables-config
-[[ -f /etc/sysconfig/ip6tables-config ]] && . /etc/sysconfig/ip6tables-config
-if [[ ${IPTABLES_SAVE_ON_STOP} == yes ]] || \
-   [[ ${IP6TABLES_SAVE_ON_STOP} == yes ]]; then
-	echo "Warning: ipset no longer saves automatically when iptables does"
-	echo "         must enable explicitly in /etc/sysconfig/ipset-config"
-fi

 %preun service
 if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
@ -162,23 +135,35 @@ fi
 %postun service
 %systemd_postun_with_restart %{name}.service

+%triggerin service -- ipset-service < 6.38-1.el7
+# Before 6.38-1, ipset.start-stop keeps a backup of previously saved sets, but
+# doesn't touch the /etc/sysconfig/ipset.d/.saved flag. Remove the backup on
+# upgrade, so that we use the current version of saved sets
+rm -f /etc/sysconfig/ipset.save || :
+exit 0
+
+%triggerun service -- ipset-service < 6.38-1.el7
+# Up to 6.29-1, ipset.start-stop uses a single data file
+for f in /etc/sysconfig/ipset.d/*; do
+    [ "${f}" = "/etc/sysconfig/ipset.d/*" ] && break
+    cat ${f} >> /etc/sysconfig/ipset || :
+done
+exit 0

 %files
-%doc ChangeLog
-%license COPYING
-%{_mandir}/man8/%{name}*.8.*
+%doc COPYING ChangeLog
+%doc %{_mandir}/man8/%{name}.8.gz
 %{_sbindir}/%{name}
-%{_sbindir}/%{name}-translate

 %files libs
-%license COPYING
+%doc COPYING
 %{_libdir}/lib%{name}.so.13*
+%doc %{_mandir}/man3/lib%{name}.3.gz

 %files devel
 %{_includedir}/lib%{name}
 %{_libdir}/lib%{name}.so
 %{_libdir}/pkgconfig/lib%{name}.pc
-%{_mandir}/man3/libipset.3.*

 %files service
 %{_unitdir}/%{name}.service
@ -191,147 +176,46 @@ fi


 %changelog
-* Tue Apr 22 2025 Phil Sutter <psutter@redhat.com> - 7.22-8
- Require new kernel-modules-extra-matched meta package
+* Sun May 26 2019 Stefano Brivio <sbrivio@redhat.com> - 7.1-1
+- Rebase to 7.1 (RHBZ#1649090):
+  - Add compatibility support for strscpy()
+  - Correct the manpage about the sort option
+  - Add missing functions to libipset.map
+  - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
+  - Implement sorting for hash types in the ipset tool
+  - Fix to list/save into file specified by option (reported by Isaac Good)
+  - Introduction of new commands and protocol version 7, updated kernel include files
+  - Add compatibility support for async in pernet_operations
+  - Use more robust awk patterns to check for backward compatibility
+  - Prepare the ipset tool to handle multiple protocol version
+  - Fix warning message handlin
+  - Correct to test null valued entry in hash:net6,port,net6 test
+  - Library reworked to support embedding ipset completely
+  - Add compatibility to support kvcalloc()
+  - Validate string type attributes in attr2data() (Stefano Brivio)
+  - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
+    (RHBZ#1649079)
+  - Add compatibility to support is_zero_ether_addr()
+  - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
+  - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
+  - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
+  - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
+- Fixes:
+  - Fix all shellcheck warnings in init script (RHBZ#1649085)
+  - Make error reporting consistent, introduce different severities (RHBZ#1683711)
+  - While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
+  - Fix covscan SC2166 warning in init script (RHBZ#1649085)

-* Mon Mar 17 2025 Eric Garver <egarver@redhat.com> - 7.22-7
- fix kernel-modules-extra dependency for aarch64 64k variant [RHEL-83582]
+* Tue Nov 13 2018 Stefano Brivio <sbrivio@redhat.com> - 6.38-3
+- Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
+  hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
+  we don't run into issues with z-stream updates

-* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 7.22-6
- Bump for sidetag build
+* Mon Oct 08 2018 Stefano Brivio <sbrivio@redhat.com> - 6.38-2
+- Drop ipset-devel dependency on kernel-devel (RHBZ#163175)

-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 7.22-5
- Bump release for October 2024 mass rebuild:
-  Resolves: RHEL-64018
-
-* Thu Oct 10 2024 Phil Sutter <psutter@redhat.com> - 7.22-4
- Add legacy actions for service save support
- ipset-services to depend on iptables-nft-services
- Require kernel-modules-extra
-
-* Tue Sep 10 2024 Phil Sutter <psutter@redhat.com> - 7.22-3
- Bump release to trigger CI
-
-* Thu Aug 29 2024 Phil Sutter <psutter@redhat.com> - 7.22-2
- Bump release to trigger CI
-
-* Thu Aug 01 2024 Phil Sutter <psutter@redhat.com> - 7.22-1
- Turn absolute ipset-translate symlink into a relative one
- Rebase onto 7.22 plus fixes
-
-* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 7.21-2
- Bump release for June 2024 mass rebuild
-
-* Mon Feb 12 2024 Nicolas Chauvet <kwizart@gmail.com> - 7.21-1
- Update to 7.21
-
-* Thu Feb 01 2024 Nicolas Chauvet <kwizart@gmail.com> - 7.20-1
- Update to 7.20
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.19-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.19-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Oct 23 2023 Nicolas Chauvet <kwizart@gmail.com> - 7.19-1
- Update to 7.19
-
-* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-7
- Convert license to SPDX format
-
-* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-6
- Convert license to SPDX format
-
-* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-5
- Convert license to SPDX format
-
-* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-4
- Convert license to SPDX format
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.17-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.17-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Mon Jan 02 2023 Nicolas Chauvet <kwizart@gmail.com> - 7.17-1
- Update to 7.17
-
-* Fri Dec 02 2022 Nicolas Chauvet <kwizart@gmail.com> - 7.16-1
- Update to 7.16
-
-* Tue Aug 23 2022 Nicolas Chauvet <kwizart@gmail.com> - 7.15-5
- Backport upstream patches - rhbz#2117654
-  ipset-translate does not work with IPv6 sets
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.15-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue Mar 15 2022 Phil Sutter <psutter@redhat.com> - 7.15-3
- Use the advanced init script from Centos9Stream
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.15-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Aug 16 2021 Nicolas Chauvet <kwizart@gmail.com> - 7.15-1
- Update to 7.15
-
-* Wed Jul 28 2021 Nicolas Chauvet <kwizart@gmail.com> - 7.14-1
- Update to 7.14
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.11-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 7.11-2
- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
-* Mon Mar 01 2021 Nicolas Chauvet <kwizart@gmail.com> - 7.11-1
- Update to 7.11
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.10-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Dec 21 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.10-1
- Update to 7.10
-
-* Wed Dec 16 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.9-1
- Update to 7.9
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Feb 24 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.6-1
- Update to 7.6
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Fri Jan 10 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.5-1
- Update to 7.5
-
-* Mon Nov 04 2019 Eric Garver <eric@garver.life> - 7.4-1
- Update to 7.4
-
-* Mon Aug 19 2019 Nicolas Chauvet <kwizart@gmail.com> - 7.3-1
- Update to 7.3
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Thu Jul 11 2019 Nicolas Chauvet <kwizart@gmail.com> - 7.2-1
- Update to 7.2
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.38-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Mon Aug 13 2018 Nicolas Chauvet <kwizart@gmail.com> - 6.38-1
- Update to 6.38
- Clean-up spec
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.35-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+* Tue Aug 14 2018 Stefano Brivio <sbrivio@redhat.com> - 6.38-1
+- Update to 6.38, source from RHEL7 6.38-2 (RHBZ#1615967)

 * Mon Feb 12 2018 Eric Garver <egarver@redhat.com> - 6.35-3
 - Patch for missing header file (RHBZ#1543596)
--- a/ipset.start-stop
+++ b/ipset.start-stop
@ -257,13 +257,7 @@ load() {
 	CLEAN_FILES="${CLEAN_FILES} ${mangled}"
 	chmod 600 "${mangled}"

-	cat "${merged}" > "${mangled}"
-	IFS='|'
-	for set in ${conflicts}; do
-		new_name=$(echo "${salt}${set}" | md5sum | head -c31)
-		echo "s/^(add|create) $set /\1 $new_name /"
-	done | sed -i -r -f - "${mangled}"
-	unset IFS
+	awk '/^(add|create) ('"${conflicts}"')/ { printf "%s ",$1; system("echo '${salt}'" $2 " | md5sum | head -c31"); $1=""; $2=""; print; next} {print}' "${merged}" > "${mangled}"
 	if ! ipset_restore "${mangled}"; then
 		err "Failed to restore configured sets"
 		exit 1
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (ipset-7.22.tar.bz2) = e375a9110eb7974480147c57eb2cff4bdd03c7704cdae006a3d254cc80fada587aa8aee25a86f7cab29db83f5e283c5f9a47a314297317660ebba5097f623d79
+SHA512 (ipset-7.1.tar.bz2) = eae9bd83f6675754af8ca443a82e0a1c9d47f60f6bf2a7a405a695223cc17063d5d4eb79428fe21a1f0a867109dfaf8ad8071b45e92191ec108b2cd2382fa854