Compare commits
No commits in common. "c8s" and "c10s" have entirely different histories.
1
.fmf/version
Normal file
1
.fmf/version
Normal file
@ -0,0 +1 @@
|
|||||||
|
1
|
||||||
3
.gitignore
vendored
3
.gitignore
vendored
@ -1,2 +1 @@
|
|||||||
SOURCES/ipset-7.1.tar.bz2
|
ipset-*.tar.bz2
|
||||||
/ipset-7.1.tar.bz2
|
|
||||||
|
|||||||
@ -0,0 +1,23 @@
|
|||||||
|
From 21080dc79c4e9244149aa78f6a8f7fbb6f4b8e81 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jozsef Kadlecsik <kadlec@netfilter.org>
|
||||||
|
Date: Thu, 6 Jun 2024 08:57:11 +0200
|
||||||
|
Subject: [PATCH] Replace BUG_ON() with WARN_ON_ONCE() according to usage
|
||||||
|
policy.
|
||||||
|
|
||||||
|
---
|
||||||
|
kernel/net/netfilter/ipset/ip_set_list_set.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/kernel/net/netfilter/ipset/ip_set_list_set.c b/kernel/net/netfilter/ipset/ip_set_list_set.c
|
||||||
|
index fd78e2db06e4f..0d3e5a7331f26 100644
|
||||||
|
--- a/kernel/net/netfilter/ipset/ip_set_list_set.c
|
||||||
|
+++ b/kernel/net/netfilter/ipset/ip_set_list_set.c
|
||||||
|
@@ -432,7 +432,7 @@ list_set_destroy(struct ip_set *set)
|
||||||
|
{
|
||||||
|
struct list_set *map = set->data;
|
||||||
|
|
||||||
|
- BUG_ON(!list_empty(&map->members));
|
||||||
|
+ WARN_ON_ONCE(!list_empty(&map->members));
|
||||||
|
kfree(map);
|
||||||
|
|
||||||
|
set->data = NULL;
|
||||||
@ -0,0 +1,54 @@
|
|||||||
|
From f1bcacf5eeb8620ea684524e1ce9c3951a77f1f9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Phil Sutter <phil@nwl.cc>
|
||||||
|
Date: Thu, 27 Jun 2024 10:18:16 +0200
|
||||||
|
Subject: [PATCH] lib: data: Fix for global-buffer-overflow warning by ASAN
|
||||||
|
|
||||||
|
After compiling with CFLAGS="-fsanitize=address -g", running the
|
||||||
|
testsuite triggers the following warning:
|
||||||
|
|
||||||
|
| ipmap: Range: Check syntax error: missing range/from-to: FAILED
|
||||||
|
| Failed test: ../src/ipset 2>.foo.err -N test ipmap
|
||||||
|
| =================================================================
|
||||||
|
| ==4204==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55a21e77172a at pc 0x7f1ef246f2a6 bp 0x7fffed8f4f40 sp 0x7fffed8f46e8
|
||||||
|
| READ of size 32 at 0x55a21e77172a thread T0
|
||||||
|
| #0 0x7f1ef246f2a5 in __interceptor_memcpy /var/tmp/portage/sys-devel/gcc-13.2.1_p20231014/work/gcc-13-20231014/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:899
|
||||||
|
| #1 0x55a21e758bf6 in ipset_strlcpy /home/n0-1/git/ipset/lib/data.c:119
|
||||||
|
| #2 0x55a21e758bf6 in ipset_data_set /home/n0-1/git/ipset/lib/data.c:349
|
||||||
|
| #3 0x55a21e75ee2f in ipset_parse_typename /home/n0-1/git/ipset/lib/parse.c:1819
|
||||||
|
| #4 0x55a21e754119 in ipset_parser /home/n0-1/git/ipset/lib/ipset.c:1205
|
||||||
|
| #5 0x55a21e752cef in ipset_parse_argv /home/n0-1/git/ipset/lib/ipset.c:1344
|
||||||
|
| #6 0x55a21e74ea45 in main /home/n0-1/git/ipset/src/ipset.c:38
|
||||||
|
| #7 0x7f1ef224cf09 (/lib64/libc.so.6+0x23f09)
|
||||||
|
| #8 0x7f1ef224cfc4 in __libc_start_main (/lib64/libc.so.6+0x23fc4)
|
||||||
|
| #9 0x55a21e74f040 in _start (/home/n0-1/git/ipset/src/ipset+0x1d040)
|
||||||
|
|
|
||||||
|
| 0x55a21e77172a is located 54 bytes before global variable '*.LC1' defined in 'ipset_bitmap_ip.c' (0x55a21e771760) of size 19
|
||||||
|
| '*.LC1' is ascii string 'IP|IP/CIDR|FROM-TO'
|
||||||
|
| 0x55a21e77172a is located 0 bytes after global variable '*.LC0' defined in 'ipset_bitmap_ip.c' (0x55a21e771720) of size 10
|
||||||
|
| '*.LC0' is ascii string 'bitmap:ip'
|
||||||
|
|
||||||
|
Fix this by avoiding 'src' array overstep in ipset_strlcpy(): In
|
||||||
|
contrast to strncpy(), memcpy() does not respect NUL-chars in input but
|
||||||
|
stubbornly reads as many bytes as specified.
|
||||||
|
|
||||||
|
Fixes: a7432ba786ca4 ("Workaround misleading -Wstringop-truncation warning")
|
||||||
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||||
|
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
|
||||||
|
---
|
||||||
|
lib/data.c | 3 +++
|
||||||
|
1 file changed, 3 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/lib/data.c b/lib/data.c
|
||||||
|
index c05b20144cdad..64cad7a377302 100644
|
||||||
|
--- a/lib/data.c
|
||||||
|
+++ b/lib/data.c
|
||||||
|
@@ -111,6 +111,9 @@ ipset_strlcpy(char *dst, const char *src, size_t len)
|
||||||
|
assert(dst);
|
||||||
|
assert(src);
|
||||||
|
|
||||||
|
+ if (strlen(src) < len)
|
||||||
|
+ len = strlen(src) + 1;
|
||||||
|
+
|
||||||
|
memcpy(dst, src, len);
|
||||||
|
dst[len - 1] = '\0';
|
||||||
|
}
|
||||||
38
0003-lib-ipset-Avoid-argv-array-overstepping.patch
Normal file
38
0003-lib-ipset-Avoid-argv-array-overstepping.patch
Normal file
@ -0,0 +1,38 @@
|
|||||||
|
From 851cb04ffee5040f1e0063f77c3fe9bc6245e0fb Mon Sep 17 00:00:00 2001
|
||||||
|
From: Phil Sutter <phil@nwl.cc>
|
||||||
|
Date: Thu, 27 Jun 2024 10:18:17 +0200
|
||||||
|
Subject: [PATCH] lib: ipset: Avoid 'argv' array overstepping
|
||||||
|
|
||||||
|
The maximum accepted value for 'argc' is MAX_ARGS which matches 'argv'
|
||||||
|
array size. The maximum allowed array index is therefore argc-1.
|
||||||
|
|
||||||
|
This fix will leave items in argv non-NULL-terminated, so explicitly
|
||||||
|
NULL the formerly last entry after shifting.
|
||||||
|
|
||||||
|
Looks like a day-1 bug. Interestingly, this neither triggered ASAN nor
|
||||||
|
valgrind. Yet adding debug output printing argv entries being copied
|
||||||
|
did.
|
||||||
|
|
||||||
|
Fixes: 1e6e8bd9a62aa ("Third stage to ipset-5")
|
||||||
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||||
|
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
|
||||||
|
---
|
||||||
|
lib/ipset.c | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/ipset.c b/lib/ipset.c
|
||||||
|
index c910d88805c28..3bf1c5fcdbc59 100644
|
||||||
|
--- a/lib/ipset.c
|
||||||
|
+++ b/lib/ipset.c
|
||||||
|
@@ -343,9 +343,9 @@ ipset_shift_argv(int *argc, char *argv[], int from)
|
||||||
|
|
||||||
|
assert(*argc >= from + 1);
|
||||||
|
|
||||||
|
- for (i = from + 1; i <= *argc; i++)
|
||||||
|
+ for (i = from + 1; i < *argc; i++)
|
||||||
|
argv[i-1] = argv[i];
|
||||||
|
- (*argc)--;
|
||||||
|
+ argv[--(*argc)] = NULL;
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
354
0004-tests-Reduce-testsuite-run-time.patch
Normal file
354
0004-tests-Reduce-testsuite-run-time.patch
Normal file
@ -0,0 +1,354 @@
|
|||||||
|
From 5c9ef9016d2781f6e07a544e34ec9f4a8d65d0e2 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Phil Sutter <phil@nwl.cc>
|
||||||
|
Date: Thu, 27 Jun 2024 10:18:18 +0200
|
||||||
|
Subject: [PATCH] tests: Reduce testsuite run-time
|
||||||
|
|
||||||
|
Where acceptable, batch add set element calls to avoid overhead of
|
||||||
|
excessive 'ipset' program spawns. On my (slow) testing VM, this patch
|
||||||
|
reduces a full run of tests/runtest.sh from ~70min down to ~11min.
|
||||||
|
|
||||||
|
This might eliminate the situation being tested: resize.sh might be such
|
||||||
|
a case so batch only 255 'ipset add' calls and continue to repeat these
|
||||||
|
batched calls 32 times in hopes that it still qualifies as the resizing
|
||||||
|
stress test tests/hash:ip.t calls it.
|
||||||
|
|
||||||
|
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||||
|
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
|
||||||
|
---
|
||||||
|
tests/resize.sh | 4 ++--
|
||||||
|
tests/resizec.sh | 32 +++++++++++++--------------
|
||||||
|
tests/resizen.sh | 49 ++++++++++++++++++++---------------------
|
||||||
|
tests/resizet.sh | 40 ++++++++++++++++-----------------
|
||||||
|
tests/setlist_resize.sh | 4 ++--
|
||||||
|
5 files changed, 64 insertions(+), 65 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/tests/resize.sh b/tests/resize.sh
|
||||||
|
index 19b93fb01876c..9069b4970e92d 100755
|
||||||
|
--- a/tests/resize.sh
|
||||||
|
+++ b/tests/resize.sh
|
||||||
|
@@ -9,6 +9,6 @@ set -e
|
||||||
|
$ipset n resize-test hash:ip hashsize 64
|
||||||
|
for x in `seq 1 32`; do
|
||||||
|
for y in `seq 1 255`; do
|
||||||
|
- $ipset a resize-test 192.168.$x.$y
|
||||||
|
- done
|
||||||
|
+ echo "a resize-test 192.168.$x.$y"
|
||||||
|
+ done | $ipset restore
|
||||||
|
done
|
||||||
|
diff --git a/tests/resizec.sh b/tests/resizec.sh
|
||||||
|
index 28d674769f76f..781acf74c38dd 100755
|
||||||
|
--- a/tests/resizec.sh
|
||||||
|
+++ b/tests/resizec.sh
|
||||||
|
@@ -25,65 +25,65 @@ case "$2" in
|
||||||
|
$ipset n test hash:ip $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y comment "text $ip$x$sep$y"
|
||||||
|
+ echo "a test $ip$x$sep$y comment \"text $ip$x$sep$y\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipport)
|
||||||
|
$ipset n test hash:ip,port $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023 "text $ip$x$sep$y,1023"
|
||||||
|
+ echo "a test $ip$x$sep$y,1023 \"text $ip$x$sep$y,1023\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipportip)
|
||||||
|
$ipset n test hash:ip,port,ip $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023,$ip2 comment "text $ip$x$sep$y,1023,$ip2"
|
||||||
|
+ echo "a test $ip$x$sep$y,1023,$ip2 comment \"text $ip$x$sep$y,1023,$ip2\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipportnet)
|
||||||
|
$ipset n test hash:ip,port,net $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023,$ip2/$net comment "text $ip$x$sep$y,1023,$ip2/$net"
|
||||||
|
+ echo "a test $ip$x$sep$y,1023,$ip2/$net comment \"text $ip$x$sep$y,1023,$ip2/$net\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
net)
|
||||||
|
$ipset n test hash:net $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net comment "text $ip$x$sep$y/$net"
|
||||||
|
+ echo "a test $ip$x$sep$y/$net comment \"text $ip$x$sep$y/$net\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netnet)
|
||||||
|
$ipset n test hash:net,net $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment "text $ip$x$sep$y/$net,$ip$y$sep$x/$net"
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net comment \"text $ip$x$sep$y/$net,$ip$y$sep$x/$net\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netport)
|
||||||
|
$ipset n test hash:net,port $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,1023 comment "text $ip$x$sep$y/$net,1023"
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,1023 comment \"text $ip$x$sep$y/$net,1023\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netiface)
|
||||||
|
$ipset n test hash:net,iface $1 hashsize 64 comment
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,eth0 comment "text $ip$x$sep$y/$net,eth0"
|
||||||
|
+ echo "$ipset a test $ip$x$sep$y/$net,eth0 comment \"text $ip$x$sep$y/$net,eth0\""
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
$ipset l test | grep ^$ip | while read x y z; do
|
||||||
|
diff --git a/tests/resizen.sh b/tests/resizen.sh
|
||||||
|
index 9322bd2a2cfce..13221f7b0894a 100755
|
||||||
|
--- a/tests/resizen.sh
|
||||||
|
+++ b/tests/resizen.sh
|
||||||
|
@@ -25,80 +25,79 @@ case "$2" in
|
||||||
|
$ipset n test hash:ip,port,net $1 hashsize 64
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch
|
||||||
|
+ echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null
|
||||||
|
+ echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore 2>/dev/null
|
||||||
|
;;
|
||||||
|
netportnet)
|
||||||
|
$ipset n test hash:net,port,net $1 hashsize 64
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023,$ip2/$net nomatch
|
||||||
|
+ echo "a test $ip$x$sep$y,1023,$ip2/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset t test $ip$x$sep$y,1023,$ip2/$net nomatch 2>/dev/null
|
||||||
|
+ echo "t test $ip$x$sep$y,1023,$ip2/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore 2>/dev/null
|
||||||
|
;;
|
||||||
|
net)
|
||||||
|
$ipset n test hash:net $1 hashsize 64
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net nomatch
|
||||||
|
+ echo "a test $ip$x$sep$y/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset t test $ip$x$sep$y/$net nomatch 2>/dev/null
|
||||||
|
+ echo "t test $ip$x$sep$y/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore 2>/dev/null
|
||||||
|
;;
|
||||||
|
netnet)
|
||||||
|
$ipset n test hash:net,net $1 hashsize 64
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch \
|
||||||
|
- 2>/dev/null
|
||||||
|
+ echo "t test $ip$x$sep$y/$net,$ip$y$sep$x/$net nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore 2>/dev/null
|
||||||
|
;;
|
||||||
|
netport)
|
||||||
|
$ipset n test hash:net,port $1 hashsize 64
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,1023 nomatch
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,1023 nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset t test $ip$x$sep$y/$net,1023 nomatch 2>/dev/null
|
||||||
|
+ echo "t test $ip$x$sep$y/$net,1023 nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore 2>/dev/null
|
||||||
|
;;
|
||||||
|
netiface)
|
||||||
|
$ipset n test hash:net,iface $1 hashsize 64
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,eth0 nomatch
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,eth0 nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset t test $ip$x$sep$y/$net,eth0 nomatch 2>/dev/null
|
||||||
|
+ echo "t test $ip$x$sep$y/$net,eth0 nomatch"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore 2>/dev/null
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
$ipset x
|
||||||
|
diff --git a/tests/resizet.sh b/tests/resizet.sh
|
||||||
|
index eed4abf2bd86e..e8fdd732435ab 100755
|
||||||
|
--- a/tests/resizet.sh
|
||||||
|
+++ b/tests/resizet.sh
|
||||||
|
@@ -25,81 +25,81 @@ case "$2" in
|
||||||
|
$ipset n test hash:ip $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y
|
||||||
|
+ echo "a test $ip$x$sep$y"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipmark)
|
||||||
|
$ipset n test hash:ip,mark $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023
|
||||||
|
+ echo "a test $ip$x$sep$y,1023"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipport)
|
||||||
|
$ipset n test hash:ip,port $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023
|
||||||
|
+ echo "a test $ip$x$sep$y,1023"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipportip)
|
||||||
|
$ipset n test hash:ip,port,ip $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023,$ip2
|
||||||
|
+ echo "a test $ip$x$sep$y,1023,$ip2"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
ipportnet)
|
||||||
|
$ipset n test hash:ip,port,net $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y,1023,$ip2/$net
|
||||||
|
+ echo "a test $ip$x$sep$y,1023,$ip2/$net"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netportnet)
|
||||||
|
$ipset n test hash:net,port,net $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 128`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,1023,$ip$y$sep$x/$net"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
net)
|
||||||
|
$ipset n test hash:net $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net
|
||||||
|
+ echo "a test $ip$x$sep$y/$net"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netnet)
|
||||||
|
$ipset n test hash:net,net $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,$ip$y$sep$x/$net
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,$ip$y$sep$x/$net"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netport)
|
||||||
|
$ipset n test hash:net,port $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,1023
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,1023"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
netiface)
|
||||||
|
$ipset n test hash:net,iface $1 hashsize 64 timeout 100
|
||||||
|
for x in `seq 0 16`; do
|
||||||
|
for y in `seq 0 255`; do
|
||||||
|
- $ipset a test $ip$x$sep$y/$net,eth0
|
||||||
|
+ echo "a test $ip$x$sep$y/$net,eth0"
|
||||||
|
done
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
$ipset l test | grep ^$ip | while read x y z; do
|
||||||
|
diff --git a/tests/setlist_resize.sh b/tests/setlist_resize.sh
|
||||||
|
index 1c2be327b841a..acb33e3ba0f08 100755
|
||||||
|
--- a/tests/setlist_resize.sh
|
||||||
|
+++ b/tests/setlist_resize.sh
|
||||||
|
@@ -25,9 +25,9 @@ rmmod ip_set >/dev/null 2>&1
|
||||||
|
create() {
|
||||||
|
n=$1
|
||||||
|
while [ $n -le 1024 ]; do
|
||||||
|
- $ipset c test$n hash:ip
|
||||||
|
+ echo "c test$n hash:ip"
|
||||||
|
n=$((n+2))
|
||||||
|
- done
|
||||||
|
+ done | $ipset restore
|
||||||
|
}
|
||||||
|
|
||||||
|
for x in `seq 1 $loop`; do
|
||||||
@ -1,7 +1,7 @@
|
|||||||
|
# Gating rhel
|
||||||
--- !Policy
|
--- !Policy
|
||||||
product_versions:
|
product_versions:
|
||||||
- rhel-8
|
- rhel-10
|
||||||
decision_context: osci_compose_gate
|
decision_context: osci_compose_gate
|
||||||
rules:
|
rules:
|
||||||
# - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
- !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-gating.functional}
|
||||||
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1-gating.functional}
|
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
# Save current ipsets on stop.
|
# Save current ipsets on stop.
|
||||||
# Value: yes|no, default: no
|
# Value: yes|no, default: no
|
||||||
# Saves all ipsets to /etc/ipset/ipset if service gets stopped
|
# Saves all ipsets to /etc/sysconfig/ipset.d/ if service gets stopped
|
||||||
# (e.g. on system shutdown).
|
# (e.g. on system shutdown).
|
||||||
IPSET_SAVE_ON_STOP="no"
|
IPSET_SAVE_ON_STOP="no"
|
||||||
|
|||||||
242
ipset.spec
242
ipset.spec
@ -2,23 +2,35 @@
|
|||||||
%define legacy_actions %{_libexecdir}/initscripts/legacy-actions
|
%define legacy_actions %{_libexecdir}/initscripts/legacy-actions
|
||||||
|
|
||||||
Name: ipset
|
Name: ipset
|
||||||
Version: 7.1
|
Version: 7.22
|
||||||
Release: 1%{?dist}
|
Release: 6%{?dist}
|
||||||
Summary: Manage Linux IP sets
|
Summary: Manage Linux IP sets
|
||||||
|
|
||||||
License: GPLv2
|
License: GPL-2.0-only
|
||||||
URL: http://ipset.netfilter.org/
|
URL: http://ipset.netfilter.org/
|
||||||
Source0: http://ipset.netfilter.org/%{name}-%{version}.tar.bz2
|
Source0: %{url}/%{name}-%{version}.tar.bz2
|
||||||
Source1: %{name}.service
|
Source1: %{name}.service
|
||||||
Source2: %{name}.start-stop
|
Source2: %{name}.start-stop
|
||||||
Source3: %{name}-config
|
Source3: %{name}-config
|
||||||
Source4: %{name}.save-legacy
|
Source4: %{name}.save-legacy
|
||||||
|
|
||||||
|
Patch001: 0001-Replace-BUG_ON-with-WARN_ON_ONCE-according-to-usage-.patch
|
||||||
|
Patch002: 0002-lib-data-Fix-for-global-buffer-overflow-warning-by-A.patch
|
||||||
|
Patch003: 0003-lib-ipset-Avoid-argv-array-overstepping.patch
|
||||||
|
Patch004: 0004-tests-Reduce-testsuite-run-time.patch
|
||||||
|
|
||||||
BuildRequires: libmnl-devel
|
BuildRequires: libmnl-devel
|
||||||
|
BuildRequires: automake
|
||||||
|
BuildRequires: autoconf
|
||||||
|
BuildRequires: make
|
||||||
|
BuildRequires: libtool
|
||||||
|
BuildRequires: libtool-ltdl-devel
|
||||||
|
|
||||||
# An explicit requirement is needed here, to avoid cases where a user would
|
# An explicit requirement is needed here, to avoid cases where a user would
|
||||||
# explicitly update only one of the two (e.g 'yum update ipset')
|
# explicitly update only one of the two (e.g 'yum update ipset')
|
||||||
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||||
|
# RHEL10 moved ipset-specific kernel modules into extra package
|
||||||
|
Requires: kernel-modules-extra
|
||||||
|
|
||||||
%description
|
%description
|
||||||
IP sets are a framework inside the Linux kernel since version 2.4.x, which can
|
IP sets are a framework inside the Linux kernel since version 2.4.x, which can
|
||||||
@ -47,6 +59,7 @@ This package contains the libraries which provide the IP sets funcionality.
|
|||||||
%package devel
|
%package devel
|
||||||
Summary: Development files for %{name}
|
Summary: Development files for %{name}
|
||||||
Requires: %{name}-libs%{?_isa} == %{version}-%{release}
|
Requires: %{name}-libs%{?_isa} == %{version}-%{release}
|
||||||
|
Requires: kernel-headers
|
||||||
|
|
||||||
%description devel
|
%description devel
|
||||||
This package contains the files required to develop software using the %{name}
|
This package contains the files required to develop software using the %{name}
|
||||||
@ -57,7 +70,7 @@ libraries.
|
|||||||
Summary: %{name} service for %{name}s
|
Summary: %{name} service for %{name}s
|
||||||
Requires: %{name} = %{version}-%{release}
|
Requires: %{name} = %{version}-%{release}
|
||||||
BuildRequires: systemd
|
BuildRequires: systemd
|
||||||
Requires: iptables-services
|
Requires: iptables-nft-services
|
||||||
Requires(post): systemd
|
Requires(post): systemd
|
||||||
Requires(preun): systemd
|
Requires(preun): systemd
|
||||||
Requires(postun): systemd
|
Requires(postun): systemd
|
||||||
@ -69,10 +82,11 @@ out of the base package since it is not active by default.
|
|||||||
|
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q
|
%autosetup -p1
|
||||||
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
|
./autogen.sh
|
||||||
%configure --enable-static=no --with-kmod=no
|
%configure --enable-static=no --with-kmod=no
|
||||||
|
|
||||||
# Just to make absolutely sure we are not building the bundled kernel module
|
# Just to make absolutely sure we are not building the bundled kernel module
|
||||||
@ -83,11 +97,11 @@ rm -fr kernel
|
|||||||
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
|
sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
|
||||||
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
|
sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
|
||||||
|
|
||||||
make %{?_smp_mflags}
|
%make_build
|
||||||
|
|
||||||
|
|
||||||
%install
|
%install
|
||||||
make install DESTDIR=%{buildroot}
|
%make_install
|
||||||
find %{buildroot} -name '*.la' -exec rm -f '{}' \;
|
find %{buildroot} -name '*.la' -exec rm -f '{}' \;
|
||||||
|
|
||||||
# install systemd unit file
|
# install systemd unit file
|
||||||
@ -109,6 +123,9 @@ install -c -m 755 %{SOURCE4} %{buildroot}/%{legacy_actions}/ipset/save
|
|||||||
# Create directory for configuration
|
# Create directory for configuration
|
||||||
mkdir -p %{buildroot}%{_sysconfdir}/%{name}
|
mkdir -p %{buildroot}%{_sysconfdir}/%{name}
|
||||||
|
|
||||||
|
# Turn absolute symlink into a relative one
|
||||||
|
ln -sf %{name} %{buildroot}/%{_sbindir}/%{name}-translate
|
||||||
|
|
||||||
|
|
||||||
%preun
|
%preun
|
||||||
if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
|
if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
|
||||||
@ -117,13 +134,23 @@ if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
|
|
||||||
%post libs -p /sbin/ldconfig
|
%ldconfig_scriptlets libs
|
||||||
|
|
||||||
%postun libs -p /sbin/ldconfig
|
|
||||||
|
|
||||||
|
|
||||||
%post service
|
%post service
|
||||||
%systemd_post %{name}.service
|
%systemd_post %{name}.service
|
||||||
|
if [[ -f /etc/ipset/ipset ]] && [[ ! -f /etc/sysconfig/ipset ]]; then
|
||||||
|
mv /etc/ipset/ipset /etc/sysconfig/ipset
|
||||||
|
ln -s /etc/sysconfig/ipset /etc/ipset/ipset
|
||||||
|
echo "Warning: ipset save location has moved to /etc/sysconfig"
|
||||||
|
fi
|
||||||
|
[[ -f /etc/sysconfig/iptables-config ]] && . /etc/sysconfig/iptables-config
|
||||||
|
[[ -f /etc/sysconfig/ip6tables-config ]] && . /etc/sysconfig/ip6tables-config
|
||||||
|
if [[ ${IPTABLES_SAVE_ON_STOP} == yes ]] || \
|
||||||
|
[[ ${IP6TABLES_SAVE_ON_STOP} == yes ]]; then
|
||||||
|
echo "Warning: ipset no longer saves automatically when iptables does"
|
||||||
|
echo " must enable explicitly in /etc/sysconfig/ipset-config"
|
||||||
|
fi
|
||||||
|
|
||||||
%preun service
|
%preun service
|
||||||
if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
|
if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then
|
||||||
@ -135,35 +162,23 @@ fi
|
|||||||
%postun service
|
%postun service
|
||||||
%systemd_postun_with_restart %{name}.service
|
%systemd_postun_with_restart %{name}.service
|
||||||
|
|
||||||
%triggerin service -- ipset-service < 6.38-1.el7
|
|
||||||
# Before 6.38-1, ipset.start-stop keeps a backup of previously saved sets, but
|
|
||||||
# doesn't touch the /etc/sysconfig/ipset.d/.saved flag. Remove the backup on
|
|
||||||
# upgrade, so that we use the current version of saved sets
|
|
||||||
rm -f /etc/sysconfig/ipset.save || :
|
|
||||||
exit 0
|
|
||||||
|
|
||||||
%triggerun service -- ipset-service < 6.38-1.el7
|
|
||||||
# Up to 6.29-1, ipset.start-stop uses a single data file
|
|
||||||
for f in /etc/sysconfig/ipset.d/*; do
|
|
||||||
[ "${f}" = "/etc/sysconfig/ipset.d/*" ] && break
|
|
||||||
cat ${f} >> /etc/sysconfig/ipset || :
|
|
||||||
done
|
|
||||||
exit 0
|
|
||||||
|
|
||||||
%files
|
%files
|
||||||
%doc COPYING ChangeLog
|
%doc ChangeLog
|
||||||
%doc %{_mandir}/man8/%{name}.8.gz
|
%license COPYING
|
||||||
|
%{_mandir}/man8/%{name}*.8.*
|
||||||
%{_sbindir}/%{name}
|
%{_sbindir}/%{name}
|
||||||
|
%{_sbindir}/%{name}-translate
|
||||||
|
|
||||||
%files libs
|
%files libs
|
||||||
%doc COPYING
|
%license COPYING
|
||||||
%{_libdir}/lib%{name}.so.13*
|
%{_libdir}/lib%{name}.so.13*
|
||||||
%doc %{_mandir}/man3/lib%{name}.3.gz
|
|
||||||
|
|
||||||
%files devel
|
%files devel
|
||||||
%{_includedir}/lib%{name}
|
%{_includedir}/lib%{name}
|
||||||
%{_libdir}/lib%{name}.so
|
%{_libdir}/lib%{name}.so
|
||||||
%{_libdir}/pkgconfig/lib%{name}.pc
|
%{_libdir}/pkgconfig/lib%{name}.pc
|
||||||
|
%{_mandir}/man3/libipset.3.*
|
||||||
|
|
||||||
%files service
|
%files service
|
||||||
%{_unitdir}/%{name}.service
|
%{_unitdir}/%{name}.service
|
||||||
@ -176,46 +191,141 @@ exit 0
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Sun May 26 2019 Stefano Brivio <sbrivio@redhat.com> - 7.1-1
|
* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 7.22-6
|
||||||
- Rebase to 7.1 (RHBZ#1649090):
|
- Bump for sidetag build
|
||||||
- Add compatibility support for strscpy()
|
|
||||||
- Correct the manpage about the sort option
|
|
||||||
- Add missing functions to libipset.map
|
|
||||||
- configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
|
|
||||||
- Implement sorting for hash types in the ipset tool
|
|
||||||
- Fix to list/save into file specified by option (reported by Isaac Good)
|
|
||||||
- Introduction of new commands and protocol version 7, updated kernel include files
|
|
||||||
- Add compatibility support for async in pernet_operations
|
|
||||||
- Use more robust awk patterns to check for backward compatibility
|
|
||||||
- Prepare the ipset tool to handle multiple protocol version
|
|
||||||
- Fix warning message handlin
|
|
||||||
- Correct to test null valued entry in hash:net6,port,net6 test
|
|
||||||
- Library reworked to support embedding ipset completely
|
|
||||||
- Add compatibility to support kvcalloc()
|
|
||||||
- Validate string type attributes in attr2data() (Stefano Brivio)
|
|
||||||
- manpage: Add comment about matching on destination MAC address (Stefano Brivio)
|
|
||||||
(RHBZ#1649079)
|
|
||||||
- Add compatibility to support is_zero_ether_addr()
|
|
||||||
- Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
|
|
||||||
- Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
|
|
||||||
- Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
|
|
||||||
- tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio)
|
|
||||||
- Fixes:
|
|
||||||
- Fix all shellcheck warnings in init script (RHBZ#1649085)
|
|
||||||
- Make error reporting consistent, introduce different severities (RHBZ#1683711)
|
|
||||||
- While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
|
|
||||||
- Fix covscan SC2166 warning in init script (RHBZ#1649085)
|
|
||||||
|
|
||||||
* Tue Nov 13 2018 Stefano Brivio <sbrivio@redhat.com> - 6.38-3
|
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 7.22-5
|
||||||
- Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
|
- Bump release for October 2024 mass rebuild:
|
||||||
hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
|
Resolves: RHEL-64018
|
||||||
we don't run into issues with z-stream updates
|
|
||||||
|
|
||||||
* Mon Oct 08 2018 Stefano Brivio <sbrivio@redhat.com> - 6.38-2
|
* Thu Oct 10 2024 Phil Sutter <psutter@redhat.com> - 7.22-4
|
||||||
- Drop ipset-devel dependency on kernel-devel (RHBZ#163175)
|
- Add legacy actions for service save support
|
||||||
|
- ipset-services to depend on iptables-nft-services
|
||||||
|
- Require kernel-modules-extra
|
||||||
|
|
||||||
* Tue Aug 14 2018 Stefano Brivio <sbrivio@redhat.com> - 6.38-1
|
* Tue Sep 10 2024 Phil Sutter <psutter@redhat.com> - 7.22-3
|
||||||
- Update to 6.38, source from RHEL7 6.38-2 (RHBZ#1615967)
|
- Bump release to trigger CI
|
||||||
|
|
||||||
|
* Thu Aug 29 2024 Phil Sutter <psutter@redhat.com> - 7.22-2
|
||||||
|
- Bump release to trigger CI
|
||||||
|
|
||||||
|
* Thu Aug 01 2024 Phil Sutter <psutter@redhat.com> - 7.22-1
|
||||||
|
- Turn absolute ipset-translate symlink into a relative one
|
||||||
|
- Rebase onto 7.22 plus fixes
|
||||||
|
|
||||||
|
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 7.21-2
|
||||||
|
- Bump release for June 2024 mass rebuild
|
||||||
|
|
||||||
|
* Mon Feb 12 2024 Nicolas Chauvet <kwizart@gmail.com> - 7.21-1
|
||||||
|
- Update to 7.21
|
||||||
|
|
||||||
|
* Thu Feb 01 2024 Nicolas Chauvet <kwizart@gmail.com> - 7.20-1
|
||||||
|
- Update to 7.20
|
||||||
|
|
||||||
|
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.19-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||||
|
|
||||||
|
* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.19-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Oct 23 2023 Nicolas Chauvet <kwizart@gmail.com> - 7.19-1
|
||||||
|
- Update to 7.19
|
||||||
|
|
||||||
|
* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-7
|
||||||
|
- Convert license to SPDX format
|
||||||
|
|
||||||
|
* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-6
|
||||||
|
- Convert license to SPDX format
|
||||||
|
|
||||||
|
* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-5
|
||||||
|
- Convert license to SPDX format
|
||||||
|
|
||||||
|
* Fri Aug 11 2023 Phil Sutter <psutter@redhat.com> - 7.17-4
|
||||||
|
- Convert license to SPDX format
|
||||||
|
|
||||||
|
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.17-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.17-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Jan 02 2023 Nicolas Chauvet <kwizart@gmail.com> - 7.17-1
|
||||||
|
- Update to 7.17
|
||||||
|
|
||||||
|
* Fri Dec 02 2022 Nicolas Chauvet <kwizart@gmail.com> - 7.16-1
|
||||||
|
- Update to 7.16
|
||||||
|
|
||||||
|
* Tue Aug 23 2022 Nicolas Chauvet <kwizart@gmail.com> - 7.15-5
|
||||||
|
- Backport upstream patches - rhbz#2117654
|
||||||
|
ipset-translate does not work with IPv6 sets
|
||||||
|
|
||||||
|
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.15-4
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||||
|
|
||||||
|
* Tue Mar 15 2022 Phil Sutter <psutter@redhat.com> - 7.15-3
|
||||||
|
- Use the advanced init script from Centos9Stream
|
||||||
|
|
||||||
|
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.15-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Aug 16 2021 Nicolas Chauvet <kwizart@gmail.com> - 7.15-1
|
||||||
|
- Update to 7.15
|
||||||
|
|
||||||
|
* Wed Jul 28 2021 Nicolas Chauvet <kwizart@gmail.com> - 7.14-1
|
||||||
|
- Update to 7.14
|
||||||
|
|
||||||
|
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.11-3
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||||
|
|
||||||
|
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 7.11-2
|
||||||
|
- Rebuilt for updated systemd-rpm-macros
|
||||||
|
See https://pagure.io/fesco/issue/2583.
|
||||||
|
|
||||||
|
* Mon Mar 01 2021 Nicolas Chauvet <kwizart@gmail.com> - 7.11-1
|
||||||
|
- Update to 7.11
|
||||||
|
|
||||||
|
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7.10-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Dec 21 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.10-1
|
||||||
|
- Update to 7.10
|
||||||
|
|
||||||
|
* Wed Dec 16 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.9-1
|
||||||
|
- Update to 7.9
|
||||||
|
|
||||||
|
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.6-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Feb 24 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.6-1
|
||||||
|
- Update to 7.6
|
||||||
|
|
||||||
|
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7.5-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||||
|
|
||||||
|
* Fri Jan 10 2020 Nicolas Chauvet <kwizart@gmail.com> - 7.5-1
|
||||||
|
- Update to 7.5
|
||||||
|
|
||||||
|
* Mon Nov 04 2019 Eric Garver <eric@garver.life> - 7.4-1
|
||||||
|
- Update to 7.4
|
||||||
|
|
||||||
|
* Mon Aug 19 2019 Nicolas Chauvet <kwizart@gmail.com> - 7.3-1
|
||||||
|
- Update to 7.3
|
||||||
|
|
||||||
|
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7.2-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||||
|
|
||||||
|
* Thu Jul 11 2019 Nicolas Chauvet <kwizart@gmail.com> - 7.2-1
|
||||||
|
- Update to 7.2
|
||||||
|
|
||||||
|
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.38-2
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||||
|
|
||||||
|
* Mon Aug 13 2018 Nicolas Chauvet <kwizart@gmail.com> - 6.38-1
|
||||||
|
- Update to 6.38
|
||||||
|
- Clean-up spec
|
||||||
|
|
||||||
|
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.35-4
|
||||||
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||||
|
|
||||||
* Mon Feb 12 2018 Eric Garver <egarver@redhat.com> - 6.35-3
|
* Mon Feb 12 2018 Eric Garver <egarver@redhat.com> - 6.35-3
|
||||||
- Patch for missing header file (RHBZ#1543596)
|
- Patch for missing header file (RHBZ#1543596)
|
||||||
|
|||||||
@ -257,7 +257,13 @@ load() {
|
|||||||
CLEAN_FILES="${CLEAN_FILES} ${mangled}"
|
CLEAN_FILES="${CLEAN_FILES} ${mangled}"
|
||||||
chmod 600 "${mangled}"
|
chmod 600 "${mangled}"
|
||||||
|
|
||||||
awk '/^(add|create) ('"${conflicts}"')/ { printf "%s ",$1; system("echo '${salt}'" $2 " | md5sum | head -c31"); $1=""; $2=""; print; next} {print}' "${merged}" > "${mangled}"
|
cat "${merged}" > "${mangled}"
|
||||||
|
IFS='|'
|
||||||
|
for set in ${conflicts}; do
|
||||||
|
new_name=$(echo "${salt}${set}" | md5sum | head -c31)
|
||||||
|
echo "s/^(add|create) $set /\1 $new_name /"
|
||||||
|
done | sed -i -r -f - "${mangled}"
|
||||||
|
unset IFS
|
||||||
if ! ipset_restore "${mangled}"; then
|
if ! ipset_restore "${mangled}"; then
|
||||||
err "Failed to restore configured sets"
|
err "Failed to restore configured sets"
|
||||||
exit 1
|
exit 1
|
||||||
|
|||||||
10
plans/tier1-gating.fmf
Normal file
10
plans/tier1-gating.fmf
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
summary: Internal Tier1-gating beakerlib tests
|
||||||
|
discover:
|
||||||
|
how: fmf
|
||||||
|
url: git://pkgs.devel.redhat.com/tests/ipset
|
||||||
|
filter: 'tag: CI-gating & tag: -destructive'
|
||||||
|
execute:
|
||||||
|
how: tmt
|
||||||
|
adjust:
|
||||||
|
enabled: false
|
||||||
|
when: distro == centos-stream or distro == fedora
|
||||||
6
rpminspect.yaml
Normal file
6
rpminspect.yaml
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
badfuncs:
|
||||||
|
allowed:
|
||||||
|
/usr/lib*/libipset.so.*:
|
||||||
|
# Upstream maintainer deliberately chose this over getaddrinfo, see
|
||||||
|
# commit c52cf6000923b ("Use gethostbyname2 instead of getaddrinfo")
|
||||||
|
- gethostbyname2
|
||||||
2
sources
2
sources
@ -1 +1 @@
|
|||||||
SHA512 (ipset-7.1.tar.bz2) = eae9bd83f6675754af8ca443a82e0a1c9d47f60f6bf2a7a405a695223cc17063d5d4eb79428fe21a1f0a867109dfaf8ad8071b45e92191ec108b2cd2382fa854
|
SHA512 (ipset-7.22.tar.bz2) = e375a9110eb7974480147c57eb2cff4bdd03c7704cdae006a3d254cc80fada587aa8aee25a86f7cab29db83f5e283c5f9a47a314297317660ebba5097f623d79
|
||||||
|
|||||||
36
tests/sanity-tests/Makefile
Normal file
36
tests/sanity-tests/Makefile
Normal file
@ -0,0 +1,36 @@
|
|||||||
|
# SPDX-License-Identifier: LGPL-2.1+
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
#
|
||||||
|
# Makefile of /CoreOS/ipset
|
||||||
|
# Description: Test if ipset working ok
|
||||||
|
# Author: Susant Sahani<susant@redhat.com>
|
||||||
|
#
|
||||||
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
export TEST=/CoreOS/ipset
|
||||||
|
export TESTVERSION=1.0
|
||||||
|
BUILT_FILES=
|
||||||
|
FILES=$(METADATA) runtest.sh Makefile iperf3d.service
|
||||||
|
.PHONY: all install download clean
|
||||||
|
run: $(FILES) build
|
||||||
|
./runtest.sh
|
||||||
|
build: $(BUILT_FILES)
|
||||||
|
test -x runtest.sh || chmod a+x runtest.sh
|
||||||
|
clean:
|
||||||
|
rm -f *~ $(BUILT_FILES)
|
||||||
|
include /usr/share/rhts/lib/rhts-make.include
|
||||||
|
$(METADATA): Makefile
|
||||||
|
@echo "Owner: Susant Sahani<susant@redhat.com>" > $(METADATA)
|
||||||
|
@echo "Name: $(TEST)" >> $(METADATA)
|
||||||
|
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||||
|
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||||
|
@echo "Description: Test ipset sanity" >> $(METADATA)
|
||||||
|
@echo "Type: Sanity" >> $(METADATA)
|
||||||
|
@echo "TestTime: 5m" >> $(METADATA)
|
||||||
|
@echo "RunFor: ipset " >> $(METADATA)
|
||||||
|
@echo "Requires: ipset iperf3 systemd iptables kernel-modules-extra" >> $(METADATA)
|
||||||
|
@echo "Priority: Normal" >> $(METADATA)
|
||||||
|
@echo "License: GPLv2" >> $(METADATA)
|
||||||
|
@echo "Confidential: no" >> $(METADATA)
|
||||||
|
@echo "Destructive: no" >> $(METADATA)
|
||||||
|
@echo "Releases: -Fedora29" >> $(METADATA)
|
||||||
|
rhts-lint $(METADATA)
|
||||||
10
tests/sanity-tests/iperf3d.service
Normal file
10
tests/sanity-tests/iperf3d.service
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=iperf3d tests for ipset
|
||||||
|
After=multi-user.target network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
ExecStart=/usr/bin/iperf3 -s -d --bind 192.168.225.32 --port 55555 -V
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
140
tests/sanity-tests/runtest.sh
Executable file
140
tests/sanity-tests/runtest.sh
Executable file
@ -0,0 +1,140 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# SPDX-License-Identifier: LGPL-2.1+
|
||||||
|
# ~~~
|
||||||
|
# runtest.sh of ipset
|
||||||
|
# Description: ipset tests.
|
||||||
|
#
|
||||||
|
# Author: Susant Sahani <susant@redhat.com>
|
||||||
|
# Copyright (c) 2018 Red Hat, Inc.
|
||||||
|
# ~~~
|
||||||
|
|
||||||
|
# Include Beaker environment
|
||||||
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||||
|
|
||||||
|
PACKAGE="ipset"
|
||||||
|
|
||||||
|
SERVICE_UNITDIR="/var/run/systemd/system"
|
||||||
|
|
||||||
|
rlJournalStart
|
||||||
|
rlPhaseStartSetup
|
||||||
|
rlAssertRpm $PACKAGE
|
||||||
|
rlAssertRpm kernel-modules-extra-$(uname -r)
|
||||||
|
rlRun "systemctl stop firewalld" 0,5
|
||||||
|
|
||||||
|
rlRun "[ -e /sys/class/net/veth-test ] && ip link del veth-test" 0,1
|
||||||
|
|
||||||
|
rlRun "cp iperf3d.service $SERVICE_UNITDIR"
|
||||||
|
rlRun "systemctl daemon-reload"
|
||||||
|
|
||||||
|
rlRun "ip link add veth-test type veth peer name veth-peer"
|
||||||
|
rlRun "ip link set veth-test addr 02:01:02:03:04:08"
|
||||||
|
rlRun "ip link set veth-peer addr 02:01:02:03:04:09"
|
||||||
|
rlRun "ip addr add 192.168.225.32/24 dev veth-test"
|
||||||
|
rlRun "ip addr add 192.168.225.33/24 dev veth-peer"
|
||||||
|
rlRun "ip link set veth-test up"
|
||||||
|
rlRun "ip link set veth-peer up"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_bitmap_ip_netfilter"
|
||||||
|
rlRun "ipset create testnetiperf hash:ip"
|
||||||
|
rlRun "ipset add testnetiperf 192.168.225.32"
|
||||||
|
rlRun "ipset add testnetiperf 192.168.225.33"
|
||||||
|
rlRun "ipset test testnetiperf 192.168.225.32"
|
||||||
|
rlRun "ipset test testnetiperf 192.168.225.33"
|
||||||
|
rlRun "systemctl start iperf3d.service"
|
||||||
|
sleep 1
|
||||||
|
rlRun "iperf3 -c 192.168.225.32 -p 55555 --connect-timeout 5"
|
||||||
|
rlRun "iptables -I INPUT -m set --match-set testnetiperf src -j DROP"
|
||||||
|
rlRun "iperf3 -c 192.168.225.32 -p 55555 --connect-timeout 5" 1
|
||||||
|
rlRun "systemctl stop iperf3d.service"
|
||||||
|
rlRun "iptables --delete INPUT -m set --match-set testnetiperf src -j DROP"
|
||||||
|
rlRun "ipset destroy testnetiperf"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_add_bitmap_ip"
|
||||||
|
rlRun "ipset create testnet hash:ip"
|
||||||
|
rlRun "ipset add testnet 192.168.11.12"
|
||||||
|
rlRun "ipset add testnet 192.168.11.13"
|
||||||
|
rlRun "ipset add testnet 192.168.11.14"
|
||||||
|
rlRun "ipset add testnet 192.168.11.15"
|
||||||
|
rlRun "ipset test testnet 192.168.11.12"
|
||||||
|
rlRun "ipset test testnet 192.168.11.13"
|
||||||
|
rlRun "ipset test testnet 192.168.11.14"
|
||||||
|
rlRun "ipset test testnet 192.168.11.15"
|
||||||
|
rlRun "ipset destroy testnet"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_delete_bitmap_ip"
|
||||||
|
rlRun "ipset create testnet hash:ip"
|
||||||
|
rlRun "ipset add testnet 192.168.11.12"
|
||||||
|
rlRun "ipset add testnet 192.168.11.13"
|
||||||
|
rlRun "ipset test testnet 192.168.11.12"
|
||||||
|
rlRun "ipset test testnet 192.168.11.13"
|
||||||
|
rlRun "ipset del testnet 192.168.11.12"
|
||||||
|
rlRun "ipset test testnet 192.168.11.12" 1
|
||||||
|
rlRun "ipset destroy testnet"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_hash_bitmap_mac"
|
||||||
|
rlRun "ipset create testmac hash:mac"
|
||||||
|
rlRun "ipset add testmac 02:01:02:03:04:09"
|
||||||
|
rlRun "ipset test testmac 02:01:02:03:04:09"
|
||||||
|
rlRun "ipset del testmac 02:01:02:03:04:09"
|
||||||
|
rlRun "ipset test testmac 02:01:02:03:04:09" 1
|
||||||
|
rlRun "ipset destroy testmac"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_hash_bitmap_ipport"
|
||||||
|
rlRun "ipset create testipport hash:ip,mac"
|
||||||
|
rlRun "ipset add testipport 1.1.1.1,02:01:02:03:04:09"
|
||||||
|
rlRun "ipset test testipport 1.1.1.1,02:01:02:03:04:09"
|
||||||
|
rlRun "ipset del testipport 1.1.1.1,02:01:02:03:04:09"
|
||||||
|
rlRun "ipset test testipport 1.1.1.1,02:01:02:03:04:09" 1
|
||||||
|
rlRun "ipset destroy testipport"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_hash_bitmap_ipport"
|
||||||
|
rlRun "ipset create testipport hash:ip,port"
|
||||||
|
rlRun "ipset add testipport 192.168.1.1,udp:53"
|
||||||
|
rlRun "ipset add testipport 192.168.1.1,5555"
|
||||||
|
rlRun "ipset test testipport 192.168.1.1,udp:53"
|
||||||
|
rlRun "ipset test testipport 192.168.1.1,5555"
|
||||||
|
rlRun "ipset del testipport 192.168.1.1,5555"
|
||||||
|
rlRun "ipset test testipport 192.168.1.1,5555" 1
|
||||||
|
rlRun "ipset destroy testipport"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_hash_bitmap_ipportip"
|
||||||
|
rlRun "ipset create testipportip hash:ip,port,ip"
|
||||||
|
rlRun "ipset add testipportip 192.168.1.1,80,10.0.0.1"
|
||||||
|
rlRun "ipset add testipportip 192.168.1.2,80,10.0.0.2"
|
||||||
|
rlRun "ipset test testipportip 192.168.1.1,80,10.0.0.1"
|
||||||
|
rlRun "ipset test testipportip 192.168.1.1,80,10.0.0.1"
|
||||||
|
rlRun "ipset del testipportip 192.168.1.1,80,10.0.0.1"
|
||||||
|
rlRun "ipset test testipportip 192.168.1.1,80,10.0.0.1" 1
|
||||||
|
rlRun "ipset destroy testipportip"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartTest "test_ipset_hash_bitmap_netiface"
|
||||||
|
rlRun "ipset create testnetiface hash:net,iface"
|
||||||
|
rlRun "ipset add testnetiface 192.168.0/24,veth-test"
|
||||||
|
rlRun "ipset add testnetiface 192.167.0/24,veth-peer"
|
||||||
|
rlRun "ipset test testnetiface 192.168.0/24,veth-test"
|
||||||
|
rlRun "ipset test testnetiface 192.167.0/24,veth-peer"
|
||||||
|
rlRun "ipset del testnetiface 192.168.0/24,veth-test"
|
||||||
|
rlRun "ipset test testnetiface 192.168.0/24,veth-test" 1
|
||||||
|
rlRun "ipset destroy testnetiface"
|
||||||
|
rlPhaseEnd
|
||||||
|
|
||||||
|
rlPhaseStartCleanup
|
||||||
|
rlRun "ip link del veth-test"
|
||||||
|
|
||||||
|
rlRun "rm $SERVICE_UNITDIR/iperf3d.service"
|
||||||
|
rlRun "systemctl daemon-reload"
|
||||||
|
|
||||||
|
rlLog "ipset tests done"
|
||||||
|
rlPhaseEnd
|
||||||
|
rlJournalPrintText
|
||||||
|
rlJournalEnd
|
||||||
|
|
||||||
|
rlGetTestState
|
||||||
14
tests/tests.yml
Normal file
14
tests/tests.yml
Normal file
@ -0,0 +1,14 @@
|
|||||||
|
- hosts: localhost
|
||||||
|
roles:
|
||||||
|
- role: standard-test-beakerlib
|
||||||
|
tags:
|
||||||
|
- classic
|
||||||
|
tests:
|
||||||
|
- sanity-tests
|
||||||
|
required_packages:
|
||||||
|
- ipset
|
||||||
|
- iptables
|
||||||
|
- systemd
|
||||||
|
- iproute
|
||||||
|
- iperf3
|
||||||
|
- kernel-modules-extra
|
||||||
Loading…
Reference in New Issue
Block a user