diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7739a2a --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/ipset-7.11.tar.bz2 diff --git a/.ipset.metadata b/.ipset.metadata new file mode 100644 index 0000000..9007288 --- /dev/null +++ b/.ipset.metadata @@ -0,0 +1 @@ +a10e4e8f0ed2fa540b653d987a93069c0c276f61 SOURCES/ipset-7.11.tar.bz2 diff --git a/SOURCES/0001-Add-deprecation-notice-to-ipset.8.patch b/SOURCES/0001-Add-deprecation-notice-to-ipset.8.patch new file mode 100644 index 0000000..92ba754 --- /dev/null +++ b/SOURCES/0001-Add-deprecation-notice-to-ipset.8.patch @@ -0,0 +1,48 @@ +From e9398b721855f8fbfb30a21d475d0aeb7f85bbe5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 25 Jun 2021 13:47:57 +0200 +Subject: [PATCH] Add deprecation notice to ipset.8 + +This is RHEL9 trying to friendly kick people towards nftables. +--- + src/ipset.8 | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/src/ipset.8 b/src/ipset.8 +index 97cece9fb04b5..d68e9bbc22891 100644 +--- a/src/ipset.8 ++++ b/src/ipset.8 +@@ -51,6 +51,18 @@ COMMANDS := { \fBcreate\fR | \fBadd\fR | \fBdel\fR | \fBtest\fR | \fBdestroy\fR + .PP + \fBipset\fR \fB\-\fR + .SH "DESCRIPTION" ++This tool is ++.B deprecated ++in Red Hat Enterprise Linux. It is maintenance only and will not receive new ++features. New setups should use ++.BR nft (8). ++Existing setups should migrate to ++.BR nft (8) ++when possible. See ++.UR https://red.ht/nft_your_tables ++.UE ++for details. ++.PP + \fBipset\fR + is used to set up, maintain and inspect so called IP sets in the Linux + kernel. Depending on the type of the set, an IP set may store IP(v4/v6) +@@ -1099,8 +1111,9 @@ Bugs? No, just funny features. :\-) + OK, just kidding... + .SH "SEE ALSO" + \fBiptables\fR(8), +-\fBip6tables\fR(8) +-\fBiptables-extensions\fR(8) ++\fBip6tables\fR(8), ++\fBiptables-extensions\fR(8), ++\fBnft\fR(8) + .SH "AUTHORS" + Jozsef Kadlecsik wrote ipset, which is based on ippool by + Joakim Axelsson, Patrick Schaaf and Martin Josefsson. +-- +2.31.1 + diff --git a/SOURCES/ipset.service b/SOURCES/ipset.service new file mode 100644 index 0000000..f4a0802 --- /dev/null +++ b/SOURCES/ipset.service @@ -0,0 +1,18 @@ +[Unit] +Description=IP sets for iptables +Before=iptables.service +Before=ip6tables.service + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ipset/ipset.start-stop start +ExecStop=/usr/libexec/ipset/ipset.start-stop stop +ExecReload=/usr/libexec/ipset/ipset.start-stop reload +# Save current ipset entries on stop/restart. +# Value: yes|no, default: no +# Saves all ipsets to /etc/ipset/ipset if ipset gets stopped +Environment=IPSET_SAVE_ON_STOP=no IPSET_SAVE_ON_RESTART=no + +[Install] +WantedBy=basic.target diff --git a/SOURCES/ipset.start-stop b/SOURCES/ipset.start-stop new file mode 100644 index 0000000..da21890 --- /dev/null +++ b/SOURCES/ipset.start-stop @@ -0,0 +1,209 @@ +#!/bin/bash +# +# ipset Start and stop ipset firewall sets +# +# config: /etc/ipset/ipset +# + +IPSET=ipset +IPSET_BIN=/usr/sbin/${IPSET} +IPSET_DATA=/etc/${IPSET}/${IPSET} + +IPTABLES_CONFIG=/etc/sysconfig/iptables-config +IP6TABLES_CONFIG=${IPTABLES_CONFIG/iptables/ip6tables} + +TMP_FIFO=/tmp/${IPSET}.$$ + +if [[ ! -x ${IPSET_BIN} ]]; then + echo "${IPSET_BIN} does not exist." + exit 5 +fi + +CLEAN_FILES=TMP_FIFO +trap "rm -f \$CLEAN_FILES" EXIT + +# Default ipset configuration: +[[ -z $IPSET_SAVE_ON_STOP ]] && IPSET_SAVE_ON_STOP=no # Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_STOP +[[ -z $IPSET_SAVE_ON_RESTART ]] && IPSET_SAVE_ON_RESTART=no # Overridden by ip(6)tables IP(6)TABLES_SAVE_ON_RESTART + +# Load iptables configuration(s) +[[ -f "$IPTABLES_CONFIG" ]] && . "$IPTABLES_CONFIG" +[[ -f "$IP6TABLES_CONFIG" ]] && . "$IP6TABLES_CONFIG" + +# It doesn't make sense to save iptables config and not our config +[[ ${IPTABLES_SAVE_ON_STOP} = yes || ${IP6TABLES_SAVE_ON_STOP} = yes ]] && IPSET_SAVE_ON_STOP=yes +[[ ${IPTABLES_SAVE_ON_RESTART} = yes || ${IP6TABLES_SAVE_ON_RESTART} = yes ]] && IPSET_SAVE_ON_RESTART=yes + +check_can_unload() { + # If the xt_set module is loaded and can't be unloaded, then iptables is + # using ipsets, so refuse to stop the service. + if [[ -n $(lsmod | grep "^xt_set ") ]]; then + rmmod xt_set 2>/dev/null + [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && return 1 + fi + + return 0 +} + +flush_n_delete() { + local ret=0 set + + # Flush sets + ${IPSET_BIN} flush + let ret+=$? + + # Delete ipset sets. If we don't do them individually, then none + # will be deleted unless they all can be. + for set in $(${IPSET_BIN} list -name); do + ${IPSET_BIN} destroy 2>/dev/null + [[ $? -ne 0 ]] && ret=1 + done + + return $ret +} + +start_clean() +{ + mkfifo -m go= "${TMP_FIFO}" + [[ $? -ne 0 ]] && return 1 + + # Get the lists of sets in current(old) config and new config + old_sets="$(${IPSET_BIN} list -name | sort -u)" + new_sets="$(grep ^create "${IPSET_DATA}" | cut -d " " -f 2 | sort -u)" + + # List of sets no longer wanted + drop_sets="$( printf "%s\n" "${old_sets}" > "${TMP_FIFO}" & + printf "%s\n" "${new_sets}" | comm -23 "${TMP_FIFO}" - + )" + + # Get rid of sets no longer needed + # Unfortunately -! doesn't work for destroy, so we have to do it a command at a time + for dset in $drop_sets; do + ipset destroy $dset 2>/dev/null + # If it won't go - ? in use by iptables, just clear it + [[ $? -ne 0 ]] && ipset flush $dset + done + + # Now delete the set members no longer required + ${IPSET_BIN} save | grep "^add " | sort >${TMP_FIFO} & + grep "^add " ${IPSET_DATA} | sort | comm -23 ${TMP_FIFO} - | sed -e "s/^add /del /" \ + | ${IPSET_BIN} restore -! + + # At last we can add the set members we haven't got + ipset restore -! <${IPSET_DATA} + + rm ${TMP_FIFO} + + return 0 +} + +start() { + # Do not start if there is no config file. + [[ ! -f "$IPSET_DATA" ]] && echo "Loaded with no configuration" && return 0 + + # We can skip the first bit and do a simple load if + # there is no current ipset configuration + res=1 + if [[ -n $(${IPSET_BIN} list -name) ]]; then + # The following may fail for some bizarre reason + start_clean + res=$? + + [[ $res -ne 0 ]] && echo "Some old configuration may remain" + fi + + # res -ne 0 => either start_clean failed, or we didn't need to run it + if [[ $res -ne 0 ]]; then + # This is the easy way to start but would leave any old + # entries still configured. Still, better than nothing - + # but fine if we had no config + ${IPSET_BIN} restore -! <${IPSET_DATA} + res=$? + fi + + if [[ $res -ne 0 ]]; then + return 1 + fi + + return 0 +} + +stop() { + # Nothing to stop if ip_set module is not loaded. + lsmod | grep -q "^ip_set " + [[ $? -ne 0 ]] && return 6 + + flush_n_delete + [[ $? -ne 0 ]] && echo Warning: Not all sets were flushed/deleted + + return 0 +} + +save() { + # Do not save if ip_set module is not loaded. + lsmod | grep -q "^ip_set " + [[ $? -ne 0 ]] && return 6 + + [[ -z $(${IPSET_BIN} list -name) ]] && return 0 + + ret=0 + TMP_FILE=$(/bin/mktemp -q /tmp/$IPSET.XXXXXX) \ + && CLEAN_FILES+=" $TMP_FILE" \ + && chmod 600 "$TMP_FILE" \ + && ${IPSET_BIN} save > $TMP_FILE 2>/dev/null \ + && [[ -s $TMP_FILE ]] \ + || ret=1 + + if [[ $ret -eq 0 ]]; then + # No need to do anything if the files are the same + if [[ ! -f $IPSET_DATA ]]; then + mv $TMP_FILE $IPSET_DATA && chmod 600 $IPSET_DATA || ret=1 + else + diff -q $TMP_FILE $IPSET_DATA >/dev/null + + if [[ $? -ne 0 ]]; then + if [[ -f $IPSET_DATA ]]; then + cp -f --preserve=timestamps $IPSET_DATA $IPSET_DATA.save \ + && chmod 600 $IPSET_DATA.save \ + || ret=1 + fi + if [[ $ret -eq 0 ]]; then + cp -f --preserve=timestamps $TMP_FILE $IPSET_DATA \ + && chmod 600 $IPSET_DATA \ + || ret=1 + fi + fi + fi + fi + + rm -f $TMP_FILE + return $ret +} + + +case "$1" in + start) + start + RETVAL=$? + ;; + stop) + check_can_unload || exit 1 + [[ $IPSET_SAVE_ON_STOP = yes ]] && save + stop + RETVAL=$? + [[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0 + ;; + reload) + [[ $IPSET_SAVE_ON_RESTART = yes ]] && save + stop + RETVAL=$? + [[ $RETVAL -eq 6 ]] && echo "${IPSET}: not running" && exit 0 + start + RETVAL=$? + ;; + *) + echo "Usage: $IPSET {start|stop|reload}" >&2 + exit 1 +esac + +exit $RETVAL diff --git a/SPECS/ipset.spec b/SPECS/ipset.spec new file mode 100644 index 0000000..b323775 --- /dev/null +++ b/SPECS/ipset.spec @@ -0,0 +1,318 @@ +Name: ipset +Version: 7.11 +Release: 5%{?dist} +Summary: Manage Linux IP sets + +License: GPLv2 +URL: http://ipset.netfilter.org/ +Source0: %{url}/%{name}-%{version}.tar.bz2 +Source1: %{name}.service +Source2: %{name}.start-stop + +Patch1: 0001-Add-deprecation-notice-to-ipset.8.patch + +BuildRequires: libmnl-devel +BuildRequires: automake +BuildRequires: autoconf +BuildRequires: make +BuildRequires: libtool +BuildRequires: libtool-ltdl-devel + +# An explicit requirement is needed here, to avoid cases where a user would +# explicitly update only one of the two (e.g 'yum update ipset') +Requires: %{name}-libs%{?_isa} = %{version}-%{release} + +%description +IP sets are a framework inside the Linux kernel since version 2.4.x, which can +be administered by the ipset utility. Depending on the type, currently an IP +set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC +addresses in a way, which ensures lightning speed when matching an entry +against a set. + +If you want to: + - store multiple IP addresses or port numbers and match against the collection + by iptables at one swoop; + - dynamically update iptables rules against IP addresses or ports without + performance penalty; + - express complex IP address and ports based rulesets with one single iptables + rule and benefit from the speed of IP sets +then ipset may be the proper tool for you. + + +%package libs +Summary: Shared library providing the IP sets functionality + +%description libs +This package contains the libraries which provide the IP sets funcionality. + + +%package devel +Summary: Development files for %{name} +Requires: %{name}-libs%{?_isa} == %{version}-%{release} +Requires: kernel-headers + +%description devel +This package contains the files required to develop software using the %{name} +libraries. + + +%package service +Summary: %{name} service for %{name}s +Requires: %{name} = %{version}-%{release} +BuildRequires: systemd +Requires: iptables-services +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +BuildArch: noarch + +%description service +This package provides the service %{name} that is split +out of the base package since it is not active by default. + + +%prep +%autosetup -p1 + + +%build +./autogen.sh +%configure --enable-static=no --with-kmod=no + +# Just to make absolutely sure we are not building the bundled kernel module +# I have to do it after the configure run unfortunately +rm -fr kernel + +# Prevent libtool from defining rpath +sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool +sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool + +%make_build + + +%install +%make_install +find %{buildroot} -name '*.la' -exec rm -f '{}' \; + +# install systemd unit file +install -d -m 755 %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE1} %{buildroot}/%{_unitdir} + +# install supporting script +install -d -m 755 %{buildroot}%{_libexecdir}/%{name} +install -c -m 755 %{SOURCE2} %{buildroot}%{_libexecdir}/%{name} + +# Create directory for configuration +mkdir -p %{buildroot}%{_sysconfdir}/%{name} + + +%preun +if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then + rmmod xt_set 2>/dev/null + [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && exit 1 +fi + + +%ldconfig_scriptlets libs + + +%post service +%systemd_post %{name}.service + +%preun service +if [[ $1 -eq 0 && -n $(lsmod | grep "^xt_set ") ]]; then + rmmod xt_set 2>/dev/null + [[ $? -ne 0 ]] && echo Current iptables configuration requires ipsets && exit 1 +fi +%systemd_preun %{name}.service + +%postun service +%systemd_postun_with_restart %{name}.service + + +%files +%doc ChangeLog +%license COPYING +%{_mandir}/man8/%{name}.8.* +%{_sbindir}/%{name} + +%files libs +%license COPYING +%{_libdir}/lib%{name}.so.13* + +%files devel +%{_includedir}/lib%{name} +%{_libdir}/lib%{name}.so +%{_libdir}/pkgconfig/lib%{name}.pc +%{_mandir}/man3/libipset.3.* + +%files service +%{_unitdir}/%{name}.service +%dir %{_libexecdir}/%{name} +%attr(0755,root,root) %{_libexecdir}/%{name}/%{name}.start-stop +%dir %{_sysconfdir}/%{name} + + +%changelog +* Mon Aug 09 2021 Mohan Boddu - 7.11-5 +- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags + Related: rhbz#1991688 + +* Fri Jul 02 2021 Phil Sutter - 7.11-4 +- Improve deprecation notice a bit + +* Fri Jun 25 2021 Phil Sutter - 7.11-3 +- Add deprecation notice to ipset.8 + +* Fri Apr 16 2021 Mohan Boddu - 7.11-2 +- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + +* Mon Mar 01 2021 Nicolas Chauvet - 7.11-1 +- Update to 7.11 + +* Tue Jan 26 2021 Fedora Release Engineering - 7.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Mon Dec 21 2020 Nicolas Chauvet - 7.10-1 +- Update to 7.10 + +* Wed Dec 16 2020 Nicolas Chauvet - 7.9-1 +- Update to 7.9 + +* Tue Jul 28 2020 Fedora Release Engineering - 7.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Feb 24 2020 Nicolas Chauvet - 7.6-1 +- Update to 7.6 + +* Wed Jan 29 2020 Fedora Release Engineering - 7.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Jan 10 2020 Nicolas Chauvet - 7.5-1 +- Update to 7.5 + +* Mon Nov 04 2019 Eric Garver - 7.4-1 +- Update to 7.4 + +* Mon Aug 19 2019 Nicolas Chauvet - 7.3-1 +- Update to 7.3 + +* Thu Jul 25 2019 Fedora Release Engineering - 7.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu Jul 11 2019 Nicolas Chauvet - 7.2-1 +- Update to 7.2 + +* Fri Feb 01 2019 Fedora Release Engineering - 6.38-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Aug 13 2018 Nicolas Chauvet - 6.38-1 +- Update to 6.38 +- Clean-up spec + +* Fri Jul 13 2018 Fedora Release Engineering - 6.35-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Mon Feb 12 2018 Eric Garver - 6.35-3 +- Patch for missing header file (RHBZ#1543596) + +* Wed Feb 07 2018 Fedora Release Engineering - 6.35-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Jan 08 2018 Nicolas Chauvet - 6.35-1 +- Update to 6.35 + +* Mon Jul 31 2017 Nicolas Chauvet - 6.32-1 +- Update to 6.32 + +* Wed Jul 26 2017 Fedora Release Engineering - 6.29-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Apr 07 2017 Nicolas Chauvet - 6.29-3 +- Userspace needs kernel-headers - rhbz#1420864 + +* Fri Feb 10 2017 Fedora Release Engineering - 6.29-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Mon Apr 18 2016 Thomas Woerner - 6.29-1 +- New upstream version 6.29 (RHBZ#1317208) + - Suppress unnecessary stderr in command loop for resize and list + - Correction in comment test + - Support chroot buildroots (reported by Jan Engelhardt) + - Fix "configure" breakage due to pkg-config related changes + (reported by Jan Engelhardt) + - Support older pkg-config packages + - Add bash completion to the install routine (Mart Frauenlob) + - Fix misleading error message with comment extension + - Test added to check 0.0.0.0/0,iface to be matched in hash:net,iface type + - Fix link with libtool >= 2.4.4 (Olivier Blin) + +* Thu Feb 04 2016 Fedora Release Engineering - 6.27-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Tue Nov 10 2015 Thomas Woerner - 6.27-1 +- New upstream version 6.27 (RHBZ#1145913) + +* Sat Oct 10 2015 Haïkel Guémar - 6.26-1 +- Upstream 6.26 (RHBZ#1145913) + +* Wed Jun 17 2015 Fedora Release Engineering - 6.22-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Thu Sep 18 2014 Mathieu Bridon - 6.22-1 +- New upstream release. + +* Sat Aug 16 2014 Fedora Release Engineering - 6.21.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Sat Jun 07 2014 Fedora Release Engineering - 6.21.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Tue Mar 11 2014 Mathieu Bridon - 6.21.1-2 +- Remove runtime requirement on the kernel. + https://lists.fedoraproject.org/pipermail/devel/2014-March/196565.html + +* Tue Oct 29 2013 Mathieu Bridon - 6.20.1-1 +- New upstream release. + +* Tue Aug 27 2013 Quentin Armitage 6.19-2 +- Add service pkg - adds save and reload functionality on shutdown/startup +- Add requires dependency of ipset on matching ipset-libs + +* Thu Aug 15 2013 Mathieu Bridon - 6.19-1 +- New upstream release. + +* Sat Aug 03 2013 Fedora Release Engineering - 6.16.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Thu Feb 14 2013 Fedora Release Engineering - 6.16.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Wed Sep 26 2012 Mathieu Bridon - 6.16.1-1 +- New upstream release. +- Fix a requirement. + +* Wed Sep 26 2012 Mathieu Bridon - 6.14-1 +- New upstream release. +- Fix scriptlets, ldconfig is needed for the libs subpackage, not the main one. + +* Mon Jul 30 2012 Mathieu Bridon - 6.13-1 +- New upstream release. +- Split out the library in its own subpackage. + +* Thu Jul 19 2012 Fedora Release Engineering - 6.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Mon Feb 06 2012 Mathieu Bridon - 6.11-1 +- New upstream release. +- Removed our patch, it has been integrated upstream. As such, we also don't + need to re-run autoreconf any more. + +* Fri Jan 13 2012 Fedora Release Engineering - 6.9.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Fri Sep 16 2011 Mathieu Bridon - 6.9.1-2 +- Some fixes based on Pierre-Yves' review feedback. + +* Wed Sep 14 2011 Mathieu Bridon - 6.9.1-1 +- Initial packaging.