similar to: CEBA-2018:3670 CentOS 7 ipset BugFix Update

I want to use the ipset-service to store ipsets persistently across boots. (For use by iptables rules. firewalld has direct support for persistent ipsets but I need the more general capability of raw iptables.) I'm using a kernel with ipsets compiled in, rather than loaded as a module. The support script that saves ipsets checks if the module is loaded before saving and finds nothing, so

https://bugzilla.netfilter.org/show_bug.cgi?id=1750 Bug ID: 1750 Summary: 'ipset save' does not save in format loadable by systemd (it saves in 'ipset list' format) Product: ipset Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: normal

http://bugzilla.netfilter.org/show_bug.cgi?id=640 Summary: ipset-4.2 : ipset -T <some_setlist> <address> always negative Product: ipset Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: P1 Component: default AssignedTo:

-------- Original Message -------- Subject: Re: [CentOS] ipset and blacklisting From: "Albert McCann" <mac358 at newsguy.com> Date: Wed, September 21, 2016 5:34 am To: "'CentOS mailing list'" <centos at centos.org> How are you saving and reloading the ipsets over a reboot? > -----Original Message----- > From: centos-bounces at centos.org

https://bugzilla.netfilter.org/show_bug.cgi?id=1081 Bug ID: 1081 Summary: /tmp/ccKT2Q7s.o: In function `help': ipset.c:(.text+0x27c): undefined reference to `ipset_envopts' Product: ipset Version: unspecified Hardware: i386 OS: Ubuntu Status: NEW Severity:

Hi all I have a CentOS6 box with shorewall-4.5.21. If I have IPSET= in shorewall.conf and I issue the command "shorewall add ppp:192.168.33.3 ptp", I get the error: /usr/share/shorewall/lib.cli: line 585: [: too many arguments ERROR: Zone ptp, interface ppp does not have a dynamic host list The error is corrected setting the actual path to ipset in shorewall.conf, or via the patch:

http://bugzilla.netfilter.org/show_bug.cgi?id=783 Summary: ipset fails to parse port names with hyphen for bitmap:port type Product: ipset Version: unspecified Platform: All OS/Version: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: default AssignedTo:

ipset on CentOS6 comes with /etc/rc.d/init.d/ipset so that "service ipset reload" can be used to (re)load the configuration. CentOS7 doesn't come with an equivalent for systemd: # systemctl reload ipset.service Failed to issue method call: Unit ipset.service failed to load: No such file or directory. # systemctl start ipset.service Failed to issue method call: Unit ipset.service

https://bugzilla.netfilter.org/show_bug.cgi?id=843 Summary: ipset swap doesn't behave as expected Product: ipset Version: unspecified Platform: All OS/Version: All Status: NEW Severity: minor Priority: P5 Component: default AssignedTo: netfilter-buglog at lists.netfilter.org ReportedBy:

https://bugzilla.netfilter.org/show_bug.cgi?id=1285 Bug ID: 1285 Summary: ipset sorting does not work Product: ipset Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 Component: default Assignee: netfilter-buglog at lists.netfilter.org

https://bugzilla.netfilter.org/show_bug.cgi?id=1258 Bug ID: 1258 Summary: ipset save can result in add ... timeout 0 line Product: ipset Version: unspecified Hardware: All OS: All Status: NEW Severity: minor Priority: P5 Component: default Assignee: netfilter-buglog at

On 18/02/15 10:47, Tom Limoncelli wrote: > ipset on CentOS6 comes with /etc/rc.d/init.d/ipset so that "service > ipset reload" can be used to (re)load the configuration. CentOS7 > doesn't come with an equivalent for systemd: <snip> >From my Fedora 21 box, I'm *presuming* it's available on C7, I don't have a C7 box to try it on though. $rpm -ql

https://bugzilla.netfilter.org/show_bug.cgi?id=1719 Bug ID: 1719 Summary: ipset wrongly blocking undefined ranges and not blocking ranges that are defined Product: ipset Version: unspecified Hardware: All OS: RedHat Linux Status: NEW Severity: critical Priority: P5

I've just started experimenting with ipset under CentOS 6, and have found what appears to be a bug (or poor design) in the init scripts for ipset, /etc/rc.d/init.d/ipset In stop(), save() and status(), it does lsmod to check for the existence of the ip_set module. If the module is not found, it exits without performing any action. This doesn't take account of a kernel where the ip_set

https://bugzilla.netfilter.org/show_bug.cgi?id=1369 Bug ID: 1369 Summary: ipset save|list -sorted sorts alphabetically instead of naturally Product: ipset Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: enhancement Priority: P5 Component: default

On Tue, Feb 17, 2015 at 7:17 PM, Peter Lawler <centos at bleeter.id.au> wrote: > From my Fedora 21 box, I'm *presuming* it's available on C7, I don't > have a C7 box to try it on though. > > $rpm -ql "ipset-service" > /etc/ipset > /usr/lib/systemd/system/ipset.service > /usr/libexec/ipset > /usr/libexec/ipset/ipset.start-stop Sadly there is no

https://bugzilla.netfilter.org/show_bug.cgi?id=1726 Bug ID: 1726 Summary: invalid json generated by ipset list -output json Product: ipset Version: unspecified Hardware: x86_64 OS: Debian GNU/Linux Status: NEW Severity: trivial Priority: P5 Component: default Assignee:

https://bugzilla.netfilter.org/show_bug.cgi?id=880 Summary: ipset doesn't refresh the timeout for an existing entry when the table is FULL. Product: ipset Version: unspecified Platform: x86_64 OS/Version: Fedora Status: NEW Severity: normal Priority: P5 Component: default

i created an ipset and added 8.8.8.8 to it and used the same iptables working all summer long but ?i can still ping 8.8.8.8 and do nslookup queries against it. ipset or iptables is broken. Anybody else rebooted since ipset-6.11-3.el6.i686 was installed and actually tested that IP addresses that are supposed to be blacklisted are actually blocked? ? Filed CentOS bug report 7977

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=485 Summary: Stresstesting ipset crashes kernel Product: ipset Version: 2.2.8 Platform: x86_64 OS/Version: RedHat Linux Status: NEW Severity: major Priority: P2 Component: default AssignedTo: kadlec@netfilter.org ReportedBy: