ipset: hash:*net* doesnt match after entry removal (both inet, inet6 families)
From: Sergey Popovich <hidden>
Date: 2013-06-20 12:16:04
Hello! Deploying ip6?tables filtering rules on one of our server we spot following issue using Linux kernel 3.9.6 and ipset 6.19 as userlang and hash:*set* set type: Deleting previously added network prefix longer than any prefix, that already in set, causes future lookups on remaining prefixes not to match (both using ipset(8) test command and ip6?tables(8) "set" match, on any hash:*net* set type). Tested on the following configurations: 1. v3.9.6, ipset 6.19 (also 6.12.1) : reproduced 2. v3.8.13(EOL), ipset 6.12.1 : reproduced 3. v3.2.46, ipset 6.12.1 : not reproducable Both IPv4 and IPv6 are affected. Steps to reproduce (using ipset(8) test command for simplicity): -------------------------------------------------------------------------------- #!/bin/bash -v ## Create ipset for inet AFI ipset create set-v4 hash:net family inet ## Add 192.168.1.0/24 prefix to set and check ipset add set-v4 192.168.1.0/24 ipset test set-v4 192.168.1.0 192.168.1.0 is in set set-v4. ipset test set-v4 192.168.1.255 192.168.1.255 is in set set-v4. ## Add 172.16.1.0/25 prefix to set and check ipset add set-v4 172.16.1.0/25 ipset test set-v4 192.168.1.0 192.168.1.0 is in set set-v4. ipset test set-v4 192.168.1.255 192.168.1.255 is in set set-v4. ipset test set-v4 172.16.1.0 172.16.1.0 is in set set-v4. ipset test set-v4 172.16.1.127 172.16.1.127 is in set set-v4. ## List set-v4 contents ipset list set-v4 Name: set-v4 Type: hash:net Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16824 References: 0 Members: 172.16.1.0/25 192.168.1.0/24 ## Delete longer (more specific) prefix from the set ipset del set-v4 172.16.1.0/25 ## And test again remaining prefixes ipset test set-v4 192.168.1.0 192.168.1.0 is NOT in set set-v4. ipset test set-v4 192.168.1.255 192.168.1.255 is NOT in set set-v4. ## List set-v4 contents ipset list set-v4 Name: set-v4 Type: hash:net Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16824 References: 0 Members: 192.168.1.0/24 ## Destroy set-v4 ipset destroy set-v4 -- SP5474-RIPE Sergey Popovich