Created attachment 1270476 [details]
Modified ipset.start-stop script - operates on sets individually
Description of problem:
The ipset service package saves all sets as large monolithic file. Would be better to operate on individual set_name.ipset files in /etc/sysconfig/ipset directory instead of a monolithic ipset file.
This would be more flexible for keeping smaller more dynamic sets up to date without having to save all sets even though they are not being changed.
Saving to and restoring from individual set files rather than monolithic allows each set to be maintained and updated on an individual basis and schedule that is appropriate for each set.
Version-Release number of selected component (if applicable):
100% It's how it works.
Steps to Reproduce:
1. /usr/libexec/ipset/ipset.start-stop save
2. /usr/libexec/ipset/ipset.start-stop start
1. All sets saved to monolithic file.
2. All sets restored from monolithic file.
1. Each set saved to individual file: /etc/sysconfig/ipset/set_name.ipset
2. Each set restored from individual file: /etc/sysconfig/ipset/set_name.ipset
Attached is modified /usr/libexec/ipset/ipset.start-stop script that operates on each set individually.
If an /etc/sysconfig/ipset file exists it will need to be removed or renamed so that the /etc/sysconfig/ipset directory can be created.
Created attachment 1328718 [details]
Modified ipset.start-stop script - operates on sets individually - Update-1
Update for: ipset-service-6.29-1.el7.noarch
Which includes: https://bugzilla.redhat.com/show_bug.cgi?id=1377621
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
Just a few comments:
> Each IP set is saved in an individual file and restored from the same file
> With this update, when running the `ipset` `systemd` service, each IP set is
> saved in its own separate file created under the `/etc/sysconfig/ipset.d/`
When the service is running, sets are not actually saved, sets get saved when the service is stopped, that's why I originally wrote "when IP sets are saved by the `ipset` `systemd` service, a separate file for each set is created [...]".
But you could approximate that with:
when the `ipset` `systemd` service is used, each IP set is saved [...]
> folder. When the `ipset` service is loading the `ipset` configuration, these
I'd go with "loads" here.
> files are also restored from each corresponding set. This feature makes
> maintenance and user configuration of single sets easier.
> Note that using one single file containing all configured set at
This should be "sets".
> `/etc/sysconfig/ipset` is still possible. However, if the `ipset` service is
> configured to save files on the `stop` action, or when the `save` operation is
> explicitly set, this legacy file will be removed, and the contents of all
[...] explicitly "called" or "invoked" ("issued", even) I'd rather say. An operation can't be "set".
> configured sets will be split into different files under
The rest looks good to me!