ipset-6.9.1: 3.0.4 kernel tests failure

ipset-6.9.1: 3.0.4 kernel tests failure

[Peter Volkov]

Hi. I've ran ipset-6.9.1 test suite on 3.0.4 kernel and it failed:

bitmap:ip: Network: Create a set from a valid network with timeout:
passed
bitmap:ip: Network: Add lower boundary: FAILED
Failed test: ../src/ipset 2>.foo.err add test 2.0.0.0 timeout 0
ipset v6.9.1: Element is out of the range of the set

Is this expected? ipset-6.8 has the same problem.

BTW, in general is it better to use in-kernel modules or kernel modules
bundled with ipset? Personally I'd better pushed required patches into
our kernels and suggested users to use them, but where it's better to
pull such patches from?

Thank you in advance.

--
Peter.

Re: ipset-6.9.1: 3.0.4 kernel tests failure

[Mr Dash Four]

> BTW, in general is it better to use in-kernel modules or kernel modules
> bundled with ipset? Personally I'd better pushed required patches into
> our kernels and suggested users to use them, but where it's better to
> pull such patches from?
>   
My own personal preference since last year has been to integrate the 
kernel modules as part of the kernel built and then use modified .spec 
file to build ipset (the userspace executable).

There are a couple of reasons for this, not least because every time I 
need to build/change the kernel (and that happens more often than 
building ipset - at least in my case, as I am testing different things 
in the kernel for different machines at one time) I have to reinstall 
the buildsys packages (I use Fedora) and tailor them for the new kernel 
in order to allow ipset kernel modules to be built, then rebuild ipset 
(userspace) as well - too much hassle.

What I do to avoid all that is create a patch based on the ipset kernel 
module sources as well as the ipset Kconfig/Kbuild menu options and then 
integrate that patch as part of the kernel built. That has never failed 
except the last time with the above version of ipset, but Jozsef 
provided a quick work-around and I am happy with it - it works!

Re: ipset-6.9.1: 3.0.4 kernel tests failure

[Jozsef Kadlecsik]

On Mon, 19 Sep 2011, Peter Volkov wrote:

> Hi. I've ran ipset-6.9.1 test suite on 3.0.4 kernel and it failed:
> 
> bitmap:ip: Network: Create a set from a valid network with timeout:
> passed
> bitmap:ip: Network: Add lower boundary: FAILED
> Failed test: ../src/ipset 2>.foo.err add test 2.0.0.0 timeout 0
> ipset v6.9.1: Element is out of the range of the set
> 
> Is this expected? ipset-6.8 has the same problem.

The testsuite always verifies the most recent ipset package (there is no 
version-dependent tests). Unfortunately a lot of fixes were committed in 
the 3.1 tree and are missing from the 3.0 tree :-(, so checking 3.0.x
with the testsuite surely fails.

> BTW, in general is it better to use in-kernel modules or kernel modules
> bundled with ipset? Personally I'd better pushed required patches into
> our kernels and suggested users to use them, but where it's better to
> pull such patches from?

Due to the different merge levels it takes some time when the patches 
finally can land in the mainline kernel.

I always send the patches to netfilter-devel mailing list, so you can pull 
them there. I can even add your address to the list of recipients if you 
think it's better for you.

The ipset git tree can be used as well, however it's meant to carry the 
ipset package with support from 2.6.35 up to the most recent kernels, so 
the source code contains kernel version dependent parts. But that's the 
only difference compared to the source code when it's submitted and merged 
into the kernel.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary