saltstack / saltstack/salt

[BUG] ipset.present does not work with type hash:ip,port

Open
#59,318 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description of Issue

When trying to use the ipset.present state with set type type hash:ip,port it will present an error:

          ID: test_entries
    Function: ipset.present
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "/usr/lib/python3/dist-packages/salt/state.py", line 2154, in call
                  *cdata["args"], **cdata["kwargs"]
                File "/usr/lib/python3/dist-packages/salt/loader.py", line 2106, in wrapper
                  return f(*args, **kwargs)
                File "/usr/lib/python3/dist-packages/salt/states/ipset.py", line 196, in present
                  if __salt__["ipset.check"](kwargs["set_name"], _entry, family) is True:
                File "/usr/lib/python3/dist-packages/salt/modules/ipset.py", line 587, in check
                  current_members = _parse_members(settype, _find_set_members(set))
                File "/usr/lib/python3/dist-packages/salt/modules/ipset.py", line 732, in _parse_members
                  return [_parse_member(settype, member) for member in members]
                File "/usr/lib/python3/dist-packages/salt/modules/ipset.py", line 732, in <listcomp>
                  return [_parse_member(settype, member) for member in members]
                File "/usr/lib/python3/dist-packages/salt/modules/ipset.py", line 760, in _parse_member
                  part = int(part)
              ValueError: invalid literal for int() with base 10: 'udp:443'
     Started: 04:31:41.663318
    Duration: 51.663 ms
     Changes:   

It looks like the first entry does get added.

Setup

ipset.sls:

test_set:
  ipset.set_present:
    - set_type: hash:ip,port
    - family: ipv4

test_entries:
  ipset.present:
    - set_name: test_set
    - entry:
      - 127.0.0.1,udp:443
      - 127.0.0.2,udp:443
    - family: ipv4
    - require:
      - ipset: test_set
Steps to Reproduce Issue

Run the above state.

test=True works as expected:

local:
----------
          ID: test_set
    Function: ipset.set_present
      Result: None
     Comment: ipset set test_set would be added for ipv4
     Started: 04:26:44.674001
    Duration: 13.651 ms
     Changes:   
----------
          ID: test_entries
    Function: ipset.present
      Result: None
     Comment: entry 127.0.0.1,udp:443 would be added to set test_set for family ipv4
              entry 127.0.0.2,udp:443 would be added to set test_set for family ipv4
     Started: 04:26:44.688672
    Duration: 15.275 ms
     Changes:   

Adding these entries manually work as expected:

user@minion:~$ sudo ipset add test_set 127.0.0.2,udp:443
user@minion:~$ sudo ipset list
Name: test_set
Type: hash:ip,port
Revision: 5
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 320
References: 0
Number of entries: 2
Members:
127.0.0.1,udp:443
127.0.0.2,udp:443
Versions Report

Minion:

# sudo salt-call --local --versions-report
Salt Version:
          Salt: 3002.2
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.7.3
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 0.5.6
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.6.1
        pygit2: Not Installed
        Python: 3.7.3 (default, Jul 25 2020, 13:03:44)
  python-gnupg: Not Installed
        PyYAML: 3.13
         PyZMQ: 17.1.2
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.1
 
System Versions:
          dist: debian 10 buster
        locale: utf-8
       machine: x86_64
       release: 5.9.0-0.bpo.5-amd64
        system: Linux
       version: Debian GNU/Linux 10 buster

Master:

# salt --versions-report
Salt Version:
          Salt: 3002.2
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.7.3
     docker-py: Not Installed
         gitdb: 2.0.5
     gitpython: 2.1.11
        Jinja2: 2.10
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 0.5.6
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.6.1
        pygit2: Not Installed
        Python: 3.7.3 (default, Jul 25 2020, 13:03:44)
  python-gnupg: Not Installed
        PyYAML: 3.13
         PyZMQ: 17.1.2
         smmap: 2.0.5
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.1
 
System Versions:
          dist: debian 10 buster
        locale: utf-8
       machine: x86_64
       release: 4.9.0-14-amd64
        system: Linux
       version: Debian GNU/Linux 10 buster

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/modules/ipset.py at check, _parse_members, and _parse_member, then review the ipset.present call in salt/states/ipset.py. Run the YAML reproduction with type hash:ip,port and verify that existing entries containing udp:443 are parsed and the state completes successfully without the ValueError.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.