<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - 'ipset save' does not save in format loadable by systemd (it saves in 'ipset list' format)"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1750">1750</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>'ipset save' does not save in format loadable by systemd (it saves in 'ipset list' format)
</td>
</tr>
<tr>
<th>Product</th>
<td>ipset
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>default
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>drankinatty@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=741" name="attach_741" title="ipset save output snippet from '# ipset save'">attachment 741</a> <a href="attachment.cgi?id=741&action=edit" title="ipset save output snippet from '# ipset save'">[details]</a></span>
ipset save output snippet from '# ipset save'
This is a bug report submitted at the request of Archlinux to ipset upstream.
See corresponding Archlinux issue:
<a href="https://gitlab.archlinux.org/archlinux/packaging/packages/ipset/-/issues/2">https://gitlab.archlinux.org/archlinux/packaging/packages/ipset/-/issues/2</a>
The current problem is simple. The `ipset save' command is not provided the
'save' format that is loadable by systemd when the system is started. Instead,
it 'ipset save' mirrors the format provided by `ipset list'` which cannot be
loaded by systemd to restore the ipsets at boot (or iptables stop/start, etc..)
This does not match the documentation provided in man 8 ipset. There is a
rather odd workaround that can produce the proper save format. That is to use
the command:
ipset -o save save > /etc/ipset.conf
To say it is rather confusing to have to use `ipset -o save save' instead of
the documented 'ipset save' (or to derive that workaround from the man page) is
an understatement. Sample output for the current 'ipset save' and the correct
output produced by 'ipset -o save save' is provided in the Archlinux gitlab
issue and an example is provided as an attachment here.
The bug is fairly self-explanatory. The 'ipset save' format wire got somehow
crossed with the 'ipset list' format wire and that prevents 'ipset save' from
outputting the proper format that can be used to create and restore the ipsets
on start.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>