ipset: fix bitmap:port entry add failing with invalid protocol

buildEntryData() unconditionally sends IPSET_ATTR_PROTO (defaulting
to TCP) whenever Port is set. For bitmap:port ipsets, this protocol
attribute is not expected and newer kernels reject it with "invalid
protocol".

Decouple Protocol and Port attributes: only send IPSET_ATTR_PROTO
when entry.Protocol is explicitly set. This matches the behavior of
the ipset CLI tool, which does not send protocol for bitmap:port.

Note: callers using hash:ip,port or hash:net,port,net must now
explicitly set entry.Protocol, as the implicit TCP default is removed.

Also add a bitmap:port test case to TestIpsetCreateListAddDelDestroy
and fix the port/protocol assertion to handle nil Protocol.

Fixes #1054

Author: chent1996

ipset_linux.go

@@ -303,13 +303,11 @@ func buildEntryData(entry *IPSetEntry) (*nl.RtAttr, error) {
 		data.AddChild(nl.NewRtAttr(nl.IPSET_ATTR_CIDR2, nl.Uint8Attr(entry.CIDR2)))
 	}
 
-	if entry.Port != nil {
-		if entry.Protocol == nil {
-			// use tcp protocol as default
-			val := uint8(unix.IPPROTO_TCP)
-			entry.Protocol = &val
-		}
+	if entry.Protocol != nil {
 		data.AddChild(nl.NewRtAttr(nl.IPSET_ATTR_PROTO, nl.Uint8Attr(*entry.Protocol)))
+	}
+
+	if entry.Port != nil {
 		buf := make([]byte, 2)
 		binary.BigEndian.PutUint16(buf, *entry.Port)
 		data.AddChild(nl.NewRtAttr(int(nl.IPSET_ATTR_PORT|nl.NLA_F_NET_BYTEORDER), buf))

ipset_linux_test.go

@@ -439,6 +439,21 @@ func TestIpsetCreateListAddDelDestroyWithTestCases(t *testing.T) {
 				Replace: false,
 			},
 		},
+		{
+			desc:     "Type-bitmap:port",
+			setname:  "my-test-ipset-bitmap-port",
+			typename: "bitmap:port",
+			options: IpsetCreateOptions{
+				Replace:  true,
+				Timeout:  &timeout,
+				PortFrom: 0,
+				PortTo:   1024,
+			},
+			entry: &IPSetEntry{
+				Port:    &port,
+				Replace: false,
+			},
+		},
 	}
 
 	for _, tC := range testCases {
@@ -517,14 +532,17 @@ func TestIpsetCreateListAddDelDestroyWithTestCases(t *testing.T) {
 			}
 
 			if tC.entry.Port != nil {
-				if *result.Entries[0].Protocol != *tC.entry.Protocol {
-					t.Fatalf("expected protocol to be '%d', got '%d'", *tC.entry.Protocol, *result.Entries[0].Protocol)
-				}
 				if *result.Entries[0].Port != *tC.entry.Port {
 					t.Fatalf("expected port to be '%d', got '%d'", *tC.entry.Port, *result.Entries[0].Port)
 				}
 			}
 
+			if tC.entry.Protocol != nil {
+				if result.Entries[0].Protocol == nil || *result.Entries[0].Protocol != *tC.entry.Protocol {
+					t.Fatalf("expected protocol to be '%d', got '%v'", *tC.entry.Protocol, result.Entries[0].Protocol)
+				}
+			}
+
 			if tC.entry.MAC != nil {
 				if result.Entries[0].MAC.String() != tC.entry.MAC.String() {
 					t.Fatalf("expected mac to be '%v', got '%v'", tC.entry.MAC, result.Entries[0].MAC)