Skip to content

Commit 4f978a7

Browse files
smirasmira
committed
fix: correctly calculate end ranges for nftables sets
If the end range reaches "max value", we need to drop it instead of overflowing. Fixes #12890 Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com> (cherry picked from commit 720a214)
1 parent 8d52e2d commit 4f978a7

File tree

52 files changed

+617
-491
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+617
-491
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 194 additions & 188 deletions
Large diffs are not rendered by default.

‎.github/workflows/dispatch.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-11T16:40:05Z by kres 4b09af7.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
"on":
66
workflow_dispatch:
@@ -52,7 +52,7 @@ jobs:
5252
done
5353
continue-on-error: true
5454
- name: checkout
55-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
55+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
5656
- name: Unshallow
5757
run: |
5858
git fetch --prune --unshallow

‎.github/workflows/grype-scan-cron.yaml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,17 +40,23 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
5353
timeout-minutes: 10
54+
- name: login-to-registry
55+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # version: v3.7.0
56+
with:
57+
password: ${{ secrets.GITHUB_TOKEN }}
58+
registry: ghcr.io
59+
username: ${{ github.repository_owner }}
5460
- name: local-grype-scan-result
5561
env:
5662
DEST: _out
@@ -61,7 +67,7 @@ jobs:
6167
make target-grype-validate
6268
- name: save artifacts
6369
if: always()
64-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # version: v6.0.0
70+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # version: v7.0.0
6571
with:
6672
name: talos-grype-scan-result
6773
path: |

‎.github/workflows/integration-airgapped-cron.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,20 +40,20 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
5353
timeout-minutes: 10
5454
- name: Download artifacts
5555
if: github.event_name != 'schedule'
56-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # version: v7.0.0
56+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # version: v8.0.0
5757
with:
5858
name: talos-artifacts
5959
path: _out
@@ -117,7 +117,7 @@ jobs:
117117
sudo -E make e2e-qemu
118118
- name: save artifacts
119119
if: always()
120-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # version: v6.0.0
120+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # version: v7.0.0
121121
with:
122122
name: talos-logs-integration-airgapped
123123
path: |-

‎.github/workflows/integration-aws-cron.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,13 +40,13 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -59,7 +59,7 @@ jobs:
5959
sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
6060
- name: Download artifacts
6161
if: github.event_name != 'schedule'
62-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # version: v7.0.0
62+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # version: v8.0.0
6363
with:
6464
name: talos-artifacts
6565
path: _out
@@ -109,13 +109,13 @@ jobs:
109109
run: |
110110
make e2e-aws-prepare
111111
- name: checkout contrib
112-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
112+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
113113
with:
114114
path: _out/contrib
115115
ref: main
116116
repository: siderolabs/contrib
117117
- name: setup tf
118-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # version: v3.1.2
118+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # version: v4.0.0
119119
with:
120120
terraform_wrapper: "false"
121121
- name: tf apply

‎.github/workflows/integration-aws-nvidia-nonfree-lts-cron.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,13 +40,13 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -59,7 +59,7 @@ jobs:
5959
sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
6060
- name: Download artifacts
6161
if: github.event_name != 'schedule'
62-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # version: v7.0.0
62+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # version: v8.0.0
6363
with:
6464
name: talos-artifacts
6565
path: _out
@@ -100,7 +100,7 @@ jobs:
100100
run: |
101101
make image-aws
102102
- name: checkout extensions
103-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
103+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
104104
with:
105105
path: _out/extensions
106106
ref: release-1.12
@@ -123,13 +123,13 @@ jobs:
123123
run: |
124124
make e2e-aws-prepare
125125
- name: checkout contrib
126-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
126+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
127127
with:
128128
path: _out/contrib
129129
ref: main
130130
repository: siderolabs/contrib
131131
- name: setup tf
132-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # version: v3.1.2
132+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # version: v4.0.0
133133
with:
134134
terraform_wrapper: "false"
135135
- name: tf apply

‎.github/workflows/integration-aws-nvidia-nonfree-production-cron.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,13 +40,13 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -59,7 +59,7 @@ jobs:
5959
sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
6060
- name: Download artifacts
6161
if: github.event_name != 'schedule'
62-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # version: v7.0.0
62+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # version: v8.0.0
6363
with:
6464
name: talos-artifacts
6565
path: _out
@@ -100,7 +100,7 @@ jobs:
100100
run: |
101101
make image-aws
102102
- name: checkout extensions
103-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
103+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
104104
with:
105105
path: _out/extensions
106106
ref: release-1.12
@@ -123,13 +123,13 @@ jobs:
123123
run: |
124124
make e2e-aws-prepare
125125
- name: checkout contrib
126-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
126+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
127127
with:
128128
path: _out/contrib
129129
ref: main
130130
repository: siderolabs/contrib
131131
- name: setup tf
132-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # version: v3.1.2
132+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # version: v4.0.0
133133
with:
134134
terraform_wrapper: "false"
135135
- name: tf apply

‎.github/workflows/integration-aws-nvidia-oss-lts-cron.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,13 +40,13 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -59,7 +59,7 @@ jobs:
5959
sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
6060
- name: Download artifacts
6161
if: github.event_name != 'schedule'
62-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # version: v7.0.0
62+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # version: v8.0.0
6363
with:
6464
name: talos-artifacts
6565
path: _out
@@ -100,7 +100,7 @@ jobs:
100100
run: |
101101
make image-aws
102102
- name: checkout extensions
103-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
103+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
104104
with:
105105
path: _out/extensions
106106
ref: release-1.12
@@ -123,13 +123,13 @@ jobs:
123123
run: |
124124
make e2e-aws-prepare
125125
- name: checkout contrib
126-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
126+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
127127
with:
128128
path: _out/contrib
129129
ref: main
130130
repository: siderolabs/contrib
131131
- name: setup tf
132-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # version: v3.1.2
132+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # version: v4.0.0
133133
with:
134134
terraform_wrapper: "false"
135135
- name: tf apply

‎.github/workflows/integration-aws-nvidia-oss-production-cron.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2025-12-19T14:39:26Z by kres 26be706.
3+
# Generated on 2026-03-06T18:00:57Z by kres 1dd7316.
44

55
concurrency:
66
group: ${{ github.head_ref || github.run_id }}
@@ -40,13 +40,13 @@ jobs:
4040
done
4141
continue-on-error: true
4242
- name: checkout
43-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
4444
- name: Unshallow
4545
run: |
4646
git fetch --prune --unshallow
4747
- name: Set up Docker Buildx
4848
id: setup-buildx
49-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # version: v3.11.1
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # version: v3.12.0
5050
with:
5151
driver: remote
5252
endpoint: tcp://buildkit-amd64.ci.svc.cluster.local:1234
@@ -59,7 +59,7 @@ jobs:
5959
sops -d .secrets.yaml | yq -e '.secrets | to_entries[] | .key + "=" + .value' >> "$GITHUB_ENV"
6060
- name: Download artifacts
6161
if: github.event_name != 'schedule'
62-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # version: v7.0.0
62+
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # version: v8.0.0
6363
with:
6464
name: talos-artifacts
6565
path: _out
@@ -100,7 +100,7 @@ jobs:
100100
run: |
101101
make image-aws
102102
- name: checkout extensions
103-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
103+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
104104
with:
105105
path: _out/extensions
106106
ref: release-1.12
@@ -123,13 +123,13 @@ jobs:
123123
run: |
124124
make e2e-aws-prepare
125125
- name: checkout contrib
126-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # version: v6.0.1
126+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # version: v6.0.2
127127
with:
128128
path: _out/contrib
129129
ref: main
130130
repository: siderolabs/contrib
131131
- name: setup tf
132-
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # version: v3.1.2
132+
uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # version: v4.0.0
133133
with:
134134
terraform_wrapper: "false"
135135
- name: tf apply

0 commit comments

Comments
 (0)