gateway: skip legacy ipset restore when sets exist

gateway/usr/share/eterban/eterban_switcher.py

@@ -135,7 +135,11 @@ def restore_legacy_ipsets():
     name_list = [ipset_eterban_1, ipset_eterban_1_ipv6, ipset_firehol]
     for name in name_list:
         snapshot = '/usr/share/eterban/' + name
-        if os.path.exists(snapshot):
+        if not os.path.exists(snapshot):
+            continue
+        exists = subprocess.run(['ipset', 'list', name], stdout=subprocess.DEVNULL,
+                                stderr=subprocess.DEVNULL, timeout=10).returncode == 0
+        if not exists:
             subprocess.run(['ipset', 'restore', '--file', snapshot], check=True, timeout=10)
 
 

tests/static-checks.sh

@@ -76,7 +76,8 @@ rg -Fq "ipset_eterban_1_ipv6, 'src', '-p', 'tcp', '-j', 'DNAT'" gateway/usr/shar
 rg -Fq 'claim_interval_seconds = 60' gateway/usr/share/eterban/eterban_switcher.py && \
 rg -Fq 'time.monotonic() >= next_claim_at' gateway/usr/share/eterban/eterban_switcher.py && \
 rg -Fq 'socket_timeout=10' gateway/usr/share/eterban/eterban_switcher.py && \
-rg -Fq 'def nonempty_stream_entries(response):' gateway/usr/share/eterban/eterban_switcher.py || {
+rg -Fq 'def nonempty_stream_entries(response):' gateway/usr/share/eterban/eterban_switcher.py && \
+rg -Fq "['ipset', 'list', name]" gateway/usr/share/eterban/eterban_switcher.py || {
     echo 'external IPv4/IPv6 ban redirects must target public port 81' >&2
     exit 1
 }