From 8fe5342cbe345dddad346a2a4b6ba54c2e29b3de Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 21 Feb 2026 11:38:41 -0800 Subject: [PATCH 1/4] Update to 1.8.12. Fixes rhbz#2440980 --- .gitignore | 2 + iptables-1.8.11-command-options-fix.patch | 27 --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ------------------ iptables.spec | 13 +- sources | 4 +- 5 files changed, 9 insertions(+), 209 deletions(-) delete mode 100644 iptables-1.8.11-command-options-fix.patch delete mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/.gitignore b/.gitignore index 3814395..2de90ef 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,5 @@ /iptables-1.8.10.tar.xz.sig /iptables-1.8.11.tar.xz /iptables-1.8.11.tar.xz.sig +/iptables-1.8.12.tar.xz +/iptables-1.8.12.tar.xz.sig diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch deleted file mode 100644 index f6eecb1..0000000 --- a/iptables-1.8.11-command-options-fix.patch +++ /dev/null @@ -1,27 +0,0 @@ -commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 -Author: Phil Sutter -Date: Wed Apr 23 12:36:13 2025 +0200 - - xshared: Accept an option if any given command allows it - - Fixed commit made option checking overly strict: Some commands may be - commbined (foremost --list and --zero), reject a given option only if it - is not allowed by any of the given commands. - - Reported-by: Adam Nielsen - Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") - Signed-off-by: Phil Sutter - -diff --git a/iptables/xshared.c b/iptables/xshared.c -index cdfd11ab..fc61e0fd 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, - */ - for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { - if ((options & optval) && -- (options_v_commands[i] & command) != command) -+ !(options_v_commands[i] & command)) - xtables_error(PARAMETER_PROBLEM, - "Illegal option `%s' with this command", - ops->option_name(optval)); diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch deleted file mode 100644 index b038616..0000000 --- a/iptables-1.8.11-fix-interface-comparisons.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 -From: Jeremy Sowden -Date: Mon, 18 Nov 2024 13:56:50 +0000 -Subject: nft: fix interface comparisons in `-C` commands - -Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from -kernel") removed code which explicitly set interface masks to all ones. The -result of this is that they are zero. However, they are used to mask interfaces -in `is_same_interfaces`. Consequently, the masked values are alway zero, the -comparisons are always true, and check commands which ought to fail succeed: - - # iptables -N test - # iptables -A test -i lo \! -o lo -j REJECT - # iptables -v -L test - Chain test (0 references) - pkts bytes target prot opt in out source destination - 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable - # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT - REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable - -Remove the mask parameters from `is_same_interfaces`. Add a test-case. - -Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") -Signed-off-by: Jeremy Sowden -Signed-off-by: Phil Sutter ---- - iptables/nft-arp.c | 10 ++---- - iptables/nft-ipv4.c | 4 +-- - iptables/nft-ipv6.c | 6 +--- - iptables/nft-shared.c | 36 +++++----------------- - iptables/nft-shared.h | 6 +--- - .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ - 6 files changed, 22 insertions(+), 49 deletions(-) - create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 264864c3..c11d64c3 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, - return false; - } - -- return is_same_interfaces(a->arp.iniface, -- a->arp.outiface, -- (unsigned char *)a->arp.iniface_mask, -- (unsigned char *)a->arp.outiface_mask, -- b->arp.iniface, -- b->arp.outiface, -- (unsigned char *)b->arp.iniface_mask, -- (unsigned char *)b->arp.outiface_mask); -+ return is_same_interfaces(a->arp.iniface, a->arp.outiface, -+ b->arp.iniface, b->arp.outiface); - } - - static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) -diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c -index 74092875..0c8bd291 100644 ---- a/iptables/nft-ipv4.c -+++ b/iptables/nft-ipv4.c -@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, - } - - return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, -- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, -- b->fw.ip.iniface, b->fw.ip.outiface, -- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); -+ b->fw.ip.iniface, b->fw.ip.outiface); - } - - static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) -diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c -index b184f8af..4dbb2af2 100644 ---- a/iptables/nft-ipv6.c -+++ b/iptables/nft-ipv6.c -@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, - } - - return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, -- a->fw6.ipv6.iniface_mask, -- a->fw6.ipv6.outiface_mask, -- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, -- b->fw6.ipv6.iniface_mask, -- b->fw6.ipv6.outiface_mask); -+ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); - } - - static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 6775578b..2c29e68f 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, - } - - bool is_same_interfaces(const char *a_iniface, const char *a_outiface, -- unsigned const char *a_iniface_mask, -- unsigned const char *a_outiface_mask, -- const char *b_iniface, const char *b_outiface, -- unsigned const char *b_iniface_mask, -- unsigned const char *b_outiface_mask) -+ const char *b_iniface, const char *b_outiface) - { -- int i; -- -- for (i = 0; i < IFNAMSIZ; i++) { -- if (a_iniface_mask[i] != b_iniface_mask[i]) { -- DEBUGP("different iniface mask %x, %x (%d)\n", -- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); -- return false; -- } -- if ((a_iniface[i] & a_iniface_mask[i]) -- != (b_iniface[i] & b_iniface_mask[i])) { -- DEBUGP("different iniface\n"); -- return false; -- } -- if (a_outiface_mask[i] != b_outiface_mask[i]) { -- DEBUGP("different outiface mask\n"); -- return false; -- } -- if ((a_outiface[i] & a_outiface_mask[i]) -- != (b_outiface[i] & b_outiface_mask[i])) { -- DEBUGP("different outiface\n"); -- return false; -- } -+ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { -+ DEBUGP("different iniface\n"); -+ return false; -+ } -+ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { -+ DEBUGP("different outiface\n"); -+ return false; - } -- - return true; - } - -diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h -index 51d1e460..b57aee1f 100644 ---- a/iptables/nft-shared.h -+++ b/iptables/nft-shared.h -@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint - void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); - - bool is_same_interfaces(const char *a_iniface, const char *a_outiface, -- unsigned const char *a_iniface_mask, -- unsigned const char *a_outiface_mask, -- const char *b_iniface, const char *b_outiface, -- unsigned const char *b_iniface_mask, -- unsigned const char *b_outiface_mask); -+ const char *b_iniface, const char *b_outiface); - - void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); - void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); -diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 -new file mode 100755 -index 00000000..278cd648 ---- /dev/null -+++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 -@@ -0,0 +1,9 @@ -+#!/bin/bash -+ -+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } -+ -+$XT_MULTI iptables -N test -+$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT -+$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 -+ -+exit 0 --- -cgit v1.2.3 - diff --git a/iptables.spec b/iptables.spec index c1f7c18..28e1adc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.11 -Release: 13%{?dist} +Version: 1.8.12 +Release: 1%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -25,12 +25,6 @@ Source9: arptables.service Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config -# Patch to fix -C handling, already upstream -# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch1: iptables-1.8.11-fix-interface-comparisons.patch -# Patch to fix overly strict command option checking -# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 -Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -476,6 +470,9 @@ fi %changelog +* Sat Feb 21 2026 Kevin Fenzi - 1.8.12-1 +- Update to 1.8.12. Fixes rhbz#2440980 + * Fri Jan 16 2026 Fedora Release Engineering - 1.8.11-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild diff --git a/sources b/sources index 1f7b750..5bf6381 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 -SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2 +SHA512 (iptables-1.8.12.tar.xz) = b25bd6f6f78a6192699bce44c2b29ca65351ef71198a84fa26d29c47cb24ed695ee0406f6581fa81ece4d30445bb0680def5dc328f7fc708b80cadcd0230fe49 +SHA512 (iptables-1.8.12.tar.xz.sig) = c1a22b6c6104a0395823a8695eafca6459d82af3467e70e88dc5625aeb6d3feba485a3f2baaf0e8e6ff1b979dc1c764427a6d6614a070476078d1e2f8cd3fd34 From b6a5b8a993c3a7c8db482c55ae59a8bacd86908a Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 26 Feb 2026 16:14:48 -0800 Subject: [PATCH 2/4] add revert to fix running in docker containers Signed-off-by: Kevin Fenzi --- iptables.spec | 5 ++++ revert-capabilities-fix-docker.patch | 45 ++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 revert-capabilities-fix-docker.patch diff --git a/iptables.spec b/iptables.spec index 28e1adc..2f1a115 100644 --- a/iptables.spec +++ b/iptables.spec @@ -26,6 +26,10 @@ Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config +# Already upstreamed fix to revert refuse to run under file capabilities +# https://bugzilla.netfilter.org/show_bug.cgi?id=1830 +Patch: revert-capabilities-fix-docker.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -472,6 +476,7 @@ fi %changelog * Sat Feb 21 2026 Kevin Fenzi - 1.8.12-1 - Update to 1.8.12. Fixes rhbz#2440980 +- Add patch to revert refuse to run under file capabilities and fix docker. * Fri Jan 16 2026 Fedora Release Engineering - 1.8.11-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild diff --git a/revert-capabilities-fix-docker.patch b/revert-capabilities-fix-docker.patch new file mode 100644 index 0000000..a555deb --- /dev/null +++ b/revert-capabilities-fix-docker.patch @@ -0,0 +1,45 @@ +From 6fff7039c06f0084ed35d7a73a6784ef0c12619e Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Mon, 23 Feb 2026 23:45:53 +0100 +Subject: Revert "libxtables: refuse to run under file capabilities" + +This reverts commit a2a733e9f0da779bbe009736644f4481e22ca3d1. + +The new iptables 1.8.12 release is broken on docker, pinpointed to the +getauxval() change that apparently can be nonzero in presence of LSMs. + +That makes getauxval() useless for the purpose of detecting a setcap binary. +So revert this. + +Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1830 +Signed-off-by: Florian Westphal +--- + libxtables/xtables.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index 51706dc4..1e1f4f78 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -31,7 +31,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -332,8 +331,8 @@ void xtables_announce_chain(const char *name) + + void xtables_init(void) + { +- /* xtables cannot be used with setuid/setcap in a safe way. */ +- if (getuid() != geteuid() || getauxval(AT_SECURE)) ++ /* xtables cannot be used with setuid in a safe way. */ ++ if (getuid() != geteuid()) + _exit(111); + + xtables_libdir = getenv("XTABLES_LIBDIR"); +-- +cgit v1.2.3 + From 3cee5b875d21f333f3737a0427d6852262b70615 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 4 Mar 2026 20:03:10 +0100 Subject: [PATCH 3/4] iptables-1.8.13-1 - new version Resolves: rhbz#2444298 --- .gitignore | 2 ++ iptables.spec | 9 +++--- revert-capabilities-fix-docker.patch | 45 ---------------------------- sources | 4 +-- 4 files changed, 8 insertions(+), 52 deletions(-) delete mode 100644 revert-capabilities-fix-docker.patch diff --git a/.gitignore b/.gitignore index 2de90ef..c7d40bb 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,5 @@ /iptables-1.8.11.tar.xz.sig /iptables-1.8.12.tar.xz /iptables-1.8.12.tar.xz.sig +/iptables-1.8.13.tar.xz +/iptables-1.8.13.tar.xz.sig diff --git a/iptables.spec b/iptables.spec index 2f1a115..3008418 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,7 +10,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.12 +Version: 1.8.13 Release: 1%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig @@ -26,10 +26,6 @@ Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config -# Already upstreamed fix to revert refuse to run under file capabilities -# https://bugzilla.netfilter.org/show_bug.cgi?id=1830 -Patch: revert-capabilities-fix-docker.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -474,6 +470,9 @@ fi %changelog +* Wed Mar 04 2026 Phil Sutter - 1.8.13-1 +- new version + * Sat Feb 21 2026 Kevin Fenzi - 1.8.12-1 - Update to 1.8.12. Fixes rhbz#2440980 - Add patch to revert refuse to run under file capabilities and fix docker. diff --git a/revert-capabilities-fix-docker.patch b/revert-capabilities-fix-docker.patch deleted file mode 100644 index a555deb..0000000 --- a/revert-capabilities-fix-docker.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 6fff7039c06f0084ed35d7a73a6784ef0c12619e Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Mon, 23 Feb 2026 23:45:53 +0100 -Subject: Revert "libxtables: refuse to run under file capabilities" - -This reverts commit a2a733e9f0da779bbe009736644f4481e22ca3d1. - -The new iptables 1.8.12 release is broken on docker, pinpointed to the -getauxval() change that apparently can be nonzero in presence of LSMs. - -That makes getauxval() useless for the purpose of detecting a setcap binary. -So revert this. - -Bugzilla: https://bugzilla.netfilter.org/show_bug.cgi?id=1830 -Signed-off-by: Florian Westphal ---- - libxtables/xtables.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index 51706dc4..1e1f4f78 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -31,7 +31,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -332,8 +331,8 @@ void xtables_announce_chain(const char *name) - - void xtables_init(void) - { -- /* xtables cannot be used with setuid/setcap in a safe way. */ -- if (getuid() != geteuid() || getauxval(AT_SECURE)) -+ /* xtables cannot be used with setuid in a safe way. */ -+ if (getuid() != geteuid()) - _exit(111); - - xtables_libdir = getenv("XTABLES_LIBDIR"); --- -cgit v1.2.3 - diff --git a/sources b/sources index 5bf6381..4eb62a1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.12.tar.xz) = b25bd6f6f78a6192699bce44c2b29ca65351ef71198a84fa26d29c47cb24ed695ee0406f6581fa81ece4d30445bb0680def5dc328f7fc708b80cadcd0230fe49 -SHA512 (iptables-1.8.12.tar.xz.sig) = c1a22b6c6104a0395823a8695eafca6459d82af3467e70e88dc5625aeb6d3feba485a3f2baaf0e8e6ff1b979dc1c764427a6d6614a070476078d1e2f8cd3fd34 +SHA512 (iptables-1.8.13.tar.xz) = 3aefd76ca60d00f46ba4d6f39cbcfdc60517d03b6714da25dcd67542f6f4eea8d82c4855bdd9124efe18b769f41951772b8340a6eda75b85f8dd52b2289b145b +SHA512 (iptables-1.8.13.tar.xz.sig) = 9b8ef597e1f73c2697f29b07ac010313696f52f478f10c65ec4c4e2dc933be50c74c5c236512e4d756220c4d2fd511fded88dc46f2376fc5d7e2bea71fd267ca From 268c3873ef3cf87017e7b0485f778ec948cf8da5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jul 2026 04:00:53 +0000 Subject: [PATCH 4/4] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 3008418..37319a2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.13 -Release: 1%{?dist} +Release: 2%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -470,6 +470,9 @@ fi %changelog +* Thu Jul 16 2026 Fedora Release Engineering - 1.8.13-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Wed Mar 04 2026 Phil Sutter - 1.8.13-1 - new version