From 6e5ffdcd277f85c7b7c7b7ee7814f40dbe4dda9f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Aug 2020 17:57:13 +0200 Subject: [PATCH 1/4] iptables-1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message --- ...eck-consistency-with-NFT_CL_FAKE-too.patch | 40 +++++++++++++++++ ...mand-name-in-ip6tables-error-message.patch | 45 +++++++++++++++++++ iptables.spec | 8 +++- 3 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch create mode 100644 0004-nft-Fix-command-name-in-ip6tables-error-message.patch diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch new file mode 100644 index 0000000..abe95fe --- /dev/null +++ b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch @@ -0,0 +1,40 @@ +From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Jul 2020 15:39:31 +0200 +Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too + +Athough this cache level fetches table names only, it shouldn't skip the +consistency check. + +Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") +Signed-off-by: Phil Sutter +(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd) +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 638b18bc7e382..434cc10b82ce7 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -511,14 +511,14 @@ retry: + if (req->level >= NFT_CL_TABLES) + fetch_table_cache(h); + if (req->level == NFT_CL_FAKE) +- return; ++ goto genid_check; + if (req->level >= NFT_CL_CHAINS) + fetch_chain_cache(h, t, chains); + if (req->level >= NFT_CL_SETS) + fetch_set_cache(h, t, NULL); + if (req->level >= NFT_CL_RULES) + fetch_rule_cache(h, t); +- ++genid_check: + mnl_genid_get(h, &genid_check); + if (h->nft_genid != genid_check) { + flush_cache(h, h->cache, NULL); +-- +2.27.0 + diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch new file mode 100644 index 0000000..b9a83f6 --- /dev/null +++ b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch @@ -0,0 +1,45 @@ +From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 7 Aug 2020 13:48:28 +0200 +Subject: [PATCH] nft: Fix command name in ip6tables error message + +Upon errors, ip6tables-nft would prefix its error messages with +'iptables:' instead of 'ip6tables:'. Turns out the command name was +hard-coded, use 'progname' variable instead. +While being at it, merge the two mostly identical fprintf() calls into +one. + +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) +Signed-off-by: Phil Sutter +--- + iptables/xtables-standalone.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c +index dd6fb7919d2e1..7b71db62f1ea6 100644 +--- a/iptables/xtables-standalone.c ++++ b/iptables/xtables-standalone.c +@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + xtables_fini(); + + if (!ret) { +- if (errno == EINVAL) { +- fprintf(stderr, "iptables: %s. " +- "Run `dmesg' for more information.\n", +- nft_strerror(errno)); +- } else { +- fprintf(stderr, "iptables: %s.\n", +- nft_strerror(errno)); +- } ++ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), ++ (errno == EINVAL ? ++ " Run `dmesg' for more information." : "")); ++ + if (errno == EAGAIN) + exit(RESOURCE_PROBLEM); + } +-- +2.27.0 + diff --git a/iptables.spec b/iptables.spec index e20e38c..42ce8c2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -34,6 +34,8 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch +Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch +Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -446,6 +448,10 @@ fi %changelog +* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 +- nft: cache: Check consistency with NFT_CL_FAKE, too +- nft: Fix command name in ip6tables error message + * Tue Jul 28 2020 Fedora Release Engineering - 1.8.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 5ce62f1362cc63eed17018582871fa2de94e8e24 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 17 Nov 2020 15:40:28 +0100 Subject: [PATCH 2/4] iptables-1.8.5-4 - ebtables: Fix for broken chain renaming --- ...tables-Fix-for-broken-chain-renaming.patch | 66 +++++++++++++++++++ iptables.spec | 6 +- 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 0005-ebtables-Fix-for-broken-chain-renaming.patch diff --git a/0005-ebtables-Fix-for-broken-chain-renaming.patch b/0005-ebtables-Fix-for-broken-chain-renaming.patch new file mode 100644 index 0000000..2ad2518 --- /dev/null +++ b/0005-ebtables-Fix-for-broken-chain-renaming.patch @@ -0,0 +1,66 @@ +From 1b7ca0bdd7284d750f894f59e48f9a8b0da82076 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Nov 2020 11:38:27 +0100 +Subject: [PATCH] ebtables: Fix for broken chain renaming + +Loading extensions pollutes 'errno' value, hence before using it to +indicate failure it should be sanitized. This was done by the called +function before the parsing/netlink split and not migrated by accident. +Move it into calling code to clarify the connection. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247) + + Conflicts: + iptables/nft.c + +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 3 --- + iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++ + iptables/xtables-eb.c | 1 + + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 0c5a74fc232c6..2e4b91916b332 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1936,9 +1936,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain, + + nft_xt_builtin_init(h, table); + +- /* Config load changed errno. Ensure genuine info for our callers. */ +- errno = 0; +- + /* Find the old chain to be renamed */ + c = nft_chain_find(h, table, chain); + if (c == NULL) { +diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +index 0c1eb4ca66f52..6f11bd12593dd 100755 +--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 ++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then + exit 1 + fi + ++$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 ++ + $XT_MULTI ebtables -t $t -F || exit 0 +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 375a95d1d5c75..6df5839f07436 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + else if (strchr(argv[optind], ' ') != NULL) + xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); + ++ errno = 0; + ret = nft_cmd_chain_user_rename(h, chain, *table, + argv[optind]); + if (ret != 0 && errno == ENOENT) +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index 42ce8c2..dcba8eb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -36,6 +36,7 @@ Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch +Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -448,6 +449,9 @@ fi %changelog +* Tue Nov 17 14:37:49 CET 2020 Phil Sutter - 1.8.5-4 +- ebtables: Fix for broken chain renaming + * Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message From 180cccf6eafd120c50470d70fec579077f0e173b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 28 Jan 2021 15:25:20 +0100 Subject: [PATCH 3/4] iptables-1.8.5-5 - ebtables: Exit gracefully on invalid table names Resolves: RHBZ#1908259 --- ...it-gracefully-on-invalid-table-names.patch | 51 +++++++++++++++++++ iptables.spec | 6 ++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch diff --git a/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch new file mode 100644 index 0000000..ba625a2 --- /dev/null +++ b/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -0,0 +1,51 @@ +From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 Jan 2021 01:09:56 +0100 +Subject: [PATCH] ebtables: Exit gracefully on invalid table names + +Users are able to cause program abort by passing a table name that +doesn't exist: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. +| Aborted + +Avoid this by checking table existence just like iptables-nft does upon +parsing '-t' optarg. Since the list of tables is known and fixed, +checking the given name's length is pointless. So just drop that check +in return. + +With this patch in place, output looks much better: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist +| Perhaps iptables or your kernel needs to be upgraded. + +Signed-off-by: Phil Sutter +Signed-off-by: Phil Sutter +--- + iptables/xtables-eb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index cfa9317c78e94..5bb34d6d292a9 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -914,10 +914,10 @@ print_zero: + xtables_error(PARAMETER_PROBLEM, + "The -t option (seen in line %u) cannot be used in %s.\n", + line, xt_params->program_name); +- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) +- xtables_error(PARAMETER_PROBLEM, +- "Table name length cannot exceed %d characters", +- EBT_TABLE_MAXNAMELEN - 1); ++ if (!nft_table_builtin_find(h, optarg)) ++ xtables_error(VERSION_PROBLEM, ++ "table '%s' does not exist", ++ optarg); + *table = optarg; + table_set = true; + break; +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index dcba8eb..4a30653 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -37,6 +37,7 @@ Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch +Patch6: 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -449,6 +450,9 @@ fi %changelog +* Thu Jan 28 2021 Phil Sutter - 1.8.5-5 +- ebtables: Exit gracefully on invalid table names + * Tue Nov 17 14:37:49 CET 2020 Phil Sutter - 1.8.5-4 - ebtables: Fix for broken chain renaming From a9e873591dca2c3e17a94c51c6084a1db9032911 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 24 Mar 2021 16:12:15 +0100 Subject: [PATCH 4/4] iptables-1.8.5-6 - iptables: accept lock file name at runtime Resolves: RHBZ#1932157 --- ...les-accept-lock-file-name-at-runtime.patch | 94 +++++++++++++++++++ iptables.spec | 6 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 0007-iptables-accept-lock-file-name-at-runtime.patch diff --git a/0007-iptables-accept-lock-file-name-at-runtime.patch b/0007-iptables-accept-lock-file-name-at-runtime.patch new file mode 100644 index 0000000..2aced55 --- /dev/null +++ b/0007-iptables-accept-lock-file-name-at-runtime.patch @@ -0,0 +1,94 @@ +From 05b2a86662ad732ecfbec1c2ef597dbedf54cf9c Mon Sep 17 00:00:00 2001 +From: Giuseppe Scrivano +Date: Fri, 17 Jul 2020 10:39:40 +0200 +Subject: [PATCH] iptables: accept lock file name at runtime + +allow users to override at runtime the lock file to use through the +XTABLES_LOCKFILE environment variable. + +It allows to use iptables when the user has granted enough +capabilities (e.g. a user+network namespace) to configure the network +but that lacks access to the XT_LOCK_NAME (by default placed under +/run). + +$ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ... + +Signed-off-by: Giuseppe Scrivano +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit 5105e844c2ff6a3e320bf8cdadc5094d4eaef2b7) +--- + configure.ac | 1 + + iptables/iptables.8.in | 8 ++++++++ + iptables/xshared.c | 11 ++++++++--- + 3 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 31a8bb261c437..d37752a20afd2 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -219,6 +219,7 @@ AC_SUBST([libxtables_vmajor]) + + AC_DEFINE_UNQUOTED([XT_LOCK_NAME], "${xt_lock_name}", + [Location of the iptables lock file]) ++AC_SUBST([XT_LOCK_NAME], "${xt_lock_name}") + + AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile + iptables/Makefile iptables/xtables.pc +diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in +index 054564b3df91e..999cf339845f9 100644 +--- a/iptables/iptables.8.in ++++ b/iptables/iptables.8.in +@@ -397,6 +397,14 @@ corresponding to that rule's position in the chain. + \fB\-\-modprobe=\fP\fIcommand\fP + When adding or inserting rules into a chain, use \fIcommand\fP + to load any necessary modules (targets, match extensions, etc). ++ ++.SH LOCK FILE ++iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at ++launch. ++ ++The \fBXTABLES_LOCKFILE\fP environment variable can be used to override ++the default setting. ++ + .SH MATCH AND TARGET EXTENSIONS + .PP + iptables can use extended packet matching and target modules. +diff --git a/iptables/xshared.c b/iptables/xshared.c +index c1d1371a6d54a..7d97637f7e129 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -249,15 +249,20 @@ void xs_init_match(struct xtables_match *match) + static int xtables_lock(int wait, struct timeval *wait_interval) + { + struct timeval time_left, wait_time; ++ const char *lock_file; + int fd, i = 0; + + time_left.tv_sec = wait; + time_left.tv_usec = 0; + +- fd = open(XT_LOCK_NAME, O_CREAT, 0600); ++ lock_file = getenv("XTABLES_LOCKFILE"); ++ if (lock_file == NULL || lock_file[0] == '\0') ++ lock_file = XT_LOCK_NAME; ++ ++ fd = open(lock_file, O_CREAT, 0600); + if (fd < 0) { + fprintf(stderr, "Fatal: can't open lock file %s: %s\n", +- XT_LOCK_NAME, strerror(errno)); ++ lock_file, strerror(errno)); + return XT_LOCK_FAILED; + } + +@@ -265,7 +270,7 @@ static int xtables_lock(int wait, struct timeval *wait_interval) + if (flock(fd, LOCK_EX) == 0) + return fd; + +- fprintf(stderr, "Can't lock %s: %s\n", XT_LOCK_NAME, ++ fprintf(stderr, "Can't lock %s: %s\n", lock_file, + strerror(errno)); + return XT_LOCK_BUSY; + } +-- +2.31.0 + diff --git a/iptables.spec b/iptables.spec index 4a30653..19941e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -38,6 +38,7 @@ Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch Patch6: 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch +Patch7: 0007-iptables-accept-lock-file-name-at-runtime.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -450,6 +451,9 @@ fi %changelog +* Wed Mar 24 2021 Phil Sutter - 1.8.5-6 +- iptables: accept lock file name at runtime + * Thu Jan 28 2021 Phil Sutter - 1.8.5-5 - ebtables: Exit gracefully on invalid table names