diff --git a/0018-iptables-Fix-setting-of-ipv6-counters.patch b/0018-iptables-Fix-setting-of-ipv6-counters.patch new file mode 100644 index 0000000..ec72c5e --- /dev/null +++ b/0018-iptables-Fix-setting-of-ipv6-counters.patch @@ -0,0 +1,102 @@ +From 935dddbb219eb09a289507e609ff8e9b4429c1ea Mon Sep 17 00:00:00 2001 +From: Jacek Tomasiak +Date: Mon, 19 Jun 2023 12:44:54 +0200 +Subject: [PATCH] iptables: Fix setting of ipv6 counters + +When setting counters using ip6tables-nft -c X Y the X and Y values were +not stored. + +This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but +applied to the nft variant of ipv6 not the legacy. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647 +Fixes: 0391677c1a0b2 ("xtables: add IPv6 support") +Signed-off-by: Jacek Tomasiak +Signed-off-by: Jacek Tomasiak +Signed-off-by: Phil Sutter +(cherry picked from commit ed839159edf8bda8e9196f1056c4038c22d78bfd) +--- + iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 | 6 +++--- + iptables/tests/shell/testcases/iptables/0003-list-rules_0 | 6 +++--- + iptables/xshared.c | 3 +++ + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 +index c98bdd6e501aa..09e39927ef390 100755 +--- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 ++++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 +@@ -3,7 +3,7 @@ + set -e + + $XT_MULTI ip6tables -N foo +-$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT ++$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42 + $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo + $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT + +@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0 + -P FORWARD ACCEPT -c 0 0 + -P OUTPUT ACCEPT -c 0 0 + -N foo +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S) +@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD) + + EXPECT='-P FORWARD ACCEPT -c 0 0 +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD) +diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 +index d335d44257a49..d07bd151be76b 100755 +--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 ++++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 +@@ -3,7 +3,7 @@ + set -e + + $XT_MULTI iptables -N foo +-$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT ++$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42 + $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo + $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT + +@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0 + -P FORWARD ACCEPT -c 0 0 + -P OUTPUT ACCEPT -c 0 0 + -N foo +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S) +@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD) + + EXPECT='-P FORWARD ACCEPT -c 0 0 +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD) +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 17aed04e02b09..71ee94d6f2f83 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1992,6 +1992,9 @@ void ipv6_post_parse(int command, struct iptables_command_state *cs, + if (args->goto_set) + cs->fw6.ipv6.flags |= IP6T_F_GOTO; + ++ /* nft-variants use cs->counters, legacy uses cs->fw6.counters */ ++ cs->counters.pcnt = args->pcnt_cnt; ++ cs->counters.bcnt = args->bcnt_cnt; + cs->fw6.counters.pcnt = args->pcnt_cnt; + cs->fw6.counters.bcnt = args->bcnt_cnt; + +-- +2.41.0 + diff --git a/0019-iptables-Fix-handling-of-non-existent-chains.patch b/0019-iptables-Fix-handling-of-non-existent-chains.patch new file mode 100644 index 0000000..9964ba5 --- /dev/null +++ b/0019-iptables-Fix-handling-of-non-existent-chains.patch @@ -0,0 +1,53 @@ +From cd3a8274e9e904d227b81ae7158d6e82b1311bf8 Mon Sep 17 00:00:00 2001 +From: Jacek Tomasiak +Date: Mon, 19 Jun 2023 13:46:36 +0200 +Subject: [PATCH] iptables: Fix handling of non-existent chains + +Since 694612adf87 the "compatibility" check considers non-existent +chains as "incompatible". This broke some scripts which used calls +like `iptables -L CHAIN404` to test for chain existence and expect +"No chain/target/match by that name." in the output. + +This patch changes the logic of `nft_is_table_compatible()` to +report non-existent chains as "compatible" which restores the old +behavior. + +Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 +Signed-off-by: Jacek Tomasiak +Signed-off-by: Jacek Tomasiak +Signed-off-by: Phil Sutter +(cherry picked from commit 82ccfb488eeac5507471099b9b4e6d136cc06e3b) +--- + iptables/nft.c | 2 +- + iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 5896fd410ca78..5e4cd76b05504 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3847,7 +3847,7 @@ bool nft_is_table_compatible(struct nft_handle *h, + if (chain) { + struct nft_chain *c = nft_chain_find(h, table, chain); + +- return c && !nft_is_chain_compatible(c, h); ++ return !c || !nft_is_chain_compatible(c, h); + } + + return !nft_chain_foreach(h, table, nft_is_chain_compatible, h); +diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 +index 33c5f1f35d17f..234f3040516e1 100755 +--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 ++++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 +@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar + cmd 0 -E foo bar + cmd 1 "$EEXIST_F" -E foo bar + cmd 1 "$ENOENT" -E foo bar2 ++cmd 1 "$ENOENT" -L foo + cmd 0 -N foo2 + cmd 1 "$EEXIST_F" -E foo2 bar + +-- +2.41.0 + diff --git a/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch b/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch new file mode 100644 index 0000000..e08b22f --- /dev/null +++ b/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch @@ -0,0 +1,42 @@ +From 90ca86dfed56510ebc52ab2924800eb28ce0d951 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 20:08:09 +0100 +Subject: [PATCH] ebtables: ip and ip6 matches depend on protocol match + +This is consistent with legacy ebtables, also avoids invalid +combinations like '-p IPv6 --ip-source 1.2.3.4'. + +Signed-off-by: Phil Sutter +(cherry picked from commit 267a26363826553280a5928043df30a07cdc63bb) +--- + iptables/nft-bridge.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index 83cbe31559d4b..b9983b203f6d0 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -104,11 +104,18 @@ static int + nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, + struct nftnl_rule *r, struct xt_entry_match *m) + { +- if (!strcmp(m->u.user.name, "802_3") && +- !(fw->bitmask & EBT_802_3)) ++ if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) + xtables_error(PARAMETER_PROBLEM, + "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH"); + ++ if (!strcmp(m->u.user.name, "ip") && fw->ethproto != htons(ETH_P_IP)) ++ xtables_error(PARAMETER_PROBLEM, ++ "For IP filtering the protocol must be specified as IPv4."); ++ ++ if (!strcmp(m->u.user.name, "ip6") && fw->ethproto != htons(ETH_P_IPV6)) ++ xtables_error(PARAMETER_PROBLEM, ++ "For IPv6 filtering the protocol must be specified as IPv6."); ++ + return add_match(h, r, m); + } + +-- +2.41.0 + diff --git a/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch b/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch new file mode 100644 index 0000000..cb23eb3 --- /dev/null +++ b/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch @@ -0,0 +1,348 @@ +From a61cac5cdd4332cf84b9e2f554a1c8852d40dc0a Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 11 Jul 2023 22:06:44 +0200 +Subject: [PATCH] nft-bridge: pass context structure to ops->add() to improve + anonymous set support + +Add context structure to improve bridge among support which creates an +anonymous set. This context structure specifies the command and it +allows to optionally store a anonymous set. + +Use this context to generate native bytecode only if this is an +add/insert/replace command. + +This fixes a dangling anonymous set that is created on rule removal. + +Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") +Reported-and-tested-by: Igor Raits +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit 4e95200ded923f0eb5579c33b91176193c59dbe0) +--- + iptables/nft-arp.c | 4 ++-- + iptables/nft-bridge.c | 9 ++++---- + iptables/nft-cmd.c | 6 ++++- + iptables/nft-ipv4.c | 6 ++--- + iptables/nft-ipv6.c | 6 ++--- + iptables/nft-shared.h | 5 ++-- + iptables/nft.c | 54 ++++++++++++++++++++++++++++--------------- + iptables/nft.h | 9 +++++--- + 8 files changed, 62 insertions(+), 37 deletions(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index df3ad430cf701..889387e4db592 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -40,8 +40,8 @@ static bool need_devaddr(struct arpt_devaddr_info *info) + return false; + } + +-static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs) ++static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs) + { + struct arpt_entry *fw = &cs->arp; + uint32_t op; +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index b9983b203f6d0..a41f411fbba14 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -102,7 +102,8 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) + + static int + nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, +- struct nftnl_rule *r, struct xt_entry_match *m) ++ struct nft_rule_ctx *ctx, struct nftnl_rule *r, ++ struct xt_entry_match *m) + { + if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) + xtables_error(PARAMETER_PROBLEM, +@@ -116,10 +117,10 @@ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, + xtables_error(PARAMETER_PROBLEM, + "For IPv6 filtering the protocol must be specified as IPv6."); + +- return add_match(h, r, m); ++ return add_match(h, ctx, r, m); + } + +-static int nft_bridge_add(struct nft_handle *h, ++static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + struct nftnl_rule *r, + struct iptables_command_state *cs) + { +@@ -181,7 +182,7 @@ static int nft_bridge_add(struct nft_handle *h, + + for (iter = cs->match_list; iter; iter = iter->next) { + if (iter->ismatch) { +- if (nft_bridge_add_match(h, fw, r, iter->u.match->m)) ++ if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m)) + break; + } else { + if (add_target(r, iter->u.watcher->t)) +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index f16ea0e6eaf8b..8cf8027e7465d 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -14,12 +14,16 @@ + #include + #include "nft.h" + #include "nft-cmd.h" ++#include + + struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + const char *table, const char *chain, + struct iptables_command_state *state, + int rulenum, bool verbose) + { ++ struct nft_rule_ctx ctx = { ++ .command = command, ++ }; + struct nftnl_rule *rule; + struct nft_cmd *cmd; + +@@ -33,7 +37,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + cmd->verbose = verbose; + + if (state) { +- rule = nft_rule_new(h, chain, table, state); ++ rule = nft_rule_new(h, &ctx, chain, table, state); + if (!rule) { + nft_cmd_free(cmd); + return NULL; +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index dcc4a8edfc87f..fb62103fd38d7 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -26,8 +26,8 @@ + #include "nft.h" + #include "nft-shared.h" + +-static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs) ++static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs) + { + struct xtables_rule_match *matchp; + uint32_t op; +@@ -81,7 +81,7 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, + add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO); + + for (matchp = cs->matches; matchp; matchp = matchp->next) { +- ret = add_match(h, r, matchp->match->m); ++ ret = add_match(h, ctx, r, matchp->match->m); + if (ret < 0) + return ret; + } +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index e98921856c75d..d36e06812e08d 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -25,8 +25,8 @@ + #include "nft.h" + #include "nft-shared.h" + +-static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs) ++static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs) + { + struct xtables_rule_match *matchp; + uint32_t op; +@@ -68,7 +68,7 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, + add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO); + + for (matchp = cs->matches; matchp; matchp = matchp->next) { +- ret = add_match(h, r, matchp->match->m); ++ ret = add_match(h, ctx, r, matchp->match->m); + if (ret < 0) + return ret; + } +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 07d39131cb0d6..9065e52f669e1 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -34,6 +34,7 @@ + | FMT_NUMERIC | FMT_NOTABLE) + #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) + ++struct nft_rule_ctx; + struct xtables_args; + struct nft_handle; + struct xt_xlate; +@@ -126,8 +127,8 @@ static inline struct nft_xt_ctx_reg *nft_xt_ctx_get_dreg(struct nft_xt_ctx *ctx, + } + + struct nft_family_ops { +- int (*add)(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs); ++ int (*add)(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs); + bool (*is_same)(const struct iptables_command_state *cs_a, + const struct iptables_command_state *cs_b); + void (*print_payload)(struct nftnl_expr *e, +diff --git a/iptables/nft.c b/iptables/nft.c +index 5e4cd76b05504..8029d70a7fbae 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1141,7 +1141,8 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags) + #define NFT_DATATYPE_ETHERADDR 9 + + static int __add_nft_among(struct nft_handle *h, const char *table, +- struct nftnl_rule *r, struct nft_among_pair *pairs, ++ struct nft_rule_ctx *ctx, struct nftnl_rule *r, ++ struct nft_among_pair *pairs, + int cnt, bool dst, bool inv, bool ip) + { + uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN; +@@ -1222,7 +1223,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table, + return 0; + } + +-static int add_nft_among(struct nft_handle *h, ++static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, + struct nftnl_rule *r, struct xt_entry_match *m) + { + struct nft_among_data *data = (struct nft_among_data *)m->data; +@@ -1238,10 +1239,10 @@ static int add_nft_among(struct nft_handle *h, + } + + if (data->src.cnt) +- __add_nft_among(h, table, r, data->pairs, data->src.cnt, ++ __add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt, + false, data->src.inv, data->src.ip); + if (data->dst.cnt) +- __add_nft_among(h, table, r, data->pairs + data->src.cnt, ++ __add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt, + data->dst.cnt, true, data->dst.inv, + data->dst.ip); + return 0; +@@ -1449,22 +1450,30 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r, + return 0; + } + +-int add_match(struct nft_handle *h, ++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, + struct nftnl_rule *r, struct xt_entry_match *m) + { + struct nftnl_expr *expr; + int ret; + +- if (!strcmp(m->u.user.name, "limit")) +- return add_nft_limit(r, m); +- else if (!strcmp(m->u.user.name, "among")) +- return add_nft_among(h, r, m); +- else if (!strcmp(m->u.user.name, "udp")) +- return add_nft_udp(h, r, m); +- else if (!strcmp(m->u.user.name, "tcp")) +- return add_nft_tcp(h, r, m); +- else if (!strcmp(m->u.user.name, "mark")) +- return add_nft_mark(h, r, m); ++ switch (ctx->command) { ++ case NFT_COMPAT_RULE_APPEND: ++ case NFT_COMPAT_RULE_INSERT: ++ case NFT_COMPAT_RULE_REPLACE: ++ if (!strcmp(m->u.user.name, "limit")) ++ return add_nft_limit(r, m); ++ else if (!strcmp(m->u.user.name, "among")) ++ return add_nft_among(h, ctx, r, m); ++ else if (!strcmp(m->u.user.name, "udp")) ++ return add_nft_udp(h, r, m); ++ else if (!strcmp(m->u.user.name, "tcp")) ++ return add_nft_tcp(h, r, m); ++ else if (!strcmp(m->u.user.name, "mark")) ++ return add_nft_mark(h, r, m); ++ break; ++ default: ++ break; ++ } + + expr = nftnl_expr_alloc("match"); + if (expr == NULL) +@@ -1692,7 +1701,8 @@ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv) + } + + struct nftnl_rule * +-nft_rule_new(struct nft_handle *h, const char *chain, const char *table, ++nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ const char *chain, const char *table, + struct iptables_command_state *cs) + { + struct nftnl_rule *r; +@@ -1705,7 +1715,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table, + nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table); + nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain); + +- if (h->ops->add(h, r, cs) < 0) ++ if (h->ops->add(h, ctx, r, cs) < 0) + goto err; + + return r; +@@ -2865,6 +2875,9 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, + { + struct iptables_command_state cs = {}; + struct nftnl_rule *r, *new_rule; ++ struct nft_rule_ctx ctx = { ++ .command = NFT_COMPAT_RULE_APPEND, ++ }; + struct nft_chain *c; + int ret = 0; + +@@ -2883,7 +2896,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, + + h->ops->rule_to_cs(h, r, &cs); + cs.counters.pcnt = cs.counters.bcnt = 0; +- new_rule = nft_rule_new(h, chain, table, &cs); ++ new_rule = nft_rule_new(h, &ctx, chain, table, &cs); + h->ops->clear_cs(&cs); + + if (!new_rule) +@@ -3261,6 +3274,9 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) + .eb.bitmask = EBT_NOPROTO, + }; + struct nftnl_udata_buf *udata; ++ struct nft_rule_ctx ctx = { ++ .command = NFT_COMPAT_RULE_APPEND, ++ }; + struct nft_handle *h = data; + struct nftnl_rule *r; + const char *pname; +@@ -3288,7 +3304,7 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) + + command_jump(&cs, pname); + +- r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), ++ r = nft_rule_new(h, &ctx, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), + nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs); + ebt_cs_clean(&cs); + +diff --git a/iptables/nft.h b/iptables/nft.h +index caff1fdeff92e..1c479fce3fc2e 100644 +--- a/iptables/nft.h ++++ b/iptables/nft.h +@@ -171,9 +171,11 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h, + /* + * Operations with rule-set. + */ +-struct nftnl_rule; ++struct nft_rule_ctx { ++ int command; ++}; + +-struct nftnl_rule *nft_rule_new(struct nft_handle *h, const char *chain, const char *table, struct iptables_command_state *cs); ++struct nftnl_rule *nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *rule, const char *chain, const char *table, struct iptables_command_state *cs); + int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, struct nftnl_rule *ref, bool verbose); + int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, int rulenum, bool verbose); + int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, bool verbose); +@@ -191,7 +193,8 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char * + */ + int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes); + int add_verdict(struct nftnl_rule *r, int verdict); +-int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match *m); ++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct xt_entry_match *m); + int add_target(struct nftnl_rule *r, struct xt_entry_target *t); + int add_jumpto(struct nftnl_rule *r, const char *name, int verdict); + int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set); +-- +2.41.0 + diff --git a/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch b/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch new file mode 100644 index 0000000..2b1e058 --- /dev/null +++ b/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch @@ -0,0 +1,34 @@ +From 48f29413f7db0e3e889733705be368915a16a228 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 19 Jul 2023 14:58:11 +0200 +Subject: [PATCH] tests: shell: Sanitize nft-only/0009-needless-bitwise_0 + +Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the +non-debug ruleset listing's empty lines, causing the diff to fail. Catch +this by exiting upon seeing the first table heading. For the sake of +comparing bytecode, the actual ruleset listing is not interesting, +anyway. + +Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0") +Signed-off-by: Phil Sutter +(cherry picked from commit 2746726e03d9017d4c940a247590f8d5c5d5a73e) +--- + iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 +index 41588a10863ec..34802cc26aad4 100755 +--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 ++++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 +@@ -340,7 +340,7 @@ bridge filter OUTPUT 10 9 + # - lines with bytecode (starting with ' [') + # - empty lines (so printed diff is not a complete mess) + filter() { +- awk '/^( \[|$)/{print}' ++ awk '/^table /{exit} /^( \[|$)/{print}' + } + + diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter) +-- +2.41.0 + diff --git a/0023-nft-Special-casing-for-among-match-in-compare_matche.patch b/0023-nft-Special-casing-for-among-match-in-compare_matche.patch new file mode 100644 index 0000000..7b7e492 --- /dev/null +++ b/0023-nft-Special-casing-for-among-match-in-compare_matche.patch @@ -0,0 +1,46 @@ +From da02d12210c4be7bcc6a5c3141ef96d3c68f6e49 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 21 Jul 2023 13:14:36 +0200 +Subject: [PATCH] nft: Special casing for among match in compare_matches() + +When other extensions may have "garbage" appended to their data which +should not be considered for match comparison, among match is the +opposite in that it extends its data beyond the value in 'size' field. +Add special casing to cover for this, avoiding false-positive rule +comparison. + +Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") +Signed-off-by: Phil Sutter +(cherry picked from commit 10583537004f7ecd4aa11f6c12b7ba73fb77fc11) +--- + iptables/nft-shared.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 4ba44a4aa4d17..413503ed86932 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -1505,6 +1505,7 @@ bool compare_matches(struct xtables_rule_match *mt1, + for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) { + struct xt_entry_match *m1 = mp1->match->m; + struct xt_entry_match *m2 = mp2->match->m; ++ size_t cmplen = mp1->match->userspacesize; + + if (strcmp(m1->u.user.name, m2->u.user.name) != 0) { + DEBUGP("mismatching match name\n"); +@@ -1516,8 +1517,10 @@ bool compare_matches(struct xtables_rule_match *mt1, + return false; + } + +- if (memcmp(m1->data, m2->data, +- mp1->match->userspacesize) != 0) { ++ if (!strcmp(m1->u.user.name, "among")) ++ cmplen = m1->u.match_size - sizeof(*m1); ++ ++ if (memcmp(m1->data, m2->data, cmplen) != 0) { + DEBUGP("mismatch match data\n"); + return false; + } +-- +2.41.0 + diff --git a/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch b/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch new file mode 100644 index 0000000..8864560 --- /dev/null +++ b/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch @@ -0,0 +1,63 @@ +From 009e5643a6e6d4ee395d8956f418bbcef0f960a8 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sat, 15 Jul 2023 01:35:39 +0200 +Subject: [PATCH] nft: Do not pass nft_rule_ctx to add_nft_among() + +It is not used, must be a left-over from an earlier version of the fixed +commit. + +Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support") +Signed-off-by: Phil Sutter +(cherry picked from commit bd71c11a95ab2b44794843fd8a3698039a7db211) +--- + iptables/nft.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8029d70a7fbae..66b47d72e3ae8 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1141,8 +1141,7 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags) + #define NFT_DATATYPE_ETHERADDR 9 + + static int __add_nft_among(struct nft_handle *h, const char *table, +- struct nft_rule_ctx *ctx, struct nftnl_rule *r, +- struct nft_among_pair *pairs, ++ struct nftnl_rule *r, struct nft_among_pair *pairs, + int cnt, bool dst, bool inv, bool ip) + { + uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN; +@@ -1223,7 +1222,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table, + return 0; + } + +-static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, ++static int add_nft_among(struct nft_handle *h, + struct nftnl_rule *r, struct xt_entry_match *m) + { + struct nft_among_data *data = (struct nft_among_data *)m->data; +@@ -1239,10 +1238,10 @@ static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, + } + + if (data->src.cnt) +- __add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt, ++ __add_nft_among(h, table, r, data->pairs, data->src.cnt, + false, data->src.inv, data->src.ip); + if (data->dst.cnt) +- __add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt, ++ __add_nft_among(h, table, r, data->pairs + data->src.cnt, + data->dst.cnt, true, data->dst.inv, + data->dst.ip); + return 0; +@@ -1463,7 +1462,7 @@ int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, + if (!strcmp(m->u.user.name, "limit")) + return add_nft_limit(r, m); + else if (!strcmp(m->u.user.name, "among")) +- return add_nft_among(h, ctx, r, m); ++ return add_nft_among(h, r, m); + else if (!strcmp(m->u.user.name, "udp")) + return add_nft_udp(h, r, m); + else if (!strcmp(m->u.user.name, "tcp")) +-- +2.41.0 + diff --git a/0025-tables-Reject-invalid-chain-names-when-renaming.patch b/0025-tables-Reject-invalid-chain-names-when-renaming.patch new file mode 100644 index 0000000..49caa9c --- /dev/null +++ b/0025-tables-Reject-invalid-chain-names-when-renaming.patch @@ -0,0 +1,31 @@ +From 2feb8fba886cb9586d6cdc1b5711cff49fe5cf5d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 21 Jul 2023 20:14:09 +0200 +Subject: [PATCH] *tables: Reject invalid chain names when renaming + +While given chain name was sanity checked with --new-chain command, +--rename-chain command allowed to choose an invalid name. Keep things +consistent by adding the missing check. + +Fixes: e6869a8f59d77 ("reorganized tree after kernel merge") +Signed-off-by: Phil Sutter +(cherry picked from commit 344e9b260ba2bbbdd0c32f112273fd552d0b73f4) +--- + iptables/xshared.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 71ee94d6f2f83..6812da501a288 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1521,6 +1521,7 @@ void do_parse(int argc, char *argv[], + "-%c requires old-chain-name and " + "new-chain-name", + cmd2char(CMD_RENAME_CHAIN)); ++ assert_valid_chain_name(p->newname); + break; + + case 'P': +-- +2.41.0 + diff --git a/0026-ebtables-Improve-invalid-chain-name-detection.patch b/0026-ebtables-Improve-invalid-chain-name-detection.patch new file mode 100644 index 0000000..291f73d --- /dev/null +++ b/0026-ebtables-Improve-invalid-chain-name-detection.patch @@ -0,0 +1,94 @@ +From d841d7a1f438e56226cc26b2f8e8525d5aeaa5c6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Jul 2023 13:50:11 +0200 +Subject: [PATCH] ebtables: Improve invalid chain name detection + +Fix several issues: + +- Most importantly, --new-chain command accepted any name. Introduce + ebt_assert_valid_chain_name() for use with both --new-chain and + --rename-chain. +- Restrict maximum name length to what legacy ebtables allows - this is + a bit more than iptables-nft, subject to be unified. +- Like iptables, legacy ebtables rejects names prefixed by '-' or '!'. +- Use xs_has_arg() for consistency, keep the check for extra args for + now. + +Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") +Signed-off-by: Phil Sutter +(cherry picked from commit 687d76937be799a405e63e58861f7e4a965dfa8d) +--- + iptables/xtables-eb.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 3a73e79725489..33f55aee32c8f 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -42,6 +42,10 @@ + #include "nft.h" + #include "nft-bridge.h" + ++/* from linux/netfilter_bridge/ebtables.h */ ++#define EBT_TABLE_MAXNAMELEN 32 ++#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN ++ + /* + * From include/ebtables_u.h + */ +@@ -74,6 +78,26 @@ static int ebt_check_inverse2(const char option[], int argc, char **argv) + return ebt_invert; + } + ++/* XXX: merge with assert_valid_chain_name()? */ ++static void ebt_assert_valid_chain_name(const char *chainname) ++{ ++ if (strlen(chainname) >= EBT_CHAIN_MAXNAMELEN) ++ xtables_error(PARAMETER_PROBLEM, ++ "Chain name length can't exceed %d", ++ EBT_CHAIN_MAXNAMELEN - 1); ++ ++ if (*chainname == '-' || *chainname == '!') ++ xtables_error(PARAMETER_PROBLEM, "No chain name specified"); ++ ++ if (xtables_find_target(chainname, XTF_TRY_LOAD)) ++ xtables_error(PARAMETER_PROBLEM, ++ "Target with name %s exists", chainname); ++ ++ if (strchr(chainname, ' ') != NULL) ++ xtables_error(PARAMETER_PROBLEM, ++ "Use of ' ' not allowed in chain names"); ++} ++ + /* + * Glue code to use libxtables + */ +@@ -750,6 +774,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + flags |= OPT_COMMAND; + + if (c == 'N') { ++ ebt_assert_valid_chain_name(chain); + ret = nft_cmd_chain_user_add(h, chain, *table); + break; + } else if (c == 'X') { +@@ -763,14 +788,12 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + } + + if (c == 'E') { +- if (optind >= argc) ++ if (!xs_has_arg(argc, argv)) + xtables_error(PARAMETER_PROBLEM, "No new chain name specified"); + else if (optind < argc - 1) + xtables_error(PARAMETER_PROBLEM, "No extra options allowed with -E"); +- else if (strlen(argv[optind]) >= NFT_CHAIN_MAXNAMELEN) +- xtables_error(PARAMETER_PROBLEM, "Chain name length can't exceed %d"" characters", NFT_CHAIN_MAXNAMELEN - 1); +- else if (strchr(argv[optind], ' ') != NULL) +- xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); ++ ++ ebt_assert_valid_chain_name(argv[optind]); + + errno = 0; + ret = nft_cmd_chain_user_rename(h, chain, *table, +-- +2.41.0 + diff --git a/0027-tests-shell-Fix-and-extend-chain-rename-test.patch b/0027-tests-shell-Fix-and-extend-chain-rename-test.patch new file mode 100644 index 0000000..c49d9eb --- /dev/null +++ b/0027-tests-shell-Fix-and-extend-chain-rename-test.patch @@ -0,0 +1,87 @@ +From 9ca7dcde885b9dad98761273eecd3921d0064ed2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Jul 2023 13:58:46 +0200 +Subject: [PATCH] tests: shell: Fix and extend chain rename test + +The old version exited unintentionally before testing ip6tables. Replace +it by a more complete variant testing for all tools, creating and +renaming of,chains with various illegal names instead of just renaming +to a clashing name. + +Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases") +Signed-off-by: Phil Sutter +(cherry picked from commit 3bbf5269f25d7bc8cb6ecf2c44e6358579acc459) +--- + .../tests/shell/testcases/chain/0003rename_0 | 40 +++++++++++++++++++ + .../tests/shell/testcases/chain/0003rename_1 | 12 ------ + 2 files changed, 40 insertions(+), 12 deletions(-) + create mode 100755 iptables/tests/shell/testcases/chain/0003rename_0 + delete mode 100755 iptables/tests/shell/testcases/chain/0003rename_1 + +diff --git a/iptables/tests/shell/testcases/chain/0003rename_0 b/iptables/tests/shell/testcases/chain/0003rename_0 +new file mode 100755 +index 0000000000000..4cb2745bc2523 +--- /dev/null ++++ b/iptables/tests/shell/testcases/chain/0003rename_0 +@@ -0,0 +1,40 @@ ++#!/bin/bash -x ++ ++die() { ++ echo "E: $@" ++ exit 1 ++} ++ ++cmds="iptables ip6tables" ++[[ $XT_MULTI == *xtables-nft-multi ]] && cmds+=" arptables ebtables" ++ ++declare -A invnames ++invnames["existing"]="c2" ++invnames["spaced"]="foo bar" ++invnames["dashed"]="-foo" ++invnames["negated"]="!foo" ++# XXX: ebtables-nft accepts 255 chars ++#invnames["overlong"]="thisisquitealongnameforachain" ++invnames["standard target"]="ACCEPT" ++invnames["extension target"]="DNAT" ++ ++for cmd in $cmds; do ++ $XT_MULTI $cmd -N c1 || die "$cmd: can't add chain c1" ++ $XT_MULTI $cmd -N c2 || die "$cmd: can't add chain c2" ++ for key in "${!invnames[@]}"; do ++ val="${invnames[$key]}" ++ if [[ $key == "extension target" ]]; then ++ if [[ $cmd == "arptables" ]]; then ++ val="mangle" ++ elif [[ $cmd == "ebtables" ]]; then ++ val="dnat" ++ fi ++ fi ++ $XT_MULTI $cmd -N "$val" && \ ++ die "$cmd: added chain with $key name" ++ $XT_MULTI $cmd -E c1 "$val" && \ ++ die "$cmd: renamed to $key name" ++ done ++done ++ ++exit 0 +diff --git a/iptables/tests/shell/testcases/chain/0003rename_1 b/iptables/tests/shell/testcases/chain/0003rename_1 +deleted file mode 100755 +index 975c8e196b9f5..0000000000000 +--- a/iptables/tests/shell/testcases/chain/0003rename_1 ++++ /dev/null +@@ -1,12 +0,0 @@ +-#!/bin/bash +- +-$XT_MULTI iptables -N c1 || exit 0 +-$XT_MULTI iptables -N c2 || exit 0 +-$XT_MULTI iptables -E c1 c2 || exit 1 +- +-$XT_MULTI ip6tables -N c1 || exit 0 +-$XT_MULTI ip6tables -N c2 || exit 0 +-$XT_MULTI ip6tables -E c1 c2 || exit 1 +- +-echo "E: Renamed with existing chain" >&2 +-exit 0 +-- +2.41.0 + diff --git a/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch b/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch new file mode 100644 index 0000000..04e661b --- /dev/null +++ b/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch @@ -0,0 +1,52 @@ +From 2eb44e79329b713e4eb50f4816beaa6e6babe1da Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 1 Aug 2023 23:28:20 +0200 +Subject: [PATCH] extensions: libipt_icmp: Fix confusion between 255/255 and + any + +Per definition, ICMP type "any" is type 255 and the full range of codes +(0-255). Save callback though ignored the actual code values, printing +"any" for every type 255 match. This at least confuses users as they +can't find their rule added as '--icmp-type 255/255' anymore. + +It is not entirely clear what the fixed commit was trying to establish, +but the save output is certainly not correct (especially since print +callback gets things right). + +Reported-by: Amelia Downs +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 +Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") +Signed-off-by: Phil Sutter +(cherry picked from commit 5b5430d627bbc227a2d51d4312c371f2015834c6) +--- + extensions/libipt_icmp.c | 3 ++- + extensions/libipt_icmp.t | 2 ++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c +index b0318aebc2c57..171b3b3949e54 100644 +--- a/extensions/libipt_icmp.c ++++ b/extensions/libipt_icmp.c +@@ -108,7 +108,8 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) + printf(" !"); + + /* special hack for 'any' case */ +- if (icmp->type == 0xFF) { ++ if (icmp->type == 0xFF && ++ icmp->code[0] == 0 && icmp->code[1] == 0xFF) { + printf(" --icmp-type any"); + } else { + printf(" --icmp-type %u", icmp->type); +diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t +index f4ba65c27f032..ce4a33f9633b5 100644 +--- a/extensions/libipt_icmp.t ++++ b/extensions/libipt_icmp.t +@@ -13,3 +13,5 @@ + # we accept "iptables -I INPUT -p tcp -m tcp", why not this below? + # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp + # -p icmp -m icmp;=;OK ++-p icmp -m icmp --icmp-type 255/255;=;OK ++-p icmp -m icmp --icmp-type 255/0:255;-p icmp -m icmp --icmp-type any;OK +-- +2.41.0 + diff --git a/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch b/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch new file mode 100644 index 0000000..391b3e6 --- /dev/null +++ b/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch @@ -0,0 +1,39 @@ +From 329a8bb4d4b701b2903b182e8d8950dadbed4752 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 1 Aug 2023 23:42:24 +0200 +Subject: [PATCH] tests: libipt_icmp.t: Enable tests with numeric output + +Unrelated to the question whether numeric (save) output is desired or +not, enable the tests and expect the known format. + +Using --list without --numeric prints the names, BTW. + +Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") +Signed-off-by: Phil Sutter +(cherry picked from commit 99d861c64cda5289e141b2084836663450f1eff0) +--- + extensions/libipt_icmp.t | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t +index ce4a33f9633b5..4ea936217c09a 100644 +--- a/extensions/libipt_icmp.t ++++ b/extensions/libipt_icmp.t +@@ -1,11 +1,8 @@ + :INPUT,FORWARD,OUTPUT + -p icmp -m icmp --icmp-type any;=;OK +-# output uses the number, better use the name? +-# ERROR: cannot find: iptables -I INPUT -p icmp -m icmp --icmp-type echo-reply +-# -p icmp -m icmp --icmp-type echo-reply;=;OK +-# output uses the number, better use the name? +-# ERROR: annot find: iptables -I INPUT -p icmp -m icmp --icmp-type destination-unreachable +-# -p icmp -m icmp --icmp-type destination-unreachable;=;OK ++# XXX: output uses the number, better use the name? ++-p icmp -m icmp --icmp-type echo-reply;-p icmp -m icmp --icmp-type 0;OK ++-p icmp -m icmp --icmp-type destination-unreachable;-p icmp -m icmp --icmp-type 3;OK + # it does not acccept name/name, should we accept this? + # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable + # -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable;=;OK +-- +2.41.0 + diff --git a/0030-man-iptables.8-Fix-intra-page-reference.patch b/0030-man-iptables.8-Fix-intra-page-reference.patch new file mode 100644 index 0000000..babf3b0 --- /dev/null +++ b/0030-man-iptables.8-Fix-intra-page-reference.patch @@ -0,0 +1,33 @@ +From ea90131706ccc3a806d9d0ee0bc196e64690f7e1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 00:23:37 +0200 +Subject: [PATCH] man: iptables.8: Fix intra page reference + +When sections MATCH EXTENSIONS and TARGET EXTENSIONS were combined, the +reference could have been updated to specify the exact title. + +Fixes: 4496801821c01 ("doc: deduplicate extension descriptions into a new manpage") +Signed-off-by: Phil Sutter +(cherry picked from commit 3bda308b32847d08b2c27077fa3c02200b59cdca) +--- + iptables/iptables.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in +index f81c632f2be86..c336ddf6e4f95 100644 +--- a/iptables/iptables.8.in ++++ b/iptables/iptables.8.in +@@ -307,8 +307,8 @@ false, evaluation will stop. + This specifies the target of the rule; i.e., what to do if the packet + matches it. The target can be a user-defined chain (other than the + one this rule is in), one of the special builtin targets which decide +-the fate of the packet immediately, or an extension (see \fBEXTENSIONS\fP +-below). If this ++the fate of the packet immediately, or an extension (see \fBMATCH AND TARGET ++EXTENSIONS\fP below). If this + option is omitted in a rule (and \fB\-g\fP + is not used), then matching the rule will have no + effect on the packet's fate, but the counters on the rule will be +-- +2.41.0 + diff --git a/0031-man-iptables.8-Clarify-goto-description.patch b/0031-man-iptables.8-Clarify-goto-description.patch new file mode 100644 index 0000000..f57e2af --- /dev/null +++ b/0031-man-iptables.8-Clarify-goto-description.patch @@ -0,0 +1,32 @@ +From 4e13b0b775522b2da8951c01713c47f235af8110 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 00:28:03 +0200 +Subject: [PATCH] man: iptables.8: Clarify --goto description + +Text speaks about behaviour of RETURN target when used in chains +redirected to using --goto instead of --jump, not the difference between +--jump option and "return". + +Fixes: 17fc163babc34 ("add 'goto' support (Henrik Nordstrom )") +Signed-off-by: Phil Sutter +(cherry picked from commit 94c19939744dbbbc6ff0fedf6cdba661769fdc87) +--- + iptables/iptables.8.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in +index c336ddf6e4f95..2365380490d52 100644 +--- a/iptables/iptables.8.in ++++ b/iptables/iptables.8.in +@@ -316,7 +316,7 @@ incremented. + .TP + \fB\-g\fP, \fB\-\-goto\fP \fIchain\fP + This specifies that the processing should continue in a user +-specified chain. Unlike the \-\-jump option return will not continue ++specified chain. Unlike with the \-\-jump option, \fBRETURN\fP will not continue + processing in this chain but instead in the chain that called us via + \-\-jump. + .TP +-- +2.41.0 + diff --git a/0032-man-iptables-restore.8-Fix-modprobe-description.patch b/0032-man-iptables-restore.8-Fix-modprobe-description.patch new file mode 100644 index 0000000..56d8dae --- /dev/null +++ b/0032-man-iptables-restore.8-Fix-modprobe-description.patch @@ -0,0 +1,37 @@ +From 1a62df2225b0d087a417d04455fe1e10384837e0 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:27:11 +0200 +Subject: [PATCH] man: iptables-restore.8: Fix --modprobe description + +- Consistently use 'modprobe' as option argument name +- Add a reference to modprobe man page +- Put the path in italics, and the command in bold + +Fixes: 8c46901ff5785 ("doc: document iptables-restore's -M option") +Signed-off-by: Phil Sutter +(cherry picked from commit 0f05f523ac02843ab7bbd09a96ba3fa384ae9523) +--- + iptables/iptables-restore.8.in | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index 20216842d8358..f95f00acd8d49 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -67,9 +67,10 @@ the program will exit if the lock cannot be obtained. This option will + make the program wait (indefinitely or for optional \fIseconds\fP) until + the exclusive lock can be obtained. + .TP +-\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe_program\fP +-Specify the path to the modprobe program. By default, iptables-restore will +-inspect /proc/sys/kernel/modprobe to determine the executable's path. ++\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe\fP ++Specify the path to the modprobe(8) program. By default, ++iptables-restore will inspect \fI/proc/sys/kernel/modprobe\fP to ++determine the executable's path. + .TP + \fB\-T\fP, \fB\-\-table\fP \fIname\fP + Restore only the named table even if the input stream contains other ones. +-- +2.41.0 + diff --git a/0033-man-iptables-restore.8-Consistently-document-w-optio.patch b/0033-man-iptables-restore.8-Consistently-document-w-optio.patch new file mode 100644 index 0000000..76b3885 --- /dev/null +++ b/0033-man-iptables-restore.8-Consistently-document-w-optio.patch @@ -0,0 +1,35 @@ +From 2b2c2310a61d17bf63845e7f70352342a072f08a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:33:26 +0200 +Subject: [PATCH] man: iptables-restore.8: Consistently document -w option + +Use the same name for the option's argument. + +Fixes: 65801d02a482b ("iptables-restore.8: document -w/-W options") +Signed-off-by: Phil Sutter +(cherry picked from commit e7bc6cc8aca993b743e83f20b2f579aed2f5d954) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index f95f00acd8d49..a63a344c0bd72 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -23,11 +23,11 @@ iptables-restore \(em Restore IP Tables + .P + ip6tables-restore \(em Restore IPv6 Tables + .SH SYNOPSIS +-\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP] ++\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .P +-\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP] ++\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .SH DESCRIPTION +-- +2.41.0 + diff --git a/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch b/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch new file mode 100644 index 0000000..ef01dfd --- /dev/null +++ b/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch @@ -0,0 +1,36 @@ +From 41257615e8d30c5969e3639d6ad5cd6f34f9143e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:34:51 +0200 +Subject: [PATCH] man: iptables-restore.8: Drop -W option from synopsis + +The description was dropped already, there is no benefit in still +listing it. + +Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") +Signed-off-by: Phil Sutter +(cherry picked from commit 193107df55541ced2e783bcce9b71b97f88a5398) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index a63a344c0bd72..bfd2fc355dd49 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -24,11 +24,11 @@ iptables-restore \(em Restore IP Tables + ip6tables-restore \(em Restore IPv6 Tables + .SH SYNOPSIS + \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] +-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] ++[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .P + \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] +-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] ++[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .SH DESCRIPTION + .PP +-- +2.41.0 + diff --git a/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch b/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch new file mode 100644 index 0000000..673c6ad --- /dev/null +++ b/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch @@ -0,0 +1,35 @@ +From 97baff1f10262947c0feb6d6d14e67f1e7eb1bb0 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:37:09 +0200 +Subject: [PATCH] man: iptables-restore.8: Put 'file' in italics in synopsis + +The text has it this way already, be consistent. + +Fixes: 081d57839e91e ("iptables-restore.8: file to read from can be specified as argument") +Signed-off-by: Phil Sutter +(cherry picked from commit b200f0870bc17046d6db64a1a65937ad5f263633) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index bfd2fc355dd49..ff8179091eeee 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -25,11 +25,11 @@ ip6tables-restore \(em Restore IPv6 Tables + .SH SYNOPSIS + \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] +-[\fBfile\fP] ++[\fIfile\fP] + .P + \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] +-[\fBfile\fP] ++[\fIfile\fP] + .SH DESCRIPTION + .PP + .B iptables-restore +-- +2.41.0 + diff --git a/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch b/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch new file mode 100644 index 0000000..badd260 --- /dev/null +++ b/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch @@ -0,0 +1,37 @@ +From 868d7b3a16741bfa7e0c89ee1c840e4a3e51e2b2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:40:17 +0200 +Subject: [PATCH] man: iptables-restore.8: Start paragraphs in upper-case + +Also add a missing full stop in one spot. + +Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") +Signed-off-by: Phil Sutter +(cherry picked from commit 935a5cf8afa96daa1c688efd59b9025e3a78fba4) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index ff8179091eeee..ce4520e626772 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -40,13 +40,13 @@ are used to restore IP and IPv6 Tables from data specified on STDIN or in + specify \fIfile\fP as an argument. + .TP + \fB\-c\fR, \fB\-\-counters\fR +-restore the values of all packet and byte counters ++Restore the values of all packet and byte counters. + .TP + \fB\-h\fP, \fB\-\-help\fP + Print a short option summary. + .TP + \fB\-n\fR, \fB\-\-noflush\fR +-don't flush the previous contents of the table. If not specified, ++Don't flush the previous contents of the table. If not specified, + both commands flush (delete) all previous contents of the respective table. + .TP + \fB\-t\fP, \fB\-\-test\fP +-- +2.41.0 + diff --git a/0037-man-Trivial-Missing-space-after-comma.patch b/0037-man-Trivial-Missing-space-after-comma.patch new file mode 100644 index 0000000..ade4e0a --- /dev/null +++ b/0037-man-Trivial-Missing-space-after-comma.patch @@ -0,0 +1,42 @@ +From 1016392a3d59afcda3eae03efe87353a3706a331 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:48:14 +0200 +Subject: [PATCH] man: Trivial: Missing space after comma + +Fixes: 6a79d78986c02 ("iptables: mention iptables-apply(8) in manpages") +Signed-off-by: Phil Sutter +(cherry picked from commit b0092a80656da7cf66f15ce906b17ab040ece12f) +--- + iptables/iptables-restore.8.in | 2 +- + iptables/iptables-save.8.in | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index ce4520e626772..aa816f794d6f3 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -82,7 +82,7 @@ from Rusty Russell. + .br + Andras Kis-Szabo contributed ip6tables-restore. + .SH SEE ALSO +-\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8) ++\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8) + .PP + The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, + which details NAT, and the netfilter-hacking-HOWTO which details the +diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in +index 7683fd3780f72..253907719acee 100644 +--- a/iptables/iptables-save.8.in ++++ b/iptables/iptables-save.8.in +@@ -62,7 +62,7 @@ Rusty Russell + .br + Andras Kis-Szabo contributed ip6tables-save. + .SH SEE ALSO +-\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8) ++\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8) + .PP + The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, + which details NAT, and the netfilter-hacking-HOWTO which details the +-- +2.41.0 + diff --git a/0038-man-iptables-save.8-Fix-modprobe-description.patch b/0038-man-iptables-save.8-Fix-modprobe-description.patch new file mode 100644 index 0000000..11d8cce --- /dev/null +++ b/0038-man-iptables-save.8-Fix-modprobe-description.patch @@ -0,0 +1,37 @@ +From 5e144f6fc73baafada7c34779ebaafbbd3ecf45b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 02:01:59 +0200 +Subject: [PATCH] man: iptables-save.8: Fix --modprobe description + +- Consistently use 'modprobe' as option argument name +- Add a reference to modprobe man page +- Put the path in italics and the command in bold + +Fixes: fbb5639c02218 ("iptables-save: module loading corrections") +Signed-off-by: Phil Sutter +(cherry picked from commit f1fd95ccefe483f0e3f2da593c6d4b671a7de522) +--- + iptables/iptables-save.8.in | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in +index 253907719acee..4a2c90c2f5956 100644 +--- a/iptables/iptables-save.8.in ++++ b/iptables/iptables-save.8.in +@@ -36,9 +36,10 @@ and + are used to dump the contents of IP or IPv6 Table in easily parseable format + either to STDOUT or to a specified file. + .TP +-\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP +-Specify the path to the modprobe program. By default, iptables-save will +-inspect /proc/sys/kernel/modprobe to determine the executable's path. ++\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe\fP ++Specify the path to the modprobe(8) program. By default, ++iptables-save will inspect \fI/proc/sys/kernel/modprobe\fP to determine ++the executable's path. + .TP + \fB\-f\fR, \fB\-\-file\fR \fIfilename\fP + Specify a filename to log the output to. If not specified, iptables-save +-- +2.41.0 + diff --git a/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch b/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch new file mode 100644 index 0000000..fd1267a --- /dev/null +++ b/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch @@ -0,0 +1,34 @@ +From 13aa85e1a27f50f91d6cfe521cca55cf37f4ac48 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 02:06:00 +0200 +Subject: [PATCH] man: iptables-save.8: Start paragraphs in upper-case + +Also add a missing full stop. + +Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") +Signed-off-by: Phil Sutter +(cherry picked from commit 952186aa0342f6bf3c4614a609525338d057d8d9) +--- + iptables/iptables-save.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in +index 4a2c90c2f5956..7c0d2552e8b97 100644 +--- a/iptables/iptables-save.8.in ++++ b/iptables/iptables-save.8.in +@@ -46,10 +46,10 @@ Specify a filename to log the output to. If not specified, iptables-save + will log to STDOUT. + .TP + \fB\-c\fR, \fB\-\-counters\fR +-include the current values of all packet and byte counters in the output ++Include the current values of all packet and byte counters in the output. + .TP + \fB\-t\fR, \fB\-\-table\fR \fItablename\fP +-restrict output to only one table. If the kernel is configured with automatic ++Restrict output to only one table. If the kernel is configured with automatic + module loading, an attempt will be made to load the appropriate module for + that table if it is not already there. + .br +-- +2.41.0 + diff --git a/0040-tests-iptables-test-Fix-command-segfault-reports.patch b/0040-tests-iptables-test-Fix-command-segfault-reports.patch new file mode 100644 index 0000000..5ec3a1d --- /dev/null +++ b/0040-tests-iptables-test-Fix-command-segfault-reports.patch @@ -0,0 +1,52 @@ +From 9b0b0db6aa82c8433002880f73a7614bb453320d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 26 Jul 2023 19:43:20 +0200 +Subject: [PATCH] tests: iptables-test: Fix command segfault reports + +Logging produced a stack trace due to undefined variable 'cmd'. + +Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") +Signed-off-by: Phil Sutter +(cherry picked from commit 5412ccba55b2318160d32efec3b8aad162608af9) +--- + iptables-test.py | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/iptables-test.py b/iptables-test.py +index de1e1e95fda55..065c322a173ca 100755 +--- a/iptables-test.py ++++ b/iptables-test.py +@@ -136,7 +136,7 @@ STDERR_IS_TTY = sys.stderr.isatty() + # check for segfaults + # + if proc.returncode == -11: +- reason = "iptables-save segfaults: " + cmd ++ reason = command + " segfaults!" + print_error(reason, filename, lineno) + delete_rule(iptables, rule, filename, lineno, netns) + return -1 +@@ -333,8 +333,11 @@ STDERR_IS_TTY = sys.stderr.isatty() + out, err = proc.communicate(input = restore_data) + + if proc.returncode == -11: +- reason = iptables + "-restore segfaults: " + cmd ++ reason = iptables + "-restore segfaults!" + print_error(reason, filename, lineno) ++ msg = [iptables + "-restore segfault from:"] ++ msg.extend(["input: " + l for l in restore_data.split("\n")]) ++ print("\n".join(msg), file=log_file) + return -1 + + if proc.returncode != 0: +@@ -355,7 +358,7 @@ STDERR_IS_TTY = sys.stderr.isatty() + out, err = proc.communicate() + + if proc.returncode == -11: +- reason = iptables + "-save segfaults: " + cmd ++ reason = iptables + "-save segfaults!" + print_error(reason, filename, lineno) + return -1 + +-- +2.41.0 + diff --git a/0041-nft-Create-builtin-chains-with-counters-enabled.patch b/0041-nft-Create-builtin-chains-with-counters-enabled.patch new file mode 100644 index 0000000..21f9912 --- /dev/null +++ b/0041-nft-Create-builtin-chains-with-counters-enabled.patch @@ -0,0 +1,63 @@ +From 85746b658b9eedafd5523b5501ce0f8b5f5bdcbf Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 10 Aug 2023 11:30:59 +0200 +Subject: [PATCH] nft: Create builtin chains with counters enabled + +The kernel enables policy counters for nftables chains only if +NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one +has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the +allocated nftnl_chain object. + +The above happened for base chains only with iptables-nft-restore if +called with --counters flag. Since this is very unintuitive to users, +fix the situation by adding counters to base chains in any case. + +Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface") +Signed-off-by: Phil Sutter +(cherry picked from commit 39a067bb3b1b4ffb50a925f66e7db56658c0dfa7) +--- + iptables/nft.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 66b47d72e3ae8..2b5a27922a06e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -686,6 +686,9 @@ nft_chain_builtin_alloc(int family, const char *tname, + + nftnl_chain_set_str(c, NFTNL_CHAIN_TYPE, chain->type); + ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0); ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0); ++ + return c; + } + +@@ -946,6 +949,7 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h, + int policy, + const struct xt_counters *counters) + { ++ static const struct xt_counters zero = {}; + struct nftnl_chain *c; + const struct builtin_table *_t; + const struct builtin_chain *_c; +@@ -970,12 +974,10 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h, + return NULL; + } + +- if (counters) { +- nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, +- counters->bcnt); +- nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, +- counters->pcnt); +- } ++ if (!counters) ++ counters = &zero; ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, counters->bcnt); ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, counters->pcnt); + + return c; + } +-- +2.41.0 + diff --git a/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch b/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch new file mode 100644 index 0000000..6818a1e --- /dev/null +++ b/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch @@ -0,0 +1,37 @@ +From 4cec9d5fec5c5bcc51b84e3ed9ba9619fe8b2909 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 3 Aug 2023 17:59:03 +0200 +Subject: [PATCH] Revert "libiptc: fix wrong maptype of base chain counters on + restore" + +This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4. + +The change can't be right: A simple rule append call will reset all +built-in chains' counters. The old code works fine even given the +mentioned "empty restore" use-case, at least if counters don't change on +the fly in-kernel. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912 +Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore") +Signed-off-by: Phil Sutter +(cherry picked from commit 43f78733059ecd28d8567d8205cab5ed62d93458) +--- + libiptc/libiptc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c +index f9b7779efdba5..29ff356f2324e 100644 +--- a/libiptc/libiptc.c ++++ b/libiptc/libiptc.c +@@ -822,7 +822,7 @@ static int __iptcc_p_del_policy(struct xtc_handle *h, unsigned int num) + + /* save counter and counter_map information */ + h->chain_iterator_cur->counter_map.maptype = +- COUNTER_MAP_ZEROED; ++ COUNTER_MAP_NORMAL_MAP; + h->chain_iterator_cur->counter_map.mappos = num-1; + memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters, + sizeof(h->chain_iterator_cur->counters)); +-- +2.41.0 + diff --git a/0043-doc-fix-example-of-xt_cpu.patch b/0043-doc-fix-example-of-xt_cpu.patch new file mode 100644 index 0000000..bfc6a76 --- /dev/null +++ b/0043-doc-fix-example-of-xt_cpu.patch @@ -0,0 +1,35 @@ +From 12e7024d3e8d245bb5645167f3aeb4c0187f75fd Mon Sep 17 00:00:00 2001 +From: Victor Julien +Date: Tue, 29 Aug 2023 14:59:32 +0200 +Subject: [PATCH] doc: fix example of xt_cpu + +REDIRECT uses --to-ports instead of --to-port. + +Fixes: 2d59208943a3 ("extension: add xt_cpu match") + +Signed-off-by: Victor Julien +Signed-off-by: Florian Westphal +(cherry picked from commit 63e4a64e943be64a7e0486838071b981074e696d) +--- + extensions/libxt_cpu.man | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_cpu.man b/extensions/libxt_cpu.man +index d9ea5c2faa20b..c89ef08afbfbb 100644 +--- a/extensions/libxt_cpu.man ++++ b/extensions/libxt_cpu.man +@@ -7,9 +7,9 @@ multiqueue NICs to spread network traffic on different queues. + Example: + .PP + iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 0 +-\-j REDIRECT \-\-to\-port 8080 ++\-j REDIRECT \-\-to\-ports 8080 + .PP + iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 1 +-\-j REDIRECT \-\-to\-port 8081 ++\-j REDIRECT \-\-to\-ports 8081 + .PP + Available since Linux 2.6.36. +-- +2.41.0 + diff --git a/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch b/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch new file mode 100644 index 0000000..632021f --- /dev/null +++ b/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch @@ -0,0 +1,92 @@ +From 16822c25bf795b54b13ada62da762ee7e9c2b12f Mon Sep 17 00:00:00 2001 +From: Quentin Armitage +Date: Sat, 23 Nov 2013 08:41:58 +0000 +Subject: [PATCH] extensions: Fix checking of conntrack --ctproto 0 + +There are three issues in the code: +1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask +2) in conntrack_mt_parse it is testing (info->invert_flags & + XT_INV_PROTO) before the invert bit has been set. +3) the sense of the error message is the wrong way round + +1) To get the error, ! -ctstatus XXX has to be specified, since + XT_INV_PROTO == XT_CONNTRACK_STATUS e.g. + | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ... + +3) Unlike --proto 0 (where 0 means all protocols), in the conntrack + match --ctproto 0 appears to mean protocol 0, which can never be. + Therefore --ctproto 0 could never match and ! --ctproto 0 will always + match. Both of these should be rejected, since the user clearly + cannot be intending what was specified. + +The attached patch resolves the issue, and also produces an error +message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since +--ctproto 0 will never match, and ! --ctproto 0 will always match. + +[Phil: - Added Fixes: tag - it's a day 1 bug + - Copied patch description from Bugzilla + - Reorganized changes to reduce diff + - Added test cases] + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874 +Fixes: 5054e85be3068 ("general conntrack match module userspace support files") +Signed-off-by: Quentin Armitage +Signed-off-by: Phil Sutter +(cherry picked from commit 2e704f6ddd6d056e360f3d9c11e8b6c56a20cf23) +--- + extensions/libxt_conntrack.c | 17 ++++++++--------- + extensions/libxt_conntrack.t | 2 ++ + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c +index 09548c297695f..ffbc7467bbf2e 100644 +--- a/extensions/libxt_conntrack.c ++++ b/extensions/libxt_conntrack.c +@@ -346,14 +346,13 @@ static void conntrack_parse(struct xt_option_call *cb) + sinfo->invflags |= XT_CONNTRACK_STATE; + break; + case O_CTPROTO: ++ if (cb->val.protocol == 0) ++ xtables_error(PARAMETER_PROBLEM, cb->invert ? ++ "condition would always match protocol" : ++ "rule would never match protocol"); + sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum = cb->val.protocol; + if (cb->invert) + sinfo->invflags |= XT_CONNTRACK_PROTO; +- if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0 +- && (sinfo->invflags & XT_INV_PROTO)) +- xtables_error(PARAMETER_PROBLEM, +- "rule would never match protocol"); +- + sinfo->flags |= XT_CONNTRACK_PROTO; + break; + case O_CTORIGSRC: +@@ -411,11 +410,11 @@ static void conntrack_mt_parse(struct xt_option_call *cb, uint8_t rev) + info->invert_flags |= XT_CONNTRACK_STATE; + break; + case O_CTPROTO: ++ if (cb->val.protocol == 0) ++ xtables_error(PARAMETER_PROBLEM, cb->invert ? ++ "conntrack: condition would always match protocol" : ++ "conntrack: rule would never match protocol"); + info->l4proto = cb->val.protocol; +- if (info->l4proto == 0 && (info->invert_flags & XT_INV_PROTO)) +- xtables_error(PARAMETER_PROBLEM, "conntrack: rule would " +- "never match protocol"); +- + info->match_flags |= XT_CONNTRACK_PROTO; + if (cb->invert) + info->invert_flags |= XT_CONNTRACK_PROTO; +diff --git a/extensions/libxt_conntrack.t b/extensions/libxt_conntrack.t +index db53147532afd..2b3c5de9cd3ab 100644 +--- a/extensions/libxt_conntrack.t ++++ b/extensions/libxt_conntrack.t +@@ -25,3 +25,5 @@ + -m conntrack --ctstatus EXPECTED;=;OK + -m conntrack --ctstatus SEEN_REPLY;=;OK + -m conntrack;;FAIL ++-m conntrack --ctproto 0;;FAIL ++-m conntrack ! --ctproto 0;;FAIL +-- +2.41.0 + diff --git a/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch b/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch new file mode 100644 index 0000000..adf28ca --- /dev/null +++ b/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch @@ -0,0 +1,44 @@ +From 73f49fada3a73b321a0c01fc3014d7617180f1ed Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 1 Sep 2023 13:16:56 +0200 +Subject: [PATCH] tests: shell: Fix for ineffective 0007-mid-restore-flush_0 + +The test did not catch non-zero exit status of the spawned coprocess. To +make it happen, Drop the line killing it (it will exit anyway) and pass +its PID to 'wait'. + +While being at it, put the sleep into the correct spot (otherwise the +check for chain 'foo' existence fails as it runs too early) and make +said chain existence check effective. + +Fixes: 4e3c11a6f5a94 ("nft: Fix for ruleset flush while restoring") +Signed-off-by: Phil Sutter +(cherry picked from commit ea12b1d2b191f100a6fdb83af4681364e4dba12a) +--- + .../shell/testcases/nft-only/0007-mid-restore-flush_0 | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 +index 43880ffbc5851..981f007f205b9 100755 +--- a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 ++++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 +@@ -13,11 +13,11 @@ COMMIT + :foo [0:0] + EOF + +-$XT_MULTI iptables-save | grep -q ':foo' ++sleep 1 ++$XT_MULTI iptables-save | grep -q ':foo' || exit 1 + nft flush ruleset + + echo "COMMIT" >&"${COPROC[1]}" +-sleep 1 +- +-[[ -n $COPROC_PID ]] && kill $COPROC_PID +-wait ++# close the pipe to make iptables-restore exit if it didn't error out yet ++eval "exec ${COPROC[1]}>&-" ++wait $COPROC_PID +-- +2.41.0 + diff --git a/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch b/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch new file mode 100644 index 0000000..0f367e7 --- /dev/null +++ b/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch @@ -0,0 +1,277 @@ +From fea09f9273e279d0a18a9db368546897fe3b2edd Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 6 Sep 2023 16:32:47 +0200 +Subject: [PATCH] nft: Fix for useless meta expressions in rule + +A relict of legacy iptables' mandatory matching on interfaces and IP +addresses is support for the '-i +' notation, basically a "match any +input interface". Trying to make things better than its predecessor, +iptables-nft boldly optimizes that nop away - not entirely though, the +meta expression loading the interface name was left in place. While not +a problem (apart from pointless overhead) in current HEAD, v1.8.7 would +trip over this as a following cmp expression (for another match) was +incorrectly linked to that stale meta expression, loading strange values +into the respective interface name field. + +While being at it, merge and generalize the functions into a common one +for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. + +Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 +Signed-off-by: Phil Sutter +(cherry picked from commit 52ed0ac516db9f3a44f61dfd8b65d20631bfa95b) +--- + extensions/libebt_standard.t | 4 ++++ + extensions/libip6t_standard.t | 3 +++ + extensions/libxt_standard.t | 2 ++ + iptables/nft-arp.c | 4 ++-- + iptables/nft-bridge.c | 38 ++++------------------------- + iptables/nft-ipv4.c | 4 ++-- + iptables/nft-ipv6.c | 4 ++-- + iptables/nft-shared.c | 45 ++++++++++++----------------------- + iptables/nft-shared.h | 4 ++-- + 9 files changed, 36 insertions(+), 72 deletions(-) + +diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t +index 97cb3baaf6d21..370a12f4a2cec 100644 +--- a/extensions/libebt_standard.t ++++ b/extensions/libebt_standard.t +@@ -14,6 +14,10 @@ + -o foobar;=;FAIL + --logical-in br0;=;OK + --logical-out br1;=;FAIL ++-i + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK ++-i + -p ip;-p IPv4;OK ++--logical-in + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK ++--logical-in + -p ip;-p IPv4;OK + :FORWARD + -i foobar;=;OK + -o foobar;=;OK +diff --git a/extensions/libip6t_standard.t b/extensions/libip6t_standard.t +index a528af10ea152..0c559cc5021f6 100644 +--- a/extensions/libip6t_standard.t ++++ b/extensions/libip6t_standard.t +@@ -3,3 +3,6 @@ + ! -d ::;! -d ::/128;OK + ! -s ::;! -s ::/128;OK + -s ::/64;=;OK ++:INPUT ++-i + -d c0::fe;-d c0::fe/128;OK ++-i + -p tcp;-p tcp;OK +diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t +index 6ed978e442b80..7c83cfa3ba232 100644 +--- a/extensions/libxt_standard.t ++++ b/extensions/libxt_standard.t +@@ -24,3 +24,5 @@ + :FORWARD + --protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK + -ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK ++-i + -d 1.2.3.4;-d 1.2.3.4/32;OK ++-i + -p tcp;-p tcp;OK +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 889387e4db592..54cddbc5f07cc 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -49,12 +49,12 @@ static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (fw->arp.iniface[0] != '\0') { + op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN); +- add_iniface(h, r, fw->arp.iniface, op); ++ add_iface(h, r, fw->arp.iniface, NFT_META_IIFNAME, op); + } + + if (fw->arp.outiface[0] != '\0') { + op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT); +- add_outiface(h, r, fw->arp.outiface, op); ++ add_iface(h, r, fw->arp.outiface, NFT_META_OIFNAME, op); + } + + if (fw->arp.arhrd != 0 || +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index a41f411fbba14..9e349813ee5b3 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -65,36 +65,6 @@ static void ebt_print_mac_and_mask(const unsigned char *mac, const unsigned char + xtables_print_mac_and_mask(mac, mask); + } + +-static void add_logical_iniface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) +-{ +- int iface_len; +- uint8_t reg; +- +- iface_len = strlen(iface); +- +- add_meta(h, r, NFT_META_BRI_IIFNAME, ®); +- if (iface[iface_len - 1] == '+') +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); +-} +- +-static void add_logical_outiface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) +-{ +- int iface_len; +- uint8_t reg; +- +- iface_len = strlen(iface); +- +- add_meta(h, r, NFT_META_BRI_OIFNAME, ®); +- if (iface[iface_len - 1] == '+') +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); +-} +- + static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) + { + return add_action(r, cs, false); +@@ -130,22 +100,22 @@ static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (fw->in[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_IIN); +- add_iniface(h, r, fw->in, op); ++ add_iface(h, r, fw->in, NFT_META_IIFNAME, op); + } + + if (fw->out[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_IOUT); +- add_outiface(h, r, fw->out, op); ++ add_iface(h, r, fw->out, NFT_META_OIFNAME, op); + } + + if (fw->logical_in[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALIN); +- add_logical_iniface(h, r, fw->logical_in, op); ++ add_iface(h, r, fw->logical_in, NFT_META_BRI_IIFNAME, op); + } + + if (fw->logical_out[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALOUT); +- add_logical_outiface(h, r, fw->logical_out, op); ++ add_iface(h, r, fw->logical_out, NFT_META_BRI_OIFNAME, op); + } + + if (fw->bitmask & EBT_ISOURCE) { +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index fb62103fd38d7..8449407bd40ed 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -35,12 +35,12 @@ static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (cs->fw.ip.iniface[0] != '\0') { + op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN); +- add_iniface(h, r, cs->fw.ip.iniface, op); ++ add_iface(h, r, cs->fw.ip.iniface, NFT_META_IIFNAME, op); + } + + if (cs->fw.ip.outiface[0] != '\0') { + op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_OUT); +- add_outiface(h, r, cs->fw.ip.outiface, op); ++ add_iface(h, r, cs->fw.ip.outiface, NFT_META_OIFNAME, op); + } + + if (cs->fw.ip.proto != 0) { +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index d36e06812e08d..443815da77acf 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -34,12 +34,12 @@ static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (cs->fw6.ipv6.iniface[0] != '\0') { + op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN); +- add_iniface(h, r, cs->fw6.ipv6.iniface, op); ++ add_iface(h, r, cs->fw6.ipv6.iniface, NFT_META_IIFNAME, op); + } + + if (cs->fw6.ipv6.outiface[0] != '\0') { + op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT); +- add_outiface(h, r, cs->fw6.ipv6.outiface, op); ++ add_iface(h, r, cs->fw6.ipv6.outiface, NFT_META_OIFNAME, op); + } + + if (cs->fw6.ipv6.proto != 0) { +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 413503ed86932..a23a2c8a8fa11 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -155,44 +155,29 @@ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg) + add_cmp_ptr(r, op, &val, sizeof(val), sreg); + } + +-void add_iniface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) ++void add_iface(struct nft_handle *h, struct nftnl_rule *r, ++ char *iface, uint32_t key, uint32_t op) + { +- int iface_len; ++ int iface_len = strlen(iface); + uint8_t reg; + +- iface_len = strlen(iface); + +- add_meta(h, r, NFT_META_IIFNAME, ®); + if (iface[iface_len - 1] == '+') { +- if (iface_len > 1) +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else if (op != NFT_CMP_EQ) +- add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D", +- strlen("INVAL/D") + 1, reg); ++ if (iface_len > 1) { ++ iface_len -= 1; ++ } else if (op != NFT_CMP_EQ) { ++ op = NFT_CMP_EQ; ++ iface = "INVAL/D"; ++ iface_len = strlen(iface) + 1; ++ } else { ++ return; /* -o + */ ++ } + } else { +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); ++ iface_len += 1; + } +-} +- +-void add_outiface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) +-{ +- int iface_len; +- uint8_t reg; + +- iface_len = strlen(iface); +- +- add_meta(h, r, NFT_META_OIFNAME, ®); +- if (iface[iface_len - 1] == '+') { +- if (iface_len > 1) +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else if (op != NFT_CMP_EQ) +- add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D", +- strlen("INVAL/D") + 1, reg); +- } else { +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); +- } ++ add_meta(h, r, key, ®); ++ add_cmp_ptr(r, op, iface, iface_len, reg); + } + + void add_addr(struct nft_handle *h, struct nftnl_rule *r, +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 9065e52f669e1..94cc295436a27 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -193,8 +193,8 @@ void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len, uint + void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op, uint8_t sreg); + void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op, uint8_t sreg); + void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg); +-void add_iniface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); +-void add_outiface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); ++void add_iface(struct nft_handle *h, struct nftnl_rule *r, ++ char *iface, uint32_t key, uint32_t op); + void add_addr(struct nft_handle *h, struct nftnl_rule *r, enum nft_payload_bases base, int offset, + void *data, void *mask, size_t len, uint32_t op); + void add_proto(struct nft_handle *h, struct nftnl_rule *r, int offset, size_t len, +-- +2.41.0 + diff --git a/iptables.spec b/iptables.spec index d779895..cb64d89 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 4%{?dist} +Release: 4%{?dist}.1 Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -37,6 +37,35 @@ Patch014: 0014-nft-shared-Drop-unused-include.patch Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +Patch018: 0018-iptables-Fix-setting-of-ipv6-counters.patch +Patch019: 0019-iptables-Fix-handling-of-non-existent-chains.patch +Patch020: 0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch +Patch021: 0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch +Patch022: 0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch +Patch023: 0023-nft-Special-casing-for-among-match-in-compare_matche.patch +Patch024: 0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch +Patch025: 0025-tables-Reject-invalid-chain-names-when-renaming.patch +Patch026: 0026-ebtables-Improve-invalid-chain-name-detection.patch +Patch027: 0027-tests-shell-Fix-and-extend-chain-rename-test.patch +Patch028: 0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch +Patch029: 0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch +Patch030: 0030-man-iptables.8-Fix-intra-page-reference.patch +Patch031: 0031-man-iptables.8-Clarify-goto-description.patch +Patch032: 0032-man-iptables-restore.8-Fix-modprobe-description.patch +Patch033: 0033-man-iptables-restore.8-Consistently-document-w-optio.patch +Patch034: 0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch +Patch035: 0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch +Patch036: 0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch +Patch037: 0037-man-Trivial-Missing-space-after-comma.patch +Patch038: 0038-man-iptables-save.8-Fix-modprobe-description.patch +Patch039: 0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch +Patch040: 0040-tests-iptables-test-Fix-command-segfault-reports.patch +Patch041: 0041-nft-Create-builtin-chains-with-counters-enabled.patch +Patch042: 0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch +Patch043: 0043-doc-fix-example-of-xt_cpu.patch +Patch044: 0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch +Patch045: 0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch +Patch046: 0046-nft-Fix-for-useless-meta-expressions-in-rule.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -447,6 +476,9 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.9-4.1 +- Backport fixes from upstream + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream