From 4ee5eabf2a57eeb5750ca7bfc6befcba39aad965 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 12 Jan 2023 14:16:58 +0100 Subject: [PATCH 01/46] New version 1.8.9 - Make iptables-xml a relative symlink - Drop not needed xtables.conf - Ship iptables.xslt with iptables-legacy package - Ship ebtables-translate tool with iptables-nft package Resolves: rhbz#2160427 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 29 +++++++++++++++++++ ...Fix-build-for-Werror-format-security.patch | 29 ------------------- iptables.spec | 26 +++++++++++++---- sources | 2 +- 5 files changed, 52 insertions(+), 35 deletions(-) create mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0001-xshared-Fix-build-for-Werror-format-security.patch diff --git a/.gitignore b/.gitignore index d0729c1..141b2e8 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /iptables-1.8.6.tar.bz2 /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 +/iptables-1.8.9.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch new file mode 100644 index 0000000..ff8adfb --- /dev/null +++ b/0001-extensions-NAT-Fix-for-Werror-format-security.patch @@ -0,0 +1,29 @@ +From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Jan 2023 14:38:44 +0100 +Subject: [iptables PATCH] extensions: NAT: Fix for -Werror=format-security + +Have to pass either a string literal or format string to xt_xlate_add(). + +Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") +Signed-off-by: Phil Sutter +--- + extensions/libxt_NAT.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c +index da9f22012c5d6..2a6343986d54f 100644 +--- a/extensions/libxt_NAT.c ++++ b/extensions/libxt_NAT.c +@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, + if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) + return 0; + +- xt_xlate_add(xl, tgt); ++ xt_xlate_add(xl, "%s", tgt); + if (strlen(range_str)) + xt_xlate_add(xl, " to %s", range_str); + if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { +-- +2.38.0 + diff --git a/0001-xshared-Fix-build-for-Werror-format-security.patch b/0001-xshared-Fix-build-for-Werror-format-security.patch deleted file mode 100644 index ba6d2db..0000000 --- a/0001-xshared-Fix-build-for-Werror-format-security.patch +++ /dev/null @@ -1,29 +0,0 @@ -From fe9bd3b29dd7661e6f74c24db8356014798d1d78 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 May 2022 16:51:58 +0200 -Subject: [PATCH] xshared: Fix build for -Werror=format-security - -Gcc complains about the omitted format string. - -Signed-off-by: Phil Sutter -(cherry picked from commit b72eb12ea5a61df0655ad99d5048994e916be83a) ---- - iptables/xshared.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/xshared.c b/iptables/xshared.c -index fae5ddd5df93e..a8512d3808154 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - return; - - if (args->family != NFPROTO_ARP) -- xtables_error(PARAMETER_PROBLEM, msg); -+ xtables_error(PARAMETER_PROBLEM, "%s", msg); - - fprintf(stderr, "%s", msg); - } --- -2.34.1 - diff --git a/iptables.spec b/iptables.spec index 7a51dd4..40ac8cd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,9 +10,9 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.8 -Release: 3%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.bz2 +Version: 1.8.9 +Release: 1%{?dist} +Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config Source3: iptables.service @@ -20,7 +20,7 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-xshared-Fix-build-for-Werror-format-security.patch +Patch01: 0001-extensions-NAT-Fix-for-Werror-format-security.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -236,6 +236,13 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +# Drop xtables.conf, it's not used +rm -f %{buildroot}%{_sysconfdir}/xtables.conf + +# fix absolute symlink +rm -f %{buildroot}%{_bindir}/iptables-xml +ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml + %ldconfig_scriptlets %post legacy @@ -349,12 +356,12 @@ fi %files compat %files legacy -%doc INCOMPATIBILITIES %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs @@ -405,6 +412,7 @@ fi %{_sbindir}/{eb,arp}tables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor +%{_sbindir}/ebtables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -412,6 +420,7 @@ fi %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* +%{_mandir}/man8/ebtables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -420,6 +429,13 @@ fi %changelog +* Thu Jan 12 2023 Phil Sutter - 1.8.9-1 +- Make iptables-xml a relative symlink +- Drop not needed xtables.conf +- Ship iptables.xslt with iptables-legacy package +- Ship ebtables-translate tool with iptables-nft package +- Update to 1.8.9. + * Thu Jul 21 2022 Fedora Release Engineering - 1.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 014f6c0..fef1030 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.8.tar.bz2) = f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59 +SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 From c7a1e984df7cbbd25916b84a2adbf662377bc689 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:19:17 +0000 Subject: [PATCH 02/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 40ac8cd..5860791 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -429,6 +429,9 @@ fi %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.8.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jan 12 2023 Phil Sutter - 1.8.9-1 - Make iptables-xml a relative symlink - Drop not needed xtables.conf From 7ae7437d5fc5e096749a942c73337d41c7a07d67 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 20 Apr 2023 13:16:15 +0200 Subject: [PATCH 03/46] iptables-1.8.9-3 - Support %%_excludedocs macro in alternatives installation --- iptables.spec | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5860791..1a8054f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -295,7 +295,9 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %?ldconfig %systemd_postun iptables.service ip6tables.service -%post nft +%post -e nft +[[ %%{_excludedocs} == 1 ]] || do_man=true + pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ @@ -320,7 +322,7 @@ fi $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ - --slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz + ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables @@ -340,9 +342,9 @@ fi $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ - --slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \ - --slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \ - --slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \ + ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ + ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ --slave $lepfx-helper arptables-helper $lepfx-nft-helper %postun nft @@ -429,6 +431,9 @@ fi %changelog +* Thu Apr 20 2023 Phil Sutter - 1.8.9-3 +- Support %%_excludedocs macro in alternatives installation + * Thu Jan 19 2023 Fedora Release Engineering - 1.8.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 5463f77d3b7c37f6b637e4ab5c70c0eb2fc1aa30 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 24 May 2023 13:03:08 +0200 Subject: [PATCH 04/46] iptables-1.8.9-4 - Backport fixes from upstream --- ...s-NAT-Fix-for-Werror-format-security.patch | 7 +- 0002-etc-Drop-xtables.conf.patch | 132 ++++++++++ ...x-for-unknown-argument-error-message.patch | 148 +++++++++++ ...es-Refuse-unselected-targets-options.patch | 232 ++++++++++++++++++ ...-Properly-split-input-in-replay-mode.patch | 31 +++ ...bebt_redirect-Fix-target-translation.patch | 48 ++++ ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ++++ ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ++++ ...t_ip-Translation-has-to-match-on-eth.patch | 85 +++++++ ...the-missing-chunk-types-in-sctp_help.patch | 36 +++ ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 ++++++++ ...-for-deletion-of-new-referenced-rule.patch | 67 +++++ ...ables-Fix-checking-existence-of-rule.patch | 33 +++ 0014-nft-shared-Drop-unused-include.patch | 29 +++ ...rsing-of-inverted-arp-operation-matc.patch | 31 +++ ...-t-omit-standard-matches-if-inverted.patch | 42 ++++ ...ing-of-option-arguments-in-same-word.patch | 211 ++++++++++++++++ iptables.spec | 23 +- 18 files changed, 1349 insertions(+), 5 deletions(-) create mode 100644 0002-etc-Drop-xtables.conf.patch create mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch create mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch create mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch create mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch create mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch create mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch create mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch create mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch create mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch create mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch create mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch create mode 100644 0014-nft-shared-Drop-unused-include.patch create mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch create mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch create mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch index ff8adfb..cecd191 100644 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ b/0001-extensions-NAT-Fix-for-Werror-format-security.patch @@ -1,12 +1,13 @@ -From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001 +From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [iptables PATCH] extensions: NAT: Fix for -Werror=format-security +Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security Have to pass either a string literal or format string to xt_xlate_add(). Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") Signed-off-by: Phil Sutter +(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) --- extensions/libxt_NAT.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -25,5 +26,5 @@ index da9f22012c5d6..2a6343986d54f 100644 xt_xlate_add(xl, " to %s", range_str); if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { -- -2.38.0 +2.40.0 diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch new file mode 100644 index 0000000..e676561 --- /dev/null +++ b/0002-etc-Drop-xtables.conf.patch @@ -0,0 +1,132 @@ +From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Jan 2023 16:38:43 +0100 +Subject: [PATCH] etc: Drop xtables.conf + +The file is not used since the commit this one fixes. Also it wasn't +installed until recently, when commit 3822a992bc277 ("Makefile: Fix for +'make distcheck'") added it in the wrong spot in an attempt to reduce +differences between tarballs generated by 'make tarball' and 'make +dist'. + +While being at it, drop stale xtables_config_main() prototype from +xtables-multi.h. + +Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") +Signed-off-by: Phil Sutter +(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) +--- + Makefile.am | 2 +- + etc/xtables.conf | 74 ---------------------------------------- + iptables/xtables-multi.h | 1 - + 3 files changed, 1 insertion(+), 76 deletions(-) + delete mode 100644 etc/xtables.conf + +diff --git a/Makefile.am b/Makefile.am +index 451c3cb2d5887..299ab46d7b8e2 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py + + if ENABLE_NFTABLES + confdir = $(sysconfdir) +-dist_conf_DATA = etc/ethertypes etc/xtables.conf ++dist_conf_DATA = etc/ethertypes + endif + + .PHONY: tarball +diff --git a/etc/xtables.conf b/etc/xtables.conf +deleted file mode 100644 +index 3c54ced043d82..0000000000000 +--- a/etc/xtables.conf ++++ /dev/null +@@ -1,74 +0,0 @@ +-family ipv4 { +- table raw { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 +- } +- +- table mangle { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 +- chain INPUT hook NF_INET_LOCAL_IN prio -150 +- chain FORWARD hook NF_INET_FORWARD prio -150 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 +- } +- +- table filter { +- chain INPUT hook NF_INET_LOCAL_IN prio 0 +- chain FORWARD hook NF_INET_FORWARD prio 0 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 +- } +- +- table nat { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 +- chain INPUT hook NF_INET_LOCAL_IN prio 100 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 +- } +- +- table security { +- chain INPUT hook NF_INET_LOCAL_IN prio 50 +- chain FORWARD hook NF_INET_FORWARD prio 50 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 +- } +-} +- +-family ipv6 { +- table raw { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 +- } +- +- table mangle { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 +- chain INPUT hook NF_INET_LOCAL_IN prio -150 +- chain FORWARD hook NF_INET_FORWARD prio -150 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 +- } +- +- table filter { +- chain INPUT hook NF_INET_LOCAL_IN prio 0 +- chain FORWARD hook NF_INET_FORWARD prio 0 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 +- } +- +- table nat { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 +- chain INPUT hook NF_INET_LOCAL_IN prio 100 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 +- } +- +- table security { +- chain INPUT hook NF_INET_LOCAL_IN prio 50 +- chain FORWARD hook NF_INET_FORWARD prio 50 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 +- } +-} +- +-family arp { +- table filter { +- chain INPUT hook NF_ARP_IN prio 0 +- chain OUTPUT hook NF_ARP_OUT prio 0 +- } +-} +diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h +index 94c24d5a22c7e..833c11a2ac914 100644 +--- a/iptables/xtables-multi.h ++++ b/iptables/xtables-multi.h +@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); + extern int xtables_eb_main(int, char **); + extern int xtables_eb_restore_main(int, char **); + extern int xtables_eb_save_main(int, char **); +-extern int xtables_config_main(int, char **); + extern int xtables_monitor_main(int, char **); + + extern struct xtables_globals arptables_globals; +-- +2.40.0 + diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch new file mode 100644 index 0000000..d807c54 --- /dev/null +++ b/0003-Proper-fix-for-unknown-argument-error-message.patch @@ -0,0 +1,148 @@ +From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 25 Jan 2023 01:51:43 +0100 +Subject: [PATCH] Proper fix for "unknown argument" error message + +While commit 1b8210f848631 kind of fixed the corner-case of invalid +short-options packed with others, it broke error reporting for +long-options. Revert it and deploy a proper solution: + +When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long +sets the variable 'optopt' to the invalid character's value. Use it for +reporting instead of optind if set. + +To distinguish between invalid options and missing option arguments, +ebtables-translate optstring needs adjustment. + +Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") +Signed-off-by: Phil Sutter +(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) +--- + .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ + iptables/xshared.c | 9 ++++-- + iptables/xtables-eb-translate.c | 8 ++--- + iptables/xtables-eb.c | 17 ++++++---- + 4 files changed, 50 insertions(+), 15 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 +new file mode 100755 +index 0000000000000..ac6e743966196 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 +@@ -0,0 +1,31 @@ ++#!/bin/bash ++ ++rc=0 ++ ++check() { ++ local cmd="$1" ++ local msg="$2" ++ ++ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { ++ echo "cmd: $XT_MULTI $1" ++ echo "exp: $msg" ++ echo "res: $($XT_MULTI $cmd 2>&1)" ++ rc=1 ++ } ++} ++ ++cmds="iptables ip6tables" ++[[ $XT_MULTI == *xtables-nft-multi ]] && { ++ cmds+=" ebtables" ++ cmds+=" iptables-translate" ++ cmds+=" ip6tables-translate" ++ cmds+=" ebtables-translate" ++} ++ ++for cmd in $cmds; do ++ check "${cmd} --foo" 'unknown option "--foo"' ++ check "${cmd} -A" 'option "-A" requires an argument' ++ check "${cmd} -aL" 'unknown option "-a"' ++done ++ ++exit $rc +diff --git a/iptables/xshared.c b/iptables/xshared.c +index f93529b11a319..ac51fac5ce9ed 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, + if (cs->c == ':') + xtables_error(PARAMETER_PROBLEM, "option \"%s\" " + "requires an argument", cs->argv[optind-1]); +- if (cs->c == '?') +- xtables_error(PARAMETER_PROBLEM, "unknown option " +- "\"%s\"", cs->argv[optind-1]); ++ if (cs->c == '?') { ++ char optoptstr[3] = {'-', optopt, '\0'}; ++ ++ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", ++ optopt ? optoptstr : cs->argv[optind - 1]); ++ } + xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); + } + +diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c +index 13b6b864a5f24..0c35272051752 100644 +--- a/iptables/xtables-eb-translate.c ++++ b/iptables/xtables-eb-translate.c +@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char + printf("nft "); + /* Getopt saves the day */ + while ((c = getopt_long(argc, argv, +- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { ++ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { + cs.c = c; + switch (c) { + case 'A': /* Add a rule */ +@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char + continue; + default: + ebt_check_inverse2(optarg, argc, argv); +- +- if (ebt_command_default(&cs)) +- xtables_error(PARAMETER_PROBLEM, +- "Unknown argument: '%s'", +- argv[optind - 1]); ++ ebt_command_default(&cs); + + if (command != 'A' && command != 'I' && + command != 'D') +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 7214a767ffe96..412b5cccdc46a 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) + return 0; + } + } +- return 1; ++ if (cs->c == ':') ++ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " ++ "requires an argument", cs->argv[optind - 1]); ++ if (cs->c == '?') { ++ char optoptstr[3] = {'-', optopt, '\0'}; ++ ++ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", ++ optopt ? optoptstr : cs->argv[optind - 1]); ++ } ++ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); + } + + int nft_init_eb(struct nft_handle *h, const char *pname) +@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + continue; + default: + ebt_check_inverse2(optarg, argc, argv); +- +- if (ebt_command_default(&cs)) +- xtables_error(PARAMETER_PROBLEM, +- "Unknown argument: '%s'", +- argv[optind]); ++ ebt_command_default(&cs); + + if (command != 'A' && command != 'I' && + command != 'D' && command != 'C' && command != 14) +-- +2.40.0 + diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch new file mode 100644 index 0000000..c41ba45 --- /dev/null +++ b/0004-ebtables-Refuse-unselected-targets-options.patch @@ -0,0 +1,232 @@ +From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 25 Jan 2023 02:01:56 +0100 +Subject: [PATCH] ebtables: Refuse unselected targets' options + +Unlike legacy, ebtables-nft would allow e.g.: + +| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be + +While the result is correct, it may mislead users into believing +multiple targets are possible per rule. Better follow legacy's behaviour +and reject target options unless they have been "enabled" by a previous +'-j' option. + +To achieve this, one needs to distinguish targets from watchers also +attached to 'xtables_targets' and otherwise behaving like regular +matches. Introduce XTABLES_EXT_WATCHER to mark the two. + +The above works already, but error messages are misleading when using +the now unsupported syntax since target options have been merged +already. Solve this by not pre-loading the targets at all, code will +just fall back to loading ad '-j' parsing time as iptables does. + +Note how this also fixes for 'counter' statement being in wrong position +of ebtables-translate output. + +Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") +Signed-off-by: Phil Sutter +(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) +--- + extensions/libebt_dnat.txlate | 12 ++++---- + extensions/libebt_log.c | 1 + + extensions/libebt_mark.txlate | 16 +++++----- + extensions/libebt_nflog.c | 1 + + extensions/libebt_snat.txlate | 8 ++--- + include/xtables.h | 1 + + .../ebtables/0002-ebtables-save-restore_0 | 4 +-- + iptables/xtables-eb.c | 29 +++++++------------ + 8 files changed, 33 insertions(+), 39 deletions(-) + +diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate +index 9f305c76c954f..531a22aa3e14f 100644 +--- a/extensions/libebt_dnat.txlate ++++ b/extensions/libebt_dnat.txlate +@@ -1,8 +1,8 @@ +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' +diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c +index 045062196d20d..9f8d158956802 100644 +--- a/extensions/libebt_log.c ++++ b/extensions/libebt_log.c +@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, + static struct xtables_target brlog_target = { + .name = "log", + .revision = 0, ++ .ext_flags = XTABLES_EXT_WATCHER, + .version = XTABLES_VERSION, + .family = NFPROTO_BRIDGE, + .size = XT_ALIGN(sizeof(struct ebt_log_info)), +diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate +index d006e8ac94008..4ace1a1f5cfde 100644 +--- a/extensions/libebt_mark.txlate ++++ b/extensions/libebt_mark.txlate +@@ -1,11 +1,11 @@ +-ebtables-translate -A INPUT --mark-set 42 +-nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' ++ebtables-translate -A INPUT -j mark --mark-set 42 ++nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' + +-ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN +-nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' ++ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN ++nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' + +-ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT +-nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' ++ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT ++nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' + +-ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP +-nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' ++ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP ++nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' +diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c +index 115e15da45845..762d6d5d8bbe2 100644 +--- a/extensions/libebt_nflog.c ++++ b/extensions/libebt_nflog.c +@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, + static struct xtables_target brnflog_watcher = { + .name = "nflog", + .revision = 0, ++ .ext_flags = XTABLES_EXT_WATCHER, + .version = XTABLES_VERSION, + .family = NFPROTO_BRIDGE, + .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), +diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate +index 857a6052aed1a..37343d3a14754 100644 +--- a/extensions/libebt_snat.txlate ++++ b/extensions/libebt_snat.txlate +@@ -1,5 +1,5 @@ +-ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff +-nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff ++nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE +-nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' ++ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE ++nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' +diff --git a/include/xtables.h b/include/xtables.h +index 4ffc8ec5a17e9..087a1d600f9ae 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -203,6 +203,7 @@ struct xtables_lmap { + + enum xtables_ext_flags { + XTABLES_EXT_ALIAS = 1 << 0, ++ XTABLES_EXT_WATCHER = 1 << 1, + }; + + struct xt_xlate; +diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +index 1091a4e80bebe..b4f9728bb9b6f 100755 +--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 ++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT + + $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT + $XT_MULTI ebtables -A foo --log +-$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT ++$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT + $XT_MULTI ebtables -A foo --nflog + $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT + $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT +@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo + $XT_MULTI ebtables -N bar + $XT_MULTI ebtables -P bar RETURN + +-$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT ++$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT + #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 + + $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 412b5cccdc46a..3a73e79725489 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) + xtables_error(OTHER_PROBLEM, "Can't alloc memory"); + } + +-static void __ebt_load_watcher(const char *name, const char *typename) ++static void ebt_load_watcher(const char *name) + { + struct xtables_target *watcher; + size_t size; + + watcher = xtables_find_target(name, XTF_TRY_LOAD); + if (!watcher) { +- fprintf(stderr, "Unable to load %s %s\n", name, typename); ++ fprintf(stderr, "Unable to load %s watcher\n", name); + return; + } + +@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) + xtables_error(OTHER_PROBLEM, "Can't alloc memory"); + } + +-static void ebt_load_watcher(const char *name) +-{ +- return __ebt_load_watcher(name, "watcher"); +-} +- +-static void ebt_load_target(const char *name) +-{ +- return __ebt_load_watcher(name, "target"); +-} +- + void ebt_load_match_extensions(void) + { + opts = ebt_original_options; +@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) + + ebt_load_watcher("log"); + ebt_load_watcher("nflog"); +- +- ebt_load_target("mark"); +- ebt_load_target("dnat"); +- ebt_load_target("snat"); +- ebt_load_target("arpreply"); +- ebt_load_target("redirect"); +- ebt_load_target("standard"); + } + + void ebt_add_match(struct xtables_match *m, +@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) + + /* Is it a watcher option? */ + for (t = xtables_targets; t; t = t->next) { ++ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) ++ continue; ++ + if (t->parse && + t->parse(cs->c - t->option_offset, cs->argv, + ebt_invert, &t->tflags, NULL, &t->t)) { +@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + optind = 0; + opterr = false; + ++ for (t = xtables_targets; t; t = t->next) { ++ t->tflags = 0; ++ t->used = 0; ++ } ++ + /* Getopt saves the day */ + while ((c = getopt_long(argc, argv, EBT_OPTSTRING, + opts, NULL)) != -1) { +-- +2.40.0 + diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch new file mode 100644 index 0000000..dd58948 --- /dev/null +++ b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch @@ -0,0 +1,31 @@ +From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 18:48:33 +0100 +Subject: [PATCH] tests: xlate: Properly split input in replay mode + +Source command may contain quotes, using shlex.split() does the right +thing there. + +Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") +Signed-off-by: Phil Sutter +(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) +--- + xlate-test.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/xlate-test.py b/xlate-test.py +index 4cb1401b71677..217d2f0062682 100755 +--- a/xlate-test.py ++++ b/xlate-test.py +@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' + if sourceline.find(';') >= 0: + sourceline, searchline = sourceline.split(';') + +- srcwords = sourceline.split() ++ srcwords = shlex.split(sourceline) + + srccmd = srcwords[0] + ipt = srccmd.split('-')[0] +-- +2.40.0 + diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch new file mode 100644 index 0000000..b2f5481 --- /dev/null +++ b/0006-extensions-libebt_redirect-Fix-target-translation.patch @@ -0,0 +1,48 @@ +From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 31 Jan 2023 22:28:24 +0100 +Subject: [PATCH] extensions: libebt_redirect: Fix target translation + +While EBT_ACCEPT is the default verdict for ebtables targets, omitting +it from translation implicitly converts it into 'continue'. Omit the +non-default EBT_CONTINUE instead. + +Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) +--- + extensions/libebt_redirect.c | 2 +- + extensions/libebt_redirect.txlate | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + create mode 100644 extensions/libebt_redirect.txlate + +diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c +index 4d4c7a02cea89..389f3ccb53f60 100644 +--- a/extensions/libebt_redirect.c ++++ b/extensions/libebt_redirect.c +@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, + const struct ebt_redirect_info *red = (const void*)params->target->data; + + xt_xlate_add(xl, "meta set pkttype host"); +- if (red->target != EBT_ACCEPT) ++ if (red->target != EBT_CONTINUE) + xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); + return 1; + } +diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate +new file mode 100644 +index 0000000000000..f0dd5deaf6406 +--- /dev/null ++++ b/extensions/libebt_redirect.txlate +@@ -0,0 +1,8 @@ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' ++ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' ++ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' +-- +2.40.0 + diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch new file mode 100644 index 0000000..8f8dcf6 --- /dev/null +++ b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch @@ -0,0 +1,48 @@ +From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 31 Jan 2023 23:32:50 +0100 +Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in + translation + +Meta key comes before 'set' in meta statement. + +Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) +--- + extensions/libebt_redirect.c | 2 +- + extensions/libebt_redirect.txlate | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c +index 389f3ccb53f60..7821935e137aa 100644 +--- a/extensions/libebt_redirect.c ++++ b/extensions/libebt_redirect.c +@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, + { + const struct ebt_redirect_info *red = (const void*)params->target->data; + +- xt_xlate_add(xl, "meta set pkttype host"); ++ xt_xlate_add(xl, "meta pkttype set host"); + if (red->target != EBT_CONTINUE) + xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); + return 1; +diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate +index f0dd5deaf6406..d073ec774c4fa 100644 +--- a/extensions/libebt_redirect.txlate ++++ b/extensions/libebt_redirect.txlate +@@ -1,8 +1,8 @@ + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' + + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' + + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' +-- +2.40.0 + diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch new file mode 100644 index 0000000..ad5a3ee --- /dev/null +++ b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch @@ -0,0 +1,50 @@ +From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 18:58:36 +0100 +Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation + +Converting from TOS field match to DSCP one is irreversible, so replay +testing is not possible. Use a raw payload expression to produce +something that translates 1:1 back into an 'ip' match. + +Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") +Signed-off-by: Phil Sutter +(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) +--- + extensions/libebt_ip.c | 4 ++-- + extensions/libebt_ip.txlate | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c +index fd87dae7e2c62..8b381aa10b5b7 100644 +--- a/extensions/libebt_ip.c ++++ b/extensions/libebt_ip.c +@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, + brip_xlate_nh(xl, info, EBT_IP_DEST); + + if (info->bitmask & EBT_IP_TOS) { +- xt_xlate_add(xl, "ip dscp "); ++ xt_xlate_add(xl, "@nh,8,8 "); + if (info->invflags & EBT_IP_TOS) + xt_xlate_add(xl, "!= "); +- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ ++ xt_xlate_add(xl, "0x%02x ", info->tos); + } + if (info->bitmask & EBT_IP_PROTO) { + struct protoent *pe; +diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate +index 75c1db246fb81..562e3157d7b92 100644 +--- a/extensions/libebt_ip.txlate ++++ b/extensions/libebt_ip.txlate +@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 + nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' + + ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff +-nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' ++nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' + + ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 + nft 'add rule bridge filter FORWARD tcp dport 22 counter' +-- +2.40.0 + diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch new file mode 100644 index 0000000..96cb5ad --- /dev/null +++ b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch @@ -0,0 +1,85 @@ +From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 17:37:40 +0100 +Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type + +On one hand, nft refuses th expression in bridge family if layer3 +protocol has not been assured by a previous match. On the other, ebt_ip +kernel module will only match on IPv4 packets, so there might be a +functional change in the translation versus the original. + +Instead of just always emitting an 'ether type' match, decide whether +it's actually needed - explicit "ip " payload matches (or +icmp ones) cause implicit creation of a match on IPv4 by nft. + +Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") +Signed-off-by: Phil Sutter +(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) +--- + extensions/libebt_ip.c | 21 +++++++++++++++++++++ + extensions/libebt_ip.txlate | 6 +++--- + 2 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c +index 8b381aa10b5b7..68f34bff97deb 100644 +--- a/extensions/libebt_ip.c ++++ b/extensions/libebt_ip.c +@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, + xtables_ipmask_to_numeric(maskp)); + } + ++static bool may_skip_ether_type_dep(uint8_t flags) ++{ ++ /* these convert to "ip (s|d)addr" matches */ ++ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) ++ return true; ++ ++ /* icmp match triggers implicit ether type dependency in nft */ ++ if (flags & EBT_IP_ICMP) ++ return true; ++ ++ /* allow if "ip protocol" match is created by brip_xlate() */ ++ if (flags & EBT_IP_PROTO && ++ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) ++ return true; ++ ++ return false; ++} ++ + static int brip_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { +@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, + brip_xlate_nh(xl, info, EBT_IP_SOURCE); + brip_xlate_nh(xl, info, EBT_IP_DEST); + ++ if (!may_skip_ether_type_dep(info->bitmask)) ++ xt_xlate_add(xl, "ether type ip "); ++ + if (info->bitmask & EBT_IP_TOS) { + xt_xlate_add(xl, "@nh,8,8 "); + if (info->invflags & EBT_IP_TOS) +diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate +index 562e3157d7b92..28996832225cb 100644 +--- a/extensions/libebt_ip.txlate ++++ b/extensions/libebt_ip.txlate +@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 + nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' + + ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff +-nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' ++nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' + + ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 +-nft 'add rule bridge filter FORWARD tcp dport 22 counter' ++nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' + + ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 +-nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' ++nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' + + ebtables-translate -A FORWARD -p ip --ip-proto 253 + nft 'add rule bridge filter FORWARD ip protocol 253 counter' +-- +2.40.0 + diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch new file mode 100644 index 0000000..410a831 --- /dev/null +++ b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch @@ -0,0 +1,36 @@ +From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Tue, 21 Feb 2023 12:19:42 -0500 +Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help + +Add the missing chunk types in sctp_help(), so that the help cmd can +display these chunk types as below: + + # iptables -p sctp --help + + chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE + +Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") +Signed-off-by: Xin Long +Signed-off-by: Phil Sutter +(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) +--- + extensions/libxt_sctp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c +index fe5f5621a033d..6e2b2745dcbd5 100644 +--- a/extensions/libxt_sctp.c ++++ b/extensions/libxt_sctp.c +@@ -50,7 +50,7 @@ static void sctp_help(void) + " --dport ...\n" + "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" + " chunktypes are present\n" +-"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); ++"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); + } + + static const struct option sctp_opts[] = { +-- +2.40.0 + diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch new file mode 100644 index 0000000..e0915f5 --- /dev/null +++ b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch @@ -0,0 +1,101 @@ +From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 22 Feb 2023 16:36:16 +0100 +Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h + +When merging IP-version-specific LOG extensions, a dependency to that +header was introduced without caching it. Fix this and drop the now +unused ip{,6}t_LOG.h files. + +Reported-by: Thomas Devoogdt +Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") +Signed-off-by: Phil Sutter +(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) +--- + include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ + include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- + include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- + 3 files changed, 20 insertions(+), 38 deletions(-) + create mode 100644 include/linux/netfilter/xt_LOG.h + delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h + delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h + +diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h +new file mode 100644 +index 0000000000000..167d4ddd2476b +--- /dev/null ++++ b/include/linux/netfilter/xt_LOG.h +@@ -0,0 +1,20 @@ ++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ ++#ifndef _XT_LOG_H ++#define _XT_LOG_H ++ ++/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ ++#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ ++#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ ++#define XT_LOG_IPOPT 0x04 /* Log IP options */ ++#define XT_LOG_UID 0x08 /* Log UID owning local socket */ ++#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ ++#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ ++#define XT_LOG_MASK 0x2f ++ ++struct xt_log_info { ++ unsigned char level; ++ unsigned char logflags; ++ char prefix[30]; ++}; ++ ++#endif /* _XT_LOG_H */ +diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h +deleted file mode 100644 +index dcdbadf9fd4a9..0000000000000 +--- a/include/linux/netfilter_ipv4/ipt_LOG.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-#ifndef _IPT_LOG_H +-#define _IPT_LOG_H +- +-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ +-#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ +-#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ +-#define IPT_LOG_IPOPT 0x04 /* Log IP options */ +-#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ +-#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ +-#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ +-#define IPT_LOG_MASK 0x2f +- +-struct ipt_log_info { +- unsigned char level; +- unsigned char logflags; +- char prefix[30]; +-}; +- +-#endif /*_IPT_LOG_H*/ +diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h +deleted file mode 100644 +index 9dd5579e02ec7..0000000000000 +--- a/include/linux/netfilter_ipv6/ip6t_LOG.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-#ifndef _IP6T_LOG_H +-#define _IP6T_LOG_H +- +-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ +-#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ +-#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ +-#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ +-#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ +-#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ +-#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ +-#define IP6T_LOG_MASK 0x2f +- +-struct ip6t_log_info { +- unsigned char level; +- unsigned char logflags; +- char prefix[30]; +-}; +- +-#endif /*_IPT_LOG_H*/ +-- +2.40.0 + diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch new file mode 100644 index 0000000..8b20709 --- /dev/null +++ b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch @@ -0,0 +1,67 @@ +From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Feb 2023 18:09:25 +0100 +Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule + +Combining multiple corner-cases here: + +* Insert a rule before another new one which is not the first. Triggers + NFTNL_RULE_ID assignment of the latter. + +* Delete the referenced new rule in the same batch again. Causes + overwriting of the previously assigned RULE_ID. + +Consequently, iptables-nft-restore fails during *insert*, because the +reference is dangling. + +Reported-by: Eric Garver +Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") +Signed-off-by: Phil Sutter +Tested-by: Eric Garver +(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) +--- + iptables/nft.c | 3 ++- + .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ + 2 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 63468cf3b1344..5896fd410ca78 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) + + nftnl_rule_list_del(r); + +- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) ++ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && ++ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) + nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); + + obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); +diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +index 3f1d229e915ff..5482b7ea17298 100755 +--- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 ++++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT + -A FORWARD -m comment --comment "rule 3" -j ACCEPT' + + diff -u -Z <(echo -e "$EXPECT") <(ipt_show) ++ ++# test adding, referencing and deleting the same rule in a batch ++ ++$XT_MULTI iptables-restore < +Date: Mon, 3 Apr 2023 23:13:47 +0200 +Subject: [PATCH] ip6tables: Fix checking existence of rule + +Pass the proper entry size when creating a match mask for checking the +existence of a rule. Failing to do so causes wrong results. + +Reported-by: Jonathan Caicedo +Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") +Signed-off-by: Markus Boehme +Signed-off-by: Phil Sutter +(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) +--- + iptables/ip6tables.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c +index 345af4519bfe7..9afc32c1a21ed 100644 +--- a/iptables/ip6tables.c ++++ b/iptables/ip6tables.c +@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, + int ret = 1; + unsigned char *mask; + +- mask = make_delete_mask(matches, target, sizeof(fw)); ++ mask = make_delete_mask(matches, target, sizeof(*fw)); + for (i = 0; i < nsaddrs; i++) { + fw->ipv6.src = saddrs[i]; + fw->ipv6.smsk = smasks[i]; +-- +2.40.0 + diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch new file mode 100644 index 0000000..c4274ca --- /dev/null +++ b/0014-nft-shared-Drop-unused-include.patch @@ -0,0 +1,29 @@ +From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Mar 2023 16:22:16 +0200 +Subject: [PATCH] nft-shared: Drop unused include + +Code does not refer to struct xt_comment_info anymore. + +Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") +Signed-off-by: Phil Sutter +(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) +--- + iptables/nft-shared.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 4a7b5406892c4..4ba44a4aa4d17 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -22,7 +22,6 @@ + #include + + #include +-#include + #include + #include + #include +-- +2.40.0 + diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch new file mode 100644 index 0000000..5474f8a --- /dev/null +++ b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch @@ -0,0 +1,31 @@ +From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:33:43 +0200 +Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match + +The wrong bit was set in 'invflags', probably due to copy'n'paste from +the previous case. + +Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") +Signed-off-by: Phil Sutter +(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) +--- + iptables/nft-arp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 210f43d2cefbe..8fae5adc50216 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, + fw->arp.arhln = ar_hln; + fw->arp.arhln_mask = 0xff; + if (inv) +- fw->arp.invflags |= IPT_INV_ARPOP; ++ fw->arp.invflags |= IPT_INV_ARPHLN; + break; + case offsetof(struct arphdr, ar_pln): + get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); +-- +2.40.0 + diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch new file mode 100644 index 0000000..1efb846 --- /dev/null +++ b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch @@ -0,0 +1,42 @@ +From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:37:47 +0200 +Subject: [PATCH] arptables: Don't omit standard matches if inverted + +Inverted --h-len and --h-type matches were omitted from output by +accident if they matched on their standard value. + +Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") +Signed-off-by: Phil Sutter +(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) +--- + iptables/nft-arp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 8fae5adc50216..df3ad430cf701 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, + + after_devdst: + +- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { ++ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || ++ fw->arp.invflags & IPT_INV_ARPHLN) { + printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN + ? "! " : ""); + printf("--h-length %d", fw->arp.arhln); +@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, + sep = " "; + } + +- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { ++ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || ++ fw->arp.invflags & IPT_INV_ARPHRD) { + uint16_t tmp = ntohs(fw->arp.arhrd); + + printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD +-- +2.40.0 + diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch new file mode 100644 index 0000000..9c5cbd2 --- /dev/null +++ b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch @@ -0,0 +1,211 @@ +From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:41:08 +0200 +Subject: [PATCH] xshared: Fix parsing of option arguments in same word + +When merging commandline parsers, a decision between 'argv[optind - 1]' +and 'optarg' had to be made in some spots. While the implementation of +check_inverse() required the former, use of the latter allows for the +common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at +the suffix while 'argv[optind - 1]' will just point at the following +option. + +Fix the mess by making check_inverse() update optarg pointer if needed +so calling code may refer to and always correct 'optarg'. + +Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 +Signed-off-by: Phil Sutter +(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) +--- + extensions/libarpt_standard.t | 2 ++ + extensions/libxt_standard.t | 3 ++ + iptables/xshared.c | 61 +++++++++++++++++------------------ + 3 files changed, 35 insertions(+), 31 deletions(-) + +diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t +index e84a00b780488..007fa2b8335e8 100644 +--- a/extensions/libarpt_standard.t ++++ b/extensions/libarpt_standard.t +@@ -12,3 +12,5 @@ + -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK + --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK + ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK ++--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK ++--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK +diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t +index 56d6da2e5884e..6ed978e442b80 100644 +--- a/extensions/libxt_standard.t ++++ b/extensions/libxt_standard.t +@@ -21,3 +21,6 @@ + -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK + -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK + -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK ++:FORWARD ++--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK ++-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index ac51fac5ce9ed..17aed04e02b09 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) + } + + static void check_inverse(struct xtables_args *args, const char option[], +- bool *invert, int *optidx, int argc) ++ bool *invert, int argc, char **argv) + { + switch (args->family) { + case NFPROTO_ARP: +@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], + xtables_error(PARAMETER_PROBLEM, + "Multiple `!' flags not allowed"); + *invert = true; +- if (optidx) { +- *optidx = *optidx + 1; +- if (argc && *optidx > argc) +- xtables_error(PARAMETER_PROBLEM, +- "no argument following `!'"); +- } ++ optind++; ++ if (optind > argc) ++ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); ++ ++ optarg = argv[optind - 1]; + } + + static const char *optstring_lookup(int family) +@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], + * Option selection + */ + case 'p': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_PROTOCOL, + &args->invflags, invert); + + /* Canonicalize into lower case */ +- for (cs->protocol = argv[optind - 1]; ++ for (cs->protocol = optarg; + *cs->protocol; cs->protocol++) + *cs->protocol = tolower(*cs->protocol); + +- cs->protocol = argv[optind - 1]; ++ cs->protocol = optarg; + args->proto = xtables_parse_protocol(cs->protocol); + + if (args->proto == 0 && +@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], + break; + + case 's': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_SOURCE, + &args->invflags, invert); +- args->shostnetworkmask = argv[optind - 1]; ++ args->shostnetworkmask = optarg; + break; + + case 'd': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_DESTINATION, + &args->invflags, invert); +- args->dhostnetworkmask = argv[optind - 1]; ++ args->dhostnetworkmask = optarg; + break; + + #ifdef IPT_F_GOTO +@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], + #endif + + case 2:/* src-mac */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_S_MAC, &args->invflags, + invert); +- args->src_mac = argv[optind - 1]; ++ args->src_mac = optarg; + break; + + case 3:/* dst-mac */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_D_MAC, &args->invflags, + invert); +- args->dst_mac = argv[optind - 1]; ++ args->dst_mac = optarg; + break; + + case 'l':/* hardware length */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_H_LENGTH, &args->invflags, + invert); +- args->arp_hlen = argv[optind - 1]; ++ args->arp_hlen = optarg; + break; + + case 8: /* was never supported, not even in arptables-legacy */ + xtables_error(PARAMETER_PROBLEM, "not supported"); + case 4:/* opcode */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_OPCODE, &args->invflags, + invert); +- args->arp_opcode = argv[optind - 1]; ++ args->arp_opcode = optarg; + break; + + case 5:/* h-type */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_H_TYPE, &args->invflags, + invert); +- args->arp_htype = argv[optind - 1]; ++ args->arp_htype = optarg; + break; + + case 6:/* proto-type */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_P_TYPE, &args->invflags, + invert); +- args->arp_ptype = argv[optind - 1]; ++ args->arp_ptype = optarg; + break; + + case 'j': + set_option(&cs->options, OPT_JUMP, &args->invflags, + invert); +- command_jump(cs, argv[optind - 1]); ++ command_jump(cs, optarg); + break; + + case 'i': + check_empty_interface(args, optarg); +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_VIANAMEIN, + &args->invflags, invert); +- xtables_parse_interface(argv[optind - 1], ++ xtables_parse_interface(optarg, + args->iniface, + args->iniface_mask); + break; + + case 'o': + check_empty_interface(args, optarg); +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_VIANAMEOUT, + &args->invflags, invert); +- xtables_parse_interface(argv[optind - 1], ++ xtables_parse_interface(optarg, + args->outiface, + args->outiface_mask); + break; +-- +2.40.0 + diff --git a/iptables.spec b/iptables.spec index 1a8054f..d779895 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,7 +20,23 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-extensions-NAT-Fix-for-Werror-format-security.patch +Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch +Patch002: 0002-etc-Drop-xtables.conf.patch +Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch +Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch +Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch +Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch +Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch +Patch014: 0014-nft-shared-Drop-unused-include.patch +Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -431,6 +447,9 @@ fi %changelog +* Wed May 24 2023 Phil Sutter - 1.8.9-4 +- Backport fixes from upstream + * Thu Apr 20 2023 Phil Sutter - 1.8.9-3 - Support %%_excludedocs macro in alternatives installation From 21624d30276597c18535a0ea0fb582d95dbbf062 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 07:35:31 +0000 Subject: [PATCH 05/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d779895..34455fc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -447,6 +447,9 @@ fi %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream From dc297257aab2e1372cf34d97a1ffdd5e5241733b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 15 Aug 2023 11:39:21 +0200 Subject: [PATCH 06/46] Convert license to SPDX format Signed-off-by: Phil Sutter --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 34455fc..57a50f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -40,7 +40,7 @@ Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 -License: GPLv2 and Artistic Licence 2.0 and ISC +License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) @@ -447,6 +447,9 @@ fi %changelog +* Tue Aug 15 2023 Phil Sutter - 1.8.9-6 +- Convert license to SPDX format + * Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 97407d1230d0860c3660855169def22be7749da7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 17:33:55 +0200 Subject: [PATCH 07/46] iptables-1.8.10-1 - New version 1.8.10 - Drop compat sub-package Resolves: rhbz#2243041 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 30 --- 0002-etc-Drop-xtables.conf.patch | 132 ---------- ...x-for-unknown-argument-error-message.patch | 148 ----------- ...es-Refuse-unselected-targets-options.patch | 232 ------------------ ...-Properly-split-input-in-replay-mode.patch | 31 --- ...bebt_redirect-Fix-target-translation.patch | 48 ---- ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ---- ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ---- ...t_ip-Translation-has-to-match-on-eth.patch | 85 ------- ...the-missing-chunk-types-in-sctp_help.patch | 36 --- ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 -------- ...-for-deletion-of-new-referenced-rule.patch | 67 ----- ...ables-Fix-checking-existence-of-rule.patch | 33 --- 0014-nft-shared-Drop-unused-include.patch | 29 --- ...rsing-of-inverted-arp-operation-matc.patch | 31 --- ...-t-omit-standard-matches-if-inverted.patch | 42 ---- ...ing-of-option-arguments-in-same-word.patch | 211 ---------------- iptables.spec | 44 +--- sources | 2 +- 20 files changed, 9 insertions(+), 1392 deletions(-) delete mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0002-etc-Drop-xtables.conf.patch delete mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch delete mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch delete mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch delete mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch delete mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch delete mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch delete mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch delete mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch delete mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch delete mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch delete mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch delete mode 100644 0014-nft-shared-Drop-unused-include.patch delete mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch delete mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch delete mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/.gitignore b/.gitignore index 141b2e8..4cb5d7a 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz +/iptables-1.8.10.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch deleted file mode 100644 index cecd191..0000000 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ /dev/null @@ -1,30 +0,0 @@ -From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security - -Have to pass either a string literal or format string to xt_xlate_add(). - -Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") -Signed-off-by: Phil Sutter -(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) ---- - extensions/libxt_NAT.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c -index da9f22012c5d6..2a6343986d54f 100644 ---- a/extensions/libxt_NAT.c -+++ b/extensions/libxt_NAT.c -@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, - if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) - return 0; - -- xt_xlate_add(xl, tgt); -+ xt_xlate_add(xl, "%s", tgt); - if (strlen(range_str)) - xt_xlate_add(xl, " to %s", range_str); - if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { --- -2.40.0 - diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch deleted file mode 100644 index e676561..0000000 --- a/0002-etc-Drop-xtables.conf.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Jan 2023 16:38:43 +0100 -Subject: [PATCH] etc: Drop xtables.conf - -The file is not used since the commit this one fixes. Also it wasn't -installed until recently, when commit 3822a992bc277 ("Makefile: Fix for -'make distcheck'") added it in the wrong spot in an attempt to reduce -differences between tarballs generated by 'make tarball' and 'make -dist'. - -While being at it, drop stale xtables_config_main() prototype from -xtables-multi.h. - -Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") -Signed-off-by: Phil Sutter -(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) ---- - Makefile.am | 2 +- - etc/xtables.conf | 74 ---------------------------------------- - iptables/xtables-multi.h | 1 - - 3 files changed, 1 insertion(+), 76 deletions(-) - delete mode 100644 etc/xtables.conf - -diff --git a/Makefile.am b/Makefile.am -index 451c3cb2d5887..299ab46d7b8e2 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py - - if ENABLE_NFTABLES - confdir = $(sysconfdir) --dist_conf_DATA = etc/ethertypes etc/xtables.conf -+dist_conf_DATA = etc/ethertypes - endif - - .PHONY: tarball -diff --git a/etc/xtables.conf b/etc/xtables.conf -deleted file mode 100644 -index 3c54ced043d82..0000000000000 ---- a/etc/xtables.conf -+++ /dev/null -@@ -1,74 +0,0 @@ --family ipv4 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family ipv6 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family arp { -- table filter { -- chain INPUT hook NF_ARP_IN prio 0 -- chain OUTPUT hook NF_ARP_OUT prio 0 -- } --} -diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h -index 94c24d5a22c7e..833c11a2ac914 100644 ---- a/iptables/xtables-multi.h -+++ b/iptables/xtables-multi.h -@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); - extern int xtables_eb_main(int, char **); - extern int xtables_eb_restore_main(int, char **); - extern int xtables_eb_save_main(int, char **); --extern int xtables_config_main(int, char **); - extern int xtables_monitor_main(int, char **); - - extern struct xtables_globals arptables_globals; --- -2.40.0 - diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch deleted file mode 100644 index d807c54..0000000 --- a/0003-Proper-fix-for-unknown-argument-error-message.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 01:51:43 +0100 -Subject: [PATCH] Proper fix for "unknown argument" error message - -While commit 1b8210f848631 kind of fixed the corner-case of invalid -short-options packed with others, it broke error reporting for -long-options. Revert it and deploy a proper solution: - -When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long -sets the variable 'optopt' to the invalid character's value. Use it for -reporting instead of optind if set. - -To distinguish between invalid options and missing option arguments, -ebtables-translate optstring needs adjustment. - -Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") -Signed-off-by: Phil Sutter -(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) ---- - .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ - iptables/xshared.c | 9 ++++-- - iptables/xtables-eb-translate.c | 8 ++--- - iptables/xtables-eb.c | 17 ++++++---- - 4 files changed, 50 insertions(+), 15 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -new file mode 100755 -index 0000000000000..ac6e743966196 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -@@ -0,0 +1,31 @@ -+#!/bin/bash -+ -+rc=0 -+ -+check() { -+ local cmd="$1" -+ local msg="$2" -+ -+ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { -+ echo "cmd: $XT_MULTI $1" -+ echo "exp: $msg" -+ echo "res: $($XT_MULTI $cmd 2>&1)" -+ rc=1 -+ } -+} -+ -+cmds="iptables ip6tables" -+[[ $XT_MULTI == *xtables-nft-multi ]] && { -+ cmds+=" ebtables" -+ cmds+=" iptables-translate" -+ cmds+=" ip6tables-translate" -+ cmds+=" ebtables-translate" -+} -+ -+for cmd in $cmds; do -+ check "${cmd} --foo" 'unknown option "--foo"' -+ check "${cmd} -A" 'option "-A" requires an argument' -+ check "${cmd} -aL" 'unknown option "-a"' -+done -+ -+exit $rc -diff --git a/iptables/xshared.c b/iptables/xshared.c -index f93529b11a319..ac51fac5ce9ed 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, - if (cs->c == ':') - xtables_error(PARAMETER_PROBLEM, "option \"%s\" " - "requires an argument", cs->argv[optind-1]); -- if (cs->c == '?') -- xtables_error(PARAMETER_PROBLEM, "unknown option " -- "\"%s\"", cs->argv[optind-1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } - xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - -diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c -index 13b6b864a5f24..0c35272051752 100644 ---- a/iptables/xtables-eb-translate.c -+++ b/iptables/xtables-eb-translate.c -@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - printf("nft "); - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, -- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { -+ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { - cs.c = c; - switch (c) { - case 'A': /* Add a rule */ -@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind - 1]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D') -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 7214a767ffe96..412b5cccdc46a 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) - return 0; - } - } -- return 1; -+ if (cs->c == ':') -+ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " -+ "requires an argument", cs->argv[optind - 1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } -+ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - - int nft_init_eb(struct nft_handle *h, const char *pname) -@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D' && command != 'C' && command != 14) --- -2.40.0 - diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch deleted file mode 100644 index c41ba45..0000000 --- a/0004-ebtables-Refuse-unselected-targets-options.patch +++ /dev/null @@ -1,232 +0,0 @@ -From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 02:01:56 +0100 -Subject: [PATCH] ebtables: Refuse unselected targets' options - -Unlike legacy, ebtables-nft would allow e.g.: - -| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be - -While the result is correct, it may mislead users into believing -multiple targets are possible per rule. Better follow legacy's behaviour -and reject target options unless they have been "enabled" by a previous -'-j' option. - -To achieve this, one needs to distinguish targets from watchers also -attached to 'xtables_targets' and otherwise behaving like regular -matches. Introduce XTABLES_EXT_WATCHER to mark the two. - -The above works already, but error messages are misleading when using -the now unsupported syntax since target options have been merged -already. Solve this by not pre-loading the targets at all, code will -just fall back to loading ad '-j' parsing time as iptables does. - -Note how this also fixes for 'counter' statement being in wrong position -of ebtables-translate output. - -Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") -Signed-off-by: Phil Sutter -(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) ---- - extensions/libebt_dnat.txlate | 12 ++++---- - extensions/libebt_log.c | 1 + - extensions/libebt_mark.txlate | 16 +++++----- - extensions/libebt_nflog.c | 1 + - extensions/libebt_snat.txlate | 8 ++--- - include/xtables.h | 1 + - .../ebtables/0002-ebtables-save-restore_0 | 4 +-- - iptables/xtables-eb.c | 29 +++++++------------ - 8 files changed, 33 insertions(+), 39 deletions(-) - -diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate -index 9f305c76c954f..531a22aa3e14f 100644 ---- a/extensions/libebt_dnat.txlate -+++ b/extensions/libebt_dnat.txlate -@@ -1,8 +1,8 @@ --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' -diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c -index 045062196d20d..9f8d158956802 100644 ---- a/extensions/libebt_log.c -+++ b/extensions/libebt_log.c -@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, - static struct xtables_target brlog_target = { - .name = "log", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_log_info)), -diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate -index d006e8ac94008..4ace1a1f5cfde 100644 ---- a/extensions/libebt_mark.txlate -+++ b/extensions/libebt_mark.txlate -@@ -1,11 +1,11 @@ --ebtables-translate -A INPUT --mark-set 42 --nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-set 42 -+nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' - --ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN --nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' -+ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN -+nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' - --ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT --nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT -+nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' - --ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP --nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' -+ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP -+nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' -diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c -index 115e15da45845..762d6d5d8bbe2 100644 ---- a/extensions/libebt_nflog.c -+++ b/extensions/libebt_nflog.c -@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, - static struct xtables_target brnflog_watcher = { - .name = "nflog", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), -diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate -index 857a6052aed1a..37343d3a14754 100644 ---- a/extensions/libebt_snat.txlate -+++ b/extensions/libebt_snat.txlate -@@ -1,5 +1,5 @@ --ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff --nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff -+nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE --nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE -+nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' -diff --git a/include/xtables.h b/include/xtables.h -index 4ffc8ec5a17e9..087a1d600f9ae 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -203,6 +203,7 @@ struct xtables_lmap { - - enum xtables_ext_flags { - XTABLES_EXT_ALIAS = 1 << 0, -+ XTABLES_EXT_WATCHER = 1 << 1, - }; - - struct xt_xlate; -diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -index 1091a4e80bebe..b4f9728bb9b6f 100755 ---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT - - $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT - $XT_MULTI ebtables -A foo --log --$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT -+$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT - $XT_MULTI ebtables -A foo --nflog - $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT - $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT -@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo - $XT_MULTI ebtables -N bar - $XT_MULTI ebtables -P bar RETURN - --$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT -+$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT - #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 - - $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 412b5cccdc46a..3a73e79725489 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void __ebt_load_watcher(const char *name, const char *typename) -+static void ebt_load_watcher(const char *name) - { - struct xtables_target *watcher; - size_t size; - - watcher = xtables_find_target(name, XTF_TRY_LOAD); - if (!watcher) { -- fprintf(stderr, "Unable to load %s %s\n", name, typename); -+ fprintf(stderr, "Unable to load %s watcher\n", name); - return; - } - -@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void ebt_load_watcher(const char *name) --{ -- return __ebt_load_watcher(name, "watcher"); --} -- --static void ebt_load_target(const char *name) --{ -- return __ebt_load_watcher(name, "target"); --} -- - void ebt_load_match_extensions(void) - { - opts = ebt_original_options; -@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) - - ebt_load_watcher("log"); - ebt_load_watcher("nflog"); -- -- ebt_load_target("mark"); -- ebt_load_target("dnat"); -- ebt_load_target("snat"); -- ebt_load_target("arpreply"); -- ebt_load_target("redirect"); -- ebt_load_target("standard"); - } - - void ebt_add_match(struct xtables_match *m, -@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) - - /* Is it a watcher option? */ - for (t = xtables_targets; t; t = t->next) { -+ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) -+ continue; -+ - if (t->parse && - t->parse(cs->c - t->option_offset, cs->argv, - ebt_invert, &t->tflags, NULL, &t->t)) { -@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - optind = 0; - opterr = false; - -+ for (t = xtables_targets; t; t = t->next) { -+ t->tflags = 0; -+ t->used = 0; -+ } -+ - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, EBT_OPTSTRING, - opts, NULL)) != -1) { --- -2.40.0 - diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch deleted file mode 100644 index dd58948..0000000 --- a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:48:33 +0100 -Subject: [PATCH] tests: xlate: Properly split input in replay mode - -Source command may contain quotes, using shlex.split() does the right -thing there. - -Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") -Signed-off-by: Phil Sutter -(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) ---- - xlate-test.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/xlate-test.py b/xlate-test.py -index 4cb1401b71677..217d2f0062682 100755 ---- a/xlate-test.py -+++ b/xlate-test.py -@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' - if sourceline.find(';') >= 0: - sourceline, searchline = sourceline.split(';') - -- srcwords = sourceline.split() -+ srcwords = shlex.split(sourceline) - - srccmd = srcwords[0] - ipt = srccmd.split('-')[0] --- -2.40.0 - diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch deleted file mode 100644 index b2f5481..0000000 --- a/0006-extensions-libebt_redirect-Fix-target-translation.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 22:28:24 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix target translation - -While EBT_ACCEPT is the default verdict for ebtables targets, omitting -it from translation implicitly converts it into 'continue'. Omit the -non-default EBT_CONTINUE instead. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 8 ++++++++ - 2 files changed, 9 insertions(+), 1 deletion(-) - create mode 100644 extensions/libebt_redirect.txlate - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 4d4c7a02cea89..389f3ccb53f60 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, - const struct ebt_redirect_info *red = (const void*)params->target->data; - - xt_xlate_add(xl, "meta set pkttype host"); -- if (red->target != EBT_ACCEPT) -+ if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; - } -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -new file mode 100644 -index 0000000000000..f0dd5deaf6406 ---- /dev/null -+++ b/extensions/libebt_redirect.txlate -@@ -0,0 +1,8 @@ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' --- -2.40.0 - diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch deleted file mode 100644 index 8f8dcf6..0000000 --- a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 23:32:50 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in - translation - -Meta key comes before 'set' in meta statement. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 6 +++--- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 389f3ccb53f60..7821935e137aa 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, - { - const struct ebt_redirect_info *red = (const void*)params->target->data; - -- xt_xlate_add(xl, "meta set pkttype host"); -+ xt_xlate_add(xl, "meta pkttype set host"); - if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -index f0dd5deaf6406..d073ec774c4fa 100644 ---- a/extensions/libebt_redirect.txlate -+++ b/extensions/libebt_redirect.txlate -@@ -1,8 +1,8 @@ - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' --- -2.40.0 - diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch deleted file mode 100644 index ad5a3ee..0000000 --- a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:58:36 +0100 -Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation - -Converting from TOS field match to DSCP one is irreversible, so replay -testing is not possible. Use a raw payload expression to produce -something that translates 1:1 back into an 'ip' match. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) ---- - extensions/libebt_ip.c | 4 ++-- - extensions/libebt_ip.txlate | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index fd87dae7e2c62..8b381aa10b5b7 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_DEST); - - if (info->bitmask & EBT_IP_TOS) { -- xt_xlate_add(xl, "ip dscp "); -+ xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) - xt_xlate_add(xl, "!= "); -- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ -+ xt_xlate_add(xl, "0x%02x ", info->tos); - } - if (info->bitmask & EBT_IP_PROTO) { - struct protoent *pe; -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 75c1db246fb81..562e3157d7b92 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 - nft 'add rule bridge filter FORWARD tcp dport 22 counter' --- -2.40.0 - diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch deleted file mode 100644 index 96cb5ad..0000000 --- a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 17:37:40 +0100 -Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type - -On one hand, nft refuses th expression in bridge family if layer3 -protocol has not been assured by a previous match. On the other, ebt_ip -kernel module will only match on IPv4 packets, so there might be a -functional change in the translation versus the original. - -Instead of just always emitting an 'ether type' match, decide whether -it's actually needed - explicit "ip " payload matches (or -icmp ones) cause implicit creation of a match on IPv4 by nft. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) ---- - extensions/libebt_ip.c | 21 +++++++++++++++++++++ - extensions/libebt_ip.txlate | 6 +++--- - 2 files changed, 24 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index 8b381aa10b5b7..68f34bff97deb 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, - xtables_ipmask_to_numeric(maskp)); - } - -+static bool may_skip_ether_type_dep(uint8_t flags) -+{ -+ /* these convert to "ip (s|d)addr" matches */ -+ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) -+ return true; -+ -+ /* icmp match triggers implicit ether type dependency in nft */ -+ if (flags & EBT_IP_ICMP) -+ return true; -+ -+ /* allow if "ip protocol" match is created by brip_xlate() */ -+ if (flags & EBT_IP_PROTO && -+ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) -+ return true; -+ -+ return false; -+} -+ - static int brip_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { -@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_SOURCE); - brip_xlate_nh(xl, info, EBT_IP_DEST); - -+ if (!may_skip_ether_type_dep(info->bitmask)) -+ xt_xlate_add(xl, "ether type ip "); -+ - if (info->bitmask & EBT_IP_TOS) { - xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 562e3157d7b92..28996832225cb 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 --nft 'add rule bridge filter FORWARD tcp dport 22 counter' -+nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 --nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' -+nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto 253 - nft 'add rule bridge filter FORWARD ip protocol 253 counter' --- -2.40.0 - diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch deleted file mode 100644 index 410a831..0000000 --- a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Tue, 21 Feb 2023 12:19:42 -0500 -Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help - -Add the missing chunk types in sctp_help(), so that the help cmd can -display these chunk types as below: - - # iptables -p sctp --help - - chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE - -Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") -Signed-off-by: Xin Long -Signed-off-by: Phil Sutter -(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) ---- - extensions/libxt_sctp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index fe5f5621a033d..6e2b2745dcbd5 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -50,7 +50,7 @@ static void sctp_help(void) - " --dport ...\n" - "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" - " chunktypes are present\n" --"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); -+"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); - } - - static const struct option sctp_opts[] = { --- -2.40.0 - diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch deleted file mode 100644 index e0915f5..0000000 --- a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 22 Feb 2023 16:36:16 +0100 -Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h - -When merging IP-version-specific LOG extensions, a dependency to that -header was introduced without caching it. Fix this and drop the now -unused ip{,6}t_LOG.h files. - -Reported-by: Thomas Devoogdt -Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") -Signed-off-by: Phil Sutter -(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) ---- - include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ - include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- - include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- - 3 files changed, 20 insertions(+), 38 deletions(-) - create mode 100644 include/linux/netfilter/xt_LOG.h - delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h - delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h - -diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h -new file mode 100644 -index 0000000000000..167d4ddd2476b ---- /dev/null -+++ b/include/linux/netfilter/xt_LOG.h -@@ -0,0 +1,20 @@ -+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -+#ifndef _XT_LOG_H -+#define _XT_LOG_H -+ -+/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ -+#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ -+#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ -+#define XT_LOG_IPOPT 0x04 /* Log IP options */ -+#define XT_LOG_UID 0x08 /* Log UID owning local socket */ -+#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ -+#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ -+#define XT_LOG_MASK 0x2f -+ -+struct xt_log_info { -+ unsigned char level; -+ unsigned char logflags; -+ char prefix[30]; -+}; -+ -+#endif /* _XT_LOG_H */ -diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h -deleted file mode 100644 -index dcdbadf9fd4a9..0000000000000 ---- a/include/linux/netfilter_ipv4/ipt_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IPT_LOG_H --#define _IPT_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IPT_LOG_IPOPT 0x04 /* Log IP options */ --#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ --#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ --#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IPT_LOG_MASK 0x2f -- --struct ipt_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ -diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h -deleted file mode 100644 -index 9dd5579e02ec7..0000000000000 ---- a/include/linux/netfilter_ipv6/ip6t_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IP6T_LOG_H --#define _IP6T_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ --#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ --#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ --#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IP6T_LOG_MASK 0x2f -- --struct ip6t_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ --- -2.40.0 - diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch deleted file mode 100644 index 8b20709..0000000 --- a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Feb 2023 18:09:25 +0100 -Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule - -Combining multiple corner-cases here: - -* Insert a rule before another new one which is not the first. Triggers - NFTNL_RULE_ID assignment of the latter. - -* Delete the referenced new rule in the same batch again. Causes - overwriting of the previously assigned RULE_ID. - -Consequently, iptables-nft-restore fails during *insert*, because the -reference is dangling. - -Reported-by: Eric Garver -Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") -Signed-off-by: Phil Sutter -Tested-by: Eric Garver -(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) ---- - iptables/nft.c | 3 ++- - .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ - 2 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 63468cf3b1344..5896fd410ca78 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) - - nftnl_rule_list_del(r); - -- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) -+ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && -+ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) - nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); - - obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); -diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -index 3f1d229e915ff..5482b7ea17298 100755 ---- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -+++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT - -A FORWARD -m comment --comment "rule 3" -j ACCEPT' - - diff -u -Z <(echo -e "$EXPECT") <(ipt_show) -+ -+# test adding, referencing and deleting the same rule in a batch -+ -+$XT_MULTI iptables-restore < -Date: Mon, 3 Apr 2023 23:13:47 +0200 -Subject: [PATCH] ip6tables: Fix checking existence of rule - -Pass the proper entry size when creating a match mask for checking the -existence of a rule. Failing to do so causes wrong results. - -Reported-by: Jonathan Caicedo -Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") -Signed-off-by: Markus Boehme -Signed-off-by: Phil Sutter -(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) ---- - iptables/ip6tables.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c -index 345af4519bfe7..9afc32c1a21ed 100644 ---- a/iptables/ip6tables.c -+++ b/iptables/ip6tables.c -@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, - int ret = 1; - unsigned char *mask; - -- mask = make_delete_mask(matches, target, sizeof(fw)); -+ mask = make_delete_mask(matches, target, sizeof(*fw)); - for (i = 0; i < nsaddrs; i++) { - fw->ipv6.src = saddrs[i]; - fw->ipv6.smsk = smasks[i]; --- -2.40.0 - diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch deleted file mode 100644 index c4274ca..0000000 --- a/0014-nft-shared-Drop-unused-include.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Mar 2023 16:22:16 +0200 -Subject: [PATCH] nft-shared: Drop unused include - -Code does not refer to struct xt_comment_info anymore. - -Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") -Signed-off-by: Phil Sutter -(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) ---- - iptables/nft-shared.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 4a7b5406892c4..4ba44a4aa4d17 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -22,7 +22,6 @@ - #include - - #include --#include - #include - #include - #include --- -2.40.0 - diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch deleted file mode 100644 index 5474f8a..0000000 --- a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:33:43 +0200 -Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match - -The wrong bit was set in 'invflags', probably due to copy'n'paste from -the previous case. - -Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") -Signed-off-by: Phil Sutter -(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) ---- - iptables/nft-arp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 210f43d2cefbe..8fae5adc50216 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, - fw->arp.arhln = ar_hln; - fw->arp.arhln_mask = 0xff; - if (inv) -- fw->arp.invflags |= IPT_INV_ARPOP; -+ fw->arp.invflags |= IPT_INV_ARPHLN; - break; - case offsetof(struct arphdr, ar_pln): - get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); --- -2.40.0 - diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch deleted file mode 100644 index 1efb846..0000000 --- a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:37:47 +0200 -Subject: [PATCH] arptables: Don't omit standard matches if inverted - -Inverted --h-len and --h-type matches were omitted from output by -accident if they matched on their standard value. - -Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") -Signed-off-by: Phil Sutter -(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) ---- - iptables/nft-arp.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 8fae5adc50216..df3ad430cf701 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - - after_devdst: - -- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { -+ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || -+ fw->arp.invflags & IPT_INV_ARPHLN) { - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN - ? "! " : ""); - printf("--h-length %d", fw->arp.arhln); -@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - sep = " "; - } - -- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { -+ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || -+ fw->arp.invflags & IPT_INV_ARPHRD) { - uint16_t tmp = ntohs(fw->arp.arhrd); - - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD --- -2.40.0 - diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch deleted file mode 100644 index 9c5cbd2..0000000 --- a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +++ /dev/null @@ -1,211 +0,0 @@ -From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:41:08 +0200 -Subject: [PATCH] xshared: Fix parsing of option arguments in same word - -When merging commandline parsers, a decision between 'argv[optind - 1]' -and 'optarg' had to be made in some spots. While the implementation of -check_inverse() required the former, use of the latter allows for the -common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at -the suffix while 'argv[optind - 1]' will just point at the following -option. - -Fix the mess by making check_inverse() update optarg pointer if needed -so calling code may refer to and always correct 'optarg'. - -Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 -Signed-off-by: Phil Sutter -(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) ---- - extensions/libarpt_standard.t | 2 ++ - extensions/libxt_standard.t | 3 ++ - iptables/xshared.c | 61 +++++++++++++++++------------------ - 3 files changed, 35 insertions(+), 31 deletions(-) - -diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t -index e84a00b780488..007fa2b8335e8 100644 ---- a/extensions/libarpt_standard.t -+++ b/extensions/libarpt_standard.t -@@ -12,3 +12,5 @@ - -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK - --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK - ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK -+--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK -+--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK -diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t -index 56d6da2e5884e..6ed978e442b80 100644 ---- a/extensions/libxt_standard.t -+++ b/extensions/libxt_standard.t -@@ -21,3 +21,6 @@ - -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK - -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK - -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK -+:FORWARD -+--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -+-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index ac51fac5ce9ed..17aed04e02b09 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - } - - static void check_inverse(struct xtables_args *args, const char option[], -- bool *invert, int *optidx, int argc) -+ bool *invert, int argc, char **argv) - { - switch (args->family) { - case NFPROTO_ARP: -@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], - xtables_error(PARAMETER_PROBLEM, - "Multiple `!' flags not allowed"); - *invert = true; -- if (optidx) { -- *optidx = *optidx + 1; -- if (argc && *optidx > argc) -- xtables_error(PARAMETER_PROBLEM, -- "no argument following `!'"); -- } -+ optind++; -+ if (optind > argc) -+ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); -+ -+ optarg = argv[optind - 1]; - } - - static const char *optstring_lookup(int family) -@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], - * Option selection - */ - case 'p': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_PROTOCOL, - &args->invflags, invert); - - /* Canonicalize into lower case */ -- for (cs->protocol = argv[optind - 1]; -+ for (cs->protocol = optarg; - *cs->protocol; cs->protocol++) - *cs->protocol = tolower(*cs->protocol); - -- cs->protocol = argv[optind - 1]; -+ cs->protocol = optarg; - args->proto = xtables_parse_protocol(cs->protocol); - - if (args->proto == 0 && -@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], - break; - - case 's': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_SOURCE, - &args->invflags, invert); -- args->shostnetworkmask = argv[optind - 1]; -+ args->shostnetworkmask = optarg; - break; - - case 'd': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_DESTINATION, - &args->invflags, invert); -- args->dhostnetworkmask = argv[optind - 1]; -+ args->dhostnetworkmask = optarg; - break; - - #ifdef IPT_F_GOTO -@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], - #endif - - case 2:/* src-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_S_MAC, &args->invflags, - invert); -- args->src_mac = argv[optind - 1]; -+ args->src_mac = optarg; - break; - - case 3:/* dst-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_D_MAC, &args->invflags, - invert); -- args->dst_mac = argv[optind - 1]; -+ args->dst_mac = optarg; - break; - - case 'l':/* hardware length */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_LENGTH, &args->invflags, - invert); -- args->arp_hlen = argv[optind - 1]; -+ args->arp_hlen = optarg; - break; - - case 8: /* was never supported, not even in arptables-legacy */ - xtables_error(PARAMETER_PROBLEM, "not supported"); - case 4:/* opcode */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_OPCODE, &args->invflags, - invert); -- args->arp_opcode = argv[optind - 1]; -+ args->arp_opcode = optarg; - break; - - case 5:/* h-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_TYPE, &args->invflags, - invert); -- args->arp_htype = argv[optind - 1]; -+ args->arp_htype = optarg; - break; - - case 6:/* proto-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_P_TYPE, &args->invflags, - invert); -- args->arp_ptype = argv[optind - 1]; -+ args->arp_ptype = optarg; - break; - - case 'j': - set_option(&cs->options, OPT_JUMP, &args->invflags, - invert); -- command_jump(cs, argv[optind - 1]); -+ command_jump(cs, optarg); - break; - - case 'i': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEIN, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->iniface, - args->iniface_mask); - break; - - case 'o': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEOUT, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->outiface, - args->outiface_mask); - break; --- -2.40.0 - diff --git a/iptables.spec b/iptables.spec index 57a50f4..e37c5e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.9 -Release: 6%{?dist} +Version: 1.8.10 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,24 +20,6 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch -Patch002: 0002-etc-Drop-xtables.conf.patch -Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch -Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch -Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch -Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch -Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch -Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch -Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch -Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch -Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch -Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch -Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch -Patch014: 0014-nft-shared-Drop-unused-include.patch -Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch -Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch -Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -54,7 +36,7 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.6 +BuildRequires: pkgconfig(libnftnl) >= 1.2.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf @@ -67,17 +49,6 @@ The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. -%package compat -Summary: Temporary transitioning package -Obsoletes: %{name} < 1.8.7-4 -Requires: %{name}-legacy = %{version}-%{release} -Requires: %{name}-utils = %{version}-%{release} - -%description compat -This package only exists to help transition iptables users to the new -package split. It will be removed after one distribution release cycle, please -do not reference it or depend on it in any way. - %package legacy Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} @@ -252,9 +223,6 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -# Drop xtables.conf, it's not used -rm -f %{buildroot}%{_sysconfdir}/xtables.conf - # fix absolute symlink rm -f %{buildroot}%{_bindir}/iptables-xml ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml @@ -371,8 +339,6 @@ if [ $1 -eq 0 ]; then done fi -%files compat - %files legacy %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -447,6 +413,10 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-1 +- New version 1.8.10 +- Drop compat sub-package + * Tue Aug 15 2023 Phil Sutter - 1.8.9-6 - Convert license to SPDX format diff --git a/sources b/sources index fef1030..59e259b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 +SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 From 4407a0239cd14b500c225119639ca72d98da6d13 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:23:45 +0200 Subject: [PATCH 08/46] tests: Drop checks for iptables RPM On one hand, the test will fail as the RPM is called 'iptables-nft' (or 'iptables-legacy', but that's not the default). On the other, if iptables RPM is missing the commands will fail as well so this check happens implicitly anyway. --- tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh | 2 -- .../RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh | 2 -- tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh | 2 -- tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh | 2 -- tests/initscript-sanity/runtest.sh | 3 --- .../runtest.sh | 3 --- .../runtest.sh | 3 --- .../ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh | 2 -- .../iptables-rule-deletion-fails-for-rules-that-use/runtest.sh | 2 -- tests/iptables-save-cuts-space-before-j/runtest.sh | 3 --- tests/iptables-save-modprobe-option/runtest.sh | 3 --- tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh | 3 --- 12 files changed, 30 deletions(-) diff --git a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh index 32eab99..952cd4c 100755 --- a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh +++ b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET=testset6 rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh index 438468d..26a667e 100755 --- a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh +++ b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" TESTD=$PWD rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "source $TESTD/rules.in" 0 "read ruleset" diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 889c1b6..5021458 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" prepare_page() { @@ -42,7 +41,6 @@ prepare_page() { rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlLogInfo $(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" diff --git a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh index 888dfbd..0b4032e 100755 --- a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh +++ b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" CGNUM="15" CGNAME="15" CGDIR="/sys/fs/cgroup/net_cls/$CGNAME" @@ -41,7 +40,6 @@ SKIP6=false rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel-$(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/initscript-sanity/runtest.sh b/tests/initscript-sanity/runtest.sh index e270b78..b132033 100755 --- a/tests/initscript-sanity/runtest.sh +++ b/tests/initscript-sanity/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 004d568..f68925c 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" diff --git a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh index f59a908..d06fc4a 100755 --- a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh +++ b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "cp /etc/sysconfig/ip6tables ." diff --git a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh index 79b2696..2daddb3 100755 --- a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh +++ b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" for svc in $SERVICES; do diff --git a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh index d17e693..f409501 100755 --- a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh +++ b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh @@ -29,13 +29,11 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET4="ipsetv4" IPSET6="ipsetv6" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ipset create $IPSET4 hash:ip" diff --git a/tests/iptables-save-cuts-space-before-j/runtest.sh b/tests/iptables-save-cuts-space-before-j/runtest.sh index a6a5099..bba6bf2 100755 --- a/tests/iptables-save-cuts-space-before-j/runtest.sh +++ b/tests/iptables-save-cuts-space-before-j/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlServiceStart iptables diff --git a/tests/iptables-save-modprobe-option/runtest.sh b/tests/iptables-save-modprobe-option/runtest.sh index 22951c4..240c76e 100755 --- a/tests/iptables-save-modprobe-option/runtest.sh +++ b/tests/iptables-save-modprobe-option/runtest.sh @@ -30,11 +30,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartTest - rlAssertRpm $PACKAGE rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported" rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported" rlPhaseEnd diff --git a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh index c3223b5..abfb03a 100755 --- a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh +++ b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd From c61918e30991a3b5c4c3e4b6988a0a99440034be Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:40:51 +0200 Subject: [PATCH 09/46] iptables-1.8.10-2 - Obsolete dropped compat package --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index e37c5e6..5d5240b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,6 +59,7 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif +Obsoletes: %{name}-compat < 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -413,6 +414,9 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-2 +- Obsolete dropped compat package + * Tue Oct 10 2023 Phil Sutter - 1.8.10-1 - New version 1.8.10 - Drop compat sub-package From 9272a9e4cc5f169c98f61123116df93c02f315b2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 14:56:09 +0100 Subject: [PATCH 10/46] iptables-1.8.10-3 - Fix compat sub-package obsoletion Resolves: rhbz#2248494 --- iptables.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5d5240b..a4506d4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,7 +59,8 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif -Obsoletes: %{name}-compat < 1.8.9-6 +Provides: %{name}-compat = %{version}-%{release} +Obsoletes: %{name}-compat <= 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -414,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-3 +- Fix compat sub-package obsoletion + * Tue Oct 10 2023 Phil Sutter - 1.8.10-2 - Obsolete dropped compat package From 452b549ac6e57bca853fd99096f5bcefaeec7f49 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 21:43:47 +0100 Subject: [PATCH 11/46] iptables-1.8.10-4 - The actual obsoletes fix Resolves: rhbz#2248494 --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index a4506d4..05ac24b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -60,7 +60,7 @@ Requires(postun): %{_sbindir}/update-alternatives Provides: iptables %endif Provides: %{name}-compat = %{version}-%{release} -Obsoletes: %{name}-compat <= 1.8.9-6 +Obsoletes: %{name}-compat < 1.8.9-7 %description legacy The iptables utility controls the network packet filtering code in the @@ -415,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-4 +- The actual obsoletes fix + * Tue Nov 07 2023 Phil Sutter - 1.8.10-3 - Fix compat sub-package obsoletion From d10a06dda4a10de64ad3fa230e2ec1828cf1766c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 8 Nov 2023 00:07:03 +0100 Subject: [PATCH 12/46] tests/TRACE-target-of-iptables-can-t-work-in: Unload modules only if loaded Apply the same kernel version check to cleanup phase and omit module unloading. --- .../runtest.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 5021458..86652af 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -119,10 +119,14 @@ rlJournalStart rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6" rlRun "iptables -t raw -F" rlRun "ip6tables -t raw -F" - rlRun "rmmod nf_log_ipv4" - rlRun "rmmod nf_log_ipv6" - rlRun "rmmod nf_log_common" - rlRun "rmmod nfnetlink_log" 0,1 + if rlTestVersion "$(uname -r)" "<" "4.6"; then + rlRun "rmmod nf_log_ipv4" + rlRun "rmmod nf_log_ipv6" + rlRun "rmmod nf_log_common" + rlRun "rmmod nfnetlink_log" 0,1 + else + rlLogInfo "new kernel detected: skipping unloading modules" + fi rlLogInfo "restoring services" for svc in $SERVICES; do rlServiceRestore $svc From 3611a44057b5cfdb4641c2370784a37ae4d56c26 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 8 Jan 2024 09:02:09 -0500 Subject: [PATCH 13/46] Fix flatpak build Installation path macros must not be used for file dependencies: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies --- iptables.spec | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index 05ac24b..cc4091e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -54,8 +54,8 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif @@ -142,9 +142,9 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} -Requires(post): %{_sbindir}/update-alternatives -Requires(post): %{_bindir}/readlink -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(post): /usr/bin/readlink +Requires(postun): /usr/sbin/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -234,7 +234,7 @@ ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -244,7 +244,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -260,7 +260,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -286,7 +286,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -304,7 +304,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -324,7 +324,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -336,7 +336,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ $cmd %{_sbindir}/$cmd-nft done fi From 86e59a1ef9148016f717558dda3478f5740c1a06 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Jan 2024 17:47:08 +0100 Subject: [PATCH 14/46] iptables-1.8.10-5 - Backport fixes from upstream - Fix flatpak build --- ...another-segfault-due-to-chain-index-.patch | 81 +++++++++++++ ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 +++++++++++++ ...-Fix-corner-case-noflush-restore-bug.patch | 63 ++++++++++ ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 +++++++ ...ants-support-v-update-OPTSTRING_COMM.patch | 31 +++++ ...n-line-number-formatting-with-legacy.patch | 28 +++++ ...-man-Do-not-escape-exclamation-marks.patch | 44 +++++++ ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 ++++++++ ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ++++++++++++++++++ ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 ++++++ iptables.spec | 17 ++- 11 files changed, 589 insertions(+), 1 deletion(-) create mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch create mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch create mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch create mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch create mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch create mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch create mode 100644 0007-man-Do-not-escape-exclamation-marks.patch create mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch create mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch create mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch new file mode 100644 index 0000000..35b5973 --- /dev/null +++ b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch @@ -0,0 +1,81 @@ +From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Oct 2023 17:27:42 +0200 +Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL + pointer + +Chain rename code missed to adjust the num_chains value which is used to +calculate the number of chain index buckets to allocate during an index +rebuild. So with the right number of chains present, the last chain in a +middle bucket being renamed (and ending up in another bucket) triggers +an index rebuild based on false data. The resulting NULL pointer index +bucket then causes a segfault upon reinsertion. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 +Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") +(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) +--- + .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ + libiptc/libiptc.c | 4 +++ + 2 files changed, 36 insertions(+) + create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 + +diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +new file mode 100755 +index 0000000000000..bc473d2511bbd +--- /dev/null ++++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +@@ -0,0 +1,32 @@ ++#!/bin/bash ++# ++# Another funny rename bug in libiptc: ++# If there is a chain index bucket with only a single chain in it and it is not ++# the last one and that chain is renamed, a chain index rebuild is triggered. ++# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an ++# extra index is allocated and remains NULL. The following insert of renamed ++# chain then segfaults. ++ ++( ++ echo "*filter" ++ # first bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-a-$i - [0:0]" ++ done ++ # second bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-b-$i - [0:0]" ++ done ++ # third bucket, just make sure it exists ++ echo ":chain-c-0 - [0:0]" ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore ++ ++# rename all chains of the middle bucket ++( ++ echo "*filter" ++ for ((i = 0; i < 40; i++)); do ++ echo "-E chain-b-$i chain-d-$i" ++ done ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore --noflush +diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c +index e475063367c26..9712a36353b9a 100644 +--- a/libiptc/libiptc.c ++++ b/libiptc/libiptc.c +@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, + return 0; + } + ++ handle->num_chains--; ++ + /* This only unlinks "c" from the list, thus no free(c) */ + iptcc_chain_index_delete_chain(c, handle); + + /* Change the name of the chain */ + strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); + ++ handle->num_chains++; ++ + /* Insert sorted into to list again */ + iptc_insert_chain(handle, c); + diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch new file mode 100644 index 0000000..c384e4b --- /dev/null +++ b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -0,0 +1,81 @@ +From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 3 Nov 2023 17:33:22 +0100 +Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage + +ARPT_ and IPT_INV flags are not interchangeable, e.g.: +define IPT_INV_SRCDEVADDR 0x0080 +define ARPT_INV_SRCDEVADDR 0x0010 + +as these flags can be tested by libarp_foo.so such checks can yield +incorrect results. + +Because arptables-nft uses existing code, e.g. xt_mark, it makes +sense to unify this completely by converting the last users of +ARPT_INV_ constants. + +Note that arptables-legacy does not do run-time module loading via +dlopen(). Functionaliy implemented by "extensions" in the +arptables-legacy git tree are built-in, so this doesn't break +arptables-legacy binaries. + +Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") +Signed-off-by: Florian Westphal +Signed-off-by: Phil Sutter +(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) +--- + extensions/libarpt_mangle.c | 4 ++-- + iptables/nft-arp.c | 2 +- + iptables/xshared.h | 4 +++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c +index 765edf34781f3..a846e97ec8f27 100644 +--- a/extensions/libarpt_mangle.c ++++ b/extensions/libarpt_mangle.c +@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! --h-length not allowed for " + "--mangle-mac-s"); +@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! hln not allowed for --mangle-mac-d"); + if (e->arp.arhln != 6) +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index aed39ebdd5166..535dd6b83237b 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, + &args->d.naddrs); + + if ((args->s.naddrs > 1 || args->d.naddrs > 1) && +- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) ++ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) + xtables_error(PARAMETER_PROBLEM, + "! not allowed with multiple" + " source or destination IP addresses"); +diff --git a/iptables/xshared.h b/iptables/xshared.h +index a200e0d620ad3..5586385456a4d 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -80,7 +80,9 @@ struct xtables_target; + #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ + #define EBT_OPTSTRING OPTSTRING_COMMON "hv" + +-/* define invflags which won't collide with IPT ones */ ++/* define invflags which won't collide with IPT ones. ++ * arptables-nft does NOT use the legacy ARPT_INV_* defines. ++ */ + #define IPT_INV_SRCDEVADDR 0x0080 + #define IPT_INV_TGTDEVADDR 0x0100 + #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch new file mode 100644 index 0000000..3386925 --- /dev/null +++ b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch @@ -0,0 +1,63 @@ +From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 7 Nov 2023 19:12:14 +0100 +Subject: [PATCH] ebtables: Fix corner-case noflush restore bug + +Report came from firwalld, but this is actually rather hard to trigger. +Since a regular chain line prevents it, typical dump/restore use-cases +are unaffected. + +Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") +Cc: Eric Garver +Signed-off-by: Phil Sutter +(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) +--- + .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ + iptables/xtables-eb.c | 2 ++ + 2 files changed, 27 insertions(+) + create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 + +diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +new file mode 100755 +index 0000000000000..0def0ac58e7be +--- /dev/null ++++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +@@ -0,0 +1,25 @@ ++#!/bin/sh ++# ++# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: ++# - with --noflush ++# - a second table after the broute one ++# - A policy command but no chain line for BROUTING chain ++ ++set -e ++ ++case "$XT_MULTI" in ++*xtables-nft-multi) ++ ;; ++*) ++ echo "skip $XT_MULTI" ++ exit 0 ++ ;; ++esac ++ ++$XT_MULTI ebtables-restore --noflush < +Date: Sun, 19 Nov 2023 13:18:26 +0100 +Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused + +Drop the boolean, it was meant to disable some existence checks in +do_parse() prior to the caching rework. Now that do_parse() runs before +any caching is done, the checks in question don't exist anymore so drop +this relict. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) +--- + iptables/xshared.h | 1 - + iptables/xtables-translate.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index 5586385456a4d..c77556a1987dc 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -284,7 +284,6 @@ struct xt_cmd_parse { + bool restore; + int line; + int verbose; +- bool xlate; + struct xt_cmd_parse_ops *ops; + }; + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 88e0a6b639494..c019cd2991305 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + .table = *table, + .restore = restore, + .line = line, +- .xlate = true, + .ops = &h->ops->cmd_parse, + }; + struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch new file mode 100644 index 0000000..c743e75 --- /dev/null +++ b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch @@ -0,0 +1,31 @@ +From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 19 Nov 2023 13:25:36 +0100 +Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON + +Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") +Signed-off-by: Phil Sutter +(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) +--- + iptables/xshared.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index c77556a1987dc..815b9d3e98726 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -75,10 +75,10 @@ struct xtables_globals; + struct xtables_rule_match; + struct xtables_target; + +-#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" +-#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" +-#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ +-#define EBT_OPTSTRING OPTSTRING_COMMON "hv" ++#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" ++#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" ++#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ ++#define EBT_OPTSTRING OPTSTRING_COMMON "h" + + /* define invflags which won't collide with IPT ones. + * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch new file mode 100644 index 0000000..07bea3a --- /dev/null +++ b/0006-ebtables-Align-line-number-formatting-with-legacy.patch @@ -0,0 +1,28 @@ +From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 21 Nov 2023 22:58:47 +0100 +Subject: [PATCH] ebtables: Align line number formatting with legacy + +Legacy ebtables appends a dot to the number printed in first column if +--Ln flag was given. + +Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") +Signed-off-by: Phil Sutter +(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) +--- + iptables/nft-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index d9a8ad2b0f373..e414ef5584392 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, + struct iptables_command_state cs = {}; + + if (format & FMT_LINENUMBERS) +- printf("%d ", num); ++ printf("%d. ", num); + + nft_rule_to_ebtables_command_state(h, r, &cs); + __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch new file mode 100644 index 0000000..b088c63 --- /dev/null +++ b/0007-man-Do-not-escape-exclamation-marks.patch @@ -0,0 +1,44 @@ +From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 13:29:17 +0100 +Subject: [PATCH] man: Do not escape exclamation marks + +This appears to be not necessary, also mandoc complains about it: + +| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! + +Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") +Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") +Signed-off-by: Phil Sutter +(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) +--- + extensions/libip6t_DNPT.man | 2 +- + extensions/libip6t_SNPT.man | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man +index 9b060f5b7179b..72c6ae5d422a2 100644 +--- a/extensions/libip6t_DNPT.man ++++ b/extensions/libip6t_DNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the SNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 +diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man +index 97e0071b43cc1..0c926978377a7 100644 +--- a/extensions/libip6t_SNPT.man ++++ b/extensions/libip6t_SNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the DNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch new file mode 100644 index 0000000..c0bbec2 --- /dev/null +++ b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch @@ -0,0 +1,49 @@ +From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 20:21:49 +0100 +Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks + +In order to parse the mask, xtopt_parse_hostmask() calls +xtopt_parse_plenmask() thereby limiting netmask support to prefix +lengths (alternatively specified in IP address notation). + +In order to lift this impractical restriction, make +xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may +fall back to xtopt_parse_mask() which correctly initializes val.hmask +itself and indicates non-CIDR-compatible masks by setting val.hlen to +-1. + +So in order to support these odd masks, it is sufficient for +xtopt_parse_plenmask() to skip its mask building from val.hlen value and +take whatever val.hmask contains. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +Signed-off-by: Phil Sutter +(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) +--- + libxtables/xtoptions.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index b16bbfbe32311..d91a78f470eda 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + + xtopt_parse_plen(cb); + ++ /* may not be convertible to CIDR notation */ ++ if (cb->val.hlen == (uint8_t)-1) ++ goto out_put; ++ + memset(mask, 0xFF, sizeof(union nf_inet_addr)); + /* This shifting is AF-independent. */ + if (cb->val.hlen == 0) { +@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + mask[1] = htonl(mask[1]); + mask[2] = htonl(mask[2]); + mask[3] = htonl(mask[3]); ++out_put: + if (entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); + } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch new file mode 100644 index 0000000..7745634 --- /dev/null +++ b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch @@ -0,0 +1,114 @@ +From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 19 Dec 2023 00:56:07 +0100 +Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting + +Parameter 'wait' passed to xtables_lock() signals three modes of +operation, depending on its value: + + 0: --wait not specified, do not wait if lock is busy +-1: --wait specified without value, wait indefinitely until lock becomes + free +>0: Wait for 'wait' seconds for lock to become free, abort otherwise + +Since fixed commit, the first two cases were treated the same apart from +calling alarm(0), but that is a nop if no alarm is pending. Fix the code +by requesting a non-blocking flock() in the second case. While at it, +restrict the alarm setup to the third case only. + +Cc: Jethro Beekman +Cc: howardjohn@google.com +Cc: Antonio Ojea +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 +Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") +Signed-off-by: Phil Sutter +(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) +--- + .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ + iptables/xshared.c | 4 +- + 2 files changed, 57 insertions(+), 2 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 +new file mode 100755 +index 0000000000000..4481f966ce435 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 +@@ -0,0 +1,55 @@ ++#!/bin/bash ++ ++case "$XT_MULTI" in ++*xtables-legacy-multi) ++ ;; ++*) ++ echo skip $XT_MULTI ++ exit 0 ++ ;; ++esac ++ ++coproc RESTORE { $XT_MULTI iptables-restore; } ++echo "*filter" >&${RESTORE[1]} ++ ++ ++$XT_MULTI iptables -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 1 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "process waits when it should not" ++ exit 1 ++} ++wait $ipt_pid ++[[ $? -eq 0 ]] && { ++ echo "process exited 0 despite busy lock" ++ exit 1 ++} ++ ++t0=$(date +%s) ++$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT ++t1=$(date +%s) ++[[ $((t1 - t0)) -ge 3 ]] || { ++ echo "wait time not expired" ++ exit 1 ++} ++ ++$XT_MULTI iptables -w -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] || { ++ echo "no indefinite wait" ++ exit 1 ++} ++kill $ipt_pid ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "killed waiting iptables call did not exit in time" ++ exit 1 ++} ++ ++kill $RESTORE_PID ++wait ++exit 0 +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 5f75a0a57a023..690502c457dd0 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -270,7 +270,7 @@ static int xtables_lock(int wait) + return XT_LOCK_FAILED; + } + +- if (wait != -1) { ++ if (wait > 0) { + sigact_alarm.sa_handler = alarm_ignore; + sigact_alarm.sa_flags = SA_RESETHAND; + sigemptyset(&sigact_alarm.sa_mask); +@@ -278,7 +278,7 @@ static int xtables_lock(int wait) + alarm(wait); + } + +- if (flock(fd, LOCK_EX) == 0) ++ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) + return fd; + + if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch new file mode 100644 index 0000000..ea88fa3 --- /dev/null +++ b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch @@ -0,0 +1,40 @@ +From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 17 Dec 2023 13:02:36 +0100 +Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK + +Do as the comment in xtopt_parse_hostmask() claims and omit +XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() +will catch the incompatibility. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) +--- + include/xtables.h | 1 - + libxtables/xtoptions.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/include/xtables.h b/include/xtables.h +index 087a1d600f9ae..9def9b43b6e58 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -61,7 +61,6 @@ struct in_addr; + * %XTTYPE_SYSLOGLEVEL: syslog level by name or number + * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) + * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length +- * (ptr: union nf_inet_addr; only host portion is stored) + * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) + * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) + * %XTTYPE_PORTRC: colon-separated port range (names acceptable), +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index d91a78f470eda..ba68056dc99f7 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { + [XTTYPE_STRING] = -1, + [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), + [XTTYPE_HOST] = sizeof(union nf_inet_addr), +- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), + [XTTYPE_PROTOCOL] = sizeof(uint8_t), + [XTTYPE_PORT] = sizeof(uint16_t), + [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/iptables.spec b/iptables.spec index cc4091e..fcc549e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,6 +20,17 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper +Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch +Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch +Patch007: 0007-man-Do-not-escape-exclamation-marks.patch +Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -415,6 +426,10 @@ fi %changelog +* Thu Jan 11 2024 Phil Sutter - 1.8.10-5 +- Backport fixes from upstream +- Fix flatpak build + * Tue Nov 07 2023 Phil Sutter - 1.8.10-4 - The actual obsoletes fix From 62720fedc38312a84687cf1632042f22dcf99b32 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:15:08 +0000 Subject: [PATCH 15/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fcc549e..dd8c7cc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 11 2024 Phil Sutter - 1.8.10-5 - Backport fixes from upstream - Fix flatpak build From 4f6c4554627cf2633bc8944cb1240ab0c8074515 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 22:54:06 +0000 Subject: [PATCH 16/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index dd8c7cc..7c995da 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d55ae5d9f184b1b93fd57c73e8cb9f12bdcfd792 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 21 May 2024 15:07:37 +0200 Subject: [PATCH 17/46] iptables-1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables Resolves: rhbz#2281595 --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 7c995da..83b972c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -358,6 +358,7 @@ fi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} @@ -426,6 +427,9 @@ fi %changelog +* Tue May 21 2024 Phil Sutter - 1.8.10-8 +- Make iptables-legacy own %%{_datadir}/xtables + * Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From de779a4b439abe447aedc2c32e4e61f1e115ace7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 3 Jul 2024 12:57:08 +0200 Subject: [PATCH 18/46] iptables-1.8.10-9 - Backport fixes from upstream --- ...se-Add-missing-braces-around-ternary.patch | 36 +++ ...xtables-Fix-memleak-of-matches-udata.patch | 32 ++ ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ++++++++++++ ...frag-Save-xlate-inverted-full-ranges.patch | 117 +++++++ ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 +++++++ ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 ++++++++ ...-esp-Save-xlate-inverted-full-ranges.patch | 119 +++++++ ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 +++ ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ++++ ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ++++++++++++++++++ ...t-Fix-for-broken-recover_rule_compat.patch | 89 +++++ ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 +++ ...sing-of-empty-string-arg-in-c-option.patch | 48 +++ iptables.spec | 20 +- 14 files changed, 1370 insertions(+), 2 deletions(-) create mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch create mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch create mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch create mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch create mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch create mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch create mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch create mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch create mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch create mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch create mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch create mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch create mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch new file mode 100644 index 0000000..f348d59 --- /dev/null +++ b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch @@ -0,0 +1,36 @@ +From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 26 Jan 2024 18:43:10 +0100 +Subject: [PATCH] nft: ruleparse: Add missing braces around ternary + +The expression evaluated the sum before the ternay, consequently not +adding target->size if tgsize was zero. + +Identified by ASAN for a simple rule using standard target: +| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN +| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN +| ================================================================= +| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 +| READ of size 8 at 0x603000000120 thread T0 +| [...] + +Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") +Signed-off-by: Phil Sutter +(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) +--- + iptables/nft-ruleparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c +index c8322f936acd9..57fe27276de35 100644 +--- a/iptables/nft-ruleparse.c ++++ b/iptables/nft-ruleparse.c +@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) + if (!target) + return NULL; + +- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; ++ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); + + target->t = xtables_calloc(1, size); + target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch new file mode 100644 index 0000000..7d9c51f --- /dev/null +++ b/0012-libxtables-Fix-memleak-of-matches-udata.patch @@ -0,0 +1,32 @@ +From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 31 Jan 2024 14:58:17 +0100 +Subject: [PATCH] libxtables: Fix memleak of matches' udata + +If the extension specifies a non-zero udata_size, field 'udata' points +to an allocated buffer which needs to be freed upon extension deinit. + +Interestingly, this bug was identified by ASAN and missed by valgrind. + +Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") +Signed-off-by: Phil Sutter +(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) +--- + libxtables/xtables.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index ba9ceaeb3da41..0f617d80ae37e 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) + free(matchp->match->m); + matchp->match->m = NULL; + } ++ if (matchp->match->udata_size) { ++ free(matchp->match->udata); ++ matchp->match->udata = NULL; ++ } + if (matchp->match == matchp->match->next) { + free(matchp->match); + matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..e9c3cb0 --- /dev/null +++ b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,200 @@ +From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:27:03 +0100 +Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges + +While at it, fix xlate output for plain '-m ah' matches: With +ip6tables-translate, one should emit an extdhr exists match since +ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, +a simple 'meta l4proto ah' was missing. + +Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") +Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) + +Conflicts: + extensions/libip6t_ah.t + extensions/libip6t_ah.txlate + extensions/libipt_ah.t + extensions/libipt_ah.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_ah.c | 22 +++++++++++++--------- + extensions/libip6t_ah.t | 1 + + extensions/libip6t_ah.txlate | 6 ++++++ + extensions/libipt_ah.c | 22 ++++++++++++++-------- + extensions/libipt_ah.t | 1 + + extensions/libipt_ah.txlate | 6 ++++++ + 6 files changed, 41 insertions(+), 17 deletions(-) + +diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c +index f35982f379d76..0f95c4735eabd 100644 +--- a/extensions/libip6t_ah.c ++++ b/extensions/libip6t_ah.c +@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) + } + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + if (min == max) + printf("%s:%s%u", name, inv, min); + else +@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + char *space = ""; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); +@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, + } + + if (!space[0]) /* plain '-m ah' */ +- xt_xlate_add(xl, "meta l4proto ah"); ++ xt_xlate_add(xl, "exthdr ah exists"); + + return 1; + } +diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t +index c1898d44cf193..9099bdc9259c3 100644 +--- a/extensions/libip6t_ah.t ++++ b/extensions/libip6t_ah.t +@@ -13,3 +13,4 @@ + -m ah --ahspi 0:invalid;;FAIL + -m ah --ahspi;;FAIL + -m ah;=;OK ++-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate +index cc33ac2718c0c..32c6b7de00937 100644 +--- a/extensions/libip6t_ah.txlate ++++ b/extensions/libip6t_ah.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' + + ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT + nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' ++ ++ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr ah exists counter' ++ ++ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' +diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c +index fec5705ce6f53..39e3013d3e74b 100644 +--- a/extensions/libipt_ah.c ++++ b/extensions/libipt_ah.c +@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) + ahinfo->invflags |= IPT_AH_INV_SPI; + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); +@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); + else + xt_xlate_add(xl, "%u", ahinfo->spis[0]); ++ } else { ++ xt_xlate_add(xl, "meta l4proto ah"); + } + + return 1; +diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t +index cd853865638e8..1aeb607e9e986 100644 +--- a/extensions/libipt_ah.t ++++ b/extensions/libipt_ah.t +@@ -11,3 +11,4 @@ + -m ah --ahspi;;FAIL + -m ah;;FAIL + -p ah -m ah;=;OK ++-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate +index 897c82b5f95c6..baf5a0ae6182a 100644 +--- a/extensions/libipt_ah.txlate ++++ b/extensions/libipt_ah.txlate +@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' + + iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP + nft 'add rule ip filter INPUT ah spi != 50 counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto ah counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..902ade1 --- /dev/null +++ b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,117 @@ +From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:39:52 +0100 +Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges + +Also translate plain '-m frag' match into an exthdr exists one. + +Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) + +Conflicts: + extensions/libip6t_frag.t + extensions/libip6t_frag.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- + extensions/libip6t_frag.t | 1 + + extensions/libip6t_frag.txlate | 6 ++++++ + 3 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c +index 49c787e709a9e..ed7fe10a4716d 100644 +--- a/extensions/libip6t_frag.c ++++ b/extensions/libip6t_frag.c +@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) + } + } + ++static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_ids(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_ids_match(min, max, invert)) { + printf("%s", name); + if (min == max) + printf(":%s%u", inv, min); +@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, + static void frag_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 +- && fraginfo->ids[1] == 0xFFFFFFFF)) { +- printf("%s --fragid ", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ printf("%s --fragid ", inv_ids ? " !" : ""); + if (fraginfo->ids[0] + != fraginfo->ids[1]) + printf("%u:%u", +@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) + printf(" --fraglast"); + } + ++#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ ++ IP6T_FRAG_MF | IP6T_FRAG_NMF) ++ + static int frag_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_frag *fraginfo = + (struct ip6t_frag *)params->match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "frag id %s", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? +- "!= " : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); + if (fraginfo->ids[0] != fraginfo->ids[1]) + xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], + fraginfo->ids[1]); + else + xt_xlate_add(xl, "%u", fraginfo->ids[0]); + ++ } else if (!(fraginfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr frag exists"); ++ return 1; + } + + /* ignore ineffective IP6T_FRAG_LEN bit */ +diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t +index 299fa03f8845b..58417c90e9217 100644 +--- a/extensions/libip6t_frag.t ++++ b/extensions/libip6t_frag.t +@@ -1,4 +1,5 @@ + :INPUT,FORWARD,OUTPUT ++-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK + -m frag --fragid 1:42;=;OK + -m frag --fraglen 42;=;OK + -m frag --fragres;=;OK +diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate +index 33fc0631dc792..e250587e7682c 100644 +--- a/extensions/libip6t_frag.txlate ++++ b/extensions/libip6t_frag.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' + + ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT + nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' ++ ++ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr frag exists counter' ++ ++ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..1afcc54 --- /dev/null +++ b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,111 @@ +From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:42:10 +0100 +Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges + +Also translate '-m mh' into an exthdr exists match unless '-p mh' is +also present. The latter is converted into 'meta l4proto mh' which might +need fixing itself at a later point. + +Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) + +Conflicts: + extensions/libip6t_mh.t + extensions/libip6t_mh.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_mh.c | 20 ++++++++++++++++---- + extensions/libip6t_mh.t | 1 + + extensions/libip6t_mh.txlate | 9 +++++++++ + 3 files changed, 26 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 1410d324b5d42..3f80e28ec94c8 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + enum { + O_MH_TYPE = 0, +@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) + printf("%s", name); + } + ++static bool skip_types_match(uint8_t min, uint8_t max, bool inv) ++{ ++ return min == 0 && max == UINT8_MAX && !inv; ++} ++ + static void print_types(uint8_t min, uint8_t max, int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFF || invert) { ++ if (!skip_types_match(min, max, invert)) { + printf(" "); + if (min == max) { + printf("%s", inv); +@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, + static void mh_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) + return; + +- if (mhinfo->invflags & IP6T_MH_INV_TYPE) ++ if (inv_type) + printf(" !"); + + if (mhinfo->types[0] != mhinfo->types[1]) +@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; ++ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { ++ if (proto != IPPROTO_MH) ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; ++ } + + if (mhinfo->types[0] != mhinfo->types[1]) + xt_xlate_add(xl, "mh type %s%u-%u", +diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t +index 6b76d13d0a00f..be5439edc9520 100644 +--- a/extensions/libip6t_mh.t ++++ b/extensions/libip6t_mh.t +@@ -4,3 +4,4 @@ + -p mobility-header -m mh --mh-type 1;=;OK + -p mobility-header -m mh ! --mh-type 4;=;OK + -p mobility-header -m mh --mh-type 4:123;=;OK ++-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 4dfaf46a2b8d7..3364ce574468f 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac + + ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' ++ ++ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++ ++ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' ++ ++ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..c9ec110 --- /dev/null +++ b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,131 @@ +From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:45:42 +0100 +Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges + +Also translate plain '-m rt' match into an exthdr exists one. + +Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) + +Conflicts: + extensions/libip6t_rt.t + extensions/libip6t_rt.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- + extensions/libip6t_rt.t | 1 + + extensions/libip6t_rt.txlate | 9 +++++++++ + 3 files changed, 30 insertions(+), 8 deletions(-) + +diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c +index d5b0458bb397e..6db09f0b2cdc8 100644 +--- a/extensions/libip6t_rt.c ++++ b/extensions/libip6t_rt.c +@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) + } + } + ++static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_nums(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_segsleft_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, + static void rt_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + printf("%s --rt-type %u", +@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 +- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- printf("%s --rt-segsleft ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); + if (rtinfo->segsleft[0] + != rtinfo->segsleft[1]) + printf("%u:%u", +@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + + } + ++#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ ++ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) ++ + static int rt_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + xt_xlate_add(xl, "rt type%s %u", +@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "rt seg-left%s ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); + + if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) + xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], + rtinfo->segsleft[1]); + else + xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); ++ } else if (!(rtinfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr rt exists"); ++ return 1; + } + + if (rtinfo->flags & IP6T_RT_LEN) { +diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t +index 3c7b2d981324a..047b6880e354d 100644 +--- a/extensions/libip6t_rt.t ++++ b/extensions/libip6t_rt.t +@@ -3,3 +3,4 @@ + -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK + -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK + -m rt;=;OK ++-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK +diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate +index 3578bcba0157e..1c2f74a588750 100644 +--- a/extensions/libip6t_rt.txlate ++++ b/extensions/libip6t_rt.txlate +@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' + + ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT + nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' ++ ++ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..318d9eb --- /dev/null +++ b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,119 @@ +From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:47:09 +0100 +Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges + +Also add a translation for plain '-m esp' match which depends on the +address family: While ip6tables-translate may emit an exthdr exists +match, iptables-translate must stick to meta l4proto. + +Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) + +Conflicts: + extensions/libxt_esp.t + extensions/libxt_esp.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_esp.c | 26 ++++++++++++++++++-------- + extensions/libxt_esp.t | 1 + + extensions/libxt_esp.txlate | 12 ++++++++++++ + 3 files changed, 31 insertions(+), 8 deletions(-) + +diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c +index 2c7ff942cb9e0..8e9766d71ed57 100644 +--- a/extensions/libxt_esp.c ++++ b/extensions/libxt_esp.c +@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) + espinfo->invflags |= XT_ESP_INV_SPI; + } + ++static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spis_match(min, max, invert)) { + if (min == max) + printf(" %s:%s%u", name, inv, min); + else +@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void esp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_esp *espinfo = (struct xt_esp *)match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 +- && espinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --espspi ", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ printf("%s --espspi ", inv_spi ? " !" : ""); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("%u:%u", +@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "esp spi%s", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); + if (espinfo->spis[0] != espinfo->spis[1]) + xt_xlate_add(xl, " %u-%u", espinfo->spis[0], + espinfo->spis[1]); + else + xt_xlate_add(xl, " %u", espinfo->spis[0]); ++ } else if (afinfo->family == NFPROTO_IPV4) { ++ xt_xlate_add(xl, "meta l4proto esp"); ++ } else if (afinfo->family == NFPROTO_IPV6) { ++ xt_xlate_add(xl, "exthdr esp exists"); ++ } else { ++ return 0; + } + + return 1; +diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t +index 92c5779f860f1..37259d6b3a08f 100644 +--- a/extensions/libxt_esp.t ++++ b/extensions/libxt_esp.t +@@ -4,5 +4,6 @@ + -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK + -p esp -m esp ! --espspi 0:4294967294;=;OK + -p esp -m esp --espspi -1;;FAIL ++-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK + -p esp -m esp;=;OK + -m esp;;FAIL +diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate +index f6aba52f52235..5e8fb241beaf4 100644 +--- a/extensions/libxt_esp.txlate ++++ b/extensions/libxt_esp.txlate +@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' + + iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP + nft 'add rule ip filter INPUT esp spi 500-600 counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto esp counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch new file mode 100644 index 0000000..316e5dd --- /dev/null +++ b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch @@ -0,0 +1,47 @@ +From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:57:46 +0100 +Subject: [PATCH] extensions: ipcomp: Save inverted full ranges + +Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") +Signed-off-by: Phil Sutter +(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) + +Conflicts: + extensions/libxt_ipcomp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_ipcomp.c | 7 ++++--- + extensions/libxt_ipcomp.t | 1 + + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c +index 4171c4a1c4eb7..961c17e584933 100644 +--- a/extensions/libxt_ipcomp.c ++++ b/extensions/libxt_ipcomp.c +@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, + static void comp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; ++ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; + + if (!(compinfo->spis[0] == 0 +- && compinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ipcompspi ", +- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); ++ && compinfo->spis[1] == UINT32_MAX ++ && !inv_spi)) { ++ printf("%s --ipcompspi ", inv_spi ? " !" : ""); + if (compinfo->spis[0] + != compinfo->spis[1]) + printf("%u:%u", +diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t +index 8546ba9ce416f..47c1fbc220c6a 100644 +--- a/extensions/libxt_ipcomp.t ++++ b/extensions/libxt_ipcomp.t +@@ -1,3 +1,4 @@ + :INPUT,OUTPUT + -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK + -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK ++-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch new file mode 100644 index 0000000..cfeacd5 --- /dev/null +++ b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch @@ -0,0 +1,70 @@ +From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 2 Feb 2024 13:14:29 +0100 +Subject: [PATCH] nft: Do not omit full ranges if inverted + +Otherwise this turns a never matching rule into an always matching one. + +Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") +Signed-off-by: Phil Sutter +(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_udp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_tcp.t | 2 ++ + extensions/libxt_udp.t | 2 ++ + iptables/nft.c | 4 ++-- + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 7a3bbd08952f0..3caa3e3f50271 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,6 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index f534770191a6e..aa2c91770e63f 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,6 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ++-p udp -m udp ! --sport :;-p udp -m udp;OK ++-p udp -m udp ! --dport :;-p udp -m udp;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/iptables/nft.c b/iptables/nft.c +index 97fd4f49fdb4c..8e7a38ac93a3e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return 0; + } + +- if (src[0] || src[1] < 0xffff) { ++ if (src[0] || src[1] < UINT16_MAX || invert_src) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); + if (!expr) + return -ENOMEM; +@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return ret; + } + +- if (dst[0] || dst[1] < 0xffff) { ++ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); + if (!expr) + return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..326544f --- /dev/null +++ b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,304 @@ +From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 17:42:12 +0100 +Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges + +Also translate a bare '-m tcp/udp' to 'meta l4proto' match. + +Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") +Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_tcp.txlate + extensions/libxt_udp.t + extensions/libxt_udp.txlate +- Context change due to Missing commits adding test cases. +--- + extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- + extensions/libxt_tcp.t | 4 ++-- + extensions/libxt_tcp.txlate | 6 +++++ + extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- + extensions/libxt_udp.t | 4 ++-- + extensions/libxt_udp.txlate | 6 +++++ + 6 files changed, 72 insertions(+), 39 deletions(-) + +diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c +index f82572828649b..32bbd684fd5d7 100644 +--- a/extensions/libxt_tcp.c ++++ b/extensions/libxt_tcp.c +@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void tcp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; + +- if (tcpinfo->spts[0] != 0 +- || tcpinfo->spts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (tcpinfo->spts[0] + != tcpinfo->spts[1]) +@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) + tcpinfo->spts[0]); + } + +- if (tcpinfo->dpts[0] != 0 +- || tcpinfo->dpts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (tcpinfo->dpts[0] + != tcpinfo->dpts[1]) +@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, + { + const struct xt_tcp *tcpinfo = + (const struct xt_tcp *)params->match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; ++ bool xlated = false; + +- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { + if (tcpinfo->spts[0] != tcpinfo->spts[1]) { + xt_xlate_add(xl, "tcp sport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0], tcpinfo->spts[1]); + } else { + xt_xlate_add(xl, "tcp sport %s%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { + if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { + xt_xlate_add(xl, "tcp dport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0], tcpinfo->dpts[1]); + } else { + xt_xlate_add(xl, "tcp dport %s%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->option) ++ if (tcpinfo->option) { + xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, + tcpinfo->invflags & XT_TCP_INV_OPTION ? + "missing" : "exists"); ++ xlated = true; ++ } + + if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { + xt_xlate_add(xl, "tcp flags %s", +@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, + print_tcp_xlate(xl, tcpinfo->flg_cmp); + xt_xlate_add(xl, " / "); + print_tcp_xlate(xl, tcpinfo->flg_mask); ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto tcp"); ++ + return 1; + } + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 3caa3e3f50271..8baeeff2fc94b 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,8 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK +--p tcp -m tcp ! --sport :;-p tcp -m tcp;OK +--p tcp -m tcp ! --dport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate +index 9802ddfe0039e..b3ddcc15833cf 100644 +--- a/extensions/libxt_tcp.txlate ++++ b/extensions/libxt_tcp.txlate +@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' + + iptables-translate -A INPUT -p tcp ! --tcp-option 23 + nft 'add rule ip filter INPUT tcp option 23 missing counter' ++ ++iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' ++ ++iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' +diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c +index ba1c3eb768592..748d418039c3a 100644 +--- a/extensions/libxt_udp.c ++++ b/extensions/libxt_udp.c +@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void udp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_udp *udpinfo = (struct xt_udp *)match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; + +- if (udpinfo->spts[0] != 0 +- || udpinfo->spts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_SRCPT) ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (udpinfo->spts[0] + != udpinfo->spts[1]) +@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) + udpinfo->spts[0]); + } + +- if (udpinfo->dpts[0] != 0 +- || udpinfo->dpts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_DSTPT) ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (udpinfo->dpts[0] + != udpinfo->dpts[1]) +@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; ++ bool xlated = false; + +- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { + if (udpinfo->spts[0] != udpinfo->spts[1]) { + xt_xlate_add(xl,"udp sport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0], udpinfo->spts[1]); + } else { + xt_xlate_add(xl, "udp sport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0]); + } ++ xlated = true; + } + +- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { + if (udpinfo->dpts[0] != udpinfo->dpts[1]) { + xt_xlate_add(xl,"udp dport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0], udpinfo->dpts[1]); + } else { + xt_xlate_add(xl,"udp dport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0]); + } ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto udp"); ++ + return 1; + } + +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index aa2c91770e63f..0cde6ac30cc15 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,8 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK +--p udp -m udp ! --sport :;-p udp -m udp;OK +--p udp -m udp ! --dport :;-p udp -m udp;OK ++-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK ++-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate +index 28e7ca206b26b..d6bbb96f5d744 100644 +--- a/extensions/libxt_udp.txlate ++++ b/extensions/libxt_udp.txlate +@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep + + iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT + nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' ++ ++iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' ++ ++iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch new file mode 100644 index 0000000..46c636c --- /dev/null +++ b/0021-nft-Fix-for-broken-recover_rule_compat.patch @@ -0,0 +1,89 @@ +From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 27 Feb 2024 18:47:39 +0100 +Subject: [PATCH] nft: Fix for broken recover_rule_compat() + +When IPv4 rule generator was changed to emit payload instead of +meta expressions for l4proto matches, the code reinserting +NFTNL_RULE_COMPAT_* attributes into rules being reused for counter +zeroing was broken by accident. + +Make rule compat recovery aware of the alternative match, basically +reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules +with NFTA_RULE_COMPAT") but add a test case this time to make sure +things stay intact. + +Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") +Signed-off-by: Phil Sutter +(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) +--- + iptables/nft.c | 27 ++++++++++++++++--- + .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ + 2 files changed, 35 insertions(+), 4 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8e7a38ac93a3e..42907a431a99e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) + return strerror(err); + } + ++static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) ++{ ++ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); ++ uint32_t poff = offsetof(struct iphdr, protocol); ++ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; ++ ++ if (!strcmp(name, "payload") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); ++ return 0; ++ } ++ if (!strcmp(name, "meta") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); ++ return 0; ++ } ++ return -1; ++} ++ + static int recover_rule_compat(struct nftnl_rule *r) + { + struct nftnl_expr_iter *iter; +@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) + if (!e) + goto out; + +- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || +- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) ++ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ ++ if (l4proto_expr_get_dreg(e, ®) < 0) + goto next_expr; + +- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); +- + e = nftnl_expr_iter_next(iter); + if (!e) + goto out; +diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +new file mode 100755 +index 0000000000000..e276a953234cf +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +@@ -0,0 +1,12 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++set -e ++ ++rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" ++for cmd in iptables ip6tables; do ++ $XT_MULTI $cmd -t mangle -A PREROUTING $rule ++ $XT_MULTI $cmd -t mangle -Z ++ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" ++done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch new file mode 100644 index 0000000..0be13ca --- /dev/null +++ b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch @@ -0,0 +1,48 @@ +From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 5 Mar 2024 17:02:56 +0100 +Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match + +Since core xlate code now ignores '-p mh' if an mh extension is also +present in the rule, mh extension has to emit the l4proto match itself. +Therefore emit the exthdr match irrespective of '-p' argument value just +like other IPv6 extension header matches do. + +Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") +Signed-off-by: Phil Sutter +(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) +--- + extensions/libip6t_mh.c | 4 +--- + extensions/libip6t_mh.txlate | 2 +- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 3f80e28ec94c8..1a1cee832b584 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; + bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; +- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + + if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { +- if (proto != IPPROTO_MH) +- xt_xlate_add(xl, "exthdr mh exists"); ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; + } + +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 3364ce574468f..7eeaeefab6116 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' + + ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT +-nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' + + ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT + nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch new file mode 100644 index 0000000..a5e7994 --- /dev/null +++ b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch @@ -0,0 +1,48 @@ +From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 9 Apr 2024 13:18:12 +0200 +Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option + +Calling iptables with '-c ""' resulted in a call to strchr() with an +invalid pointer as 'optarg + 1' points to past the buffer. The most +simple fix is to drop the offset: The global optstring part specifies a +single colon after 'c', so getopt() enforces a valid pointer in optarg. +If it contains a comma at first position, packet counter value parsing +will fail so all cases are covered. + +Reported-by: gorbanev.es@gmail.com +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 +Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") +Signed-off-by: Phil Sutter +(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) +--- + extensions/iptables.t | 5 +++++ + iptables/xshared.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extensions/iptables.t b/extensions/iptables.t +index b4b6d677abab1..5d6d3d15cc5fd 100644 +--- a/extensions/iptables.t ++++ b/extensions/iptables.t +@@ -4,3 +4,8 @@ + -i eth+ -o alongifacename+;=;OK + ! -i eth0;=;OK + ! -o eth+;=;OK ++-c "";;FAIL ++-c ,3;;FAIL ++-c 3,;;FAIL ++-c ,;;FAIL ++-c 2,3 -j ACCEPT;-j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 690502c457dd0..f2e3bc03a2824 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], + set_option(&cs->options, OPT_COUNTERS, &args->invflags, + invert); + args->pcnt = optarg; +- args->bcnt = strchr(args->pcnt + 1, ','); ++ args->bcnt = strchr(args->pcnt, ','); + if (args->bcnt) + args->bcnt++; + if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/iptables.spec b/iptables.spec index 83b972c..bc0675d 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 8%{?dist} +Release: 9%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -30,6 +30,19 @@ Patch007: 0007-man-Do-not-escape-exclamation-marks.patch Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch +Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch +Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch +Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch +Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -37,7 +50,7 @@ License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) -# libnfnetlink-devel is requires for nfnl_osf +# libnfnetlink-devel is required for nfnl_osf BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers @@ -427,6 +440,9 @@ fi %changelog +* Wed Jul 03 2024 Phil Sutter - 1.8.10-9 +- Backport fixes from upstream + * Tue May 21 2024 Phil Sutter - 1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables From 4be8ae789abd28ae701aca4f05897a1a0f65b018 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:34:58 +0200 Subject: [PATCH 19/46] iptables-1.8.10-10 - Verify tarball GPG signature --- .gitignore | 1 + coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 +++++++++++++++++++++++++ iptables.spec | 40 +++++++++------- sources | 1 + 4 files changed, 89 insertions(+), 17 deletions(-) create mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt diff --git a/.gitignore b/.gitignore index 4cb5d7a..b61615f 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz +/iptables-1.8.10.tar.xz.sig diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt new file mode 100644 index 0000000..2d3b902 --- /dev/null +++ b/coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded +660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi +V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 +zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t +Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh +KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 +dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi +WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg +9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj ++IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR +U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 ++ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd +RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 +4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN +IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w +bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf +Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj +QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 +wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb +4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET +tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP +n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV +oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 +o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S +ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU +tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp +HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM +FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ +diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid +R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK +uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv +Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl +UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q +KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO +RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc +wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 +0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ +q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU +k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk +pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY +plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC +qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu +iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p +jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O +ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 +CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag +8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB +bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM +jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR +rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg +3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ +7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 +7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ +yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 +leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 +U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ +rlbu70nh2kSJrg== +=wukb +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index bc0675d..9d817f5 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,14 +11,16 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 9%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.xz -Source1: iptables.init -Source2: iptables-config -Source3: iptables.service -Source4: sysconfig_iptables -Source5: sysconfig_ip6tables -Source6: arptables-nft-helper +Release: 10%{?dist} +Source0: %{url}/files/%{name}-%{version}.tar.xz +source1: %{url}/files/%{name}-%{version}.tar.xz.sig +Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source3: iptables.init +Source4: iptables-config +Source5: iptables.service +Source6: sysconfig_iptables +Source7: sysconfig_ip6tables +Source8: arptables-nft-helper Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -179,6 +181,7 @@ Provides: ebtables nftables compatibility for iptables, arptables and ebtables. %prep +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 %build @@ -201,20 +204,20 @@ rm -f %{buildroot}%{_libdir}/*.la # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} -install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init +install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig -install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config +install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config -install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables -install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables +install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir} -sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service +install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} # install legacy actions for service command @@ -240,7 +243,7 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ +install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ touch %{buildroot}%{_libexecdir}/arptables-helper # prepare for alternatives @@ -440,6 +443,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-10 +- Verify tarball GPG signature + * Wed Jul 03 2024 Phil Sutter - 1.8.10-9 - Backport fixes from upstream diff --git a/sources b/sources index 59e259b..6015b94 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 +SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 From f61dd7d5ce88be4c6b9442a2eedaa598e6c6065f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:43:00 +0200 Subject: [PATCH 20/46] iptables-1.8.10-11 - Add missing build dependency --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 9d817f5..906c6f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -69,6 +69,7 @@ BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make +BuildRequires: gnupg2 %description The iptables utility controls the network packet filtering code in the @@ -443,6 +444,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-11 +- Add missing build dependency + * Fri Jul 05 2024 Phil Sutter - 1.8.10-10 - Verify tarball GPG signature From fdb7f30ead0154d756382d5523101154f1e7fc5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 14 Apr 2024 14:38:45 +0200 Subject: [PATCH 21/46] Fix build with %_sbindir==%_bindir and add compat sbin Provides For https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. nsntrace requires /usr/sbin/iptables. --- iptables.spec | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 906c6f4..ee41fa8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -178,6 +178,13 @@ Provides: iptables Provides: arptables Provides: ebtables +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description nft nftables compatibility for iptables, arptables and ebtables. @@ -254,8 +261,7 @@ touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink -rm -f %{buildroot}%{_bindir}/iptables-xml -ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %ldconfig_scriptlets @@ -444,6 +450,9 @@ fi %changelog +* Tue Jul 09 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-12 +- Rebuilt for the bin-sbin merge + * Fri Jul 05 2024 Phil Sutter - 1.8.10-11 - Add missing build dependency From d710b74abd664ed3cb4cb9d75ba59b5eea6d7404 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:46:20 +0200 Subject: [PATCH 22/46] Call alternatives without full path As part of https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin, alternatives is moved from /usr/sbin/alternatives to /usr/bin/alternatives. (This happened when alternatives rpm was rebuilt in a build environment with the updated definitions.) On traditional systems a compat symlink is created, so both paths work. This means that packages that use paths into /usr/sbin do not need to be rebuilt and will continue to work fine. Unfortunately, on ostree systems, the compat symlinks are missing, so calls to /usr/sbin/alternatives fail. There is no benefit from specifying the full path to binaries in scriptlets because the scriptlets are called with a well-defined $PATH. So drop the full path, so that the package works fine no matter where exactly alternatives is installed. --- iptables.spec | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/iptables.spec b/iptables.spec index ee41fa8..4d5876c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -268,7 +268,7 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -278,7 +278,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - /usr/sbin/update-alternatives --remove \ + update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -294,7 +294,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -320,7 +320,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -338,7 +338,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -358,7 +358,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -370,8 +370,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - /usr/sbin/update-alternatives --remove \ - $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi From 9ddeac8b47f05cbca9b732f176fb5ccf95da7f6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:50:40 +0200 Subject: [PATCH 23/46] Add changelog entry and bump release --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 4d5876c..fadaa3e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 12%{?dist} +Release: 13%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -449,6 +449,9 @@ fi %changelog +* Fri Jul 12 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-13 +- Bump release and add changelog entry + * Tue Jul 09 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-12 - Rebuilt for the bin-sbin merge From 4d531018fe7b7c7b143fe1e28ffc6baa9ac8fec7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 11:27:43 +0200 Subject: [PATCH 24/46] Add unmerged-sbin compat also for -legacy subpackage There are two subpackages which provide /usr/s?bin/iptables: -nft and -legacy. In mock, for whatever reason, iptables-legacy was being installed, from the rebuild with merged-sbin, but since there was no dependency on the updated filesystem, an old version of filesystem was left, and only /usr/bin/iptables would available. --- iptables.spec | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fadaa3e..2737ddf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 13%{?dist} +Release: 14%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -89,6 +89,13 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description legacy The iptables utility controls the network packet filtering code in the Linux kernel. This package contains the legacy tools which are obsoleted by @@ -449,6 +456,9 @@ fi %changelog +* Sat Jul 13 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-14 +- Add unmerged-sbin compat also for -legacy subpackage + * Fri Jul 12 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-13 - Bump release and add changelog entry From d9521ce9d679ccedc2d85f0892827d96b1919e53 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 10:33:34 +0000 Subject: [PATCH 25/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 2737ddf..90ba23e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 14%{?dist} +Release: 15%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -456,6 +456,9 @@ fi %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jul 13 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-14 - Add unmerged-sbin compat also for -legacy subpackage From bf80e3901433c9d04166e8ebbac18529f1b360d8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 8 Nov 2024 16:28:18 +0100 Subject: [PATCH 26/46] iptables-1.8.11-1 - new version --- .gitignore | 2 + ...another-segfault-due-to-chain-index-.patch | 81 ----- ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 ----- ...-Fix-corner-case-noflush-restore-bug.patch | 63 ---- ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 --- ...ants-support-v-update-OPTSTRING_COMM.patch | 31 -- ...n-line-number-formatting-with-legacy.patch | 28 -- ...-man-Do-not-escape-exclamation-marks.patch | 44 --- ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 --- ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ------- ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 --- ...se-Add-missing-braces-around-ternary.patch | 36 --- ...xtables-Fix-memleak-of-matches-udata.patch | 32 -- ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ------------ ...frag-Save-xlate-inverted-full-ranges.patch | 117 ------- ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 ------- ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 -------- ...-esp-Save-xlate-inverted-full-ranges.patch | 119 ------- ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 --- ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ---- ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ------------------ ...t-Fix-for-broken-recover_rule_compat.patch | 89 ----- ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 --- ...sing-of-empty-string-arg-in-c-option.patch | 48 --- coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 ---- coreteam-gpg-key-0xD70D1A666ACF2B21.txt | 64 ++++ iptables.spec | 35 +- sources | 4 +- 28 files changed, 76 insertions(+), 2018 deletions(-) delete mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch delete mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch delete mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch delete mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch delete mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch delete mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch delete mode 100644 0007-man-Do-not-escape-exclamation-marks.patch delete mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch delete mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch delete mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch delete mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch delete mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch delete mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch delete mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch delete mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch delete mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch delete mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch delete mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch delete mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch delete mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch delete mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch delete mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt create mode 100644 coreteam-gpg-key-0xD70D1A666ACF2B21.txt diff --git a/.gitignore b/.gitignore index b61615f..3814395 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz /iptables-1.8.10.tar.xz.sig +/iptables-1.8.11.tar.xz +/iptables-1.8.11.tar.xz.sig diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch deleted file mode 100644 index 35b5973..0000000 --- a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Oct 2023 17:27:42 +0200 -Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL - pointer - -Chain rename code missed to adjust the num_chains value which is used to -calculate the number of chain index buckets to allocate during an index -rebuild. So with the right number of chains present, the last chain in a -middle bucket being renamed (and ending up in another bucket) triggers -an index rebuild based on false data. The resulting NULL pointer index -bucket then causes a segfault upon reinsertion. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 -Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") -(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) ---- - .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ - libiptc/libiptc.c | 4 +++ - 2 files changed, 36 insertions(+) - create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 - -diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -new file mode 100755 -index 0000000000000..bc473d2511bbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -@@ -0,0 +1,32 @@ -+#!/bin/bash -+# -+# Another funny rename bug in libiptc: -+# If there is a chain index bucket with only a single chain in it and it is not -+# the last one and that chain is renamed, a chain index rebuild is triggered. -+# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an -+# extra index is allocated and remains NULL. The following insert of renamed -+# chain then segfaults. -+ -+( -+ echo "*filter" -+ # first bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-a-$i - [0:0]" -+ done -+ # second bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-b-$i - [0:0]" -+ done -+ # third bucket, just make sure it exists -+ echo ":chain-c-0 - [0:0]" -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore -+ -+# rename all chains of the middle bucket -+( -+ echo "*filter" -+ for ((i = 0; i < 40; i++)); do -+ echo "-E chain-b-$i chain-d-$i" -+ done -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore --noflush -diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c -index e475063367c26..9712a36353b9a 100644 ---- a/libiptc/libiptc.c -+++ b/libiptc/libiptc.c -@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, - return 0; - } - -+ handle->num_chains--; -+ - /* This only unlinks "c" from the list, thus no free(c) */ - iptcc_chain_index_delete_chain(c, handle); - - /* Change the name of the chain */ - strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); - -+ handle->num_chains++; -+ - /* Insert sorted into to list again */ - iptc_insert_chain(handle, c); - diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch deleted file mode 100644 index c384e4b..0000000 --- a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Fri, 3 Nov 2023 17:33:22 +0100 -Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage - -ARPT_ and IPT_INV flags are not interchangeable, e.g.: -define IPT_INV_SRCDEVADDR 0x0080 -define ARPT_INV_SRCDEVADDR 0x0010 - -as these flags can be tested by libarp_foo.so such checks can yield -incorrect results. - -Because arptables-nft uses existing code, e.g. xt_mark, it makes -sense to unify this completely by converting the last users of -ARPT_INV_ constants. - -Note that arptables-legacy does not do run-time module loading via -dlopen(). Functionaliy implemented by "extensions" in the -arptables-legacy git tree are built-in, so this doesn't break -arptables-legacy binaries. - -Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") -Signed-off-by: Florian Westphal -Signed-off-by: Phil Sutter -(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) ---- - extensions/libarpt_mangle.c | 4 ++-- - iptables/nft-arp.c | 2 +- - iptables/xshared.h | 4 +++- - 3 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c -index 765edf34781f3..a846e97ec8f27 100644 ---- a/extensions/libarpt_mangle.c -+++ b/extensions/libarpt_mangle.c -@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! --h-length not allowed for " - "--mangle-mac-s"); -@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! hln not allowed for --mangle-mac-d"); - if (e->arp.arhln != 6) -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index aed39ebdd5166..535dd6b83237b 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, - &args->d.naddrs); - - if ((args->s.naddrs > 1 || args->d.naddrs > 1) && -- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) -+ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) - xtables_error(PARAMETER_PROBLEM, - "! not allowed with multiple" - " source or destination IP addresses"); -diff --git a/iptables/xshared.h b/iptables/xshared.h -index a200e0d620ad3..5586385456a4d 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -80,7 +80,9 @@ struct xtables_target; - #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ - #define EBT_OPTSTRING OPTSTRING_COMMON "hv" - --/* define invflags which won't collide with IPT ones */ -+/* define invflags which won't collide with IPT ones. -+ * arptables-nft does NOT use the legacy ARPT_INV_* defines. -+ */ - #define IPT_INV_SRCDEVADDR 0x0080 - #define IPT_INV_TGTDEVADDR 0x0100 - #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch deleted file mode 100644 index 3386925..0000000 --- a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +++ /dev/null @@ -1,63 +0,0 @@ -From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 7 Nov 2023 19:12:14 +0100 -Subject: [PATCH] ebtables: Fix corner-case noflush restore bug - -Report came from firwalld, but this is actually rather hard to trigger. -Since a regular chain line prevents it, typical dump/restore use-cases -are unaffected. - -Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") -Cc: Eric Garver -Signed-off-by: Phil Sutter -(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) ---- - .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ - iptables/xtables-eb.c | 2 ++ - 2 files changed, 27 insertions(+) - create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 - -diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -new file mode 100755 -index 0000000000000..0def0ac58e7be ---- /dev/null -+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -@@ -0,0 +1,25 @@ -+#!/bin/sh -+# -+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: -+# - with --noflush -+# - a second table after the broute one -+# - A policy command but no chain line for BROUTING chain -+ -+set -e -+ -+case "$XT_MULTI" in -+*xtables-nft-multi) -+ ;; -+*) -+ echo "skip $XT_MULTI" -+ exit 0 -+ ;; -+esac -+ -+$XT_MULTI ebtables-restore --noflush < -Date: Sun, 19 Nov 2023 13:18:26 +0100 -Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused - -Drop the boolean, it was meant to disable some existence checks in -do_parse() prior to the caching rework. Now that do_parse() runs before -any caching is done, the checks in question don't exist anymore so drop -this relict. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) ---- - iptables/xshared.h | 1 - - iptables/xtables-translate.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index 5586385456a4d..c77556a1987dc 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -284,7 +284,6 @@ struct xt_cmd_parse { - bool restore; - int line; - int verbose; -- bool xlate; - struct xt_cmd_parse_ops *ops; - }; - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 88e0a6b639494..c019cd2991305 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - .table = *table, - .restore = restore, - .line = line, -- .xlate = true, - .ops = &h->ops->cmd_parse, - }; - struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch deleted file mode 100644 index c743e75..0000000 --- a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 19 Nov 2023 13:25:36 +0100 -Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON - -Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") -Signed-off-by: Phil Sutter -(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) ---- - iptables/xshared.h | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index c77556a1987dc..815b9d3e98726 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -75,10 +75,10 @@ struct xtables_globals; - struct xtables_rule_match; - struct xtables_target; - --#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" --#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" --#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ --#define EBT_OPTSTRING OPTSTRING_COMMON "hv" -+#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" -+#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" -+#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ -+#define EBT_OPTSTRING OPTSTRING_COMMON "h" - - /* define invflags which won't collide with IPT ones. - * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch deleted file mode 100644 index 07bea3a..0000000 --- a/0006-ebtables-Align-line-number-formatting-with-legacy.patch +++ /dev/null @@ -1,28 +0,0 @@ -From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 21 Nov 2023 22:58:47 +0100 -Subject: [PATCH] ebtables: Align line number formatting with legacy - -Legacy ebtables appends a dot to the number printed in first column if ---Ln flag was given. - -Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") -Signed-off-by: Phil Sutter -(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) ---- - iptables/nft-bridge.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index d9a8ad2b0f373..e414ef5584392 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, - struct iptables_command_state cs = {}; - - if (format & FMT_LINENUMBERS) -- printf("%d ", num); -+ printf("%d. ", num); - - nft_rule_to_ebtables_command_state(h, r, &cs); - __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch deleted file mode 100644 index b088c63..0000000 --- a/0007-man-Do-not-escape-exclamation-marks.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 13:29:17 +0100 -Subject: [PATCH] man: Do not escape exclamation marks - -This appears to be not necessary, also mandoc complains about it: - -| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! - -Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") -Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") -Signed-off-by: Phil Sutter -(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) ---- - extensions/libip6t_DNPT.man | 2 +- - extensions/libip6t_SNPT.man | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man -index 9b060f5b7179b..72c6ae5d422a2 100644 ---- a/extensions/libip6t_DNPT.man -+++ b/extensions/libip6t_DNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the SNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 -diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man -index 97e0071b43cc1..0c926978377a7 100644 ---- a/extensions/libip6t_SNPT.man -+++ b/extensions/libip6t_SNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the DNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch deleted file mode 100644 index c0bbec2..0000000 --- a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 20:21:49 +0100 -Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks - -In order to parse the mask, xtopt_parse_hostmask() calls -xtopt_parse_plenmask() thereby limiting netmask support to prefix -lengths (alternatively specified in IP address notation). - -In order to lift this impractical restriction, make -xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may -fall back to xtopt_parse_mask() which correctly initializes val.hmask -itself and indicates non-CIDR-compatible masks by setting val.hlen to --1. - -So in order to support these odd masks, it is sufficient for -xtopt_parse_plenmask() to skip its mask building from val.hlen value and -take whatever val.hmask contains. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) ---- - libxtables/xtoptions.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index b16bbfbe32311..d91a78f470eda 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - - xtopt_parse_plen(cb); - -+ /* may not be convertible to CIDR notation */ -+ if (cb->val.hlen == (uint8_t)-1) -+ goto out_put; -+ - memset(mask, 0xFF, sizeof(union nf_inet_addr)); - /* This shifting is AF-independent. */ - if (cb->val.hlen == 0) { -@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - mask[1] = htonl(mask[1]); - mask[2] = htonl(mask[2]); - mask[3] = htonl(mask[3]); -+out_put: - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); - } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch deleted file mode 100644 index 7745634..0000000 --- a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 19 Dec 2023 00:56:07 +0100 -Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting - -Parameter 'wait' passed to xtables_lock() signals three modes of -operation, depending on its value: - - 0: --wait not specified, do not wait if lock is busy --1: --wait specified without value, wait indefinitely until lock becomes - free ->0: Wait for 'wait' seconds for lock to become free, abort otherwise - -Since fixed commit, the first two cases were treated the same apart from -calling alarm(0), but that is a nop if no alarm is pending. Fix the code -by requesting a non-blocking flock() in the second case. While at it, -restrict the alarm setup to the third case only. - -Cc: Jethro Beekman -Cc: howardjohn@google.com -Cc: Antonio Ojea -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 -Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") -Signed-off-by: Phil Sutter -(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) ---- - .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ - iptables/xshared.c | 4 +- - 2 files changed, 57 insertions(+), 2 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 -new file mode 100755 -index 0000000000000..4481f966ce435 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 -@@ -0,0 +1,55 @@ -+#!/bin/bash -+ -+case "$XT_MULTI" in -+*xtables-legacy-multi) -+ ;; -+*) -+ echo skip $XT_MULTI -+ exit 0 -+ ;; -+esac -+ -+coproc RESTORE { $XT_MULTI iptables-restore; } -+echo "*filter" >&${RESTORE[1]} -+ -+ -+$XT_MULTI iptables -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 1 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "process waits when it should not" -+ exit 1 -+} -+wait $ipt_pid -+[[ $? -eq 0 ]] && { -+ echo "process exited 0 despite busy lock" -+ exit 1 -+} -+ -+t0=$(date +%s) -+$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT -+t1=$(date +%s) -+[[ $((t1 - t0)) -ge 3 ]] || { -+ echo "wait time not expired" -+ exit 1 -+} -+ -+$XT_MULTI iptables -w -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] || { -+ echo "no indefinite wait" -+ exit 1 -+} -+kill $ipt_pid -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "killed waiting iptables call did not exit in time" -+ exit 1 -+} -+ -+kill $RESTORE_PID -+wait -+exit 0 -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 5f75a0a57a023..690502c457dd0 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -270,7 +270,7 @@ static int xtables_lock(int wait) - return XT_LOCK_FAILED; - } - -- if (wait != -1) { -+ if (wait > 0) { - sigact_alarm.sa_handler = alarm_ignore; - sigact_alarm.sa_flags = SA_RESETHAND; - sigemptyset(&sigact_alarm.sa_mask); -@@ -278,7 +278,7 @@ static int xtables_lock(int wait) - alarm(wait); - } - -- if (flock(fd, LOCK_EX) == 0) -+ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) - return fd; - - if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch deleted file mode 100644 index ea88fa3..0000000 --- a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 17 Dec 2023 13:02:36 +0100 -Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK - -Do as the comment in xtopt_parse_hostmask() claims and omit -XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() -will catch the incompatibility. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) ---- - include/xtables.h | 1 - - libxtables/xtoptions.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/include/xtables.h b/include/xtables.h -index 087a1d600f9ae..9def9b43b6e58 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -61,7 +61,6 @@ struct in_addr; - * %XTTYPE_SYSLOGLEVEL: syslog level by name or number - * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) - * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length -- * (ptr: union nf_inet_addr; only host portion is stored) - * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) - * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) - * %XTTYPE_PORTRC: colon-separated port range (names acceptable), -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d91a78f470eda..ba68056dc99f7 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { - [XTTYPE_STRING] = -1, - [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), - [XTTYPE_HOST] = sizeof(union nf_inet_addr), -- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), - [XTTYPE_PROTOCOL] = sizeof(uint8_t), - [XTTYPE_PORT] = sizeof(uint16_t), - [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch deleted file mode 100644 index f348d59..0000000 --- a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 26 Jan 2024 18:43:10 +0100 -Subject: [PATCH] nft: ruleparse: Add missing braces around ternary - -The expression evaluated the sum before the ternay, consequently not -adding target->size if tgsize was zero. - -Identified by ASAN for a simple rule using standard target: -| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN -| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN -| ================================================================= -| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 -| READ of size 8 at 0x603000000120 thread T0 -| [...] - -Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") -Signed-off-by: Phil Sutter -(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) ---- - iptables/nft-ruleparse.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c -index c8322f936acd9..57fe27276de35 100644 ---- a/iptables/nft-ruleparse.c -+++ b/iptables/nft-ruleparse.c -@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) - if (!target) - return NULL; - -- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; -+ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); - - target->t = xtables_calloc(1, size); - target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch deleted file mode 100644 index 7d9c51f..0000000 --- a/0012-libxtables-Fix-memleak-of-matches-udata.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 31 Jan 2024 14:58:17 +0100 -Subject: [PATCH] libxtables: Fix memleak of matches' udata - -If the extension specifies a non-zero udata_size, field 'udata' points -to an allocated buffer which needs to be freed upon extension deinit. - -Interestingly, this bug was identified by ASAN and missed by valgrind. - -Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") -Signed-off-by: Phil Sutter -(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) ---- - libxtables/xtables.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index ba9ceaeb3da41..0f617d80ae37e 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) - free(matchp->match->m); - matchp->match->m = NULL; - } -+ if (matchp->match->udata_size) { -+ free(matchp->match->udata); -+ matchp->match->udata = NULL; -+ } - if (matchp->match == matchp->match->next) { - free(matchp->match); - matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index e9c3cb0..0000000 --- a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,200 +0,0 @@ -From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:27:03 +0100 -Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges - -While at it, fix xlate output for plain '-m ah' matches: With -ip6tables-translate, one should emit an extdhr exists match since -ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, -a simple 'meta l4proto ah' was missing. - -Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") -Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) - -Conflicts: - extensions/libip6t_ah.t - extensions/libip6t_ah.txlate - extensions/libipt_ah.t - extensions/libipt_ah.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_ah.c | 22 +++++++++++++--------- - extensions/libip6t_ah.t | 1 + - extensions/libip6t_ah.txlate | 6 ++++++ - extensions/libipt_ah.c | 22 ++++++++++++++-------- - extensions/libipt_ah.t | 1 + - extensions/libipt_ah.txlate | 6 ++++++ - 6 files changed, 41 insertions(+), 17 deletions(-) - -diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c -index f35982f379d76..0f95c4735eabd 100644 ---- a/extensions/libip6t_ah.c -+++ b/extensions/libip6t_ah.c -@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) - } - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - if (min == max) - printf("%s:%s%u", name, inv, min); - else -@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - char *space = ""; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); -@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, - } - - if (!space[0]) /* plain '-m ah' */ -- xt_xlate_add(xl, "meta l4proto ah"); -+ xt_xlate_add(xl, "exthdr ah exists"); - - return 1; - } -diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t -index c1898d44cf193..9099bdc9259c3 100644 ---- a/extensions/libip6t_ah.t -+++ b/extensions/libip6t_ah.t -@@ -13,3 +13,4 @@ - -m ah --ahspi 0:invalid;;FAIL - -m ah --ahspi;;FAIL - -m ah;=;OK -+-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate -index cc33ac2718c0c..32c6b7de00937 100644 ---- a/extensions/libip6t_ah.txlate -+++ b/extensions/libip6t_ah.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' - - ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT - nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' -+ -+ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr ah exists counter' -+ -+ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' -diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c -index fec5705ce6f53..39e3013d3e74b 100644 ---- a/extensions/libipt_ah.c -+++ b/extensions/libipt_ah.c -@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) - ahinfo->invflags |= IPT_AH_INV_SPI; - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - printf("%s", name); - if (min == max) { - printf(":%s", inv); -@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); - else - xt_xlate_add(xl, "%u", ahinfo->spis[0]); -+ } else { -+ xt_xlate_add(xl, "meta l4proto ah"); - } - - return 1; -diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t -index cd853865638e8..1aeb607e9e986 100644 ---- a/extensions/libipt_ah.t -+++ b/extensions/libipt_ah.t -@@ -11,3 +11,4 @@ - -m ah --ahspi;;FAIL - -m ah;;FAIL - -p ah -m ah;=;OK -+-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate -index 897c82b5f95c6..baf5a0ae6182a 100644 ---- a/extensions/libipt_ah.txlate -+++ b/extensions/libipt_ah.txlate -@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' - - iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP - nft 'add rule ip filter INPUT ah spi != 50 counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto ah counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 902ade1..0000000 --- a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,117 +0,0 @@ -From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:39:52 +0100 -Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges - -Also translate plain '-m frag' match into an exthdr exists one. - -Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) - -Conflicts: - extensions/libip6t_frag.t - extensions/libip6t_frag.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- - extensions/libip6t_frag.t | 1 + - extensions/libip6t_frag.txlate | 6 ++++++ - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c -index 49c787e709a9e..ed7fe10a4716d 100644 ---- a/extensions/libip6t_frag.c -+++ b/extensions/libip6t_frag.c -@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) - } - } - -+static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_ids(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_ids_match(min, max, invert)) { - printf("%s", name); - if (min == max) - printf(":%s%u", inv, min); -@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, - static void frag_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 -- && fraginfo->ids[1] == 0xFFFFFFFF)) { -- printf("%s --fragid ", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ printf("%s --fragid ", inv_ids ? " !" : ""); - if (fraginfo->ids[0] - != fraginfo->ids[1]) - printf("%u:%u", -@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) - printf(" --fraglast"); - } - -+#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ -+ IP6T_FRAG_MF | IP6T_FRAG_NMF) -+ - static int frag_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_frag *fraginfo = - (struct ip6t_frag *)params->match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "frag id %s", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? -- "!= " : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); - if (fraginfo->ids[0] != fraginfo->ids[1]) - xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], - fraginfo->ids[1]); - else - xt_xlate_add(xl, "%u", fraginfo->ids[0]); - -+ } else if (!(fraginfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr frag exists"); -+ return 1; - } - - /* ignore ineffective IP6T_FRAG_LEN bit */ -diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t -index 299fa03f8845b..58417c90e9217 100644 ---- a/extensions/libip6t_frag.t -+++ b/extensions/libip6t_frag.t -@@ -1,4 +1,5 @@ - :INPUT,FORWARD,OUTPUT -+-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK - -m frag --fragid 1:42;=;OK - -m frag --fraglen 42;=;OK - -m frag --fragres;=;OK -diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate -index 33fc0631dc792..e250587e7682c 100644 ---- a/extensions/libip6t_frag.txlate -+++ b/extensions/libip6t_frag.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' - - ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT - nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' -+ -+ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr frag exists counter' -+ -+ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 1afcc54..0000000 --- a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,111 +0,0 @@ -From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:42:10 +0100 -Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges - -Also translate '-m mh' into an exthdr exists match unless '-p mh' is -also present. The latter is converted into 'meta l4proto mh' which might -need fixing itself at a later point. - -Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) - -Conflicts: - extensions/libip6t_mh.t - extensions/libip6t_mh.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_mh.c | 20 ++++++++++++++++---- - extensions/libip6t_mh.t | 1 + - extensions/libip6t_mh.txlate | 9 +++++++++ - 3 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 1410d324b5d42..3f80e28ec94c8 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - enum { - O_MH_TYPE = 0, -@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) - printf("%s", name); - } - -+static bool skip_types_match(uint8_t min, uint8_t max, bool inv) -+{ -+ return min == 0 && max == UINT8_MAX && !inv; -+} -+ - static void print_types(uint8_t min, uint8_t max, int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFF || invert) { -+ if (!skip_types_match(min, max, invert)) { - printf(" "); - if (min == max) { - printf("%s", inv); -@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, - static void mh_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) - return; - -- if (mhinfo->invflags & IP6T_MH_INV_TYPE) -+ if (inv_type) - printf(" !"); - - if (mhinfo->types[0] != mhinfo->types[1]) -@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -+ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -+ if (proto != IPPROTO_MH) -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; -+ } - - if (mhinfo->types[0] != mhinfo->types[1]) - xt_xlate_add(xl, "mh type %s%u-%u", -diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t -index 6b76d13d0a00f..be5439edc9520 100644 ---- a/extensions/libip6t_mh.t -+++ b/extensions/libip6t_mh.t -@@ -4,3 +4,4 @@ - -p mobility-header -m mh --mh-type 1;=;OK - -p mobility-header -m mh ! --mh-type 4;=;OK - -p mobility-header -m mh --mh-type 4:123;=;OK -+-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 4dfaf46a2b8d7..3364ce574468f 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac - - ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' -+ -+ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+ -+ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' -+ -+ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index c9ec110..0000000 --- a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:45:42 +0100 -Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges - -Also translate plain '-m rt' match into an exthdr exists one. - -Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) - -Conflicts: - extensions/libip6t_rt.t - extensions/libip6t_rt.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- - extensions/libip6t_rt.t | 1 + - extensions/libip6t_rt.txlate | 9 +++++++++ - 3 files changed, 30 insertions(+), 8 deletions(-) - -diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c -index d5b0458bb397e..6db09f0b2cdc8 100644 ---- a/extensions/libip6t_rt.c -+++ b/extensions/libip6t_rt.c -@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) - } - } - -+static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_nums(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_segsleft_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, - static void rt_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - printf("%s --rt-type %u", -@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 -- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- printf("%s --rt-segsleft ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); - if (rtinfo->segsleft[0] - != rtinfo->segsleft[1]) - printf("%u:%u", -@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - - } - -+#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ -+ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) -+ - static int rt_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - xt_xlate_add(xl, "rt type%s %u", -@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "rt seg-left%s ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); - - if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) - xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], - rtinfo->segsleft[1]); - else - xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); -+ } else if (!(rtinfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr rt exists"); -+ return 1; - } - - if (rtinfo->flags & IP6T_RT_LEN) { -diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t -index 3c7b2d981324a..047b6880e354d 100644 ---- a/extensions/libip6t_rt.t -+++ b/extensions/libip6t_rt.t -@@ -3,3 +3,4 @@ - -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK - -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK - -m rt;=;OK -+-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK -diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate -index 3578bcba0157e..1c2f74a588750 100644 ---- a/extensions/libip6t_rt.txlate -+++ b/extensions/libip6t_rt.txlate -@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' - - ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT - nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' -+ -+ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 318d9eb..0000000 --- a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,119 +0,0 @@ -From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:47:09 +0100 -Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges - -Also add a translation for plain '-m esp' match which depends on the -address family: While ip6tables-translate may emit an exthdr exists -match, iptables-translate must stick to meta l4proto. - -Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) - -Conflicts: - extensions/libxt_esp.t - extensions/libxt_esp.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_esp.c | 26 ++++++++++++++++++-------- - extensions/libxt_esp.t | 1 + - extensions/libxt_esp.txlate | 12 ++++++++++++ - 3 files changed, 31 insertions(+), 8 deletions(-) - -diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c -index 2c7ff942cb9e0..8e9766d71ed57 100644 ---- a/extensions/libxt_esp.c -+++ b/extensions/libxt_esp.c -@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) - espinfo->invflags |= XT_ESP_INV_SPI; - } - -+static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spis_match(min, max, invert)) { - if (min == max) - printf(" %s:%s%u", name, inv, min); - else -@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void esp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_esp *espinfo = (struct xt_esp *)match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 -- && espinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --espspi ", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ printf("%s --espspi ", inv_spi ? " !" : ""); - if (espinfo->spis[0] - != espinfo->spis[1]) - printf("%u:%u", -@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "esp spi%s", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); - if (espinfo->spis[0] != espinfo->spis[1]) - xt_xlate_add(xl, " %u-%u", espinfo->spis[0], - espinfo->spis[1]); - else - xt_xlate_add(xl, " %u", espinfo->spis[0]); -+ } else if (afinfo->family == NFPROTO_IPV4) { -+ xt_xlate_add(xl, "meta l4proto esp"); -+ } else if (afinfo->family == NFPROTO_IPV6) { -+ xt_xlate_add(xl, "exthdr esp exists"); -+ } else { -+ return 0; - } - - return 1; -diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t -index 92c5779f860f1..37259d6b3a08f 100644 ---- a/extensions/libxt_esp.t -+++ b/extensions/libxt_esp.t -@@ -4,5 +4,6 @@ - -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK - -p esp -m esp ! --espspi 0:4294967294;=;OK - -p esp -m esp --espspi -1;;FAIL -+-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK - -p esp -m esp;=;OK - -m esp;;FAIL -diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate -index f6aba52f52235..5e8fb241beaf4 100644 ---- a/extensions/libxt_esp.txlate -+++ b/extensions/libxt_esp.txlate -@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' - - iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP - nft 'add rule ip filter INPUT esp spi 500-600 counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto esp counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch deleted file mode 100644 index 316e5dd..0000000 --- a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:57:46 +0100 -Subject: [PATCH] extensions: ipcomp: Save inverted full ranges - -Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") -Signed-off-by: Phil Sutter -(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) - -Conflicts: - extensions/libxt_ipcomp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_ipcomp.c | 7 ++++--- - extensions/libxt_ipcomp.t | 1 + - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c -index 4171c4a1c4eb7..961c17e584933 100644 ---- a/extensions/libxt_ipcomp.c -+++ b/extensions/libxt_ipcomp.c -@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, - static void comp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; -+ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; - - if (!(compinfo->spis[0] == 0 -- && compinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ipcompspi ", -- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); -+ && compinfo->spis[1] == UINT32_MAX -+ && !inv_spi)) { -+ printf("%s --ipcompspi ", inv_spi ? " !" : ""); - if (compinfo->spis[0] - != compinfo->spis[1]) - printf("%u:%u", -diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t -index 8546ba9ce416f..47c1fbc220c6a 100644 ---- a/extensions/libxt_ipcomp.t -+++ b/extensions/libxt_ipcomp.t -@@ -1,3 +1,4 @@ - :INPUT,OUTPUT - -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK - -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK -+-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch deleted file mode 100644 index cfeacd5..0000000 --- a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 2 Feb 2024 13:14:29 +0100 -Subject: [PATCH] nft: Do not omit full ranges if inverted - -Otherwise this turns a never matching rule into an always matching one. - -Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") -Signed-off-by: Phil Sutter -(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_udp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_tcp.t | 2 ++ - extensions/libxt_udp.t | 2 ++ - iptables/nft.c | 4 ++-- - 3 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 7a3bbd08952f0..3caa3e3f50271 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,6 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index f534770191a6e..aa2c91770e63f 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,6 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK -+-p udp -m udp ! --sport :;-p udp -m udp;OK -+-p udp -m udp ! --dport :;-p udp -m udp;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/iptables/nft.c b/iptables/nft.c -index 97fd4f49fdb4c..8e7a38ac93a3e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return 0; - } - -- if (src[0] || src[1] < 0xffff) { -+ if (src[0] || src[1] < UINT16_MAX || invert_src) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); - if (!expr) - return -ENOMEM; -@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return ret; - } - -- if (dst[0] || dst[1] < 0xffff) { -+ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); - if (!expr) - return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 326544f..0000000 --- a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 17:42:12 +0100 -Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges - -Also translate a bare '-m tcp/udp' to 'meta l4proto' match. - -Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") -Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_tcp.txlate - extensions/libxt_udp.t - extensions/libxt_udp.txlate -- Context change due to Missing commits adding test cases. ---- - extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- - extensions/libxt_tcp.t | 4 ++-- - extensions/libxt_tcp.txlate | 6 +++++ - extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- - extensions/libxt_udp.t | 4 ++-- - extensions/libxt_udp.txlate | 6 +++++ - 6 files changed, 72 insertions(+), 39 deletions(-) - -diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c -index f82572828649b..32bbd684fd5d7 100644 ---- a/extensions/libxt_tcp.c -+++ b/extensions/libxt_tcp.c -@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void tcp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; - -- if (tcpinfo->spts[0] != 0 -- || tcpinfo->spts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (tcpinfo->spts[0] - != tcpinfo->spts[1]) -@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) - tcpinfo->spts[0]); - } - -- if (tcpinfo->dpts[0] != 0 -- || tcpinfo->dpts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (tcpinfo->dpts[0] - != tcpinfo->dpts[1]) -@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, - { - const struct xt_tcp *tcpinfo = - (const struct xt_tcp *)params->match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; -+ bool xlated = false; - -- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { - if (tcpinfo->spts[0] != tcpinfo->spts[1]) { - xt_xlate_add(xl, "tcp sport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0], tcpinfo->spts[1]); - } else { - xt_xlate_add(xl, "tcp sport %s%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { - if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { - xt_xlate_add(xl, "tcp dport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0], tcpinfo->dpts[1]); - } else { - xt_xlate_add(xl, "tcp dport %s%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->option) -+ if (tcpinfo->option) { - xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, - tcpinfo->invflags & XT_TCP_INV_OPTION ? - "missing" : "exists"); -+ xlated = true; -+ } - - if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "tcp flags %s", -@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, - print_tcp_xlate(xl, tcpinfo->flg_cmp); - xt_xlate_add(xl, " / "); - print_tcp_xlate(xl, tcpinfo->flg_mask); -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto tcp"); -+ - return 1; - } - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 3caa3e3f50271..8baeeff2fc94b 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,8 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ---p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ---p tcp -m tcp ! --dport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate -index 9802ddfe0039e..b3ddcc15833cf 100644 ---- a/extensions/libxt_tcp.txlate -+++ b/extensions/libxt_tcp.txlate -@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' - - iptables-translate -A INPUT -p tcp ! --tcp-option 23 - nft 'add rule ip filter INPUT tcp option 23 missing counter' -+ -+iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' -+ -+iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' -diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c -index ba1c3eb768592..748d418039c3a 100644 ---- a/extensions/libxt_udp.c -+++ b/extensions/libxt_udp.c -@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void udp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_udp *udpinfo = (struct xt_udp *)match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; - -- if (udpinfo->spts[0] != 0 -- || udpinfo->spts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_SRCPT) -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (udpinfo->spts[0] - != udpinfo->spts[1]) -@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) - udpinfo->spts[0]); - } - -- if (udpinfo->dpts[0] != 0 -- || udpinfo->dpts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_DSTPT) -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (udpinfo->dpts[0] - != udpinfo->dpts[1]) -@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; -+ bool xlated = false; - -- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { - if (udpinfo->spts[0] != udpinfo->spts[1]) { - xt_xlate_add(xl,"udp sport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0], udpinfo->spts[1]); - } else { - xt_xlate_add(xl, "udp sport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0]); - } -+ xlated = true; - } - -- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { - if (udpinfo->dpts[0] != udpinfo->dpts[1]) { - xt_xlate_add(xl,"udp dport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0], udpinfo->dpts[1]); - } else { - xt_xlate_add(xl,"udp dport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0]); - } -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto udp"); -+ - return 1; - } - -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index aa2c91770e63f..0cde6ac30cc15 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,8 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ---p udp -m udp ! --sport :;-p udp -m udp;OK ---p udp -m udp ! --dport :;-p udp -m udp;OK -+-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK -+-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate -index 28e7ca206b26b..d6bbb96f5d744 100644 ---- a/extensions/libxt_udp.txlate -+++ b/extensions/libxt_udp.txlate -@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep - - iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT - nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' -+ -+iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' -+ -+iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch deleted file mode 100644 index 46c636c..0000000 --- a/0021-nft-Fix-for-broken-recover_rule_compat.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 27 Feb 2024 18:47:39 +0100 -Subject: [PATCH] nft: Fix for broken recover_rule_compat() - -When IPv4 rule generator was changed to emit payload instead of -meta expressions for l4proto matches, the code reinserting -NFTNL_RULE_COMPAT_* attributes into rules being reused for counter -zeroing was broken by accident. - -Make rule compat recovery aware of the alternative match, basically -reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules -with NFTA_RULE_COMPAT") but add a test case this time to make sure -things stay intact. - -Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") -Signed-off-by: Phil Sutter -(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) ---- - iptables/nft.c | 27 ++++++++++++++++--- - .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ - 2 files changed, 35 insertions(+), 4 deletions(-) - create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8e7a38ac93a3e..42907a431a99e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) - return strerror(err); - } - -+static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) -+{ -+ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); -+ uint32_t poff = offsetof(struct iphdr, protocol); -+ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; -+ -+ if (!strcmp(name, "payload") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); -+ return 0; -+ } -+ if (!strcmp(name, "meta") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -+ return 0; -+ } -+ return -1; -+} -+ - static int recover_rule_compat(struct nftnl_rule *r) - { - struct nftnl_expr_iter *iter; -@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) - if (!e) - goto out; - -- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || -- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) -+ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ -+ if (l4proto_expr_get_dreg(e, ®) < 0) - goto next_expr; - -- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -- - e = nftnl_expr_iter_next(iter); - if (!e) - goto out; -diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -new file mode 100755 -index 0000000000000..e276a953234cf ---- /dev/null -+++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -@@ -0,0 +1,12 @@ -+#!/bin/bash -+ -+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } -+ -+set -e -+ -+rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" -+for cmd in iptables ip6tables; do -+ $XT_MULTI $cmd -t mangle -A PREROUTING $rule -+ $XT_MULTI $cmd -t mangle -Z -+ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" -+done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch deleted file mode 100644 index 0be13ca..0000000 --- a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 5 Mar 2024 17:02:56 +0100 -Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match - -Since core xlate code now ignores '-p mh' if an mh extension is also -present in the rule, mh extension has to emit the l4proto match itself. -Therefore emit the exthdr match irrespective of '-p' argument value just -like other IPv6 extension header matches do. - -Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") -Signed-off-by: Phil Sutter -(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) ---- - extensions/libip6t_mh.c | 4 +--- - extensions/libip6t_mh.txlate | 2 +- - 2 files changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 3f80e28ec94c8..1a1cee832b584 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; - bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - - if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -- if (proto != IPPROTO_MH) -- xt_xlate_add(xl, "exthdr mh exists"); -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; - } - -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 3364ce574468f..7eeaeefab6116 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' - - ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT --nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' - - ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT - nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch deleted file mode 100644 index a5e7994..0000000 --- a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 9 Apr 2024 13:18:12 +0200 -Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option - -Calling iptables with '-c ""' resulted in a call to strchr() with an -invalid pointer as 'optarg + 1' points to past the buffer. The most -simple fix is to drop the offset: The global optstring part specifies a -single colon after 'c', so getopt() enforces a valid pointer in optarg. -If it contains a comma at first position, packet counter value parsing -will fail so all cases are covered. - -Reported-by: gorbanev.es@gmail.com -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 -Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") -Signed-off-by: Phil Sutter -(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) ---- - extensions/iptables.t | 5 +++++ - iptables/xshared.c | 2 +- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/extensions/iptables.t b/extensions/iptables.t -index b4b6d677abab1..5d6d3d15cc5fd 100644 ---- a/extensions/iptables.t -+++ b/extensions/iptables.t -@@ -4,3 +4,8 @@ - -i eth+ -o alongifacename+;=;OK - ! -i eth0;=;OK - ! -o eth+;=;OK -+-c "";;FAIL -+-c ,3;;FAIL -+-c 3,;;FAIL -+-c ,;;FAIL -+-c 2,3 -j ACCEPT;-j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 690502c457dd0..f2e3bc03a2824 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], - set_option(&cs->options, OPT_COUNTERS, &args->invflags, - invert); - args->pcnt = optarg; -- args->bcnt = strchr(args->pcnt + 1, ','); -+ args->bcnt = strchr(args->pcnt, ','); - if (args->bcnt) - args->bcnt++; - if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt deleted file mode 100644 index 2d3b902..0000000 --- a/coreteam-gpg-key-0xD55D978A8A1420E4.txt +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded -660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi -V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 -zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t -Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh -KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 -dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi -WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg -9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj -+IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR -U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB -tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC -VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ -CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 -+ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd -RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 -4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN -IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w -bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf -Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj -QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 -wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb -4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET -tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP -n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV -oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 -o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S -ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU -tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp -HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM -FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ -diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid -R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK -uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv -Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl -UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q -KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO -RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc -wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 -0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ -q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU -k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk -pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY -plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC -qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu -iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p -jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O -ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 -CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag -8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB -bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM -jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR -rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg -3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ -7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 -7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ -yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 -leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 -U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ -rlbu70nh2kSJrg== -=wukb ------END PGP PUBLIC KEY BLOCK----- diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt new file mode 100644 index 0000000..cd4a35b --- /dev/null +++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E +o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+ +2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w +nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ +P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF +qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK +5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz +ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX +u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT +/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b +cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L +LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF +8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL +5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK +AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi +Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR +VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF +RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B +uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE +zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq +ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v +3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X +iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi +wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/ +UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj +M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm +97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E +FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW +IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb +0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF +GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu +bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8 +QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD +Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU +3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR +yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS +C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K +klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I +zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST +Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM +X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh +5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB +woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT +njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl +yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU +hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv +BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj +ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh +hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP +tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s +E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H +fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv +CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT +EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ +gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC +9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W +oD8ElPP+m/v6iA== +=70vD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index 90ba23e..edea0ae 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,11 +10,11 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.10 -Release: 15%{?dist} +Version: 1.8.11 +Release: 1%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig -Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt Source3: iptables.init Source4: iptables-config Source5: iptables.service @@ -22,30 +22,6 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-nft-helper -Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch -Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch -Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch -Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch -Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch -Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch -Patch007: 0007-man-Do-not-escape-exclamation-marks.patch -Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch -Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch -Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch -Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch -Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch -Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch -Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch -Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch -Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch -Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch -Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch -Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch -Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch -Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch -Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch -Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -440,6 +416,7 @@ fi %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %{_sbindir}/ebtables-translate +%{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -448,6 +425,7 @@ fi %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* +%{_mandir}/man8/arptables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -456,6 +434,9 @@ fi %changelog +* Fri Nov 08 2024 Phil Sutter - 1.8.11-1 +- new version + * Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 6015b94..1f7b750 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 -SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 +SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2 From f8d67dc298024ae283e050e7af6b1afc23f26bed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 18:27:10 +0200 Subject: [PATCH 27/46] Use %sbin_merge_compat macro for brevity --- iptables.spec | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index edea0ae..c94f3d7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,12 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -161,12 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. From e18ea14e5e3c134b44d50e6456f249f6f3ee6860 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:31:44 +0100 Subject: [PATCH 28/46] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c94f3d7..cb9c4e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 1%{?dist} +Release: 2%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -424,6 +424,9 @@ fi %changelog +* Sun Jan 12 2025 Zbigniew JÄ™drzejewski-Szmek - 1.8.11-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Fri Nov 08 2024 Phil Sutter - 1.8.11-1 - new version From 43696a4be35ecb64b596d1db368cb736a91316e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 14 Jan 2025 14:59:44 +0100 Subject: [PATCH 29/46] Keep alternatives symlinks under /usr/sbin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit update-alternatives becomes unhappy when called with paths under /usr/bin and /usr/sbin that are mixed: >>> Non-critical error in post-install scriptlet: iptables-legacy-0:1.8.11-3.fc42.x86_64 >>> Scriptlet output: >>> the primary link for iptables must be /usr/sbin/iptables >>> >>> [RPM] %post(iptables-legacy-1.8.11-3.fc42.x86_64) scriptlet failed, exit status 2 Things will mostly work if we keep using the old path: * On new installs, /usr/sbin will be a symlink, so the /usr/sbin paths will just point to /usr/bin and both sets of paths will work equivalently. * On upgrades, we'll maintain the /usr/sbin paths, which should be fine also, since everything must support using those paths for compatiblity. * The only thing that will not work is the merging of /usr/sbin to ./bin once /usr/sbin only contains symlinks. The scriptlets in filesystem.rpm would need to be adjusted to handle that case (i.e. allow symlinks /usr/sbin/foo → ../bin/foo and /usr/sbin/foo → /etc/alternatives/foo to be removed). This special case can be handled later. --- iptables.spec | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index cb9c4e6..66f245a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 2%{?dist} +Release: 3%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -236,11 +236,17 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +%if "%{_sbindir}" == "%{_bindir}" +# We keep those symlinks in /usr/sbin for compatibility +mkdir -p %{buildroot}/usr/sbin +mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +%endif + %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -252,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables /usr/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -265,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -291,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -301,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=/usr/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -317,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=/usr/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -343,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd /usr/sbin/$cmd-nft done fi @@ -355,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -416,14 +422,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 +- Keep symlinks managed by alternatives under /usr/sbin + * Sun Jan 12 2025 Zbigniew JÄ™drzejewski-Szmek - 1.8.11-2 - Rebuilt for the bin-sbin merge (2nd attempt) From 2533c217e52cbe658e05afb25fc6bc2f912fca59 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 07:22:06 +0000 Subject: [PATCH 30/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 66f245a..b170a43 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 3%{?dist} +Release: 4%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -430,6 +430,9 @@ fi %changelog +* Fri Jan 17 2025 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 - Keep symlinks managed by alternatives under /usr/sbin From c8015c16af9b2260f1fda5ccd6920774fc4d2efc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 26 Mar 2025 14:03:28 -0400 Subject: [PATCH 31/46] Flatpak fix for "Keep alternatives symlinks under /usr/sbin" Even if specific %_*dir macros cannot be used, %_prefix must be used at a minimum to refer to the installation path of files from the given package. This is a requirement for flatpak builds. --- iptables.spec | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/iptables.spec b/iptables.spec index b170a43..f211aa9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,7 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -156,7 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -238,15 +238,15 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %if "%{_sbindir}" == "%{_bindir}" # We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +mkdir -p %{buildroot}%{_prefix}/sbin +mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ %endif %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -258,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -271,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -307,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -323,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -349,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -361,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -422,8 +422,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From a1603c18de94a6d18aa110c640ea27941ca5927c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 2 Apr 2025 15:01:46 +0200 Subject: [PATCH 32/46] Assimilate arptables-services Provide the service as part of iptables-services. The arptables-nft-helper was already quite similar to arptables-legacy-helper, it should serve fine for legacy arptables, too. --- arptables-nft-helper => arptables-helper | 0 arptables.service | 12 +++++++++ iptables.spec | 32 ++++++++++++++---------- 3 files changed, 31 insertions(+), 13 deletions(-) rename arptables-nft-helper => arptables-helper (100%) create mode 100644 arptables.service diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index f211aa9..d195a2c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -20,7 +20,8 @@ Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-nft-helper +Source8: arptables-helper +Source9: arptables.service # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -125,6 +126,10 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} BuildArch: noarch %description services @@ -155,6 +160,9 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 %sbin_merge_compat %{_prefix}/sbin/iptables @@ -188,16 +196,18 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -224,9 +234,6 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 @@ -285,14 +292,14 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post iptables.service ip6tables.service +%systemd_post arptables.service iptables.service ip6tables.service %preun services -%systemd_preun iptables.service ip6tables.service +%systemd_preun arptables.service iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun iptables.service ip6tables.service +%systemd_postun arptables.service iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -343,8 +350,7 @@ update-alternatives --install \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} %postun nft if [ $1 -eq 0 ]; then @@ -390,9 +396,11 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%{_unitdir}/{arp,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/arptables-helper %files utils %license COPYING @@ -415,7 +423,6 @@ fi %{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* @@ -424,7 +431,6 @@ fi %{_mandir}/man8/arptables-translate* %ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From 347e497e7205a827bf52674e20c05d5595c100e0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 02:05:13 +0200 Subject: [PATCH 33/46] Assimilate ebtables-services Provide the service as part of iptables-services. --- ebtables-config | 11 +++++ ebtables-helper | 102 +++++++++++++++++++++++++++++++++++++++++++++++ ebtables.service | 11 +++++ iptables.spec | 28 +++++++++---- 4 files changed, 145 insertions(+), 7 deletions(-) create mode 100644 ebtables-config create mode 100644 ebtables-helper create mode 100644 ebtables.service diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index d195a2c..2144ee0 100644 --- a/iptables.spec +++ b/iptables.spec @@ -22,6 +22,9 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-helper Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -130,6 +133,10 @@ Obsoletes: %{name}-ipv6 < 1.4.11.1 Conflicts: %{name}-nft < 1.8.11-5 Obsoletes: arptables-services < 0.0.5-16 Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -196,7 +203,7 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init -install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config @@ -204,10 +211,12 @@ install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6table install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -292,14 +301,17 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post arptables.service iptables.service ip6tables.service +%systemd_post arptables.service ebtables.service +%systemd_post iptables.service ip6tables.service %preun services -%systemd_preun arptables.service iptables.service ip6tables.service +%systemd_preun arptables.service ebtables.service +%systemd_preun iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun arptables.service iptables.service ip6tables.service +%systemd_postun arptables.service ebtables.service +%systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -397,10 +409,12 @@ fi %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} %config(noreplace) %{_sysconfdir}/sysconfig/arptables -%{_unitdir}/{arp,ip,ip6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} -%{_libexecdir}/arptables-helper +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING From 45128b30b581863eee82c03977fd0d57cd301acc Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:50:18 +0200 Subject: [PATCH 34/46] rpmlint: Fix for E: description-line-too-long --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 2144ee0..ce9a1ee 100644 --- a/iptables.spec +++ b/iptables.spec @@ -93,9 +93,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 From e71883b551ebfba9eb6cd16095612d43ad878547 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:52:40 +0200 Subject: [PATCH 35/46] rpmlint: Fix for W: dangling-relative-symlink The %ghost directives in %files sections pick up the symlinks installed by the iptables build system, when in fact these are maintained in Fedora by alternatives. To avoid the confusion, remove them. To avoid causing 'W: zero-perms-ghost', add a %attr statement to the respective %ghost lines. --- iptables.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/iptables.spec b/iptables.spec index ce9a1ee..5efa959 100644 --- a/iptables.spec +++ b/iptables.spec @@ -247,16 +247,11 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}%{_prefix}/sbin -mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ -%endif - %ldconfig_scriptlets %post legacy @@ -378,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -442,8 +437,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From b2d1af398f3799020bc82f5f71a999ccd9dba432 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 11:43:34 +0200 Subject: [PATCH 36/46] spec: Merge common non-symlink removal loops --- iptables.spec | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5efa959..c8927c8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -310,6 +310,23 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_prefix}/sbin/iptables pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ @@ -322,14 +339,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ @@ -338,18 +347,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ From ac4331ac14f14b40c09d5009ca958697c7b8d1a0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 13:15:57 +0200 Subject: [PATCH 37/46] iptables-1.8.11-5 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c8927c8..93641a9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 4%{?dist} +Release: 5%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -441,6 +441,9 @@ fi %changelog +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From b56d83fa63cfe3b2db4f9d3f2e367b17cec36d23 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 20 Apr 2025 09:15:04 -0700 Subject: [PATCH 38/46] Add patch to fix -C handling ( fixes rhbz#2360423 ) --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ++++++++++++++++++ iptables.spec | 8 +- 2 files changed, 179 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 93641a9..177c6fd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 5%{?dist} +Release: 6%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -25,6 +25,9 @@ Source9: arptables.service Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch: iptables-1.8.11-fix-interface-comparisons.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -441,6 +444,9 @@ fi %changelog +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + * Thu Apr 03 2025 Phil Sutter - 1.8.11-5 - iptables-services to assimilate arptables- and ebtables-services From 046b2467b46a166204cecce9a6adc5ccfbd09031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 12 Mar 2025 16:06:49 +0100 Subject: [PATCH 39/46] Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit 43696a4be35ecb64b596d1db368cb736a91316e8 and also the follow-up work from c8015c16af9b2260f1fda5ccd6920774fc4d2efc. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected. Issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2361004. --- iptables.spec | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/iptables.spec b/iptables.spec index 177c6fd..bc9f667 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 6%{?dist} +Release: 7%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -271,7 +272,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -315,7 +316,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_prefix}/sbin/{eb,arp}tables; do +for pfx in %{_sbindir}/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -330,8 +331,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +341,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +349,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -361,7 +362,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +374,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +438,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + * Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 - Add patch to fix -C handling ( fixes rhbz#2360423 ) From 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Sat, 3 May 2025 23:22:49 +0200 Subject: [PATCH 40/46] Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit 046b2467b46a166204cecce9a6adc5ccfbd09031. These changes break systems, see bz#2362648 and bz#2362808 for details. --- iptables.spec | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/iptables.spec b/iptables.spec index bc9f667..fac1bbf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 7%{?dist} +Release: 8%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,7 +64,6 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -259,8 +258,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -272,7 +271,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -285,8 +284,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -316,7 +315,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_sbindir}/{eb,arp}tables; do +for pfx in %{_prefix}/sbin/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -331,8 +330,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -341,7 +340,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -349,7 +348,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -362,7 +361,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -374,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -438,13 +437,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + * Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 - Keep symlinks managed by alternatives under /usr/bin From 90a211ef7302c29a98a674de8afb3f6c7a0ab3ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 7 May 2025 16:30:51 +0200 Subject: [PATCH 41/46] Move iptables symlinks to /usr/bin again This partially reverts commit 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems. --- iptables.spec | 60 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index fac1bbf..edcea9a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 8%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -268,10 +269,19 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +294,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,6 +307,15 @@ alternatives --set iptables $(/dev/null || : +done +%endif + %post services %systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service @@ -330,8 +349,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +359,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +367,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -358,10 +377,19 @@ update-alternatives --install \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +401,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +465,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + * Sat May 03 2025 Phil Sutter - 1.8.11-8 - Revert last release, it breaks alternatives symlinks From 6f0696f58a45a6c3265c6d9837e06da2ffce5270 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 13 May 2025 10:55:45 +0200 Subject: [PATCH 42/46] Use modern option name for "follower" symlinks --- iptables.spec | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/iptables.spec b/iptables.spec index edcea9a..b5d83c1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -263,11 +263,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -298,11 +298,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $( Date: Tue, 20 May 2025 23:54:42 +0200 Subject: [PATCH 43/46] Fix for ghost files not present in iptables-nft RPM When fixing for rpmlint warnings, the standard symlinks installed by package's 'make install' were removed but they are in fact necessary for the globbing in %files section to happen. Replace them by empty files after removal to fix this. Fixes: e71883b551ebfba9eb6cd16095612d43ad878547 --- iptables.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index b5d83c1..c7216fb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -251,7 +251,8 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml From cc26decabc00149c006f76fc10450ce15d707077 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 20 May 2025 23:59:29 +0200 Subject: [PATCH 44/46] iptables-1.8.11-10 - Fix for ghost files not present in iptables-nft RPM Resolves: rhbz#2365424 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c7216fb..cdf4f66 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 9%{?dist} +Release: 10%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + * Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged. From 8ce4421d204c44131cbdc96465cafcb1f5f71288 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:46:02 +0000 Subject: [PATCH 45/46] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index cdf4f66..837bf0a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Phil Sutter - 1.8.11-10 - Fix for ghost files not present in iptables-nft RPM From 6a017827bbf2ff7454a8f3f45937124175c05e43 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Oct 2025 11:21:29 -0400 Subject: [PATCH 46/46] - Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. --- iptables-1.8.11-command-options-fix.patch | 27 +++++++++++++++++++++++ iptables.spec | 10 +++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 iptables-1.8.11-command-options-fix.patch diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables.spec b/iptables.spec index 837bf0a..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -27,7 +27,10 @@ Source11: ebtables-helper Source12: ebtables-config # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch: iptables-1.8.11-fix-interface-comparisons.patch +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -473,6 +476,9 @@ fi %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + * Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild