From 86e31320cc4dfc61cfcdb2e0638e21e741c87ddd Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 9 Jul 2018 16:14:24 +0200 Subject: [PATCH 001/100] iptables-1.8.0-1 - New upstream version 1.8.0. - Replace ldconfig calls with newly introduced macros. - Rename compat subpackage to iptables-nft to clarify its purpose. - Make use of Alternatives system. --- iptables.spec | 126 +++++++++++++++++++++++++++++++++++++------------- 1 file changed, 95 insertions(+), 31 deletions(-) diff --git a/iptables.spec b/iptables.spec index 80bbdf5..812764e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -6,8 +6,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities -Version: 1.6.2 -Release: 3%{?dist} +Version: 1.8.0 +Release: 1%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -41,6 +41,8 @@ Requires: %{name}-libs%{?_isa} = %{version}-%{release} %if 0%{?fedora} > 24 Conflicts: setup < 2.10.4-1 %endif +Requires(post): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives %description The iptables utility controls the network packet filtering code in the @@ -101,12 +103,13 @@ Utils for iptables. Currently only provides nfnl_osf with the pf.os database. -%package compat +%package nft Summary: nftables compatibility for iptables, arptables and ebtables Group: System Environment/Base Requires: %{name} = %{version}-%{release} +Obsoletes: iptables-compat < 1.6.2-4 -%description compat +%description nft nftables compatibility for iptables, arptables and ebtables. %prep @@ -186,20 +189,33 @@ install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/ rm -f %{buildroot}%{_sysconfdir}/ethertypes %endif -%if 0%{?rhel} -%pre -for p in %{_sysconfdir}/alternatives/{iptables,ip6tables}.*; do - if [ -h "$p" ]; then - ipt=$(readlink "$p") - echo "Removing alternatives for ${p##*/} with path $ipt" - %{_sbindir}/alternatives --remove "${p##*/}" "$ipt" - fi -done -%endif +# rename ebtables and arptables to avoid conflicts +mv %{buildroot}%{_sbindir}/ebtables %{buildroot}%{_sbindir}/ebtables-nft +mv %{buildroot}%{_sbindir}/arptables %{buildroot}%{_sbindir}/arptables-nft -%post -p /sbin/ldconfig +touch %{buildroot}%{_sbindir}/ebtables +touch %{buildroot}%{_sbindir}/arptables +touch %{buildroot}%{_sbindir}/iptables +touch %{buildroot}%{_sbindir}/ip6tables -%postun -p /sbin/ldconfig +%ldconfig_scriptlets + +%post +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables +%{_sbindir}/update-alternatives --install \ + $pfx iptables $pfx-legacy 10 \ + --slave $pfx6 ip6tables $pfx6-legacy \ + --slave $pfx-restore iptables-restore $pfx-legacy-restore \ + --slave $pfx-save iptables-save $pfx-legacy-save \ + --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --slave $pfx6-save ip6tables-save $pfx6-legacy-save + +%postun +if [ $1 -eq 0 ]; then + %{_sbindir}/update-alternatives --remove \ + iptables %{_sbindir}/iptables-legacy +fi %post services %systemd_post iptables.service ip6tables.service @@ -208,9 +224,36 @@ done %systemd_preun iptables.service ip6tables.service %postun services -/sbin/ldconfig +%?ldconfig %systemd_postun iptables.service ip6tables.service +%post nft +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables +%{_sbindir}/update-alternatives --install \ + $pfx iptables $pfx-nft 5 \ + --slave $pfx6 ip6tables $pfx6-nft \ + --slave $pfx-restore iptables-restore $pfx-nft-restore \ + --slave $pfx-save iptables-save $pfx-nft-save \ + --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ + --slave $pfx6-save ip6tables-save $pfx6-nft-save + +for cmd in ebtables arptables; do + if [ "$(readlink -e %{_sbindir}/$cmd)" == %{_sbindir}/$cmd ]; then + rm -f %{_sbindir}/$cmd + fi + %{_sbindir}/update-alternatives --install \ + %{_sbindir}/$cmd $cmd %{_sbindir}/$cmd-nft 5 +done + +%postun nft +if [ $1 -eq 0 ]; then + for cmd in iptables ebtables arptables; do + %{_sbindir}/update-alternatives --remove \ + $cmd %{_sbindir}/$cmd-nft + done +fi + %files %{!?_licensedir:%global license %%doc} %license COPYING @@ -220,26 +263,28 @@ done %if 0%{?fedora} <= 24 %{_sysconfdir}/ethertypes %endif -%{_sbindir}/iptables %{_sbindir}/iptables-apply -%{_sbindir}/iptables-restore -%{_sbindir}/iptables-save -%{_sbindir}/ip6tables -%{_sbindir}/ip6tables-restore -%{_sbindir}/ip6tables-save -%{_sbindir}/xtables-multi -%{_sbindir}/nfbpf_compile +%{_sbindir}/iptables-legacy* +%{_sbindir}/ip6tables-legacy* +%{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/iptables* %{_mandir}/man8/ip6tables* %{_mandir}/man8/nfnl_osf* +%{_mandir}/man8/xtables-legacy* %dir %{_libdir}/xtables %{_libdir}/xtables/libarpt* %{_libdir}/xtables/libebt* %{_libdir}/xtables/libipt* %{_libdir}/xtables/libip6t* %{_libdir}/xtables/libxt* +%ghost %{_sbindir}/iptables +%ghost %{_sbindir}/iptables-restore +%ghost %{_sbindir}/iptables-save +%ghost %{_sbindir}/ip6tables +%ghost %{_sbindir}/ip6tables-restore +%ghost %{_sbindir}/ip6tables-save %files libs %{_libdir}/libip*tc.so.* @@ -277,21 +322,40 @@ done %files utils %{_sbindir}/nfnl_osf +%{_sbindir}/nfbpf_compile %dir %{_datadir}/xtables %{_datadir}/xtables/pf.os -%files compat -%{_sbindir}/iptables-compat* +%files nft +%{_sbindir}/iptables-nft* %{_sbindir}/iptables-restore-translate %{_sbindir}/iptables-translate -%{_sbindir}/ip6tables-compat* +%{_sbindir}/ip6tables-nft* %{_sbindir}/ip6tables-restore-translate %{_sbindir}/ip6tables-translate -%{_sbindir}/ebtables-compat* -%{_sbindir}/arptables-compat -%{_sbindir}/xtables-compat-multi +%{_sbindir}/ebtables-nft +%{_sbindir}/arptables-nft +%{_sbindir}/xtables-nft-multi +%{_sbindir}/xtables-monitor +%{_mandir}/man8/xtables-monitor* +%{_mandir}/man8/xtables-nft* +%{_mandir}/man8/xtables-translate* +%ghost %{_sbindir}/iptables +%ghost %{_sbindir}/iptables-restore +%ghost %{_sbindir}/iptables-save +%ghost %{_sbindir}/ip6tables +%ghost %{_sbindir}/ip6tables-restore +%ghost %{_sbindir}/ip6tables-save +%ghost %{_sbindir}/ebtables +%ghost %{_sbindir}/arptables %changelog +* Mon Jul 09 2018 Phil Sutter - 1.8.0-1 +- New upstream version 1.8.0. +- Replace ldconfig calls with newly introduced macros. +- Rename compat subpackage to iptables-nft to clarify its purpose. +- Make use of Alternatives system. + * Fri May 04 2018 Phil Sutter - 1.6.2-3 - Fix License: tag in spec-file - Fix separation into compat subpackage From dc75e7cdb9013bba80bb6c58b414d416c666e2e1 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Jul 2018 16:37:45 +0200 Subject: [PATCH 002/100] Update sources for new version --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 439733e..202af89 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /iptables-1.6.2.tar.bz2 +/iptables-1.8.0.tar.bz2 diff --git a/sources b/sources index d6f5bba..10e8a70 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.6.2.tar.bz2) = 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0 +SHA512 (iptables-1.8.0.tar.bz2) = 5f3fe4c15f02e29a2e6ee2905a242f450f8a3b51553618e0cdc59301c35b8bb663e8f2ea70dfcaed8d4e53192c01519906b60ff649385c693e0602622742890f From a52c75665f52ac400b69ecfaf4386af6134b5baf Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Jul 2018 18:48:49 +0200 Subject: [PATCH 003/100] iptables-1.8.0-2 - Fix calling ebtables-nft and arptables-nft via their new names. --- iptables-1.8.0-xtables-nft-multi.patch | 15 +++++++++++++++ iptables.spec | 7 ++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.0-xtables-nft-multi.patch diff --git a/iptables-1.8.0-xtables-nft-multi.patch b/iptables-1.8.0-xtables-nft-multi.patch new file mode 100644 index 0000000..f1f5ab8 --- /dev/null +++ b/iptables-1.8.0-xtables-nft-multi.patch @@ -0,0 +1,15 @@ +diff --git a/iptables/xtables-nft-multi.c b/iptables/xtables-nft-multi.c +index 187da81e9f59b..03690a56edb72 100644 +--- a/iptables/xtables-nft-multi.c ++++ b/iptables/xtables-nft-multi.c +@@ -31,8 +31,10 @@ static const struct subcommand multi_subcommands[] = { + {"iptables-restore-translate", xtables_ip4_xlate_restore_main}, + {"ip6tables-restore-translate", xtables_ip6_xlate_restore_main}, + {"arptables", xtables_arp_main}, ++ {"arptables-nft", xtables_arp_main}, + {"ebtables-translate", xtables_eb_xlate_main}, + {"ebtables", xtables_eb_main}, ++ {"ebtables-nft", xtables_eb_main}, + {"xtables-monitor", xtables_monitor_main}, + {NULL}, + }; diff --git a/iptables.spec b/iptables.spec index 812764e..0ee7aa3 100644 --- a/iptables.spec +++ b/iptables.spec @@ -7,7 +7,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities Version: 1.8.0 -Release: 1%{?dist} +Release: 2%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -15,6 +15,7 @@ Source3: iptables.service Source4: sysconfig_iptables Source5: sysconfig_ip6tables Patch1: iptables-1.6.0-iptables-apply_mktemp.patch +Patch2: iptables-1.8.0-xtables-nft-multi.patch URL: http://www.netfilter.org/ # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -115,6 +116,7 @@ nftables compatibility for iptables, arptables and ebtables. %prep %setup -q %patch1 -p1 -b .iptables-apply_mktemp +%patch2 -p1 -b .iptables-xtables_nft_multi %build CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ @@ -350,6 +352,9 @@ fi %ghost %{_sbindir}/arptables %changelog +* Tue Jul 10 2018 Phil Sutter - 1.8.0-2 +- Fix calling ebtables-nft and arptables-nft via their new names. + * Mon Jul 09 2018 Phil Sutter - 1.8.0-1 - New upstream version 1.8.0. - Replace ldconfig calls with newly introduced macros. From fc1d0e4b43c101c8ed3ad691179cbf7999f8e3e7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 13 Jul 2018 05:48:59 +0000 Subject: [PATCH 004/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 0ee7aa3..e954efa 100644 --- a/iptables.spec +++ b/iptables.spec @@ -7,7 +7,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities Version: 1.8.0 -Release: 2%{?dist} +Release: 3%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -352,6 +352,9 @@ fi %ghost %{_sbindir}/arptables %changelog +* Fri Jul 13 2018 Fedora Release Engineering - 1.8.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Tue Jul 10 2018 Phil Sutter - 1.8.0-2 - Fix calling ebtables-nft and arptables-nft via their new names. From 3ee5faca7ef4469c39ef37d71849d9aa98397b94 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Sun, 14 Oct 2018 18:42:59 +0100 Subject: [PATCH 005/100] drop groups --- iptables.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/iptables.spec b/iptables.spec index e954efa..ae6ee08 100644 --- a/iptables.spec +++ b/iptables.spec @@ -52,7 +52,6 @@ you should install this package. %package libs Summary: iptables libraries -Group: System Environment/Base %description libs iptables libraries. @@ -66,7 +65,6 @@ For more information about this, please have a look at %package devel Summary: Development package for iptables -Group: System Environment/Base Requires: %{name}%{?_isa} = %{version}-%{release} Requires: pkgconfig @@ -78,7 +76,6 @@ stable and may change with every new version. It is therefore unsupported. %package services Summary: iptables and ip6tables services for iptables -Group: System Environment/Base Requires: %{name} = %{version}-%{release} Requires(post): systemd Requires(preun): systemd @@ -96,7 +93,6 @@ out of the base package since they are not active by default anymore. %package utils Summary: iptables and ip6tables services for iptables -Group: System Environment/Base Requires: %{name} = %{version}-%{release} %description utils @@ -106,7 +102,6 @@ Currently only provides nfnl_osf with the pf.os database. %package nft Summary: nftables compatibility for iptables, arptables and ebtables -Group: System Environment/Base Requires: %{name} = %{version}-%{release} Obsoletes: iptables-compat < 1.6.2-4 From abf89772b169b7e6e61f11f803e530bc872ffc43 Mon Sep 17 00:00:00 2001 From: Bogdan Dobrelya Date: Wed, 23 Jan 2019 11:31:38 +0100 Subject: [PATCH 006/100] Optimize systemd dependency for containers According to https://fedoraproject.org/wiki/Packaging:Scriptlets: If a package is suitable for installation without systemd (in a container image, for example) and does not require any of the systemd mechanisms such as tmpfiles.d, then the systemd_ordering macro MAY be used instead of the systemd_requires macro. That is exactly the case we want to address for container images when installing packages in it. Resolves: rhbz#1668678 Related-Bug: #1804822 Signed-off-by: Bogdan Dobrelya --- iptables.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/iptables.spec b/iptables.spec index ae6ee08..d68e2fe 100644 --- a/iptables.spec +++ b/iptables.spec @@ -7,7 +7,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities Version: 1.8.0 -Release: 3%{?dist} +Release: 4%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -77,9 +77,7 @@ stable and may change with every new version. It is therefore unsupported. %package services Summary: iptables and ip6tables services for iptables Requires: %{name} = %{version}-%{release} -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd +%{?systemd_ordering} # obsolete old main package Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package @@ -347,6 +345,9 @@ fi %ghost %{_sbindir}/arptables %changelog +* Wed Jan 23 2019 Bogdan Dobrelya - 1.8.0-4 +- Use systemd_ordering macro + * Fri Jul 13 2018 Fedora Release Engineering - 1.8.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From ce8383a58db9f28a35f66a8571b678ae2836f673 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 1 Feb 2019 03:30:33 +0000 Subject: [PATCH 007/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d68e2fe..f1a077c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -7,7 +7,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities Version: 1.8.0 -Release: 4%{?dist} +Release: 5%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -345,6 +345,9 @@ fi %ghost %{_sbindir}/arptables %changelog +* Fri Feb 01 2019 Fedora Release Engineering - 1.8.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Wed Jan 23 2019 Bogdan Dobrelya - 1.8.0-4 - Use systemd_ordering macro From 51c612a0d8298229fa35fb6b1ea272ee446b1032 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 15 Apr 2019 18:18:25 +0200 Subject: [PATCH 008/100] iptables-1.8.2-1 - New upstream version 1.8.2 - Integrate ebtables and arptables save/restore scripts with alternatives - Add nft-specific ebtables and arptables man pages - Move /etc/sysconfig/ip*tables-config files into services sub-package --- ...apply-Use-mktemp-instead-of-tempfile.patch | 35 + ...mat-security-fixes-in-libip-6-t_icmp.patch | 60 + 0003-doc-Add-arptables-nft-man-pages.patch | 486 +++++++ 0004-doc-Adjust-arptables-man-pages.patch | 192 +++ 0005-doc-Add-ebtables-man-page.patch | 1186 +++++++++++++++++ 0006-doc-Adjust-ebtables-man-page.patch | 275 ++++ arptables-nft-helper | 68 + iptables-1.6.0-iptables-apply_mktemp.patch | 21 - iptables-1.8.0-xtables-nft-multi.patch | 15 - iptables.spec | 105 +- 10 files changed, 2383 insertions(+), 60 deletions(-) create mode 100644 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch create mode 100644 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch create mode 100644 0003-doc-Add-arptables-nft-man-pages.patch create mode 100644 0004-doc-Adjust-arptables-man-pages.patch create mode 100644 0005-doc-Add-ebtables-man-page.patch create mode 100644 0006-doc-Adjust-ebtables-man-page.patch create mode 100644 arptables-nft-helper delete mode 100644 iptables-1.6.0-iptables-apply_mktemp.patch delete mode 100644 iptables-1.8.0-xtables-nft-multi.patch diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch new file mode 100644 index 0000000..b6e1712 --- /dev/null +++ b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch @@ -0,0 +1,35 @@ +From 1dba0d0a2c9c269dc5ed9e7d841b8ecb9dc060af Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 12 Apr 2019 18:02:19 +0200 +Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile + +Signed-off-by: Phil Sutter +--- + iptables/iptables-apply | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-apply b/iptables/iptables-apply +index 819ca4a459c42..a685b6bbcd7dc 100755 +--- a/iptables/iptables-apply ++++ b/iptables/iptables-apply +@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then + exit 2 + fi + +-COMMANDS=(tempfile "$SAVE" "$RESTORE") ++COMMANDS=(mktemp "$SAVE" "$RESTORE") + + for cmd in "${COMMANDS[@]}"; do + if ! command -v $cmd >/dev/null; then +@@ -122,7 +122,7 @@ done + + umask 0700 + +-TMPFILE=$(tempfile -p iptap) ++TMPFILE=$(mktemp) + trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \ + FPE USR1 SEGV USR2 PIPE ALRM TERM + +-- +2.21.0 + diff --git a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch b/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch new file mode 100644 index 0000000..1bdbbd1 --- /dev/null +++ b/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch @@ -0,0 +1,60 @@ +From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= +Date: Wed, 14 Nov 2018 07:35:28 +0100 +Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") +introduced support for gcc feature to check format string against passed +argument. This commit adds missing bits to extenstions's libipt_icmp.c +and libip6t_icmp6.c that were causing build to fail. + +Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") +Signed-off-by: Adam Gołębiowski +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Phil Sutter +--- + extensions/libip6t_icmp6.c | 4 ++-- + extensions/libipt_icmp.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c +index 45a71875722c4..cc7bfaeb72fd7 100644 +--- a/extensions/libip6t_icmp6.c ++++ b/extensions/libip6t_icmp6.c +@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + type_name = icmp6_type_xlate(icmptype); + + if (type_name) { +- xt_xlate_add(xl, type_name); ++ xt_xlate_add(xl, "%s", type_name); + } else { + for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) + if (icmpv6_codes[i].type == icmptype && +@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + break; + + if (i != ARRAY_SIZE(icmpv6_codes)) +- xt_xlate_add(xl, icmpv6_codes[i].name); ++ xt_xlate_add(xl, "%s", icmpv6_codes[i].name); + else + return 0; + } +diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c +index 5418997668d4c..e76257c54708c 100644 +--- a/extensions/libipt_icmp.c ++++ b/extensions/libipt_icmp.c +@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, + if (icmp_codes[i].type == icmptype && + icmp_codes[i].code_min == code_min && + icmp_codes[i].code_max == code_max) { +- xt_xlate_add(xl, icmp_codes[i].name); ++ xt_xlate_add(xl, "%s", icmp_codes[i].name); + return 1; + } + } +-- +2.21.0 + diff --git a/0003-doc-Add-arptables-nft-man-pages.patch b/0003-doc-Add-arptables-nft-man-pages.patch new file mode 100644 index 0000000..b4bae67 --- /dev/null +++ b/0003-doc-Add-arptables-nft-man-pages.patch @@ -0,0 +1,486 @@ +From 1d0089550ab9882ac90d0fc673f213c51e133552 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 13 Mar 2019 20:46:12 +0100 +Subject: [PATCH] doc: Add arptables-nft man pages + +These are 1:1 copies from legacy arptables repository. + +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +(cherry picked from commit 4dbb6b9118e32a9b748ead893106de59579424f5) +Signed-off-by: Phil Sutter +--- + iptables/Makefile.am | 3 + + iptables/arptables-nft-restore.8 | 41 ++++ + iptables/arptables-nft-save.8 | 37 ++++ + iptables/arptables-nft.8 | 352 +++++++++++++++++++++++++++++++ + 4 files changed, 433 insertions(+) + create mode 100644 iptables/arptables-nft-restore.8 + create mode 100644 iptables/arptables-nft-save.8 + create mode 100644 iptables/arptables-nft.8 + +diff --git a/iptables/Makefile.am b/iptables/Makefile.am +index 581dc32ba846b..52309679d390c 100644 +--- a/iptables/Makefile.am ++++ b/iptables/Makefile.am +@@ -63,6 +63,9 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ + ip6tables-save.8 iptables-extensions.8 \ + xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ + xtables-monitor.8 ++if ENABLE_NFTABLES ++man_MANS += arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 ++endif + CLEANFILES = iptables.8 xtables-monitor.8 \ + xtables-config-parser.c xtables-config-syntax.c + +diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8 +new file mode 100644 +index 0000000000000..4f2f623673415 +--- /dev/null ++++ b/iptables/arptables-nft-restore.8 +@@ -0,0 +1,41 @@ ++.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" "" ++.\" ++.\" Man page written by Jesper Dangaard Brouer based on a ++.\" Man page written by Harald Welte ++.\" It is based on the iptables-restore man page. ++.\" ++.\" This program is free software; you can redistribute it and/or modify ++.\" it under the terms of the GNU General Public License as published by ++.\" the Free Software Foundation; either version 2 of the License, or ++.\" (at your option) any later version. ++.\" ++.\" This program is distributed in the hope that it will be useful, ++.\" but WITHOUT ANY WARRANTY; without even the implied warranty of ++.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++.\" GNU General Public License for more details. ++.\" ++.\" You should have received a copy of the GNU General Public License ++.\" along with this program; if not, write to the Free Software ++.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++.\" ++.\" ++.SH NAME ++arptables-restore \(em Restore ARP Tables ++.SH SYNOPSIS ++\fBarptables\-restore ++.SH DESCRIPTION ++.PP ++.B arptables-restore ++is used to restore ARP Tables from data specified on STDIN or ++via a file as first argument. ++Use I/O redirection provided by your shell to read from a file ++.TP ++.B arptables-restore ++flushes (deletes) all previous contents of the respective ARP Table. ++.SH BUGS ++None known as of arptables-0.0.4 release ++.SH AUTHOR ++Jesper Dangaard Brouer ++.SH SEE ALSO ++\fBarptables\-save\fP(8), \fBarptables\fP(8) ++.PP +diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8 +new file mode 100644 +index 0000000000000..34791a9c087f0 +--- /dev/null ++++ b/iptables/arptables-nft-save.8 +@@ -0,0 +1,37 @@ ++.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" "" ++.\" ++.\" Man page written by Jesper Dangaard Brouer based on a ++.\" Man page written by Harald Welte ++.\" It is based on the iptables-save man page. ++.\" ++.\" This program is free software; you can redistribute it and/or modify ++.\" it under the terms of the GNU General Public License as published by ++.\" the Free Software Foundation; either version 2 of the License, or ++.\" (at your option) any later version. ++.\" ++.\" This program is distributed in the hope that it will be useful, ++.\" but WITHOUT ANY WARRANTY; without even the implied warranty of ++.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++.\" GNU General Public License for more details. ++.\" ++.\" You should have received a copy of the GNU General Public License ++.\" along with this program; if not, write to the Free Software ++.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++.\" ++.\" ++.SH NAME ++arptables-save \(em dump arptables rules to stdout ++.SH SYNOPSIS ++\fBarptables\-save ++.SH DESCRIPTION ++.PP ++.B arptables-save ++is used to dump the contents of an ARP Table in easily parseable format ++to STDOUT. Use I/O-redirection provided by your shell to write to a file. ++.SH BUGS ++None known as of arptables-0.0.4 release ++.SH AUTHOR ++Jesper Dangaard Brouer ++.SH SEE ALSO ++\fBarptables\-restore\fP(8), \fBarptables\fP(8) ++.PP +diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8 +new file mode 100644 +index 0000000000000..3ce99e3757004 +--- /dev/null ++++ b/iptables/arptables-nft.8 +@@ -0,0 +1,352 @@ ++.TH ARPTABLES 8 "June 2018" ++.\" ++.\" Man page originally written by Jochen Friedrich , ++.\" maintained by Bart De Schuymer. ++.\" It is based on the iptables man page. ++.\" ++.\" Iptables page by Herve Eychenne March 2000. ++.\" ++.\" This program is free software; you can redistribute it and/or modify ++.\" it under the terms of the GNU General Public License as published by ++.\" the Free Software Foundation; either version 2 of the License, or ++.\" (at your option) any later version. ++.\" ++.\" This program is distributed in the hope that it will be useful, ++.\" but WITHOUT ANY WARRANTY; without even the implied warranty of ++.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++.\" GNU General Public License for more details. ++.\" ++.\" You should have received a copy of the GNU General Public License ++.\" along with this program; if not, write to the Free Software ++.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++.\" ++.\" ++.SH NAME ++arptables \- ARP table administration (legacy) ++.SH SYNOPSIS ++.BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ] ++.br ++.BR "arptables " [ "-t table" ] " -" [ RI ] " chain rulenum rule-specification " [ options ] ++.br ++.BR "arptables " [ "-t table" ] " -D chain rulenum " [ options ] ++.br ++.BR "arptables " [ "-t table" ] " -" [ "LFZ" ] " " [ chain ] " " [ options ] ++.br ++.BR "arptables " [ "-t table" ] " -" [ "NX" ] " chain" ++.br ++.BR "arptables " [ "-t table" ] " -E old-chain-name new-chain-name" ++.br ++.BR "arptables " [ "-t table" ] " -P chain target " [ options ] ++ ++.SH LEGACY ++This tool uses the old xtables/setsockopt framework, and is a legacy version ++of arptables. That means that a new, more modern tool exists with the same ++functionality using the nf_tables framework and you are encouraged to migrate now. ++The new binaries (formerly known as -compat) uses the same syntax and ++semantics than this legacy one. ++ ++You can still use this legacy tool. You should probably get some specific ++information from your Linux distribution or vendor. ++More docs are available at https://wiki.nftables.org ++ ++.SH DESCRIPTION ++.B arptables ++is a user space tool, it is used to set up and maintain the ++tables of ARP rules in the Linux kernel. These rules inspect ++the ARP frames which they see. ++.B arptables ++is analogous to the ++.B iptables ++user space tool, but ++.B arptables ++is less complicated. ++ ++.SS CHAINS ++The kernel table is used to divide functionality into ++different sets of rules. Each set of rules is called a chain. ++Each chain is an ordered list of rules that can match ARP frames. If a ++rule matches an ARP frame, then a processing specification tells ++what to do with that matching frame. The processing specification is ++called a 'target'. However, if the frame does not match the current ++rule in the chain, then the next rule in the chain is examined and so forth. ++The user can create new (user-defined) chains which can be used as the 'target' of a rule. ++ ++.SS TARGETS ++A firewall rule specifies criteria for an ARP frame and a frame ++processing specification called a target. When a frame matches a rule, ++then the next action performed by the kernel is specified by the target. ++The target can be one of these values: ++.IR ACCEPT , ++.IR DROP , ++.IR CONTINUE , ++.IR RETURN , ++an 'extension' (see below) or a user-defined chain. ++.PP ++.I ACCEPT ++means to let the frame through. ++.I DROP ++means the frame has to be dropped. ++.I CONTINUE ++means the next rule has to be checked. This can be handy to know how many ++frames pass a certain point in the chain or to log those frames. ++.I RETURN ++means stop traversing this chain and resume at the next rule in the ++previous (calling) chain. ++For the extension targets please see the ++.B "TARGET EXTENSIONS" ++section of this man page. ++.SS TABLES ++There is only one ARP table in the Linux ++kernel. The table is ++.BR filter. ++You can drop the '-t filter' argument to the arptables command. ++The -t argument must be the ++first argument on the arptables command line, if used. ++.TP ++.B "-t, --table" ++.br ++.BR filter , ++is the only table and contains two (Linux kernels 2.4.X) or three (Linux kernels 2.6.0 and later) built-in chains: ++.B INPUT ++(for frames destined for the host), ++.B OUTPUT ++(for locally-generated frames) and ++.B FORWARD ++(for frames being forwarded by the bridge code). The ++.B FORWARD ++chain doesn't exist in Linux 2.4.X kernels. ++.br ++.br ++.SH ARPTABLES COMMAND LINE ARGUMENTS ++After the initial arptables command line argument, the remaining ++arguments can be divided into several different groups. These groups ++are commands, miscellaneous commands, rule-specifications, match-extensions, ++and watcher-extensions. ++.SS COMMANDS ++The arptables command arguments specify the actions to perform on the table ++defined with the -t argument. If you do not use the -t argument to name ++a table, the commands apply to the default filter table. ++With the exception of the ++.B "-Z" ++command, only one command may be used on the command line at a time. ++.TP ++.B "-A, --append" ++Append a rule to the end of the selected chain. ++.TP ++.B "-D, --delete" ++Delete the specified rule from the selected chain. There are two ways to ++use this command. The first is by specifying an interval of rule numbers ++to delete, syntax: start_nr[:end_nr]. Using negative numbers is allowed, for more ++details about using negative numbers, see the -I command. The second usage is by ++specifying the complete rule as it would have been specified when it was added. ++.TP ++.B "-I, --insert" ++Insert the specified rule into the selected chain at the specified rule number. ++If the current number of rules equals N, then the specified number can be ++between -N and N+1. For a positive number i, it holds that i and i-N-1 specify the ++same place in the chain where the rule should be inserted. The number 0 specifies ++the place past the last rule in the chain and using this number is therefore ++equivalent with using the -A command. ++.TP ++.B "-R, --replace" ++Replaces the specified rule into the selected chain at the specified rule number. ++If the current number of rules equals N, then the specified number can be ++between 1 and N. i specifies the place in the chain where the rule should be replaced. ++.TP ++.B "-P, --policy" ++Set the policy for the chain to the given target. The policy can be ++.BR ACCEPT ", " DROP " or " RETURN . ++.TP ++.B "-F, --flush" ++Flush the selected chain. If no chain is selected, then every chain will be ++flushed. Flushing the chain does not change the policy of the ++chain, however. ++.TP ++.B "-Z, --zero" ++Set the counters of the selected chain to zero. If no chain is selected, all the counters ++are set to zero. The ++.B "-Z" ++command can be used in conjunction with the ++.B "-L" ++command. ++When both the ++.B "-Z" ++and ++.B "-L" ++commands are used together in this way, the rule counters are printed on the screen ++before they are set to zero. ++.TP ++.B "-L, --list" ++List all rules in the selected chain. If no chain is selected, all chains ++are listed. ++.TP ++.B "-N, --new-chain" ++Create a new user-defined chain with the given name. The number of ++user-defined chains is unlimited. A user-defined chain name has maximum ++length of 31 characters. ++.TP ++.B "-X, --delete-chain" ++Delete the specified user-defined chain. There must be no remaining references ++to the specified chain, otherwise ++.B arptables ++will refuse to delete it. If no chain is specified, all user-defined ++chains that aren't referenced will be removed. ++.TP ++.B "-E, --rename-chain" ++Rename the specified chain to a new name. Besides renaming a user-defined ++chain, you may rename a standard chain name to a name that suits your ++taste. For example, if you like PREBRIDGING more than PREROUTING, ++then you can use the -E command to rename the PREROUTING chain. If you do ++rename one of the standard ++.B arptables ++chain names, please be sure to mention ++this fact should you post a question on the ++.B arptables ++mailing lists. ++It would be wise to use the standard name in your post. Renaming a standard ++.B arptables ++chain in this fashion has no effect on the structure or function ++of the ++.B arptables ++kernel table. ++ ++.SS MISCELLANOUS COMMANDS ++.TP ++.B "-V, --version" ++Show the version of the arptables userspace program. ++.TP ++.B "-h, --help" ++Give a brief description of the command syntax. ++.TP ++.BR "-j, --jump " "\fItarget\fP" ++The target of the rule. This is one of the following values: ++.BR ACCEPT , ++.BR DROP , ++.BR CONTINUE , ++.BR RETURN , ++a target extension (see ++.BR "TARGET EXTENSIONS" ")" ++or a user-defined chain name. ++.TP ++.BI "-c, --set-counters " "PKTS BYTES" ++This enables the administrator to initialize the packet and byte ++counters of a rule (during ++.B INSERT, ++.B APPEND, ++.B REPLACE ++operations). ++ ++.SS RULE-SPECIFICATIONS ++The following command line arguments make up a rule specification (as used ++in the add and delete commands). A "!" option before the specification ++inverts the test for that specification. Apart from these standard rule ++specifications there are some other command line arguments of interest. ++.TP ++.BR "-s, --source-ip " "[!] \fIaddress\fP[/\fImask]\fP" ++The Source IP specification. ++.TP ++.BR "-d, --destination-ip " "[!] \fIaddress\fP[/\fImask]\fP" ++The Destination IP specification. ++.TP ++.BR "--source-mac " "[!] \fIaddress\fP[/\fImask\fP]" ++The source mac address. Both mask and address are written as 6 hexadecimal ++numbers separated by colons. ++.TP ++.BR "--destination-mac " "[!] \fIaddress\fP[/\fImask\fP]" ++The destination mac address. Both mask and address are written as 6 hexadecimal ++numbers separated by colons. ++.TP ++.BR "-i, --in-interface " "[!] \fIname\fP" ++The interface via which a frame is received (for the ++.BR INPUT " and " FORWARD ++chains). The flag ++.B --in-if ++is an alias for this option. ++.TP ++.BR "-o, --out-interface " "[!] \fIname\fP" ++The interface via which a frame is going to be sent (for the ++.BR OUTPUT " and " FORWARD ++chains). The flag ++.B --out-if ++is an alias for this option. ++.TP ++.BR "-l, --h-length " "\fIlength\fP[/\fImask\fP]" ++The hardware length (nr of bytes) ++.TP ++.BR "--opcode " "\fIcode\fP[/\fImask\fP] ++The operation code (2 bytes). Available values are: ++.BR 1 = Request ++.BR 2 = Reply ++.BR 3 = Request_Reverse ++.BR 4 = Reply_Reverse ++.BR 5 = DRARP_Request ++.BR 6 = DRARP_Reply ++.BR 7 = DRARP_Error ++.BR 8 = InARP_Request ++.BR 9 = ARP_NAK . ++.TP ++.BR "--h-type " "\fItype\fP[/\fImask\fP]" ++The hardware type (2 bytes, hexadecimal). Available values are: ++.BR 1 = Ethernet . ++.TP ++.BR "--proto-type " "\fItype\fP[/\fImask\fP]" ++The protocol type (2 bytes). Available values are: ++.BR 0x800 = IPv4 . ++ ++.SS TARGET-EXTENSIONS ++.B arptables ++extensions are precompiled into the userspace tool. So there is no need ++to explicitly load them with a -m option like in ++.BR iptables . ++However, these ++extensions deal with functionality supported by supplemental kernel modules. ++.SS mangle ++.TP ++.BR "--mangle-ip-s IP address" ++Mangles Source IP Address to given value. ++.TP ++.BR "--mangle-ip-d IP address" ++Mangles Destination IP Address to given value. ++.TP ++.BR "--mangle-mac-s MAC address" ++Mangles Source MAC Address to given value. ++.TP ++.BR "--mangle-mac-d MAC address" ++Mangles Destination MAC Address to given value. ++.TP ++.BR "--mangle-target target " ++Target of ARP mangle operation ++.BR "" ( DROP ", " CONTINUE " or " ACCEPT " -- default is " ACCEPT ). ++.SS CLASSIFY ++This module allows you to set the skb->priority value (and thus clas- ++sify the packet into a specific CBQ class). ++ ++.TP ++.BR "--set-class major:minor" ++ ++Set the major and minor class value. The values are always ++interpreted as hexadecimal even if no 0x prefix is given. ++ ++.SS MARK ++This module allows you to set the skb->mark value (and thus classify ++the packet by the mark in u32) ++ ++.TP ++.BR "--set-mark mark" ++Set the mark value. The values are always ++interpreted as hexadecimal even if no 0x prefix is given ++ ++.TP ++.BR "--and-mark mark" ++Binary AND the mark with bits. ++ ++.TP ++.BR "--or-mark mark" ++Binary OR the mark with bits. ++ ++.SH MAILINGLISTS ++.BR "" "See " http://netfilter.org/mailinglists.html ++.SH SEE ALSO ++.BR iptables "(8), " ebtables "(8), " arp "(8), " rarp "(8), " ifconfig "(8), " route (8) ++.PP ++.BR "" "See " http://ebtables.sf.net +-- +2.21.0 + diff --git a/0004-doc-Adjust-arptables-man-pages.patch b/0004-doc-Adjust-arptables-man-pages.patch new file mode 100644 index 0000000..3bf16d5 --- /dev/null +++ b/0004-doc-Adjust-arptables-man-pages.patch @@ -0,0 +1,192 @@ +From 2efbd30ed9f1db90b32b556d0e3df16d05281bc7 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 13 Mar 2019 20:46:13 +0100 +Subject: [PATCH] doc: Adjust arptables man pages + +Change content to suit the shipped nft-based variant. Most relevant +changes: + +* FORWARD chain is not supported +* arptables-nft-save supports a few parameters + +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +(cherry picked from commit 1a0cd997d601794c7031346063b8b77f4af2a13e) +Signed-off-by: Phil Sutter +--- + iptables/arptables-nft-restore.8 | 6 ++-- + iptables/arptables-nft-save.8 | 20 +++++++++---- + iptables/arptables-nft.8 | 48 +++++++++++++++----------------- + 3 files changed, 39 insertions(+), 35 deletions(-) + +diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8 +index 4f2f623673415..09d9082cf9fd3 100644 +--- a/iptables/arptables-nft-restore.8 ++++ b/iptables/arptables-nft-restore.8 +@@ -1,4 +1,4 @@ +-.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" "" ++.TH ARPTABLES-RESTORE 8 "March 2019" "" "" + .\" + .\" Man page written by Jesper Dangaard Brouer based on a + .\" Man page written by Harald Welte +@@ -20,7 +20,7 @@ + .\" + .\" + .SH NAME +-arptables-restore \(em Restore ARP Tables ++arptables-restore \- Restore ARP Tables (nft-based) + .SH SYNOPSIS + \fBarptables\-restore + .SH DESCRIPTION +@@ -32,8 +32,6 @@ Use I/O redirection provided by your shell to read from a file + .TP + .B arptables-restore + flushes (deletes) all previous contents of the respective ARP Table. +-.SH BUGS +-None known as of arptables-0.0.4 release + .SH AUTHOR + Jesper Dangaard Brouer + .SH SEE ALSO +diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8 +index 34791a9c087f0..905e59854cc28 100644 +--- a/iptables/arptables-nft-save.8 ++++ b/iptables/arptables-nft-save.8 +@@ -1,4 +1,4 @@ +-.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" "" ++.TH ARPTABLES-SAVE 8 "March 2019" "" "" + .\" + .\" Man page written by Jesper Dangaard Brouer based on a + .\" Man page written by Harald Welte +@@ -20,16 +20,26 @@ + .\" + .\" + .SH NAME +-arptables-save \(em dump arptables rules to stdout ++arptables-save \- dump arptables rules to stdout (nft-based) + .SH SYNOPSIS +-\fBarptables\-save ++\fBarptables\-save\fP [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP] ++.P ++\fBarptables\-save\fP [\fB\-V\fP] + .SH DESCRIPTION + .PP + .B arptables-save + is used to dump the contents of an ARP Table in easily parseable format + to STDOUT. Use I/O-redirection provided by your shell to write to a file. +-.SH BUGS +-None known as of arptables-0.0.4 release ++.TP ++\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP ++Specify the path to the modprobe program. By default, arptables-save will ++inspect /proc/sys/kernel/modprobe to determine the executable's path. ++.TP ++\fB\-c\fR, \fB\-\-counters\fR ++Include the current values of all packet and byte counters in the output. ++.TP ++\fB\-V\fR, \fB\-\-version\fR ++Print version information and exit. + .SH AUTHOR + Jesper Dangaard Brouer + .SH SEE ALSO +diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8 +index 3ce99e3757004..ea31e0842acd4 100644 +--- a/iptables/arptables-nft.8 ++++ b/iptables/arptables-nft.8 +@@ -1,4 +1,4 @@ +-.TH ARPTABLES 8 "June 2018" ++.TH ARPTABLES 8 "March 2019" + .\" + .\" Man page originally written by Jochen Friedrich , + .\" maintained by Bart De Schuymer. +@@ -22,7 +22,7 @@ + .\" + .\" + .SH NAME +-arptables \- ARP table administration (legacy) ++arptables \- ARP table administration (nft-based) + .SH SYNOPSIS + .BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ] + .br +@@ -38,17 +38,6 @@ arptables \- ARP table administration (legacy) + .br + .BR "arptables " [ "-t table" ] " -P chain target " [ options ] + +-.SH LEGACY +-This tool uses the old xtables/setsockopt framework, and is a legacy version +-of arptables. That means that a new, more modern tool exists with the same +-functionality using the nf_tables framework and you are encouraged to migrate now. +-The new binaries (formerly known as -compat) uses the same syntax and +-semantics than this legacy one. +- +-You can still use this legacy tool. You should probably get some specific +-information from your Linux distribution or vendor. +-More docs are available at https://wiki.nftables.org +- + .SH DESCRIPTION + .B arptables + is a user space tool, it is used to set up and maintain the +@@ -106,15 +95,11 @@ first argument on the arptables command line, if used. + .B "-t, --table" + .br + .BR filter , +-is the only table and contains two (Linux kernels 2.4.X) or three (Linux kernels 2.6.0 and later) built-in chains: ++is the only table and contains two built-in chains: + .B INPUT +-(for frames destined for the host), ++(for frames destined for the host) and + .B OUTPUT +-(for locally-generated frames) and +-.B FORWARD +-(for frames being forwarded by the bridge code). The +-.B FORWARD +-chain doesn't exist in Linux 2.4.X kernels. ++(for locally-generated frames). + .br + .br + .SH ARPTABLES COMMAND LINE ARGUMENTS +@@ -258,15 +243,15 @@ numbers separated by colons. + .TP + .BR "-i, --in-interface " "[!] \fIname\fP" + The interface via which a frame is received (for the +-.BR INPUT " and " FORWARD +-chains). The flag ++.B INPUT ++chain). The flag + .B --in-if + is an alias for this option. + .TP + .BR "-o, --out-interface " "[!] \fIname\fP" + The interface via which a frame is going to be sent (for the +-.BR OUTPUT " and " FORWARD +-chains). The flag ++.B OUTPUT ++chain). The flag + .B --out-if + is an alias for this option. + .TP +@@ -344,9 +329,20 @@ Binary AND the mark with bits. + .BR "--or-mark mark" + Binary OR the mark with bits. + ++.SH NOTES ++In this nft-based version of ++.BR arptables , ++support for ++.B FORWARD ++chain has not been implemented. Since ARP packets are "forwarded" only by Linux ++bridges, the same may be achieved using ++.B FORWARD ++chain in ++.BR ebtables . ++ + .SH MAILINGLISTS + .BR "" "See " http://netfilter.org/mailinglists.html + .SH SEE ALSO +-.BR iptables "(8), " ebtables "(8), " arp "(8), " rarp "(8), " ifconfig "(8), " route (8) ++.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip (8) + .PP +-.BR "" "See " http://ebtables.sf.net ++.BR "" "See " https://wiki.nftables.org +-- +2.21.0 + diff --git a/0005-doc-Add-ebtables-man-page.patch b/0005-doc-Add-ebtables-man-page.patch new file mode 100644 index 0000000..a7b8203 --- /dev/null +++ b/0005-doc-Add-ebtables-man-page.patch @@ -0,0 +1,1186 @@ +From c1d57b73ccd3cd3ab09a8bb8c0d2b5afd3ceb307 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 13 Mar 2019 20:46:14 +0100 +Subject: [PATCH] doc: Add ebtables man page + +This is a 1:1 copy from legacy ebtables repository. + +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +(cherry picked from commit eefd72aca33c6cdf7290da0c4a656c6768097181) +Signed-off-by: Phil Sutter +--- + iptables/Makefile.am | 3 +- + iptables/ebtables-nft.8 | 1146 +++++++++++++++++++++++++++++++++++++++ + 2 files changed, 1148 insertions(+), 1 deletion(-) + create mode 100644 iptables/ebtables-nft.8 + +diff --git a/iptables/Makefile.am b/iptables/Makefile.am +index 52309679d390c..37937b43cc310 100644 +--- a/iptables/Makefile.am ++++ b/iptables/Makefile.am +@@ -64,7 +64,8 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ + xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ + xtables-monitor.8 + if ENABLE_NFTABLES +-man_MANS += arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 ++man_MANS += arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 \ ++ ebtables-nft.8 + endif + CLEANFILES = iptables.8 xtables-monitor.8 \ + xtables-config-parser.c xtables-config-syntax.c +diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 +new file mode 100644 +index 0000000000000..55204ab91e8a4 +--- /dev/null ++++ b/iptables/ebtables-nft.8 +@@ -0,0 +1,1146 @@ ++.TH EBTABLES 8 "December 2011" ++.\" ++.\" Man page written by Bart De Schuymer ++.\" It is based on the iptables man page. ++.\" ++.\" The man page was edited, February 25th 2003, by ++.\" Greg Morgan <" dr_kludge_at_users_sourceforge_net > ++.\" ++.\" Iptables page by Herve Eychenne March 2000. ++.\" ++.\" This program is free software; you can redistribute it and/or modify ++.\" it under the terms of the GNU General Public License as published by ++.\" the Free Software Foundation; either version 2 of the License, or ++.\" (at your option) any later version. ++.\" ++.\" This program is distributed in the hope that it will be useful, ++.\" but WITHOUT ANY WARRANTY; without even the implied warranty of ++.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++.\" GNU General Public License for more details. ++.\" ++.\" You should have received a copy of the GNU General Public License ++.\" along with this program; if not, write to the Free Software ++.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++.\" ++.\" ++.SH NAME ++ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legacy) ++.SH SYNOPSIS ++.BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" ++.br ++.BR "ebtables " [ -t " table ] " -P " chain " ACCEPT " | " DROP " | " RETURN ++.br ++.BR "ebtables " [ -t " table ] " -F " [chain]" ++.br ++.BR "ebtables " [ -t " table ] " -Z " [chain]" ++.br ++.BR "ebtables " [ -t " table ] " -L " [" -Z "] [chain] [ [" --Ln "] | [" --Lx "] ] [" --Lc "] [" --Lmac2 ] ++.br ++.BR "ebtables " [ -t " table ] " -N " chain [" "-P ACCEPT " | " DROP " | " RETURN" ] ++.br ++.BR "ebtables " [ -t " table ] " -X " [chain]" ++.br ++.BR "ebtables " [ -t " table ] " -E " old-chain-name new-chain-name" ++.br ++.BR "ebtables " [ -t " table ] " --init-table ++.br ++.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit ++.br ++.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init ++.br ++.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save ++.br ++ ++.SH LEGACY ++This tool uses the old xtables/setsockopt framework, and is a legacy version ++of ebtables. That means that a new, more modern tool exists with the same ++functionality using the nf_tables framework and you are encouraged to migrate now. ++The new binaries (known as ebtables-nft and formerly known as ebtables-compat) ++uses the same syntax and semantics than this legacy one. ++ ++You can still use this legacy tool. You should probably get some specific ++information from your Linux distribution or vendor. ++More docs are available at https://wiki.nftables.org ++ ++.SH DESCRIPTION ++.B ebtables ++is an application program used to set up and maintain the ++tables of rules (inside the Linux kernel) that inspect ++Ethernet frames. ++It is analogous to the ++.B iptables ++application, but less complicated, due to the fact that the Ethernet protocol ++is much simpler than the IP protocol. ++.SS CHAINS ++There are three ebtables tables with built-in chains in the ++Linux kernel. These tables are used to divide functionality into ++different sets of rules. Each set of rules is called a chain. ++Each chain is an ordered list of rules that can match Ethernet frames. If a ++rule matches an Ethernet frame, then a processing specification tells ++what to do with that matching frame. The processing specification is ++called a 'target'. However, if the frame does not match the current ++rule in the chain, then the next rule in the chain is examined and so forth. ++The user can create new (user-defined) chains that can be used as the 'target' ++of a rule. User-defined chains are very useful to get better performance ++over the linear traversal of the rules and are also essential for structuring ++the filtering rules into well-organized and maintainable sets of rules. ++.SS TARGETS ++A firewall rule specifies criteria for an Ethernet frame and a frame ++processing specification called a target. When a frame matches a rule, ++then the next action performed by the kernel is specified by the target. ++The target can be one of these values: ++.BR ACCEPT , ++.BR DROP , ++.BR CONTINUE , ++.BR RETURN , ++an 'extension' (see below) or a jump to a user-defined chain. ++.PP ++.B ACCEPT ++means to let the frame through. ++.B DROP ++means the frame has to be dropped. In the ++.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different" ++meanings (see the info provided for the ++.BR -t " option)." ++.B CONTINUE ++means the next rule has to be checked. This can be handy, f.e., to know how many ++frames pass a certain point in the chain, to log those frames or to apply multiple ++targets on a frame. ++.B RETURN ++means stop traversing this chain and resume at the next rule in the ++previous (calling) chain. ++For the extension targets please refer to the ++.B "TARGET EXTENSIONS" ++section of this man page. ++.SS TABLES ++As stated earlier, there are three ebtables tables in the Linux ++kernel. The table names are ++.BR filter ", " nat " and " broute . ++Of these three tables, ++the filter table is the default table that the command operates on. ++If you are working with the filter table, then you can drop the '-t filter' ++argument to the ebtables command. However, you will need to provide ++the -t argument for the other two tables. Moreover, the -t argument must be the ++first argument on the ebtables command line, if used. ++.TP ++.B "-t, --table" ++.br ++.B filter ++is the default table and contains three built-in chains: ++.B INPUT ++(for frames destined for the bridge itself, on the level of the MAC destination address), ++.B OUTPUT ++(for locally-generated or (b)routed frames) and ++.B FORWARD ++(for frames being forwarded by the bridge). ++.br ++.br ++.B nat ++is mostly used to change the mac addresses and contains three built-in chains: ++.B PREROUTING ++(for altering frames as soon as they come in), ++.B OUTPUT ++(for altering locally generated or (b)routed frames before they are bridged) and ++.B POSTROUTING ++(for altering frames as they are about to go out). A small note on the naming ++of chains PREROUTING and POSTROUTING: it would be more accurate to call them ++PREFORWARDING and POSTFORWARDING, but for all those who come from the ++iptables world to ebtables it is easier to have the same names. Note that you ++can change the name ++.BR "" ( -E ) ++if you don't like the default. ++.br ++.br ++.B broute ++is used to make a brouter, it has one built-in chain: ++.BR BROUTING . ++The targets ++.BR DROP " and " ACCEPT ++have a special meaning in the broute table (these names are used instead of ++more descriptive names to keep the implementation generic). ++.B DROP ++actually means the frame has to be routed, while ++.B ACCEPT ++means the frame has to be bridged. The ++.B BROUTING ++chain is traversed very early. However, it is only traversed by frames entering on ++a bridge port that is in forwarding state. Normally those frames ++would be bridged, but you can decide otherwise here. The ++.B redirect ++target is very handy here. ++.SH EBTABLES COMMAND LINE ARGUMENTS ++After the initial ebtables '-t table' command line argument, the remaining ++arguments can be divided into several groups. These groups ++are commands, miscellaneous commands, rule specifications, match extensions, ++watcher extensions and target extensions. ++.SS COMMANDS ++The ebtables command arguments specify the actions to perform on the table ++defined with the -t argument. If you do not use the -t argument to name ++a table, the commands apply to the default filter table. ++Only one command may be used on the command line at a time, except when ++the commands ++.BR -L " and " -Z ++are combined, the commands ++.BR -N " and " -P ++are combined, or when ++.B --atomic-file ++is used. ++.TP ++.B "-A, --append" ++Append a rule to the end of the selected chain. ++.TP ++.B "-D, --delete" ++Delete the specified rule or rules from the selected chain. There are two ways to ++use this command. The first is by specifying an interval of rule numbers ++to delete (directly after ++.BR -D ). ++Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use ++.B -L --Ln ++to list the rules with their rule number). When \fIend_nr\fP is omitted, all rules starting ++from \fIstart_nr\fP are deleted. Using negative numbers is allowed, for more ++details about using negative numbers, see the ++.B -I ++command. The second usage is by ++specifying the complete rule as it would have been specified when it was added. Only ++the first encountered rule that is the same as this specified rule, in other ++words the matching rule with the lowest (positive) rule number, is deleted. ++.TP ++.B "-C, --change-counters" ++Change the counters of the specified rule or rules from the selected chain. There are two ways to ++use this command. The first is by specifying an interval of rule numbers ++to do the changes on (directly after ++.BR -C ). ++Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use ++.B -L --Ln ++to list the rules with their rule number). The details are the same as for the ++.BR -D " command. The second usage is by" ++specifying the complete rule as it would have been specified when it was added. Only ++the counters of the first encountered rule that is the same as this specified rule, in other ++words the matching rule with the lowest (positive) rule number, are changed. ++In the first usage, the counters are specified directly after the interval specification, ++in the second usage directly after ++.BR -C . ++First the packet counter is specified, then the byte counter. If the specified counters start ++with a '+', the counter values are added to the respective current counter values. ++If the specified counters start with a '-', the counter values are decreased from the respective ++current counter values. No bounds checking is done. If the counters don't start with '+' or '-', ++the current counters are changed to the specified counters. ++.TP ++.B "-I, --insert" ++Insert the specified rule into the selected chain at the specified rule number. If the ++rule number is not specified, the rule is added at the head of the chain. ++If the current number of rules equals ++.IR N , ++then the specified number can be ++between ++.IR -N " and " N+1 . ++For a positive number ++.IR i , ++it holds that ++.IR i " and " i-N-1 ++specify the same place in the chain where the rule should be inserted. The rule number ++0 specifies the place past the last rule in the chain and using this number is therefore ++equivalent to using the ++.BR -A " command." ++Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted ++in a chain. ++.TP ++.B "-P, --policy" ++Set the policy for the chain to the given target. The policy can be ++.BR ACCEPT ", " DROP " or " RETURN . ++.TP ++.B "-F, --flush" ++Flush the selected chain. If no chain is selected, then every chain will be ++flushed. Flushing a chain does not change the policy of the ++chain, however. ++.TP ++.B "-Z, --zero" ++Set the counters of the selected chain to zero. If no chain is selected, all the counters ++are set to zero. The ++.B "-Z" ++command can be used in conjunction with the ++.B "-L" ++command. ++When both the ++.B "-Z" ++and ++.B "-L" ++commands are used together in this way, the rule counters are printed on the screen ++before they are set to zero. ++.TP ++.B "-L, --list" ++List all rules in the selected chain. If no chain is selected, all chains ++are listed. ++.br ++The following options change the output of the ++.B "-L" ++command. ++.br ++.B "--Ln" ++.br ++Places the rule number in front of every rule. This option is incompatible with the ++.BR --Lx " option." ++.br ++.B "--Lc" ++.br ++Shows the counters at the end of each rule displayed by the ++.B "-L" ++command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed. ++The frame counter shows how many frames have matched the specific rule, the byte ++counter shows the sum of the frame sizes of these matching frames. Using this option ++.BR "" "in combination with the " --Lx " option causes the counters to be written out" ++.BR "" "in the '" -c " ' option format." ++.br ++.B "--Lx" ++.br ++Changes the output so that it produces a set of ebtables commands that construct ++the contents of the chain, when specified. ++If no chain is specified, ebtables commands to construct the contents of the ++table are given, including commands for creating the user-defined chains (if any). ++You can use this set of commands in an ebtables boot or reload ++script. For example the output could be used at system startup. ++The ++.B "--Lx" ++option is incompatible with the ++.B "--Ln" ++listing option. Using the ++.BR --Lx " option together with the " --Lc " option will cause the counters to be written out" ++.BR "" "in the '" -c " ' option format." ++.br ++.B "--Lmac2" ++.br ++Shows all MAC addresses with the same length, adding leading zeroes ++if necessary. The default representation omits leading zeroes in the addresses. ++.TP ++.B "-N, --new-chain" ++Create a new user-defined chain with the given name. The number of ++user-defined chains is limited only by the number of possible chain names. ++A user-defined chain name has a maximum ++length of 31 characters. The standard policy of the user-defined chain is ++ACCEPT. The policy of the new chain can be initialized to a different standard ++target by using the ++.B -P ++command together with the ++.B -N ++command. In this case, the chain name does not have to be specified for the ++.B -P ++command. ++.TP ++.B "-X, --delete-chain" ++Delete the specified user-defined chain. There must be no remaining references (jumps) ++to the specified chain, otherwise ebtables will refuse to delete it. If no chain is ++specified, all user-defined chains that aren't referenced will be removed. ++.TP ++.B "-E, --rename-chain" ++Rename the specified chain to a new name. Besides renaming a user-defined ++chain, you can rename a standard chain to a name that suits your ++taste. For example, if you like PREFORWARDING more than PREROUTING, ++then you can use the -E command to rename the PREROUTING chain. If you do ++rename one of the standard ebtables chain names, please be sure to mention ++this fact should you post a question on the ebtables mailing lists. ++It would be wise to use the standard name in your post. Renaming a standard ++ebtables chain in this fashion has no effect on the structure or functioning ++of the ebtables kernel table. ++.TP ++.B "--init-table" ++Replace the current table data by the initial table data. ++.TP ++.B "--atomic-init" ++Copy the kernel's initial data of the table to the specified ++file. This can be used as the first action, after which rules are added ++to the file. The file can be specified using the ++.B --atomic-file ++command or through the ++.IR EBTABLES_ATOMIC_FILE " environment variable." ++.TP ++.B "--atomic-save" ++Copy the kernel's current data of the table to the specified ++file. This can be used as the first action, after which rules are added ++to the file. The file can be specified using the ++.B --atomic-file ++command or through the ++.IR EBTABLES_ATOMIC_FILE " environment variable." ++.TP ++.B "--atomic-commit" ++Replace the kernel table data with the data contained in the specified ++file. This is a useful command that allows you to load all your rules of a ++certain table into the kernel at once, saving the kernel a lot of precious ++time and allowing atomic updates of the tables. The file which contains ++the table data is constructed by using either the ++.B "--atomic-init" ++or the ++.B "--atomic-save" ++command to generate a starting file. After that, using the ++.B "--atomic-file" ++command when constructing rules or setting the ++.IR EBTABLES_ATOMIC_FILE " environment variable" ++allows you to extend the file and build the complete table before ++committing it to the kernel. This command can be very useful in boot scripts ++to populate the ebtables tables in a fast way. ++.SS MISCELLANOUS COMMANDS ++.TP ++.B "-V, --version" ++Show the version of the ebtables userspace program. ++.TP ++.BR "-h, --help " "[\fIlist of module names\fP]" ++Give a brief description of the command syntax. Here you can also specify ++names of extensions and ebtables will try to write help about those ++extensions. E.g. ++.IR "ebtables -h snat log ip arp" . ++Specify ++.I list_extensions ++to list all extensions supported by the userspace ++utility. ++.TP ++.BR "-j, --jump " "\fItarget\fP" ++The target of the rule. This is one of the following values: ++.BR ACCEPT , ++.BR DROP , ++.BR CONTINUE , ++.BR RETURN , ++a target extension (see ++.BR "TARGET EXTENSIONS" ")" ++or a user-defined chain name. ++.TP ++.B --atomic-file "\fIfile\fP" ++Let the command operate on the specified ++.IR file . ++The data of the table to ++operate on will be extracted from the file and the result of the operation ++will be saved back into the file. If specified, this option should come ++before the command specification. An alternative that should be preferred, ++is setting the ++.IR EBTABLES_ATOMIC_FILE " environment variable." ++.TP ++.B -M, --modprobe "\fIprogram\fP" ++When talking to the kernel, use this ++.I program ++to try to automatically load missing kernel modules. ++.TP ++.B --concurrent ++Use a file lock to support concurrent scripts updating the ebtables kernel tables. ++ ++.SS ++RULE SPECIFICATIONS ++The following command line arguments make up a rule specification (as used ++in the add and delete commands). A "!" option before the specification ++inverts the test for that specification. Apart from these standard rule ++specifications there are some other command line arguments of interest. ++See both the ++.BR "MATCH EXTENSIONS" ++and the ++.BR "WATCHER EXTENSIONS" ++below. ++.TP ++.BR "-p, --protocol " "[!] \fIprotocol\fP" ++The protocol that was responsible for creating the frame. This can be a ++hexadecimal number, above ++.IR 0x0600 , ++a name (e.g. ++.I ARP ++) or ++.BR LENGTH . ++The protocol field of the Ethernet frame can be used to denote the ++length of the header (802.2/802.3 networks). When the value of that field is ++below or equals ++.IR 0x0600 , ++the value equals the size of the header and shouldn't be used as a ++protocol number. Instead, all frames where the protocol field is used as ++the length field are assumed to be of the same 'protocol'. The protocol ++name used in ebtables for these frames is ++.BR LENGTH . ++.br ++The file ++.B /etc/ethertypes ++can be used to show readable ++characters instead of hexadecimal numbers for the protocols. For example, ++.I 0x0800 ++will be represented by ++.IR IPV4 . ++The use of this file is not case sensitive. ++See that file for more information. The flag ++.B --proto ++is an alias for this option. ++.TP ++.BR "-i, --in-interface " "[!] \fIname\fP" ++The interface (bridge port) via which a frame is received (this option is useful in the ++.BR INPUT , ++.BR FORWARD , ++.BR PREROUTING " and " BROUTING ++chains). If the interface name ends with '+', then ++any interface name that begins with this name (disregarding '+') will match. ++The flag ++.B --in-if ++is an alias for this option. ++.TP ++.BR "--logical-in " "[!] \fIname\fP" ++The (logical) bridge interface via which a frame is received (this option is useful in the ++.BR INPUT , ++.BR FORWARD , ++.BR PREROUTING " and " BROUTING ++chains). ++If the interface name ends with '+', then ++any interface name that begins with this name (disregarding '+') will match. ++.TP ++.BR "-o, --out-interface " "[!] \fIname\fP" ++The interface (bridge port) via which a frame is going to be sent (this option is useful in the ++.BR OUTPUT , ++.B FORWARD ++and ++.B POSTROUTING ++chains). If the interface name ends with '+', then ++any interface name that begins with this name (disregarding '+') will match. ++The flag ++.B --out-if ++is an alias for this option. ++.TP ++.BR "--logical-out " "[!] \fIname\fP" ++The (logical) bridge interface via which a frame is going to be sent (this option ++is useful in the ++.BR OUTPUT , ++.B FORWARD ++and ++.B POSTROUTING ++chains). ++If the interface name ends with '+', then ++any interface name that begins with this name (disregarding '+') will match. ++.TP ++.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]" ++The source MAC address. Both mask and address are written as 6 hexadecimal ++numbers separated by colons. Alternatively one can specify Unicast, ++Multicast, Broadcast or BGA (Bridge Group Address): ++.br ++.IR "Unicast" "=00:00:00:00:00:00/01:00:00:00:00:00," ++.IR "Multicast" "=01:00:00:00:00:00/01:00:00:00:00:00," ++.IR "Broadcast" "=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or" ++.IR "BGA" "=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff." ++Note that a broadcast ++address will also match the multicast specification. The flag ++.B --src ++is an alias for this option. ++.TP ++.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]" ++The destination MAC address. See ++.B -s ++(above) for more details on MAC addresses. The flag ++.B --dst ++is an alias for this option. ++.TP ++.BR "-c, --set-counter " "\fIpcnt bcnt\fP" ++If used with ++.BR -A " or " -I ", then the packet and byte counters of the new rule will be set to ++.IR pcnt ", resp. " bcnt ". ++If used with the ++.BR -C " or " -D " commands, only rules with a packet and byte count equal to" ++.IR pcnt ", resp. " bcnt " will match." ++ ++.SS MATCH EXTENSIONS ++Ebtables extensions are dynamically loaded into the userspace tool, ++there is therefore no need to explicitly load them with a ++-m option like is done in iptables. ++These extensions deal with functionality supported by kernel modules supplemental to ++the core ebtables code. ++.SS 802_3 ++Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as ++.IR "LENGTH " "(see the option " " -p " above). ++.TP ++.BR "--802_3-sap " "[!] \fIsap\fP" ++DSAP and SSAP are two one byte 802.3 fields. The bytes are always ++equal, so only one byte (hexadecimal) is needed as an argument. ++.TP ++.BR "--802_3-type " "[!] \fItype\fP" ++If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must ++be consulted to determine the payload protocol. This is a two byte ++(hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are ++checked for type. ++.SS among ++Match a MAC address or MAC/IP address pair versus a list of MAC addresses ++and MAC/IP address pairs. ++A list entry has the following format: ++.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" ++list entries are separated by a comma, specifying an IP address corresponding to ++the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address ++but different IP address (and vice versa) can be specified. If the MAC address doesn't ++match any entry from the list, the frame doesn't match the rule (unless "!" was used). ++.TP ++.BR "--among-dst " "[!] \fIlist\fP" ++Compare the MAC destination to the given list. If the Ethernet frame has type ++.IR IPv4 " or " ARP , ++then comparison with MAC/IP destination address pairs from the ++list is possible. ++.TP ++.BR "--among-src " "[!] \fIlist\fP" ++Compare the MAC source to the given list. If the Ethernet frame has type ++.IR IPv4 " or " ARP , ++then comparison with MAC/IP source address pairs from the list ++is possible. ++.TP ++.BR "--among-dst-file " "[!] \fIfile\fP" ++Same as ++.BR --among-dst " but the list is read in from the specified file." ++.TP ++.BR "--among-src-file " "[!] \fIfile\fP" ++Same as ++.BR --among-src " but the list is read in from the specified file." ++.SS arp ++Specify (R)ARP fields. The protocol must be specified as ++.IR ARP " or " RARP . ++.TP ++.BR "--arp-opcode " "[!] \fIopcode\fP" ++The (R)ARP opcode (decimal or a string, for more details see ++.BR "ebtables -h arp" ). ++.TP ++.BR "--arp-htype " "[!] \fIhardware type\fP" ++The hardware type, this can be a decimal or the string ++.I Ethernet ++(which sets ++.I type ++to 1). Most (R)ARP packets have Eternet as hardware type. ++.TP ++.BR "--arp-ptype " "[!] \fIprotocol type\fP" ++The protocol type for which the (r)arp is used (hexadecimal or the string ++.IR IPv4 , ++denoting 0x0800). ++Most (R)ARP packets have protocol type IPv4. ++.TP ++.BR "--arp-ip-src " "[!] \fIaddress\fP[/\fImask\fP]" ++The (R)ARP IP source address specification. ++.TP ++.BR "--arp-ip-dst " "[!] \fIaddress\fP[/\fImask\fP]" ++The (R)ARP IP destination address specification. ++.TP ++.BR "--arp-mac-src " "[!] \fIaddress\fP[/\fImask\fP]" ++The (R)ARP MAC source address specification. ++.TP ++.BR "--arp-mac-dst " "[!] \fIaddress\fP[/\fImask\fP]" ++The (R)ARP MAC destination address specification. ++.TP ++.BR "" "[!]" " --arp-gratuitous" ++Checks for ARP gratuitous packets: checks equality of IPv4 source ++address and IPv4 destination address inside the ARP header. ++.SS ip ++Specify IPv4 fields. The protocol must be specified as ++.IR IPv4 . ++.TP ++.BR "--ip-source " "[!] \fIaddress\fP[/\fImask\fP]" ++The source IP address. ++The flag ++.B --ip-src ++is an alias for this option. ++.TP ++.BR "--ip-destination " "[!] \fIaddress\fP[/\fImask\fP]" ++The destination IP address. ++The flag ++.B --ip-dst ++is an alias for this option. ++.TP ++.BR "--ip-tos " "[!] \fItos\fP" ++The IP type of service, in hexadecimal numbers. ++.BR IPv4 . ++.TP ++.BR "--ip-protocol " "[!] \fIprotocol\fP" ++The IP protocol. ++The flag ++.B --ip-proto ++is an alias for this option. ++.TP ++.BR "--ip-source-port " "[!] \fIport1\fP[:\fIport2\fP]" ++The source port or port range for the IP protocols 6 (TCP), 17 ++(UDP), 33 (DCCP) or 132 (SCTP). The ++.B --ip-protocol ++option must be specified as ++.IR TCP ", " UDP ", " DCCP " or " SCTP . ++If ++.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." ++The flag ++.B --ip-sport ++is an alias for this option. ++.TP ++.BR "--ip-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" ++The destination port or port range for ip protocols 6 (TCP), 17 ++(UDP), 33 (DCCP) or 132 (SCTP). The ++.B --ip-protocol ++option must be specified as ++.IR TCP ", " UDP ", " DCCP " or " SCTP . ++If ++.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." ++The flag ++.B --ip-dport ++is an alias for this option. ++.SS ip6 ++Specify IPv6 fields. The protocol must be specified as ++.IR IPv6 . ++.TP ++.BR "--ip6-source " "[!] \fIaddress\fP[/\fImask\fP]" ++The source IPv6 address. ++The flag ++.B --ip6-src ++is an alias for this option. ++.TP ++.BR "--ip6-destination " "[!] \fIaddress\fP[/\fImask\fP]" ++The destination IPv6 address. ++The flag ++.B --ip6-dst ++is an alias for this option. ++.TP ++.BR "--ip6-tclass " "[!] \fItclass\fP" ++The IPv6 traffic class, in hexadecimal numbers. ++.TP ++.BR "--ip6-protocol " "[!] \fIprotocol\fP" ++The IP protocol. ++The flag ++.B --ip6-proto ++is an alias for this option. ++.TP ++.BR "--ip6-source-port " "[!] \fIport1\fP[:\fIport2\fP]" ++The source port or port range for the IPv6 protocols 6 (TCP), 17 ++(UDP), 33 (DCCP) or 132 (SCTP). The ++.B --ip6-protocol ++option must be specified as ++.IR TCP ", " UDP ", " DCCP " or " SCTP . ++If ++.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." ++The flag ++.B --ip6-sport ++is an alias for this option. ++.TP ++.BR "--ip6-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" ++The destination port or port range for IPv6 protocols 6 (TCP), 17 ++(UDP), 33 (DCCP) or 132 (SCTP). The ++.B --ip6-protocol ++option must be specified as ++.IR TCP ", " UDP ", " DCCP " or " SCTP . ++If ++.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." ++The flag ++.B --ip6-dport ++is an alias for this option. ++.TP ++.BR "--ip6-icmp-type " "[!] {\fItype\fP[:\fItype\fP]/\fIcode\fP[:\fIcode\fP]|\fItypename\fP}" ++Specify ipv6\-icmp type and code to match. ++Ranges for both type and code are supported. Type and code are ++separated by a slash. Valid numbers for type and range are 0 to 255. ++To match a single type including all valid codes, symbolic names can ++be used instead of numbers. The list of known type names is shown by the command ++.nf ++ ebtables \-\-help ip6 ++.fi ++This option is only valid for \-\-ip6-prococol ipv6-icmp. ++.SS limit ++This module matches at a limited rate using a token bucket filter. ++A rule using this extension will match until this limit is reached. ++It can be used with the ++.B --log ++watcher to give limited logging, for example. Its use is the same ++as the limit match of iptables. ++.TP ++.BR "--limit " "[\fIvalue\fP]" ++Maximum average matching rate: specified as a number, with an optional ++.IR /second ", " /minute ", " /hour ", or " /day " suffix; the default is " 3/hour . ++.TP ++.BR "--limit-burst " "[\fInumber\fP]" ++Maximum initial number of packets to match: this number gets recharged by ++one every time the limit specified above is not reached, up to this ++number; the default is ++.IR 5 . ++.SS mark_m ++.TP ++.BR "--mark " "[!] [\fIvalue\fP][/\fImask\fP]" ++Matches frames with the given unsigned mark value. If a ++.IR value " and " mask " are specified, the logical AND of the mark value of the frame and" ++the user-specified ++.IR mask " is taken before comparing it with the" ++user-specified mark ++.IR value ". When only a mark " ++.IR value " is specified, the packet" ++only matches when the mark value of the frame equals the user-specified ++mark ++.IR value . ++If only a ++.IR mask " is specified, the logical" ++AND of the mark value of the frame and the user-specified ++.IR mask " is taken and the frame matches when the result of this logical AND is" ++non-zero. Only specifying a ++.IR mask " is useful to match multiple mark values." ++.SS pkttype ++.TP ++.BR "--pkttype-type " "[!] \fItype\fP" ++Matches on the Ethernet "class" of the frame, which is determined by the ++generic networking code. Possible values: ++.IR broadcast " (MAC destination is the broadcast address)," ++.IR multicast " (MAC destination is a multicast address)," ++.IR host " (MAC destination is the receiving network device), or " ++.IR otherhost " (none of the above)." ++.SS stp ++Specify stp BPDU (bridge protocol data unit) fields. The destination ++address ++.BR "" ( -d ") must be specified as the bridge group address" ++.IR "" ( BGA ). ++For all options for which a range of values can be specified, it holds that ++if the lower bound is omitted (but the colon is not), then the lowest possible lower bound ++for that option is used, while if the upper bound is omitted (but the colon again is not), the ++highest possible upper bound for that option is used. ++.TP ++.BR "--stp-type " "[!] \fItype\fP" ++The BPDU type (0-255), recognized non-numerical types are ++.IR config ", denoting a configuration BPDU (=0), and" ++.IR tcn ", denothing a topology change notification BPDU (=128)." ++.TP ++.BR "--stp-flags " "[!] \fIflag\fP" ++The BPDU flag (0-255), recognized non-numerical flags are ++.IR topology-change ", denoting the topology change flag (=1), and" ++.IR topology-change-ack ", denoting the topology change acknowledgement flag (=128)." ++.TP ++.BR "--stp-root-prio " "[!] [\fIprio\fP][:\fIprio\fP]" ++The root priority (0-65535) range. ++.TP ++.BR "--stp-root-addr " "[!] [\fIaddress\fP][/\fImask\fP]" ++The root mac address, see the option ++.BR -s " for more details." ++.TP ++.BR "--stp-root-cost " "[!] [\fIcost\fP][:\fIcost\fP]" ++The root path cost (0-4294967295) range. ++.TP ++.BR "--stp-sender-prio " "[!] [\fIprio\fP][:\fIprio\fP]" ++The BPDU's sender priority (0-65535) range. ++.TP ++.BR "--stp-sender-addr " "[!] [\fIaddress\fP][/\fImask\fP]" ++The BPDU's sender mac address, see the option ++.BR -s " for more details." ++.TP ++.BR "--stp-port " "[!] [\fIport\fP][:\fIport\fP]" ++The port identifier (0-65535) range. ++.TP ++.BR "--stp-msg-age " "[!] [\fIage\fP][:\fIage\fP]" ++The message age timer (0-65535) range. ++.TP ++.BR "--stp-max-age " "[!] [\fIage\fP][:\fIage\fP]" ++The max age timer (0-65535) range. ++.TP ++.BR "--stp-hello-time " "[!] [\fItime\fP][:\fItime\fP]" ++The hello time timer (0-65535) range. ++.TP ++.BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]" ++The forward delay timer (0-65535) range. ++.SS string ++This module matches on a given string using some pattern matching strategy. ++.TP ++.BR "--string-algo " "\fIalgorithm\fP" ++The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) ++.TP ++.BR "--string-from " "\fIoffset\fP" ++The lowest offset from which a match can start. (default: 0) ++.TP ++.BR "--string-to " "\fIoffset\fP" ++The highest offset from which a match can start. (default: size of frame) ++.TP ++.BR "--string " "[!] \fIpattern\fP" ++Matches the given pattern. ++.TP ++.BR "--string-hex " "[!] \fIpattern\fP" ++Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' ++.TP ++.BR "--string-icase" ++Ignore case when searching. ++.SS vlan ++Specify 802.1Q Tag Control Information fields. ++The protocol must be specified as ++.IR 802_1Q " (0x8100)." ++.TP ++.BR "--vlan-id " "[!] \fIid\fP" ++The VLAN identifier field (VID). Decimal number from 0 to 4095. ++.TP ++.BR "--vlan-prio " "[!] \fIprio\fP" ++The user priority field, a decimal number from 0 to 7. ++The VID should be set to 0 ("null VID") or unspecified ++(in the latter case the VID is deliberately set to 0). ++.TP ++.BR "--vlan-encap " "[!] \fItype\fP" ++The encapsulated Ethernet frame type/length. ++Specified as a hexadecimal ++number from 0x0000 to 0xFFFF or as a symbolic name ++from ++.BR /etc/ethertypes . ++ ++.SS WATCHER EXTENSIONS ++Watchers only look at frames passing by, they don't modify them nor decide ++to accept the frames or not. These watchers only ++see the frame if the frame matches the rule, and they see it before the ++target is executed. ++.SS log ++The log watcher writes descriptive data about a frame to the syslog. ++.TP ++.B "--log" ++.br ++Log with the default loggin options: log-level= ++.IR info , ++log-prefix="", no ip logging, no arp logging. ++.TP ++.B --log-level "\fIlevel\fP" ++.br ++Defines the logging level. For the possible values, see ++.BR "ebtables -h log" . ++The default level is ++.IR info . ++.TP ++.BR --log-prefix " \fItext\fP" ++.br ++Defines the prefix ++.I text ++to be printed at the beginning of the line with the logging information. ++.TP ++.B --log-ip ++.br ++Will log the ip information when a frame made by the ip protocol matches ++the rule. The default is no ip information logging. ++.TP ++.B --log-ip6 ++.br ++Will log the ipv6 information when a frame made by the ipv6 protocol matches ++the rule. The default is no ipv6 information logging. ++.TP ++.B --log-arp ++.br ++Will log the (r)arp information when a frame made by the (r)arp protocols ++matches the rule. The default is no (r)arp information logging. ++.SS nflog ++The nflog watcher passes the packet to the loaded logging backend ++in order to log the packet. This is usually used in combination with ++nfnetlink_log as logging backend, which will multicast the packet ++through a ++.IR netlink ++socket to the specified multicast group. One or more userspace processes ++may subscribe to the group to receive the packets. ++.TP ++.B "--nflog" ++.br ++Log with the default logging options ++.TP ++.B --nflog-group "\fInlgroup\fP" ++.br ++The netlink group (1 - 2^32-1) to which packets are (only applicable for ++nfnetlink_log). The default value is 1. ++.TP ++.B --nflog-prefix "\fIprefix\fP" ++.br ++A prefix string to include in the log message, up to 30 characters ++long, useful for distinguishing messages in the logs. ++.TP ++.B --nflog-range "\fIsize\fP" ++.br ++The number of bytes to be copied to userspace (only applicable for ++nfnetlink_log). nfnetlink_log instances may specify their own ++range, this option overrides it. ++.TP ++.B --nflog-threshold "\fIsize\fP" ++.br ++Number of packets to queue inside the kernel before sending them ++to userspace (only applicable for nfnetlink_log). Higher values ++result in less overhead per packet, but increase delay until the ++packets reach userspace. The default value is 1. ++.SS ulog ++The ulog watcher passes the packet to a userspace ++logging daemon using netlink multicast sockets. This differs ++from the log watcher in the sense that the complete packet is ++sent to userspace instead of a descriptive text and that ++netlink multicast sockets are used instead of the syslog. ++This watcher enables parsing of packets with userspace programs, the ++physical bridge in and out ports are also included in the netlink messages. ++The ulog watcher module accepts 2 parameters when the module is loaded ++into the kernel (e.g. with modprobe): ++.B nlbufsiz ++specifies how big the buffer for each netlink multicast ++group is. If you say ++.IR nlbufsiz=8192 , ++for example, up to eight kB of packets will ++get accumulated in the kernel until they are sent to userspace. It is ++not possible to allocate more than 128kB. Please also keep in mind that ++this buffer size is allocated for each nlgroup you are using, so the ++total kernel memory usage increases by that factor. The default is 4096. ++.B flushtimeout ++specifies after how many hundredths of a second the queue should be ++flushed, even if it is not full yet. The default is 10 (one tenth of ++a second). ++.TP ++.B "--ulog" ++.br ++Use the default settings: ulog-prefix="", ulog-nlgroup=1, ++ulog-cprange=4096, ulog-qthreshold=1. ++.TP ++.B --ulog-prefix "\fItext\fP" ++.br ++Defines the prefix included with the packets sent to userspace. ++.TP ++.BR --ulog-nlgroup " \fIgroup\fP" ++.br ++Defines which netlink group number to use (a number from 1 to 32). ++Make sure the netlink group numbers used for the iptables ULOG ++target differ from those used for the ebtables ulog watcher. ++The default group number is 1. ++.TP ++.BR --ulog-cprange " \fIrange\fP" ++.br ++Defines the maximum copy range to userspace, for packets matching the ++rule. The default range is 0, which means the maximum copy range is ++given by ++.BR nlbufsiz . ++A maximum copy range larger than ++128*1024 is meaningless as the packets sent to userspace have an upper ++size limit of 128*1024. ++.TP ++.BR --ulog-qthreshold " \fIthreshold\fP" ++.br ++Queue at most ++.I threshold ++number of packets before sending them to ++userspace with a netlink socket. Note that packets can be sent to ++userspace before the queue is full, this happens when the ulog ++kernel timer goes off (the frequency of this timer depends on ++.BR flushtimeout ). ++.SS TARGET EXTENSIONS ++.SS arpreply ++The ++.B arpreply ++target can be used in the ++.BR PREROUTING " chain of the " nat " table." ++If this target sees an ARP request it will automatically reply ++with an ARP reply. The used MAC address for the reply can be specified. ++The protocol must be specified as ++.IR ARP . ++When the ARP message is not an ARP request or when the ARP request isn't ++for an IP address on an Ethernet network, it is ignored by this target ++.BR "" ( CONTINUE ). ++When the ARP request is malformed, it is dropped ++.BR "" ( DROP ). ++.TP ++.BR "--arpreply-mac " "\fIaddress\fP" ++Specifies the MAC address to reply with: the Ethernet source MAC and the ++ARP payload source MAC will be filled in with this address. ++.TP ++.BR "--arpreply-target " "\fItarget\fP" ++Specifies the standard target. After sending the ARP reply, the rule still ++has to give a standard target so ebtables knows what to do with the ARP request. ++The default target ++.BR "" "is " DROP . ++.SS dnat ++The ++.B dnat ++target can only be used in the ++.BR BROUTING " chain of the " broute " table and the " ++.BR PREROUTING " and " OUTPUT " chains of the " nat " table." ++It specifies that the destination MAC address has to be changed. ++.TP ++.BR "--to-destination " "\fIaddress\fP" ++.br ++Change the destination MAC address to the specified ++.IR address . ++The flag ++.B --to-dst ++is an alias for this option. ++.TP ++.BR "--dnat-target " "\fItarget\fP" ++.br ++Specifies the standard target. After doing the dnat, the rule still has to ++give a standard target so ebtables knows what to do with the dnated frame. ++The default target is ++.BR ACCEPT . ++Making it ++.BR CONTINUE " could let you use" ++multiple target extensions on the same frame. Making it ++.BR DROP " only makes" ++sense in the ++.BR BROUTING " chain but using the " redirect " target is more logical there. " RETURN " is also allowed. Note that using " RETURN ++in a base chain is not allowed (for obvious reasons). ++.SS mark ++.BR "" "The " mark " target can be used in every chain of every table. It is possible" ++to use the marking of a frame/packet in both ebtables and iptables, ++if the bridge-nf code is compiled into the kernel. Both put the marking at the ++same place. This allows for a form of communication between ebtables and iptables. ++.TP ++.BR "--mark-set " "\fIvalue\fP" ++.br ++Mark the frame with the specified non-negative ++.IR value . ++.TP ++.BR "--mark-or " "\fIvalue\fP" ++.br ++Or the frame with the specified non-negative ++.IR value . ++.TP ++.BR "--mark-and " "\fIvalue\fP" ++.br ++And the frame with the specified non-negative ++.IR value . ++.TP ++.BR "--mark-xor " "\fIvalue\fP" ++.br ++Xor the frame with the specified non-negative ++.IR value . ++.TP ++.BR "--mark-target " "\fItarget\fP" ++.br ++Specifies the standard target. After marking the frame, the rule ++still has to give a standard target so ebtables knows what to do. ++The default target is ++.BR ACCEPT ". Making it " CONTINUE " can let you do other" ++things with the frame in subsequent rules of the chain. ++.SS redirect ++The ++.B redirect ++target will change the MAC target address to that of the bridge device the ++frame arrived on. This target can only be used in the ++.BR BROUTING " chain of the " broute " table and the " ++.BR PREROUTING " chain of the " nat " table." ++In the ++.BR BROUTING " chain, the MAC address of the bridge port is used as destination address," ++.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used." ++.TP ++.BR "--redirect-target " "\fItarget\fP" ++.br ++Specifies the standard target. After doing the MAC redirect, the rule ++still has to give a standard target so ebtables knows what to do. ++The default target is ++.BR ACCEPT ". Making it " CONTINUE " could let you use" ++multiple target extensions on the same frame. Making it ++.BR DROP " in the " BROUTING " chain will let the frames be routed. " RETURN " is also allowed. Note" ++.BR "" "that using " RETURN " in a base chain is not allowed." ++.SS snat ++The ++.B snat ++target can only be used in the ++.BR POSTROUTING " chain of the " nat " table." ++It specifies that the source MAC address has to be changed. ++.TP ++.BR "--to-source " "\fIaddress\fP" ++.br ++Changes the source MAC address to the specified ++.IR address ". The flag" ++.B --to-src ++is an alias for this option. ++.TP ++.BR "--snat-target " "\fItarget\fP" ++.br ++Specifies the standard target. After doing the snat, the rule still has ++to give a standard target so ebtables knows what to do. ++.BR "" "The default target is " ACCEPT ". Making it " CONTINUE " could let you use" ++.BR "" "multiple target extensions on the same frame. Making it " DROP " doesn't" ++.BR "" "make sense, but you could do that too. " RETURN " is also allowed. Note" ++.BR "" "that using " RETURN " in a base chain is not allowed." ++.br ++.TP ++.BR "--snat-arp " ++.br ++Also change the hardware source address inside the arp header if the packet is an ++arp message and the hardware address length in the arp header is 6 bytes. ++.br ++.SH FILES ++.I /etc/ethertypes ++.I /var/lib/ebtables/lock ++.SH ENVIRONMENT VARIABLES ++.I EBTABLES_ATOMIC_FILE ++.SH MAILINGLISTS ++.BR "" "See " http://netfilter.org/mailinglists.html ++.SH SEE ALSO ++.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8) ++.PP ++.BR "" "See " http://ebtables.sf.net +-- +2.21.0 + diff --git a/0006-doc-Adjust-ebtables-man-page.patch b/0006-doc-Adjust-ebtables-man-page.patch new file mode 100644 index 0000000..58c2c22 --- /dev/null +++ b/0006-doc-Adjust-ebtables-man-page.patch @@ -0,0 +1,275 @@ +From a3310b304ca75f45505b89071b1537a6fcc97228 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 13 Mar 2019 20:46:15 +0100 +Subject: [PATCH] doc: Adjust ebtables man page + +Change content to match nft-variant, most notably: + +* There is no broute table, drop all references to it +* Comment out description of among and string matches, we don't support + them (yet) + +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +(cherry picked from commit 1939cbc25e6f51cebaa7a2d71c45bb312bab8668) +Signed-off-by: Phil Sutter +--- + iptables/ebtables-nft.8 | 164 ++++++++++++++++------------------------ + 1 file changed, 67 insertions(+), 97 deletions(-) + +diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 +index 55204ab91e8a4..db8b2ab28cca5 100644 +--- a/iptables/ebtables-nft.8 ++++ b/iptables/ebtables-nft.8 +@@ -24,7 +24,7 @@ + .\" + .\" + .SH NAME +-ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legacy) ++ebtables \- Ethernet bridge frame table administration (nft-based) + .SH SYNOPSIS + .BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" + .br +@@ -51,17 +51,6 @@ ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legac + .BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save + .br + +-.SH LEGACY +-This tool uses the old xtables/setsockopt framework, and is a legacy version +-of ebtables. That means that a new, more modern tool exists with the same +-functionality using the nf_tables framework and you are encouraged to migrate now. +-The new binaries (known as ebtables-nft and formerly known as ebtables-compat) +-uses the same syntax and semantics than this legacy one. +- +-You can still use this legacy tool. You should probably get some specific +-information from your Linux distribution or vendor. +-More docs are available at https://wiki.nftables.org +- + .SH DESCRIPTION + .B ebtables + is an application program used to set up and maintain the +@@ -72,7 +61,7 @@ It is analogous to the + application, but less complicated, due to the fact that the Ethernet protocol + is much simpler than the IP protocol. + .SS CHAINS +-There are three ebtables tables with built-in chains in the ++There are two ebtables tables with built-in chains in the + Linux kernel. These tables are used to divide functionality into + different sets of rules. Each set of rules is called a chain. + Each chain is an ordered list of rules that can match Ethernet frames. If a +@@ -98,10 +87,7 @@ an 'extension' (see below) or a jump to a user-defined chain. + .B ACCEPT + means to let the frame through. + .B DROP +-means the frame has to be dropped. In the +-.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different" +-meanings (see the info provided for the +-.BR -t " option)." ++means the frame has to be dropped. + .B CONTINUE + means the next rule has to be checked. This can be handy, f.e., to know how many + frames pass a certain point in the chain, to log those frames or to apply multiple +@@ -113,14 +99,16 @@ For the extension targets please refer to the + .B "TARGET EXTENSIONS" + section of this man page. + .SS TABLES +-As stated earlier, there are three ebtables tables in the Linux ++As stated earlier, there are two ebtables tables in the Linux + kernel. The table names are +-.BR filter ", " nat " and " broute . +-Of these three tables, ++.BR filter " and " nat . ++Of these two tables, + the filter table is the default table that the command operates on. + If you are working with the filter table, then you can drop the '-t filter' + argument to the ebtables command. However, you will need to provide +-the -t argument for the other two tables. Moreover, the -t argument must be the ++the -t argument for ++.B nat ++table. Moreover, the -t argument must be the + first argument on the ebtables command line, if used. + .TP + .B "-t, --table" +@@ -149,25 +137,6 @@ iptables world to ebtables it is easier to have the same names. Note that you + can change the name + .BR "" ( -E ) + if you don't like the default. +-.br +-.br +-.B broute +-is used to make a brouter, it has one built-in chain: +-.BR BROUTING . +-The targets +-.BR DROP " and " ACCEPT +-have a special meaning in the broute table (these names are used instead of +-more descriptive names to keep the implementation generic). +-.B DROP +-actually means the frame has to be routed, while +-.B ACCEPT +-means the frame has to be bridged. The +-.B BROUTING +-chain is traversed very early. However, it is only traversed by frames entering on +-a bridge port that is in forwarding state. Normally those frames +-would be bridged, but you can decide otherwise here. The +-.B redirect +-target is very handy here. + .SH EBTABLES COMMAND LINE ARGUMENTS + After the initial ebtables '-t table' command line argument, the remaining + arguments can be divided into several groups. These groups +@@ -553,35 +522,35 @@ If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must + be consulted to determine the payload protocol. This is a two byte + (hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are + checked for type. +-.SS among +-Match a MAC address or MAC/IP address pair versus a list of MAC addresses +-and MAC/IP address pairs. +-A list entry has the following format: +-.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" +-list entries are separated by a comma, specifying an IP address corresponding to +-the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address +-but different IP address (and vice versa) can be specified. If the MAC address doesn't +-match any entry from the list, the frame doesn't match the rule (unless "!" was used). +-.TP +-.BR "--among-dst " "[!] \fIlist\fP" +-Compare the MAC destination to the given list. If the Ethernet frame has type +-.IR IPv4 " or " ARP , +-then comparison with MAC/IP destination address pairs from the +-list is possible. +-.TP +-.BR "--among-src " "[!] \fIlist\fP" +-Compare the MAC source to the given list. If the Ethernet frame has type +-.IR IPv4 " or " ARP , +-then comparison with MAC/IP source address pairs from the list +-is possible. +-.TP +-.BR "--among-dst-file " "[!] \fIfile\fP" +-Same as +-.BR --among-dst " but the list is read in from the specified file." +-.TP +-.BR "--among-src-file " "[!] \fIfile\fP" +-Same as +-.BR --among-src " but the list is read in from the specified file." ++.\" .SS among ++.\" Match a MAC address or MAC/IP address pair versus a list of MAC addresses ++.\" and MAC/IP address pairs. ++.\" A list entry has the following format: ++.\" .IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" ++.\" list entries are separated by a comma, specifying an IP address corresponding to ++.\" the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address ++.\" but different IP address (and vice versa) can be specified. If the MAC address doesn't ++.\" match any entry from the list, the frame doesn't match the rule (unless "!" was used). ++.\" .TP ++.\" .BR "--among-dst " "[!] \fIlist\fP" ++.\" Compare the MAC destination to the given list. If the Ethernet frame has type ++.\" .IR IPv4 " or " ARP , ++.\" then comparison with MAC/IP destination address pairs from the ++.\" list is possible. ++.\" .TP ++.\" .BR "--among-src " "[!] \fIlist\fP" ++.\" Compare the MAC source to the given list. If the Ethernet frame has type ++.\" .IR IPv4 " or " ARP , ++.\" then comparison with MAC/IP source address pairs from the list ++.\" is possible. ++.\" .TP ++.\" .BR "--among-dst-file " "[!] \fIfile\fP" ++.\" Same as ++.\" .BR --among-dst " but the list is read in from the specified file." ++.\" .TP ++.\" .BR "--among-src-file " "[!] \fIfile\fP" ++.\" Same as ++.\" .BR --among-src " but the list is read in from the specified file." + .SS arp + Specify (R)ARP fields. The protocol must be specified as + .IR ARP " or " RARP . +@@ -822,26 +791,26 @@ The hello time timer (0-65535) range. + .TP + .BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]" + The forward delay timer (0-65535) range. +-.SS string +-This module matches on a given string using some pattern matching strategy. +-.TP +-.BR "--string-algo " "\fIalgorithm\fP" +-The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) +-.TP +-.BR "--string-from " "\fIoffset\fP" +-The lowest offset from which a match can start. (default: 0) +-.TP +-.BR "--string-to " "\fIoffset\fP" +-The highest offset from which a match can start. (default: size of frame) +-.TP +-.BR "--string " "[!] \fIpattern\fP" +-Matches the given pattern. +-.TP +-.BR "--string-hex " "[!] \fIpattern\fP" +-Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' +-.TP +-.BR "--string-icase" +-Ignore case when searching. ++.\" .SS string ++.\" This module matches on a given string using some pattern matching strategy. ++.\" .TP ++.\" .BR "--string-algo " "\fIalgorithm\fP" ++.\" The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) ++.\" .TP ++.\" .BR "--string-from " "\fIoffset\fP" ++.\" The lowest offset from which a match can start. (default: 0) ++.\" .TP ++.\" .BR "--string-to " "\fIoffset\fP" ++.\" The highest offset from which a match can start. (default: size of frame) ++.\" .TP ++.\" .BR "--string " "[!] \fIpattern\fP" ++.\" Matches the given pattern. ++.\" .TP ++.\" .BR "--string-hex " "[!] \fIpattern\fP" ++.\" Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' ++.\" .TP ++.\" .BR "--string-icase" ++.\" Ignore case when searching. + .SS vlan + Specify 802.1Q Tag Control Information fields. + The protocol must be specified as +@@ -1026,7 +995,6 @@ The default target + The + .B dnat + target can only be used in the +-.BR BROUTING " chain of the " broute " table and the " + .BR PREROUTING " and " OUTPUT " chains of the " nat " table." + It specifies that the destination MAC address has to be changed. + .TP +@@ -1089,11 +1057,8 @@ The + .B redirect + target will change the MAC target address to that of the bridge device the + frame arrived on. This target can only be used in the +-.BR BROUTING " chain of the " broute " table and the " + .BR PREROUTING " chain of the " nat " table." +-In the +-.BR BROUTING " chain, the MAC address of the bridge port is used as destination address," +-.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used." ++The MAC address of the bridge is used as destination address." + .TP + .BR "--redirect-target " "\fItarget\fP" + .br +@@ -1135,12 +1100,17 @@ arp message and the hardware address length in the arp header is 6 bytes. + .br + .SH FILES + .I /etc/ethertypes +-.I /var/lib/ebtables/lock + .SH ENVIRONMENT VARIABLES + .I EBTABLES_ATOMIC_FILE + .SH MAILINGLISTS + .BR "" "See " http://netfilter.org/mailinglists.html ++.SH BUGS ++The version of ebtables this man page ships with does not support the ++.B broute ++table. Also there is no support for ++.BR among " and " string ++matches. And finally, this list is probably not complete. + .SH SEE ALSO +-.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8) ++.BR xtables-nft "(8), " iptables "(8), " ip (8) + .PP +-.BR "" "See " http://ebtables.sf.net ++.BR "" "See " https://wiki.nftables.org +-- +2.21.0 + diff --git a/arptables-nft-helper b/arptables-nft-helper new file mode 100644 index 0000000..8bb0629 --- /dev/null +++ b/arptables-nft-helper @@ -0,0 +1,68 @@ +#!/bin/sh +# config: /etc/sysconfig/arptables + +# Source 'em up +. /etc/init.d/functions + +ARPTABLES_CONFIG=/etc/sysconfig/arptables + +start() { + if [ ! -x /usr/sbin/arptables ]; then + exit 4 + fi + + # don't do squat if we don't have the config file + if [ -f $ARPTABLES_CONFIG ]; then + echo -n $"Applying arptables firewall rules: " + /usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \ + success || \ + failure + echo + touch /var/lock/subsys/arptables + else + failure + echo + echo $"Configuration file /etc/sysconfig/arptables missing" + exit 6 + fi +} + +stop() { + echo -n $"Removing user defined chains:" + arptables -X && success || failure + echo -n $"Flushing all chains:" + arptables -F && success || failure + echo -n $"Resetting built-in chains to the default ACCEPT policy:" + arptables -P INPUT ACCEPT && \ + arptables -P OUTPUT ACCEPT && \ + success || \ + failure + echo + rm -f /var/lock/subsys/arptables +} + +case "$1" in +start) + start + ;; + +stop) + stop + ;; + +restart|reload) + # "restart" is really just "start" as this isn't a daemon, + # and "start" clears any pre-defined rules anyway. + # This is really only here to make those who expect it happy + start + ;; + +condrestart|try-restart|force-reload) + [ -e /var/lock/subsys/arptables ] && start + ;; + +*) + exit 2 +esac + +exit 0 diff --git a/iptables-1.6.0-iptables-apply_mktemp.patch b/iptables-1.6.0-iptables-apply_mktemp.patch deleted file mode 100644 index 607a611..0000000 --- a/iptables-1.6.0-iptables-apply_mktemp.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -up iptables-1.6.0/iptables/iptables-apply.iptables-apply_mktemp iptables-1.6.0/iptables/iptables-apply ---- iptables-1.6.0/iptables/iptables-apply.iptables-apply_mktemp 2015-12-09 13:55:06.000000000 +0100 -+++ iptables-1.6.0/iptables/iptables-apply 2016-04-13 17:44:07.130453958 +0200 -@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then - exit 2 - fi - --COMMANDS=(tempfile "$SAVE" "$RESTORE") -+COMMANDS=(mktemp "$SAVE" "$RESTORE") - - for cmd in "${COMMANDS[@]}"; do - if ! command -v $cmd >/dev/null; then -@@ -122,7 +122,7 @@ done - - umask 0700 - --TMPFILE=$(tempfile -p iptap) -+TMPFILE=$(mktemp) - trap "rm -f $TMPFILE" EXIT 1 2 3 4 5 6 7 8 10 11 12 13 14 15 - - if ! "$SAVE" >"$TMPFILE"; then diff --git a/iptables-1.8.0-xtables-nft-multi.patch b/iptables-1.8.0-xtables-nft-multi.patch deleted file mode 100644 index f1f5ab8..0000000 --- a/iptables-1.8.0-xtables-nft-multi.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff --git a/iptables/xtables-nft-multi.c b/iptables/xtables-nft-multi.c -index 187da81e9f59b..03690a56edb72 100644 ---- a/iptables/xtables-nft-multi.c -+++ b/iptables/xtables-nft-multi.c -@@ -31,8 +31,10 @@ static const struct subcommand multi_subcommands[] = { - {"iptables-restore-translate", xtables_ip4_xlate_restore_main}, - {"ip6tables-restore-translate", xtables_ip6_xlate_restore_main}, - {"arptables", xtables_arp_main}, -+ {"arptables-nft", xtables_arp_main}, - {"ebtables-translate", xtables_eb_xlate_main}, - {"ebtables", xtables_eb_main}, -+ {"ebtables-nft", xtables_eb_main}, - {"xtables-monitor", xtables_monitor_main}, - {NULL}, - }; diff --git a/iptables.spec b/iptables.spec index f1a077c..26996e1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -6,16 +6,21 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities -Version: 1.8.0 -Release: 5%{?dist} +Version: 1.8.2 +Release: 1%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config Source3: iptables.service Source4: sysconfig_iptables Source5: sysconfig_ip6tables -Patch1: iptables-1.6.0-iptables-apply_mktemp.patch -Patch2: iptables-1.8.0-xtables-nft-multi.patch +Source6: arptables-nft-helper +Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +Patch2: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch +Patch3: 0003-doc-Add-arptables-nft-man-pages.patch +Patch4: 0004-doc-Adjust-arptables-man-pages.patch +Patch5: 0005-doc-Add-ebtables-man-page.patch +Patch6: 0006-doc-Adjust-ebtables-man-page.patch URL: http://www.netfilter.org/ # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -38,6 +43,10 @@ BuildRequires: pkgconfig(libmnl) >= 1.0 BuildRequires: pkgconfig(libnftnl) >= 1.0.5 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel +BuildRequires: autogen +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: libtool Requires: %{name}-libs%{?_isa} = %{version}-%{release} %if 0%{?fedora} > 24 Conflicts: setup < 2.10.4-1 @@ -102,16 +111,16 @@ Currently only provides nfnl_osf with the pf.os database. Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name} = %{version}-%{release} Obsoletes: iptables-compat < 1.6.2-4 +Provides: arptables-helper %description nft nftables compatibility for iptables, arptables and ebtables. %prep -%setup -q -%patch1 -p1 -b .iptables-apply_mktemp -%patch2 -p1 -b .iptables-xtables_nft_multi +%autosetup -p1 %build +./autogen.sh CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ %configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr @@ -184,14 +193,14 @@ install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/ rm -f %{buildroot}%{_sysconfdir}/ethertypes %endif -# rename ebtables and arptables to avoid conflicts -mv %{buildroot}%{_sbindir}/ebtables %{buildroot}%{_sbindir}/ebtables-nft -mv %{buildroot}%{_sbindir}/arptables %{buildroot}%{_sbindir}/arptables-nft +install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ +touch %{buildroot}%{_libexecdir}/arptables-helper -touch %{buildroot}%{_sbindir}/ebtables -touch %{buildroot}%{_sbindir}/arptables -touch %{buildroot}%{_sbindir}/iptables -touch %{buildroot}%{_sbindir}/ip6tables +# prepare for alternatives +touch %{buildroot}%{_mandir}/man8/arptables.8 +touch %{buildroot}%{_mandir}/man8/arptables-save.8 +touch %{buildroot}%{_mandir}/man8/arptables-restore.8 +touch %{buildroot}%{_mandir}/man8/ebtables.8 %ldconfig_scriptlets @@ -233,13 +242,44 @@ pfx6=%{_sbindir}/ip6tables --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -for cmd in ebtables arptables; do - if [ "$(readlink -e %{_sbindir}/$cmd)" == %{_sbindir}/$cmd ]; then - rm -f %{_sbindir}/$cmd +pfx=%{_sbindir}/ebtables +manpfx=%{_mandir}/man8/ebtables +for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx fi - %{_sbindir}/update-alternatives --install \ - %{_sbindir}/$cmd $cmd %{_sbindir}/$cmd-nft 5 done +if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then + rm -f $manpfx.8.gz +fi +%{_sbindir}/update-alternatives --install \ + $pfx ebtables $pfx-nft 5 \ + --slave $pfx-save ebtables-save $pfx-nft-save \ + --slave $pfx-restore ebtables-restore $pfx-nft-restore \ + --slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz + +pfx=%{_sbindir}/arptables +manpfx=%{_mandir}/man8/arptables +lepfx=%{_libexecdir}/arptables +for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then + rm -f $manpfx$sfx.8.gz + fi +done +if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then + rm -f $lepfx-helper +fi +%{_sbindir}/update-alternatives --install \ + $pfx arptables $pfx-nft 5 \ + --slave $pfx-save arptables-save $pfx-nft-save \ + --slave $pfx-restore arptables-restore $pfx-nft-restore \ + --slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \ + --slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \ + --slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \ + --slave $lepfx-helper arptables-helper $lepfx-nft-helper %postun nft if [ $1 -eq 0 ]; then @@ -253,8 +293,6 @@ fi %{!?_licensedir:%global license %%doc} %license COPYING %doc INCOMPATIBILITIES -%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config -%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config %if 0%{?fedora} <= 24 %{_sysconfdir}/ethertypes %endif @@ -306,6 +344,8 @@ fi %{script_path}/ip6tables.init %config(noreplace) %{_sysconfdir}/sysconfig/iptables %config(noreplace) %{_sysconfdir}/sysconfig/ip6tables +%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config +%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config %{_unitdir}/iptables.service %{_unitdir}/ip6tables.service %dir %{legacy_actions}/iptables @@ -328,13 +368,14 @@ fi %{_sbindir}/ip6tables-nft* %{_sbindir}/ip6tables-restore-translate %{_sbindir}/ip6tables-translate -%{_sbindir}/ebtables-nft -%{_sbindir}/arptables-nft +%{_sbindir}/ebtables-nft* +%{_sbindir}/arptables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor +%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* -%{_mandir}/man8/xtables-nft* %{_mandir}/man8/xtables-translate* +%{_mandir}/man8/*-nft* %ghost %{_sbindir}/iptables %ghost %{_sbindir}/iptables-restore %ghost %{_sbindir}/iptables-save @@ -342,9 +383,25 @@ fi %ghost %{_sbindir}/ip6tables-restore %ghost %{_sbindir}/ip6tables-save %ghost %{_sbindir}/ebtables +%ghost %{_sbindir}/ebtables-save +%ghost %{_sbindir}/ebtables-restore %ghost %{_sbindir}/arptables +%ghost %{_sbindir}/arptables-save +%ghost %{_sbindir}/arptables-restore +%ghost %{_libexecdir}/arptables-helper +%ghost %{_mandir}/man8/arptables.8.gz +%ghost %{_mandir}/man8/arptables-save.8.gz +%ghost %{_mandir}/man8/arptables-restore.8.gz +%ghost %{_mandir}/man8/ebtables.8.gz + %changelog +* Mon Apr 15 2019 Phil Sutter - 1.8.2-1 +- New upstream version 1.8.2 +- Integrate ebtables and arptables save/restore scripts with alternatives +- Add nft-specific ebtables and arptables man pages +- Move /etc/sysconfig/ip*tables-config files into services sub-package + * Fri Feb 01 2019 Fedora Release Engineering - 1.8.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 5350adb4e29203b3321bb3d9c0dce314d71d73f1 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 24 Apr 2019 19:11:56 +0200 Subject: [PATCH 009/100] Update sources and .gitignore --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 202af89..dc8f3ac 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /iptables-1.6.2.tar.bz2 /iptables-1.8.0.tar.bz2 +/iptables-1.8.2.tar.bz2 diff --git a/sources b/sources index 10e8a70..d0b6fc7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.0.tar.bz2) = 5f3fe4c15f02e29a2e6ee2905a242f450f8a3b51553618e0cdc59301c35b8bb663e8f2ea70dfcaed8d4e53192c01519906b60ff649385c693e0602622742890f +SHA512 (iptables-1.8.2.tar.bz2) = 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76 From 5b754cea1af9caad55d6666e9de750e3332ecc13 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Jun 2019 11:58:42 +0200 Subject: [PATCH 010/100] iptables-1.8.3-1 - New upstream version 1.8.3 --- .gitignore | 1 + iptables.spec | 12 +++++------- sources | 2 +- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index dc8f3ac..b08866a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /iptables-1.6.2.tar.bz2 /iptables-1.8.0.tar.bz2 /iptables-1.8.2.tar.bz2 +/iptables-1.8.3.tar.bz2 diff --git a/iptables.spec b/iptables.spec index 26996e1..8488a98 100644 --- a/iptables.spec +++ b/iptables.spec @@ -6,7 +6,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities -Version: 1.8.2 +Version: 1.8.3 Release: 1%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init @@ -16,11 +16,6 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch -Patch2: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch -Patch3: 0003-doc-Add-arptables-nft-man-pages.patch -Patch4: 0004-doc-Adjust-arptables-man-pages.patch -Patch5: 0005-doc-Add-ebtables-man-page.patch -Patch6: 0006-doc-Adjust-ebtables-man-page.patch URL: http://www.netfilter.org/ # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -33,7 +28,7 @@ BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers BuildRequires: systemd -BuildRequires: pkgconfig(libnftnl) +BuildRequires: pkgconfig(libnftnl) >= 1.1.3 BuildRequires: pkgconfig(libmnl) >= 1.0 # libmnl, libnftnl, bison, flex for nftables BuildRequires: bison @@ -396,6 +391,9 @@ fi %changelog +* Wed May 29 2019 Phil Sutter - 1.8.3-1 +- New upstream version 1.8.3 + * Mon Apr 15 2019 Phil Sutter - 1.8.2-1 - New upstream version 1.8.2 - Integrate ebtables and arptables save/restore scripts with alternatives diff --git a/sources b/sources index d0b6fc7..a175f1e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.2.tar.bz2) = 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76 +SHA512 (iptables-1.8.3.tar.bz2) = 84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d From 28d2f32245ea38bc6d8e9a374a0ad33129dfb380 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Jun 2019 12:16:40 +0200 Subject: [PATCH 011/100] iptables-1.8.3-2 - Install new man page for nfbpf_compile utility - Move nfnl_osf man page to utils subpackage --- iptables.spec | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/iptables.spec b/iptables.spec index 8488a98..a843584 100644 --- a/iptables.spec +++ b/iptables.spec @@ -7,7 +7,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities Version: 1.8.3 -Release: 1%{?dist} +Release: 2%{?dist} Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -98,9 +98,10 @@ Summary: iptables and ip6tables services for iptables Requires: %{name} = %{version}-%{release} %description utils -Utils for iptables. +Utils for iptables -Currently only provides nfnl_osf with the pf.os database. +This package provides nfnl_osf with the pf.os database and nfbpf_compile, +a bytecode generator for use with xt_bpf. %package nft Summary: nftables compatibility for iptables, arptables and ebtables @@ -299,7 +300,6 @@ fi %{_mandir}/man1/iptables-xml* %{_mandir}/man8/iptables* %{_mandir}/man8/ip6tables* -%{_mandir}/man8/nfnl_osf* %{_mandir}/man8/xtables-legacy* %dir %{_libdir}/xtables %{_libdir}/xtables/libarpt* @@ -355,6 +355,8 @@ fi %{_sbindir}/nfbpf_compile %dir %{_datadir}/xtables %{_datadir}/xtables/pf.os +%{_mandir}/man8/nfnl_osf* +%{_mandir}/man8/nfbpf_compile* %files nft %{_sbindir}/iptables-nft* @@ -391,6 +393,10 @@ fi %changelog +* Tue Jun 25 2019 Phil Sutter - 1.8.3-2 +- Install new man page for nfbpf_compile utility +- Move nfnl_osf man page to utils subpackage + * Wed May 29 2019 Phil Sutter - 1.8.3-1 - New upstream version 1.8.3 From 972fb0a368223bc0b10c119b043a4efdf4301085 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Jun 2019 16:26:43 +0200 Subject: [PATCH 012/100] iptables-1.8.3-3 - Change URL to point at iptables project, not netfilter overview page - Reuse URL value in tarball source - Reduce globbing of library file names to expose future SONAME changes - Add bootstrapping for libip*tc SONAME bump --- 0003-doc-Add-arptables-nft-man-pages.patch | 486 -------- 0004-doc-Adjust-arptables-man-pages.patch | 192 ---- 0005-doc-Add-ebtables-man-page.patch | 1186 -------------------- 0006-doc-Adjust-ebtables-man-page.patch | 275 ----- iptables.spec | 65 +- 5 files changed, 60 insertions(+), 2144 deletions(-) delete mode 100644 0003-doc-Add-arptables-nft-man-pages.patch delete mode 100644 0004-doc-Adjust-arptables-man-pages.patch delete mode 100644 0005-doc-Add-ebtables-man-page.patch delete mode 100644 0006-doc-Adjust-ebtables-man-page.patch diff --git a/0003-doc-Add-arptables-nft-man-pages.patch b/0003-doc-Add-arptables-nft-man-pages.patch deleted file mode 100644 index b4bae67..0000000 --- a/0003-doc-Add-arptables-nft-man-pages.patch +++ /dev/null @@ -1,486 +0,0 @@ -From 1d0089550ab9882ac90d0fc673f213c51e133552 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 13 Mar 2019 20:46:12 +0100 -Subject: [PATCH] doc: Add arptables-nft man pages - -These are 1:1 copies from legacy arptables repository. - -Signed-off-by: Phil Sutter -Signed-off-by: Florian Westphal -(cherry picked from commit 4dbb6b9118e32a9b748ead893106de59579424f5) -Signed-off-by: Phil Sutter ---- - iptables/Makefile.am | 3 + - iptables/arptables-nft-restore.8 | 41 ++++ - iptables/arptables-nft-save.8 | 37 ++++ - iptables/arptables-nft.8 | 352 +++++++++++++++++++++++++++++++ - 4 files changed, 433 insertions(+) - create mode 100644 iptables/arptables-nft-restore.8 - create mode 100644 iptables/arptables-nft-save.8 - create mode 100644 iptables/arptables-nft.8 - -diff --git a/iptables/Makefile.am b/iptables/Makefile.am -index 581dc32ba846b..52309679d390c 100644 ---- a/iptables/Makefile.am -+++ b/iptables/Makefile.am -@@ -63,6 +63,9 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ - ip6tables-save.8 iptables-extensions.8 \ - xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ - xtables-monitor.8 -+if ENABLE_NFTABLES -+man_MANS += arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 -+endif - CLEANFILES = iptables.8 xtables-monitor.8 \ - xtables-config-parser.c xtables-config-syntax.c - -diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8 -new file mode 100644 -index 0000000000000..4f2f623673415 ---- /dev/null -+++ b/iptables/arptables-nft-restore.8 -@@ -0,0 +1,41 @@ -+.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" "" -+.\" -+.\" Man page written by Jesper Dangaard Brouer based on a -+.\" Man page written by Harald Welte -+.\" It is based on the iptables-restore man page. -+.\" -+.\" This program is free software; you can redistribute it and/or modify -+.\" it under the terms of the GNU General Public License as published by -+.\" the Free Software Foundation; either version 2 of the License, or -+.\" (at your option) any later version. -+.\" -+.\" This program is distributed in the hope that it will be useful, -+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of -+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+.\" GNU General Public License for more details. -+.\" -+.\" You should have received a copy of the GNU General Public License -+.\" along with this program; if not, write to the Free Software -+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -+.\" -+.\" -+.SH NAME -+arptables-restore \(em Restore ARP Tables -+.SH SYNOPSIS -+\fBarptables\-restore -+.SH DESCRIPTION -+.PP -+.B arptables-restore -+is used to restore ARP Tables from data specified on STDIN or -+via a file as first argument. -+Use I/O redirection provided by your shell to read from a file -+.TP -+.B arptables-restore -+flushes (deletes) all previous contents of the respective ARP Table. -+.SH BUGS -+None known as of arptables-0.0.4 release -+.SH AUTHOR -+Jesper Dangaard Brouer -+.SH SEE ALSO -+\fBarptables\-save\fP(8), \fBarptables\fP(8) -+.PP -diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8 -new file mode 100644 -index 0000000000000..34791a9c087f0 ---- /dev/null -+++ b/iptables/arptables-nft-save.8 -@@ -0,0 +1,37 @@ -+.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" "" -+.\" -+.\" Man page written by Jesper Dangaard Brouer based on a -+.\" Man page written by Harald Welte -+.\" It is based on the iptables-save man page. -+.\" -+.\" This program is free software; you can redistribute it and/or modify -+.\" it under the terms of the GNU General Public License as published by -+.\" the Free Software Foundation; either version 2 of the License, or -+.\" (at your option) any later version. -+.\" -+.\" This program is distributed in the hope that it will be useful, -+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of -+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+.\" GNU General Public License for more details. -+.\" -+.\" You should have received a copy of the GNU General Public License -+.\" along with this program; if not, write to the Free Software -+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -+.\" -+.\" -+.SH NAME -+arptables-save \(em dump arptables rules to stdout -+.SH SYNOPSIS -+\fBarptables\-save -+.SH DESCRIPTION -+.PP -+.B arptables-save -+is used to dump the contents of an ARP Table in easily parseable format -+to STDOUT. Use I/O-redirection provided by your shell to write to a file. -+.SH BUGS -+None known as of arptables-0.0.4 release -+.SH AUTHOR -+Jesper Dangaard Brouer -+.SH SEE ALSO -+\fBarptables\-restore\fP(8), \fBarptables\fP(8) -+.PP -diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8 -new file mode 100644 -index 0000000000000..3ce99e3757004 ---- /dev/null -+++ b/iptables/arptables-nft.8 -@@ -0,0 +1,352 @@ -+.TH ARPTABLES 8 "June 2018" -+.\" -+.\" Man page originally written by Jochen Friedrich , -+.\" maintained by Bart De Schuymer. -+.\" It is based on the iptables man page. -+.\" -+.\" Iptables page by Herve Eychenne March 2000. -+.\" -+.\" This program is free software; you can redistribute it and/or modify -+.\" it under the terms of the GNU General Public License as published by -+.\" the Free Software Foundation; either version 2 of the License, or -+.\" (at your option) any later version. -+.\" -+.\" This program is distributed in the hope that it will be useful, -+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of -+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+.\" GNU General Public License for more details. -+.\" -+.\" You should have received a copy of the GNU General Public License -+.\" along with this program; if not, write to the Free Software -+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -+.\" -+.\" -+.SH NAME -+arptables \- ARP table administration (legacy) -+.SH SYNOPSIS -+.BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ] -+.br -+.BR "arptables " [ "-t table" ] " -" [ RI ] " chain rulenum rule-specification " [ options ] -+.br -+.BR "arptables " [ "-t table" ] " -D chain rulenum " [ options ] -+.br -+.BR "arptables " [ "-t table" ] " -" [ "LFZ" ] " " [ chain ] " " [ options ] -+.br -+.BR "arptables " [ "-t table" ] " -" [ "NX" ] " chain" -+.br -+.BR "arptables " [ "-t table" ] " -E old-chain-name new-chain-name" -+.br -+.BR "arptables " [ "-t table" ] " -P chain target " [ options ] -+ -+.SH LEGACY -+This tool uses the old xtables/setsockopt framework, and is a legacy version -+of arptables. That means that a new, more modern tool exists with the same -+functionality using the nf_tables framework and you are encouraged to migrate now. -+The new binaries (formerly known as -compat) uses the same syntax and -+semantics than this legacy one. -+ -+You can still use this legacy tool. You should probably get some specific -+information from your Linux distribution or vendor. -+More docs are available at https://wiki.nftables.org -+ -+.SH DESCRIPTION -+.B arptables -+is a user space tool, it is used to set up and maintain the -+tables of ARP rules in the Linux kernel. These rules inspect -+the ARP frames which they see. -+.B arptables -+is analogous to the -+.B iptables -+user space tool, but -+.B arptables -+is less complicated. -+ -+.SS CHAINS -+The kernel table is used to divide functionality into -+different sets of rules. Each set of rules is called a chain. -+Each chain is an ordered list of rules that can match ARP frames. If a -+rule matches an ARP frame, then a processing specification tells -+what to do with that matching frame. The processing specification is -+called a 'target'. However, if the frame does not match the current -+rule in the chain, then the next rule in the chain is examined and so forth. -+The user can create new (user-defined) chains which can be used as the 'target' of a rule. -+ -+.SS TARGETS -+A firewall rule specifies criteria for an ARP frame and a frame -+processing specification called a target. When a frame matches a rule, -+then the next action performed by the kernel is specified by the target. -+The target can be one of these values: -+.IR ACCEPT , -+.IR DROP , -+.IR CONTINUE , -+.IR RETURN , -+an 'extension' (see below) or a user-defined chain. -+.PP -+.I ACCEPT -+means to let the frame through. -+.I DROP -+means the frame has to be dropped. -+.I CONTINUE -+means the next rule has to be checked. This can be handy to know how many -+frames pass a certain point in the chain or to log those frames. -+.I RETURN -+means stop traversing this chain and resume at the next rule in the -+previous (calling) chain. -+For the extension targets please see the -+.B "TARGET EXTENSIONS" -+section of this man page. -+.SS TABLES -+There is only one ARP table in the Linux -+kernel. The table is -+.BR filter. -+You can drop the '-t filter' argument to the arptables command. -+The -t argument must be the -+first argument on the arptables command line, if used. -+.TP -+.B "-t, --table" -+.br -+.BR filter , -+is the only table and contains two (Linux kernels 2.4.X) or three (Linux kernels 2.6.0 and later) built-in chains: -+.B INPUT -+(for frames destined for the host), -+.B OUTPUT -+(for locally-generated frames) and -+.B FORWARD -+(for frames being forwarded by the bridge code). The -+.B FORWARD -+chain doesn't exist in Linux 2.4.X kernels. -+.br -+.br -+.SH ARPTABLES COMMAND LINE ARGUMENTS -+After the initial arptables command line argument, the remaining -+arguments can be divided into several different groups. These groups -+are commands, miscellaneous commands, rule-specifications, match-extensions, -+and watcher-extensions. -+.SS COMMANDS -+The arptables command arguments specify the actions to perform on the table -+defined with the -t argument. If you do not use the -t argument to name -+a table, the commands apply to the default filter table. -+With the exception of the -+.B "-Z" -+command, only one command may be used on the command line at a time. -+.TP -+.B "-A, --append" -+Append a rule to the end of the selected chain. -+.TP -+.B "-D, --delete" -+Delete the specified rule from the selected chain. There are two ways to -+use this command. The first is by specifying an interval of rule numbers -+to delete, syntax: start_nr[:end_nr]. Using negative numbers is allowed, for more -+details about using negative numbers, see the -I command. The second usage is by -+specifying the complete rule as it would have been specified when it was added. -+.TP -+.B "-I, --insert" -+Insert the specified rule into the selected chain at the specified rule number. -+If the current number of rules equals N, then the specified number can be -+between -N and N+1. For a positive number i, it holds that i and i-N-1 specify the -+same place in the chain where the rule should be inserted. The number 0 specifies -+the place past the last rule in the chain and using this number is therefore -+equivalent with using the -A command. -+.TP -+.B "-R, --replace" -+Replaces the specified rule into the selected chain at the specified rule number. -+If the current number of rules equals N, then the specified number can be -+between 1 and N. i specifies the place in the chain where the rule should be replaced. -+.TP -+.B "-P, --policy" -+Set the policy for the chain to the given target. The policy can be -+.BR ACCEPT ", " DROP " or " RETURN . -+.TP -+.B "-F, --flush" -+Flush the selected chain. If no chain is selected, then every chain will be -+flushed. Flushing the chain does not change the policy of the -+chain, however. -+.TP -+.B "-Z, --zero" -+Set the counters of the selected chain to zero. If no chain is selected, all the counters -+are set to zero. The -+.B "-Z" -+command can be used in conjunction with the -+.B "-L" -+command. -+When both the -+.B "-Z" -+and -+.B "-L" -+commands are used together in this way, the rule counters are printed on the screen -+before they are set to zero. -+.TP -+.B "-L, --list" -+List all rules in the selected chain. If no chain is selected, all chains -+are listed. -+.TP -+.B "-N, --new-chain" -+Create a new user-defined chain with the given name. The number of -+user-defined chains is unlimited. A user-defined chain name has maximum -+length of 31 characters. -+.TP -+.B "-X, --delete-chain" -+Delete the specified user-defined chain. There must be no remaining references -+to the specified chain, otherwise -+.B arptables -+will refuse to delete it. If no chain is specified, all user-defined -+chains that aren't referenced will be removed. -+.TP -+.B "-E, --rename-chain" -+Rename the specified chain to a new name. Besides renaming a user-defined -+chain, you may rename a standard chain name to a name that suits your -+taste. For example, if you like PREBRIDGING more than PREROUTING, -+then you can use the -E command to rename the PREROUTING chain. If you do -+rename one of the standard -+.B arptables -+chain names, please be sure to mention -+this fact should you post a question on the -+.B arptables -+mailing lists. -+It would be wise to use the standard name in your post. Renaming a standard -+.B arptables -+chain in this fashion has no effect on the structure or function -+of the -+.B arptables -+kernel table. -+ -+.SS MISCELLANOUS COMMANDS -+.TP -+.B "-V, --version" -+Show the version of the arptables userspace program. -+.TP -+.B "-h, --help" -+Give a brief description of the command syntax. -+.TP -+.BR "-j, --jump " "\fItarget\fP" -+The target of the rule. This is one of the following values: -+.BR ACCEPT , -+.BR DROP , -+.BR CONTINUE , -+.BR RETURN , -+a target extension (see -+.BR "TARGET EXTENSIONS" ")" -+or a user-defined chain name. -+.TP -+.BI "-c, --set-counters " "PKTS BYTES" -+This enables the administrator to initialize the packet and byte -+counters of a rule (during -+.B INSERT, -+.B APPEND, -+.B REPLACE -+operations). -+ -+.SS RULE-SPECIFICATIONS -+The following command line arguments make up a rule specification (as used -+in the add and delete commands). A "!" option before the specification -+inverts the test for that specification. Apart from these standard rule -+specifications there are some other command line arguments of interest. -+.TP -+.BR "-s, --source-ip " "[!] \fIaddress\fP[/\fImask]\fP" -+The Source IP specification. -+.TP -+.BR "-d, --destination-ip " "[!] \fIaddress\fP[/\fImask]\fP" -+The Destination IP specification. -+.TP -+.BR "--source-mac " "[!] \fIaddress\fP[/\fImask\fP]" -+The source mac address. Both mask and address are written as 6 hexadecimal -+numbers separated by colons. -+.TP -+.BR "--destination-mac " "[!] \fIaddress\fP[/\fImask\fP]" -+The destination mac address. Both mask and address are written as 6 hexadecimal -+numbers separated by colons. -+.TP -+.BR "-i, --in-interface " "[!] \fIname\fP" -+The interface via which a frame is received (for the -+.BR INPUT " and " FORWARD -+chains). The flag -+.B --in-if -+is an alias for this option. -+.TP -+.BR "-o, --out-interface " "[!] \fIname\fP" -+The interface via which a frame is going to be sent (for the -+.BR OUTPUT " and " FORWARD -+chains). The flag -+.B --out-if -+is an alias for this option. -+.TP -+.BR "-l, --h-length " "\fIlength\fP[/\fImask\fP]" -+The hardware length (nr of bytes) -+.TP -+.BR "--opcode " "\fIcode\fP[/\fImask\fP] -+The operation code (2 bytes). Available values are: -+.BR 1 = Request -+.BR 2 = Reply -+.BR 3 = Request_Reverse -+.BR 4 = Reply_Reverse -+.BR 5 = DRARP_Request -+.BR 6 = DRARP_Reply -+.BR 7 = DRARP_Error -+.BR 8 = InARP_Request -+.BR 9 = ARP_NAK . -+.TP -+.BR "--h-type " "\fItype\fP[/\fImask\fP]" -+The hardware type (2 bytes, hexadecimal). Available values are: -+.BR 1 = Ethernet . -+.TP -+.BR "--proto-type " "\fItype\fP[/\fImask\fP]" -+The protocol type (2 bytes). Available values are: -+.BR 0x800 = IPv4 . -+ -+.SS TARGET-EXTENSIONS -+.B arptables -+extensions are precompiled into the userspace tool. So there is no need -+to explicitly load them with a -m option like in -+.BR iptables . -+However, these -+extensions deal with functionality supported by supplemental kernel modules. -+.SS mangle -+.TP -+.BR "--mangle-ip-s IP address" -+Mangles Source IP Address to given value. -+.TP -+.BR "--mangle-ip-d IP address" -+Mangles Destination IP Address to given value. -+.TP -+.BR "--mangle-mac-s MAC address" -+Mangles Source MAC Address to given value. -+.TP -+.BR "--mangle-mac-d MAC address" -+Mangles Destination MAC Address to given value. -+.TP -+.BR "--mangle-target target " -+Target of ARP mangle operation -+.BR "" ( DROP ", " CONTINUE " or " ACCEPT " -- default is " ACCEPT ). -+.SS CLASSIFY -+This module allows you to set the skb->priority value (and thus clas- -+sify the packet into a specific CBQ class). -+ -+.TP -+.BR "--set-class major:minor" -+ -+Set the major and minor class value. The values are always -+interpreted as hexadecimal even if no 0x prefix is given. -+ -+.SS MARK -+This module allows you to set the skb->mark value (and thus classify -+the packet by the mark in u32) -+ -+.TP -+.BR "--set-mark mark" -+Set the mark value. The values are always -+interpreted as hexadecimal even if no 0x prefix is given -+ -+.TP -+.BR "--and-mark mark" -+Binary AND the mark with bits. -+ -+.TP -+.BR "--or-mark mark" -+Binary OR the mark with bits. -+ -+.SH MAILINGLISTS -+.BR "" "See " http://netfilter.org/mailinglists.html -+.SH SEE ALSO -+.BR iptables "(8), " ebtables "(8), " arp "(8), " rarp "(8), " ifconfig "(8), " route (8) -+.PP -+.BR "" "See " http://ebtables.sf.net --- -2.21.0 - diff --git a/0004-doc-Adjust-arptables-man-pages.patch b/0004-doc-Adjust-arptables-man-pages.patch deleted file mode 100644 index 3bf16d5..0000000 --- a/0004-doc-Adjust-arptables-man-pages.patch +++ /dev/null @@ -1,192 +0,0 @@ -From 2efbd30ed9f1db90b32b556d0e3df16d05281bc7 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 13 Mar 2019 20:46:13 +0100 -Subject: [PATCH] doc: Adjust arptables man pages - -Change content to suit the shipped nft-based variant. Most relevant -changes: - -* FORWARD chain is not supported -* arptables-nft-save supports a few parameters - -Signed-off-by: Phil Sutter -Signed-off-by: Florian Westphal -(cherry picked from commit 1a0cd997d601794c7031346063b8b77f4af2a13e) -Signed-off-by: Phil Sutter ---- - iptables/arptables-nft-restore.8 | 6 ++-- - iptables/arptables-nft-save.8 | 20 +++++++++---- - iptables/arptables-nft.8 | 48 +++++++++++++++----------------- - 3 files changed, 39 insertions(+), 35 deletions(-) - -diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8 -index 4f2f623673415..09d9082cf9fd3 100644 ---- a/iptables/arptables-nft-restore.8 -+++ b/iptables/arptables-nft-restore.8 -@@ -1,4 +1,4 @@ --.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" "" -+.TH ARPTABLES-RESTORE 8 "March 2019" "" "" - .\" - .\" Man page written by Jesper Dangaard Brouer based on a - .\" Man page written by Harald Welte -@@ -20,7 +20,7 @@ - .\" - .\" - .SH NAME --arptables-restore \(em Restore ARP Tables -+arptables-restore \- Restore ARP Tables (nft-based) - .SH SYNOPSIS - \fBarptables\-restore - .SH DESCRIPTION -@@ -32,8 +32,6 @@ Use I/O redirection provided by your shell to read from a file - .TP - .B arptables-restore - flushes (deletes) all previous contents of the respective ARP Table. --.SH BUGS --None known as of arptables-0.0.4 release - .SH AUTHOR - Jesper Dangaard Brouer - .SH SEE ALSO -diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8 -index 34791a9c087f0..905e59854cc28 100644 ---- a/iptables/arptables-nft-save.8 -+++ b/iptables/arptables-nft-save.8 -@@ -1,4 +1,4 @@ --.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" "" -+.TH ARPTABLES-SAVE 8 "March 2019" "" "" - .\" - .\" Man page written by Jesper Dangaard Brouer based on a - .\" Man page written by Harald Welte -@@ -20,16 +20,26 @@ - .\" - .\" - .SH NAME --arptables-save \(em dump arptables rules to stdout -+arptables-save \- dump arptables rules to stdout (nft-based) - .SH SYNOPSIS --\fBarptables\-save -+\fBarptables\-save\fP [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP] -+.P -+\fBarptables\-save\fP [\fB\-V\fP] - .SH DESCRIPTION - .PP - .B arptables-save - is used to dump the contents of an ARP Table in easily parseable format - to STDOUT. Use I/O-redirection provided by your shell to write to a file. --.SH BUGS --None known as of arptables-0.0.4 release -+.TP -+\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP -+Specify the path to the modprobe program. By default, arptables-save will -+inspect /proc/sys/kernel/modprobe to determine the executable's path. -+.TP -+\fB\-c\fR, \fB\-\-counters\fR -+Include the current values of all packet and byte counters in the output. -+.TP -+\fB\-V\fR, \fB\-\-version\fR -+Print version information and exit. - .SH AUTHOR - Jesper Dangaard Brouer - .SH SEE ALSO -diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8 -index 3ce99e3757004..ea31e0842acd4 100644 ---- a/iptables/arptables-nft.8 -+++ b/iptables/arptables-nft.8 -@@ -1,4 +1,4 @@ --.TH ARPTABLES 8 "June 2018" -+.TH ARPTABLES 8 "March 2019" - .\" - .\" Man page originally written by Jochen Friedrich , - .\" maintained by Bart De Schuymer. -@@ -22,7 +22,7 @@ - .\" - .\" - .SH NAME --arptables \- ARP table administration (legacy) -+arptables \- ARP table administration (nft-based) - .SH SYNOPSIS - .BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ] - .br -@@ -38,17 +38,6 @@ arptables \- ARP table administration (legacy) - .br - .BR "arptables " [ "-t table" ] " -P chain target " [ options ] - --.SH LEGACY --This tool uses the old xtables/setsockopt framework, and is a legacy version --of arptables. That means that a new, more modern tool exists with the same --functionality using the nf_tables framework and you are encouraged to migrate now. --The new binaries (formerly known as -compat) uses the same syntax and --semantics than this legacy one. -- --You can still use this legacy tool. You should probably get some specific --information from your Linux distribution or vendor. --More docs are available at https://wiki.nftables.org -- - .SH DESCRIPTION - .B arptables - is a user space tool, it is used to set up and maintain the -@@ -106,15 +95,11 @@ first argument on the arptables command line, if used. - .B "-t, --table" - .br - .BR filter , --is the only table and contains two (Linux kernels 2.4.X) or three (Linux kernels 2.6.0 and later) built-in chains: -+is the only table and contains two built-in chains: - .B INPUT --(for frames destined for the host), -+(for frames destined for the host) and - .B OUTPUT --(for locally-generated frames) and --.B FORWARD --(for frames being forwarded by the bridge code). The --.B FORWARD --chain doesn't exist in Linux 2.4.X kernels. -+(for locally-generated frames). - .br - .br - .SH ARPTABLES COMMAND LINE ARGUMENTS -@@ -258,15 +243,15 @@ numbers separated by colons. - .TP - .BR "-i, --in-interface " "[!] \fIname\fP" - The interface via which a frame is received (for the --.BR INPUT " and " FORWARD --chains). The flag -+.B INPUT -+chain). The flag - .B --in-if - is an alias for this option. - .TP - .BR "-o, --out-interface " "[!] \fIname\fP" - The interface via which a frame is going to be sent (for the --.BR OUTPUT " and " FORWARD --chains). The flag -+.B OUTPUT -+chain). The flag - .B --out-if - is an alias for this option. - .TP -@@ -344,9 +329,20 @@ Binary AND the mark with bits. - .BR "--or-mark mark" - Binary OR the mark with bits. - -+.SH NOTES -+In this nft-based version of -+.BR arptables , -+support for -+.B FORWARD -+chain has not been implemented. Since ARP packets are "forwarded" only by Linux -+bridges, the same may be achieved using -+.B FORWARD -+chain in -+.BR ebtables . -+ - .SH MAILINGLISTS - .BR "" "See " http://netfilter.org/mailinglists.html - .SH SEE ALSO --.BR iptables "(8), " ebtables "(8), " arp "(8), " rarp "(8), " ifconfig "(8), " route (8) -+.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip (8) - .PP --.BR "" "See " http://ebtables.sf.net -+.BR "" "See " https://wiki.nftables.org --- -2.21.0 - diff --git a/0005-doc-Add-ebtables-man-page.patch b/0005-doc-Add-ebtables-man-page.patch deleted file mode 100644 index a7b8203..0000000 --- a/0005-doc-Add-ebtables-man-page.patch +++ /dev/null @@ -1,1186 +0,0 @@ -From c1d57b73ccd3cd3ab09a8bb8c0d2b5afd3ceb307 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 13 Mar 2019 20:46:14 +0100 -Subject: [PATCH] doc: Add ebtables man page - -This is a 1:1 copy from legacy ebtables repository. - -Signed-off-by: Phil Sutter -Signed-off-by: Florian Westphal -(cherry picked from commit eefd72aca33c6cdf7290da0c4a656c6768097181) -Signed-off-by: Phil Sutter ---- - iptables/Makefile.am | 3 +- - iptables/ebtables-nft.8 | 1146 +++++++++++++++++++++++++++++++++++++++ - 2 files changed, 1148 insertions(+), 1 deletion(-) - create mode 100644 iptables/ebtables-nft.8 - -diff --git a/iptables/Makefile.am b/iptables/Makefile.am -index 52309679d390c..37937b43cc310 100644 ---- a/iptables/Makefile.am -+++ b/iptables/Makefile.am -@@ -64,7 +64,8 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ - xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ - xtables-monitor.8 - if ENABLE_NFTABLES --man_MANS += arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 -+man_MANS += arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8 \ -+ ebtables-nft.8 - endif - CLEANFILES = iptables.8 xtables-monitor.8 \ - xtables-config-parser.c xtables-config-syntax.c -diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 -new file mode 100644 -index 0000000000000..55204ab91e8a4 ---- /dev/null -+++ b/iptables/ebtables-nft.8 -@@ -0,0 +1,1146 @@ -+.TH EBTABLES 8 "December 2011" -+.\" -+.\" Man page written by Bart De Schuymer -+.\" It is based on the iptables man page. -+.\" -+.\" The man page was edited, February 25th 2003, by -+.\" Greg Morgan <" dr_kludge_at_users_sourceforge_net > -+.\" -+.\" Iptables page by Herve Eychenne March 2000. -+.\" -+.\" This program is free software; you can redistribute it and/or modify -+.\" it under the terms of the GNU General Public License as published by -+.\" the Free Software Foundation; either version 2 of the License, or -+.\" (at your option) any later version. -+.\" -+.\" This program is distributed in the hope that it will be useful, -+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of -+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+.\" GNU General Public License for more details. -+.\" -+.\" You should have received a copy of the GNU General Public License -+.\" along with this program; if not, write to the Free Software -+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -+.\" -+.\" -+.SH NAME -+ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legacy) -+.SH SYNOPSIS -+.BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" -+.br -+.BR "ebtables " [ -t " table ] " -P " chain " ACCEPT " | " DROP " | " RETURN -+.br -+.BR "ebtables " [ -t " table ] " -F " [chain]" -+.br -+.BR "ebtables " [ -t " table ] " -Z " [chain]" -+.br -+.BR "ebtables " [ -t " table ] " -L " [" -Z "] [chain] [ [" --Ln "] | [" --Lx "] ] [" --Lc "] [" --Lmac2 ] -+.br -+.BR "ebtables " [ -t " table ] " -N " chain [" "-P ACCEPT " | " DROP " | " RETURN" ] -+.br -+.BR "ebtables " [ -t " table ] " -X " [chain]" -+.br -+.BR "ebtables " [ -t " table ] " -E " old-chain-name new-chain-name" -+.br -+.BR "ebtables " [ -t " table ] " --init-table -+.br -+.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit -+.br -+.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init -+.br -+.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save -+.br -+ -+.SH LEGACY -+This tool uses the old xtables/setsockopt framework, and is a legacy version -+of ebtables. That means that a new, more modern tool exists with the same -+functionality using the nf_tables framework and you are encouraged to migrate now. -+The new binaries (known as ebtables-nft and formerly known as ebtables-compat) -+uses the same syntax and semantics than this legacy one. -+ -+You can still use this legacy tool. You should probably get some specific -+information from your Linux distribution or vendor. -+More docs are available at https://wiki.nftables.org -+ -+.SH DESCRIPTION -+.B ebtables -+is an application program used to set up and maintain the -+tables of rules (inside the Linux kernel) that inspect -+Ethernet frames. -+It is analogous to the -+.B iptables -+application, but less complicated, due to the fact that the Ethernet protocol -+is much simpler than the IP protocol. -+.SS CHAINS -+There are three ebtables tables with built-in chains in the -+Linux kernel. These tables are used to divide functionality into -+different sets of rules. Each set of rules is called a chain. -+Each chain is an ordered list of rules that can match Ethernet frames. If a -+rule matches an Ethernet frame, then a processing specification tells -+what to do with that matching frame. The processing specification is -+called a 'target'. However, if the frame does not match the current -+rule in the chain, then the next rule in the chain is examined and so forth. -+The user can create new (user-defined) chains that can be used as the 'target' -+of a rule. User-defined chains are very useful to get better performance -+over the linear traversal of the rules and are also essential for structuring -+the filtering rules into well-organized and maintainable sets of rules. -+.SS TARGETS -+A firewall rule specifies criteria for an Ethernet frame and a frame -+processing specification called a target. When a frame matches a rule, -+then the next action performed by the kernel is specified by the target. -+The target can be one of these values: -+.BR ACCEPT , -+.BR DROP , -+.BR CONTINUE , -+.BR RETURN , -+an 'extension' (see below) or a jump to a user-defined chain. -+.PP -+.B ACCEPT -+means to let the frame through. -+.B DROP -+means the frame has to be dropped. In the -+.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different" -+meanings (see the info provided for the -+.BR -t " option)." -+.B CONTINUE -+means the next rule has to be checked. This can be handy, f.e., to know how many -+frames pass a certain point in the chain, to log those frames or to apply multiple -+targets on a frame. -+.B RETURN -+means stop traversing this chain and resume at the next rule in the -+previous (calling) chain. -+For the extension targets please refer to the -+.B "TARGET EXTENSIONS" -+section of this man page. -+.SS TABLES -+As stated earlier, there are three ebtables tables in the Linux -+kernel. The table names are -+.BR filter ", " nat " and " broute . -+Of these three tables, -+the filter table is the default table that the command operates on. -+If you are working with the filter table, then you can drop the '-t filter' -+argument to the ebtables command. However, you will need to provide -+the -t argument for the other two tables. Moreover, the -t argument must be the -+first argument on the ebtables command line, if used. -+.TP -+.B "-t, --table" -+.br -+.B filter -+is the default table and contains three built-in chains: -+.B INPUT -+(for frames destined for the bridge itself, on the level of the MAC destination address), -+.B OUTPUT -+(for locally-generated or (b)routed frames) and -+.B FORWARD -+(for frames being forwarded by the bridge). -+.br -+.br -+.B nat -+is mostly used to change the mac addresses and contains three built-in chains: -+.B PREROUTING -+(for altering frames as soon as they come in), -+.B OUTPUT -+(for altering locally generated or (b)routed frames before they are bridged) and -+.B POSTROUTING -+(for altering frames as they are about to go out). A small note on the naming -+of chains PREROUTING and POSTROUTING: it would be more accurate to call them -+PREFORWARDING and POSTFORWARDING, but for all those who come from the -+iptables world to ebtables it is easier to have the same names. Note that you -+can change the name -+.BR "" ( -E ) -+if you don't like the default. -+.br -+.br -+.B broute -+is used to make a brouter, it has one built-in chain: -+.BR BROUTING . -+The targets -+.BR DROP " and " ACCEPT -+have a special meaning in the broute table (these names are used instead of -+more descriptive names to keep the implementation generic). -+.B DROP -+actually means the frame has to be routed, while -+.B ACCEPT -+means the frame has to be bridged. The -+.B BROUTING -+chain is traversed very early. However, it is only traversed by frames entering on -+a bridge port that is in forwarding state. Normally those frames -+would be bridged, but you can decide otherwise here. The -+.B redirect -+target is very handy here. -+.SH EBTABLES COMMAND LINE ARGUMENTS -+After the initial ebtables '-t table' command line argument, the remaining -+arguments can be divided into several groups. These groups -+are commands, miscellaneous commands, rule specifications, match extensions, -+watcher extensions and target extensions. -+.SS COMMANDS -+The ebtables command arguments specify the actions to perform on the table -+defined with the -t argument. If you do not use the -t argument to name -+a table, the commands apply to the default filter table. -+Only one command may be used on the command line at a time, except when -+the commands -+.BR -L " and " -Z -+are combined, the commands -+.BR -N " and " -P -+are combined, or when -+.B --atomic-file -+is used. -+.TP -+.B "-A, --append" -+Append a rule to the end of the selected chain. -+.TP -+.B "-D, --delete" -+Delete the specified rule or rules from the selected chain. There are two ways to -+use this command. The first is by specifying an interval of rule numbers -+to delete (directly after -+.BR -D ). -+Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use -+.B -L --Ln -+to list the rules with their rule number). When \fIend_nr\fP is omitted, all rules starting -+from \fIstart_nr\fP are deleted. Using negative numbers is allowed, for more -+details about using negative numbers, see the -+.B -I -+command. The second usage is by -+specifying the complete rule as it would have been specified when it was added. Only -+the first encountered rule that is the same as this specified rule, in other -+words the matching rule with the lowest (positive) rule number, is deleted. -+.TP -+.B "-C, --change-counters" -+Change the counters of the specified rule or rules from the selected chain. There are two ways to -+use this command. The first is by specifying an interval of rule numbers -+to do the changes on (directly after -+.BR -C ). -+Syntax: \fIstart_nr\fP[\fI:end_nr\fP] (use -+.B -L --Ln -+to list the rules with their rule number). The details are the same as for the -+.BR -D " command. The second usage is by" -+specifying the complete rule as it would have been specified when it was added. Only -+the counters of the first encountered rule that is the same as this specified rule, in other -+words the matching rule with the lowest (positive) rule number, are changed. -+In the first usage, the counters are specified directly after the interval specification, -+in the second usage directly after -+.BR -C . -+First the packet counter is specified, then the byte counter. If the specified counters start -+with a '+', the counter values are added to the respective current counter values. -+If the specified counters start with a '-', the counter values are decreased from the respective -+current counter values. No bounds checking is done. If the counters don't start with '+' or '-', -+the current counters are changed to the specified counters. -+.TP -+.B "-I, --insert" -+Insert the specified rule into the selected chain at the specified rule number. If the -+rule number is not specified, the rule is added at the head of the chain. -+If the current number of rules equals -+.IR N , -+then the specified number can be -+between -+.IR -N " and " N+1 . -+For a positive number -+.IR i , -+it holds that -+.IR i " and " i-N-1 -+specify the same place in the chain where the rule should be inserted. The rule number -+0 specifies the place past the last rule in the chain and using this number is therefore -+equivalent to using the -+.BR -A " command." -+Rule numbers structly smaller than 0 can be useful when more than one rule needs to be inserted -+in a chain. -+.TP -+.B "-P, --policy" -+Set the policy for the chain to the given target. The policy can be -+.BR ACCEPT ", " DROP " or " RETURN . -+.TP -+.B "-F, --flush" -+Flush the selected chain. If no chain is selected, then every chain will be -+flushed. Flushing a chain does not change the policy of the -+chain, however. -+.TP -+.B "-Z, --zero" -+Set the counters of the selected chain to zero. If no chain is selected, all the counters -+are set to zero. The -+.B "-Z" -+command can be used in conjunction with the -+.B "-L" -+command. -+When both the -+.B "-Z" -+and -+.B "-L" -+commands are used together in this way, the rule counters are printed on the screen -+before they are set to zero. -+.TP -+.B "-L, --list" -+List all rules in the selected chain. If no chain is selected, all chains -+are listed. -+.br -+The following options change the output of the -+.B "-L" -+command. -+.br -+.B "--Ln" -+.br -+Places the rule number in front of every rule. This option is incompatible with the -+.BR --Lx " option." -+.br -+.B "--Lc" -+.br -+Shows the counters at the end of each rule displayed by the -+.B "-L" -+command. Both a frame counter (pcnt) and a byte counter (bcnt) are displayed. -+The frame counter shows how many frames have matched the specific rule, the byte -+counter shows the sum of the frame sizes of these matching frames. Using this option -+.BR "" "in combination with the " --Lx " option causes the counters to be written out" -+.BR "" "in the '" -c " ' option format." -+.br -+.B "--Lx" -+.br -+Changes the output so that it produces a set of ebtables commands that construct -+the contents of the chain, when specified. -+If no chain is specified, ebtables commands to construct the contents of the -+table are given, including commands for creating the user-defined chains (if any). -+You can use this set of commands in an ebtables boot or reload -+script. For example the output could be used at system startup. -+The -+.B "--Lx" -+option is incompatible with the -+.B "--Ln" -+listing option. Using the -+.BR --Lx " option together with the " --Lc " option will cause the counters to be written out" -+.BR "" "in the '" -c " ' option format." -+.br -+.B "--Lmac2" -+.br -+Shows all MAC addresses with the same length, adding leading zeroes -+if necessary. The default representation omits leading zeroes in the addresses. -+.TP -+.B "-N, --new-chain" -+Create a new user-defined chain with the given name. The number of -+user-defined chains is limited only by the number of possible chain names. -+A user-defined chain name has a maximum -+length of 31 characters. The standard policy of the user-defined chain is -+ACCEPT. The policy of the new chain can be initialized to a different standard -+target by using the -+.B -P -+command together with the -+.B -N -+command. In this case, the chain name does not have to be specified for the -+.B -P -+command. -+.TP -+.B "-X, --delete-chain" -+Delete the specified user-defined chain. There must be no remaining references (jumps) -+to the specified chain, otherwise ebtables will refuse to delete it. If no chain is -+specified, all user-defined chains that aren't referenced will be removed. -+.TP -+.B "-E, --rename-chain" -+Rename the specified chain to a new name. Besides renaming a user-defined -+chain, you can rename a standard chain to a name that suits your -+taste. For example, if you like PREFORWARDING more than PREROUTING, -+then you can use the -E command to rename the PREROUTING chain. If you do -+rename one of the standard ebtables chain names, please be sure to mention -+this fact should you post a question on the ebtables mailing lists. -+It would be wise to use the standard name in your post. Renaming a standard -+ebtables chain in this fashion has no effect on the structure or functioning -+of the ebtables kernel table. -+.TP -+.B "--init-table" -+Replace the current table data by the initial table data. -+.TP -+.B "--atomic-init" -+Copy the kernel's initial data of the table to the specified -+file. This can be used as the first action, after which rules are added -+to the file. The file can be specified using the -+.B --atomic-file -+command or through the -+.IR EBTABLES_ATOMIC_FILE " environment variable." -+.TP -+.B "--atomic-save" -+Copy the kernel's current data of the table to the specified -+file. This can be used as the first action, after which rules are added -+to the file. The file can be specified using the -+.B --atomic-file -+command or through the -+.IR EBTABLES_ATOMIC_FILE " environment variable." -+.TP -+.B "--atomic-commit" -+Replace the kernel table data with the data contained in the specified -+file. This is a useful command that allows you to load all your rules of a -+certain table into the kernel at once, saving the kernel a lot of precious -+time and allowing atomic updates of the tables. The file which contains -+the table data is constructed by using either the -+.B "--atomic-init" -+or the -+.B "--atomic-save" -+command to generate a starting file. After that, using the -+.B "--atomic-file" -+command when constructing rules or setting the -+.IR EBTABLES_ATOMIC_FILE " environment variable" -+allows you to extend the file and build the complete table before -+committing it to the kernel. This command can be very useful in boot scripts -+to populate the ebtables tables in a fast way. -+.SS MISCELLANOUS COMMANDS -+.TP -+.B "-V, --version" -+Show the version of the ebtables userspace program. -+.TP -+.BR "-h, --help " "[\fIlist of module names\fP]" -+Give a brief description of the command syntax. Here you can also specify -+names of extensions and ebtables will try to write help about those -+extensions. E.g. -+.IR "ebtables -h snat log ip arp" . -+Specify -+.I list_extensions -+to list all extensions supported by the userspace -+utility. -+.TP -+.BR "-j, --jump " "\fItarget\fP" -+The target of the rule. This is one of the following values: -+.BR ACCEPT , -+.BR DROP , -+.BR CONTINUE , -+.BR RETURN , -+a target extension (see -+.BR "TARGET EXTENSIONS" ")" -+or a user-defined chain name. -+.TP -+.B --atomic-file "\fIfile\fP" -+Let the command operate on the specified -+.IR file . -+The data of the table to -+operate on will be extracted from the file and the result of the operation -+will be saved back into the file. If specified, this option should come -+before the command specification. An alternative that should be preferred, -+is setting the -+.IR EBTABLES_ATOMIC_FILE " environment variable." -+.TP -+.B -M, --modprobe "\fIprogram\fP" -+When talking to the kernel, use this -+.I program -+to try to automatically load missing kernel modules. -+.TP -+.B --concurrent -+Use a file lock to support concurrent scripts updating the ebtables kernel tables. -+ -+.SS -+RULE SPECIFICATIONS -+The following command line arguments make up a rule specification (as used -+in the add and delete commands). A "!" option before the specification -+inverts the test for that specification. Apart from these standard rule -+specifications there are some other command line arguments of interest. -+See both the -+.BR "MATCH EXTENSIONS" -+and the -+.BR "WATCHER EXTENSIONS" -+below. -+.TP -+.BR "-p, --protocol " "[!] \fIprotocol\fP" -+The protocol that was responsible for creating the frame. This can be a -+hexadecimal number, above -+.IR 0x0600 , -+a name (e.g. -+.I ARP -+) or -+.BR LENGTH . -+The protocol field of the Ethernet frame can be used to denote the -+length of the header (802.2/802.3 networks). When the value of that field is -+below or equals -+.IR 0x0600 , -+the value equals the size of the header and shouldn't be used as a -+protocol number. Instead, all frames where the protocol field is used as -+the length field are assumed to be of the same 'protocol'. The protocol -+name used in ebtables for these frames is -+.BR LENGTH . -+.br -+The file -+.B /etc/ethertypes -+can be used to show readable -+characters instead of hexadecimal numbers for the protocols. For example, -+.I 0x0800 -+will be represented by -+.IR IPV4 . -+The use of this file is not case sensitive. -+See that file for more information. The flag -+.B --proto -+is an alias for this option. -+.TP -+.BR "-i, --in-interface " "[!] \fIname\fP" -+The interface (bridge port) via which a frame is received (this option is useful in the -+.BR INPUT , -+.BR FORWARD , -+.BR PREROUTING " and " BROUTING -+chains). If the interface name ends with '+', then -+any interface name that begins with this name (disregarding '+') will match. -+The flag -+.B --in-if -+is an alias for this option. -+.TP -+.BR "--logical-in " "[!] \fIname\fP" -+The (logical) bridge interface via which a frame is received (this option is useful in the -+.BR INPUT , -+.BR FORWARD , -+.BR PREROUTING " and " BROUTING -+chains). -+If the interface name ends with '+', then -+any interface name that begins with this name (disregarding '+') will match. -+.TP -+.BR "-o, --out-interface " "[!] \fIname\fP" -+The interface (bridge port) via which a frame is going to be sent (this option is useful in the -+.BR OUTPUT , -+.B FORWARD -+and -+.B POSTROUTING -+chains). If the interface name ends with '+', then -+any interface name that begins with this name (disregarding '+') will match. -+The flag -+.B --out-if -+is an alias for this option. -+.TP -+.BR "--logical-out " "[!] \fIname\fP" -+The (logical) bridge interface via which a frame is going to be sent (this option -+is useful in the -+.BR OUTPUT , -+.B FORWARD -+and -+.B POSTROUTING -+chains). -+If the interface name ends with '+', then -+any interface name that begins with this name (disregarding '+') will match. -+.TP -+.BR "-s, --source " "[!] \fIaddress\fP[/\fImask\fP]" -+The source MAC address. Both mask and address are written as 6 hexadecimal -+numbers separated by colons. Alternatively one can specify Unicast, -+Multicast, Broadcast or BGA (Bridge Group Address): -+.br -+.IR "Unicast" "=00:00:00:00:00:00/01:00:00:00:00:00," -+.IR "Multicast" "=01:00:00:00:00:00/01:00:00:00:00:00," -+.IR "Broadcast" "=ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff or" -+.IR "BGA" "=01:80:c2:00:00:00/ff:ff:ff:ff:ff:ff." -+Note that a broadcast -+address will also match the multicast specification. The flag -+.B --src -+is an alias for this option. -+.TP -+.BR "-d, --destination " "[!] \fIaddress\fP[/\fImask\fP]" -+The destination MAC address. See -+.B -s -+(above) for more details on MAC addresses. The flag -+.B --dst -+is an alias for this option. -+.TP -+.BR "-c, --set-counter " "\fIpcnt bcnt\fP" -+If used with -+.BR -A " or " -I ", then the packet and byte counters of the new rule will be set to -+.IR pcnt ", resp. " bcnt ". -+If used with the -+.BR -C " or " -D " commands, only rules with a packet and byte count equal to" -+.IR pcnt ", resp. " bcnt " will match." -+ -+.SS MATCH EXTENSIONS -+Ebtables extensions are dynamically loaded into the userspace tool, -+there is therefore no need to explicitly load them with a -+-m option like is done in iptables. -+These extensions deal with functionality supported by kernel modules supplemental to -+the core ebtables code. -+.SS 802_3 -+Specify 802.3 DSAP/SSAP fields or SNAP type. The protocol must be specified as -+.IR "LENGTH " "(see the option " " -p " above). -+.TP -+.BR "--802_3-sap " "[!] \fIsap\fP" -+DSAP and SSAP are two one byte 802.3 fields. The bytes are always -+equal, so only one byte (hexadecimal) is needed as an argument. -+.TP -+.BR "--802_3-type " "[!] \fItype\fP" -+If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must -+be consulted to determine the payload protocol. This is a two byte -+(hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are -+checked for type. -+.SS among -+Match a MAC address or MAC/IP address pair versus a list of MAC addresses -+and MAC/IP address pairs. -+A list entry has the following format: -+.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" -+list entries are separated by a comma, specifying an IP address corresponding to -+the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address -+but different IP address (and vice versa) can be specified. If the MAC address doesn't -+match any entry from the list, the frame doesn't match the rule (unless "!" was used). -+.TP -+.BR "--among-dst " "[!] \fIlist\fP" -+Compare the MAC destination to the given list. If the Ethernet frame has type -+.IR IPv4 " or " ARP , -+then comparison with MAC/IP destination address pairs from the -+list is possible. -+.TP -+.BR "--among-src " "[!] \fIlist\fP" -+Compare the MAC source to the given list. If the Ethernet frame has type -+.IR IPv4 " or " ARP , -+then comparison with MAC/IP source address pairs from the list -+is possible. -+.TP -+.BR "--among-dst-file " "[!] \fIfile\fP" -+Same as -+.BR --among-dst " but the list is read in from the specified file." -+.TP -+.BR "--among-src-file " "[!] \fIfile\fP" -+Same as -+.BR --among-src " but the list is read in from the specified file." -+.SS arp -+Specify (R)ARP fields. The protocol must be specified as -+.IR ARP " or " RARP . -+.TP -+.BR "--arp-opcode " "[!] \fIopcode\fP" -+The (R)ARP opcode (decimal or a string, for more details see -+.BR "ebtables -h arp" ). -+.TP -+.BR "--arp-htype " "[!] \fIhardware type\fP" -+The hardware type, this can be a decimal or the string -+.I Ethernet -+(which sets -+.I type -+to 1). Most (R)ARP packets have Eternet as hardware type. -+.TP -+.BR "--arp-ptype " "[!] \fIprotocol type\fP" -+The protocol type for which the (r)arp is used (hexadecimal or the string -+.IR IPv4 , -+denoting 0x0800). -+Most (R)ARP packets have protocol type IPv4. -+.TP -+.BR "--arp-ip-src " "[!] \fIaddress\fP[/\fImask\fP]" -+The (R)ARP IP source address specification. -+.TP -+.BR "--arp-ip-dst " "[!] \fIaddress\fP[/\fImask\fP]" -+The (R)ARP IP destination address specification. -+.TP -+.BR "--arp-mac-src " "[!] \fIaddress\fP[/\fImask\fP]" -+The (R)ARP MAC source address specification. -+.TP -+.BR "--arp-mac-dst " "[!] \fIaddress\fP[/\fImask\fP]" -+The (R)ARP MAC destination address specification. -+.TP -+.BR "" "[!]" " --arp-gratuitous" -+Checks for ARP gratuitous packets: checks equality of IPv4 source -+address and IPv4 destination address inside the ARP header. -+.SS ip -+Specify IPv4 fields. The protocol must be specified as -+.IR IPv4 . -+.TP -+.BR "--ip-source " "[!] \fIaddress\fP[/\fImask\fP]" -+The source IP address. -+The flag -+.B --ip-src -+is an alias for this option. -+.TP -+.BR "--ip-destination " "[!] \fIaddress\fP[/\fImask\fP]" -+The destination IP address. -+The flag -+.B --ip-dst -+is an alias for this option. -+.TP -+.BR "--ip-tos " "[!] \fItos\fP" -+The IP type of service, in hexadecimal numbers. -+.BR IPv4 . -+.TP -+.BR "--ip-protocol " "[!] \fIprotocol\fP" -+The IP protocol. -+The flag -+.B --ip-proto -+is an alias for this option. -+.TP -+.BR "--ip-source-port " "[!] \fIport1\fP[:\fIport2\fP]" -+The source port or port range for the IP protocols 6 (TCP), 17 -+(UDP), 33 (DCCP) or 132 (SCTP). The -+.B --ip-protocol -+option must be specified as -+.IR TCP ", " UDP ", " DCCP " or " SCTP . -+If -+.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -+The flag -+.B --ip-sport -+is an alias for this option. -+.TP -+.BR "--ip-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" -+The destination port or port range for ip protocols 6 (TCP), 17 -+(UDP), 33 (DCCP) or 132 (SCTP). The -+.B --ip-protocol -+option must be specified as -+.IR TCP ", " UDP ", " DCCP " or " SCTP . -+If -+.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -+The flag -+.B --ip-dport -+is an alias for this option. -+.SS ip6 -+Specify IPv6 fields. The protocol must be specified as -+.IR IPv6 . -+.TP -+.BR "--ip6-source " "[!] \fIaddress\fP[/\fImask\fP]" -+The source IPv6 address. -+The flag -+.B --ip6-src -+is an alias for this option. -+.TP -+.BR "--ip6-destination " "[!] \fIaddress\fP[/\fImask\fP]" -+The destination IPv6 address. -+The flag -+.B --ip6-dst -+is an alias for this option. -+.TP -+.BR "--ip6-tclass " "[!] \fItclass\fP" -+The IPv6 traffic class, in hexadecimal numbers. -+.TP -+.BR "--ip6-protocol " "[!] \fIprotocol\fP" -+The IP protocol. -+The flag -+.B --ip6-proto -+is an alias for this option. -+.TP -+.BR "--ip6-source-port " "[!] \fIport1\fP[:\fIport2\fP]" -+The source port or port range for the IPv6 protocols 6 (TCP), 17 -+(UDP), 33 (DCCP) or 132 (SCTP). The -+.B --ip6-protocol -+option must be specified as -+.IR TCP ", " UDP ", " DCCP " or " SCTP . -+If -+.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -+The flag -+.B --ip6-sport -+is an alias for this option. -+.TP -+.BR "--ip6-destination-port " "[!] \fIport1\fP[:\fIport2\fP]" -+The destination port or port range for IPv6 protocols 6 (TCP), 17 -+(UDP), 33 (DCCP) or 132 (SCTP). The -+.B --ip6-protocol -+option must be specified as -+.IR TCP ", " UDP ", " DCCP " or " SCTP . -+If -+.IR port1 " is omitted, " 0:port2 " is used; if " port2 " is omitted but a colon is specified, " port1:65535 " is used." -+The flag -+.B --ip6-dport -+is an alias for this option. -+.TP -+.BR "--ip6-icmp-type " "[!] {\fItype\fP[:\fItype\fP]/\fIcode\fP[:\fIcode\fP]|\fItypename\fP}" -+Specify ipv6\-icmp type and code to match. -+Ranges for both type and code are supported. Type and code are -+separated by a slash. Valid numbers for type and range are 0 to 255. -+To match a single type including all valid codes, symbolic names can -+be used instead of numbers. The list of known type names is shown by the command -+.nf -+ ebtables \-\-help ip6 -+.fi -+This option is only valid for \-\-ip6-prococol ipv6-icmp. -+.SS limit -+This module matches at a limited rate using a token bucket filter. -+A rule using this extension will match until this limit is reached. -+It can be used with the -+.B --log -+watcher to give limited logging, for example. Its use is the same -+as the limit match of iptables. -+.TP -+.BR "--limit " "[\fIvalue\fP]" -+Maximum average matching rate: specified as a number, with an optional -+.IR /second ", " /minute ", " /hour ", or " /day " suffix; the default is " 3/hour . -+.TP -+.BR "--limit-burst " "[\fInumber\fP]" -+Maximum initial number of packets to match: this number gets recharged by -+one every time the limit specified above is not reached, up to this -+number; the default is -+.IR 5 . -+.SS mark_m -+.TP -+.BR "--mark " "[!] [\fIvalue\fP][/\fImask\fP]" -+Matches frames with the given unsigned mark value. If a -+.IR value " and " mask " are specified, the logical AND of the mark value of the frame and" -+the user-specified -+.IR mask " is taken before comparing it with the" -+user-specified mark -+.IR value ". When only a mark " -+.IR value " is specified, the packet" -+only matches when the mark value of the frame equals the user-specified -+mark -+.IR value . -+If only a -+.IR mask " is specified, the logical" -+AND of the mark value of the frame and the user-specified -+.IR mask " is taken and the frame matches when the result of this logical AND is" -+non-zero. Only specifying a -+.IR mask " is useful to match multiple mark values." -+.SS pkttype -+.TP -+.BR "--pkttype-type " "[!] \fItype\fP" -+Matches on the Ethernet "class" of the frame, which is determined by the -+generic networking code. Possible values: -+.IR broadcast " (MAC destination is the broadcast address)," -+.IR multicast " (MAC destination is a multicast address)," -+.IR host " (MAC destination is the receiving network device), or " -+.IR otherhost " (none of the above)." -+.SS stp -+Specify stp BPDU (bridge protocol data unit) fields. The destination -+address -+.BR "" ( -d ") must be specified as the bridge group address" -+.IR "" ( BGA ). -+For all options for which a range of values can be specified, it holds that -+if the lower bound is omitted (but the colon is not), then the lowest possible lower bound -+for that option is used, while if the upper bound is omitted (but the colon again is not), the -+highest possible upper bound for that option is used. -+.TP -+.BR "--stp-type " "[!] \fItype\fP" -+The BPDU type (0-255), recognized non-numerical types are -+.IR config ", denoting a configuration BPDU (=0), and" -+.IR tcn ", denothing a topology change notification BPDU (=128)." -+.TP -+.BR "--stp-flags " "[!] \fIflag\fP" -+The BPDU flag (0-255), recognized non-numerical flags are -+.IR topology-change ", denoting the topology change flag (=1), and" -+.IR topology-change-ack ", denoting the topology change acknowledgement flag (=128)." -+.TP -+.BR "--stp-root-prio " "[!] [\fIprio\fP][:\fIprio\fP]" -+The root priority (0-65535) range. -+.TP -+.BR "--stp-root-addr " "[!] [\fIaddress\fP][/\fImask\fP]" -+The root mac address, see the option -+.BR -s " for more details." -+.TP -+.BR "--stp-root-cost " "[!] [\fIcost\fP][:\fIcost\fP]" -+The root path cost (0-4294967295) range. -+.TP -+.BR "--stp-sender-prio " "[!] [\fIprio\fP][:\fIprio\fP]" -+The BPDU's sender priority (0-65535) range. -+.TP -+.BR "--stp-sender-addr " "[!] [\fIaddress\fP][/\fImask\fP]" -+The BPDU's sender mac address, see the option -+.BR -s " for more details." -+.TP -+.BR "--stp-port " "[!] [\fIport\fP][:\fIport\fP]" -+The port identifier (0-65535) range. -+.TP -+.BR "--stp-msg-age " "[!] [\fIage\fP][:\fIage\fP]" -+The message age timer (0-65535) range. -+.TP -+.BR "--stp-max-age " "[!] [\fIage\fP][:\fIage\fP]" -+The max age timer (0-65535) range. -+.TP -+.BR "--stp-hello-time " "[!] [\fItime\fP][:\fItime\fP]" -+The hello time timer (0-65535) range. -+.TP -+.BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]" -+The forward delay timer (0-65535) range. -+.SS string -+This module matches on a given string using some pattern matching strategy. -+.TP -+.BR "--string-algo " "\fIalgorithm\fP" -+The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) -+.TP -+.BR "--string-from " "\fIoffset\fP" -+The lowest offset from which a match can start. (default: 0) -+.TP -+.BR "--string-to " "\fIoffset\fP" -+The highest offset from which a match can start. (default: size of frame) -+.TP -+.BR "--string " "[!] \fIpattern\fP" -+Matches the given pattern. -+.TP -+.BR "--string-hex " "[!] \fIpattern\fP" -+Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' -+.TP -+.BR "--string-icase" -+Ignore case when searching. -+.SS vlan -+Specify 802.1Q Tag Control Information fields. -+The protocol must be specified as -+.IR 802_1Q " (0x8100)." -+.TP -+.BR "--vlan-id " "[!] \fIid\fP" -+The VLAN identifier field (VID). Decimal number from 0 to 4095. -+.TP -+.BR "--vlan-prio " "[!] \fIprio\fP" -+The user priority field, a decimal number from 0 to 7. -+The VID should be set to 0 ("null VID") or unspecified -+(in the latter case the VID is deliberately set to 0). -+.TP -+.BR "--vlan-encap " "[!] \fItype\fP" -+The encapsulated Ethernet frame type/length. -+Specified as a hexadecimal -+number from 0x0000 to 0xFFFF or as a symbolic name -+from -+.BR /etc/ethertypes . -+ -+.SS WATCHER EXTENSIONS -+Watchers only look at frames passing by, they don't modify them nor decide -+to accept the frames or not. These watchers only -+see the frame if the frame matches the rule, and they see it before the -+target is executed. -+.SS log -+The log watcher writes descriptive data about a frame to the syslog. -+.TP -+.B "--log" -+.br -+Log with the default loggin options: log-level= -+.IR info , -+log-prefix="", no ip logging, no arp logging. -+.TP -+.B --log-level "\fIlevel\fP" -+.br -+Defines the logging level. For the possible values, see -+.BR "ebtables -h log" . -+The default level is -+.IR info . -+.TP -+.BR --log-prefix " \fItext\fP" -+.br -+Defines the prefix -+.I text -+to be printed at the beginning of the line with the logging information. -+.TP -+.B --log-ip -+.br -+Will log the ip information when a frame made by the ip protocol matches -+the rule. The default is no ip information logging. -+.TP -+.B --log-ip6 -+.br -+Will log the ipv6 information when a frame made by the ipv6 protocol matches -+the rule. The default is no ipv6 information logging. -+.TP -+.B --log-arp -+.br -+Will log the (r)arp information when a frame made by the (r)arp protocols -+matches the rule. The default is no (r)arp information logging. -+.SS nflog -+The nflog watcher passes the packet to the loaded logging backend -+in order to log the packet. This is usually used in combination with -+nfnetlink_log as logging backend, which will multicast the packet -+through a -+.IR netlink -+socket to the specified multicast group. One or more userspace processes -+may subscribe to the group to receive the packets. -+.TP -+.B "--nflog" -+.br -+Log with the default logging options -+.TP -+.B --nflog-group "\fInlgroup\fP" -+.br -+The netlink group (1 - 2^32-1) to which packets are (only applicable for -+nfnetlink_log). The default value is 1. -+.TP -+.B --nflog-prefix "\fIprefix\fP" -+.br -+A prefix string to include in the log message, up to 30 characters -+long, useful for distinguishing messages in the logs. -+.TP -+.B --nflog-range "\fIsize\fP" -+.br -+The number of bytes to be copied to userspace (only applicable for -+nfnetlink_log). nfnetlink_log instances may specify their own -+range, this option overrides it. -+.TP -+.B --nflog-threshold "\fIsize\fP" -+.br -+Number of packets to queue inside the kernel before sending them -+to userspace (only applicable for nfnetlink_log). Higher values -+result in less overhead per packet, but increase delay until the -+packets reach userspace. The default value is 1. -+.SS ulog -+The ulog watcher passes the packet to a userspace -+logging daemon using netlink multicast sockets. This differs -+from the log watcher in the sense that the complete packet is -+sent to userspace instead of a descriptive text and that -+netlink multicast sockets are used instead of the syslog. -+This watcher enables parsing of packets with userspace programs, the -+physical bridge in and out ports are also included in the netlink messages. -+The ulog watcher module accepts 2 parameters when the module is loaded -+into the kernel (e.g. with modprobe): -+.B nlbufsiz -+specifies how big the buffer for each netlink multicast -+group is. If you say -+.IR nlbufsiz=8192 , -+for example, up to eight kB of packets will -+get accumulated in the kernel until they are sent to userspace. It is -+not possible to allocate more than 128kB. Please also keep in mind that -+this buffer size is allocated for each nlgroup you are using, so the -+total kernel memory usage increases by that factor. The default is 4096. -+.B flushtimeout -+specifies after how many hundredths of a second the queue should be -+flushed, even if it is not full yet. The default is 10 (one tenth of -+a second). -+.TP -+.B "--ulog" -+.br -+Use the default settings: ulog-prefix="", ulog-nlgroup=1, -+ulog-cprange=4096, ulog-qthreshold=1. -+.TP -+.B --ulog-prefix "\fItext\fP" -+.br -+Defines the prefix included with the packets sent to userspace. -+.TP -+.BR --ulog-nlgroup " \fIgroup\fP" -+.br -+Defines which netlink group number to use (a number from 1 to 32). -+Make sure the netlink group numbers used for the iptables ULOG -+target differ from those used for the ebtables ulog watcher. -+The default group number is 1. -+.TP -+.BR --ulog-cprange " \fIrange\fP" -+.br -+Defines the maximum copy range to userspace, for packets matching the -+rule. The default range is 0, which means the maximum copy range is -+given by -+.BR nlbufsiz . -+A maximum copy range larger than -+128*1024 is meaningless as the packets sent to userspace have an upper -+size limit of 128*1024. -+.TP -+.BR --ulog-qthreshold " \fIthreshold\fP" -+.br -+Queue at most -+.I threshold -+number of packets before sending them to -+userspace with a netlink socket. Note that packets can be sent to -+userspace before the queue is full, this happens when the ulog -+kernel timer goes off (the frequency of this timer depends on -+.BR flushtimeout ). -+.SS TARGET EXTENSIONS -+.SS arpreply -+The -+.B arpreply -+target can be used in the -+.BR PREROUTING " chain of the " nat " table." -+If this target sees an ARP request it will automatically reply -+with an ARP reply. The used MAC address for the reply can be specified. -+The protocol must be specified as -+.IR ARP . -+When the ARP message is not an ARP request or when the ARP request isn't -+for an IP address on an Ethernet network, it is ignored by this target -+.BR "" ( CONTINUE ). -+When the ARP request is malformed, it is dropped -+.BR "" ( DROP ). -+.TP -+.BR "--arpreply-mac " "\fIaddress\fP" -+Specifies the MAC address to reply with: the Ethernet source MAC and the -+ARP payload source MAC will be filled in with this address. -+.TP -+.BR "--arpreply-target " "\fItarget\fP" -+Specifies the standard target. After sending the ARP reply, the rule still -+has to give a standard target so ebtables knows what to do with the ARP request. -+The default target -+.BR "" "is " DROP . -+.SS dnat -+The -+.B dnat -+target can only be used in the -+.BR BROUTING " chain of the " broute " table and the " -+.BR PREROUTING " and " OUTPUT " chains of the " nat " table." -+It specifies that the destination MAC address has to be changed. -+.TP -+.BR "--to-destination " "\fIaddress\fP" -+.br -+Change the destination MAC address to the specified -+.IR address . -+The flag -+.B --to-dst -+is an alias for this option. -+.TP -+.BR "--dnat-target " "\fItarget\fP" -+.br -+Specifies the standard target. After doing the dnat, the rule still has to -+give a standard target so ebtables knows what to do with the dnated frame. -+The default target is -+.BR ACCEPT . -+Making it -+.BR CONTINUE " could let you use" -+multiple target extensions on the same frame. Making it -+.BR DROP " only makes" -+sense in the -+.BR BROUTING " chain but using the " redirect " target is more logical there. " RETURN " is also allowed. Note that using " RETURN -+in a base chain is not allowed (for obvious reasons). -+.SS mark -+.BR "" "The " mark " target can be used in every chain of every table. It is possible" -+to use the marking of a frame/packet in both ebtables and iptables, -+if the bridge-nf code is compiled into the kernel. Both put the marking at the -+same place. This allows for a form of communication between ebtables and iptables. -+.TP -+.BR "--mark-set " "\fIvalue\fP" -+.br -+Mark the frame with the specified non-negative -+.IR value . -+.TP -+.BR "--mark-or " "\fIvalue\fP" -+.br -+Or the frame with the specified non-negative -+.IR value . -+.TP -+.BR "--mark-and " "\fIvalue\fP" -+.br -+And the frame with the specified non-negative -+.IR value . -+.TP -+.BR "--mark-xor " "\fIvalue\fP" -+.br -+Xor the frame with the specified non-negative -+.IR value . -+.TP -+.BR "--mark-target " "\fItarget\fP" -+.br -+Specifies the standard target. After marking the frame, the rule -+still has to give a standard target so ebtables knows what to do. -+The default target is -+.BR ACCEPT ". Making it " CONTINUE " can let you do other" -+things with the frame in subsequent rules of the chain. -+.SS redirect -+The -+.B redirect -+target will change the MAC target address to that of the bridge device the -+frame arrived on. This target can only be used in the -+.BR BROUTING " chain of the " broute " table and the " -+.BR PREROUTING " chain of the " nat " table." -+In the -+.BR BROUTING " chain, the MAC address of the bridge port is used as destination address," -+.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used." -+.TP -+.BR "--redirect-target " "\fItarget\fP" -+.br -+Specifies the standard target. After doing the MAC redirect, the rule -+still has to give a standard target so ebtables knows what to do. -+The default target is -+.BR ACCEPT ". Making it " CONTINUE " could let you use" -+multiple target extensions on the same frame. Making it -+.BR DROP " in the " BROUTING " chain will let the frames be routed. " RETURN " is also allowed. Note" -+.BR "" "that using " RETURN " in a base chain is not allowed." -+.SS snat -+The -+.B snat -+target can only be used in the -+.BR POSTROUTING " chain of the " nat " table." -+It specifies that the source MAC address has to be changed. -+.TP -+.BR "--to-source " "\fIaddress\fP" -+.br -+Changes the source MAC address to the specified -+.IR address ". The flag" -+.B --to-src -+is an alias for this option. -+.TP -+.BR "--snat-target " "\fItarget\fP" -+.br -+Specifies the standard target. After doing the snat, the rule still has -+to give a standard target so ebtables knows what to do. -+.BR "" "The default target is " ACCEPT ". Making it " CONTINUE " could let you use" -+.BR "" "multiple target extensions on the same frame. Making it " DROP " doesn't" -+.BR "" "make sense, but you could do that too. " RETURN " is also allowed. Note" -+.BR "" "that using " RETURN " in a base chain is not allowed." -+.br -+.TP -+.BR "--snat-arp " -+.br -+Also change the hardware source address inside the arp header if the packet is an -+arp message and the hardware address length in the arp header is 6 bytes. -+.br -+.SH FILES -+.I /etc/ethertypes -+.I /var/lib/ebtables/lock -+.SH ENVIRONMENT VARIABLES -+.I EBTABLES_ATOMIC_FILE -+.SH MAILINGLISTS -+.BR "" "See " http://netfilter.org/mailinglists.html -+.SH SEE ALSO -+.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8) -+.PP -+.BR "" "See " http://ebtables.sf.net --- -2.21.0 - diff --git a/0006-doc-Adjust-ebtables-man-page.patch b/0006-doc-Adjust-ebtables-man-page.patch deleted file mode 100644 index 58c2c22..0000000 --- a/0006-doc-Adjust-ebtables-man-page.patch +++ /dev/null @@ -1,275 +0,0 @@ -From a3310b304ca75f45505b89071b1537a6fcc97228 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 13 Mar 2019 20:46:15 +0100 -Subject: [PATCH] doc: Adjust ebtables man page - -Change content to match nft-variant, most notably: - -* There is no broute table, drop all references to it -* Comment out description of among and string matches, we don't support - them (yet) - -Signed-off-by: Phil Sutter -Signed-off-by: Florian Westphal -(cherry picked from commit 1939cbc25e6f51cebaa7a2d71c45bb312bab8668) -Signed-off-by: Phil Sutter ---- - iptables/ebtables-nft.8 | 164 ++++++++++++++++------------------------ - 1 file changed, 67 insertions(+), 97 deletions(-) - -diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 -index 55204ab91e8a4..db8b2ab28cca5 100644 ---- a/iptables/ebtables-nft.8 -+++ b/iptables/ebtables-nft.8 -@@ -24,7 +24,7 @@ - .\" - .\" - .SH NAME --ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legacy) -+ebtables \- Ethernet bridge frame table administration (nft-based) - .SH SYNOPSIS - .BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target" - .br -@@ -51,17 +51,6 @@ ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legac - .BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save - .br - --.SH LEGACY --This tool uses the old xtables/setsockopt framework, and is a legacy version --of ebtables. That means that a new, more modern tool exists with the same --functionality using the nf_tables framework and you are encouraged to migrate now. --The new binaries (known as ebtables-nft and formerly known as ebtables-compat) --uses the same syntax and semantics than this legacy one. -- --You can still use this legacy tool. You should probably get some specific --information from your Linux distribution or vendor. --More docs are available at https://wiki.nftables.org -- - .SH DESCRIPTION - .B ebtables - is an application program used to set up and maintain the -@@ -72,7 +61,7 @@ It is analogous to the - application, but less complicated, due to the fact that the Ethernet protocol - is much simpler than the IP protocol. - .SS CHAINS --There are three ebtables tables with built-in chains in the -+There are two ebtables tables with built-in chains in the - Linux kernel. These tables are used to divide functionality into - different sets of rules. Each set of rules is called a chain. - Each chain is an ordered list of rules that can match Ethernet frames. If a -@@ -98,10 +87,7 @@ an 'extension' (see below) or a jump to a user-defined chain. - .B ACCEPT - means to let the frame through. - .B DROP --means the frame has to be dropped. In the --.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different" --meanings (see the info provided for the --.BR -t " option)." -+means the frame has to be dropped. - .B CONTINUE - means the next rule has to be checked. This can be handy, f.e., to know how many - frames pass a certain point in the chain, to log those frames or to apply multiple -@@ -113,14 +99,16 @@ For the extension targets please refer to the - .B "TARGET EXTENSIONS" - section of this man page. - .SS TABLES --As stated earlier, there are three ebtables tables in the Linux -+As stated earlier, there are two ebtables tables in the Linux - kernel. The table names are --.BR filter ", " nat " and " broute . --Of these three tables, -+.BR filter " and " nat . -+Of these two tables, - the filter table is the default table that the command operates on. - If you are working with the filter table, then you can drop the '-t filter' - argument to the ebtables command. However, you will need to provide --the -t argument for the other two tables. Moreover, the -t argument must be the -+the -t argument for -+.B nat -+table. Moreover, the -t argument must be the - first argument on the ebtables command line, if used. - .TP - .B "-t, --table" -@@ -149,25 +137,6 @@ iptables world to ebtables it is easier to have the same names. Note that you - can change the name - .BR "" ( -E ) - if you don't like the default. --.br --.br --.B broute --is used to make a brouter, it has one built-in chain: --.BR BROUTING . --The targets --.BR DROP " and " ACCEPT --have a special meaning in the broute table (these names are used instead of --more descriptive names to keep the implementation generic). --.B DROP --actually means the frame has to be routed, while --.B ACCEPT --means the frame has to be bridged. The --.B BROUTING --chain is traversed very early. However, it is only traversed by frames entering on --a bridge port that is in forwarding state. Normally those frames --would be bridged, but you can decide otherwise here. The --.B redirect --target is very handy here. - .SH EBTABLES COMMAND LINE ARGUMENTS - After the initial ebtables '-t table' command line argument, the remaining - arguments can be divided into several groups. These groups -@@ -553,35 +522,35 @@ If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must - be consulted to determine the payload protocol. This is a two byte - (hexadecimal) argument. Only 802.3 frames with DSAP/SSAP 0xaa are - checked for type. --.SS among --Match a MAC address or MAC/IP address pair versus a list of MAC addresses --and MAC/IP address pairs. --A list entry has the following format: --.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" --list entries are separated by a comma, specifying an IP address corresponding to --the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address --but different IP address (and vice versa) can be specified. If the MAC address doesn't --match any entry from the list, the frame doesn't match the rule (unless "!" was used). --.TP --.BR "--among-dst " "[!] \fIlist\fP" --Compare the MAC destination to the given list. If the Ethernet frame has type --.IR IPv4 " or " ARP , --then comparison with MAC/IP destination address pairs from the --list is possible. --.TP --.BR "--among-src " "[!] \fIlist\fP" --Compare the MAC source to the given list. If the Ethernet frame has type --.IR IPv4 " or " ARP , --then comparison with MAC/IP source address pairs from the list --is possible. --.TP --.BR "--among-dst-file " "[!] \fIfile\fP" --Same as --.BR --among-dst " but the list is read in from the specified file." --.TP --.BR "--among-src-file " "[!] \fIfile\fP" --Same as --.BR --among-src " but the list is read in from the specified file." -+.\" .SS among -+.\" Match a MAC address or MAC/IP address pair versus a list of MAC addresses -+.\" and MAC/IP address pairs. -+.\" A list entry has the following format: -+.\" .IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple" -+.\" list entries are separated by a comma, specifying an IP address corresponding to -+.\" the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address -+.\" but different IP address (and vice versa) can be specified. If the MAC address doesn't -+.\" match any entry from the list, the frame doesn't match the rule (unless "!" was used). -+.\" .TP -+.\" .BR "--among-dst " "[!] \fIlist\fP" -+.\" Compare the MAC destination to the given list. If the Ethernet frame has type -+.\" .IR IPv4 " or " ARP , -+.\" then comparison with MAC/IP destination address pairs from the -+.\" list is possible. -+.\" .TP -+.\" .BR "--among-src " "[!] \fIlist\fP" -+.\" Compare the MAC source to the given list. If the Ethernet frame has type -+.\" .IR IPv4 " or " ARP , -+.\" then comparison with MAC/IP source address pairs from the list -+.\" is possible. -+.\" .TP -+.\" .BR "--among-dst-file " "[!] \fIfile\fP" -+.\" Same as -+.\" .BR --among-dst " but the list is read in from the specified file." -+.\" .TP -+.\" .BR "--among-src-file " "[!] \fIfile\fP" -+.\" Same as -+.\" .BR --among-src " but the list is read in from the specified file." - .SS arp - Specify (R)ARP fields. The protocol must be specified as - .IR ARP " or " RARP . -@@ -822,26 +791,26 @@ The hello time timer (0-65535) range. - .TP - .BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]" - The forward delay timer (0-65535) range. --.SS string --This module matches on a given string using some pattern matching strategy. --.TP --.BR "--string-algo " "\fIalgorithm\fP" --The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) --.TP --.BR "--string-from " "\fIoffset\fP" --The lowest offset from which a match can start. (default: 0) --.TP --.BR "--string-to " "\fIoffset\fP" --The highest offset from which a match can start. (default: size of frame) --.TP --.BR "--string " "[!] \fIpattern\fP" --Matches the given pattern. --.TP --.BR "--string-hex " "[!] \fIpattern\fP" --Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' --.TP --.BR "--string-icase" --Ignore case when searching. -+.\" .SS string -+.\" This module matches on a given string using some pattern matching strategy. -+.\" .TP -+.\" .BR "--string-algo " "\fIalgorithm\fP" -+.\" The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris) -+.\" .TP -+.\" .BR "--string-from " "\fIoffset\fP" -+.\" The lowest offset from which a match can start. (default: 0) -+.\" .TP -+.\" .BR "--string-to " "\fIoffset\fP" -+.\" The highest offset from which a match can start. (default: size of frame) -+.\" .TP -+.\" .BR "--string " "[!] \fIpattern\fP" -+.\" Matches the given pattern. -+.\" .TP -+.\" .BR "--string-hex " "[!] \fIpattern\fP" -+.\" Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|' -+.\" .TP -+.\" .BR "--string-icase" -+.\" Ignore case when searching. - .SS vlan - Specify 802.1Q Tag Control Information fields. - The protocol must be specified as -@@ -1026,7 +995,6 @@ The default target - The - .B dnat - target can only be used in the --.BR BROUTING " chain of the " broute " table and the " - .BR PREROUTING " and " OUTPUT " chains of the " nat " table." - It specifies that the destination MAC address has to be changed. - .TP -@@ -1089,11 +1057,8 @@ The - .B redirect - target will change the MAC target address to that of the bridge device the - frame arrived on. This target can only be used in the --.BR BROUTING " chain of the " broute " table and the " - .BR PREROUTING " chain of the " nat " table." --In the --.BR BROUTING " chain, the MAC address of the bridge port is used as destination address," --.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used." -+The MAC address of the bridge is used as destination address." - .TP - .BR "--redirect-target " "\fItarget\fP" - .br -@@ -1135,12 +1100,17 @@ arp message and the hardware address length in the arp header is 6 bytes. - .br - .SH FILES - .I /etc/ethertypes --.I /var/lib/ebtables/lock - .SH ENVIRONMENT VARIABLES - .I EBTABLES_ATOMIC_FILE - .SH MAILINGLISTS - .BR "" "See " http://netfilter.org/mailinglists.html -+.SH BUGS -+The version of ebtables this man page ships with does not support the -+.B broute -+table. Also there is no support for -+.BR among " and " string -+matches. And finally, this list is probably not complete. - .SH SEE ALSO --.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8) -+.BR xtables-nft "(8), " iptables "(8), " ip (8) - .PP --.BR "" "See " http://ebtables.sf.net -+.BR "" "See " https://wiki.nftables.org --- -2.21.0 - diff --git a/iptables.spec b/iptables.spec index a843584..bfebd8b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -4,19 +4,33 @@ # service legacy actions (RHBZ#748134) %global legacy_actions %{_libexecdir}/initscripts/legacy-actions +# Bootstrap mode providing old and new versions of libip{4,6}tc in parallel +%global bootstrap 1 + +%if 0%{?bootstrap} +%global version_old 1.8.2 +%global iptc_so_ver_old 0 +%endif +%global iptc_so_ver 2 + Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities +URL: http://www.netfilter.org/projects/iptables Version: 1.8.3 -Release: 2%{?dist} -Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2 +Release: 3%{?dist} +Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config Source3: iptables.service Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper +%if 0%{?bootstrap} +Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 +Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch +%endif + Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch -URL: http://www.netfilter.org/ # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -115,6 +129,14 @@ nftables compatibility for iptables, arptables and ebtables. %prep %autosetup -p1 +%if 0%{?bootstrap} +%{__mkdir} -p bootstrap_ver +pushd bootstrap_ver +%{__tar} --strip-components=1 -xf %{SOURCE7} +%{__patch} -p1 <%{SOURCE8} +popd +%endif + %build ./autogen.sh CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ @@ -128,7 +150,31 @@ rm -f include/linux/types.h make %{?_smp_mflags} +%if 0%{?bootstrap} +pushd bootstrap_ver +./autogen.sh +CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ +%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr + +# do not use rpath +sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool +sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool + +rm -f include/linux/types.h + +make %{?_smp_mflags} +popd +%endif + %install +%if 0%{?bootstrap} +%make_install -C bootstrap_ver +%{_bindir}/find %{buildroot} -xtype f -not \ + -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print +%{_bindir}/find %{buildroot} -type l -not \ + -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print +%endif + make install DESTDIR=%{buildroot} # remove la file(s) rm -f %{buildroot}/%{_libdir}/*.la @@ -315,8 +361,11 @@ fi %ghost %{_sbindir}/ip6tables-save %files libs -%{_libdir}/libip*tc.so.* -%{_libdir}/libxtables.so.* +%{_libdir}/libip*tc.so.%{iptc_so_ver}* +%if 0%{?bootstrap} +%{_libdir}/libip*tc.so.%{iptc_so_ver_old}* +%endif +%{_libdir}/libxtables.so.12* %files devel %dir %{_includedir}/iptables @@ -393,6 +442,12 @@ fi %changelog +* Tue Jun 25 2019 Phil Sutter - 1.8.3-3 +- Change URL to point at iptables project, not netfilter overview page +- Reuse URL value in tarball source +- Reduce globbing of library file names to expose future SONAME changes +- Add bootstrapping for libip*tc SONAME bump + * Tue Jun 25 2019 Phil Sutter - 1.8.3-2 - Install new man page for nfbpf_compile utility - Move nfnl_osf man page to utils subpackage From 084f96bd4290efa7b66cd3d173658edabdfd875a Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Jun 2019 17:07:54 +0200 Subject: [PATCH 013/100] Update sources file --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index a175f1e..24a883a 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (iptables-1.8.3.tar.bz2) = 84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d +SHA512 (iptables-1.8.2.tar.bz2) = 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76 From d77ee4b99d2ab369ec84c3c6f85aabb0a061853d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Tue, 25 Jun 2019 19:45:26 +0200 Subject: [PATCH 014/100] iptables-1.8.3-4 - Disable bootstrapping --- iptables.spec | 7 +++++-- sources | 1 - 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index bfebd8b..e1ed56a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -5,7 +5,7 @@ %global legacy_actions %{_libexecdir}/initscripts/legacy-actions # Bootstrap mode providing old and new versions of libip{4,6}tc in parallel -%global bootstrap 1 +%global bootstrap 0 %if 0%{?bootstrap} %global version_old 1.8.2 @@ -17,7 +17,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.3 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -442,6 +442,9 @@ fi %changelog +* Tue Jun 25 2019 Björn Esser - 1.8.3-4 +- Disable bootstrapping + * Tue Jun 25 2019 Phil Sutter - 1.8.3-3 - Change URL to point at iptables project, not netfilter overview page - Reuse URL value in tarball source diff --git a/sources b/sources index 24a883a..a175f1e 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ SHA512 (iptables-1.8.3.tar.bz2) = 84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d -SHA512 (iptables-1.8.2.tar.bz2) = 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76 From 44fab225f9fca30cec222d60b3d4db44889f7d92 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Tue, 25 Jun 2019 20:11:52 +0200 Subject: [PATCH 015/100] Fix for differing so-versions --- iptables.spec | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/iptables.spec b/iptables.spec index e1ed56a..444bcf3 100644 --- a/iptables.spec +++ b/iptables.spec @@ -5,13 +5,15 @@ %global legacy_actions %{_libexecdir}/initscripts/legacy-actions # Bootstrap mode providing old and new versions of libip{4,6}tc in parallel -%global bootstrap 0 +%global bootstrap 0 %if 0%{?bootstrap} -%global version_old 1.8.2 -%global iptc_so_ver_old 0 +%global version_old 1.8.2 +%global iptc_so_ver_old 0 +%global ipXtc_so_ver_old 0 %endif -%global iptc_so_ver 2 +%global iptc_so_ver 0 +%global ipXtc_so_ver 2 Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities @@ -361,9 +363,11 @@ fi %ghost %{_sbindir}/ip6tables-save %files libs -%{_libdir}/libip*tc.so.%{iptc_so_ver}* +%{_libdir}/libiptc.so.%{iptc_so_ver}* +%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}* %if 0%{?bootstrap} -%{_libdir}/libip*tc.so.%{iptc_so_ver_old}* +%{_libdir}/libiptc.so.%{iptc_so_ver_old}* +%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}* %endif %{_libdir}/libxtables.so.12* From b7623c906b10819e96b226af8f10eff7228147c2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jul 2019 09:40:19 +0000 Subject: [PATCH 016/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 444bcf3..77da8ba 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.3 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -446,6 +446,9 @@ fi %changelog +* Thu Jul 25 2019 Fedora Release Engineering - 1.8.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Tue Jun 25 2019 Björn Esser - 1.8.3-4 - Disable bootstrapping From 0681cd970811419ee1585f08abaa47939e1e6576 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 4 Dec 2019 16:44:05 +0100 Subject: [PATCH 017/100] iptables-1.8.4-1 - New upstream version 1.8.4 --- .gitignore | 1 + iptables.spec | 12 ++++++------ sources | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index b08866a..55b0b32 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /iptables-1.8.0.tar.bz2 /iptables-1.8.2.tar.bz2 /iptables-1.8.3.tar.bz2 +/iptables-1.8.4.tar.bz2 diff --git a/iptables.spec b/iptables.spec index 77da8ba..6fce111 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.3 -Release: 5%{?dist} +Version: 1.8.4 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -44,14 +44,12 @@ BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers BuildRequires: systemd -BuildRequires: pkgconfig(libnftnl) >= 1.1.3 -BuildRequires: pkgconfig(libmnl) >= 1.0 # libmnl, libnftnl, bison, flex for nftables BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.0.5 +BuildRequires: pkgconfig(libnftnl) >= 1.1.5 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autogen @@ -363,7 +361,6 @@ fi %ghost %{_sbindir}/ip6tables-save %files libs -%{_libdir}/libiptc.so.%{iptc_so_ver}* %{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}* %if 0%{?bootstrap} %{_libdir}/libiptc.so.%{iptc_so_ver_old}* @@ -446,6 +443,9 @@ fi %changelog +* Wed Dec 04 2019 Phil Sutter - 1.8.4-1 +- New upstream version 1.8.4 + * Thu Jul 25 2019 Fedora Release Engineering - 1.8.3-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index a175f1e..34b13bd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.3.tar.bz2) = 84b10080646077cbea78b7f3fcc58c6c6e1898213341c69862e1b48179f37a6820c3d84437c896071f966b61aa6d16b132d91948a85fd8c05740f29be3a0986d +SHA512 (iptables-1.8.4.tar.bz2) = a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb From 195c6f705117ee28af2e3107a5253aaebd174db8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Dec 2019 22:29:00 +0100 Subject: [PATCH 018/100] iptables-1.8.4-2 - iptables-services requires /etc/init.d/functions --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 6fce111..5c51ed7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -95,6 +95,7 @@ stable and may change with every new version. It is therefore unsupported. %package services Summary: iptables and ip6tables services for iptables Requires: %{name} = %{version}-%{release} +Requires: /etc/init.d/functions %{?systemd_ordering} # obsolete old main package Obsoletes: %{name} < 1.4.16.1 @@ -443,6 +444,9 @@ fi %changelog +* Tue Dec 10 2019 Phil Sutter - 1.8.4-2 +- iptables-services requires /etc/init.d/functions + * Wed Dec 04 2019 Phil Sutter - 1.8.4-1 - New upstream version 1.8.4 From 1eb645da34fc7563462f29afe140f1a3ddb32855 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 13 Dec 2019 14:52:22 +0100 Subject: [PATCH 019/100] iptables-1.8.4-3 - Remove dependencies on initscripts package --- iptables.init | 18 ++++++++++++++++-- iptables.spec | 6 ++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/iptables.init b/iptables.init index 8f74bb3..51155b0 100755 --- a/iptables.init +++ b/iptables.init @@ -18,8 +18,22 @@ # Description: Start, stop and save iptables firewall ### END INIT INFO -# Source function library. -. /etc/init.d/functions +# compat for removed initscripts dependency + +success() { + echo -n "[ OK ]" + return 0 +} + +warning() { + echo -n "[WARNING]" + return 1 +} + +failure() { + echo -n "[FAILED]" + return 1 +} IPTABLES=iptables IPTABLES_DATA=/etc/sysconfig/$IPTABLES diff --git a/iptables.spec b/iptables.spec index 5c51ed7..648dde7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -95,7 +95,6 @@ stable and may change with every new version. It is therefore unsupported. %package services Summary: iptables and ip6tables services for iptables Requires: %{name} = %{version}-%{release} -Requires: /etc/init.d/functions %{?systemd_ordering} # obsolete old main package Obsoletes: %{name} < 1.4.16.1 @@ -444,6 +443,9 @@ fi %changelog +* Fri Dec 13 2019 Phil Sutter - 1.8.4-3 +- Remove dependencies on initscripts package + * Tue Dec 10 2019 Phil Sutter - 1.8.4-2 - iptables-services requires /etc/init.d/functions From cdcc1ab620278156756a0032c9b369a63c4f651a Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 19 Dec 2019 12:02:45 +0100 Subject: [PATCH 020/100] iptables-1.8.4-4 - Drop leftover include in arptables-nft-helper --- arptables-nft-helper | 16 ++++++++++++---- iptables.spec | 5 ++++- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/arptables-nft-helper b/arptables-nft-helper index 8bb0629..7380abf 100644 --- a/arptables-nft-helper +++ b/arptables-nft-helper @@ -1,11 +1,19 @@ #!/bin/sh -# config: /etc/sysconfig/arptables - -# Source 'em up -. /etc/init.d/functions ARPTABLES_CONFIG=/etc/sysconfig/arptables +# compat for removed initscripts dependency + +success() { + echo -n "[ OK ]" + return 0 +} + +failure() { + echo -n "[FAILED]" + return 1 +} + start() { if [ ! -x /usr/sbin/arptables ]; then exit 4 diff --git a/iptables.spec b/iptables.spec index 648dde7..c0ffb8a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -443,6 +443,9 @@ fi %changelog +* Thu Dec 19 2019 Phil Sutter - 1.8.4-4 +- Drop leftover include in arptables-nft-helper + * Fri Dec 13 2019 Phil Sutter - 1.8.4-3 - Remove dependencies on initscripts package From c92b9d3896369ee992f643e2a2c5d2b1c824fefb Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 16 Jan 2020 12:40:33 +0100 Subject: [PATCH 021/100] iptables-1.8.4-5 - Raise Alternatives priority of nft variants to match legacy ones - Add Provides lines to allow for iptables-nft as full legacy alternative --- iptables.spec | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/iptables.spec b/iptables.spec index c0ffb8a..82db381 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -122,6 +122,9 @@ Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name} = %{version}-%{release} Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper +Provides: iptables +Provides: arptables +Provides: ebtables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -175,7 +178,7 @@ popd -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print %endif -make install DESTDIR=%{buildroot} +make install DESTDIR=%{buildroot} # remove la file(s) rm -f %{buildroot}/%{_libdir}/*.la @@ -277,7 +280,7 @@ fi pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ - $pfx iptables $pfx-nft 5 \ + $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ --slave $pfx-save iptables-save $pfx-nft-save \ @@ -295,7 +298,7 @@ if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi %{_sbindir}/update-alternatives --install \ - $pfx ebtables $pfx-nft 5 \ + $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ --slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz @@ -315,7 +318,7 @@ if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi %{_sbindir}/update-alternatives --install \ - $pfx arptables $pfx-nft 5 \ + $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ --slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \ @@ -443,6 +446,10 @@ fi %changelog +* Wed Jan 15 2020 Phil Sutter - 1.8.4-5 +- Raise Alternatives priority of nft variants to match legacy ones +- Add Provides lines to allow for iptables-nft as full legacy alternative + * Thu Dec 19 2019 Phil Sutter - 1.8.4-4 - Drop leftover include in arptables-nft-helper From cebf536dea98f146fd7a74b11859afc06367461d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 05:36:32 +0000 Subject: [PATCH 022/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 82db381..caa83bc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -446,6 +446,9 @@ fi %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 1.8.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Wed Jan 15 2020 Phil Sutter - 1.8.4-5 - Raise Alternatives priority of nft variants to match legacy ones - Add Provides lines to allow for iptables-nft as full legacy alternative From 66ed4161feee196cffd87f969dc13a97218999e8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 12 Feb 2020 19:21:32 +0100 Subject: [PATCH 023/100] iptables-1.8.4-7 - Move nft-specific extensions into iptables-nft package - Move remaining extensions into iptables-libs package - Make iptables-nft depend on iptables-libs instead of iptables - Add upstream-suggested fixes --- ...apply-Use-mktemp-instead-of-tempfile.patch | 4 +- 0002-Fix-DEBUG-build.patch | 33 ++++++++ ...ore-Fix-parser-feed-from-line-buffer.patch | 59 ++++++++++++++ ...e-Avoid-access-of-uninitialized-data.patch | 31 ++++++++ ...xtensions-time-Avoid-undefined-shift.patch | 31 ++++++++ ...nsions-cluster-Avoid-undefined-shift.patch | 31 ++++++++ ...te-Guard-strcpy-call-in-xlate_ifname.patch | 40 ++++++++++ ...extensions-among-Check-call-to-fstat.patch | 41 ++++++++++ ...tore-fix-for-noflush-and-empty-lines.patch | 78 +++++++++++++++++++ iptables.spec | 32 ++++++-- 10 files changed, 370 insertions(+), 10 deletions(-) create mode 100644 0002-Fix-DEBUG-build.patch create mode 100644 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch create mode 100644 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch create mode 100644 0005-extensions-time-Avoid-undefined-shift.patch create mode 100644 0006-extensions-cluster-Avoid-undefined-shift.patch create mode 100644 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch create mode 100644 0008-extensions-among-Check-call-to-fstat.patch create mode 100644 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch index b6e1712..970370d 100644 --- a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +++ b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch @@ -1,4 +1,4 @@ -From 1dba0d0a2c9c269dc5ed9e7d841b8ecb9dc060af Mon Sep 17 00:00:00 2001 +From 6455a8201fab45194413b326aecc1d764033db0b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Apr 2019 18:02:19 +0200 Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile @@ -31,5 +31,5 @@ index 819ca4a459c42..a685b6bbcd7dc 100755 FPE USR1 SEGV USR2 PIPE ALRM TERM -- -2.21.0 +2.24.1 diff --git a/0002-Fix-DEBUG-build.patch b/0002-Fix-DEBUG-build.patch new file mode 100644 index 0000000..f95306b --- /dev/null +++ b/0002-Fix-DEBUG-build.patch @@ -0,0 +1,33 @@ +From a7eb134ce97d873c0fe5d30ac1ddce447aba576c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Dec 2019 09:36:59 +0100 +Subject: [PATCH] Fix DEBUG build + +Fixed commit missed to update this conditional call to +nft_rule_print_save(). + +Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d) +Signed-off-by: Phil Sutter +--- + iptables/nft-shared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 78e422781723f..426765641cff6 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data) + + DEBUGP("comparing with... "); + #ifdef DEBUG_DEL +- nft_rule_print_save(r, NFT_RULE_APPEND, 0); ++ nft_rule_print_save(h, r, NFT_RULE_APPEND, 0); + #endif + if (!h->ops->is_same(cs, &this)) + goto out; +-- +2.24.1 + diff --git a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch new file mode 100644 index 0000000..85a760b --- /dev/null +++ b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch @@ -0,0 +1,59 @@ +From f587011318fd47b18d0f0174b6594485a546ca8f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Dec 2019 09:56:06 +0100 +Subject: [PATCH] xtables-restore: Fix parser feed from line buffer + +When called with --noflush, xtables-restore would trip over chain lines: +Parser uses strtok() to separate chain name, policy and counters which +inserts nul-chars into the source string. Therefore strlen() can't be +used anymore to find end of line. Fix this by caching line length before +calling xtables_restore_parse_line(). + +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c) +Signed-off-by: Phil Sutter +--- + .../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++ + iptables/xtables-restore.c | 4 +++- + 2 files changed, 13 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +new file mode 100755 +index 0000000000000..739e684a21183 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +@@ -0,0 +1,10 @@ ++#!/bin/sh -e ++ ++# assert input feed from buffer doesn't trip over ++# added nul-chars from parsing chain line. ++ ++$XT_MULTI iptables-restore --noflush <error.lineno = ++line; + DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr); + xtables_restore_parse_line(h, p, &state, ptr); +- ptr += strlen(ptr) + 1; ++ ptr += len + 1; + } + if (*buffer) { + h->error.lineno = ++line; +-- +2.24.1 + diff --git a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch new file mode 100644 index 0000000..d640ab6 --- /dev/null +++ b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch @@ -0,0 +1,31 @@ +From 79aea9da9108323922dce0820d362c23619371f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 11:40:26 +0100 +Subject: [PATCH] xtables-restore: Avoid access of uninitialized data + +When flushing, 'buffer' is not written to prior to checking its first +byte's value. Therefore it needs to be initialized upon declaration. + +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08) +Signed-off-by: Phil Sutter +--- + iptables/xtables-restore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c +index dd907e0b8ddd5..63cc15cee9621 100644 +--- a/iptables/xtables-restore.c ++++ b/iptables/xtables-restore.c +@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h, + const struct nft_xt_restore_parse *p) + { + struct nft_xt_restore_state state = {}; +- char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr; ++ char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr; + + if (!h->noflush) { + nft_fake_cache(h); +-- +2.24.1 + diff --git a/0005-extensions-time-Avoid-undefined-shift.patch b/0005-extensions-time-Avoid-undefined-shift.patch new file mode 100644 index 0000000..8af492d --- /dev/null +++ b/0005-extensions-time-Avoid-undefined-shift.patch @@ -0,0 +1,31 @@ +From cf6d2d3892f62d60fa029a94867a99e87e2ab175 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:15:01 +0100 +Subject: [PATCH] extensions: time: Avoid undefined shift + +Value 1 is signed by default and left-shifting by 31 is undefined for +those. Fix this by marking the value as unsigned. + +Fixes: ad326ef9f734a ("Add the libxt_time iptables match") +(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b) +Signed-off-by: Phil Sutter +--- + extensions/libxt_time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c +index 5a8cc5de13031..d001f5b7f448f 100644 +--- a/extensions/libxt_time.c ++++ b/extensions/libxt_time.c +@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable) + + printf(" "); + for (i = 1; i <= 31; ++i) +- if (mask & (1 << i)) { ++ if (mask & (1u << i)) { + if (nbdays++ > 0) + printf(","); + printf("%u", i); +-- +2.24.1 + diff --git a/0006-extensions-cluster-Avoid-undefined-shift.patch b/0006-extensions-cluster-Avoid-undefined-shift.patch new file mode 100644 index 0000000..f9c429f --- /dev/null +++ b/0006-extensions-cluster-Avoid-undefined-shift.patch @@ -0,0 +1,31 @@ +From adfa4a0a95d26b7aaae0c1754f77a863bcd05120 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:36:31 +0100 +Subject: [PATCH] extensions: cluster: Avoid undefined shift + +Value 1 is signed by default and left-shifting by 31 is undefined for +those. Fix this by marking the value as unsigned. + +Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft") +(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694) +Signed-off-by: Phil Sutter +--- + extensions/libxt_cluster.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c +index c9c35ee22e3df..d164bf6960166 100644 +--- a/extensions/libxt_cluster.c ++++ b/extensions/libxt_cluster.c +@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl, + xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st, + info->total_nodes, info->hash_seed); + for (node = 0; node < 32; node++) { +- if (info->node_mask & (1 << node)) { ++ if (info->node_mask & (1u << node)) { + if (needs_set == 0) { + xt_xlate_add(xl, "{ "); + needs_set = 1; +-- +2.24.1 + diff --git a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch new file mode 100644 index 0000000..cfc0235 --- /dev/null +++ b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch @@ -0,0 +1,40 @@ +From 24e3defb866ecd391ee92417129df96402e1867c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 16:01:29 +0100 +Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname() + +The function potentially fed overlong strings to strcpy(). Given that +everything needed to avoid this is there, reorder code a bit to prevent +those inputs, too. + +Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft") +(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652) +Signed-off-by: Phil Sutter +--- + iptables/xtables-translate.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index a42c60a3b64c6..77a186b905d73 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -32,14 +32,13 @@ + void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert) + { ++ int ifaclen = strlen(ifname); + char iface[IFNAMSIZ]; +- int ifaclen; + +- if (ifname[0] == '\0') ++ if (ifaclen < 1 || ifaclen >= IFNAMSIZ) + return; + + strcpy(iface, ifname); +- ifaclen = strlen(iface); + if (iface[ifaclen - 1] == '+') + iface[ifaclen - 1] = '*'; + +-- +2.24.1 + diff --git a/0008-extensions-among-Check-call-to-fstat.patch b/0008-extensions-among-Check-call-to-fstat.patch new file mode 100644 index 0000000..ca84456 --- /dev/null +++ b/0008-extensions-among-Check-call-to-fstat.patch @@ -0,0 +1,41 @@ +From 10b51ba86b63a4d7afa208ea206c7c9872bc6e0a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 16:35:51 +0100 +Subject: [PATCH] extensions: among: Check call to fstat() + +If this fails, a bogus length value may be passed to mmap(). + +Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") +(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968) +Signed-off-by: Phil Sutter +--- + extensions/libebt_among.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c +index 2e87db3bc06fa..715d559f432c2 100644 +--- a/extensions/libebt_among.c ++++ b/extensions/libebt_among.c +@@ -6,6 +6,7 @@ + * August, 2003 + */ + ++#include + #include + #include + #include +@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert, + if ((fd = open(optarg, O_RDONLY)) == -1) + xtables_error(PARAMETER_PROBLEM, + "Couldn't open file '%s'", optarg); +- fstat(fd, &stats); ++ if (fstat(fd, &stats) < 0) ++ xtables_error(PARAMETER_PROBLEM, ++ "fstat(%s) failed: '%s'", ++ optarg, strerror(errno)); + flen = stats.st_size; + /* use mmap because the file will probably be big */ + optarg = mmap(0, flen, PROT_READ | PROT_WRITE, +-- +2.24.1 + diff --git a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch new file mode 100644 index 0000000..aca04fa --- /dev/null +++ b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch @@ -0,0 +1,78 @@ +From 17b62e149147f05d419103dbbde9dca361c2bd5d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 11 Feb 2020 16:52:59 +0100 +Subject: [PATCH] xtables-restore: fix for --noflush and empty lines + +Lookahead buffer used for cache requirements estimate in restore +--noflush separates individual lines with nul-chars. Two consecutive +nul-chars are interpreted as end of buffer and remaining buffer content +is skipped. + +Sadly, reading an empty line (i.e., one containing a newline character +only) caused double nul-chars to appear in buffer as well, leading to +premature stop when reading cached lines from buffer. + +To fix that, make use of xtables_restore_parse_line() skipping empty +lines without calling strtok() and just leave the newline character in +place. A more intuitive approach, namely skipping empty lines while +buffering, is deliberately not chosen as that would cause wrong values +in 'line' variable. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400 +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +Signed-off-by: Phil Sutter +Acked-by: Arturo Borrero Gonzalez +(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29) +Signed-off-by: Phil Sutter +--- + .../ipt-restore/0011-noflush-empty-line_0 | 16 ++++++++++++++++ + iptables/xtables-restore.c | 8 +++++--- + 2 files changed, 21 insertions(+), 3 deletions(-) + create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 +new file mode 100755 +index 0000000000000..bea1a690bb624 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 +@@ -0,0 +1,16 @@ ++#!/bin/bash -e ++ ++# make sure empty lines won't break --noflush ++ ++cat <in)) { + size_t blen = strlen(buffer); + +- /* drop trailing newline; xtables_restore_parse_line() ++ /* Drop trailing newline; xtables_restore_parse_line() + * uses strtok() which replaces them by nul-characters, + * causing unpredictable string delimiting in +- * preload_buffer */ +- if (buffer[blen - 1] == '\n') ++ * preload_buffer. ++ * Unless this is an empty line which would fold into a ++ * spurious EoB indicator (double nul-char). */ ++ if (buffer[blen - 1] == '\n' && blen > 1) + buffer[blen - 1] = '\0'; + else + blen++; +-- +2.24.1 + diff --git a/iptables.spec b/iptables.spec index caa83bc..b6c3780 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -33,6 +33,15 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +Patch2: 0002-Fix-DEBUG-build.patch +Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch +Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch +Patch5: 0005-extensions-time-Avoid-undefined-shift.patch +Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch +Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch +Patch8: 0008-extensions-among-Check-call-to-fstat.patch +Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -119,7 +128,7 @@ a bytecode generator for use with xt_bpf. %package nft Summary: nftables compatibility for iptables, arptables and ebtables -Requires: %{name} = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -350,12 +359,6 @@ fi %{_mandir}/man8/iptables* %{_mandir}/man8/ip6tables* %{_mandir}/man8/xtables-legacy* -%dir %{_libdir}/xtables -%{_libdir}/xtables/libarpt* -%{_libdir}/xtables/libebt* -%{_libdir}/xtables/libipt* -%{_libdir}/xtables/libip6t* -%{_libdir}/xtables/libxt* %ghost %{_sbindir}/iptables %ghost %{_sbindir}/iptables-restore %ghost %{_sbindir}/iptables-save @@ -370,6 +373,10 @@ fi %{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}* %endif %{_libdir}/libxtables.so.12* +%dir %{_libdir}/xtables +%{_libdir}/xtables/libipt* +%{_libdir}/xtables/libip6t* +%{_libdir}/xtables/libxt* %files devel %dir %{_includedir}/iptables @@ -422,6 +429,9 @@ fi %{_sbindir}/arptables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor +%dir %{_libdir}/xtables +%{_libdir}/xtables/libarpt* +%{_libdir}/xtables/libebt* %{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* @@ -446,6 +456,12 @@ fi %changelog +* Wed Feb 12 2020 Phil Sutter - 1.8.4-7 +- Move nft-specific extensions into iptables-nft package +- Move remaining extensions into iptables-libs package +- Make iptables-nft depend on iptables-libs instead of iptables +- Add upstream-suggested fixes + * Wed Jan 29 2020 Fedora Release Engineering - 1.8.4-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From bf5df54de681d9ea008a0bd0518002dd09902a83 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Jun 2020 12:01:10 +0200 Subject: [PATCH 024/100] iptables-1.8.5-1 - Rebase onto upstream version 1.8.5 plus two late fixes - Drop explicit iptables-apply installation, upstream fixed that - Ship ip6tables-apply along with iptables package --- .gitignore | 1 + ...iptables-apply-not-getting-installed.patch | 42 ++++++++++ ...apply-Use-mktemp-instead-of-tempfile.patch | 35 --------- 0002-Fix-DEBUG-build.patch | 33 -------- ...ate-don-t-fail-if-help-was-requested.patch | 58 ++++++++++++++ ...ore-Fix-parser-feed-from-line-buffer.patch | 59 -------------- ...e-Avoid-access-of-uninitialized-data.patch | 31 -------- ...xtensions-time-Avoid-undefined-shift.patch | 31 -------- ...nsions-cluster-Avoid-undefined-shift.patch | 31 -------- ...te-Guard-strcpy-call-in-xlate_ifname.patch | 40 ---------- ...extensions-among-Check-call-to-fstat.patch | 41 ---------- ...tore-fix-for-noflush-and-empty-lines.patch | 78 ------------------- iptables.spec | 25 +++--- sources | 2 +- 14 files changed, 112 insertions(+), 395 deletions(-) create mode 100644 0001-build-resolve-iptables-apply-not-getting-installed.patch delete mode 100644 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch delete mode 100644 0002-Fix-DEBUG-build.patch create mode 100644 0002-xtables-translate-don-t-fail-if-help-was-requested.patch delete mode 100644 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch delete mode 100644 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch delete mode 100644 0005-extensions-time-Avoid-undefined-shift.patch delete mode 100644 0006-extensions-cluster-Avoid-undefined-shift.patch delete mode 100644 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch delete mode 100644 0008-extensions-among-Check-call-to-fstat.patch delete mode 100644 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch diff --git a/.gitignore b/.gitignore index 55b0b32..ae4c970 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /iptables-1.8.2.tar.bz2 /iptables-1.8.3.tar.bz2 /iptables-1.8.4.tar.bz2 +/iptables-1.8.5.tar.bz2 diff --git a/0001-build-resolve-iptables-apply-not-getting-installed.patch b/0001-build-resolve-iptables-apply-not-getting-installed.patch new file mode 100644 index 0000000..26e08db --- /dev/null +++ b/0001-build-resolve-iptables-apply-not-getting-installed.patch @@ -0,0 +1,42 @@ +From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001 +From: Jan Engelhardt +Date: Wed, 3 Jun 2020 15:38:48 +0200 +Subject: [PATCH] build: resolve iptables-apply not getting installed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +ip6tables-apply gets installed but iptables-apply does not. +That is wrong. + +» make install DESTDIR=$PWD/r +» find r -name "*app*" +r/usr/local/sbin/ip6tables-apply +r/usr/local/share/man/man8/iptables-apply.8 +r/usr/local/share/man/man8/ip6tables-apply.8 + +Fixes: v1.8.5~87 +Signed-off-by: Jan Engelhardt +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b) +Signed-off-by: Phil Sutter +--- + iptables/Makefile.am | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/Makefile.am b/iptables/Makefile.am +index dc66b3cc09c08..2024dbf5cb88c 100644 +--- a/iptables/Makefile.am ++++ b/iptables/Makefile.am +@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ + ip6tables-save.8 iptables-extensions.8 \ + iptables-apply.8 ip6tables-apply.8 + +-sbin_SCRIPT = iptables-apply ++sbin_SCRIPTS = iptables-apply + + if ENABLE_NFTABLES + man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ +-- +2.27.0 + diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch deleted file mode 100644 index 970370d..0000000 --- a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 6455a8201fab45194413b326aecc1d764033db0b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 12 Apr 2019 18:02:19 +0200 -Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile - -Signed-off-by: Phil Sutter ---- - iptables/iptables-apply | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-apply b/iptables/iptables-apply -index 819ca4a459c42..a685b6bbcd7dc 100755 ---- a/iptables/iptables-apply -+++ b/iptables/iptables-apply -@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then - exit 2 - fi - --COMMANDS=(tempfile "$SAVE" "$RESTORE") -+COMMANDS=(mktemp "$SAVE" "$RESTORE") - - for cmd in "${COMMANDS[@]}"; do - if ! command -v $cmd >/dev/null; then -@@ -122,7 +122,7 @@ done - - umask 0700 - --TMPFILE=$(tempfile -p iptap) -+TMPFILE=$(mktemp) - trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \ - FPE USR1 SEGV USR2 PIPE ALRM TERM - --- -2.24.1 - diff --git a/0002-Fix-DEBUG-build.patch b/0002-Fix-DEBUG-build.patch deleted file mode 100644 index f95306b..0000000 --- a/0002-Fix-DEBUG-build.patch +++ /dev/null @@ -1,33 +0,0 @@ -From a7eb134ce97d873c0fe5d30ac1ddce447aba576c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 4 Dec 2019 09:36:59 +0100 -Subject: [PATCH] Fix DEBUG build - -Fixed commit missed to update this conditional call to -nft_rule_print_save(). - -Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback") -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d) -Signed-off-by: Phil Sutter ---- - iptables/nft-shared.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 78e422781723f..426765641cff6 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data) - - DEBUGP("comparing with... "); - #ifdef DEBUG_DEL -- nft_rule_print_save(r, NFT_RULE_APPEND, 0); -+ nft_rule_print_save(h, r, NFT_RULE_APPEND, 0); - #endif - if (!h->ops->is_same(cs, &this)) - goto out; --- -2.24.1 - diff --git a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch new file mode 100644 index 0000000..4fcb549 --- /dev/null +++ b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch @@ -0,0 +1,58 @@ +From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001 +From: Arturo Borrero Gonzalez +Date: Tue, 16 Jun 2020 11:20:42 +0200 +Subject: [PATCH] xtables-translate: don't fail if help was requested + +If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle +this case in do_command_xlate(). + +Before this patch, you would see: + + user@debian:~$ sudo iptables-translate -h + [..] + nft Unsupported command? + user@debian:~$ echo $? + 1 + +After this patch: + + user@debian:~$ sudo iptables-translate -h + [..] + user@debian:~$ echo $? + 0 + +Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") +Acked-by: Phil Sutter +Signed-off-by: Arturo Borrero Gonzalez +(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069) +Signed-off-by: Phil Sutter +--- + iptables/xtables-translate.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 5aa42496b5a48..363c8be15b3fa 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + + cs.restore = restore; + +- if (!restore) ++ if (!restore && p.command != CMD_NONE) + printf("nft "); + + switch (p.command) { +@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + break; + case CMD_SET_POLICY: + break; ++ case CMD_NONE: ++ ret = 1; ++ break; + default: + /* We should never reach this... */ + printf("Unsupported command?\n"); +-- +2.27.0 + diff --git a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch deleted file mode 100644 index 85a760b..0000000 --- a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch +++ /dev/null @@ -1,59 +0,0 @@ -From f587011318fd47b18d0f0174b6594485a546ca8f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 4 Dec 2019 09:56:06 +0100 -Subject: [PATCH] xtables-restore: Fix parser feed from line buffer - -When called with --noflush, xtables-restore would trip over chain lines: -Parser uses strtok() to separate chain name, policy and counters which -inserts nul-chars into the source string. Therefore strlen() can't be -used anymore to find end of line. Fix this by caching line length before -calling xtables_restore_parse_line(). - -Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c) -Signed-off-by: Phil Sutter ---- - .../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++ - iptables/xtables-restore.c | 4 +++- - 2 files changed, 13 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 - -diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 -new file mode 100755 -index 0000000000000..739e684a21183 ---- /dev/null -+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 -@@ -0,0 +1,10 @@ -+#!/bin/sh -e -+ -+# assert input feed from buffer doesn't trip over -+# added nul-chars from parsing chain line. -+ -+$XT_MULTI iptables-restore --noflush <error.lineno = ++line; - DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr); - xtables_restore_parse_line(h, p, &state, ptr); -- ptr += strlen(ptr) + 1; -+ ptr += len + 1; - } - if (*buffer) { - h->error.lineno = ++line; --- -2.24.1 - diff --git a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch deleted file mode 100644 index d640ab6..0000000 --- a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 79aea9da9108323922dce0820d362c23619371f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 11:40:26 +0100 -Subject: [PATCH] xtables-restore: Avoid access of uninitialized data - -When flushing, 'buffer' is not written to prior to checking its first -byte's value. Therefore it needs to be initialized upon declaration. - -Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") -(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08) -Signed-off-by: Phil Sutter ---- - iptables/xtables-restore.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c -index dd907e0b8ddd5..63cc15cee9621 100644 ---- a/iptables/xtables-restore.c -+++ b/iptables/xtables-restore.c -@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h, - const struct nft_xt_restore_parse *p) - { - struct nft_xt_restore_state state = {}; -- char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr; -+ char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr; - - if (!h->noflush) { - nft_fake_cache(h); --- -2.24.1 - diff --git a/0005-extensions-time-Avoid-undefined-shift.patch b/0005-extensions-time-Avoid-undefined-shift.patch deleted file mode 100644 index 8af492d..0000000 --- a/0005-extensions-time-Avoid-undefined-shift.patch +++ /dev/null @@ -1,31 +0,0 @@ -From cf6d2d3892f62d60fa029a94867a99e87e2ab175 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 13:15:01 +0100 -Subject: [PATCH] extensions: time: Avoid undefined shift - -Value 1 is signed by default and left-shifting by 31 is undefined for -those. Fix this by marking the value as unsigned. - -Fixes: ad326ef9f734a ("Add the libxt_time iptables match") -(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b) -Signed-off-by: Phil Sutter ---- - extensions/libxt_time.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c -index 5a8cc5de13031..d001f5b7f448f 100644 ---- a/extensions/libxt_time.c -+++ b/extensions/libxt_time.c -@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable) - - printf(" "); - for (i = 1; i <= 31; ++i) -- if (mask & (1 << i)) { -+ if (mask & (1u << i)) { - if (nbdays++ > 0) - printf(","); - printf("%u", i); --- -2.24.1 - diff --git a/0006-extensions-cluster-Avoid-undefined-shift.patch b/0006-extensions-cluster-Avoid-undefined-shift.patch deleted file mode 100644 index f9c429f..0000000 --- a/0006-extensions-cluster-Avoid-undefined-shift.patch +++ /dev/null @@ -1,31 +0,0 @@ -From adfa4a0a95d26b7aaae0c1754f77a863bcd05120 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 13:36:31 +0100 -Subject: [PATCH] extensions: cluster: Avoid undefined shift - -Value 1 is signed by default and left-shifting by 31 is undefined for -those. Fix this by marking the value as unsigned. - -Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft") -(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694) -Signed-off-by: Phil Sutter ---- - extensions/libxt_cluster.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c -index c9c35ee22e3df..d164bf6960166 100644 ---- a/extensions/libxt_cluster.c -+++ b/extensions/libxt_cluster.c -@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl, - xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st, - info->total_nodes, info->hash_seed); - for (node = 0; node < 32; node++) { -- if (info->node_mask & (1 << node)) { -+ if (info->node_mask & (1u << node)) { - if (needs_set == 0) { - xt_xlate_add(xl, "{ "); - needs_set = 1; --- -2.24.1 - diff --git a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch deleted file mode 100644 index cfc0235..0000000 --- a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 24e3defb866ecd391ee92417129df96402e1867c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 16:01:29 +0100 -Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname() - -The function potentially fed overlong strings to strcpy(). Given that -everything needed to avoid this is there, reorder code a bit to prevent -those inputs, too. - -Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft") -(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652) -Signed-off-by: Phil Sutter ---- - iptables/xtables-translate.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index a42c60a3b64c6..77a186b905d73 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -32,14 +32,13 @@ - void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, - bool invert) - { -+ int ifaclen = strlen(ifname); - char iface[IFNAMSIZ]; -- int ifaclen; - -- if (ifname[0] == '\0') -+ if (ifaclen < 1 || ifaclen >= IFNAMSIZ) - return; - - strcpy(iface, ifname); -- ifaclen = strlen(iface); - if (iface[ifaclen - 1] == '+') - iface[ifaclen - 1] = '*'; - --- -2.24.1 - diff --git a/0008-extensions-among-Check-call-to-fstat.patch b/0008-extensions-among-Check-call-to-fstat.patch deleted file mode 100644 index ca84456..0000000 --- a/0008-extensions-among-Check-call-to-fstat.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 10b51ba86b63a4d7afa208ea206c7c9872bc6e0a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 16:35:51 +0100 -Subject: [PATCH] extensions: among: Check call to fstat() - -If this fails, a bogus length value may be passed to mmap(). - -Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") -(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968) -Signed-off-by: Phil Sutter ---- - extensions/libebt_among.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c -index 2e87db3bc06fa..715d559f432c2 100644 ---- a/extensions/libebt_among.c -+++ b/extensions/libebt_among.c -@@ -6,6 +6,7 @@ - * August, 2003 - */ - -+#include - #include - #include - #include -@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert, - if ((fd = open(optarg, O_RDONLY)) == -1) - xtables_error(PARAMETER_PROBLEM, - "Couldn't open file '%s'", optarg); -- fstat(fd, &stats); -+ if (fstat(fd, &stats) < 0) -+ xtables_error(PARAMETER_PROBLEM, -+ "fstat(%s) failed: '%s'", -+ optarg, strerror(errno)); - flen = stats.st_size; - /* use mmap because the file will probably be big */ - optarg = mmap(0, flen, PROT_READ | PROT_WRITE, --- -2.24.1 - diff --git a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch deleted file mode 100644 index aca04fa..0000000 --- a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 17b62e149147f05d419103dbbde9dca361c2bd5d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 11 Feb 2020 16:52:59 +0100 -Subject: [PATCH] xtables-restore: fix for --noflush and empty lines - -Lookahead buffer used for cache requirements estimate in restore ---noflush separates individual lines with nul-chars. Two consecutive -nul-chars are interpreted as end of buffer and remaining buffer content -is skipped. - -Sadly, reading an empty line (i.e., one containing a newline character -only) caused double nul-chars to appear in buffer as well, leading to -premature stop when reading cached lines from buffer. - -To fix that, make use of xtables_restore_parse_line() skipping empty -lines without calling strtok() and just leave the newline character in -place. A more intuitive approach, namely skipping empty lines while -buffering, is deliberately not chosen as that would cause wrong values -in 'line' variable. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400 -Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") -Signed-off-by: Phil Sutter -Acked-by: Arturo Borrero Gonzalez -(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29) -Signed-off-by: Phil Sutter ---- - .../ipt-restore/0011-noflush-empty-line_0 | 16 ++++++++++++++++ - iptables/xtables-restore.c | 8 +++++--- - 2 files changed, 21 insertions(+), 3 deletions(-) - create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 - -diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 -new file mode 100755 -index 0000000000000..bea1a690bb624 ---- /dev/null -+++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 -@@ -0,0 +1,16 @@ -+#!/bin/bash -e -+ -+# make sure empty lines won't break --noflush -+ -+cat <in)) { - size_t blen = strlen(buffer); - -- /* drop trailing newline; xtables_restore_parse_line() -+ /* Drop trailing newline; xtables_restore_parse_line() - * uses strtok() which replaces them by nul-characters, - * causing unpredictable string delimiting in -- * preload_buffer */ -- if (buffer[blen - 1] == '\n') -+ * preload_buffer. -+ * Unless this is an empty line which would fold into a -+ * spurious EoB indicator (double nul-char). */ -+ if (buffer[blen - 1] == '\n' && blen > 1) - buffer[blen - 1] = '\0'; - else - blen++; --- -2.24.1 - diff --git a/iptables.spec b/iptables.spec index b6c3780..638aecd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.4 -Release: 7%{?dist} +Version: 1.8.5 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,15 +32,8 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch -Patch2: 0002-Fix-DEBUG-build.patch -Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch -Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch -Patch5: 0005-extensions-time-Avoid-undefined-shift.patch -Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch -Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch -Patch8: 0008-extensions-among-Check-call-to-fstat.patch -Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch +Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch +Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -238,10 +231,6 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic -# install iptables-apply with man page -install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/ -install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/ - %if 0%{?fedora} > 24 # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes @@ -351,6 +340,7 @@ fi %{_sysconfdir}/ethertypes %endif %{_sbindir}/iptables-apply +%{_sbindir}/ip6tables-apply %{_sbindir}/iptables-legacy* %{_sbindir}/ip6tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -456,6 +446,11 @@ fi %changelog +* Tue Jun 23 2020 Phil Sutter - 1.8.5-1 +- Rebase onto upstream version 1.8.5 plus two late fixes +- Drop explicit iptables-apply installation, upstream fixed that +- Ship ip6tables-apply along with iptables package + * Wed Feb 12 2020 Phil Sutter - 1.8.4-7 - Move nft-specific extensions into iptables-nft package - Move remaining extensions into iptables-libs package diff --git a/sources b/sources index 34b13bd..a7e9f94 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.4.tar.bz2) = a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb +SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8 From 34ff3b278c12c3fca6e5e8230fa59b3118c1acab Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 01:56:02 +0000 Subject: [PATCH 025/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 638aecd..e20e38c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -446,6 +446,9 @@ fi %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 1.8.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jun 23 2020 Phil Sutter - 1.8.5-1 - Rebase onto upstream version 1.8.5 plus two late fixes - Drop explicit iptables-apply installation, upstream fixed that From fb677ca83cc1a1ad64e67ae869318c8909650c47 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Aug 2020 17:57:13 +0200 Subject: [PATCH 026/100] iptables-1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message --- ...eck-consistency-with-NFT_CL_FAKE-too.patch | 40 +++++++++++++++++ ...mand-name-in-ip6tables-error-message.patch | 45 +++++++++++++++++++ iptables.spec | 8 +++- 3 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch create mode 100644 0004-nft-Fix-command-name-in-ip6tables-error-message.patch diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch new file mode 100644 index 0000000..abe95fe --- /dev/null +++ b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch @@ -0,0 +1,40 @@ +From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Jul 2020 15:39:31 +0200 +Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too + +Athough this cache level fetches table names only, it shouldn't skip the +consistency check. + +Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") +Signed-off-by: Phil Sutter +(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd) +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 638b18bc7e382..434cc10b82ce7 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -511,14 +511,14 @@ retry: + if (req->level >= NFT_CL_TABLES) + fetch_table_cache(h); + if (req->level == NFT_CL_FAKE) +- return; ++ goto genid_check; + if (req->level >= NFT_CL_CHAINS) + fetch_chain_cache(h, t, chains); + if (req->level >= NFT_CL_SETS) + fetch_set_cache(h, t, NULL); + if (req->level >= NFT_CL_RULES) + fetch_rule_cache(h, t); +- ++genid_check: + mnl_genid_get(h, &genid_check); + if (h->nft_genid != genid_check) { + flush_cache(h, h->cache, NULL); +-- +2.27.0 + diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch new file mode 100644 index 0000000..b9a83f6 --- /dev/null +++ b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch @@ -0,0 +1,45 @@ +From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 7 Aug 2020 13:48:28 +0200 +Subject: [PATCH] nft: Fix command name in ip6tables error message + +Upon errors, ip6tables-nft would prefix its error messages with +'iptables:' instead of 'ip6tables:'. Turns out the command name was +hard-coded, use 'progname' variable instead. +While being at it, merge the two mostly identical fprintf() calls into +one. + +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) +Signed-off-by: Phil Sutter +--- + iptables/xtables-standalone.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c +index dd6fb7919d2e1..7b71db62f1ea6 100644 +--- a/iptables/xtables-standalone.c ++++ b/iptables/xtables-standalone.c +@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + xtables_fini(); + + if (!ret) { +- if (errno == EINVAL) { +- fprintf(stderr, "iptables: %s. " +- "Run `dmesg' for more information.\n", +- nft_strerror(errno)); +- } else { +- fprintf(stderr, "iptables: %s.\n", +- nft_strerror(errno)); +- } ++ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), ++ (errno == EINVAL ? ++ " Run `dmesg' for more information." : "")); ++ + if (errno == EAGAIN) + exit(RESOURCE_PROBLEM); + } +-- +2.27.0 + diff --git a/iptables.spec b/iptables.spec index e20e38c..42ce8c2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -34,6 +34,8 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch +Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch +Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -446,6 +448,10 @@ fi %changelog +* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 +- nft: cache: Check consistency with NFT_CL_FAKE, too +- nft: Fix command name in ip6tables error message + * Tue Jul 28 2020 Fedora Release Engineering - 1.8.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 730c58d40441a3e02712919ad84548d819a7d1bd Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 31 Oct 2020 16:49:52 -0700 Subject: [PATCH 027/100] Update to 1.8.6. Fixes bug #1893453 --- .gitignore | 1 + ...iptables-apply-not-getting-installed.patch | 42 ------------- ...mat-security-fixes-in-libip-6-t_icmp.patch | 60 ------------------- ...ate-don-t-fail-if-help-was-requested.patch | 58 ------------------ ...eck-consistency-with-NFT_CL_FAKE-too.patch | 40 ------------- ...mand-name-in-ip6tables-error-message.patch | 45 -------------- iptables.spec | 12 ++-- sources | 2 +- 8 files changed, 7 insertions(+), 253 deletions(-) delete mode 100644 0001-build-resolve-iptables-apply-not-getting-installed.patch delete mode 100644 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch delete mode 100644 0002-xtables-translate-don-t-fail-if-help-was-requested.patch delete mode 100644 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch delete mode 100644 0004-nft-Fix-command-name-in-ip6tables-error-message.patch diff --git a/.gitignore b/.gitignore index ae4c970..a72e3b2 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /iptables-1.8.3.tar.bz2 /iptables-1.8.4.tar.bz2 /iptables-1.8.5.tar.bz2 +/iptables-1.8.6.tar.bz2 diff --git a/0001-build-resolve-iptables-apply-not-getting-installed.patch b/0001-build-resolve-iptables-apply-not-getting-installed.patch deleted file mode 100644 index 26e08db..0000000 --- a/0001-build-resolve-iptables-apply-not-getting-installed.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001 -From: Jan Engelhardt -Date: Wed, 3 Jun 2020 15:38:48 +0200 -Subject: [PATCH] build: resolve iptables-apply not getting installed -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -ip6tables-apply gets installed but iptables-apply does not. -That is wrong. - -» make install DESTDIR=$PWD/r -» find r -name "*app*" -r/usr/local/sbin/ip6tables-apply -r/usr/local/share/man/man8/iptables-apply.8 -r/usr/local/share/man/man8/ip6tables-apply.8 - -Fixes: v1.8.5~87 -Signed-off-by: Jan Engelhardt -Signed-off-by: Pablo Neira Ayuso -(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b) -Signed-off-by: Phil Sutter ---- - iptables/Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/Makefile.am b/iptables/Makefile.am -index dc66b3cc09c08..2024dbf5cb88c 100644 ---- a/iptables/Makefile.am -+++ b/iptables/Makefile.am -@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ - ip6tables-save.8 iptables-extensions.8 \ - iptables-apply.8 ip6tables-apply.8 - --sbin_SCRIPT = iptables-apply -+sbin_SCRIPTS = iptables-apply - - if ENABLE_NFTABLES - man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ --- -2.27.0 - diff --git a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch b/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch deleted file mode 100644 index 1bdbbd1..0000000 --- a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= -Date: Wed, 14 Nov 2018 07:35:28 +0100 -Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") -introduced support for gcc feature to check format string against passed -argument. This commit adds missing bits to extenstions's libipt_icmp.c -and libip6t_icmp6.c that were causing build to fail. - -Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") -Signed-off-by: Adam Gołębiowski -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Phil Sutter ---- - extensions/libip6t_icmp6.c | 4 ++-- - extensions/libipt_icmp.c | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c -index 45a71875722c4..cc7bfaeb72fd7 100644 ---- a/extensions/libip6t_icmp6.c -+++ b/extensions/libip6t_icmp6.c -@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, - type_name = icmp6_type_xlate(icmptype); - - if (type_name) { -- xt_xlate_add(xl, type_name); -+ xt_xlate_add(xl, "%s", type_name); - } else { - for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) - if (icmpv6_codes[i].type == icmptype && -@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, - break; - - if (i != ARRAY_SIZE(icmpv6_codes)) -- xt_xlate_add(xl, icmpv6_codes[i].name); -+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name); - else - return 0; - } -diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c -index 5418997668d4c..e76257c54708c 100644 ---- a/extensions/libipt_icmp.c -+++ b/extensions/libipt_icmp.c -@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, - if (icmp_codes[i].type == icmptype && - icmp_codes[i].code_min == code_min && - icmp_codes[i].code_max == code_max) { -- xt_xlate_add(xl, icmp_codes[i].name); -+ xt_xlate_add(xl, "%s", icmp_codes[i].name); - return 1; - } - } --- -2.21.0 - diff --git a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch deleted file mode 100644 index 4fcb549..0000000 --- a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001 -From: Arturo Borrero Gonzalez -Date: Tue, 16 Jun 2020 11:20:42 +0200 -Subject: [PATCH] xtables-translate: don't fail if help was requested - -If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle -this case in do_command_xlate(). - -Before this patch, you would see: - - user@debian:~$ sudo iptables-translate -h - [..] - nft Unsupported command? - user@debian:~$ echo $? - 1 - -After this patch: - - user@debian:~$ sudo iptables-translate -h - [..] - user@debian:~$ echo $? - 0 - -Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") -Acked-by: Phil Sutter -Signed-off-by: Arturo Borrero Gonzalez -(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069) -Signed-off-by: Phil Sutter ---- - iptables/xtables-translate.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 5aa42496b5a48..363c8be15b3fa 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - - cs.restore = restore; - -- if (!restore) -+ if (!restore && p.command != CMD_NONE) - printf("nft "); - - switch (p.command) { -@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - break; - case CMD_SET_POLICY: - break; -+ case CMD_NONE: -+ ret = 1; -+ break; - default: - /* We should never reach this... */ - printf("Unsupported command?\n"); --- -2.27.0 - diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch deleted file mode 100644 index abe95fe..0000000 --- a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch +++ /dev/null @@ -1,40 +0,0 @@ -From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Jul 2020 15:39:31 +0200 -Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too - -Athough this cache level fetches table names only, it shouldn't skip the -consistency check. - -Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") -Signed-off-by: Phil Sutter -(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd) -Signed-off-by: Phil Sutter ---- - iptables/nft-cache.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c -index 638b18bc7e382..434cc10b82ce7 100644 ---- a/iptables/nft-cache.c -+++ b/iptables/nft-cache.c -@@ -511,14 +511,14 @@ retry: - if (req->level >= NFT_CL_TABLES) - fetch_table_cache(h); - if (req->level == NFT_CL_FAKE) -- return; -+ goto genid_check; - if (req->level >= NFT_CL_CHAINS) - fetch_chain_cache(h, t, chains); - if (req->level >= NFT_CL_SETS) - fetch_set_cache(h, t, NULL); - if (req->level >= NFT_CL_RULES) - fetch_rule_cache(h, t); -- -+genid_check: - mnl_genid_get(h, &genid_check); - if (h->nft_genid != genid_check) { - flush_cache(h, h->cache, NULL); --- -2.27.0 - diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch deleted file mode 100644 index b9a83f6..0000000 --- a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch +++ /dev/null @@ -1,45 +0,0 @@ -From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 7 Aug 2020 13:48:28 +0200 -Subject: [PATCH] nft: Fix command name in ip6tables error message - -Upon errors, ip6tables-nft would prefix its error messages with -'iptables:' instead of 'ip6tables:'. Turns out the command name was -hard-coded, use 'progname' variable instead. -While being at it, merge the two mostly identical fprintf() calls into -one. - -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) -Signed-off-by: Phil Sutter ---- - iptables/xtables-standalone.c | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - -diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c -index dd6fb7919d2e1..7b71db62f1ea6 100644 ---- a/iptables/xtables-standalone.c -+++ b/iptables/xtables-standalone.c -@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) - xtables_fini(); - - if (!ret) { -- if (errno == EINVAL) { -- fprintf(stderr, "iptables: %s. " -- "Run `dmesg' for more information.\n", -- nft_strerror(errno)); -- } else { -- fprintf(stderr, "iptables: %s.\n", -- nft_strerror(errno)); -- } -+ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), -+ (errno == EINVAL ? -+ " Run `dmesg' for more information." : "")); -+ - if (errno == EAGAIN) - exit(RESOURCE_PROBLEM); - } --- -2.27.0 - diff --git a/iptables.spec b/iptables.spec index 42ce8c2..21cd8f1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.5 -Release: 3%{?dist} +Version: 1.8.6 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,11 +32,6 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch -Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch -Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch -Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -448,6 +443,9 @@ fi %changelog +* Sat Oct 31 2020 Kevin Fenzi - 1.8.6-1 +- Update to 1.8.6. Fixes bug #1893453 + * Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message diff --git a/sources b/sources index a7e9f94..ece3ae2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8 +SHA512 (iptables-1.8.6.tar.bz2) = d06e4cddb69822c4618664a35877fc5811992936cade2040bb0e4eb25a4d879eadc7c84401c40fb39ffac7888568505adcb1cfe995cd166a15c702237daf6acf From e922d284f823879ec8985b305b345963aa8c9f7e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 5 Nov 2020 11:55:03 +0100 Subject: [PATCH 028/100] Remove build dependency on autogen --- iptables.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 21cd8f1..3d7f652 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -51,7 +51,6 @@ BuildRequires: pkgconfig(libmnl) >= 1.0 BuildRequires: pkgconfig(libnftnl) >= 1.1.5 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel -BuildRequires: autogen BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool @@ -443,6 +442,9 @@ fi %changelog +* Thu Nov 5 2020 Florian Weimer - 1.8.6-2 +- Remove build dependency on autogen + * Sat Oct 31 2020 Kevin Fenzi - 1.8.6-1 - Update to 1.8.6. Fixes bug #1893453 From d2237b3900401f30d610639c08f9477e0d28e9b3 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 16 Nov 2020 13:57:14 +0100 Subject: [PATCH 029/100] iptables-1.8.6-3 - Drop obsolete StandardOutput setting from unit file - Remove StandardError setting from unit file, its value is default --- iptables.service | 2 -- iptables.spec | 6 +++++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/iptables.service b/iptables.service index 6722c7a..342ac93 100644 --- a/iptables.service +++ b/iptables.service @@ -11,8 +11,6 @@ ExecReload=/usr/libexec/iptables/iptables.init reload ExecStop=/usr/libexec/iptables/iptables.init stop Environment=BOOTUP=serial Environment=CONSOLETYPE=serial -StandardOutput=syslog -StandardError=syslog [Install] WantedBy=basic.target diff --git a/iptables.spec b/iptables.spec index 3d7f652..6fd5eef 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -442,6 +442,10 @@ fi %changelog +* Mon Nov 16 13:39:22 CET 2020 Phil Sutter - 1.8.6-3 +- Drop obsolete StandardOutput setting from unit file +- Remove StandardError setting from unit file, its value is default + * Thu Nov 5 2020 Florian Weimer - 1.8.6-2 - Remove build dependency on autogen From 4ef8aaebbe6d2223197a3ce86a056949368aca86 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 17 Nov 2020 14:27:08 +0100 Subject: [PATCH 030/100] iptables-1.8.6-4 - ebtables: Fix for broken chain renaming --- ...tables-Fix-for-broken-chain-renaming.patch | 60 +++++++++++++++++++ iptables.spec | 7 ++- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 0001-ebtables-Fix-for-broken-chain-renaming.patch diff --git a/0001-ebtables-Fix-for-broken-chain-renaming.patch b/0001-ebtables-Fix-for-broken-chain-renaming.patch new file mode 100644 index 0000000..b7c0afe --- /dev/null +++ b/0001-ebtables-Fix-for-broken-chain-renaming.patch @@ -0,0 +1,60 @@ +From 55b7c71dce7144f4dc0297c17abf0f04879ee247 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Nov 2020 11:38:27 +0100 +Subject: [iptables PATCH] ebtables: Fix for broken chain renaming + +Loading extensions pollutes 'errno' value, hence before using it to +indicate failure it should be sanitized. This was done by the called +function before the parsing/netlink split and not migrated by accident. +Move it into calling code to clarify the connection. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 3 --- + iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++ + iptables/xtables-eb.c | 1 + + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 39882a443a974..411e2597205c9 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1896,9 +1896,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain, + return 0; + } + +- /* Config load changed errno. Ensure genuine info for our callers. */ +- errno = 0; +- + /* Find the old chain to be renamed */ + c = nft_chain_find(h, table, chain); + if (c == NULL) { +diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +index 0c1eb4ca66f52..6f11bd12593dd 100755 +--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 ++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then + exit 1 + fi + ++$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 ++ + $XT_MULTI ebtables -t $t -F || exit 0 +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 6641a21a72d32..5e4184b8e80de 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + else if (strchr(argv[optind], ' ') != NULL) + xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); + ++ errno = 0; + ret = nft_cmd_chain_user_rename(h, chain, *table, + argv[optind]); + if (ret != 0 && errno == ENOENT) +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index 6fd5eef..f80a798 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,6 +32,8 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif +Patch1: 0001-ebtables-Fix-for-broken-chain-renaming.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -442,6 +444,9 @@ fi %changelog +* Tue Nov 17 14:05:30 CET 2020 Phil Sutter - 1.8.6-4 +- ebtables: Fix for broken chain renaming + * Mon Nov 16 13:39:22 CET 2020 Phil Sutter - 1.8.6-3 - Drop obsolete StandardOutput setting from unit file - Remove StandardError setting from unit file, its value is default From 706150b129c945e887c203d96492d03046199bd2 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Mon, 13 Jul 2020 20:18:37 +0000 Subject: [PATCH 031/100] Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro --- iptables.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/iptables.spec b/iptables.spec index f80a798..23d5e98 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -151,7 +151,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool rm -f include/linux/types.h -make %{?_smp_mflags} +%make_build %if 0%{?bootstrap} pushd bootstrap_ver @@ -165,7 +165,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool rm -f include/linux/types.h -make %{?_smp_mflags} +%make_build popd %endif @@ -178,7 +178,7 @@ popd -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print %endif -make install DESTDIR=%{buildroot} +%make_install # remove la file(s) rm -f %{buildroot}/%{_libdir}/*.la @@ -444,6 +444,9 @@ fi %changelog +* Thu Nov 19 17:32:24 CET 2020 Tom Stellard - 1.8.6-5 +- Use make macros + * Tue Nov 17 14:05:30 CET 2020 Phil Sutter - 1.8.6-4 - ebtables: Fix for broken chain renaming From ab5d74c2b9d2a4c783f27e3c3f104ace4e3a3786 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 19 Dec 2020 00:54:33 +0000 Subject: [PATCH 032/100] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- iptables.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/iptables.spec b/iptables.spec index 23d5e98..2ff73b5 100644 --- a/iptables.spec +++ b/iptables.spec @@ -56,6 +56,7 @@ BuildRequires: libpcap-devel BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool +BuildRequires: make Requires: %{name}-libs%{?_isa} = %{version}-%{release} %if 0%{?fedora} > 24 Conflicts: setup < 2.10.4-1 From 1c2b75e472ee9d0aa4807a450d61f4bec138b664 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 16 Jan 2021 13:35:56 -0800 Subject: [PATCH 033/100] Update to 1.8.7. Fixes rhbz#1916948 --- .gitignore | 1 + ...tables-Fix-for-broken-chain-renaming.patch | 60 ------------------- iptables.spec | 9 +-- sources | 2 +- 4 files changed, 7 insertions(+), 65 deletions(-) delete mode 100644 0001-ebtables-Fix-for-broken-chain-renaming.patch diff --git a/.gitignore b/.gitignore index a72e3b2..d5a31d9 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /iptables-1.8.4.tar.bz2 /iptables-1.8.5.tar.bz2 /iptables-1.8.6.tar.bz2 +/iptables-1.8.7.tar.bz2 diff --git a/0001-ebtables-Fix-for-broken-chain-renaming.patch b/0001-ebtables-Fix-for-broken-chain-renaming.patch deleted file mode 100644 index b7c0afe..0000000 --- a/0001-ebtables-Fix-for-broken-chain-renaming.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55b7c71dce7144f4dc0297c17abf0f04879ee247 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Nov 2020 11:38:27 +0100 -Subject: [iptables PATCH] ebtables: Fix for broken chain renaming - -Loading extensions pollutes 'errno' value, hence before using it to -indicate failure it should be sanitized. This was done by the called -function before the parsing/netlink split and not migrated by accident. -Move it into calling code to clarify the connection. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter ---- - iptables/nft.c | 3 --- - iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++ - iptables/xtables-eb.c | 1 + - 3 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 39882a443a974..411e2597205c9 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1896,9 +1896,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain, - return 0; - } - -- /* Config load changed errno. Ensure genuine info for our callers. */ -- errno = 0; -- - /* Find the old chain to be renamed */ - c = nft_chain_find(h, table, chain); - if (c == NULL) { -diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 -index 0c1eb4ca66f52..6f11bd12593dd 100755 ---- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 -+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 -@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then - exit 1 - fi - -+$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1 -+$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1 -+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 -+ - $XT_MULTI ebtables -t $t -F || exit 0 -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 6641a21a72d32..5e4184b8e80de 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - else if (strchr(argv[optind], ' ') != NULL) - xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); - -+ errno = 0; - ret = nft_cmd_chain_user_rename(h, chain, *table, - argv[optind]); - if (ret != 0 && errno == ENOENT) --- -2.28.0 - diff --git a/iptables.spec b/iptables.spec index 2ff73b5..3057989 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.6 -Release: 5%{?dist} +Version: 1.8.7 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,8 +32,6 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-ebtables-Fix-for-broken-chain-renaming.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -445,6 +443,9 @@ fi %changelog +* Sat Jan 16 2021 Kevin Fenzi - 1.8.7-1 +- Update to 1.8.7. Fixes rhbz#1916948 + * Thu Nov 19 17:32:24 CET 2020 Tom Stellard - 1.8.6-5 - Use make macros diff --git a/sources b/sources index ece3ae2..e9a1323 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.6.tar.bz2) = d06e4cddb69822c4618664a35877fc5811992936cade2040bb0e4eb25a4d879eadc7c84401c40fb39ffac7888568505adcb1cfe995cd166a15c702237daf6acf +SHA512 (iptables-1.8.7.tar.bz2) = c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75 From 4ee1618a2fc6d4c1ae8eb4ffdfe43d38e699b45c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 14:28:12 +0000 Subject: [PATCH 034/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 3057989..c218724 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -443,6 +443,9 @@ fi %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.8.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sat Jan 16 2021 Kevin Fenzi - 1.8.7-1 - Update to 1.8.7. Fixes rhbz#1916948 From 0075af4c46a40dbda2381d3a4515aa53fac399a2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 27 Jan 2021 19:07:17 +0100 Subject: [PATCH 035/100] tests: Disable invalid test Since Fedora moved to cgroupsv2, this test does not apply anymore. --- tests/tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/tests.yml b/tests/tests.yml index dead758..a0b531d 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -21,7 +21,7 @@ roles: - role: standard-test-rhts tests: - - backport-iptables-add-libxt-cgroup-frontend +# - backport-iptables-add-libxt-cgroup-frontend - initscript-sanity - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets - ip6tables-service-does-not-allow-dhcpv6-client-by From 648ffbc31613acd9f9015892c0820df9be00cb89 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 28 Jan 2021 14:44:50 +0100 Subject: [PATCH 036/100] ebtables: Exit gracefully on invalid table names --- ...it-gracefully-on-invalid-table-names.patch | 51 +++++++++++++++++++ iptables.spec | 7 ++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch diff --git a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch new file mode 100644 index 0000000..ba625a2 --- /dev/null +++ b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -0,0 +1,51 @@ +From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 Jan 2021 01:09:56 +0100 +Subject: [PATCH] ebtables: Exit gracefully on invalid table names + +Users are able to cause program abort by passing a table name that +doesn't exist: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. +| Aborted + +Avoid this by checking table existence just like iptables-nft does upon +parsing '-t' optarg. Since the list of tables is known and fixed, +checking the given name's length is pointless. So just drop that check +in return. + +With this patch in place, output looks much better: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist +| Perhaps iptables or your kernel needs to be upgraded. + +Signed-off-by: Phil Sutter +Signed-off-by: Phil Sutter +--- + iptables/xtables-eb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index cfa9317c78e94..5bb34d6d292a9 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -914,10 +914,10 @@ print_zero: + xtables_error(PARAMETER_PROBLEM, + "The -t option (seen in line %u) cannot be used in %s.\n", + line, xt_params->program_name); +- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) +- xtables_error(PARAMETER_PROBLEM, +- "Table name length cannot exceed %d characters", +- EBT_TABLE_MAXNAMELEN - 1); ++ if (!nft_table_builtin_find(h, optarg)) ++ xtables_error(VERSION_PROBLEM, ++ "table '%s' does not exist", ++ optarg); + *table = optarg; + table_set = true; + break; +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index c218724..eb8e3e2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,6 +32,8 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif +Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -443,6 +445,9 @@ fi %changelog +* Thu Jan 28 2021 Phil Sutter - 1.8.7-3 +- ebtables: Exit gracefully on invalid table names + * Tue Jan 26 2021 Fedora Release Engineering - 1.8.7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From bc305c871c0d19690cd0be598a55b56a565d0886 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 1 Feb 2021 17:38:05 +0100 Subject: [PATCH 037/100] Disable failing test in role standard-test-beakerlib as well Missed this one in previous commit. --- tests/tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/tests.yml b/tests/tests.yml index a0b531d..97069b7 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -43,7 +43,7 @@ roles: - role: standard-test-beakerlib tests: - - backport-iptables-add-libxt-cgroup-frontend +# - backport-iptables-add-libxt-cgroup-frontend - initscript-sanity - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets - ip6tables-service-does-not-allow-dhcpv6-client-by From cf6ddaf2539e452b7606b10454ff0cadee5dfcc1 Mon Sep 17 00:00:00 2001 From: Robert Scheck Date: Sat, 30 Jan 2021 22:59:17 +0100 Subject: [PATCH 038/100] Spec file cleanup --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index eb8e3e2..b0ed611 100644 --- a/iptables.spec +++ b/iptables.spec @@ -17,7 +17,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities -URL: http://www.netfilter.org/projects/iptables +URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 @@ -181,7 +181,7 @@ popd %make_install # remove la file(s) -rm -f %{buildroot}/%{_libdir}/*.la +rm -f %{buildroot}%{_libdir}/*.la # install ip*tables.h header files install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/ @@ -332,7 +332,6 @@ if [ $1 -eq 0 ]; then fi %files -%{!?_licensedir:%global license %%doc} %license COPYING %doc INCOMPATIBILITIES %if 0%{?fedora} <= 24 From f04bde23a01002f45c03863516e994c7332a37b3 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 17 Feb 2021 02:45:05 +0100 Subject: [PATCH 039/100] iptables-1.8.7-4 - Drop bootstrap code again - Drop workarounds for F24 and lower - Fix iptables-utils summary - Ship iptables-apply with iptables-utils - Reduce files sections by use of globbing - Ship common man pages with iptables-libs - Ship *-translate man pages with iptables-nft - Move legacy iptables binaries, libraries and headers into sub-packages - Introduce compat sub-package to help with above transitions - Drop libipulog header from devel package, this belongs to libnetfilter_log - Do not ship internal headers in devel package --- iptables.spec | 245 +++++++++++++++++++++----------------------------- 1 file changed, 102 insertions(+), 143 deletions(-) diff --git a/iptables.spec b/iptables.spec index b0ed611..09ac10c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -4,14 +4,6 @@ # service legacy actions (RHBZ#748134) %global legacy_actions %{_libexecdir}/initscripts/legacy-actions -# Bootstrap mode providing old and new versions of libip{4,6}tc in parallel -%global bootstrap 0 - -%if 0%{?bootstrap} -%global version_old 1.8.2 -%global iptc_so_ver_old 0 -%global ipXtc_so_ver_old 0 -%endif %global iptc_so_ver 0 %global ipXtc_so_ver 2 @@ -19,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -27,10 +19,6 @@ Source3: iptables.service Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -%if 0%{?bootstrap} -Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 -Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch -%endif Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -57,22 +45,54 @@ BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make -Requires: %{name}-libs%{?_isa} = %{version}-%{release} -%if 0%{?fedora} > 24 -Conflicts: setup < 2.10.4-1 -%endif -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives %description The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. +%package compat +Summary: Temporary transitioning package +Obsoletes: %{name} < 1.8.7-4 +Requires: %{name}-legacy = %{version}-%{release} +Requires: %{name}-utils = %{version}-%{release} + +%description compat +This package only exists to help transition iptables users to the new +package split. It will be removed after one distribution release cycle, please +do not reference it or depend on it in any way. + +%package legacy +Summary: Legacy tools for managing Linux kernel packet filtering capabilities +Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Conflicts: setup < 2.10.4-1 +Requires(post): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +%if 0%{?rhel} < 9 +Provides: iptables +%endif + +%description legacy +The iptables utility controls the network packet filtering code in the +Linux kernel. This package contains the legacy tools which are obsoleted by +nft-variants in iptables-nft package for backwards compatibility reasons. +If you need to set up firewalls and/or IP masquerading, you should not install +this package but either nftables or iptables-nft instead. + %package libs -Summary: iptables libraries +Summary: libxtables and iptables extensions userspace support %description libs +libxtables and associated shared object files + +Libxtables provides unified access to iptables extensions in userspace. Data +and logic for those is kept in per-extension shared object files. + +%package legacy-libs +Summary: iptables legacy libraries + +%description legacy-libs iptables libraries. Please remember that libip*tc libraries do neither have a stable API nor a real so version. @@ -81,14 +101,23 @@ For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 - %package devel Summary: Development package for iptables -Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +# XXX: Drop this after two releases or so +Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release} Requires: pkgconfig %description devel -iptables development headers and libraries. +libxtables development headers and pkgconfig files + +%package legacy-devel +Summary: Development package for legacy iptables +Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} +Requires: pkgconfig + +%description legacy-devel +Legacy iptables development headers and pkgconfig files The iptc libraries are marked as not public by upstream. The interface is not stable and may change with every new version. It is therefore unsupported. @@ -109,14 +138,15 @@ This package provides the services iptables and ip6tables that have been split out of the base package since they are not active by default anymore. %package utils -Summary: iptables and ip6tables services for iptables +Summary: iptables and ip6tables misc utilities Requires: %{name} = %{version}-%{release} %description utils Utils for iptables This package provides nfnl_osf with the pf.os database and nfbpf_compile, -a bytecode generator for use with xt_bpf. +a bytecode generator for use with xt_bpf. Also included is iptables-apply, +a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables @@ -133,14 +163,6 @@ nftables compatibility for iptables, arptables and ebtables. %prep %autosetup -p1 -%if 0%{?bootstrap} -%{__mkdir} -p bootstrap_ver -pushd bootstrap_ver -%{__tar} --strip-components=1 -xf %{SOURCE7} -%{__patch} -p1 <%{SOURCE8} -popd -%endif - %build ./autogen.sh CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ @@ -154,44 +176,11 @@ rm -f include/linux/types.h %make_build -%if 0%{?bootstrap} -pushd bootstrap_ver -./autogen.sh -CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ -%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr - -# do not use rpath -sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool -sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool - -rm -f include/linux/types.h - -%make_build -popd -%endif - %install -%if 0%{?bootstrap} -%make_install -C bootstrap_ver -%{_bindir}/find %{buildroot} -xtype f -not \ - -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print -%{_bindir}/find %{buildroot} -type l -not \ - -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print -%endif - %make_install # remove la file(s) rm -f %{buildroot}%{_libdir}/*.la -# install ip*tables.h header files -install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/ -install -d -m 755 %{buildroot}%{_includedir}/iptables -install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/ - -# install ipulog header file -install -d -m 755 %{buildroot}%{_includedir}/libipulog/ -install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/ - # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init @@ -230,10 +219,8 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic -%if 0%{?fedora} > 24 # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -%endif install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ touch %{buildroot}%{_libexecdir}/arptables-helper @@ -246,7 +233,7 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 %ldconfig_scriptlets -%post +%post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ @@ -257,7 +244,7 @@ pfx6=%{_sbindir}/ip6tables --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save -%postun +%postun legacy if [ $1 -eq 0 ]; then %{_sbindir}/update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy @@ -331,119 +318,91 @@ if [ $1 -eq 0 ]; then done fi -%files +%files compat + +%files legacy %license COPYING %doc INCOMPATIBILITIES -%if 0%{?fedora} <= 24 -%{_sysconfdir}/ethertypes -%endif -%{_sbindir}/iptables-apply -%{_sbindir}/ip6tables-apply -%{_sbindir}/iptables-legacy* -%{_sbindir}/ip6tables-legacy* +%{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* -%{_mandir}/man8/iptables* -%{_mandir}/man8/ip6tables* %{_mandir}/man8/xtables-legacy* -%ghost %{_sbindir}/iptables -%ghost %{_sbindir}/iptables-restore -%ghost %{_sbindir}/iptables-save -%ghost %{_sbindir}/ip6tables -%ghost %{_sbindir}/ip6tables-restore -%ghost %{_sbindir}/ip6tables-save +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs -%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}* -%if 0%{?bootstrap} -%{_libdir}/libiptc.so.%{iptc_so_ver_old}* -%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}* -%endif %{_libdir}/libxtables.so.12* %dir %{_libdir}/xtables -%{_libdir}/xtables/libipt* -%{_libdir}/xtables/libip6t* -%{_libdir}/xtables/libxt* +%{_libdir}/xtables/lib{ip,ip6,x}t* +%{_mandir}/man8/ip{,6}tables.8.gz +%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz + +%files legacy-libs +%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}* %files devel -%dir %{_includedir}/iptables -%{_includedir}/iptables/*.h -%{_includedir}/*.h +%{_includedir}/xtables{,-version}.h +%{_libdir}/libxtables.so +%{_libdir}/pkgconfig/xtables.pc + +%files legacy-devel %dir %{_includedir}/libiptc %{_includedir}/libiptc/*.h -%dir %{_includedir}/libipulog -%{_includedir}/libipulog/*.h %{_libdir}/libip*tc.so -%{_libdir}/libxtables.so -%{_libdir}/pkgconfig/libiptc.pc -%{_libdir}/pkgconfig/libip4tc.pc -%{_libdir}/pkgconfig/libip6tc.pc -%{_libdir}/pkgconfig/xtables.pc +%{_libdir}/pkgconfig/libip{,4,6}tc.pc %files services %dir %{script_path} -%{script_path}/iptables.init -%{script_path}/ip6tables.init -%config(noreplace) %{_sysconfdir}/sysconfig/iptables -%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables -%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config -%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config -%{_unitdir}/iptables.service -%{_unitdir}/ip6tables.service -%dir %{legacy_actions}/iptables -%{legacy_actions}/iptables/save -%{legacy_actions}/iptables/panic -%dir %{legacy_actions}/ip6tables -%{legacy_actions}/ip6tables/save -%{legacy_actions}/ip6tables/panic +%{script_path}/ip{,6}tables.init +%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} +%{_unitdir}/ip{,6}tables.service +%dir %{legacy_actions}/ip{,6}tables +%{legacy_actions}/ip{,6}tables/{save,panic} %files utils %{_sbindir}/nfnl_osf %{_sbindir}/nfbpf_compile +%{_sbindir}/ip{,6}tables-apply %dir %{_datadir}/xtables %{_datadir}/xtables/pf.os %{_mandir}/man8/nfnl_osf* %{_mandir}/man8/nfbpf_compile* +%{_mandir}/man8/ip{,6}tables-apply* %files nft -%{_sbindir}/iptables-nft* -%{_sbindir}/iptables-restore-translate -%{_sbindir}/iptables-translate -%{_sbindir}/ip6tables-nft* -%{_sbindir}/ip6tables-restore-translate -%{_sbindir}/ip6tables-translate -%{_sbindir}/ebtables-nft* -%{_sbindir}/arptables-nft* +%{_sbindir}/ip{,6}tables-nft* +%{_sbindir}/ip{,6}tables{,-restore}-translate +%{_sbindir}/{eb,arp}tables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %dir %{_libdir}/xtables -%{_libdir}/xtables/libarpt* -%{_libdir}/xtables/libebt* +%{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* -%ghost %{_sbindir}/iptables -%ghost %{_sbindir}/iptables-restore -%ghost %{_sbindir}/iptables-save -%ghost %{_sbindir}/ip6tables -%ghost %{_sbindir}/ip6tables-restore -%ghost %{_sbindir}/ip6tables-save -%ghost %{_sbindir}/ebtables -%ghost %{_sbindir}/ebtables-save -%ghost %{_sbindir}/ebtables-restore -%ghost %{_sbindir}/arptables -%ghost %{_sbindir}/arptables-save -%ghost %{_sbindir}/arptables-restore +%{_mandir}/man8/ip{,6}tables{,-restore}-translate* +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper -%ghost %{_mandir}/man8/arptables.8.gz -%ghost %{_mandir}/man8/arptables-save.8.gz -%ghost %{_mandir}/man8/arptables-restore.8.gz +%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Feb 16 2021 Phil Sutter - 1.8.7-4 +- Drop bootstrap code again +- Drop workarounds for F24 and lower +- Fix iptables-utils summary +- Ship iptables-apply with iptables-utils +- Reduce files sections by use of globbing +- Ship common man pages with iptables-libs +- Ship *-translate man pages with iptables-nft +- Move legacy iptables binaries, libraries and headers into sub-packages +- Introduce compat sub-package to help with above transitions +- Drop libipulog header from devel package, this belongs to libnetfilter_log +- Do not ship internal headers in devel package + * Thu Jan 28 2021 Phil Sutter - 1.8.7-3 - ebtables: Exit gracefully on invalid table names From 3fe153906e430df5053b185f2c36474b2729df2f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Mar 2021 12:33:45 +0100 Subject: [PATCH 040/100] iptables-1.8.7-5 - Fix upgrade path with package rename - Add missing dependencies to iptables-nft package --- iptables.spec | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 09ac10c..6c55721 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -151,6 +151,8 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Requires(post): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -250,6 +252,20 @@ if [ $1 -eq 0 ]; then iptables %{_sbindir}/iptables-legacy fi +# iptables-1.8.0-1 introduced the use of alternatives +# when upgrading, its %postun script runs due to the package renaming +# fix this by repeating the install into alternatives +%triggerpostun legacy -- iptables > 1.8.0 +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables +%{_sbindir}/update-alternatives --install \ + $pfx iptables $pfx-legacy 10 \ + --slave $pfx6 ip6tables $pfx6-legacy \ + --slave $pfx-restore iptables-restore $pfx-legacy-restore \ + --slave $pfx-save iptables-save $pfx-legacy-save \ + --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --slave $pfx6-save ip6tables-save $pfx6-legacy-save + %post services %systemd_post iptables.service ip6tables.service @@ -390,6 +406,10 @@ fi %changelog +* Tue Mar 23 2021 Phil Sutter - 1.8.7-5 +- Fix upgrade path with package rename +- Add missing dependencies to iptables-nft package + * Tue Feb 16 2021 Phil Sutter - 1.8.7-4 - Drop bootstrap code again - Drop workarounds for F24 and lower From ad1732dc5dde9d655d66d4639dc2f1edff5e529c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Mar 2021 21:16:19 +0100 Subject: [PATCH 041/100] iptables-1.8.7-6 - Restore alternatives configuration after upgrade - Fix license location --- iptables.spec | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 6c55721..258f9dc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -255,6 +255,12 @@ fi # iptables-1.8.0-1 introduced the use of alternatives # when upgrading, its %postun script runs due to the package renaming # fix this by repeating the install into alternatives +# also keep the old alternatives configuration to not change the system +%triggerun legacy -- iptables > 1.8.0 +alternatives --list | awk '/^iptables/{print $3; exit}' \ + >/var/tmp/alternatives.iptables.current +cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup + %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables @@ -265,6 +271,9 @@ pfx6=%{_sbindir}/ip6tables --slave $pfx-save iptables-save $pfx-legacy-save \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +alternatives --set iptables $( - 1.8.7-6 +- Restore alternatives configuration after upgrade +- Fix license location + * Tue Mar 23 2021 Phil Sutter - 1.8.7-5 - Fix upgrade path with package rename - Add missing dependencies to iptables-nft package From 2eea62dd86d3eafe7938a922f0dca0bc722b0674 Mon Sep 17 00:00:00 2001 From: Damian Wrobel Date: Sun, 28 Mar 2021 19:04:41 +0200 Subject: [PATCH 042/100] Add missing readlink required for iptables-nft(post) The following is observed while creating fedora-server image: Running scriptlet: iptables-nft-1.8.5-5.fc33.armv7hl /var/tmp/rpm-tmp.5nTAii: line 14: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 14: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 18: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 31: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 34: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 31: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 34: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 31: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 34: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 38: readlink: command not found --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 258f9dc..64f594f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -152,6 +152,7 @@ a safer way to update iptables remotely. Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} Requires(post): %{_sbindir}/update-alternatives +Requires(post): %{_bindir}/readlink Requires(postun): %{_sbindir}/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper @@ -417,6 +418,9 @@ fi %changelog +* Mon Mar 29 2021 Damian Wrobel - 1.8.7-7 +- Add missing readlink required for iptables-nft(post) + * Tue Mar 23 2021 Phil Sutter - 1.8.7-6 - Restore alternatives configuration after upgrade - Fix license location From 1f406341515f590a695a7c1bb7fb8253c6a7f37d Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 7 May 2021 18:33:08 +0200 Subject: [PATCH 043/100] iptables-1.8.7-8 - iptables.init: Fix functionality for iptables-nft - iptables.init: Ignore sysctl files not suffixed '.conf' - iptables.init: Drop unused NEW_MODUTILS check - iptables.init: Drop some trailing whitespace --- iptables.init | 51 +++++++++++++++++++++++++++++++++------------------ iptables.spec | 8 +++++++- 2 files changed, 40 insertions(+), 19 deletions(-) diff --git a/iptables.init b/iptables.init index 51155b0..ffbd742 100755 --- a/iptables.init +++ b/iptables.init @@ -55,11 +55,6 @@ if [ ! -x /sbin/$IPTABLES ]; then exit 5 fi -# Old or new modutils -/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \ - && NEW_MODUTILS=1 \ - || NEW_MODUTILS=0 - # Default firewall configuration: IPTABLES_MODULES="" IPTABLES_SAVE_ON_STOP="no" @@ -75,13 +70,33 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000 # Load firewall configuration. [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG" +is_iptables_nft() { + iptables --version | grep -q '(nf_tables)' +} + +netfilter_active() { + is_iptables_nft && return 0 + [ -e "$PROC_IPTABLES_NAMES" ] +} + +netfilter_tables() { + netfilter_active || return 1 + is_iptables_nft && { + # explicitly omit security table from this list as + # it should be reserved for SELinux use + echo "raw mangle filter nat" + return 0 + } + cat "$PROC_IPTABLES_NAMES" 2>/dev/null +} + # Get active tables -NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null) +NF_TABLES=$(netfilter_tables) flush_n_delete() { # Flush firewall rules and delete chains. - [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0 + netfilter_active || return 0 # Check if firewall is configured (has tables) [ -z "$NF_TABLES" ] && return 1 @@ -113,10 +128,10 @@ set_policy() { policy=$1 # Check if iptable module is loaded - [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0 + netfilter_active || return 0 # Check if firewall is configured (has tables) - tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null) + tables=$(netfilter_tables) [ -z "$tables" ] && return 1 echo -n $"${IPTABLES}: Setting chains to policy $policy: " @@ -166,7 +181,7 @@ load_sysctl() { echo -n $"Loading sysctl settings: " ret=0 for item in $IPTABLES_SYSCTL_LOAD_LIST; do - fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null + fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null let ret+=$?; done [ $ret -eq 0 ] && success || failure @@ -217,7 +232,7 @@ start() { return 1 fi fi - + # Load additional modules (helpers) if [ -n "$IPTABLES_MODULES" ]; then echo -n $"${IPTABLES}: Loading additional modules: " @@ -230,7 +245,7 @@ start() { [ $ret -eq 0 ] && success || failure echo fi - + # Load sysctl settings load_sysctl @@ -240,7 +255,7 @@ start() { stop() { # Do not stop if iptables module is not loaded. - [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0 + netfilter_active || return 0 # Set default chain policy to ACCEPT, in order to not break shutdown # on systems where the default policy is DROP and root device is @@ -248,14 +263,14 @@ stop() { set_policy ACCEPT # And then, flush the rules and delete chains flush_n_delete - + rm -f $VAR_SUBSYS_IPTABLES return $ret } save() { # Check if iptable module is loaded - if [ ! -e "$PROC_IPTABLES_NAMES" ]; then + if ! netfilter_active; then echo -n $"${IPTABLES}: Nothing to save."; warning; echo return 0 fi @@ -298,7 +313,7 @@ save() { } status() { - if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then + if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then echo $"${IPTABLES}: Firewall is not running." return 3 fi @@ -306,7 +321,7 @@ status() { # Do not print status if lockfile is missing and iptables modules are not # loaded. # Check if iptable modules are loaded - if [ ! -e "$PROC_IPTABLES_NAMES" ]; then + if ! netfilter_active; then echo $"${IPTABLES}: Firewall modules are not loaded." return 3 fi @@ -319,7 +334,7 @@ status() { NUM= [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n" - VERBOSE= + VERBOSE= [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose" COUNT= [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers" diff --git a/iptables.spec b/iptables.spec index 64f594f..498fc7f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -418,6 +418,12 @@ fi %changelog +* Fri May 07 2021 Phil Sutter - 1.8.7-8 +- iptables.init: Fix functionality for iptables-nft +- iptables.init: Ignore sysctl files not suffixed '.conf' +- iptables.init: Drop unused NEW_MODUTILS check +- iptables.init: Drop some trailing whitespace + * Mon Mar 29 2021 Damian Wrobel - 1.8.7-7 - Add missing readlink required for iptables-nft(post) From ff526cce7ecff7cdf76451cedb1f526bef526ec8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 16 Jun 2021 11:24:21 +0200 Subject: [PATCH 044/100] iptables-1.8.7-9 - Remove bashisms from arptables-nft-helper - tests: Use iproute instead of bridge-utils --- arptables-nft-helper | 17 +++++++---------- iptables.spec | 5 ++++- .../Makefile | 2 +- .../runtest.sh | 4 ++-- tests/tests.yml | 1 - 5 files changed, 14 insertions(+), 15 deletions(-) diff --git a/arptables-nft-helper b/arptables-nft-helper index 7380abf..913298d 100644 --- a/arptables-nft-helper +++ b/arptables-nft-helper @@ -5,12 +5,12 @@ ARPTABLES_CONFIG=/etc/sysconfig/arptables # compat for removed initscripts dependency success() { - echo -n "[ OK ]" + echo "[ OK ]" return 0 } failure() { - echo -n "[FAILED]" + echo "[FAILED]" return 1 } @@ -21,31 +21,28 @@ start() { # don't do squat if we don't have the config file if [ -f $ARPTABLES_CONFIG ]; then - echo -n $"Applying arptables firewall rules: " + printf "Applying arptables firewall rules: " /usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \ success || \ failure - echo touch /var/lock/subsys/arptables else failure - echo - echo $"Configuration file /etc/sysconfig/arptables missing" + echo "Configuration file /etc/sysconfig/arptables missing" exit 6 fi } stop() { - echo -n $"Removing user defined chains:" + printf "Removing user defined chains: " arptables -X && success || failure - echo -n $"Flushing all chains:" + printf "Flushing all chains: " arptables -F && success || failure - echo -n $"Resetting built-in chains to the default ACCEPT policy:" + printf "Resetting built-in chains to the default ACCEPT policy: " arptables -P INPUT ACCEPT && \ arptables -P OUTPUT ACCEPT && \ success || \ failure - echo rm -f /var/lock/subsys/arptables } diff --git a/iptables.spec b/iptables.spec index 498fc7f..368e429 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 8%{?dist} +Release: 9%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -418,6 +418,9 @@ fi %changelog +* Wed Jun 16 2021 Phil Sutter - 1.8.7-9 +- Remove bashisms from arptables-nft-helper + * Fri May 07 2021 Phil Sutter - 1.8.7-8 - iptables.init: Fix functionality for iptables-nft - iptables.init: Ignore sysctl files not suffixed '.conf' diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile index 5b7f979..3d9ade1 100644 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: iptables" >> $(METADATA) - @echo "Requires: iptables bridge-utils ipset" >> $(METADATA) + @echo "Requires: iptables iproute ipset" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 75f7413..004d568 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -38,7 +38,7 @@ rlJournalStart rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" rlRun "iptables-save > iptables.backup" - rlRun "brctl addbr testbr" 0 "create bridge iface" + rlRun "ip link add dev testbr type bridge" 0 "create bridge iface" rlPhaseEnd rlPhaseStartTest @@ -75,7 +75,7 @@ rlJournalStart rlRun "ip6tables-restore < ip6tables.backup" rlRun "iptables-restore < iptables.backup" rlRun "ip link set down dev testbr" - rlRun "brctl delbr testbr" 0 "remove bridge iface" + rlRun "ip link del testbr" 0 "remove bridge iface" rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset" rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset" rlRun "popd" diff --git a/tests/tests.yml b/tests/tests.yml index 97069b7..8bac1f4 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,7 +10,6 @@ - iptables-services # multiple tests need iptables/ip6tables config files - initscripts # multiple tests need system command - libcgroup-tools # backport-iptables-add-libxt-cgroup-frontend needs cg* commands - - bridge-utils # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command - ipset # multiple tests need ipset command - strace # xtables-tools-locking-vulnerable-to-local-DoS needs strace command - policycoreutils # initscript-sanity needs restorecon command From 18074ebc22491d0b58d1c08f88799deea2e4c801 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 16 Jun 2021 11:24:21 +0200 Subject: [PATCH 045/100] iptables-1.8.7-10 - Backport fixes from upstream --- ...it-gracefully-on-invalid-table-names.patch | 6 +- 0002-iptables-nft-fix-Z-option.patch | 104 ++++++++++++++++++ ...twise-expression-avoidance-detection.patch | 73 ++++++++++++ ...nsions-sctp-Fix-nftables-translation.patch | 80 ++++++++++++++ ...leftover-variable-in-xtables_numeric.patch | 33 ++++++ ...ons-libebt_ip6-Drop-unused-variables.patch | 49 +++++++++ ...-Fix-memleak-in-xtopt_parse_hostmask.patch | 29 +++++ ...memleak-in-error-path-of-nft_cmd_new.patch | 34 ++++++ ...-iptables-apply-Drop-unused-variable.patch | 29 +++++ iptables.spec | 15 ++- 10 files changed, 447 insertions(+), 5 deletions(-) create mode 100644 0002-iptables-nft-fix-Z-option.patch create mode 100644 0003-nft-Fix-bitwise-expression-avoidance-detection.patch create mode 100644 0004-extensions-sctp-Fix-nftables-translation.patch create mode 100644 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch create mode 100644 0006-extensions-libebt_ip6-Drop-unused-variables.patch create mode 100644 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch create mode 100644 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch create mode 100644 0009-iptables-apply-Drop-unused-variable.patch diff --git a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch index ba625a2..93191ca 100644 --- a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +++ b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -1,4 +1,4 @@ -From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001 +From df7ed83da048317d344b34e9c38e31035e508f24 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 28 Jan 2021 01:09:56 +0100 Subject: [PATCH] ebtables: Exit gracefully on invalid table names @@ -22,7 +22,7 @@ With this patch in place, output looks much better: | Perhaps iptables or your kernel needs to be upgraded. Signed-off-by: Phil Sutter -Signed-off-by: Phil Sutter +(cherry picked from commit 30c1d443896311e69762d6b51b63908ec602574f) --- iptables/xtables-eb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) @@ -47,5 +47,5 @@ index cfa9317c78e94..5bb34d6d292a9 100644 table_set = true; break; -- -2.28.0 +2.31.1 diff --git a/0002-iptables-nft-fix-Z-option.patch b/0002-iptables-nft-fix-Z-option.patch new file mode 100644 index 0000000..d7f4a6a --- /dev/null +++ b/0002-iptables-nft-fix-Z-option.patch @@ -0,0 +1,104 @@ +From 56f5ee8dee86d4ceaeac7eb6e1eaaa2ac3a1d0f8 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 24 Feb 2021 11:08:02 +0100 +Subject: [PATCH] iptables-nft: fix -Z option + +it zeroes the rule counters, so it needs fully populated cache. +Add a test case to cover this. + +Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands") +Signed-off-by: Florian Westphal +Acked-by: Phil Sutter +(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2) +--- + iptables/nft-cmd.c | 2 +- + .../testcases/iptables/0007-zero-counters_0 | 64 +++++++++++++++++++ + 2 files changed, 65 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0 + +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index 5d33f1f00f574..f2b935c57dab4 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain, + if (!cmd) + return 0; + +- nft_cache_level_set(h, NFT_CL_CHAINS, cmd); ++ nft_cache_level_set(h, NFT_CL_RULES, cmd); + + return 1; + } +diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 +new file mode 100755 +index 0000000000000..36da1907e3b22 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 +@@ -0,0 +1,64 @@ ++#!/bin/bash ++ ++RC=0 ++COUNTR=$RANDOM$RANDOM ++ ++$XT_MULTI iptables-restore -c < +Date: Fri, 19 Feb 2021 16:54:57 +0100 +Subject: [PATCH] nft: Fix bitwise expression avoidance detection + +Byte-boundary prefix detection was too sloppy: Any data following the +first zero-byte was ignored. Add a follow-up loop making sure there are +no stray bits in the designated host part. + +Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") +Signed-off-by: Phil Sutter +(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba) +--- + iptables/nft-shared.c | 4 +++- + .../testcases/ip6tables/0004-address-masks_0 | 24 +++++++++++++++++++ + 2 files changed, 27 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 10553ab26823b..c1664b50f9383 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, + { + const unsigned char *m = mask; + bool bitwise = false; +- int i; ++ int i, j; + + for (i = 0; i < len; i++) { + if (m[i] != 0xff) { +@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, + break; + } + } ++ for (j = i + 1; !bitwise && j < len; j++) ++ bitwise = !!m[j]; + + if (!bitwise) + len = i; +diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 +new file mode 100755 +index 0000000000000..7eb42f08da975 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 +@@ -0,0 +1,24 @@ ++#!/bin/bash ++ ++set -e ++ ++$XT_MULTI ip6tables-restore < +Date: Tue, 4 May 2021 16:03:24 +0200 +Subject: [PATCH] extensions: sctp: Fix nftables translation + +If both sport and dport was present, incorrect nft syntax was generated. + +Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a61282ec6a1697bfb40f19d13a28a74559050167) +--- + extensions/libxt_sctp.c | 10 ++++------ + extensions/libxt_sctp.txlate | 10 +++++----- + 2 files changed, 9 insertions(+), 11 deletions(-) + +diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c +index 140de2653b1ef..ee4e99ebf11bf 100644 +--- a/extensions/libxt_sctp.c ++++ b/extensions/libxt_sctp.c +@@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl, + if (!einfo->flags) + return 0; + +- xt_xlate_add(xl, "sctp "); +- + if (einfo->flags & XT_SCTP_SRC_PORTS) { + if (einfo->spts[0] != einfo->spts[1]) +- xt_xlate_add(xl, "sport%s %u-%u", ++ xt_xlate_add(xl, "sctp sport%s %u-%u", + einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", + einfo->spts[0], einfo->spts[1]); + else +- xt_xlate_add(xl, "sport%s %u", ++ xt_xlate_add(xl, "sctp sport%s %u", + einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", + einfo->spts[0]); + space = " "; +@@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl, + + if (einfo->flags & XT_SCTP_DEST_PORTS) { + if (einfo->dpts[0] != einfo->dpts[1]) +- xt_xlate_add(xl, "%sdport%s %u-%u", space, ++ xt_xlate_add(xl, "%ssctp dport%s %u-%u", space, + einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", + einfo->dpts[0], einfo->dpts[1]); + else +- xt_xlate_add(xl, "%sdport%s %u", space, ++ xt_xlate_add(xl, "%ssctp dport%s %u", space, + einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", + einfo->dpts[0]); + } +diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate +index 72f4641ab021c..0d6c59e183675 100644 +--- a/extensions/libxt_sctp.txlate ++++ b/extensions/libxt_sctp.txlate +@@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT + nft add rule ip filter INPUT sctp dport != 50-56 counter accept + + iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept ++nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept + + iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept ++nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept + + iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept ++nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept + + iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept ++nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept + + iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT +-nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept ++nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept +-- +2.31.1 + diff --git a/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch b/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch new file mode 100644 index 0000000..a97305a --- /dev/null +++ b/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch @@ -0,0 +1,33 @@ +From bdd9eb3bcce460815eecc39decf0cceb3fb0949b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 Nov 2020 21:04:39 +0100 +Subject: [PATCH] libxtables: Drop leftover variable in + xtables_numeric_to_ip6addr() + +Variable 'err' was only used in removed debug code, so drop it as well. + +Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code") +Signed-off-by: Phil Sutter +(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc) +--- + libxtables/xtables.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index bc42ba8221f3a..6947441fec659 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) + struct in6_addr *xtables_numeric_to_ip6addr(const char *num) + { + static struct in6_addr ap; +- int err; + +- if ((err = inet_pton(AF_INET6, num, &ap)) == 1) ++ if (inet_pton(AF_INET6, num, &ap) == 1) + return ≈ + + return NULL; +-- +2.31.1 + diff --git a/0006-extensions-libebt_ip6-Drop-unused-variables.patch b/0006-extensions-libebt_ip6-Drop-unused-variables.patch new file mode 100644 index 0000000..5b40690 --- /dev/null +++ b/0006-extensions-libebt_ip6-Drop-unused-variables.patch @@ -0,0 +1,49 @@ +From 8724e4edb3630f17ddf1897172953f2dc97ef6a1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 Nov 2020 21:13:50 +0100 +Subject: [PATCH] extensions: libebt_ip6: Drop unused variables + +They are being assigned to but never read. + +Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc) +--- + extensions/libebt_ip6.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c +index b8a5a5d8c3a92..301bed9aadefd 100644 +--- a/extensions/libebt_ip6.c ++++ b/extensions/libebt_ip6.c +@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match) + static struct in6_addr *numeric_to_addr(const char *num) + { + static struct in6_addr ap; +- int err; + +- if ((err=inet_pton(AF_INET6, num, &ap)) == 1) ++ if (inet_pton(AF_INET6, num, &ap) == 1) + return ≈ + return (struct in6_addr *)NULL; + } +@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i + char buf[256]; + char *p; + int i; +- int err; + + strncpy(buf, address, sizeof(buf) - 1); + /* first the mask */ +@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i + if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any))) + strcpy(buf, "::"); + +- if ((err=inet_pton(AF_INET6, buf, addr)) < 1) { ++ if (inet_pton(AF_INET6, buf, addr) < 1) { + xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf); + return; + } +-- +2.31.1 + diff --git a/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch b/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch new file mode 100644 index 0000000..8b7829b --- /dev/null +++ b/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch @@ -0,0 +1,29 @@ +From 81e5a32b0369d44a3319b76395ef76950884ecce Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Jun 2021 11:04:30 +0200 +Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask() + +The allocated hostmask duplicate needs to be freed again. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +Signed-off-by: Phil Sutter +(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e) +--- + libxtables/xtoptions.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index d329f2ff7979e..0dcdf607f4678 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb) + cb->arg = p; + xtopt_parse_plenmask(cb); + cb->arg = orig_arg; ++ free(work); + } + + static void xtopt_parse_ethermac(struct xt_option_call *cb) +-- +2.31.1 + diff --git a/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch b/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch new file mode 100644 index 0000000..2006ef2 --- /dev/null +++ b/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch @@ -0,0 +1,34 @@ +From bf931f3213cc66f798a1a9966220816fd3259a2f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Jun 2021 11:55:20 +0200 +Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new() + +If rule allocation fails, free the allocated 'cmd' before returning to +caller. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3) +--- + iptables/nft-cmd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index f2b935c57dab4..c3f6c14e0b99e 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + + if (state) { + rule = nft_rule_new(h, chain, table, state); +- if (!rule) ++ if (!rule) { ++ nft_cmd_free(cmd); + return NULL; ++ } + + cmd->obj.rule = rule; + +-- +2.31.1 + diff --git a/0009-iptables-apply-Drop-unused-variable.patch b/0009-iptables-apply-Drop-unused-variable.patch new file mode 100644 index 0000000..be088c2 --- /dev/null +++ b/0009-iptables-apply-Drop-unused-variable.patch @@ -0,0 +1,29 @@ +From fa0569c3d701d929393def1851421a4cacf251cc Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Jun 2021 12:50:57 +0200 +Subject: [PATCH] iptables-apply: Drop unused variable + +It was assigned to but never read. + +Fixes: b45b4e3903414 ("iptables-apply: script and manpage update") +Signed-off-by: Phil Sutter +(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764) +--- + iptables/iptables-apply | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/iptables/iptables-apply b/iptables/iptables-apply +index 4683b1b402d08..3a7df5e3cbc1f 100755 +--- a/iptables/iptables-apply ++++ b/iptables/iptables-apply +@@ -231,7 +231,6 @@ case "$MODE" in + "$RUNCMD" & + CMD_PID=$! + ( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) & +- CMDTIMEOUT_PID=$! + if ! wait "$CMD_PID"; then + echo "failed." + echo "Error: unknown error running command: $RUNCMD" >&2 +-- +2.31.1 + diff --git a/iptables.spec b/iptables.spec index 368e429..e02c24d 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 9%{?dist} +Release: 10%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -20,7 +20,15 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +Patch01: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +Patch02: 0002-iptables-nft-fix-Z-option.patch +Patch03: 0003-nft-Fix-bitwise-expression-avoidance-detection.patch +Patch04: 0004-extensions-sctp-Fix-nftables-translation.patch +Patch05: 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch +Patch06: 0006-extensions-libebt_ip6-Drop-unused-variables.patch +Patch07: 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch +Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch +Patch09: 0009-iptables-apply-Drop-unused-variable.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -418,6 +426,9 @@ fi %changelog +* Wed Jun 16 2021 Phil Sutter - 1.8.7-10 +- Backport fixes from upstream + * Wed Jun 16 2021 Phil Sutter - 1.8.7-9 - Remove bashisms from arptables-nft-helper From 36833ea1e0189b0445d46d42f84ac7dc0aeed5fe Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 1 Jul 2021 18:31:01 +0200 Subject: [PATCH 046/100] iptables-1.8.7-11 - Fix performance restoring large rulesets - Review unit file --- ...nft-cache-Sort-chains-on-demand-only.patch | 211 ++++++++++++++++++ ...CH_PAGE_SIZE-to-support-huge-ruleset.patch | 56 +++++ iptables.service | 5 +- iptables.spec | 8 +- 4 files changed, 277 insertions(+), 3 deletions(-) create mode 100644 0010-nft-cache-Sort-chains-on-demand-only.patch create mode 100644 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch diff --git a/0010-nft-cache-Sort-chains-on-demand-only.patch b/0010-nft-cache-Sort-chains-on-demand-only.patch new file mode 100644 index 0000000..2a57862 --- /dev/null +++ b/0010-nft-cache-Sort-chains-on-demand-only.patch @@ -0,0 +1,211 @@ +From b7582864a4cb71d4dcde752a3a2203c81159d6e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 25 Mar 2021 16:24:39 +0100 +Subject: [PATCH] nft: cache: Sort chains on demand only + +Mandatory sorted insert of chains into cache significantly slows down +restoring of large rulesets. Since the sorted list of user-defined +chains is needed for listing and verbose output only, introduce +nft_cache_sort_chains() and call it where needed. + +Signed-off-by: Phil Sutter +(cherry picked from commit fdf64dcdace989589bac441805082e3b1fe6a915) +--- + iptables/nft-cache.c | 71 +++++++++++++++++++++++++++++++++-------- + iptables/nft-cache.h | 1 + + iptables/nft.c | 12 +++++++ + iptables/nft.h | 1 + + iptables/xtables-save.c | 1 + + 5 files changed, 73 insertions(+), 13 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 6b6e6da40a826..8fbf9727826d8 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -223,24 +223,67 @@ int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, + + h->cache->table[t->type].base_chains[hooknum] = nc; + } else { +- struct nft_chain_list *clist = h->cache->table[t->type].chains; +- struct list_head *pos = &clist->list; +- struct nft_chain *cur; +- const char *n; +- +- list_for_each_entry(cur, &clist->list, head) { +- n = nftnl_chain_get_str(cur->nftnl, NFTNL_CHAIN_NAME); +- if (strcmp(cname, n) <= 0) { +- pos = &cur->head; +- break; +- } +- } +- list_add_tail(&nc->head, pos); ++ list_add_tail(&nc->head, ++ &h->cache->table[t->type].chains->list); + } + hlist_add_head(&nc->hnode, chain_name_hlist(h, t, cname)); + return 0; + } + ++static void __nft_chain_list_sort(struct list_head *list, ++ int (*cmp)(struct nft_chain *a, ++ struct nft_chain *b)) ++{ ++ struct nft_chain *pivot, *cur, *sav; ++ LIST_HEAD(sublist); ++ ++ if (list_empty(list)) ++ return; ++ ++ /* grab first item as pivot (dividing) value */ ++ pivot = list_entry(list->next, struct nft_chain, head); ++ list_del(&pivot->head); ++ ++ /* move any smaller value into sublist */ ++ list_for_each_entry_safe(cur, sav, list, head) { ++ if (cmp(pivot, cur) > 0) { ++ list_del(&cur->head); ++ list_add_tail(&cur->head, &sublist); ++ } ++ } ++ /* conquer divided */ ++ __nft_chain_list_sort(&sublist, cmp); ++ __nft_chain_list_sort(list, cmp); ++ ++ /* merge divided and pivot again */ ++ list_add_tail(&pivot->head, &sublist); ++ list_splice(&sublist, list); ++} ++ ++static int nft_chain_cmp_byname(struct nft_chain *a, struct nft_chain *b) ++{ ++ const char *aname = nftnl_chain_get_str(a->nftnl, NFTNL_CHAIN_NAME); ++ const char *bname = nftnl_chain_get_str(b->nftnl, NFTNL_CHAIN_NAME); ++ ++ return strcmp(aname, bname); ++} ++ ++int nft_cache_sort_chains(struct nft_handle *h, const char *table) ++{ ++ const struct builtin_table *t = nft_table_builtin_find(h, table); ++ ++ if (!t) ++ return -1; ++ ++ if (h->cache->table[t->type].sorted) ++ return 0; ++ ++ __nft_chain_list_sort(&h->cache->table[t->type].chains->list, ++ nft_chain_cmp_byname); ++ h->cache->table[t->type].sorted = true; ++ return 0; ++} ++ + struct nftnl_chain_list_cb_data { + struct nft_handle *h; + const struct builtin_table *t; +@@ -663,6 +706,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, + + flush_base_chain_cache(c->table[table->type].base_chains); + nft_chain_foreach(h, tablename, __flush_chain_cache, NULL); ++ c->table[table->type].sorted = false; + + if (c->table[table->type].sets) + nftnl_set_list_foreach(c->table[table->type].sets, +@@ -678,6 +722,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, + if (c->table[i].chains) { + nft_chain_list_free(c->table[i].chains); + c->table[i].chains = NULL; ++ c->table[i].sorted = false; + } + + if (c->table[i].sets) { +diff --git a/iptables/nft-cache.h b/iptables/nft-cache.h +index 20d96beede876..58a015265056c 100644 +--- a/iptables/nft-cache.h ++++ b/iptables/nft-cache.h +@@ -16,6 +16,7 @@ int flush_rule_cache(struct nft_handle *h, const char *table, + void nft_cache_build(struct nft_handle *h); + int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, + struct nftnl_chain *c); ++int nft_cache_sort_chains(struct nft_handle *h, const char *table); + + struct nft_chain * + nft_chain_find(struct nft_handle *h, const char *table, const char *chain); +diff --git a/iptables/nft.c b/iptables/nft.c +index bde4ca72d3fcc..8b14daeaed610 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1754,6 +1754,8 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table, + return 1; + } + ++ nft_cache_sort_chains(h, table); ++ + ret = nft_chain_foreach(h, table, nft_rule_flush_cb, &d); + + /* the core expects 1 for success and 0 for error */ +@@ -1900,6 +1902,9 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain, + goto out; + } + ++ if (verbose) ++ nft_cache_sort_chains(h, table); ++ + ret = nft_chain_foreach(h, table, __nft_chain_user_del, &d); + out: + /* the core expects 1 for success and 0 for error */ +@@ -2437,6 +2442,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table, + return 1; + } + ++ nft_cache_sort_chains(h, table); ++ + if (ops->print_table_header) + ops->print_table_header(table); + +@@ -2540,6 +2547,8 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain, + return nft_rule_list_cb(c, &d); + } + ++ nft_cache_sort_chains(h, table); ++ + /* Dump policies and custom chains first */ + nft_chain_foreach(h, table, nft_rule_list_chain_save, &counters); + +@@ -3431,6 +3440,9 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain, + goto err; + } + ++ if (verbose) ++ nft_cache_sort_chains(h, table); ++ + ret = nft_chain_foreach(h, table, __nft_chain_zero_counters, &d); + err: + /* the core expects 1 for success and 0 for error */ +diff --git a/iptables/nft.h b/iptables/nft.h +index 0910f82a2773c..4ac7e0099d567 100644 +--- a/iptables/nft.h ++++ b/iptables/nft.h +@@ -44,6 +44,7 @@ struct nft_cache { + struct nft_chain_list *chains; + struct nftnl_set_list *sets; + bool exists; ++ bool sorted; + } table[NFT_TABLE_MAX]; + }; + +diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c +index d7901c650ea70..cfce0472f3ee8 100644 +--- a/iptables/xtables-save.c ++++ b/iptables/xtables-save.c +@@ -87,6 +87,7 @@ __do_output(struct nft_handle *h, const char *tablename, void *data) + printf("*%s\n", tablename); + /* Dump out chain names first, + * thereby preventing dependency conflicts */ ++ nft_cache_sort_chains(h, tablename); + nft_chain_foreach(h, tablename, nft_chain_save, h); + nft_rule_save(h, tablename, d->format); + if (d->commit) +-- +2.31.1 + diff --git a/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch b/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch new file mode 100644 index 0000000..863206e --- /dev/null +++ b/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch @@ -0,0 +1,56 @@ +From 8086d05bb16e75a23b49bf1accef615193e726e6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 6 Apr 2021 10:51:20 +0200 +Subject: [PATCH] nft: Increase BATCH_PAGE_SIZE to support huge rulesets + +In order to support the same ruleset sizes as legacy iptables, the +kernel's limit of 1024 iovecs has to be overcome. Therefore increase +each iovec's size from 128KB to 2MB. + +While being at it, add a log message for failing sendmsg() call. This is +not supposed to happen, even if the transaction fails. Yet if it does, +users are left with only a "line XXX failed" message (with line number +being the COMMIT line). + +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +(cherry picked from commit a3e81c62e8c5abb4158f1f66df6bbcffd1b33240) +--- + iptables/nft.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8b14daeaed610..f1deb82f87576 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -88,11 +88,11 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh, + + #define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize()) + +-/* selected batch page is 256 Kbytes long to load ruleset of +- * half a million rules without hitting -EMSGSIZE due to large +- * iovec. ++/* Selected batch page is 2 Mbytes long to support loading a ruleset of 3.5M ++ * rules matching on source and destination address as well as input and output ++ * interfaces. This is what legacy iptables supports. + */ +-#define BATCH_PAGE_SIZE getpagesize() * 32 ++#define BATCH_PAGE_SIZE 2 * 1024 * 1024 + + static struct nftnl_batch *mnl_batch_init(void) + { +@@ -220,8 +220,10 @@ static int mnl_batch_talk(struct nft_handle *h, int numcmds) + int err = 0; + + ret = mnl_nft_socket_sendmsg(h, numcmds); +- if (ret == -1) ++ if (ret == -1) { ++ fprintf(stderr, "sendmsg() failed: %s\n", strerror(errno)); + return -1; ++ } + + FD_ZERO(&readfds); + FD_SET(fd, &readfds); +-- +2.31.1 + diff --git a/iptables.service b/iptables.service index 342ac93..6b996d1 100644 --- a/iptables.service +++ b/iptables.service @@ -1,7 +1,8 @@ [Unit] Description=IPv4 firewall with iptables -After=syslog.target AssertPathExists=/etc/sysconfig/iptables +Before=network-pre.target +Wants=network-pre.target [Service] Type=oneshot @@ -13,4 +14,4 @@ Environment=BOOTUP=serial Environment=CONSOLETYPE=serial [Install] -WantedBy=basic.target +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index e02c24d..ba0d1dd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 10%{?dist} +Release: 11%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -29,6 +29,8 @@ Patch06: 0006-extensions-libebt_ip6-Drop-unused-variables.patch Patch07: 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch Patch09: 0009-iptables-apply-Drop-unused-variable.patch +Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch +Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -426,6 +428,10 @@ fi %changelog +* Thu Jul 01 2021 Phil Sutter - 1.8.7-11 +- Fix performance restoring large rulesets +- Review unit file + * Wed Jun 16 2021 Phil Sutter - 1.8.7-10 - Backport fixes from upstream From 19e3e9da9802c1232bf754fea0edd93564eb0445 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 08:42:28 +0000 Subject: [PATCH 047/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index ba0d1dd..9546dc3 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 11%{?dist} +Release: 12%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -428,6 +428,9 @@ fi %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 1.8.7-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Thu Jul 01 2021 Phil Sutter - 1.8.7-11 - Fix performance restoring large rulesets - Review unit file From cf09f27f9106977bf789c267deb2b03416d90db5 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Aug 2021 14:19:53 +0200 Subject: [PATCH 048/100] iptables-1.8.7-13 - doc: ebtables-nft.8: Adjust for missing atomic-options - nft: Fix for non-verbose check command - Build services sub-package as noarch --- ....8-Adjust-for-missing-atomic-options.patch | 130 ++++++++++++++++++ ...ft-Fix-for-non-verbose-check-command.patch | 31 +++++ iptables.spec | 10 +- 3 files changed, 170 insertions(+), 1 deletion(-) create mode 100644 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch create mode 100644 0013-nft-Fix-for-non-verbose-check-command.patch diff --git a/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch b/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch new file mode 100644 index 0000000..d07e50f --- /dev/null +++ b/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch @@ -0,0 +1,130 @@ +From 172a84516d3311733cf2a11acc7a86203ad38156 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 28 Jul 2021 17:53:53 +0200 +Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options + +Drop any reference to them (and the environment variable) but list them +in BUGS section hinting at ebtables-save and -restore tools. + +Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 765bf04ecc228783cb88c810c85bc0c769579c39) +--- + iptables/ebtables-nft.8 | 64 ++++++----------------------------------- + 1 file changed, 8 insertions(+), 56 deletions(-) + +diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 +index 1fa5ad9388cc0..08e9766f2cc74 100644 +--- a/iptables/ebtables-nft.8 ++++ b/iptables/ebtables-nft.8 +@@ -44,12 +44,6 @@ ebtables \- Ethernet bridge frame table administration (nft-based) + .br + .BR "ebtables " [ -t " table ] " --init-table + .br +-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit +-.br +-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init +-.br +-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save +-.br + + .SH DESCRIPTION + .B ebtables +@@ -149,11 +143,9 @@ a table, the commands apply to the default filter table. + Only one command may be used on the command line at a time, except when + the commands + .BR -L " and " -Z +-are combined, the commands ++are combined or the commands + .BR -N " and " -P +-are combined, or when +-.B --atomic-file +-is used. ++are combined. + .TP + .B "-A, --append" + Append a rule to the end of the selected chain. +@@ -313,39 +305,6 @@ of the ebtables kernel table. + .TP + .B "--init-table" + Replace the current table data by the initial table data. +-.TP +-.B "--atomic-init" +-Copy the kernel's initial data of the table to the specified +-file. This can be used as the first action, after which rules are added +-to the file. The file can be specified using the +-.B --atomic-file +-command or through the +-.IR EBTABLES_ATOMIC_FILE " environment variable." +-.TP +-.B "--atomic-save" +-Copy the kernel's current data of the table to the specified +-file. This can be used as the first action, after which rules are added +-to the file. The file can be specified using the +-.B --atomic-file +-command or through the +-.IR EBTABLES_ATOMIC_FILE " environment variable." +-.TP +-.B "--atomic-commit" +-Replace the kernel table data with the data contained in the specified +-file. This is a useful command that allows you to load all your rules of a +-certain table into the kernel at once, saving the kernel a lot of precious +-time and allowing atomic updates of the tables. The file which contains +-the table data is constructed by using either the +-.B "--atomic-init" +-or the +-.B "--atomic-save" +-command to generate a starting file. After that, using the +-.B "--atomic-file" +-command when constructing rules or setting the +-.IR EBTABLES_ATOMIC_FILE " environment variable" +-allows you to extend the file and build the complete table before +-committing it to the kernel. This command can be very useful in boot scripts +-to populate the ebtables tables in a fast way. + .SS MISCELLANOUS COMMANDS + .TP + .B "-V, --version" +@@ -371,16 +330,6 @@ a target extension (see + .BR "TARGET EXTENSIONS" ")" + or a user-defined chain name. + .TP +-.B --atomic-file "\fIfile\fP" +-Let the command operate on the specified +-.IR file . +-The data of the table to +-operate on will be extracted from the file and the result of the operation +-will be saved back into the file. If specified, this option should come +-before the command specification. An alternative that should be preferred, +-is setting the +-.IR EBTABLES_ATOMIC_FILE " environment variable." +-.TP + .B -M, --modprobe "\fIprogram\fP" + When talking to the kernel, use this + .I program +@@ -1100,8 +1049,6 @@ arp message and the hardware address length in the arp header is 6 bytes. + .br + .SH FILES + .I /etc/ethertypes +-.SH ENVIRONMENT VARIABLES +-.I EBTABLES_ATOMIC_FILE + .SH MAILINGLISTS + .BR "" "See " http://netfilter.org/mailinglists.html + .SH BUGS +@@ -1109,7 +1056,12 @@ The version of ebtables this man page ships with does not support the + .B broute + table. Also there is no support for + .B string +-match. And finally, this list is probably not complete. ++match. Further, support for atomic-options ++.RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit ) ++has not been implemented, although ++.BR ebtables-save " and " ebtables-restore ++might replace them entirely given the inherent atomicity of nftables. ++Finally, this list is probably not complete. + .SH SEE ALSO + .BR xtables-nft "(8), " iptables "(8), " ip (8) + .PP +-- +2.32.0 + diff --git a/0013-nft-Fix-for-non-verbose-check-command.patch b/0013-nft-Fix-for-non-verbose-check-command.patch new file mode 100644 index 0000000..3d9d27d --- /dev/null +++ b/0013-nft-Fix-for-non-verbose-check-command.patch @@ -0,0 +1,31 @@ +From f3d74895be5847db13af403067c28385356376df Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 3 Aug 2021 10:55:20 +0200 +Subject: [PATCH] nft: Fix for non-verbose check command + +Check command was unconditionally verbose since v1.8.5. Make it respect +--verbose option again. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit 57d1422dbbc41c36ed2e9f6c67aa040c65a429a0) +--- + iptables/nft.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index f1deb82f87576..795dff8605404 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3126,7 +3126,7 @@ static int nft_prepare(struct nft_handle *h) + case NFT_COMPAT_RULE_CHECK: + assert_chain_exists(h, cmd->table, cmd->jumpto); + ret = nft_rule_check(h, cmd->chain, cmd->table, +- cmd->obj.rule, cmd->rulenum); ++ cmd->obj.rule, cmd->verbose); + break; + case NFT_COMPAT_RULE_ZERO: + ret = nft_rule_zero_counters(h, cmd->chain, cmd->table, +-- +2.32.0 + diff --git a/iptables.spec b/iptables.spec index 9546dc3..5af268f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 12%{?dist} +Release: 13%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -31,6 +31,8 @@ Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch Patch09: 0009-iptables-apply-Drop-unused-variable.patch Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch +Patch12: 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch +Patch13: 0013-nft-Fix-for-non-verbose-check-command.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -140,6 +142,7 @@ Requires: %{name} = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +BuildArch: noarch %description services iptables services for IPv4 and IPv6 @@ -428,6 +431,11 @@ fi %changelog +* Thu Aug 05 2021 Phil Sutter - 1.8.7-13 +- doc: ebtables-nft.8: Adjust for missing atomic-options +- nft: Fix for non-verbose check command +- Build services sub-package as noarch + * Thu Jul 22 2021 Fedora Release Engineering - 1.8.7-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 3f23334d0e73ae9aba392f94a2bfbc6a6cba4a2d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 27 Nov 2021 16:54:53 -0800 Subject: [PATCH 049/100] Rebuild for new libnftnl. --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 5af268f..1a87186 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 13%{?dist} +Release: 14%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -431,6 +431,9 @@ fi %changelog +* Sat Nov 27 2021 Kevin Fenzi - 1.8.7-14 +- Rebuild for new libnftnl. + * Thu Aug 05 2021 Phil Sutter - 1.8.7-13 - doc: ebtables-nft.8: Adjust for missing atomic-options - nft: Fix for non-verbose check command From c2fb2d6c94706eac7aa0ce571d58842d12810cea Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 13:25:32 +0000 Subject: [PATCH 050/100] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 1a87186..f5f0e31 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 14%{?dist} +Release: 15%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -431,6 +431,9 @@ fi %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.8.7-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 27 2021 Kevin Fenzi - 1.8.7-14 - Rebuild for new libnftnl. From 0f9f220b6715c18ad71c66c3aa0a740ec4cac1c9 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Mar 2022 13:28:15 +0100 Subject: [PATCH 051/100] iptables-1.8.7-16 - Improve error messages for unsupported extensions - xshared: Fix response to unprivileged users - libxtables: Register only the highest revision extension - Ignore typical 'fedpkg local' results in .gitignore --- .gitignore | 5 + ...ter-only-the-highest-revision-extens.patch | 64 +++++++++ ...d-Fix-response-to-unprivileged-users.patch | 134 ++++++++++++++++++ ...-messages-for-unsupported-extensions.patch | 84 +++++++++++ iptables.spec | 11 +- 5 files changed, 297 insertions(+), 1 deletion(-) create mode 100644 0014-libxtables-Register-only-the-highest-revision-extens.patch create mode 100644 0015-xshared-Fix-response-to-unprivileged-users.patch create mode 100644 0016-Improve-error-messages-for-unsupported-extensions.patch diff --git a/.gitignore b/.gitignore index d5a31d9..550d2b4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,8 @@ +/.build-*.log +/iptables-*.src.rpm +/noarch/ +/x86_64/ +/iptables.spec.orig /iptables-1.6.2.tar.bz2 /iptables-1.8.0.tar.bz2 /iptables-1.8.2.tar.bz2 diff --git a/0014-libxtables-Register-only-the-highest-revision-extens.patch b/0014-libxtables-Register-only-the-highest-revision-extens.patch new file mode 100644 index 0000000..a27d151 --- /dev/null +++ b/0014-libxtables-Register-only-the-highest-revision-extens.patch @@ -0,0 +1,64 @@ +From 3ffbffeb5193bf7259b04fcd2297a0d3e218b7a2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 11 Feb 2022 17:39:24 +0100 +Subject: [PATCH] libxtables: Register only the highest revision extension + +When fully registering extensions, ignore all consecutive ones with same +name and family value. Since commit b3ac87038f4e4 ("libxtables: Make +sure extensions register in revision order"), one may safely assume the +list of pending extensions has highest revision numbers first. Since +iptables is only interested in the highest revision the kernel supports, +registration and compatibility checks may be skipped once the first +matching extension in pending list has validated. + +Signed-off-by: Phil Sutter +(cherry picked from commit 2dbb49d15fb44ddd521a734eca3be3f940b7c1ba) +--- + libxtables/xtables.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index 6947441fec659..b0c969676bc85 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -668,6 +668,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, + struct xtables_match **dptr; + struct xtables_match *ptr; + const char *icmp6 = "icmp6"; ++ bool found = false; + + if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) + xtables_error(PARAMETER_PROBLEM, +@@ -686,7 +687,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, + if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { + ptr = *dptr; + *dptr = (*dptr)->next; +- if (xtables_fully_register_pending_match(ptr, prev)) { ++ if (!found && ++ xtables_fully_register_pending_match(ptr, prev)) { ++ found = true; + prev = ptr; + continue; + } else if (prev) { +@@ -788,6 +791,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) + struct xtables_target *prev = NULL; + struct xtables_target **dptr; + struct xtables_target *ptr; ++ bool found = false; + + /* Standard target? */ + if (strcmp(name, "") == 0 +@@ -802,7 +806,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) + if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { + ptr = *dptr; + *dptr = (*dptr)->next; +- if (xtables_fully_register_pending_target(ptr, prev)) { ++ if (!found && ++ xtables_fully_register_pending_target(ptr, prev)) { ++ found = true; + prev = ptr; + continue; + } else if (prev) { +-- +2.34.1 + diff --git a/0015-xshared-Fix-response-to-unprivileged-users.patch b/0015-xshared-Fix-response-to-unprivileged-users.patch new file mode 100644 index 0000000..fa28fde --- /dev/null +++ b/0015-xshared-Fix-response-to-unprivileged-users.patch @@ -0,0 +1,134 @@ +From eec7fd187a9eeda1250c1a35b32c92eff074dff6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 18 Jan 2022 22:39:08 +0100 +Subject: [PATCH] xshared: Fix response to unprivileged users + +Expected behaviour in both variants is: + +* Print help without error, append extension help if -m and/or -j + options are present +* Indicate lack of permissions in an error message for anything else + +With iptables-nft, this was broken basically from day 1. Shared use of +do_parse() then somewhat broke legacy: it started complaining about +inability to create a lock file. + +Fix this by making iptables-nft assume extension revision 0 is present +if permissions don't allow to verify. This is consistent with legacy. + +Second part is to exit directly after printing help - this avoids having +to make the following code "nop-aware" to prevent privileged actions. + +Signed-off-by: Phil Sutter +Reviewed-by: Florian Westphal +(cherry picked from commit 26ecdf53960658771c0fc582f72a4025e2887f75) + +Conflicts: + iptables/xshared.c +-> Apply direct exit from do_parse() to xtables.c, upstream merged + do_parse() functions. +--- + iptables/nft.c | 5 ++ + .../testcases/iptables/0008-unprivileged_0 | 60 +++++++++++++++++++ + iptables/xtables.c | 2 +- + 3 files changed, 66 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0 + +diff --git a/iptables/nft.c b/iptables/nft.c +index 795dff8605404..5aa14aebeb31e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3256,6 +3256,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) + err: + mnl_socket_close(nl); + ++ /* pretend revision 0 is valid if not permitted to check - ++ * this is required for printing extension help texts as user */ ++ if (ret < 0 && errno == EPERM && rev == 0) ++ return 1; ++ + return ret < 0 ? 0 : 1; + } + +diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 +new file mode 100755 +index 0000000000000..43e3bc8721dbd +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 +@@ -0,0 +1,60 @@ ++#!/bin/bash ++ ++# iptables may print match/target specific help texts ++# help output should work for unprivileged users ++ ++run() { ++ echo "running: $*" >&2 ++ runuser -u nobody -- "$@" ++} ++ ++grep_or_rc() { ++ declare -g rc ++ grep -q "$*" && return 0 ++ echo "missing in output: $*" >&2 ++ return 1 ++} ++ ++out=$(run $XT_MULTI iptables --help) ++let "rc+=$?" ++grep_or_rc "iptables -h (print this help information)" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -m limit --help) ++let "rc+=$?" ++grep_or_rc "limit match options:" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -p tcp --help) ++let "rc+=$?" ++grep_or_rc "tcp match options:" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -j DNAT --help) ++let "rc+=$?" ++grep_or_rc "DNAT target options:" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) ++let "rc+=$?" ++grep_or_rc "tcp match options:" <<< "$out" ++let "rc+=$?" ++out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) ++let "rc+=$?" ++grep_or_rc "DNAT target options:" <<< "$out" ++let "rc+=$?" ++ ++ ++run $XT_MULTI iptables -L 2>&1 | \ ++ grep_or_rc "Permission denied" ++let "rc+=$?" ++ ++run $XT_MULTI iptables -A FORWARD -p tcp --dport 123 2>&1 | \ ++ grep_or_rc "Permission denied" ++let "rc+=$?" ++ ++run $XT_MULTI iptables -A FORWARD -j DNAT --to-destination 1.2.3.4 2>&1 | \ ++ grep_or_rc "Permission denied" ++let "rc+=$?" ++ ++exit $rc +diff --git a/iptables/xtables.c b/iptables/xtables.c +index 9779bd83d53b3..a16bba74dc578 100644 +--- a/iptables/xtables.c ++++ b/iptables/xtables.c +@@ -645,7 +645,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], + + printhelp(cs->matches); + p->command = CMD_NONE; +- return; ++ exit(0); + + /* + * Option selection +-- +2.34.1 + diff --git a/0016-Improve-error-messages-for-unsupported-extensions.patch b/0016-Improve-error-messages-for-unsupported-extensions.patch new file mode 100644 index 0000000..bd8282c --- /dev/null +++ b/0016-Improve-error-messages-for-unsupported-extensions.patch @@ -0,0 +1,84 @@ +From 721af7dfbfd5dc18af86e00d30de108dbf1687fb Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 11 Feb 2022 17:47:22 +0100 +Subject: [PATCH] Improve error messages for unsupported extensions + +If a given extension was not supported by the kernel, iptables would +print a rather confusing error message if extension parameters were +given: + +| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko +| # iptables -A FORWARD -j LOG --log-prefix foo +| iptables v1.8.7 (legacy): unknown option "--log-prefix" + +Avoid this by pretending extension revision 0 is always supported. It is +the same hack as used to successfully print extension help texts as +unprivileged user, extended to all error codes to serve privileged ones +as well. + +In addition, print a warning if kernel rejected revision 0 and it's not +a permissions problem. This helps users find out which extension in a +rule the kernel didn't like. + +Finally, the above commands result in these messages: + +| Warning: Extension LOG revision 0 not supported, missing kernel module? +| iptables: No chain/target/match by that name. + +Or, for iptables-nft: + +| Warning: Extension LOG revision 0 not supported, missing kernel module? +| iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD + +Signed-off-by: Phil Sutter +(cherry picked from commit 17534cb18ed0a5052dc45c117401251359dba6aa) +--- + iptables/nft.c | 12 +++++++++--- + libxtables/xtables.c | 7 ++++++- + 2 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 5aa14aebeb31e..0b1759c3e35ea 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3256,10 +3256,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) + err: + mnl_socket_close(nl); + +- /* pretend revision 0 is valid if not permitted to check - +- * this is required for printing extension help texts as user */ +- if (ret < 0 && errno == EPERM && rev == 0) ++ /* pretend revision 0 is valid - ++ * this is required for printing extension help texts as user, also ++ * helps error messaging on unavailable kernel extension */ ++ if (ret < 0 && rev == 0) { ++ if (errno != EPERM) ++ fprintf(stderr, ++ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", ++ name); + return 1; ++ } + + return ret < 0 ? 0 : 1; + } +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index b0c969676bc85..10b985b7c3a79 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -929,7 +929,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt) + /* Definitely don't support this? */ + if (errno == ENOENT || errno == EPROTONOSUPPORT) { + close(sockfd); +- return 0; ++ /* Pretend revision 0 support for better error messaging */ ++ if (revision == 0) ++ fprintf(stderr, ++ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", ++ name); ++ return (revision == 0); + } else if (errno == ENOPROTOOPT) { + close(sockfd); + /* Assume only revision 0 support (old kernel) */ +-- +2.34.1 + diff --git a/iptables.spec b/iptables.spec index f5f0e31..d8c8823 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 15%{?dist} +Release: 16%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -33,6 +33,9 @@ Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch Patch12: 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch Patch13: 0013-nft-Fix-for-non-verbose-check-command.patch +Patch14: 0014-libxtables-Register-only-the-highest-revision-extens.patch +Patch15: 0015-xshared-Fix-response-to-unprivileged-users.patch +Patch16: 0016-Improve-error-messages-for-unsupported-extensions.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -431,6 +434,12 @@ fi %changelog +* Thu Mar 03 2022 Phil Sutter - 1.8.7-16 +- Improve error messages for unsupported extensions +- xshared: Fix response to unprivileged users +- libxtables: Register only the highest revision extension +- Ignore typical 'fedpkg local' results in .gitignore + * Thu Jan 20 2022 Fedora Release Engineering - 1.8.7-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 8e6fc4330b4fa78c1da8b03341765ef1adf79689 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 13 May 2022 16:48:39 +0200 Subject: [PATCH 052/100] Update to 1.8.8. Fixes rhbz#2085503 --- .gitignore | 1 + ...it-gracefully-on-invalid-table-names.patch | 51 ----- ...Fix-build-for-Werror-format-security.patch | 29 +++ 0002-iptables-nft-fix-Z-option.patch | 104 --------- ...twise-expression-avoidance-detection.patch | 73 ------ ...nsions-sctp-Fix-nftables-translation.patch | 80 ------- ...leftover-variable-in-xtables_numeric.patch | 33 --- ...ons-libebt_ip6-Drop-unused-variables.patch | 49 ---- ...-Fix-memleak-in-xtopt_parse_hostmask.patch | 29 --- ...memleak-in-error-path-of-nft_cmd_new.patch | 34 --- ...-iptables-apply-Drop-unused-variable.patch | 29 --- ...nft-cache-Sort-chains-on-demand-only.patch | 211 ------------------ ...CH_PAGE_SIZE-to-support-huge-ruleset.patch | 56 ----- ....8-Adjust-for-missing-atomic-options.patch | 130 ----------- ...ft-Fix-for-non-verbose-check-command.patch | 31 --- ...ter-only-the-highest-revision-extens.patch | 64 ------ ...d-Fix-response-to-unprivileged-users.patch | 134 ----------- ...-messages-for-unsupported-extensions.patch | 84 ------- iptables.spec | 26 +-- sources | 2 +- 20 files changed, 38 insertions(+), 1212 deletions(-) delete mode 100644 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch create mode 100644 0001-xshared-Fix-build-for-Werror-format-security.patch delete mode 100644 0002-iptables-nft-fix-Z-option.patch delete mode 100644 0003-nft-Fix-bitwise-expression-avoidance-detection.patch delete mode 100644 0004-extensions-sctp-Fix-nftables-translation.patch delete mode 100644 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch delete mode 100644 0006-extensions-libebt_ip6-Drop-unused-variables.patch delete mode 100644 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch delete mode 100644 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch delete mode 100644 0009-iptables-apply-Drop-unused-variable.patch delete mode 100644 0010-nft-cache-Sort-chains-on-demand-only.patch delete mode 100644 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch delete mode 100644 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch delete mode 100644 0013-nft-Fix-for-non-verbose-check-command.patch delete mode 100644 0014-libxtables-Register-only-the-highest-revision-extens.patch delete mode 100644 0015-xshared-Fix-response-to-unprivileged-users.patch delete mode 100644 0016-Improve-error-messages-for-unsupported-extensions.patch diff --git a/.gitignore b/.gitignore index 550d2b4..d0729c1 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /iptables-1.8.5.tar.bz2 /iptables-1.8.6.tar.bz2 /iptables-1.8.7.tar.bz2 +/iptables-1.8.8.tar.bz2 diff --git a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch deleted file mode 100644 index 93191ca..0000000 --- a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +++ /dev/null @@ -1,51 +0,0 @@ -From df7ed83da048317d344b34e9c38e31035e508f24 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 28 Jan 2021 01:09:56 +0100 -Subject: [PATCH] ebtables: Exit gracefully on invalid table names - -Users are able to cause program abort by passing a table name that -doesn't exist: - -| # ebtables-nft -t dummy -P INPUT ACCEPT -| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. -| Aborted - -Avoid this by checking table existence just like iptables-nft does upon -parsing '-t' optarg. Since the list of tables is known and fixed, -checking the given name's length is pointless. So just drop that check -in return. - -With this patch in place, output looks much better: - -| # ebtables-nft -t dummy -P INPUT ACCEPT -| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist -| Perhaps iptables or your kernel needs to be upgraded. - -Signed-off-by: Phil Sutter -(cherry picked from commit 30c1d443896311e69762d6b51b63908ec602574f) ---- - iptables/xtables-eb.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index cfa9317c78e94..5bb34d6d292a9 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -914,10 +914,10 @@ print_zero: - xtables_error(PARAMETER_PROBLEM, - "The -t option (seen in line %u) cannot be used in %s.\n", - line, xt_params->program_name); -- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) -- xtables_error(PARAMETER_PROBLEM, -- "Table name length cannot exceed %d characters", -- EBT_TABLE_MAXNAMELEN - 1); -+ if (!nft_table_builtin_find(h, optarg)) -+ xtables_error(VERSION_PROBLEM, -+ "table '%s' does not exist", -+ optarg); - *table = optarg; - table_set = true; - break; --- -2.31.1 - diff --git a/0001-xshared-Fix-build-for-Werror-format-security.patch b/0001-xshared-Fix-build-for-Werror-format-security.patch new file mode 100644 index 0000000..ba6d2db --- /dev/null +++ b/0001-xshared-Fix-build-for-Werror-format-security.patch @@ -0,0 +1,29 @@ +From fe9bd3b29dd7661e6f74c24db8356014798d1d78 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 May 2022 16:51:58 +0200 +Subject: [PATCH] xshared: Fix build for -Werror=format-security + +Gcc complains about the omitted format string. + +Signed-off-by: Phil Sutter +(cherry picked from commit b72eb12ea5a61df0655ad99d5048994e916be83a) +--- + iptables/xshared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index fae5ddd5df93e..a8512d3808154 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) + return; + + if (args->family != NFPROTO_ARP) +- xtables_error(PARAMETER_PROBLEM, msg); ++ xtables_error(PARAMETER_PROBLEM, "%s", msg); + + fprintf(stderr, "%s", msg); + } +-- +2.34.1 + diff --git a/0002-iptables-nft-fix-Z-option.patch b/0002-iptables-nft-fix-Z-option.patch deleted file mode 100644 index d7f4a6a..0000000 --- a/0002-iptables-nft-fix-Z-option.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 56f5ee8dee86d4ceaeac7eb6e1eaaa2ac3a1d0f8 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Wed, 24 Feb 2021 11:08:02 +0100 -Subject: [PATCH] iptables-nft: fix -Z option - -it zeroes the rule counters, so it needs fully populated cache. -Add a test case to cover this. - -Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands") -Signed-off-by: Florian Westphal -Acked-by: Phil Sutter -(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2) ---- - iptables/nft-cmd.c | 2 +- - .../testcases/iptables/0007-zero-counters_0 | 64 +++++++++++++++++++ - 2 files changed, 65 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0 - -diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c -index 5d33f1f00f574..f2b935c57dab4 100644 ---- a/iptables/nft-cmd.c -+++ b/iptables/nft-cmd.c -@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain, - if (!cmd) - return 0; - -- nft_cache_level_set(h, NFT_CL_CHAINS, cmd); -+ nft_cache_level_set(h, NFT_CL_RULES, cmd); - - return 1; - } -diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 -new file mode 100755 -index 0000000000000..36da1907e3b22 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 -@@ -0,0 +1,64 @@ -+#!/bin/bash -+ -+RC=0 -+COUNTR=$RANDOM$RANDOM -+ -+$XT_MULTI iptables-restore -c < -Date: Fri, 19 Feb 2021 16:54:57 +0100 -Subject: [PATCH] nft: Fix bitwise expression avoidance detection - -Byte-boundary prefix detection was too sloppy: Any data following the -first zero-byte was ignored. Add a follow-up loop making sure there are -no stray bits in the designated host part. - -Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") -Signed-off-by: Phil Sutter -(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba) ---- - iptables/nft-shared.c | 4 +++- - .../testcases/ip6tables/0004-address-masks_0 | 24 +++++++++++++++++++ - 2 files changed, 27 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 10553ab26823b..c1664b50f9383 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, - { - const unsigned char *m = mask; - bool bitwise = false; -- int i; -+ int i, j; - - for (i = 0; i < len; i++) { - if (m[i] != 0xff) { -@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, - break; - } - } -+ for (j = i + 1; !bitwise && j < len; j++) -+ bitwise = !!m[j]; - - if (!bitwise) - len = i; -diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 -new file mode 100755 -index 0000000000000..7eb42f08da975 ---- /dev/null -+++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 -@@ -0,0 +1,24 @@ -+#!/bin/bash -+ -+set -e -+ -+$XT_MULTI ip6tables-restore < -Date: Tue, 4 May 2021 16:03:24 +0200 -Subject: [PATCH] extensions: sctp: Fix nftables translation - -If both sport and dport was present, incorrect nft syntax was generated. - -Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a61282ec6a1697bfb40f19d13a28a74559050167) ---- - extensions/libxt_sctp.c | 10 ++++------ - extensions/libxt_sctp.txlate | 10 +++++----- - 2 files changed, 9 insertions(+), 11 deletions(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index 140de2653b1ef..ee4e99ebf11bf 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl, - if (!einfo->flags) - return 0; - -- xt_xlate_add(xl, "sctp "); -- - if (einfo->flags & XT_SCTP_SRC_PORTS) { - if (einfo->spts[0] != einfo->spts[1]) -- xt_xlate_add(xl, "sport%s %u-%u", -+ xt_xlate_add(xl, "sctp sport%s %u-%u", - einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", - einfo->spts[0], einfo->spts[1]); - else -- xt_xlate_add(xl, "sport%s %u", -+ xt_xlate_add(xl, "sctp sport%s %u", - einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", - einfo->spts[0]); - space = " "; -@@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl, - - if (einfo->flags & XT_SCTP_DEST_PORTS) { - if (einfo->dpts[0] != einfo->dpts[1]) -- xt_xlate_add(xl, "%sdport%s %u-%u", space, -+ xt_xlate_add(xl, "%ssctp dport%s %u-%u", space, - einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", - einfo->dpts[0], einfo->dpts[1]); - else -- xt_xlate_add(xl, "%sdport%s %u", space, -+ xt_xlate_add(xl, "%ssctp dport%s %u", space, - einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", - einfo->dpts[0]); - } -diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate -index 72f4641ab021c..0d6c59e183675 100644 ---- a/extensions/libxt_sctp.txlate -+++ b/extensions/libxt_sctp.txlate -@@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT - nft add rule ip filter INPUT sctp dport != 50-56 counter accept - - iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept -+nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept - - iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept -+nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept - - iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept -+nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept - - iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept -+nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept - - iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT --nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept -+nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept --- -2.31.1 - diff --git a/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch b/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch deleted file mode 100644 index a97305a..0000000 --- a/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch +++ /dev/null @@ -1,33 +0,0 @@ -From bdd9eb3bcce460815eecc39decf0cceb3fb0949b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 Nov 2020 21:04:39 +0100 -Subject: [PATCH] libxtables: Drop leftover variable in - xtables_numeric_to_ip6addr() - -Variable 'err' was only used in removed debug code, so drop it as well. - -Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code") -Signed-off-by: Phil Sutter -(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc) ---- - libxtables/xtables.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index bc42ba8221f3a..6947441fec659 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) - struct in6_addr *xtables_numeric_to_ip6addr(const char *num) - { - static struct in6_addr ap; -- int err; - -- if ((err = inet_pton(AF_INET6, num, &ap)) == 1) -+ if (inet_pton(AF_INET6, num, &ap) == 1) - return ≈ - - return NULL; --- -2.31.1 - diff --git a/0006-extensions-libebt_ip6-Drop-unused-variables.patch b/0006-extensions-libebt_ip6-Drop-unused-variables.patch deleted file mode 100644 index 5b40690..0000000 --- a/0006-extensions-libebt_ip6-Drop-unused-variables.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 8724e4edb3630f17ddf1897172953f2dc97ef6a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 Nov 2020 21:13:50 +0100 -Subject: [PATCH] extensions: libebt_ip6: Drop unused variables - -They are being assigned to but never read. - -Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc) ---- - extensions/libebt_ip6.c | 6 ++---- - 1 file changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c -index b8a5a5d8c3a92..301bed9aadefd 100644 ---- a/extensions/libebt_ip6.c -+++ b/extensions/libebt_ip6.c -@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match) - static struct in6_addr *numeric_to_addr(const char *num) - { - static struct in6_addr ap; -- int err; - -- if ((err=inet_pton(AF_INET6, num, &ap)) == 1) -+ if (inet_pton(AF_INET6, num, &ap) == 1) - return ≈ - return (struct in6_addr *)NULL; - } -@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i - char buf[256]; - char *p; - int i; -- int err; - - strncpy(buf, address, sizeof(buf) - 1); - /* first the mask */ -@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i - if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any))) - strcpy(buf, "::"); - -- if ((err=inet_pton(AF_INET6, buf, addr)) < 1) { -+ if (inet_pton(AF_INET6, buf, addr) < 1) { - xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf); - return; - } --- -2.31.1 - diff --git a/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch b/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch deleted file mode 100644 index 8b7829b..0000000 --- a/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 81e5a32b0369d44a3319b76395ef76950884ecce Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Jun 2021 11:04:30 +0200 -Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask() - -The allocated hostmask duplicate needs to be freed again. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e) ---- - libxtables/xtoptions.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d329f2ff7979e..0dcdf607f4678 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb) - cb->arg = p; - xtopt_parse_plenmask(cb); - cb->arg = orig_arg; -+ free(work); - } - - static void xtopt_parse_ethermac(struct xt_option_call *cb) --- -2.31.1 - diff --git a/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch b/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch deleted file mode 100644 index 2006ef2..0000000 --- a/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch +++ /dev/null @@ -1,34 +0,0 @@ -From bf931f3213cc66f798a1a9966220816fd3259a2f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Jun 2021 11:55:20 +0200 -Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new() - -If rule allocation fails, free the allocated 'cmd' before returning to -caller. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3) ---- - iptables/nft-cmd.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c -index f2b935c57dab4..c3f6c14e0b99e 100644 ---- a/iptables/nft-cmd.c -+++ b/iptables/nft-cmd.c -@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, - - if (state) { - rule = nft_rule_new(h, chain, table, state); -- if (!rule) -+ if (!rule) { -+ nft_cmd_free(cmd); - return NULL; -+ } - - cmd->obj.rule = rule; - --- -2.31.1 - diff --git a/0009-iptables-apply-Drop-unused-variable.patch b/0009-iptables-apply-Drop-unused-variable.patch deleted file mode 100644 index be088c2..0000000 --- a/0009-iptables-apply-Drop-unused-variable.patch +++ /dev/null @@ -1,29 +0,0 @@ -From fa0569c3d701d929393def1851421a4cacf251cc Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Jun 2021 12:50:57 +0200 -Subject: [PATCH] iptables-apply: Drop unused variable - -It was assigned to but never read. - -Fixes: b45b4e3903414 ("iptables-apply: script and manpage update") -Signed-off-by: Phil Sutter -(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764) ---- - iptables/iptables-apply | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/iptables-apply b/iptables/iptables-apply -index 4683b1b402d08..3a7df5e3cbc1f 100755 ---- a/iptables/iptables-apply -+++ b/iptables/iptables-apply -@@ -231,7 +231,6 @@ case "$MODE" in - "$RUNCMD" & - CMD_PID=$! - ( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) & -- CMDTIMEOUT_PID=$! - if ! wait "$CMD_PID"; then - echo "failed." - echo "Error: unknown error running command: $RUNCMD" >&2 --- -2.31.1 - diff --git a/0010-nft-cache-Sort-chains-on-demand-only.patch b/0010-nft-cache-Sort-chains-on-demand-only.patch deleted file mode 100644 index 2a57862..0000000 --- a/0010-nft-cache-Sort-chains-on-demand-only.patch +++ /dev/null @@ -1,211 +0,0 @@ -From b7582864a4cb71d4dcde752a3a2203c81159d6e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 25 Mar 2021 16:24:39 +0100 -Subject: [PATCH] nft: cache: Sort chains on demand only - -Mandatory sorted insert of chains into cache significantly slows down -restoring of large rulesets. Since the sorted list of user-defined -chains is needed for listing and verbose output only, introduce -nft_cache_sort_chains() and call it where needed. - -Signed-off-by: Phil Sutter -(cherry picked from commit fdf64dcdace989589bac441805082e3b1fe6a915) ---- - iptables/nft-cache.c | 71 +++++++++++++++++++++++++++++++++-------- - iptables/nft-cache.h | 1 + - iptables/nft.c | 12 +++++++ - iptables/nft.h | 1 + - iptables/xtables-save.c | 1 + - 5 files changed, 73 insertions(+), 13 deletions(-) - -diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c -index 6b6e6da40a826..8fbf9727826d8 100644 ---- a/iptables/nft-cache.c -+++ b/iptables/nft-cache.c -@@ -223,24 +223,67 @@ int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, - - h->cache->table[t->type].base_chains[hooknum] = nc; - } else { -- struct nft_chain_list *clist = h->cache->table[t->type].chains; -- struct list_head *pos = &clist->list; -- struct nft_chain *cur; -- const char *n; -- -- list_for_each_entry(cur, &clist->list, head) { -- n = nftnl_chain_get_str(cur->nftnl, NFTNL_CHAIN_NAME); -- if (strcmp(cname, n) <= 0) { -- pos = &cur->head; -- break; -- } -- } -- list_add_tail(&nc->head, pos); -+ list_add_tail(&nc->head, -+ &h->cache->table[t->type].chains->list); - } - hlist_add_head(&nc->hnode, chain_name_hlist(h, t, cname)); - return 0; - } - -+static void __nft_chain_list_sort(struct list_head *list, -+ int (*cmp)(struct nft_chain *a, -+ struct nft_chain *b)) -+{ -+ struct nft_chain *pivot, *cur, *sav; -+ LIST_HEAD(sublist); -+ -+ if (list_empty(list)) -+ return; -+ -+ /* grab first item as pivot (dividing) value */ -+ pivot = list_entry(list->next, struct nft_chain, head); -+ list_del(&pivot->head); -+ -+ /* move any smaller value into sublist */ -+ list_for_each_entry_safe(cur, sav, list, head) { -+ if (cmp(pivot, cur) > 0) { -+ list_del(&cur->head); -+ list_add_tail(&cur->head, &sublist); -+ } -+ } -+ /* conquer divided */ -+ __nft_chain_list_sort(&sublist, cmp); -+ __nft_chain_list_sort(list, cmp); -+ -+ /* merge divided and pivot again */ -+ list_add_tail(&pivot->head, &sublist); -+ list_splice(&sublist, list); -+} -+ -+static int nft_chain_cmp_byname(struct nft_chain *a, struct nft_chain *b) -+{ -+ const char *aname = nftnl_chain_get_str(a->nftnl, NFTNL_CHAIN_NAME); -+ const char *bname = nftnl_chain_get_str(b->nftnl, NFTNL_CHAIN_NAME); -+ -+ return strcmp(aname, bname); -+} -+ -+int nft_cache_sort_chains(struct nft_handle *h, const char *table) -+{ -+ const struct builtin_table *t = nft_table_builtin_find(h, table); -+ -+ if (!t) -+ return -1; -+ -+ if (h->cache->table[t->type].sorted) -+ return 0; -+ -+ __nft_chain_list_sort(&h->cache->table[t->type].chains->list, -+ nft_chain_cmp_byname); -+ h->cache->table[t->type].sorted = true; -+ return 0; -+} -+ - struct nftnl_chain_list_cb_data { - struct nft_handle *h; - const struct builtin_table *t; -@@ -663,6 +706,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, - - flush_base_chain_cache(c->table[table->type].base_chains); - nft_chain_foreach(h, tablename, __flush_chain_cache, NULL); -+ c->table[table->type].sorted = false; - - if (c->table[table->type].sets) - nftnl_set_list_foreach(c->table[table->type].sets, -@@ -678,6 +722,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, - if (c->table[i].chains) { - nft_chain_list_free(c->table[i].chains); - c->table[i].chains = NULL; -+ c->table[i].sorted = false; - } - - if (c->table[i].sets) { -diff --git a/iptables/nft-cache.h b/iptables/nft-cache.h -index 20d96beede876..58a015265056c 100644 ---- a/iptables/nft-cache.h -+++ b/iptables/nft-cache.h -@@ -16,6 +16,7 @@ int flush_rule_cache(struct nft_handle *h, const char *table, - void nft_cache_build(struct nft_handle *h); - int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, - struct nftnl_chain *c); -+int nft_cache_sort_chains(struct nft_handle *h, const char *table); - - struct nft_chain * - nft_chain_find(struct nft_handle *h, const char *table, const char *chain); -diff --git a/iptables/nft.c b/iptables/nft.c -index bde4ca72d3fcc..8b14daeaed610 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1754,6 +1754,8 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table, - return 1; - } - -+ nft_cache_sort_chains(h, table); -+ - ret = nft_chain_foreach(h, table, nft_rule_flush_cb, &d); - - /* the core expects 1 for success and 0 for error */ -@@ -1900,6 +1902,9 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain, - goto out; - } - -+ if (verbose) -+ nft_cache_sort_chains(h, table); -+ - ret = nft_chain_foreach(h, table, __nft_chain_user_del, &d); - out: - /* the core expects 1 for success and 0 for error */ -@@ -2437,6 +2442,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table, - return 1; - } - -+ nft_cache_sort_chains(h, table); -+ - if (ops->print_table_header) - ops->print_table_header(table); - -@@ -2540,6 +2547,8 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain, - return nft_rule_list_cb(c, &d); - } - -+ nft_cache_sort_chains(h, table); -+ - /* Dump policies and custom chains first */ - nft_chain_foreach(h, table, nft_rule_list_chain_save, &counters); - -@@ -3431,6 +3440,9 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain, - goto err; - } - -+ if (verbose) -+ nft_cache_sort_chains(h, table); -+ - ret = nft_chain_foreach(h, table, __nft_chain_zero_counters, &d); - err: - /* the core expects 1 for success and 0 for error */ -diff --git a/iptables/nft.h b/iptables/nft.h -index 0910f82a2773c..4ac7e0099d567 100644 ---- a/iptables/nft.h -+++ b/iptables/nft.h -@@ -44,6 +44,7 @@ struct nft_cache { - struct nft_chain_list *chains; - struct nftnl_set_list *sets; - bool exists; -+ bool sorted; - } table[NFT_TABLE_MAX]; - }; - -diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c -index d7901c650ea70..cfce0472f3ee8 100644 ---- a/iptables/xtables-save.c -+++ b/iptables/xtables-save.c -@@ -87,6 +87,7 @@ __do_output(struct nft_handle *h, const char *tablename, void *data) - printf("*%s\n", tablename); - /* Dump out chain names first, - * thereby preventing dependency conflicts */ -+ nft_cache_sort_chains(h, tablename); - nft_chain_foreach(h, tablename, nft_chain_save, h); - nft_rule_save(h, tablename, d->format); - if (d->commit) --- -2.31.1 - diff --git a/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch b/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch deleted file mode 100644 index 863206e..0000000 --- a/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 8086d05bb16e75a23b49bf1accef615193e726e6 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 6 Apr 2021 10:51:20 +0200 -Subject: [PATCH] nft: Increase BATCH_PAGE_SIZE to support huge rulesets - -In order to support the same ruleset sizes as legacy iptables, the -kernel's limit of 1024 iovecs has to be overcome. Therefore increase -each iovec's size from 128KB to 2MB. - -While being at it, add a log message for failing sendmsg() call. This is -not supposed to happen, even if the transaction fails. Yet if it does, -users are left with only a "line XXX failed" message (with line number -being the COMMIT line). - -Signed-off-by: Phil Sutter -Signed-off-by: Florian Westphal -(cherry picked from commit a3e81c62e8c5abb4158f1f66df6bbcffd1b33240) ---- - iptables/nft.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8b14daeaed610..f1deb82f87576 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -88,11 +88,11 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh, - - #define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize()) - --/* selected batch page is 256 Kbytes long to load ruleset of -- * half a million rules without hitting -EMSGSIZE due to large -- * iovec. -+/* Selected batch page is 2 Mbytes long to support loading a ruleset of 3.5M -+ * rules matching on source and destination address as well as input and output -+ * interfaces. This is what legacy iptables supports. - */ --#define BATCH_PAGE_SIZE getpagesize() * 32 -+#define BATCH_PAGE_SIZE 2 * 1024 * 1024 - - static struct nftnl_batch *mnl_batch_init(void) - { -@@ -220,8 +220,10 @@ static int mnl_batch_talk(struct nft_handle *h, int numcmds) - int err = 0; - - ret = mnl_nft_socket_sendmsg(h, numcmds); -- if (ret == -1) -+ if (ret == -1) { -+ fprintf(stderr, "sendmsg() failed: %s\n", strerror(errno)); - return -1; -+ } - - FD_ZERO(&readfds); - FD_SET(fd, &readfds); --- -2.31.1 - diff --git a/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch b/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch deleted file mode 100644 index d07e50f..0000000 --- a/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch +++ /dev/null @@ -1,130 +0,0 @@ -From 172a84516d3311733cf2a11acc7a86203ad38156 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 28 Jul 2021 17:53:53 +0200 -Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options - -Drop any reference to them (and the environment variable) but list them -in BUGS section hinting at ebtables-save and -restore tools. - -Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit 765bf04ecc228783cb88c810c85bc0c769579c39) ---- - iptables/ebtables-nft.8 | 64 ++++++----------------------------------- - 1 file changed, 8 insertions(+), 56 deletions(-) - -diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 -index 1fa5ad9388cc0..08e9766f2cc74 100644 ---- a/iptables/ebtables-nft.8 -+++ b/iptables/ebtables-nft.8 -@@ -44,12 +44,6 @@ ebtables \- Ethernet bridge frame table administration (nft-based) - .br - .BR "ebtables " [ -t " table ] " --init-table - .br --.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit --.br --.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init --.br --.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save --.br - - .SH DESCRIPTION - .B ebtables -@@ -149,11 +143,9 @@ a table, the commands apply to the default filter table. - Only one command may be used on the command line at a time, except when - the commands - .BR -L " and " -Z --are combined, the commands -+are combined or the commands - .BR -N " and " -P --are combined, or when --.B --atomic-file --is used. -+are combined. - .TP - .B "-A, --append" - Append a rule to the end of the selected chain. -@@ -313,39 +305,6 @@ of the ebtables kernel table. - .TP - .B "--init-table" - Replace the current table data by the initial table data. --.TP --.B "--atomic-init" --Copy the kernel's initial data of the table to the specified --file. This can be used as the first action, after which rules are added --to the file. The file can be specified using the --.B --atomic-file --command or through the --.IR EBTABLES_ATOMIC_FILE " environment variable." --.TP --.B "--atomic-save" --Copy the kernel's current data of the table to the specified --file. This can be used as the first action, after which rules are added --to the file. The file can be specified using the --.B --atomic-file --command or through the --.IR EBTABLES_ATOMIC_FILE " environment variable." --.TP --.B "--atomic-commit" --Replace the kernel table data with the data contained in the specified --file. This is a useful command that allows you to load all your rules of a --certain table into the kernel at once, saving the kernel a lot of precious --time and allowing atomic updates of the tables. The file which contains --the table data is constructed by using either the --.B "--atomic-init" --or the --.B "--atomic-save" --command to generate a starting file. After that, using the --.B "--atomic-file" --command when constructing rules or setting the --.IR EBTABLES_ATOMIC_FILE " environment variable" --allows you to extend the file and build the complete table before --committing it to the kernel. This command can be very useful in boot scripts --to populate the ebtables tables in a fast way. - .SS MISCELLANOUS COMMANDS - .TP - .B "-V, --version" -@@ -371,16 +330,6 @@ a target extension (see - .BR "TARGET EXTENSIONS" ")" - or a user-defined chain name. - .TP --.B --atomic-file "\fIfile\fP" --Let the command operate on the specified --.IR file . --The data of the table to --operate on will be extracted from the file and the result of the operation --will be saved back into the file. If specified, this option should come --before the command specification. An alternative that should be preferred, --is setting the --.IR EBTABLES_ATOMIC_FILE " environment variable." --.TP - .B -M, --modprobe "\fIprogram\fP" - When talking to the kernel, use this - .I program -@@ -1100,8 +1049,6 @@ arp message and the hardware address length in the arp header is 6 bytes. - .br - .SH FILES - .I /etc/ethertypes --.SH ENVIRONMENT VARIABLES --.I EBTABLES_ATOMIC_FILE - .SH MAILINGLISTS - .BR "" "See " http://netfilter.org/mailinglists.html - .SH BUGS -@@ -1109,7 +1056,12 @@ The version of ebtables this man page ships with does not support the - .B broute - table. Also there is no support for - .B string --match. And finally, this list is probably not complete. -+match. Further, support for atomic-options -+.RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit ) -+has not been implemented, although -+.BR ebtables-save " and " ebtables-restore -+might replace them entirely given the inherent atomicity of nftables. -+Finally, this list is probably not complete. - .SH SEE ALSO - .BR xtables-nft "(8), " iptables "(8), " ip (8) - .PP --- -2.32.0 - diff --git a/0013-nft-Fix-for-non-verbose-check-command.patch b/0013-nft-Fix-for-non-verbose-check-command.patch deleted file mode 100644 index 3d9d27d..0000000 --- a/0013-nft-Fix-for-non-verbose-check-command.patch +++ /dev/null @@ -1,31 +0,0 @@ -From f3d74895be5847db13af403067c28385356376df Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 3 Aug 2021 10:55:20 +0200 -Subject: [PATCH] nft: Fix for non-verbose check command - -Check command was unconditionally verbose since v1.8.5. Make it respect ---verbose option again. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit 57d1422dbbc41c36ed2e9f6c67aa040c65a429a0) ---- - iptables/nft.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index f1deb82f87576..795dff8605404 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3126,7 +3126,7 @@ static int nft_prepare(struct nft_handle *h) - case NFT_COMPAT_RULE_CHECK: - assert_chain_exists(h, cmd->table, cmd->jumpto); - ret = nft_rule_check(h, cmd->chain, cmd->table, -- cmd->obj.rule, cmd->rulenum); -+ cmd->obj.rule, cmd->verbose); - break; - case NFT_COMPAT_RULE_ZERO: - ret = nft_rule_zero_counters(h, cmd->chain, cmd->table, --- -2.32.0 - diff --git a/0014-libxtables-Register-only-the-highest-revision-extens.patch b/0014-libxtables-Register-only-the-highest-revision-extens.patch deleted file mode 100644 index a27d151..0000000 --- a/0014-libxtables-Register-only-the-highest-revision-extens.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 3ffbffeb5193bf7259b04fcd2297a0d3e218b7a2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 11 Feb 2022 17:39:24 +0100 -Subject: [PATCH] libxtables: Register only the highest revision extension - -When fully registering extensions, ignore all consecutive ones with same -name and family value. Since commit b3ac87038f4e4 ("libxtables: Make -sure extensions register in revision order"), one may safely assume the -list of pending extensions has highest revision numbers first. Since -iptables is only interested in the highest revision the kernel supports, -registration and compatibility checks may be skipped once the first -matching extension in pending list has validated. - -Signed-off-by: Phil Sutter -(cherry picked from commit 2dbb49d15fb44ddd521a734eca3be3f940b7c1ba) ---- - libxtables/xtables.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index 6947441fec659..b0c969676bc85 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -668,6 +668,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, - struct xtables_match **dptr; - struct xtables_match *ptr; - const char *icmp6 = "icmp6"; -+ bool found = false; - - if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) - xtables_error(PARAMETER_PROBLEM, -@@ -686,7 +687,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, - if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { - ptr = *dptr; - *dptr = (*dptr)->next; -- if (xtables_fully_register_pending_match(ptr, prev)) { -+ if (!found && -+ xtables_fully_register_pending_match(ptr, prev)) { -+ found = true; - prev = ptr; - continue; - } else if (prev) { -@@ -788,6 +791,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) - struct xtables_target *prev = NULL; - struct xtables_target **dptr; - struct xtables_target *ptr; -+ bool found = false; - - /* Standard target? */ - if (strcmp(name, "") == 0 -@@ -802,7 +806,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) - if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { - ptr = *dptr; - *dptr = (*dptr)->next; -- if (xtables_fully_register_pending_target(ptr, prev)) { -+ if (!found && -+ xtables_fully_register_pending_target(ptr, prev)) { -+ found = true; - prev = ptr; - continue; - } else if (prev) { --- -2.34.1 - diff --git a/0015-xshared-Fix-response-to-unprivileged-users.patch b/0015-xshared-Fix-response-to-unprivileged-users.patch deleted file mode 100644 index fa28fde..0000000 --- a/0015-xshared-Fix-response-to-unprivileged-users.patch +++ /dev/null @@ -1,134 +0,0 @@ -From eec7fd187a9eeda1250c1a35b32c92eff074dff6 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 18 Jan 2022 22:39:08 +0100 -Subject: [PATCH] xshared: Fix response to unprivileged users - -Expected behaviour in both variants is: - -* Print help without error, append extension help if -m and/or -j - options are present -* Indicate lack of permissions in an error message for anything else - -With iptables-nft, this was broken basically from day 1. Shared use of -do_parse() then somewhat broke legacy: it started complaining about -inability to create a lock file. - -Fix this by making iptables-nft assume extension revision 0 is present -if permissions don't allow to verify. This is consistent with legacy. - -Second part is to exit directly after printing help - this avoids having -to make the following code "nop-aware" to prevent privileged actions. - -Signed-off-by: Phil Sutter -Reviewed-by: Florian Westphal -(cherry picked from commit 26ecdf53960658771c0fc582f72a4025e2887f75) - -Conflicts: - iptables/xshared.c --> Apply direct exit from do_parse() to xtables.c, upstream merged - do_parse() functions. ---- - iptables/nft.c | 5 ++ - .../testcases/iptables/0008-unprivileged_0 | 60 +++++++++++++++++++ - iptables/xtables.c | 2 +- - 3 files changed, 66 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 795dff8605404..5aa14aebeb31e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3256,6 +3256,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) - err: - mnl_socket_close(nl); - -+ /* pretend revision 0 is valid if not permitted to check - -+ * this is required for printing extension help texts as user */ -+ if (ret < 0 && errno == EPERM && rev == 0) -+ return 1; -+ - return ret < 0 ? 0 : 1; - } - -diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 -new file mode 100755 -index 0000000000000..43e3bc8721dbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 -@@ -0,0 +1,60 @@ -+#!/bin/bash -+ -+# iptables may print match/target specific help texts -+# help output should work for unprivileged users -+ -+run() { -+ echo "running: $*" >&2 -+ runuser -u nobody -- "$@" -+} -+ -+grep_or_rc() { -+ declare -g rc -+ grep -q "$*" && return 0 -+ echo "missing in output: $*" >&2 -+ return 1 -+} -+ -+out=$(run $XT_MULTI iptables --help) -+let "rc+=$?" -+grep_or_rc "iptables -h (print this help information)" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -m limit --help) -+let "rc+=$?" -+grep_or_rc "limit match options:" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -p tcp --help) -+let "rc+=$?" -+grep_or_rc "tcp match options:" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -j DNAT --help) -+let "rc+=$?" -+grep_or_rc "DNAT target options:" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) -+let "rc+=$?" -+grep_or_rc "tcp match options:" <<< "$out" -+let "rc+=$?" -+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) -+let "rc+=$?" -+grep_or_rc "DNAT target options:" <<< "$out" -+let "rc+=$?" -+ -+ -+run $XT_MULTI iptables -L 2>&1 | \ -+ grep_or_rc "Permission denied" -+let "rc+=$?" -+ -+run $XT_MULTI iptables -A FORWARD -p tcp --dport 123 2>&1 | \ -+ grep_or_rc "Permission denied" -+let "rc+=$?" -+ -+run $XT_MULTI iptables -A FORWARD -j DNAT --to-destination 1.2.3.4 2>&1 | \ -+ grep_or_rc "Permission denied" -+let "rc+=$?" -+ -+exit $rc -diff --git a/iptables/xtables.c b/iptables/xtables.c -index 9779bd83d53b3..a16bba74dc578 100644 ---- a/iptables/xtables.c -+++ b/iptables/xtables.c -@@ -645,7 +645,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], - - printhelp(cs->matches); - p->command = CMD_NONE; -- return; -+ exit(0); - - /* - * Option selection --- -2.34.1 - diff --git a/0016-Improve-error-messages-for-unsupported-extensions.patch b/0016-Improve-error-messages-for-unsupported-extensions.patch deleted file mode 100644 index bd8282c..0000000 --- a/0016-Improve-error-messages-for-unsupported-extensions.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 721af7dfbfd5dc18af86e00d30de108dbf1687fb Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 11 Feb 2022 17:47:22 +0100 -Subject: [PATCH] Improve error messages for unsupported extensions - -If a given extension was not supported by the kernel, iptables would -print a rather confusing error message if extension parameters were -given: - -| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko -| # iptables -A FORWARD -j LOG --log-prefix foo -| iptables v1.8.7 (legacy): unknown option "--log-prefix" - -Avoid this by pretending extension revision 0 is always supported. It is -the same hack as used to successfully print extension help texts as -unprivileged user, extended to all error codes to serve privileged ones -as well. - -In addition, print a warning if kernel rejected revision 0 and it's not -a permissions problem. This helps users find out which extension in a -rule the kernel didn't like. - -Finally, the above commands result in these messages: - -| Warning: Extension LOG revision 0 not supported, missing kernel module? -| iptables: No chain/target/match by that name. - -Or, for iptables-nft: - -| Warning: Extension LOG revision 0 not supported, missing kernel module? -| iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD - -Signed-off-by: Phil Sutter -(cherry picked from commit 17534cb18ed0a5052dc45c117401251359dba6aa) ---- - iptables/nft.c | 12 +++++++++--- - libxtables/xtables.c | 7 ++++++- - 2 files changed, 15 insertions(+), 4 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 5aa14aebeb31e..0b1759c3e35ea 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3256,10 +3256,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) - err: - mnl_socket_close(nl); - -- /* pretend revision 0 is valid if not permitted to check - -- * this is required for printing extension help texts as user */ -- if (ret < 0 && errno == EPERM && rev == 0) -+ /* pretend revision 0 is valid - -+ * this is required for printing extension help texts as user, also -+ * helps error messaging on unavailable kernel extension */ -+ if (ret < 0 && rev == 0) { -+ if (errno != EPERM) -+ fprintf(stderr, -+ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", -+ name); - return 1; -+ } - - return ret < 0 ? 0 : 1; - } -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index b0c969676bc85..10b985b7c3a79 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -929,7 +929,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt) - /* Definitely don't support this? */ - if (errno == ENOENT || errno == EPROTONOSUPPORT) { - close(sockfd); -- return 0; -+ /* Pretend revision 0 support for better error messaging */ -+ if (revision == 0) -+ fprintf(stderr, -+ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", -+ name); -+ return (revision == 0); - } else if (errno == ENOPROTOOPT) { - close(sockfd); - /* Assume only revision 0 support (old kernel) */ --- -2.34.1 - diff --git a/iptables.spec b/iptables.spec index d8c8823..0d443bf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.7 -Release: 16%{?dist} +Version: 1.8.8 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -20,22 +20,7 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch -Patch02: 0002-iptables-nft-fix-Z-option.patch -Patch03: 0003-nft-Fix-bitwise-expression-avoidance-detection.patch -Patch04: 0004-extensions-sctp-Fix-nftables-translation.patch -Patch05: 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch -Patch06: 0006-extensions-libebt_ip6-Drop-unused-variables.patch -Patch07: 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch -Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch -Patch09: 0009-iptables-apply-Drop-unused-variable.patch -Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch -Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch -Patch12: 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch -Patch13: 0013-nft-Fix-for-non-verbose-check-command.patch -Patch14: 0014-libxtables-Register-only-the-highest-revision-extens.patch -Patch15: 0015-xshared-Fix-response-to-unprivileged-users.patch -Patch16: 0016-Improve-error-messages-for-unsupported-extensions.patch +Patch01: 0001-xshared-Fix-build-for-Werror-format-security.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -53,7 +38,7 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.5 +BuildRequires: pkgconfig(libnftnl) >= 1.1.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf @@ -434,6 +419,9 @@ fi %changelog +* Fri May 13 2022 Phil Sutter - 1.8.8-1 +- Update to 1.8.8. Fixes rhbz#2085503 + * Thu Mar 03 2022 Phil Sutter - 1.8.7-16 - Improve error messages for unsupported extensions - xshared: Fix response to unprivileged users diff --git a/sources b/sources index e9a1323..014f6c0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.7.tar.bz2) = c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75 +SHA512 (iptables-1.8.8.tar.bz2) = f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59 From b28381ff810cfbf46a5c89a7d1cec2c9ae2eb588 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 8 Jul 2022 11:48:31 +0100 Subject: [PATCH 053/100] iptables-services requires iptables-apply in utils to apply rules --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 0d443bf..d50d748 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.8 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -125,6 +125,7 @@ stable and may change with every new version. It is therefore unsupported. %package services Summary: iptables and ip6tables services for iptables Requires: %{name} = %{version}-%{release} +Requires: %{name}-utils = %{version}-%{release} %{?systemd_ordering} # obsolete old main package Obsoletes: %{name} < 1.4.16.1 @@ -419,6 +420,9 @@ fi %changelog +* Fri Jul 08 2022 Peter Robinson - 1.8.8-2 +- iptables-services requires iptables-apply in utils to apply rules + * Fri May 13 2022 Phil Sutter - 1.8.8-1 - Update to 1.8.8. Fixes rhbz#2085503 From 565364658d1907f178f2c412e6e7c0d9bcb4dbf9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 14:49:19 +0000 Subject: [PATCH 054/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d50d748..7a51dd4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.8 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -420,6 +420,9 @@ fi %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 1.8.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Fri Jul 08 2022 Peter Robinson - 1.8.8-2 - iptables-services requires iptables-apply in utils to apply rules From 4ee5eabf2a57eeb5750ca7bfc6befcba39aad965 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 12 Jan 2023 14:16:58 +0100 Subject: [PATCH 055/100] New version 1.8.9 - Make iptables-xml a relative symlink - Drop not needed xtables.conf - Ship iptables.xslt with iptables-legacy package - Ship ebtables-translate tool with iptables-nft package Resolves: rhbz#2160427 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 29 +++++++++++++++++++ ...Fix-build-for-Werror-format-security.patch | 29 ------------------- iptables.spec | 26 +++++++++++++---- sources | 2 +- 5 files changed, 52 insertions(+), 35 deletions(-) create mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0001-xshared-Fix-build-for-Werror-format-security.patch diff --git a/.gitignore b/.gitignore index d0729c1..141b2e8 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /iptables-1.8.6.tar.bz2 /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 +/iptables-1.8.9.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch new file mode 100644 index 0000000..ff8adfb --- /dev/null +++ b/0001-extensions-NAT-Fix-for-Werror-format-security.patch @@ -0,0 +1,29 @@ +From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Jan 2023 14:38:44 +0100 +Subject: [iptables PATCH] extensions: NAT: Fix for -Werror=format-security + +Have to pass either a string literal or format string to xt_xlate_add(). + +Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") +Signed-off-by: Phil Sutter +--- + extensions/libxt_NAT.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c +index da9f22012c5d6..2a6343986d54f 100644 +--- a/extensions/libxt_NAT.c ++++ b/extensions/libxt_NAT.c +@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, + if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) + return 0; + +- xt_xlate_add(xl, tgt); ++ xt_xlate_add(xl, "%s", tgt); + if (strlen(range_str)) + xt_xlate_add(xl, " to %s", range_str); + if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { +-- +2.38.0 + diff --git a/0001-xshared-Fix-build-for-Werror-format-security.patch b/0001-xshared-Fix-build-for-Werror-format-security.patch deleted file mode 100644 index ba6d2db..0000000 --- a/0001-xshared-Fix-build-for-Werror-format-security.patch +++ /dev/null @@ -1,29 +0,0 @@ -From fe9bd3b29dd7661e6f74c24db8356014798d1d78 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 May 2022 16:51:58 +0200 -Subject: [PATCH] xshared: Fix build for -Werror=format-security - -Gcc complains about the omitted format string. - -Signed-off-by: Phil Sutter -(cherry picked from commit b72eb12ea5a61df0655ad99d5048994e916be83a) ---- - iptables/xshared.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/xshared.c b/iptables/xshared.c -index fae5ddd5df93e..a8512d3808154 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - return; - - if (args->family != NFPROTO_ARP) -- xtables_error(PARAMETER_PROBLEM, msg); -+ xtables_error(PARAMETER_PROBLEM, "%s", msg); - - fprintf(stderr, "%s", msg); - } --- -2.34.1 - diff --git a/iptables.spec b/iptables.spec index 7a51dd4..40ac8cd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,9 +10,9 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.8 -Release: 3%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.bz2 +Version: 1.8.9 +Release: 1%{?dist} +Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config Source3: iptables.service @@ -20,7 +20,7 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-xshared-Fix-build-for-Werror-format-security.patch +Patch01: 0001-extensions-NAT-Fix-for-Werror-format-security.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -236,6 +236,13 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +# Drop xtables.conf, it's not used +rm -f %{buildroot}%{_sysconfdir}/xtables.conf + +# fix absolute symlink +rm -f %{buildroot}%{_bindir}/iptables-xml +ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml + %ldconfig_scriptlets %post legacy @@ -349,12 +356,12 @@ fi %files compat %files legacy -%doc INCOMPATIBILITIES %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs @@ -405,6 +412,7 @@ fi %{_sbindir}/{eb,arp}tables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor +%{_sbindir}/ebtables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -412,6 +420,7 @@ fi %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* +%{_mandir}/man8/ebtables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -420,6 +429,13 @@ fi %changelog +* Thu Jan 12 2023 Phil Sutter - 1.8.9-1 +- Make iptables-xml a relative symlink +- Drop not needed xtables.conf +- Ship iptables.xslt with iptables-legacy package +- Ship ebtables-translate tool with iptables-nft package +- Update to 1.8.9. + * Thu Jul 21 2022 Fedora Release Engineering - 1.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 014f6c0..fef1030 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.8.tar.bz2) = f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59 +SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 From c7a1e984df7cbbd25916b84a2adbf662377bc689 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:19:17 +0000 Subject: [PATCH 056/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 40ac8cd..5860791 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -429,6 +429,9 @@ fi %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.8.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jan 12 2023 Phil Sutter - 1.8.9-1 - Make iptables-xml a relative symlink - Drop not needed xtables.conf From 7ae7437d5fc5e096749a942c73337d41c7a07d67 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 20 Apr 2023 13:16:15 +0200 Subject: [PATCH 057/100] iptables-1.8.9-3 - Support %%_excludedocs macro in alternatives installation --- iptables.spec | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5860791..1a8054f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -295,7 +295,9 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %?ldconfig %systemd_postun iptables.service ip6tables.service -%post nft +%post -e nft +[[ %%{_excludedocs} == 1 ]] || do_man=true + pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ @@ -320,7 +322,7 @@ fi $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ - --slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz + ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables @@ -340,9 +342,9 @@ fi $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ - --slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \ - --slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \ - --slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \ + ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ + ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ --slave $lepfx-helper arptables-helper $lepfx-nft-helper %postun nft @@ -429,6 +431,9 @@ fi %changelog +* Thu Apr 20 2023 Phil Sutter - 1.8.9-3 +- Support %%_excludedocs macro in alternatives installation + * Thu Jan 19 2023 Fedora Release Engineering - 1.8.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 5463f77d3b7c37f6b637e4ab5c70c0eb2fc1aa30 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 24 May 2023 13:03:08 +0200 Subject: [PATCH 058/100] iptables-1.8.9-4 - Backport fixes from upstream --- ...s-NAT-Fix-for-Werror-format-security.patch | 7 +- 0002-etc-Drop-xtables.conf.patch | 132 ++++++++++ ...x-for-unknown-argument-error-message.patch | 148 +++++++++++ ...es-Refuse-unselected-targets-options.patch | 232 ++++++++++++++++++ ...-Properly-split-input-in-replay-mode.patch | 31 +++ ...bebt_redirect-Fix-target-translation.patch | 48 ++++ ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ++++ ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ++++ ...t_ip-Translation-has-to-match-on-eth.patch | 85 +++++++ ...the-missing-chunk-types-in-sctp_help.patch | 36 +++ ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 ++++++++ ...-for-deletion-of-new-referenced-rule.patch | 67 +++++ ...ables-Fix-checking-existence-of-rule.patch | 33 +++ 0014-nft-shared-Drop-unused-include.patch | 29 +++ ...rsing-of-inverted-arp-operation-matc.patch | 31 +++ ...-t-omit-standard-matches-if-inverted.patch | 42 ++++ ...ing-of-option-arguments-in-same-word.patch | 211 ++++++++++++++++ iptables.spec | 23 +- 18 files changed, 1349 insertions(+), 5 deletions(-) create mode 100644 0002-etc-Drop-xtables.conf.patch create mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch create mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch create mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch create mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch create mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch create mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch create mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch create mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch create mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch create mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch create mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch create mode 100644 0014-nft-shared-Drop-unused-include.patch create mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch create mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch create mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch index ff8adfb..cecd191 100644 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ b/0001-extensions-NAT-Fix-for-Werror-format-security.patch @@ -1,12 +1,13 @@ -From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001 +From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [iptables PATCH] extensions: NAT: Fix for -Werror=format-security +Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security Have to pass either a string literal or format string to xt_xlate_add(). Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") Signed-off-by: Phil Sutter +(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) --- extensions/libxt_NAT.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -25,5 +26,5 @@ index da9f22012c5d6..2a6343986d54f 100644 xt_xlate_add(xl, " to %s", range_str); if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { -- -2.38.0 +2.40.0 diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch new file mode 100644 index 0000000..e676561 --- /dev/null +++ b/0002-etc-Drop-xtables.conf.patch @@ -0,0 +1,132 @@ +From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Jan 2023 16:38:43 +0100 +Subject: [PATCH] etc: Drop xtables.conf + +The file is not used since the commit this one fixes. Also it wasn't +installed until recently, when commit 3822a992bc277 ("Makefile: Fix for +'make distcheck'") added it in the wrong spot in an attempt to reduce +differences between tarballs generated by 'make tarball' and 'make +dist'. + +While being at it, drop stale xtables_config_main() prototype from +xtables-multi.h. + +Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") +Signed-off-by: Phil Sutter +(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) +--- + Makefile.am | 2 +- + etc/xtables.conf | 74 ---------------------------------------- + iptables/xtables-multi.h | 1 - + 3 files changed, 1 insertion(+), 76 deletions(-) + delete mode 100644 etc/xtables.conf + +diff --git a/Makefile.am b/Makefile.am +index 451c3cb2d5887..299ab46d7b8e2 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py + + if ENABLE_NFTABLES + confdir = $(sysconfdir) +-dist_conf_DATA = etc/ethertypes etc/xtables.conf ++dist_conf_DATA = etc/ethertypes + endif + + .PHONY: tarball +diff --git a/etc/xtables.conf b/etc/xtables.conf +deleted file mode 100644 +index 3c54ced043d82..0000000000000 +--- a/etc/xtables.conf ++++ /dev/null +@@ -1,74 +0,0 @@ +-family ipv4 { +- table raw { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 +- } +- +- table mangle { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 +- chain INPUT hook NF_INET_LOCAL_IN prio -150 +- chain FORWARD hook NF_INET_FORWARD prio -150 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 +- } +- +- table filter { +- chain INPUT hook NF_INET_LOCAL_IN prio 0 +- chain FORWARD hook NF_INET_FORWARD prio 0 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 +- } +- +- table nat { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 +- chain INPUT hook NF_INET_LOCAL_IN prio 100 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 +- } +- +- table security { +- chain INPUT hook NF_INET_LOCAL_IN prio 50 +- chain FORWARD hook NF_INET_FORWARD prio 50 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 +- } +-} +- +-family ipv6 { +- table raw { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 +- } +- +- table mangle { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 +- chain INPUT hook NF_INET_LOCAL_IN prio -150 +- chain FORWARD hook NF_INET_FORWARD prio -150 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 +- } +- +- table filter { +- chain INPUT hook NF_INET_LOCAL_IN prio 0 +- chain FORWARD hook NF_INET_FORWARD prio 0 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 +- } +- +- table nat { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 +- chain INPUT hook NF_INET_LOCAL_IN prio 100 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 +- } +- +- table security { +- chain INPUT hook NF_INET_LOCAL_IN prio 50 +- chain FORWARD hook NF_INET_FORWARD prio 50 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 +- } +-} +- +-family arp { +- table filter { +- chain INPUT hook NF_ARP_IN prio 0 +- chain OUTPUT hook NF_ARP_OUT prio 0 +- } +-} +diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h +index 94c24d5a22c7e..833c11a2ac914 100644 +--- a/iptables/xtables-multi.h ++++ b/iptables/xtables-multi.h +@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); + extern int xtables_eb_main(int, char **); + extern int xtables_eb_restore_main(int, char **); + extern int xtables_eb_save_main(int, char **); +-extern int xtables_config_main(int, char **); + extern int xtables_monitor_main(int, char **); + + extern struct xtables_globals arptables_globals; +-- +2.40.0 + diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch new file mode 100644 index 0000000..d807c54 --- /dev/null +++ b/0003-Proper-fix-for-unknown-argument-error-message.patch @@ -0,0 +1,148 @@ +From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 25 Jan 2023 01:51:43 +0100 +Subject: [PATCH] Proper fix for "unknown argument" error message + +While commit 1b8210f848631 kind of fixed the corner-case of invalid +short-options packed with others, it broke error reporting for +long-options. Revert it and deploy a proper solution: + +When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long +sets the variable 'optopt' to the invalid character's value. Use it for +reporting instead of optind if set. + +To distinguish between invalid options and missing option arguments, +ebtables-translate optstring needs adjustment. + +Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") +Signed-off-by: Phil Sutter +(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) +--- + .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ + iptables/xshared.c | 9 ++++-- + iptables/xtables-eb-translate.c | 8 ++--- + iptables/xtables-eb.c | 17 ++++++---- + 4 files changed, 50 insertions(+), 15 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 +new file mode 100755 +index 0000000000000..ac6e743966196 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 +@@ -0,0 +1,31 @@ ++#!/bin/bash ++ ++rc=0 ++ ++check() { ++ local cmd="$1" ++ local msg="$2" ++ ++ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { ++ echo "cmd: $XT_MULTI $1" ++ echo "exp: $msg" ++ echo "res: $($XT_MULTI $cmd 2>&1)" ++ rc=1 ++ } ++} ++ ++cmds="iptables ip6tables" ++[[ $XT_MULTI == *xtables-nft-multi ]] && { ++ cmds+=" ebtables" ++ cmds+=" iptables-translate" ++ cmds+=" ip6tables-translate" ++ cmds+=" ebtables-translate" ++} ++ ++for cmd in $cmds; do ++ check "${cmd} --foo" 'unknown option "--foo"' ++ check "${cmd} -A" 'option "-A" requires an argument' ++ check "${cmd} -aL" 'unknown option "-a"' ++done ++ ++exit $rc +diff --git a/iptables/xshared.c b/iptables/xshared.c +index f93529b11a319..ac51fac5ce9ed 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, + if (cs->c == ':') + xtables_error(PARAMETER_PROBLEM, "option \"%s\" " + "requires an argument", cs->argv[optind-1]); +- if (cs->c == '?') +- xtables_error(PARAMETER_PROBLEM, "unknown option " +- "\"%s\"", cs->argv[optind-1]); ++ if (cs->c == '?') { ++ char optoptstr[3] = {'-', optopt, '\0'}; ++ ++ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", ++ optopt ? optoptstr : cs->argv[optind - 1]); ++ } + xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); + } + +diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c +index 13b6b864a5f24..0c35272051752 100644 +--- a/iptables/xtables-eb-translate.c ++++ b/iptables/xtables-eb-translate.c +@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char + printf("nft "); + /* Getopt saves the day */ + while ((c = getopt_long(argc, argv, +- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { ++ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { + cs.c = c; + switch (c) { + case 'A': /* Add a rule */ +@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char + continue; + default: + ebt_check_inverse2(optarg, argc, argv); +- +- if (ebt_command_default(&cs)) +- xtables_error(PARAMETER_PROBLEM, +- "Unknown argument: '%s'", +- argv[optind - 1]); ++ ebt_command_default(&cs); + + if (command != 'A' && command != 'I' && + command != 'D') +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 7214a767ffe96..412b5cccdc46a 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) + return 0; + } + } +- return 1; ++ if (cs->c == ':') ++ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " ++ "requires an argument", cs->argv[optind - 1]); ++ if (cs->c == '?') { ++ char optoptstr[3] = {'-', optopt, '\0'}; ++ ++ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", ++ optopt ? optoptstr : cs->argv[optind - 1]); ++ } ++ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); + } + + int nft_init_eb(struct nft_handle *h, const char *pname) +@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + continue; + default: + ebt_check_inverse2(optarg, argc, argv); +- +- if (ebt_command_default(&cs)) +- xtables_error(PARAMETER_PROBLEM, +- "Unknown argument: '%s'", +- argv[optind]); ++ ebt_command_default(&cs); + + if (command != 'A' && command != 'I' && + command != 'D' && command != 'C' && command != 14) +-- +2.40.0 + diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch new file mode 100644 index 0000000..c41ba45 --- /dev/null +++ b/0004-ebtables-Refuse-unselected-targets-options.patch @@ -0,0 +1,232 @@ +From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 25 Jan 2023 02:01:56 +0100 +Subject: [PATCH] ebtables: Refuse unselected targets' options + +Unlike legacy, ebtables-nft would allow e.g.: + +| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be + +While the result is correct, it may mislead users into believing +multiple targets are possible per rule. Better follow legacy's behaviour +and reject target options unless they have been "enabled" by a previous +'-j' option. + +To achieve this, one needs to distinguish targets from watchers also +attached to 'xtables_targets' and otherwise behaving like regular +matches. Introduce XTABLES_EXT_WATCHER to mark the two. + +The above works already, but error messages are misleading when using +the now unsupported syntax since target options have been merged +already. Solve this by not pre-loading the targets at all, code will +just fall back to loading ad '-j' parsing time as iptables does. + +Note how this also fixes for 'counter' statement being in wrong position +of ebtables-translate output. + +Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") +Signed-off-by: Phil Sutter +(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) +--- + extensions/libebt_dnat.txlate | 12 ++++---- + extensions/libebt_log.c | 1 + + extensions/libebt_mark.txlate | 16 +++++----- + extensions/libebt_nflog.c | 1 + + extensions/libebt_snat.txlate | 8 ++--- + include/xtables.h | 1 + + .../ebtables/0002-ebtables-save-restore_0 | 4 +-- + iptables/xtables-eb.c | 29 +++++++------------ + 8 files changed, 33 insertions(+), 39 deletions(-) + +diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate +index 9f305c76c954f..531a22aa3e14f 100644 +--- a/extensions/libebt_dnat.txlate ++++ b/extensions/libebt_dnat.txlate +@@ -1,8 +1,8 @@ +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' +diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c +index 045062196d20d..9f8d158956802 100644 +--- a/extensions/libebt_log.c ++++ b/extensions/libebt_log.c +@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, + static struct xtables_target brlog_target = { + .name = "log", + .revision = 0, ++ .ext_flags = XTABLES_EXT_WATCHER, + .version = XTABLES_VERSION, + .family = NFPROTO_BRIDGE, + .size = XT_ALIGN(sizeof(struct ebt_log_info)), +diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate +index d006e8ac94008..4ace1a1f5cfde 100644 +--- a/extensions/libebt_mark.txlate ++++ b/extensions/libebt_mark.txlate +@@ -1,11 +1,11 @@ +-ebtables-translate -A INPUT --mark-set 42 +-nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' ++ebtables-translate -A INPUT -j mark --mark-set 42 ++nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' + +-ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN +-nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' ++ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN ++nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' + +-ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT +-nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' ++ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT ++nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' + +-ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP +-nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' ++ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP ++nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' +diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c +index 115e15da45845..762d6d5d8bbe2 100644 +--- a/extensions/libebt_nflog.c ++++ b/extensions/libebt_nflog.c +@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, + static struct xtables_target brnflog_watcher = { + .name = "nflog", + .revision = 0, ++ .ext_flags = XTABLES_EXT_WATCHER, + .version = XTABLES_VERSION, + .family = NFPROTO_BRIDGE, + .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), +diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate +index 857a6052aed1a..37343d3a14754 100644 +--- a/extensions/libebt_snat.txlate ++++ b/extensions/libebt_snat.txlate +@@ -1,5 +1,5 @@ +-ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff +-nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff ++nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE +-nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' ++ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE ++nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' +diff --git a/include/xtables.h b/include/xtables.h +index 4ffc8ec5a17e9..087a1d600f9ae 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -203,6 +203,7 @@ struct xtables_lmap { + + enum xtables_ext_flags { + XTABLES_EXT_ALIAS = 1 << 0, ++ XTABLES_EXT_WATCHER = 1 << 1, + }; + + struct xt_xlate; +diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +index 1091a4e80bebe..b4f9728bb9b6f 100755 +--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 ++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT + + $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT + $XT_MULTI ebtables -A foo --log +-$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT ++$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT + $XT_MULTI ebtables -A foo --nflog + $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT + $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT +@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo + $XT_MULTI ebtables -N bar + $XT_MULTI ebtables -P bar RETURN + +-$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT ++$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT + #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 + + $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 412b5cccdc46a..3a73e79725489 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) + xtables_error(OTHER_PROBLEM, "Can't alloc memory"); + } + +-static void __ebt_load_watcher(const char *name, const char *typename) ++static void ebt_load_watcher(const char *name) + { + struct xtables_target *watcher; + size_t size; + + watcher = xtables_find_target(name, XTF_TRY_LOAD); + if (!watcher) { +- fprintf(stderr, "Unable to load %s %s\n", name, typename); ++ fprintf(stderr, "Unable to load %s watcher\n", name); + return; + } + +@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) + xtables_error(OTHER_PROBLEM, "Can't alloc memory"); + } + +-static void ebt_load_watcher(const char *name) +-{ +- return __ebt_load_watcher(name, "watcher"); +-} +- +-static void ebt_load_target(const char *name) +-{ +- return __ebt_load_watcher(name, "target"); +-} +- + void ebt_load_match_extensions(void) + { + opts = ebt_original_options; +@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) + + ebt_load_watcher("log"); + ebt_load_watcher("nflog"); +- +- ebt_load_target("mark"); +- ebt_load_target("dnat"); +- ebt_load_target("snat"); +- ebt_load_target("arpreply"); +- ebt_load_target("redirect"); +- ebt_load_target("standard"); + } + + void ebt_add_match(struct xtables_match *m, +@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) + + /* Is it a watcher option? */ + for (t = xtables_targets; t; t = t->next) { ++ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) ++ continue; ++ + if (t->parse && + t->parse(cs->c - t->option_offset, cs->argv, + ebt_invert, &t->tflags, NULL, &t->t)) { +@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + optind = 0; + opterr = false; + ++ for (t = xtables_targets; t; t = t->next) { ++ t->tflags = 0; ++ t->used = 0; ++ } ++ + /* Getopt saves the day */ + while ((c = getopt_long(argc, argv, EBT_OPTSTRING, + opts, NULL)) != -1) { +-- +2.40.0 + diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch new file mode 100644 index 0000000..dd58948 --- /dev/null +++ b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch @@ -0,0 +1,31 @@ +From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 18:48:33 +0100 +Subject: [PATCH] tests: xlate: Properly split input in replay mode + +Source command may contain quotes, using shlex.split() does the right +thing there. + +Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") +Signed-off-by: Phil Sutter +(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) +--- + xlate-test.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/xlate-test.py b/xlate-test.py +index 4cb1401b71677..217d2f0062682 100755 +--- a/xlate-test.py ++++ b/xlate-test.py +@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' + if sourceline.find(';') >= 0: + sourceline, searchline = sourceline.split(';') + +- srcwords = sourceline.split() ++ srcwords = shlex.split(sourceline) + + srccmd = srcwords[0] + ipt = srccmd.split('-')[0] +-- +2.40.0 + diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch new file mode 100644 index 0000000..b2f5481 --- /dev/null +++ b/0006-extensions-libebt_redirect-Fix-target-translation.patch @@ -0,0 +1,48 @@ +From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 31 Jan 2023 22:28:24 +0100 +Subject: [PATCH] extensions: libebt_redirect: Fix target translation + +While EBT_ACCEPT is the default verdict for ebtables targets, omitting +it from translation implicitly converts it into 'continue'. Omit the +non-default EBT_CONTINUE instead. + +Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) +--- + extensions/libebt_redirect.c | 2 +- + extensions/libebt_redirect.txlate | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + create mode 100644 extensions/libebt_redirect.txlate + +diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c +index 4d4c7a02cea89..389f3ccb53f60 100644 +--- a/extensions/libebt_redirect.c ++++ b/extensions/libebt_redirect.c +@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, + const struct ebt_redirect_info *red = (const void*)params->target->data; + + xt_xlate_add(xl, "meta set pkttype host"); +- if (red->target != EBT_ACCEPT) ++ if (red->target != EBT_CONTINUE) + xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); + return 1; + } +diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate +new file mode 100644 +index 0000000000000..f0dd5deaf6406 +--- /dev/null ++++ b/extensions/libebt_redirect.txlate +@@ -0,0 +1,8 @@ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' ++ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' ++ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' +-- +2.40.0 + diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch new file mode 100644 index 0000000..8f8dcf6 --- /dev/null +++ b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch @@ -0,0 +1,48 @@ +From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 31 Jan 2023 23:32:50 +0100 +Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in + translation + +Meta key comes before 'set' in meta statement. + +Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) +--- + extensions/libebt_redirect.c | 2 +- + extensions/libebt_redirect.txlate | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c +index 389f3ccb53f60..7821935e137aa 100644 +--- a/extensions/libebt_redirect.c ++++ b/extensions/libebt_redirect.c +@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, + { + const struct ebt_redirect_info *red = (const void*)params->target->data; + +- xt_xlate_add(xl, "meta set pkttype host"); ++ xt_xlate_add(xl, "meta pkttype set host"); + if (red->target != EBT_CONTINUE) + xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); + return 1; +diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate +index f0dd5deaf6406..d073ec774c4fa 100644 +--- a/extensions/libebt_redirect.txlate ++++ b/extensions/libebt_redirect.txlate +@@ -1,8 +1,8 @@ + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' + + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' + + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' +-- +2.40.0 + diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch new file mode 100644 index 0000000..ad5a3ee --- /dev/null +++ b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch @@ -0,0 +1,50 @@ +From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 18:58:36 +0100 +Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation + +Converting from TOS field match to DSCP one is irreversible, so replay +testing is not possible. Use a raw payload expression to produce +something that translates 1:1 back into an 'ip' match. + +Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") +Signed-off-by: Phil Sutter +(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) +--- + extensions/libebt_ip.c | 4 ++-- + extensions/libebt_ip.txlate | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c +index fd87dae7e2c62..8b381aa10b5b7 100644 +--- a/extensions/libebt_ip.c ++++ b/extensions/libebt_ip.c +@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, + brip_xlate_nh(xl, info, EBT_IP_DEST); + + if (info->bitmask & EBT_IP_TOS) { +- xt_xlate_add(xl, "ip dscp "); ++ xt_xlate_add(xl, "@nh,8,8 "); + if (info->invflags & EBT_IP_TOS) + xt_xlate_add(xl, "!= "); +- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ ++ xt_xlate_add(xl, "0x%02x ", info->tos); + } + if (info->bitmask & EBT_IP_PROTO) { + struct protoent *pe; +diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate +index 75c1db246fb81..562e3157d7b92 100644 +--- a/extensions/libebt_ip.txlate ++++ b/extensions/libebt_ip.txlate +@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 + nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' + + ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff +-nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' ++nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' + + ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 + nft 'add rule bridge filter FORWARD tcp dport 22 counter' +-- +2.40.0 + diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch new file mode 100644 index 0000000..96cb5ad --- /dev/null +++ b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch @@ -0,0 +1,85 @@ +From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 17:37:40 +0100 +Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type + +On one hand, nft refuses th expression in bridge family if layer3 +protocol has not been assured by a previous match. On the other, ebt_ip +kernel module will only match on IPv4 packets, so there might be a +functional change in the translation versus the original. + +Instead of just always emitting an 'ether type' match, decide whether +it's actually needed - explicit "ip " payload matches (or +icmp ones) cause implicit creation of a match on IPv4 by nft. + +Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") +Signed-off-by: Phil Sutter +(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) +--- + extensions/libebt_ip.c | 21 +++++++++++++++++++++ + extensions/libebt_ip.txlate | 6 +++--- + 2 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c +index 8b381aa10b5b7..68f34bff97deb 100644 +--- a/extensions/libebt_ip.c ++++ b/extensions/libebt_ip.c +@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, + xtables_ipmask_to_numeric(maskp)); + } + ++static bool may_skip_ether_type_dep(uint8_t flags) ++{ ++ /* these convert to "ip (s|d)addr" matches */ ++ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) ++ return true; ++ ++ /* icmp match triggers implicit ether type dependency in nft */ ++ if (flags & EBT_IP_ICMP) ++ return true; ++ ++ /* allow if "ip protocol" match is created by brip_xlate() */ ++ if (flags & EBT_IP_PROTO && ++ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) ++ return true; ++ ++ return false; ++} ++ + static int brip_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { +@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, + brip_xlate_nh(xl, info, EBT_IP_SOURCE); + brip_xlate_nh(xl, info, EBT_IP_DEST); + ++ if (!may_skip_ether_type_dep(info->bitmask)) ++ xt_xlate_add(xl, "ether type ip "); ++ + if (info->bitmask & EBT_IP_TOS) { + xt_xlate_add(xl, "@nh,8,8 "); + if (info->invflags & EBT_IP_TOS) +diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate +index 562e3157d7b92..28996832225cb 100644 +--- a/extensions/libebt_ip.txlate ++++ b/extensions/libebt_ip.txlate +@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 + nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' + + ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff +-nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' ++nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' + + ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 +-nft 'add rule bridge filter FORWARD tcp dport 22 counter' ++nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' + + ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 +-nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' ++nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' + + ebtables-translate -A FORWARD -p ip --ip-proto 253 + nft 'add rule bridge filter FORWARD ip protocol 253 counter' +-- +2.40.0 + diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch new file mode 100644 index 0000000..410a831 --- /dev/null +++ b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch @@ -0,0 +1,36 @@ +From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Tue, 21 Feb 2023 12:19:42 -0500 +Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help + +Add the missing chunk types in sctp_help(), so that the help cmd can +display these chunk types as below: + + # iptables -p sctp --help + + chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE + +Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") +Signed-off-by: Xin Long +Signed-off-by: Phil Sutter +(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) +--- + extensions/libxt_sctp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c +index fe5f5621a033d..6e2b2745dcbd5 100644 +--- a/extensions/libxt_sctp.c ++++ b/extensions/libxt_sctp.c +@@ -50,7 +50,7 @@ static void sctp_help(void) + " --dport ...\n" + "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" + " chunktypes are present\n" +-"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); ++"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); + } + + static const struct option sctp_opts[] = { +-- +2.40.0 + diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch new file mode 100644 index 0000000..e0915f5 --- /dev/null +++ b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch @@ -0,0 +1,101 @@ +From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 22 Feb 2023 16:36:16 +0100 +Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h + +When merging IP-version-specific LOG extensions, a dependency to that +header was introduced without caching it. Fix this and drop the now +unused ip{,6}t_LOG.h files. + +Reported-by: Thomas Devoogdt +Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") +Signed-off-by: Phil Sutter +(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) +--- + include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ + include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- + include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- + 3 files changed, 20 insertions(+), 38 deletions(-) + create mode 100644 include/linux/netfilter/xt_LOG.h + delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h + delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h + +diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h +new file mode 100644 +index 0000000000000..167d4ddd2476b +--- /dev/null ++++ b/include/linux/netfilter/xt_LOG.h +@@ -0,0 +1,20 @@ ++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ ++#ifndef _XT_LOG_H ++#define _XT_LOG_H ++ ++/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ ++#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ ++#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ ++#define XT_LOG_IPOPT 0x04 /* Log IP options */ ++#define XT_LOG_UID 0x08 /* Log UID owning local socket */ ++#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ ++#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ ++#define XT_LOG_MASK 0x2f ++ ++struct xt_log_info { ++ unsigned char level; ++ unsigned char logflags; ++ char prefix[30]; ++}; ++ ++#endif /* _XT_LOG_H */ +diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h +deleted file mode 100644 +index dcdbadf9fd4a9..0000000000000 +--- a/include/linux/netfilter_ipv4/ipt_LOG.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-#ifndef _IPT_LOG_H +-#define _IPT_LOG_H +- +-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ +-#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ +-#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ +-#define IPT_LOG_IPOPT 0x04 /* Log IP options */ +-#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ +-#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ +-#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ +-#define IPT_LOG_MASK 0x2f +- +-struct ipt_log_info { +- unsigned char level; +- unsigned char logflags; +- char prefix[30]; +-}; +- +-#endif /*_IPT_LOG_H*/ +diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h +deleted file mode 100644 +index 9dd5579e02ec7..0000000000000 +--- a/include/linux/netfilter_ipv6/ip6t_LOG.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-#ifndef _IP6T_LOG_H +-#define _IP6T_LOG_H +- +-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ +-#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ +-#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ +-#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ +-#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ +-#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ +-#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ +-#define IP6T_LOG_MASK 0x2f +- +-struct ip6t_log_info { +- unsigned char level; +- unsigned char logflags; +- char prefix[30]; +-}; +- +-#endif /*_IPT_LOG_H*/ +-- +2.40.0 + diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch new file mode 100644 index 0000000..8b20709 --- /dev/null +++ b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch @@ -0,0 +1,67 @@ +From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Feb 2023 18:09:25 +0100 +Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule + +Combining multiple corner-cases here: + +* Insert a rule before another new one which is not the first. Triggers + NFTNL_RULE_ID assignment of the latter. + +* Delete the referenced new rule in the same batch again. Causes + overwriting of the previously assigned RULE_ID. + +Consequently, iptables-nft-restore fails during *insert*, because the +reference is dangling. + +Reported-by: Eric Garver +Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") +Signed-off-by: Phil Sutter +Tested-by: Eric Garver +(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) +--- + iptables/nft.c | 3 ++- + .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ + 2 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 63468cf3b1344..5896fd410ca78 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) + + nftnl_rule_list_del(r); + +- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) ++ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && ++ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) + nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); + + obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); +diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +index 3f1d229e915ff..5482b7ea17298 100755 +--- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 ++++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT + -A FORWARD -m comment --comment "rule 3" -j ACCEPT' + + diff -u -Z <(echo -e "$EXPECT") <(ipt_show) ++ ++# test adding, referencing and deleting the same rule in a batch ++ ++$XT_MULTI iptables-restore < +Date: Mon, 3 Apr 2023 23:13:47 +0200 +Subject: [PATCH] ip6tables: Fix checking existence of rule + +Pass the proper entry size when creating a match mask for checking the +existence of a rule. Failing to do so causes wrong results. + +Reported-by: Jonathan Caicedo +Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") +Signed-off-by: Markus Boehme +Signed-off-by: Phil Sutter +(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) +--- + iptables/ip6tables.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c +index 345af4519bfe7..9afc32c1a21ed 100644 +--- a/iptables/ip6tables.c ++++ b/iptables/ip6tables.c +@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, + int ret = 1; + unsigned char *mask; + +- mask = make_delete_mask(matches, target, sizeof(fw)); ++ mask = make_delete_mask(matches, target, sizeof(*fw)); + for (i = 0; i < nsaddrs; i++) { + fw->ipv6.src = saddrs[i]; + fw->ipv6.smsk = smasks[i]; +-- +2.40.0 + diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch new file mode 100644 index 0000000..c4274ca --- /dev/null +++ b/0014-nft-shared-Drop-unused-include.patch @@ -0,0 +1,29 @@ +From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Mar 2023 16:22:16 +0200 +Subject: [PATCH] nft-shared: Drop unused include + +Code does not refer to struct xt_comment_info anymore. + +Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") +Signed-off-by: Phil Sutter +(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) +--- + iptables/nft-shared.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 4a7b5406892c4..4ba44a4aa4d17 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -22,7 +22,6 @@ + #include + + #include +-#include + #include + #include + #include +-- +2.40.0 + diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch new file mode 100644 index 0000000..5474f8a --- /dev/null +++ b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch @@ -0,0 +1,31 @@ +From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:33:43 +0200 +Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match + +The wrong bit was set in 'invflags', probably due to copy'n'paste from +the previous case. + +Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") +Signed-off-by: Phil Sutter +(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) +--- + iptables/nft-arp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 210f43d2cefbe..8fae5adc50216 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, + fw->arp.arhln = ar_hln; + fw->arp.arhln_mask = 0xff; + if (inv) +- fw->arp.invflags |= IPT_INV_ARPOP; ++ fw->arp.invflags |= IPT_INV_ARPHLN; + break; + case offsetof(struct arphdr, ar_pln): + get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); +-- +2.40.0 + diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch new file mode 100644 index 0000000..1efb846 --- /dev/null +++ b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch @@ -0,0 +1,42 @@ +From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:37:47 +0200 +Subject: [PATCH] arptables: Don't omit standard matches if inverted + +Inverted --h-len and --h-type matches were omitted from output by +accident if they matched on their standard value. + +Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") +Signed-off-by: Phil Sutter +(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) +--- + iptables/nft-arp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 8fae5adc50216..df3ad430cf701 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, + + after_devdst: + +- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { ++ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || ++ fw->arp.invflags & IPT_INV_ARPHLN) { + printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN + ? "! " : ""); + printf("--h-length %d", fw->arp.arhln); +@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, + sep = " "; + } + +- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { ++ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || ++ fw->arp.invflags & IPT_INV_ARPHRD) { + uint16_t tmp = ntohs(fw->arp.arhrd); + + printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD +-- +2.40.0 + diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch new file mode 100644 index 0000000..9c5cbd2 --- /dev/null +++ b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch @@ -0,0 +1,211 @@ +From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:41:08 +0200 +Subject: [PATCH] xshared: Fix parsing of option arguments in same word + +When merging commandline parsers, a decision between 'argv[optind - 1]' +and 'optarg' had to be made in some spots. While the implementation of +check_inverse() required the former, use of the latter allows for the +common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at +the suffix while 'argv[optind - 1]' will just point at the following +option. + +Fix the mess by making check_inverse() update optarg pointer if needed +so calling code may refer to and always correct 'optarg'. + +Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 +Signed-off-by: Phil Sutter +(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) +--- + extensions/libarpt_standard.t | 2 ++ + extensions/libxt_standard.t | 3 ++ + iptables/xshared.c | 61 +++++++++++++++++------------------ + 3 files changed, 35 insertions(+), 31 deletions(-) + +diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t +index e84a00b780488..007fa2b8335e8 100644 +--- a/extensions/libarpt_standard.t ++++ b/extensions/libarpt_standard.t +@@ -12,3 +12,5 @@ + -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK + --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK + ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK ++--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK ++--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK +diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t +index 56d6da2e5884e..6ed978e442b80 100644 +--- a/extensions/libxt_standard.t ++++ b/extensions/libxt_standard.t +@@ -21,3 +21,6 @@ + -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK + -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK + -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK ++:FORWARD ++--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK ++-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index ac51fac5ce9ed..17aed04e02b09 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) + } + + static void check_inverse(struct xtables_args *args, const char option[], +- bool *invert, int *optidx, int argc) ++ bool *invert, int argc, char **argv) + { + switch (args->family) { + case NFPROTO_ARP: +@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], + xtables_error(PARAMETER_PROBLEM, + "Multiple `!' flags not allowed"); + *invert = true; +- if (optidx) { +- *optidx = *optidx + 1; +- if (argc && *optidx > argc) +- xtables_error(PARAMETER_PROBLEM, +- "no argument following `!'"); +- } ++ optind++; ++ if (optind > argc) ++ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); ++ ++ optarg = argv[optind - 1]; + } + + static const char *optstring_lookup(int family) +@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], + * Option selection + */ + case 'p': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_PROTOCOL, + &args->invflags, invert); + + /* Canonicalize into lower case */ +- for (cs->protocol = argv[optind - 1]; ++ for (cs->protocol = optarg; + *cs->protocol; cs->protocol++) + *cs->protocol = tolower(*cs->protocol); + +- cs->protocol = argv[optind - 1]; ++ cs->protocol = optarg; + args->proto = xtables_parse_protocol(cs->protocol); + + if (args->proto == 0 && +@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], + break; + + case 's': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_SOURCE, + &args->invflags, invert); +- args->shostnetworkmask = argv[optind - 1]; ++ args->shostnetworkmask = optarg; + break; + + case 'd': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_DESTINATION, + &args->invflags, invert); +- args->dhostnetworkmask = argv[optind - 1]; ++ args->dhostnetworkmask = optarg; + break; + + #ifdef IPT_F_GOTO +@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], + #endif + + case 2:/* src-mac */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_S_MAC, &args->invflags, + invert); +- args->src_mac = argv[optind - 1]; ++ args->src_mac = optarg; + break; + + case 3:/* dst-mac */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_D_MAC, &args->invflags, + invert); +- args->dst_mac = argv[optind - 1]; ++ args->dst_mac = optarg; + break; + + case 'l':/* hardware length */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_H_LENGTH, &args->invflags, + invert); +- args->arp_hlen = argv[optind - 1]; ++ args->arp_hlen = optarg; + break; + + case 8: /* was never supported, not even in arptables-legacy */ + xtables_error(PARAMETER_PROBLEM, "not supported"); + case 4:/* opcode */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_OPCODE, &args->invflags, + invert); +- args->arp_opcode = argv[optind - 1]; ++ args->arp_opcode = optarg; + break; + + case 5:/* h-type */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_H_TYPE, &args->invflags, + invert); +- args->arp_htype = argv[optind - 1]; ++ args->arp_htype = optarg; + break; + + case 6:/* proto-type */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_P_TYPE, &args->invflags, + invert); +- args->arp_ptype = argv[optind - 1]; ++ args->arp_ptype = optarg; + break; + + case 'j': + set_option(&cs->options, OPT_JUMP, &args->invflags, + invert); +- command_jump(cs, argv[optind - 1]); ++ command_jump(cs, optarg); + break; + + case 'i': + check_empty_interface(args, optarg); +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_VIANAMEIN, + &args->invflags, invert); +- xtables_parse_interface(argv[optind - 1], ++ xtables_parse_interface(optarg, + args->iniface, + args->iniface_mask); + break; + + case 'o': + check_empty_interface(args, optarg); +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_VIANAMEOUT, + &args->invflags, invert); +- xtables_parse_interface(argv[optind - 1], ++ xtables_parse_interface(optarg, + args->outiface, + args->outiface_mask); + break; +-- +2.40.0 + diff --git a/iptables.spec b/iptables.spec index 1a8054f..d779895 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,7 +20,23 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-extensions-NAT-Fix-for-Werror-format-security.patch +Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch +Patch002: 0002-etc-Drop-xtables.conf.patch +Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch +Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch +Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch +Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch +Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch +Patch014: 0014-nft-shared-Drop-unused-include.patch +Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -431,6 +447,9 @@ fi %changelog +* Wed May 24 2023 Phil Sutter - 1.8.9-4 +- Backport fixes from upstream + * Thu Apr 20 2023 Phil Sutter - 1.8.9-3 - Support %%_excludedocs macro in alternatives installation From 21624d30276597c18535a0ea0fb582d95dbbf062 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 07:35:31 +0000 Subject: [PATCH 059/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d779895..34455fc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -447,6 +447,9 @@ fi %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream From dc297257aab2e1372cf34d97a1ffdd5e5241733b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 15 Aug 2023 11:39:21 +0200 Subject: [PATCH 060/100] Convert license to SPDX format Signed-off-by: Phil Sutter --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 34455fc..57a50f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -40,7 +40,7 @@ Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 -License: GPLv2 and Artistic Licence 2.0 and ISC +License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) @@ -447,6 +447,9 @@ fi %changelog +* Tue Aug 15 2023 Phil Sutter - 1.8.9-6 +- Convert license to SPDX format + * Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 97407d1230d0860c3660855169def22be7749da7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 17:33:55 +0200 Subject: [PATCH 061/100] iptables-1.8.10-1 - New version 1.8.10 - Drop compat sub-package Resolves: rhbz#2243041 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 30 --- 0002-etc-Drop-xtables.conf.patch | 132 ---------- ...x-for-unknown-argument-error-message.patch | 148 ----------- ...es-Refuse-unselected-targets-options.patch | 232 ------------------ ...-Properly-split-input-in-replay-mode.patch | 31 --- ...bebt_redirect-Fix-target-translation.patch | 48 ---- ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ---- ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ---- ...t_ip-Translation-has-to-match-on-eth.patch | 85 ------- ...the-missing-chunk-types-in-sctp_help.patch | 36 --- ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 -------- ...-for-deletion-of-new-referenced-rule.patch | 67 ----- ...ables-Fix-checking-existence-of-rule.patch | 33 --- 0014-nft-shared-Drop-unused-include.patch | 29 --- ...rsing-of-inverted-arp-operation-matc.patch | 31 --- ...-t-omit-standard-matches-if-inverted.patch | 42 ---- ...ing-of-option-arguments-in-same-word.patch | 211 ---------------- iptables.spec | 44 +--- sources | 2 +- 20 files changed, 9 insertions(+), 1392 deletions(-) delete mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0002-etc-Drop-xtables.conf.patch delete mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch delete mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch delete mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch delete mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch delete mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch delete mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch delete mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch delete mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch delete mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch delete mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch delete mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch delete mode 100644 0014-nft-shared-Drop-unused-include.patch delete mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch delete mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch delete mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/.gitignore b/.gitignore index 141b2e8..4cb5d7a 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz +/iptables-1.8.10.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch deleted file mode 100644 index cecd191..0000000 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ /dev/null @@ -1,30 +0,0 @@ -From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security - -Have to pass either a string literal or format string to xt_xlate_add(). - -Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") -Signed-off-by: Phil Sutter -(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) ---- - extensions/libxt_NAT.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c -index da9f22012c5d6..2a6343986d54f 100644 ---- a/extensions/libxt_NAT.c -+++ b/extensions/libxt_NAT.c -@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, - if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) - return 0; - -- xt_xlate_add(xl, tgt); -+ xt_xlate_add(xl, "%s", tgt); - if (strlen(range_str)) - xt_xlate_add(xl, " to %s", range_str); - if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { --- -2.40.0 - diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch deleted file mode 100644 index e676561..0000000 --- a/0002-etc-Drop-xtables.conf.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Jan 2023 16:38:43 +0100 -Subject: [PATCH] etc: Drop xtables.conf - -The file is not used since the commit this one fixes. Also it wasn't -installed until recently, when commit 3822a992bc277 ("Makefile: Fix for -'make distcheck'") added it in the wrong spot in an attempt to reduce -differences between tarballs generated by 'make tarball' and 'make -dist'. - -While being at it, drop stale xtables_config_main() prototype from -xtables-multi.h. - -Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") -Signed-off-by: Phil Sutter -(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) ---- - Makefile.am | 2 +- - etc/xtables.conf | 74 ---------------------------------------- - iptables/xtables-multi.h | 1 - - 3 files changed, 1 insertion(+), 76 deletions(-) - delete mode 100644 etc/xtables.conf - -diff --git a/Makefile.am b/Makefile.am -index 451c3cb2d5887..299ab46d7b8e2 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py - - if ENABLE_NFTABLES - confdir = $(sysconfdir) --dist_conf_DATA = etc/ethertypes etc/xtables.conf -+dist_conf_DATA = etc/ethertypes - endif - - .PHONY: tarball -diff --git a/etc/xtables.conf b/etc/xtables.conf -deleted file mode 100644 -index 3c54ced043d82..0000000000000 ---- a/etc/xtables.conf -+++ /dev/null -@@ -1,74 +0,0 @@ --family ipv4 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family ipv6 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family arp { -- table filter { -- chain INPUT hook NF_ARP_IN prio 0 -- chain OUTPUT hook NF_ARP_OUT prio 0 -- } --} -diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h -index 94c24d5a22c7e..833c11a2ac914 100644 ---- a/iptables/xtables-multi.h -+++ b/iptables/xtables-multi.h -@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); - extern int xtables_eb_main(int, char **); - extern int xtables_eb_restore_main(int, char **); - extern int xtables_eb_save_main(int, char **); --extern int xtables_config_main(int, char **); - extern int xtables_monitor_main(int, char **); - - extern struct xtables_globals arptables_globals; --- -2.40.0 - diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch deleted file mode 100644 index d807c54..0000000 --- a/0003-Proper-fix-for-unknown-argument-error-message.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 01:51:43 +0100 -Subject: [PATCH] Proper fix for "unknown argument" error message - -While commit 1b8210f848631 kind of fixed the corner-case of invalid -short-options packed with others, it broke error reporting for -long-options. Revert it and deploy a proper solution: - -When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long -sets the variable 'optopt' to the invalid character's value. Use it for -reporting instead of optind if set. - -To distinguish between invalid options and missing option arguments, -ebtables-translate optstring needs adjustment. - -Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") -Signed-off-by: Phil Sutter -(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) ---- - .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ - iptables/xshared.c | 9 ++++-- - iptables/xtables-eb-translate.c | 8 ++--- - iptables/xtables-eb.c | 17 ++++++---- - 4 files changed, 50 insertions(+), 15 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -new file mode 100755 -index 0000000000000..ac6e743966196 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -@@ -0,0 +1,31 @@ -+#!/bin/bash -+ -+rc=0 -+ -+check() { -+ local cmd="$1" -+ local msg="$2" -+ -+ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { -+ echo "cmd: $XT_MULTI $1" -+ echo "exp: $msg" -+ echo "res: $($XT_MULTI $cmd 2>&1)" -+ rc=1 -+ } -+} -+ -+cmds="iptables ip6tables" -+[[ $XT_MULTI == *xtables-nft-multi ]] && { -+ cmds+=" ebtables" -+ cmds+=" iptables-translate" -+ cmds+=" ip6tables-translate" -+ cmds+=" ebtables-translate" -+} -+ -+for cmd in $cmds; do -+ check "${cmd} --foo" 'unknown option "--foo"' -+ check "${cmd} -A" 'option "-A" requires an argument' -+ check "${cmd} -aL" 'unknown option "-a"' -+done -+ -+exit $rc -diff --git a/iptables/xshared.c b/iptables/xshared.c -index f93529b11a319..ac51fac5ce9ed 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, - if (cs->c == ':') - xtables_error(PARAMETER_PROBLEM, "option \"%s\" " - "requires an argument", cs->argv[optind-1]); -- if (cs->c == '?') -- xtables_error(PARAMETER_PROBLEM, "unknown option " -- "\"%s\"", cs->argv[optind-1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } - xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - -diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c -index 13b6b864a5f24..0c35272051752 100644 ---- a/iptables/xtables-eb-translate.c -+++ b/iptables/xtables-eb-translate.c -@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - printf("nft "); - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, -- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { -+ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { - cs.c = c; - switch (c) { - case 'A': /* Add a rule */ -@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind - 1]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D') -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 7214a767ffe96..412b5cccdc46a 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) - return 0; - } - } -- return 1; -+ if (cs->c == ':') -+ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " -+ "requires an argument", cs->argv[optind - 1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } -+ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - - int nft_init_eb(struct nft_handle *h, const char *pname) -@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D' && command != 'C' && command != 14) --- -2.40.0 - diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch deleted file mode 100644 index c41ba45..0000000 --- a/0004-ebtables-Refuse-unselected-targets-options.patch +++ /dev/null @@ -1,232 +0,0 @@ -From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 02:01:56 +0100 -Subject: [PATCH] ebtables: Refuse unselected targets' options - -Unlike legacy, ebtables-nft would allow e.g.: - -| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be - -While the result is correct, it may mislead users into believing -multiple targets are possible per rule. Better follow legacy's behaviour -and reject target options unless they have been "enabled" by a previous -'-j' option. - -To achieve this, one needs to distinguish targets from watchers also -attached to 'xtables_targets' and otherwise behaving like regular -matches. Introduce XTABLES_EXT_WATCHER to mark the two. - -The above works already, but error messages are misleading when using -the now unsupported syntax since target options have been merged -already. Solve this by not pre-loading the targets at all, code will -just fall back to loading ad '-j' parsing time as iptables does. - -Note how this also fixes for 'counter' statement being in wrong position -of ebtables-translate output. - -Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") -Signed-off-by: Phil Sutter -(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) ---- - extensions/libebt_dnat.txlate | 12 ++++---- - extensions/libebt_log.c | 1 + - extensions/libebt_mark.txlate | 16 +++++----- - extensions/libebt_nflog.c | 1 + - extensions/libebt_snat.txlate | 8 ++--- - include/xtables.h | 1 + - .../ebtables/0002-ebtables-save-restore_0 | 4 +-- - iptables/xtables-eb.c | 29 +++++++------------ - 8 files changed, 33 insertions(+), 39 deletions(-) - -diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate -index 9f305c76c954f..531a22aa3e14f 100644 ---- a/extensions/libebt_dnat.txlate -+++ b/extensions/libebt_dnat.txlate -@@ -1,8 +1,8 @@ --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' -diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c -index 045062196d20d..9f8d158956802 100644 ---- a/extensions/libebt_log.c -+++ b/extensions/libebt_log.c -@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, - static struct xtables_target brlog_target = { - .name = "log", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_log_info)), -diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate -index d006e8ac94008..4ace1a1f5cfde 100644 ---- a/extensions/libebt_mark.txlate -+++ b/extensions/libebt_mark.txlate -@@ -1,11 +1,11 @@ --ebtables-translate -A INPUT --mark-set 42 --nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-set 42 -+nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' - --ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN --nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' -+ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN -+nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' - --ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT --nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT -+nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' - --ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP --nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' -+ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP -+nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' -diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c -index 115e15da45845..762d6d5d8bbe2 100644 ---- a/extensions/libebt_nflog.c -+++ b/extensions/libebt_nflog.c -@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, - static struct xtables_target brnflog_watcher = { - .name = "nflog", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), -diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate -index 857a6052aed1a..37343d3a14754 100644 ---- a/extensions/libebt_snat.txlate -+++ b/extensions/libebt_snat.txlate -@@ -1,5 +1,5 @@ --ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff --nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff -+nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE --nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE -+nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' -diff --git a/include/xtables.h b/include/xtables.h -index 4ffc8ec5a17e9..087a1d600f9ae 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -203,6 +203,7 @@ struct xtables_lmap { - - enum xtables_ext_flags { - XTABLES_EXT_ALIAS = 1 << 0, -+ XTABLES_EXT_WATCHER = 1 << 1, - }; - - struct xt_xlate; -diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -index 1091a4e80bebe..b4f9728bb9b6f 100755 ---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT - - $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT - $XT_MULTI ebtables -A foo --log --$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT -+$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT - $XT_MULTI ebtables -A foo --nflog - $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT - $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT -@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo - $XT_MULTI ebtables -N bar - $XT_MULTI ebtables -P bar RETURN - --$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT -+$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT - #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 - - $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 412b5cccdc46a..3a73e79725489 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void __ebt_load_watcher(const char *name, const char *typename) -+static void ebt_load_watcher(const char *name) - { - struct xtables_target *watcher; - size_t size; - - watcher = xtables_find_target(name, XTF_TRY_LOAD); - if (!watcher) { -- fprintf(stderr, "Unable to load %s %s\n", name, typename); -+ fprintf(stderr, "Unable to load %s watcher\n", name); - return; - } - -@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void ebt_load_watcher(const char *name) --{ -- return __ebt_load_watcher(name, "watcher"); --} -- --static void ebt_load_target(const char *name) --{ -- return __ebt_load_watcher(name, "target"); --} -- - void ebt_load_match_extensions(void) - { - opts = ebt_original_options; -@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) - - ebt_load_watcher("log"); - ebt_load_watcher("nflog"); -- -- ebt_load_target("mark"); -- ebt_load_target("dnat"); -- ebt_load_target("snat"); -- ebt_load_target("arpreply"); -- ebt_load_target("redirect"); -- ebt_load_target("standard"); - } - - void ebt_add_match(struct xtables_match *m, -@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) - - /* Is it a watcher option? */ - for (t = xtables_targets; t; t = t->next) { -+ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) -+ continue; -+ - if (t->parse && - t->parse(cs->c - t->option_offset, cs->argv, - ebt_invert, &t->tflags, NULL, &t->t)) { -@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - optind = 0; - opterr = false; - -+ for (t = xtables_targets; t; t = t->next) { -+ t->tflags = 0; -+ t->used = 0; -+ } -+ - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, EBT_OPTSTRING, - opts, NULL)) != -1) { --- -2.40.0 - diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch deleted file mode 100644 index dd58948..0000000 --- a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:48:33 +0100 -Subject: [PATCH] tests: xlate: Properly split input in replay mode - -Source command may contain quotes, using shlex.split() does the right -thing there. - -Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") -Signed-off-by: Phil Sutter -(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) ---- - xlate-test.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/xlate-test.py b/xlate-test.py -index 4cb1401b71677..217d2f0062682 100755 ---- a/xlate-test.py -+++ b/xlate-test.py -@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' - if sourceline.find(';') >= 0: - sourceline, searchline = sourceline.split(';') - -- srcwords = sourceline.split() -+ srcwords = shlex.split(sourceline) - - srccmd = srcwords[0] - ipt = srccmd.split('-')[0] --- -2.40.0 - diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch deleted file mode 100644 index b2f5481..0000000 --- a/0006-extensions-libebt_redirect-Fix-target-translation.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 22:28:24 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix target translation - -While EBT_ACCEPT is the default verdict for ebtables targets, omitting -it from translation implicitly converts it into 'continue'. Omit the -non-default EBT_CONTINUE instead. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 8 ++++++++ - 2 files changed, 9 insertions(+), 1 deletion(-) - create mode 100644 extensions/libebt_redirect.txlate - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 4d4c7a02cea89..389f3ccb53f60 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, - const struct ebt_redirect_info *red = (const void*)params->target->data; - - xt_xlate_add(xl, "meta set pkttype host"); -- if (red->target != EBT_ACCEPT) -+ if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; - } -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -new file mode 100644 -index 0000000000000..f0dd5deaf6406 ---- /dev/null -+++ b/extensions/libebt_redirect.txlate -@@ -0,0 +1,8 @@ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' --- -2.40.0 - diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch deleted file mode 100644 index 8f8dcf6..0000000 --- a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 23:32:50 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in - translation - -Meta key comes before 'set' in meta statement. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 6 +++--- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 389f3ccb53f60..7821935e137aa 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, - { - const struct ebt_redirect_info *red = (const void*)params->target->data; - -- xt_xlate_add(xl, "meta set pkttype host"); -+ xt_xlate_add(xl, "meta pkttype set host"); - if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -index f0dd5deaf6406..d073ec774c4fa 100644 ---- a/extensions/libebt_redirect.txlate -+++ b/extensions/libebt_redirect.txlate -@@ -1,8 +1,8 @@ - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' --- -2.40.0 - diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch deleted file mode 100644 index ad5a3ee..0000000 --- a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:58:36 +0100 -Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation - -Converting from TOS field match to DSCP one is irreversible, so replay -testing is not possible. Use a raw payload expression to produce -something that translates 1:1 back into an 'ip' match. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) ---- - extensions/libebt_ip.c | 4 ++-- - extensions/libebt_ip.txlate | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index fd87dae7e2c62..8b381aa10b5b7 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_DEST); - - if (info->bitmask & EBT_IP_TOS) { -- xt_xlate_add(xl, "ip dscp "); -+ xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) - xt_xlate_add(xl, "!= "); -- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ -+ xt_xlate_add(xl, "0x%02x ", info->tos); - } - if (info->bitmask & EBT_IP_PROTO) { - struct protoent *pe; -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 75c1db246fb81..562e3157d7b92 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 - nft 'add rule bridge filter FORWARD tcp dport 22 counter' --- -2.40.0 - diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch deleted file mode 100644 index 96cb5ad..0000000 --- a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 17:37:40 +0100 -Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type - -On one hand, nft refuses th expression in bridge family if layer3 -protocol has not been assured by a previous match. On the other, ebt_ip -kernel module will only match on IPv4 packets, so there might be a -functional change in the translation versus the original. - -Instead of just always emitting an 'ether type' match, decide whether -it's actually needed - explicit "ip " payload matches (or -icmp ones) cause implicit creation of a match on IPv4 by nft. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) ---- - extensions/libebt_ip.c | 21 +++++++++++++++++++++ - extensions/libebt_ip.txlate | 6 +++--- - 2 files changed, 24 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index 8b381aa10b5b7..68f34bff97deb 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, - xtables_ipmask_to_numeric(maskp)); - } - -+static bool may_skip_ether_type_dep(uint8_t flags) -+{ -+ /* these convert to "ip (s|d)addr" matches */ -+ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) -+ return true; -+ -+ /* icmp match triggers implicit ether type dependency in nft */ -+ if (flags & EBT_IP_ICMP) -+ return true; -+ -+ /* allow if "ip protocol" match is created by brip_xlate() */ -+ if (flags & EBT_IP_PROTO && -+ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) -+ return true; -+ -+ return false; -+} -+ - static int brip_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { -@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_SOURCE); - brip_xlate_nh(xl, info, EBT_IP_DEST); - -+ if (!may_skip_ether_type_dep(info->bitmask)) -+ xt_xlate_add(xl, "ether type ip "); -+ - if (info->bitmask & EBT_IP_TOS) { - xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 562e3157d7b92..28996832225cb 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 --nft 'add rule bridge filter FORWARD tcp dport 22 counter' -+nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 --nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' -+nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto 253 - nft 'add rule bridge filter FORWARD ip protocol 253 counter' --- -2.40.0 - diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch deleted file mode 100644 index 410a831..0000000 --- a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Tue, 21 Feb 2023 12:19:42 -0500 -Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help - -Add the missing chunk types in sctp_help(), so that the help cmd can -display these chunk types as below: - - # iptables -p sctp --help - - chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE - -Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") -Signed-off-by: Xin Long -Signed-off-by: Phil Sutter -(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) ---- - extensions/libxt_sctp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index fe5f5621a033d..6e2b2745dcbd5 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -50,7 +50,7 @@ static void sctp_help(void) - " --dport ...\n" - "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" - " chunktypes are present\n" --"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); -+"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); - } - - static const struct option sctp_opts[] = { --- -2.40.0 - diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch deleted file mode 100644 index e0915f5..0000000 --- a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 22 Feb 2023 16:36:16 +0100 -Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h - -When merging IP-version-specific LOG extensions, a dependency to that -header was introduced without caching it. Fix this and drop the now -unused ip{,6}t_LOG.h files. - -Reported-by: Thomas Devoogdt -Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") -Signed-off-by: Phil Sutter -(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) ---- - include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ - include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- - include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- - 3 files changed, 20 insertions(+), 38 deletions(-) - create mode 100644 include/linux/netfilter/xt_LOG.h - delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h - delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h - -diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h -new file mode 100644 -index 0000000000000..167d4ddd2476b ---- /dev/null -+++ b/include/linux/netfilter/xt_LOG.h -@@ -0,0 +1,20 @@ -+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -+#ifndef _XT_LOG_H -+#define _XT_LOG_H -+ -+/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ -+#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ -+#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ -+#define XT_LOG_IPOPT 0x04 /* Log IP options */ -+#define XT_LOG_UID 0x08 /* Log UID owning local socket */ -+#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ -+#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ -+#define XT_LOG_MASK 0x2f -+ -+struct xt_log_info { -+ unsigned char level; -+ unsigned char logflags; -+ char prefix[30]; -+}; -+ -+#endif /* _XT_LOG_H */ -diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h -deleted file mode 100644 -index dcdbadf9fd4a9..0000000000000 ---- a/include/linux/netfilter_ipv4/ipt_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IPT_LOG_H --#define _IPT_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IPT_LOG_IPOPT 0x04 /* Log IP options */ --#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ --#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ --#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IPT_LOG_MASK 0x2f -- --struct ipt_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ -diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h -deleted file mode 100644 -index 9dd5579e02ec7..0000000000000 ---- a/include/linux/netfilter_ipv6/ip6t_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IP6T_LOG_H --#define _IP6T_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ --#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ --#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ --#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IP6T_LOG_MASK 0x2f -- --struct ip6t_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ --- -2.40.0 - diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch deleted file mode 100644 index 8b20709..0000000 --- a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Feb 2023 18:09:25 +0100 -Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule - -Combining multiple corner-cases here: - -* Insert a rule before another new one which is not the first. Triggers - NFTNL_RULE_ID assignment of the latter. - -* Delete the referenced new rule in the same batch again. Causes - overwriting of the previously assigned RULE_ID. - -Consequently, iptables-nft-restore fails during *insert*, because the -reference is dangling. - -Reported-by: Eric Garver -Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") -Signed-off-by: Phil Sutter -Tested-by: Eric Garver -(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) ---- - iptables/nft.c | 3 ++- - .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ - 2 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 63468cf3b1344..5896fd410ca78 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) - - nftnl_rule_list_del(r); - -- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) -+ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && -+ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) - nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); - - obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); -diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -index 3f1d229e915ff..5482b7ea17298 100755 ---- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -+++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT - -A FORWARD -m comment --comment "rule 3" -j ACCEPT' - - diff -u -Z <(echo -e "$EXPECT") <(ipt_show) -+ -+# test adding, referencing and deleting the same rule in a batch -+ -+$XT_MULTI iptables-restore < -Date: Mon, 3 Apr 2023 23:13:47 +0200 -Subject: [PATCH] ip6tables: Fix checking existence of rule - -Pass the proper entry size when creating a match mask for checking the -existence of a rule. Failing to do so causes wrong results. - -Reported-by: Jonathan Caicedo -Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") -Signed-off-by: Markus Boehme -Signed-off-by: Phil Sutter -(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) ---- - iptables/ip6tables.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c -index 345af4519bfe7..9afc32c1a21ed 100644 ---- a/iptables/ip6tables.c -+++ b/iptables/ip6tables.c -@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, - int ret = 1; - unsigned char *mask; - -- mask = make_delete_mask(matches, target, sizeof(fw)); -+ mask = make_delete_mask(matches, target, sizeof(*fw)); - for (i = 0; i < nsaddrs; i++) { - fw->ipv6.src = saddrs[i]; - fw->ipv6.smsk = smasks[i]; --- -2.40.0 - diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch deleted file mode 100644 index c4274ca..0000000 --- a/0014-nft-shared-Drop-unused-include.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Mar 2023 16:22:16 +0200 -Subject: [PATCH] nft-shared: Drop unused include - -Code does not refer to struct xt_comment_info anymore. - -Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") -Signed-off-by: Phil Sutter -(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) ---- - iptables/nft-shared.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 4a7b5406892c4..4ba44a4aa4d17 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -22,7 +22,6 @@ - #include - - #include --#include - #include - #include - #include --- -2.40.0 - diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch deleted file mode 100644 index 5474f8a..0000000 --- a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:33:43 +0200 -Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match - -The wrong bit was set in 'invflags', probably due to copy'n'paste from -the previous case. - -Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") -Signed-off-by: Phil Sutter -(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) ---- - iptables/nft-arp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 210f43d2cefbe..8fae5adc50216 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, - fw->arp.arhln = ar_hln; - fw->arp.arhln_mask = 0xff; - if (inv) -- fw->arp.invflags |= IPT_INV_ARPOP; -+ fw->arp.invflags |= IPT_INV_ARPHLN; - break; - case offsetof(struct arphdr, ar_pln): - get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); --- -2.40.0 - diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch deleted file mode 100644 index 1efb846..0000000 --- a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:37:47 +0200 -Subject: [PATCH] arptables: Don't omit standard matches if inverted - -Inverted --h-len and --h-type matches were omitted from output by -accident if they matched on their standard value. - -Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") -Signed-off-by: Phil Sutter -(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) ---- - iptables/nft-arp.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 8fae5adc50216..df3ad430cf701 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - - after_devdst: - -- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { -+ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || -+ fw->arp.invflags & IPT_INV_ARPHLN) { - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN - ? "! " : ""); - printf("--h-length %d", fw->arp.arhln); -@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - sep = " "; - } - -- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { -+ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || -+ fw->arp.invflags & IPT_INV_ARPHRD) { - uint16_t tmp = ntohs(fw->arp.arhrd); - - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD --- -2.40.0 - diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch deleted file mode 100644 index 9c5cbd2..0000000 --- a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +++ /dev/null @@ -1,211 +0,0 @@ -From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:41:08 +0200 -Subject: [PATCH] xshared: Fix parsing of option arguments in same word - -When merging commandline parsers, a decision between 'argv[optind - 1]' -and 'optarg' had to be made in some spots. While the implementation of -check_inverse() required the former, use of the latter allows for the -common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at -the suffix while 'argv[optind - 1]' will just point at the following -option. - -Fix the mess by making check_inverse() update optarg pointer if needed -so calling code may refer to and always correct 'optarg'. - -Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 -Signed-off-by: Phil Sutter -(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) ---- - extensions/libarpt_standard.t | 2 ++ - extensions/libxt_standard.t | 3 ++ - iptables/xshared.c | 61 +++++++++++++++++------------------ - 3 files changed, 35 insertions(+), 31 deletions(-) - -diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t -index e84a00b780488..007fa2b8335e8 100644 ---- a/extensions/libarpt_standard.t -+++ b/extensions/libarpt_standard.t -@@ -12,3 +12,5 @@ - -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK - --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK - ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK -+--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK -+--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK -diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t -index 56d6da2e5884e..6ed978e442b80 100644 ---- a/extensions/libxt_standard.t -+++ b/extensions/libxt_standard.t -@@ -21,3 +21,6 @@ - -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK - -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK - -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK -+:FORWARD -+--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -+-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index ac51fac5ce9ed..17aed04e02b09 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - } - - static void check_inverse(struct xtables_args *args, const char option[], -- bool *invert, int *optidx, int argc) -+ bool *invert, int argc, char **argv) - { - switch (args->family) { - case NFPROTO_ARP: -@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], - xtables_error(PARAMETER_PROBLEM, - "Multiple `!' flags not allowed"); - *invert = true; -- if (optidx) { -- *optidx = *optidx + 1; -- if (argc && *optidx > argc) -- xtables_error(PARAMETER_PROBLEM, -- "no argument following `!'"); -- } -+ optind++; -+ if (optind > argc) -+ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); -+ -+ optarg = argv[optind - 1]; - } - - static const char *optstring_lookup(int family) -@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], - * Option selection - */ - case 'p': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_PROTOCOL, - &args->invflags, invert); - - /* Canonicalize into lower case */ -- for (cs->protocol = argv[optind - 1]; -+ for (cs->protocol = optarg; - *cs->protocol; cs->protocol++) - *cs->protocol = tolower(*cs->protocol); - -- cs->protocol = argv[optind - 1]; -+ cs->protocol = optarg; - args->proto = xtables_parse_protocol(cs->protocol); - - if (args->proto == 0 && -@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], - break; - - case 's': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_SOURCE, - &args->invflags, invert); -- args->shostnetworkmask = argv[optind - 1]; -+ args->shostnetworkmask = optarg; - break; - - case 'd': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_DESTINATION, - &args->invflags, invert); -- args->dhostnetworkmask = argv[optind - 1]; -+ args->dhostnetworkmask = optarg; - break; - - #ifdef IPT_F_GOTO -@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], - #endif - - case 2:/* src-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_S_MAC, &args->invflags, - invert); -- args->src_mac = argv[optind - 1]; -+ args->src_mac = optarg; - break; - - case 3:/* dst-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_D_MAC, &args->invflags, - invert); -- args->dst_mac = argv[optind - 1]; -+ args->dst_mac = optarg; - break; - - case 'l':/* hardware length */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_LENGTH, &args->invflags, - invert); -- args->arp_hlen = argv[optind - 1]; -+ args->arp_hlen = optarg; - break; - - case 8: /* was never supported, not even in arptables-legacy */ - xtables_error(PARAMETER_PROBLEM, "not supported"); - case 4:/* opcode */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_OPCODE, &args->invflags, - invert); -- args->arp_opcode = argv[optind - 1]; -+ args->arp_opcode = optarg; - break; - - case 5:/* h-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_TYPE, &args->invflags, - invert); -- args->arp_htype = argv[optind - 1]; -+ args->arp_htype = optarg; - break; - - case 6:/* proto-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_P_TYPE, &args->invflags, - invert); -- args->arp_ptype = argv[optind - 1]; -+ args->arp_ptype = optarg; - break; - - case 'j': - set_option(&cs->options, OPT_JUMP, &args->invflags, - invert); -- command_jump(cs, argv[optind - 1]); -+ command_jump(cs, optarg); - break; - - case 'i': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEIN, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->iniface, - args->iniface_mask); - break; - - case 'o': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEOUT, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->outiface, - args->outiface_mask); - break; --- -2.40.0 - diff --git a/iptables.spec b/iptables.spec index 57a50f4..e37c5e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.9 -Release: 6%{?dist} +Version: 1.8.10 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,24 +20,6 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch -Patch002: 0002-etc-Drop-xtables.conf.patch -Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch -Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch -Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch -Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch -Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch -Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch -Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch -Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch -Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch -Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch -Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch -Patch014: 0014-nft-shared-Drop-unused-include.patch -Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch -Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch -Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -54,7 +36,7 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.6 +BuildRequires: pkgconfig(libnftnl) >= 1.2.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf @@ -67,17 +49,6 @@ The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. -%package compat -Summary: Temporary transitioning package -Obsoletes: %{name} < 1.8.7-4 -Requires: %{name}-legacy = %{version}-%{release} -Requires: %{name}-utils = %{version}-%{release} - -%description compat -This package only exists to help transition iptables users to the new -package split. It will be removed after one distribution release cycle, please -do not reference it or depend on it in any way. - %package legacy Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} @@ -252,9 +223,6 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -# Drop xtables.conf, it's not used -rm -f %{buildroot}%{_sysconfdir}/xtables.conf - # fix absolute symlink rm -f %{buildroot}%{_bindir}/iptables-xml ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml @@ -371,8 +339,6 @@ if [ $1 -eq 0 ]; then done fi -%files compat - %files legacy %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -447,6 +413,10 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-1 +- New version 1.8.10 +- Drop compat sub-package + * Tue Aug 15 2023 Phil Sutter - 1.8.9-6 - Convert license to SPDX format diff --git a/sources b/sources index fef1030..59e259b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 +SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 From 4407a0239cd14b500c225119639ca72d98da6d13 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:23:45 +0200 Subject: [PATCH 062/100] tests: Drop checks for iptables RPM On one hand, the test will fail as the RPM is called 'iptables-nft' (or 'iptables-legacy', but that's not the default). On the other, if iptables RPM is missing the commands will fail as well so this check happens implicitly anyway. --- tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh | 2 -- .../RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh | 2 -- tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh | 2 -- tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh | 2 -- tests/initscript-sanity/runtest.sh | 3 --- .../runtest.sh | 3 --- .../runtest.sh | 3 --- .../ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh | 2 -- .../iptables-rule-deletion-fails-for-rules-that-use/runtest.sh | 2 -- tests/iptables-save-cuts-space-before-j/runtest.sh | 3 --- tests/iptables-save-modprobe-option/runtest.sh | 3 --- tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh | 3 --- 12 files changed, 30 deletions(-) diff --git a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh index 32eab99..952cd4c 100755 --- a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh +++ b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET=testset6 rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh index 438468d..26a667e 100755 --- a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh +++ b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" TESTD=$PWD rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "source $TESTD/rules.in" 0 "read ruleset" diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 889c1b6..5021458 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" prepare_page() { @@ -42,7 +41,6 @@ prepare_page() { rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlLogInfo $(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" diff --git a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh index 888dfbd..0b4032e 100755 --- a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh +++ b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" CGNUM="15" CGNAME="15" CGDIR="/sys/fs/cgroup/net_cls/$CGNAME" @@ -41,7 +40,6 @@ SKIP6=false rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel-$(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/initscript-sanity/runtest.sh b/tests/initscript-sanity/runtest.sh index e270b78..b132033 100755 --- a/tests/initscript-sanity/runtest.sh +++ b/tests/initscript-sanity/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 004d568..f68925c 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" diff --git a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh index f59a908..d06fc4a 100755 --- a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh +++ b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "cp /etc/sysconfig/ip6tables ." diff --git a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh index 79b2696..2daddb3 100755 --- a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh +++ b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" for svc in $SERVICES; do diff --git a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh index d17e693..f409501 100755 --- a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh +++ b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh @@ -29,13 +29,11 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET4="ipsetv4" IPSET6="ipsetv6" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ipset create $IPSET4 hash:ip" diff --git a/tests/iptables-save-cuts-space-before-j/runtest.sh b/tests/iptables-save-cuts-space-before-j/runtest.sh index a6a5099..bba6bf2 100755 --- a/tests/iptables-save-cuts-space-before-j/runtest.sh +++ b/tests/iptables-save-cuts-space-before-j/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlServiceStart iptables diff --git a/tests/iptables-save-modprobe-option/runtest.sh b/tests/iptables-save-modprobe-option/runtest.sh index 22951c4..240c76e 100755 --- a/tests/iptables-save-modprobe-option/runtest.sh +++ b/tests/iptables-save-modprobe-option/runtest.sh @@ -30,11 +30,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartTest - rlAssertRpm $PACKAGE rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported" rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported" rlPhaseEnd diff --git a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh index c3223b5..abfb03a 100755 --- a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh +++ b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd From c61918e30991a3b5c4c3e4b6988a0a99440034be Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:40:51 +0200 Subject: [PATCH 063/100] iptables-1.8.10-2 - Obsolete dropped compat package --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index e37c5e6..5d5240b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,6 +59,7 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif +Obsoletes: %{name}-compat < 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -413,6 +414,9 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-2 +- Obsolete dropped compat package + * Tue Oct 10 2023 Phil Sutter - 1.8.10-1 - New version 1.8.10 - Drop compat sub-package From 9272a9e4cc5f169c98f61123116df93c02f315b2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 14:56:09 +0100 Subject: [PATCH 064/100] iptables-1.8.10-3 - Fix compat sub-package obsoletion Resolves: rhbz#2248494 --- iptables.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5d5240b..a4506d4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,7 +59,8 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif -Obsoletes: %{name}-compat < 1.8.9-6 +Provides: %{name}-compat = %{version}-%{release} +Obsoletes: %{name}-compat <= 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -414,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-3 +- Fix compat sub-package obsoletion + * Tue Oct 10 2023 Phil Sutter - 1.8.10-2 - Obsolete dropped compat package From 452b549ac6e57bca853fd99096f5bcefaeec7f49 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 21:43:47 +0100 Subject: [PATCH 065/100] iptables-1.8.10-4 - The actual obsoletes fix Resolves: rhbz#2248494 --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index a4506d4..05ac24b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -60,7 +60,7 @@ Requires(postun): %{_sbindir}/update-alternatives Provides: iptables %endif Provides: %{name}-compat = %{version}-%{release} -Obsoletes: %{name}-compat <= 1.8.9-6 +Obsoletes: %{name}-compat < 1.8.9-7 %description legacy The iptables utility controls the network packet filtering code in the @@ -415,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-4 +- The actual obsoletes fix + * Tue Nov 07 2023 Phil Sutter - 1.8.10-3 - Fix compat sub-package obsoletion From d10a06dda4a10de64ad3fa230e2ec1828cf1766c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 8 Nov 2023 00:07:03 +0100 Subject: [PATCH 066/100] tests/TRACE-target-of-iptables-can-t-work-in: Unload modules only if loaded Apply the same kernel version check to cleanup phase and omit module unloading. --- .../runtest.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 5021458..86652af 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -119,10 +119,14 @@ rlJournalStart rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6" rlRun "iptables -t raw -F" rlRun "ip6tables -t raw -F" - rlRun "rmmod nf_log_ipv4" - rlRun "rmmod nf_log_ipv6" - rlRun "rmmod nf_log_common" - rlRun "rmmod nfnetlink_log" 0,1 + if rlTestVersion "$(uname -r)" "<" "4.6"; then + rlRun "rmmod nf_log_ipv4" + rlRun "rmmod nf_log_ipv6" + rlRun "rmmod nf_log_common" + rlRun "rmmod nfnetlink_log" 0,1 + else + rlLogInfo "new kernel detected: skipping unloading modules" + fi rlLogInfo "restoring services" for svc in $SERVICES; do rlServiceRestore $svc From 3611a44057b5cfdb4641c2370784a37ae4d56c26 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 8 Jan 2024 09:02:09 -0500 Subject: [PATCH 067/100] Fix flatpak build Installation path macros must not be used for file dependencies: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies --- iptables.spec | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index 05ac24b..cc4091e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -54,8 +54,8 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif @@ -142,9 +142,9 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} -Requires(post): %{_sbindir}/update-alternatives -Requires(post): %{_bindir}/readlink -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(post): /usr/bin/readlink +Requires(postun): /usr/sbin/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -234,7 +234,7 @@ ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -244,7 +244,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -260,7 +260,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -286,7 +286,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -304,7 +304,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -324,7 +324,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -336,7 +336,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ $cmd %{_sbindir}/$cmd-nft done fi From 86e59a1ef9148016f717558dda3478f5740c1a06 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Jan 2024 17:47:08 +0100 Subject: [PATCH 068/100] iptables-1.8.10-5 - Backport fixes from upstream - Fix flatpak build --- ...another-segfault-due-to-chain-index-.patch | 81 +++++++++++++ ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 +++++++++++++ ...-Fix-corner-case-noflush-restore-bug.patch | 63 ++++++++++ ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 +++++++ ...ants-support-v-update-OPTSTRING_COMM.patch | 31 +++++ ...n-line-number-formatting-with-legacy.patch | 28 +++++ ...-man-Do-not-escape-exclamation-marks.patch | 44 +++++++ ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 ++++++++ ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ++++++++++++++++++ ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 ++++++ iptables.spec | 17 ++- 11 files changed, 589 insertions(+), 1 deletion(-) create mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch create mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch create mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch create mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch create mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch create mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch create mode 100644 0007-man-Do-not-escape-exclamation-marks.patch create mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch create mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch create mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch new file mode 100644 index 0000000..35b5973 --- /dev/null +++ b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch @@ -0,0 +1,81 @@ +From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Oct 2023 17:27:42 +0200 +Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL + pointer + +Chain rename code missed to adjust the num_chains value which is used to +calculate the number of chain index buckets to allocate during an index +rebuild. So with the right number of chains present, the last chain in a +middle bucket being renamed (and ending up in another bucket) triggers +an index rebuild based on false data. The resulting NULL pointer index +bucket then causes a segfault upon reinsertion. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 +Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") +(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) +--- + .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ + libiptc/libiptc.c | 4 +++ + 2 files changed, 36 insertions(+) + create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 + +diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +new file mode 100755 +index 0000000000000..bc473d2511bbd +--- /dev/null ++++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +@@ -0,0 +1,32 @@ ++#!/bin/bash ++# ++# Another funny rename bug in libiptc: ++# If there is a chain index bucket with only a single chain in it and it is not ++# the last one and that chain is renamed, a chain index rebuild is triggered. ++# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an ++# extra index is allocated and remains NULL. The following insert of renamed ++# chain then segfaults. ++ ++( ++ echo "*filter" ++ # first bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-a-$i - [0:0]" ++ done ++ # second bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-b-$i - [0:0]" ++ done ++ # third bucket, just make sure it exists ++ echo ":chain-c-0 - [0:0]" ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore ++ ++# rename all chains of the middle bucket ++( ++ echo "*filter" ++ for ((i = 0; i < 40; i++)); do ++ echo "-E chain-b-$i chain-d-$i" ++ done ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore --noflush +diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c +index e475063367c26..9712a36353b9a 100644 +--- a/libiptc/libiptc.c ++++ b/libiptc/libiptc.c +@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, + return 0; + } + ++ handle->num_chains--; ++ + /* This only unlinks "c" from the list, thus no free(c) */ + iptcc_chain_index_delete_chain(c, handle); + + /* Change the name of the chain */ + strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); + ++ handle->num_chains++; ++ + /* Insert sorted into to list again */ + iptc_insert_chain(handle, c); + diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch new file mode 100644 index 0000000..c384e4b --- /dev/null +++ b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -0,0 +1,81 @@ +From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 3 Nov 2023 17:33:22 +0100 +Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage + +ARPT_ and IPT_INV flags are not interchangeable, e.g.: +define IPT_INV_SRCDEVADDR 0x0080 +define ARPT_INV_SRCDEVADDR 0x0010 + +as these flags can be tested by libarp_foo.so such checks can yield +incorrect results. + +Because arptables-nft uses existing code, e.g. xt_mark, it makes +sense to unify this completely by converting the last users of +ARPT_INV_ constants. + +Note that arptables-legacy does not do run-time module loading via +dlopen(). Functionaliy implemented by "extensions" in the +arptables-legacy git tree are built-in, so this doesn't break +arptables-legacy binaries. + +Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") +Signed-off-by: Florian Westphal +Signed-off-by: Phil Sutter +(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) +--- + extensions/libarpt_mangle.c | 4 ++-- + iptables/nft-arp.c | 2 +- + iptables/xshared.h | 4 +++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c +index 765edf34781f3..a846e97ec8f27 100644 +--- a/extensions/libarpt_mangle.c ++++ b/extensions/libarpt_mangle.c +@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! --h-length not allowed for " + "--mangle-mac-s"); +@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! hln not allowed for --mangle-mac-d"); + if (e->arp.arhln != 6) +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index aed39ebdd5166..535dd6b83237b 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, + &args->d.naddrs); + + if ((args->s.naddrs > 1 || args->d.naddrs > 1) && +- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) ++ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) + xtables_error(PARAMETER_PROBLEM, + "! not allowed with multiple" + " source or destination IP addresses"); +diff --git a/iptables/xshared.h b/iptables/xshared.h +index a200e0d620ad3..5586385456a4d 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -80,7 +80,9 @@ struct xtables_target; + #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ + #define EBT_OPTSTRING OPTSTRING_COMMON "hv" + +-/* define invflags which won't collide with IPT ones */ ++/* define invflags which won't collide with IPT ones. ++ * arptables-nft does NOT use the legacy ARPT_INV_* defines. ++ */ + #define IPT_INV_SRCDEVADDR 0x0080 + #define IPT_INV_TGTDEVADDR 0x0100 + #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch new file mode 100644 index 0000000..3386925 --- /dev/null +++ b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch @@ -0,0 +1,63 @@ +From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 7 Nov 2023 19:12:14 +0100 +Subject: [PATCH] ebtables: Fix corner-case noflush restore bug + +Report came from firwalld, but this is actually rather hard to trigger. +Since a regular chain line prevents it, typical dump/restore use-cases +are unaffected. + +Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") +Cc: Eric Garver +Signed-off-by: Phil Sutter +(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) +--- + .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ + iptables/xtables-eb.c | 2 ++ + 2 files changed, 27 insertions(+) + create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 + +diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +new file mode 100755 +index 0000000000000..0def0ac58e7be +--- /dev/null ++++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +@@ -0,0 +1,25 @@ ++#!/bin/sh ++# ++# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: ++# - with --noflush ++# - a second table after the broute one ++# - A policy command but no chain line for BROUTING chain ++ ++set -e ++ ++case "$XT_MULTI" in ++*xtables-nft-multi) ++ ;; ++*) ++ echo "skip $XT_MULTI" ++ exit 0 ++ ;; ++esac ++ ++$XT_MULTI ebtables-restore --noflush < +Date: Sun, 19 Nov 2023 13:18:26 +0100 +Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused + +Drop the boolean, it was meant to disable some existence checks in +do_parse() prior to the caching rework. Now that do_parse() runs before +any caching is done, the checks in question don't exist anymore so drop +this relict. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) +--- + iptables/xshared.h | 1 - + iptables/xtables-translate.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index 5586385456a4d..c77556a1987dc 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -284,7 +284,6 @@ struct xt_cmd_parse { + bool restore; + int line; + int verbose; +- bool xlate; + struct xt_cmd_parse_ops *ops; + }; + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 88e0a6b639494..c019cd2991305 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + .table = *table, + .restore = restore, + .line = line, +- .xlate = true, + .ops = &h->ops->cmd_parse, + }; + struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch new file mode 100644 index 0000000..c743e75 --- /dev/null +++ b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch @@ -0,0 +1,31 @@ +From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 19 Nov 2023 13:25:36 +0100 +Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON + +Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") +Signed-off-by: Phil Sutter +(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) +--- + iptables/xshared.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index c77556a1987dc..815b9d3e98726 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -75,10 +75,10 @@ struct xtables_globals; + struct xtables_rule_match; + struct xtables_target; + +-#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" +-#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" +-#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ +-#define EBT_OPTSTRING OPTSTRING_COMMON "hv" ++#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" ++#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" ++#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ ++#define EBT_OPTSTRING OPTSTRING_COMMON "h" + + /* define invflags which won't collide with IPT ones. + * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch new file mode 100644 index 0000000..07bea3a --- /dev/null +++ b/0006-ebtables-Align-line-number-formatting-with-legacy.patch @@ -0,0 +1,28 @@ +From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 21 Nov 2023 22:58:47 +0100 +Subject: [PATCH] ebtables: Align line number formatting with legacy + +Legacy ebtables appends a dot to the number printed in first column if +--Ln flag was given. + +Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") +Signed-off-by: Phil Sutter +(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) +--- + iptables/nft-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index d9a8ad2b0f373..e414ef5584392 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, + struct iptables_command_state cs = {}; + + if (format & FMT_LINENUMBERS) +- printf("%d ", num); ++ printf("%d. ", num); + + nft_rule_to_ebtables_command_state(h, r, &cs); + __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch new file mode 100644 index 0000000..b088c63 --- /dev/null +++ b/0007-man-Do-not-escape-exclamation-marks.patch @@ -0,0 +1,44 @@ +From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 13:29:17 +0100 +Subject: [PATCH] man: Do not escape exclamation marks + +This appears to be not necessary, also mandoc complains about it: + +| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! + +Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") +Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") +Signed-off-by: Phil Sutter +(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) +--- + extensions/libip6t_DNPT.man | 2 +- + extensions/libip6t_SNPT.man | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man +index 9b060f5b7179b..72c6ae5d422a2 100644 +--- a/extensions/libip6t_DNPT.man ++++ b/extensions/libip6t_DNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the SNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 +diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man +index 97e0071b43cc1..0c926978377a7 100644 +--- a/extensions/libip6t_SNPT.man ++++ b/extensions/libip6t_SNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the DNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch new file mode 100644 index 0000000..c0bbec2 --- /dev/null +++ b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch @@ -0,0 +1,49 @@ +From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 20:21:49 +0100 +Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks + +In order to parse the mask, xtopt_parse_hostmask() calls +xtopt_parse_plenmask() thereby limiting netmask support to prefix +lengths (alternatively specified in IP address notation). + +In order to lift this impractical restriction, make +xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may +fall back to xtopt_parse_mask() which correctly initializes val.hmask +itself and indicates non-CIDR-compatible masks by setting val.hlen to +-1. + +So in order to support these odd masks, it is sufficient for +xtopt_parse_plenmask() to skip its mask building from val.hlen value and +take whatever val.hmask contains. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +Signed-off-by: Phil Sutter +(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) +--- + libxtables/xtoptions.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index b16bbfbe32311..d91a78f470eda 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + + xtopt_parse_plen(cb); + ++ /* may not be convertible to CIDR notation */ ++ if (cb->val.hlen == (uint8_t)-1) ++ goto out_put; ++ + memset(mask, 0xFF, sizeof(union nf_inet_addr)); + /* This shifting is AF-independent. */ + if (cb->val.hlen == 0) { +@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + mask[1] = htonl(mask[1]); + mask[2] = htonl(mask[2]); + mask[3] = htonl(mask[3]); ++out_put: + if (entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); + } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch new file mode 100644 index 0000000..7745634 --- /dev/null +++ b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch @@ -0,0 +1,114 @@ +From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 19 Dec 2023 00:56:07 +0100 +Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting + +Parameter 'wait' passed to xtables_lock() signals three modes of +operation, depending on its value: + + 0: --wait not specified, do not wait if lock is busy +-1: --wait specified without value, wait indefinitely until lock becomes + free +>0: Wait for 'wait' seconds for lock to become free, abort otherwise + +Since fixed commit, the first two cases were treated the same apart from +calling alarm(0), but that is a nop if no alarm is pending. Fix the code +by requesting a non-blocking flock() in the second case. While at it, +restrict the alarm setup to the third case only. + +Cc: Jethro Beekman +Cc: howardjohn@google.com +Cc: Antonio Ojea +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 +Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") +Signed-off-by: Phil Sutter +(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) +--- + .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ + iptables/xshared.c | 4 +- + 2 files changed, 57 insertions(+), 2 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 +new file mode 100755 +index 0000000000000..4481f966ce435 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 +@@ -0,0 +1,55 @@ ++#!/bin/bash ++ ++case "$XT_MULTI" in ++*xtables-legacy-multi) ++ ;; ++*) ++ echo skip $XT_MULTI ++ exit 0 ++ ;; ++esac ++ ++coproc RESTORE { $XT_MULTI iptables-restore; } ++echo "*filter" >&${RESTORE[1]} ++ ++ ++$XT_MULTI iptables -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 1 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "process waits when it should not" ++ exit 1 ++} ++wait $ipt_pid ++[[ $? -eq 0 ]] && { ++ echo "process exited 0 despite busy lock" ++ exit 1 ++} ++ ++t0=$(date +%s) ++$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT ++t1=$(date +%s) ++[[ $((t1 - t0)) -ge 3 ]] || { ++ echo "wait time not expired" ++ exit 1 ++} ++ ++$XT_MULTI iptables -w -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] || { ++ echo "no indefinite wait" ++ exit 1 ++} ++kill $ipt_pid ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "killed waiting iptables call did not exit in time" ++ exit 1 ++} ++ ++kill $RESTORE_PID ++wait ++exit 0 +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 5f75a0a57a023..690502c457dd0 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -270,7 +270,7 @@ static int xtables_lock(int wait) + return XT_LOCK_FAILED; + } + +- if (wait != -1) { ++ if (wait > 0) { + sigact_alarm.sa_handler = alarm_ignore; + sigact_alarm.sa_flags = SA_RESETHAND; + sigemptyset(&sigact_alarm.sa_mask); +@@ -278,7 +278,7 @@ static int xtables_lock(int wait) + alarm(wait); + } + +- if (flock(fd, LOCK_EX) == 0) ++ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) + return fd; + + if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch new file mode 100644 index 0000000..ea88fa3 --- /dev/null +++ b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch @@ -0,0 +1,40 @@ +From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 17 Dec 2023 13:02:36 +0100 +Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK + +Do as the comment in xtopt_parse_hostmask() claims and omit +XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() +will catch the incompatibility. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) +--- + include/xtables.h | 1 - + libxtables/xtoptions.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/include/xtables.h b/include/xtables.h +index 087a1d600f9ae..9def9b43b6e58 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -61,7 +61,6 @@ struct in_addr; + * %XTTYPE_SYSLOGLEVEL: syslog level by name or number + * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) + * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length +- * (ptr: union nf_inet_addr; only host portion is stored) + * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) + * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) + * %XTTYPE_PORTRC: colon-separated port range (names acceptable), +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index d91a78f470eda..ba68056dc99f7 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { + [XTTYPE_STRING] = -1, + [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), + [XTTYPE_HOST] = sizeof(union nf_inet_addr), +- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), + [XTTYPE_PROTOCOL] = sizeof(uint8_t), + [XTTYPE_PORT] = sizeof(uint16_t), + [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/iptables.spec b/iptables.spec index cc4091e..fcc549e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,6 +20,17 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper +Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch +Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch +Patch007: 0007-man-Do-not-escape-exclamation-marks.patch +Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -415,6 +426,10 @@ fi %changelog +* Thu Jan 11 2024 Phil Sutter - 1.8.10-5 +- Backport fixes from upstream +- Fix flatpak build + * Tue Nov 07 2023 Phil Sutter - 1.8.10-4 - The actual obsoletes fix From 62720fedc38312a84687cf1632042f22dcf99b32 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:15:08 +0000 Subject: [PATCH 069/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fcc549e..dd8c7cc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 11 2024 Phil Sutter - 1.8.10-5 - Backport fixes from upstream - Fix flatpak build From 4f6c4554627cf2633bc8944cb1240ab0c8074515 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 22:54:06 +0000 Subject: [PATCH 070/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index dd8c7cc..7c995da 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d55ae5d9f184b1b93fd57c73e8cb9f12bdcfd792 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 21 May 2024 15:07:37 +0200 Subject: [PATCH 071/100] iptables-1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables Resolves: rhbz#2281595 --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 7c995da..83b972c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -358,6 +358,7 @@ fi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} @@ -426,6 +427,9 @@ fi %changelog +* Tue May 21 2024 Phil Sutter - 1.8.10-8 +- Make iptables-legacy own %%{_datadir}/xtables + * Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From de779a4b439abe447aedc2c32e4e61f1e115ace7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 3 Jul 2024 12:57:08 +0200 Subject: [PATCH 072/100] iptables-1.8.10-9 - Backport fixes from upstream --- ...se-Add-missing-braces-around-ternary.patch | 36 +++ ...xtables-Fix-memleak-of-matches-udata.patch | 32 ++ ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ++++++++++++ ...frag-Save-xlate-inverted-full-ranges.patch | 117 +++++++ ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 +++++++ ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 ++++++++ ...-esp-Save-xlate-inverted-full-ranges.patch | 119 +++++++ ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 +++ ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ++++ ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ++++++++++++++++++ ...t-Fix-for-broken-recover_rule_compat.patch | 89 +++++ ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 +++ ...sing-of-empty-string-arg-in-c-option.patch | 48 +++ iptables.spec | 20 +- 14 files changed, 1370 insertions(+), 2 deletions(-) create mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch create mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch create mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch create mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch create mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch create mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch create mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch create mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch create mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch create mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch create mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch create mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch create mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch new file mode 100644 index 0000000..f348d59 --- /dev/null +++ b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch @@ -0,0 +1,36 @@ +From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 26 Jan 2024 18:43:10 +0100 +Subject: [PATCH] nft: ruleparse: Add missing braces around ternary + +The expression evaluated the sum before the ternay, consequently not +adding target->size if tgsize was zero. + +Identified by ASAN for a simple rule using standard target: +| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN +| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN +| ================================================================= +| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 +| READ of size 8 at 0x603000000120 thread T0 +| [...] + +Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") +Signed-off-by: Phil Sutter +(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) +--- + iptables/nft-ruleparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c +index c8322f936acd9..57fe27276de35 100644 +--- a/iptables/nft-ruleparse.c ++++ b/iptables/nft-ruleparse.c +@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) + if (!target) + return NULL; + +- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; ++ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); + + target->t = xtables_calloc(1, size); + target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch new file mode 100644 index 0000000..7d9c51f --- /dev/null +++ b/0012-libxtables-Fix-memleak-of-matches-udata.patch @@ -0,0 +1,32 @@ +From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 31 Jan 2024 14:58:17 +0100 +Subject: [PATCH] libxtables: Fix memleak of matches' udata + +If the extension specifies a non-zero udata_size, field 'udata' points +to an allocated buffer which needs to be freed upon extension deinit. + +Interestingly, this bug was identified by ASAN and missed by valgrind. + +Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") +Signed-off-by: Phil Sutter +(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) +--- + libxtables/xtables.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index ba9ceaeb3da41..0f617d80ae37e 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) + free(matchp->match->m); + matchp->match->m = NULL; + } ++ if (matchp->match->udata_size) { ++ free(matchp->match->udata); ++ matchp->match->udata = NULL; ++ } + if (matchp->match == matchp->match->next) { + free(matchp->match); + matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..e9c3cb0 --- /dev/null +++ b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,200 @@ +From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:27:03 +0100 +Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges + +While at it, fix xlate output for plain '-m ah' matches: With +ip6tables-translate, one should emit an extdhr exists match since +ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, +a simple 'meta l4proto ah' was missing. + +Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") +Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) + +Conflicts: + extensions/libip6t_ah.t + extensions/libip6t_ah.txlate + extensions/libipt_ah.t + extensions/libipt_ah.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_ah.c | 22 +++++++++++++--------- + extensions/libip6t_ah.t | 1 + + extensions/libip6t_ah.txlate | 6 ++++++ + extensions/libipt_ah.c | 22 ++++++++++++++-------- + extensions/libipt_ah.t | 1 + + extensions/libipt_ah.txlate | 6 ++++++ + 6 files changed, 41 insertions(+), 17 deletions(-) + +diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c +index f35982f379d76..0f95c4735eabd 100644 +--- a/extensions/libip6t_ah.c ++++ b/extensions/libip6t_ah.c +@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) + } + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + if (min == max) + printf("%s:%s%u", name, inv, min); + else +@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + char *space = ""; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); +@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, + } + + if (!space[0]) /* plain '-m ah' */ +- xt_xlate_add(xl, "meta l4proto ah"); ++ xt_xlate_add(xl, "exthdr ah exists"); + + return 1; + } +diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t +index c1898d44cf193..9099bdc9259c3 100644 +--- a/extensions/libip6t_ah.t ++++ b/extensions/libip6t_ah.t +@@ -13,3 +13,4 @@ + -m ah --ahspi 0:invalid;;FAIL + -m ah --ahspi;;FAIL + -m ah;=;OK ++-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate +index cc33ac2718c0c..32c6b7de00937 100644 +--- a/extensions/libip6t_ah.txlate ++++ b/extensions/libip6t_ah.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' + + ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT + nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' ++ ++ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr ah exists counter' ++ ++ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' +diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c +index fec5705ce6f53..39e3013d3e74b 100644 +--- a/extensions/libipt_ah.c ++++ b/extensions/libipt_ah.c +@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) + ahinfo->invflags |= IPT_AH_INV_SPI; + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); +@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); + else + xt_xlate_add(xl, "%u", ahinfo->spis[0]); ++ } else { ++ xt_xlate_add(xl, "meta l4proto ah"); + } + + return 1; +diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t +index cd853865638e8..1aeb607e9e986 100644 +--- a/extensions/libipt_ah.t ++++ b/extensions/libipt_ah.t +@@ -11,3 +11,4 @@ + -m ah --ahspi;;FAIL + -m ah;;FAIL + -p ah -m ah;=;OK ++-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate +index 897c82b5f95c6..baf5a0ae6182a 100644 +--- a/extensions/libipt_ah.txlate ++++ b/extensions/libipt_ah.txlate +@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' + + iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP + nft 'add rule ip filter INPUT ah spi != 50 counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto ah counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..902ade1 --- /dev/null +++ b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,117 @@ +From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:39:52 +0100 +Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges + +Also translate plain '-m frag' match into an exthdr exists one. + +Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) + +Conflicts: + extensions/libip6t_frag.t + extensions/libip6t_frag.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- + extensions/libip6t_frag.t | 1 + + extensions/libip6t_frag.txlate | 6 ++++++ + 3 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c +index 49c787e709a9e..ed7fe10a4716d 100644 +--- a/extensions/libip6t_frag.c ++++ b/extensions/libip6t_frag.c +@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) + } + } + ++static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_ids(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_ids_match(min, max, invert)) { + printf("%s", name); + if (min == max) + printf(":%s%u", inv, min); +@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, + static void frag_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 +- && fraginfo->ids[1] == 0xFFFFFFFF)) { +- printf("%s --fragid ", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ printf("%s --fragid ", inv_ids ? " !" : ""); + if (fraginfo->ids[0] + != fraginfo->ids[1]) + printf("%u:%u", +@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) + printf(" --fraglast"); + } + ++#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ ++ IP6T_FRAG_MF | IP6T_FRAG_NMF) ++ + static int frag_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_frag *fraginfo = + (struct ip6t_frag *)params->match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "frag id %s", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? +- "!= " : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); + if (fraginfo->ids[0] != fraginfo->ids[1]) + xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], + fraginfo->ids[1]); + else + xt_xlate_add(xl, "%u", fraginfo->ids[0]); + ++ } else if (!(fraginfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr frag exists"); ++ return 1; + } + + /* ignore ineffective IP6T_FRAG_LEN bit */ +diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t +index 299fa03f8845b..58417c90e9217 100644 +--- a/extensions/libip6t_frag.t ++++ b/extensions/libip6t_frag.t +@@ -1,4 +1,5 @@ + :INPUT,FORWARD,OUTPUT ++-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK + -m frag --fragid 1:42;=;OK + -m frag --fraglen 42;=;OK + -m frag --fragres;=;OK +diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate +index 33fc0631dc792..e250587e7682c 100644 +--- a/extensions/libip6t_frag.txlate ++++ b/extensions/libip6t_frag.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' + + ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT + nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' ++ ++ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr frag exists counter' ++ ++ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..1afcc54 --- /dev/null +++ b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,111 @@ +From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:42:10 +0100 +Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges + +Also translate '-m mh' into an exthdr exists match unless '-p mh' is +also present. The latter is converted into 'meta l4proto mh' which might +need fixing itself at a later point. + +Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) + +Conflicts: + extensions/libip6t_mh.t + extensions/libip6t_mh.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_mh.c | 20 ++++++++++++++++---- + extensions/libip6t_mh.t | 1 + + extensions/libip6t_mh.txlate | 9 +++++++++ + 3 files changed, 26 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 1410d324b5d42..3f80e28ec94c8 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + enum { + O_MH_TYPE = 0, +@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) + printf("%s", name); + } + ++static bool skip_types_match(uint8_t min, uint8_t max, bool inv) ++{ ++ return min == 0 && max == UINT8_MAX && !inv; ++} ++ + static void print_types(uint8_t min, uint8_t max, int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFF || invert) { ++ if (!skip_types_match(min, max, invert)) { + printf(" "); + if (min == max) { + printf("%s", inv); +@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, + static void mh_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) + return; + +- if (mhinfo->invflags & IP6T_MH_INV_TYPE) ++ if (inv_type) + printf(" !"); + + if (mhinfo->types[0] != mhinfo->types[1]) +@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; ++ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { ++ if (proto != IPPROTO_MH) ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; ++ } + + if (mhinfo->types[0] != mhinfo->types[1]) + xt_xlate_add(xl, "mh type %s%u-%u", +diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t +index 6b76d13d0a00f..be5439edc9520 100644 +--- a/extensions/libip6t_mh.t ++++ b/extensions/libip6t_mh.t +@@ -4,3 +4,4 @@ + -p mobility-header -m mh --mh-type 1;=;OK + -p mobility-header -m mh ! --mh-type 4;=;OK + -p mobility-header -m mh --mh-type 4:123;=;OK ++-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 4dfaf46a2b8d7..3364ce574468f 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac + + ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' ++ ++ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++ ++ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' ++ ++ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..c9ec110 --- /dev/null +++ b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,131 @@ +From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:45:42 +0100 +Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges + +Also translate plain '-m rt' match into an exthdr exists one. + +Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) + +Conflicts: + extensions/libip6t_rt.t + extensions/libip6t_rt.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- + extensions/libip6t_rt.t | 1 + + extensions/libip6t_rt.txlate | 9 +++++++++ + 3 files changed, 30 insertions(+), 8 deletions(-) + +diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c +index d5b0458bb397e..6db09f0b2cdc8 100644 +--- a/extensions/libip6t_rt.c ++++ b/extensions/libip6t_rt.c +@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) + } + } + ++static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_nums(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_segsleft_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, + static void rt_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + printf("%s --rt-type %u", +@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 +- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- printf("%s --rt-segsleft ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); + if (rtinfo->segsleft[0] + != rtinfo->segsleft[1]) + printf("%u:%u", +@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + + } + ++#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ ++ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) ++ + static int rt_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + xt_xlate_add(xl, "rt type%s %u", +@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "rt seg-left%s ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); + + if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) + xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], + rtinfo->segsleft[1]); + else + xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); ++ } else if (!(rtinfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr rt exists"); ++ return 1; + } + + if (rtinfo->flags & IP6T_RT_LEN) { +diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t +index 3c7b2d981324a..047b6880e354d 100644 +--- a/extensions/libip6t_rt.t ++++ b/extensions/libip6t_rt.t +@@ -3,3 +3,4 @@ + -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK + -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK + -m rt;=;OK ++-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK +diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate +index 3578bcba0157e..1c2f74a588750 100644 +--- a/extensions/libip6t_rt.txlate ++++ b/extensions/libip6t_rt.txlate +@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' + + ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT + nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' ++ ++ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..318d9eb --- /dev/null +++ b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,119 @@ +From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:47:09 +0100 +Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges + +Also add a translation for plain '-m esp' match which depends on the +address family: While ip6tables-translate may emit an exthdr exists +match, iptables-translate must stick to meta l4proto. + +Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) + +Conflicts: + extensions/libxt_esp.t + extensions/libxt_esp.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_esp.c | 26 ++++++++++++++++++-------- + extensions/libxt_esp.t | 1 + + extensions/libxt_esp.txlate | 12 ++++++++++++ + 3 files changed, 31 insertions(+), 8 deletions(-) + +diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c +index 2c7ff942cb9e0..8e9766d71ed57 100644 +--- a/extensions/libxt_esp.c ++++ b/extensions/libxt_esp.c +@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) + espinfo->invflags |= XT_ESP_INV_SPI; + } + ++static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spis_match(min, max, invert)) { + if (min == max) + printf(" %s:%s%u", name, inv, min); + else +@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void esp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_esp *espinfo = (struct xt_esp *)match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 +- && espinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --espspi ", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ printf("%s --espspi ", inv_spi ? " !" : ""); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("%u:%u", +@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "esp spi%s", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); + if (espinfo->spis[0] != espinfo->spis[1]) + xt_xlate_add(xl, " %u-%u", espinfo->spis[0], + espinfo->spis[1]); + else + xt_xlate_add(xl, " %u", espinfo->spis[0]); ++ } else if (afinfo->family == NFPROTO_IPV4) { ++ xt_xlate_add(xl, "meta l4proto esp"); ++ } else if (afinfo->family == NFPROTO_IPV6) { ++ xt_xlate_add(xl, "exthdr esp exists"); ++ } else { ++ return 0; + } + + return 1; +diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t +index 92c5779f860f1..37259d6b3a08f 100644 +--- a/extensions/libxt_esp.t ++++ b/extensions/libxt_esp.t +@@ -4,5 +4,6 @@ + -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK + -p esp -m esp ! --espspi 0:4294967294;=;OK + -p esp -m esp --espspi -1;;FAIL ++-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK + -p esp -m esp;=;OK + -m esp;;FAIL +diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate +index f6aba52f52235..5e8fb241beaf4 100644 +--- a/extensions/libxt_esp.txlate ++++ b/extensions/libxt_esp.txlate +@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' + + iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP + nft 'add rule ip filter INPUT esp spi 500-600 counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto esp counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch new file mode 100644 index 0000000..316e5dd --- /dev/null +++ b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch @@ -0,0 +1,47 @@ +From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:57:46 +0100 +Subject: [PATCH] extensions: ipcomp: Save inverted full ranges + +Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") +Signed-off-by: Phil Sutter +(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) + +Conflicts: + extensions/libxt_ipcomp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_ipcomp.c | 7 ++++--- + extensions/libxt_ipcomp.t | 1 + + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c +index 4171c4a1c4eb7..961c17e584933 100644 +--- a/extensions/libxt_ipcomp.c ++++ b/extensions/libxt_ipcomp.c +@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, + static void comp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; ++ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; + + if (!(compinfo->spis[0] == 0 +- && compinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ipcompspi ", +- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); ++ && compinfo->spis[1] == UINT32_MAX ++ && !inv_spi)) { ++ printf("%s --ipcompspi ", inv_spi ? " !" : ""); + if (compinfo->spis[0] + != compinfo->spis[1]) + printf("%u:%u", +diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t +index 8546ba9ce416f..47c1fbc220c6a 100644 +--- a/extensions/libxt_ipcomp.t ++++ b/extensions/libxt_ipcomp.t +@@ -1,3 +1,4 @@ + :INPUT,OUTPUT + -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK + -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK ++-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch new file mode 100644 index 0000000..cfeacd5 --- /dev/null +++ b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch @@ -0,0 +1,70 @@ +From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 2 Feb 2024 13:14:29 +0100 +Subject: [PATCH] nft: Do not omit full ranges if inverted + +Otherwise this turns a never matching rule into an always matching one. + +Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") +Signed-off-by: Phil Sutter +(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_udp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_tcp.t | 2 ++ + extensions/libxt_udp.t | 2 ++ + iptables/nft.c | 4 ++-- + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 7a3bbd08952f0..3caa3e3f50271 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,6 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index f534770191a6e..aa2c91770e63f 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,6 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ++-p udp -m udp ! --sport :;-p udp -m udp;OK ++-p udp -m udp ! --dport :;-p udp -m udp;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/iptables/nft.c b/iptables/nft.c +index 97fd4f49fdb4c..8e7a38ac93a3e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return 0; + } + +- if (src[0] || src[1] < 0xffff) { ++ if (src[0] || src[1] < UINT16_MAX || invert_src) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); + if (!expr) + return -ENOMEM; +@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return ret; + } + +- if (dst[0] || dst[1] < 0xffff) { ++ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); + if (!expr) + return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..326544f --- /dev/null +++ b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,304 @@ +From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 17:42:12 +0100 +Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges + +Also translate a bare '-m tcp/udp' to 'meta l4proto' match. + +Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") +Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_tcp.txlate + extensions/libxt_udp.t + extensions/libxt_udp.txlate +- Context change due to Missing commits adding test cases. +--- + extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- + extensions/libxt_tcp.t | 4 ++-- + extensions/libxt_tcp.txlate | 6 +++++ + extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- + extensions/libxt_udp.t | 4 ++-- + extensions/libxt_udp.txlate | 6 +++++ + 6 files changed, 72 insertions(+), 39 deletions(-) + +diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c +index f82572828649b..32bbd684fd5d7 100644 +--- a/extensions/libxt_tcp.c ++++ b/extensions/libxt_tcp.c +@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void tcp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; + +- if (tcpinfo->spts[0] != 0 +- || tcpinfo->spts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (tcpinfo->spts[0] + != tcpinfo->spts[1]) +@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) + tcpinfo->spts[0]); + } + +- if (tcpinfo->dpts[0] != 0 +- || tcpinfo->dpts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (tcpinfo->dpts[0] + != tcpinfo->dpts[1]) +@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, + { + const struct xt_tcp *tcpinfo = + (const struct xt_tcp *)params->match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; ++ bool xlated = false; + +- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { + if (tcpinfo->spts[0] != tcpinfo->spts[1]) { + xt_xlate_add(xl, "tcp sport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0], tcpinfo->spts[1]); + } else { + xt_xlate_add(xl, "tcp sport %s%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { + if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { + xt_xlate_add(xl, "tcp dport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0], tcpinfo->dpts[1]); + } else { + xt_xlate_add(xl, "tcp dport %s%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->option) ++ if (tcpinfo->option) { + xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, + tcpinfo->invflags & XT_TCP_INV_OPTION ? + "missing" : "exists"); ++ xlated = true; ++ } + + if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { + xt_xlate_add(xl, "tcp flags %s", +@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, + print_tcp_xlate(xl, tcpinfo->flg_cmp); + xt_xlate_add(xl, " / "); + print_tcp_xlate(xl, tcpinfo->flg_mask); ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto tcp"); ++ + return 1; + } + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 3caa3e3f50271..8baeeff2fc94b 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,8 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK +--p tcp -m tcp ! --sport :;-p tcp -m tcp;OK +--p tcp -m tcp ! --dport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate +index 9802ddfe0039e..b3ddcc15833cf 100644 +--- a/extensions/libxt_tcp.txlate ++++ b/extensions/libxt_tcp.txlate +@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' + + iptables-translate -A INPUT -p tcp ! --tcp-option 23 + nft 'add rule ip filter INPUT tcp option 23 missing counter' ++ ++iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' ++ ++iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' +diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c +index ba1c3eb768592..748d418039c3a 100644 +--- a/extensions/libxt_udp.c ++++ b/extensions/libxt_udp.c +@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void udp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_udp *udpinfo = (struct xt_udp *)match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; + +- if (udpinfo->spts[0] != 0 +- || udpinfo->spts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_SRCPT) ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (udpinfo->spts[0] + != udpinfo->spts[1]) +@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) + udpinfo->spts[0]); + } + +- if (udpinfo->dpts[0] != 0 +- || udpinfo->dpts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_DSTPT) ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (udpinfo->dpts[0] + != udpinfo->dpts[1]) +@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; ++ bool xlated = false; + +- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { + if (udpinfo->spts[0] != udpinfo->spts[1]) { + xt_xlate_add(xl,"udp sport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0], udpinfo->spts[1]); + } else { + xt_xlate_add(xl, "udp sport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0]); + } ++ xlated = true; + } + +- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { + if (udpinfo->dpts[0] != udpinfo->dpts[1]) { + xt_xlate_add(xl,"udp dport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0], udpinfo->dpts[1]); + } else { + xt_xlate_add(xl,"udp dport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0]); + } ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto udp"); ++ + return 1; + } + +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index aa2c91770e63f..0cde6ac30cc15 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,8 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK +--p udp -m udp ! --sport :;-p udp -m udp;OK +--p udp -m udp ! --dport :;-p udp -m udp;OK ++-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK ++-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate +index 28e7ca206b26b..d6bbb96f5d744 100644 +--- a/extensions/libxt_udp.txlate ++++ b/extensions/libxt_udp.txlate +@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep + + iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT + nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' ++ ++iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' ++ ++iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch new file mode 100644 index 0000000..46c636c --- /dev/null +++ b/0021-nft-Fix-for-broken-recover_rule_compat.patch @@ -0,0 +1,89 @@ +From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 27 Feb 2024 18:47:39 +0100 +Subject: [PATCH] nft: Fix for broken recover_rule_compat() + +When IPv4 rule generator was changed to emit payload instead of +meta expressions for l4proto matches, the code reinserting +NFTNL_RULE_COMPAT_* attributes into rules being reused for counter +zeroing was broken by accident. + +Make rule compat recovery aware of the alternative match, basically +reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules +with NFTA_RULE_COMPAT") but add a test case this time to make sure +things stay intact. + +Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") +Signed-off-by: Phil Sutter +(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) +--- + iptables/nft.c | 27 ++++++++++++++++--- + .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ + 2 files changed, 35 insertions(+), 4 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8e7a38ac93a3e..42907a431a99e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) + return strerror(err); + } + ++static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) ++{ ++ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); ++ uint32_t poff = offsetof(struct iphdr, protocol); ++ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; ++ ++ if (!strcmp(name, "payload") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); ++ return 0; ++ } ++ if (!strcmp(name, "meta") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); ++ return 0; ++ } ++ return -1; ++} ++ + static int recover_rule_compat(struct nftnl_rule *r) + { + struct nftnl_expr_iter *iter; +@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) + if (!e) + goto out; + +- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || +- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) ++ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ ++ if (l4proto_expr_get_dreg(e, ®) < 0) + goto next_expr; + +- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); +- + e = nftnl_expr_iter_next(iter); + if (!e) + goto out; +diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +new file mode 100755 +index 0000000000000..e276a953234cf +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +@@ -0,0 +1,12 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++set -e ++ ++rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" ++for cmd in iptables ip6tables; do ++ $XT_MULTI $cmd -t mangle -A PREROUTING $rule ++ $XT_MULTI $cmd -t mangle -Z ++ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" ++done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch new file mode 100644 index 0000000..0be13ca --- /dev/null +++ b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch @@ -0,0 +1,48 @@ +From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 5 Mar 2024 17:02:56 +0100 +Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match + +Since core xlate code now ignores '-p mh' if an mh extension is also +present in the rule, mh extension has to emit the l4proto match itself. +Therefore emit the exthdr match irrespective of '-p' argument value just +like other IPv6 extension header matches do. + +Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") +Signed-off-by: Phil Sutter +(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) +--- + extensions/libip6t_mh.c | 4 +--- + extensions/libip6t_mh.txlate | 2 +- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 3f80e28ec94c8..1a1cee832b584 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; + bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; +- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + + if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { +- if (proto != IPPROTO_MH) +- xt_xlate_add(xl, "exthdr mh exists"); ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; + } + +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 3364ce574468f..7eeaeefab6116 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' + + ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT +-nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' + + ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT + nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch new file mode 100644 index 0000000..a5e7994 --- /dev/null +++ b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch @@ -0,0 +1,48 @@ +From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 9 Apr 2024 13:18:12 +0200 +Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option + +Calling iptables with '-c ""' resulted in a call to strchr() with an +invalid pointer as 'optarg + 1' points to past the buffer. The most +simple fix is to drop the offset: The global optstring part specifies a +single colon after 'c', so getopt() enforces a valid pointer in optarg. +If it contains a comma at first position, packet counter value parsing +will fail so all cases are covered. + +Reported-by: gorbanev.es@gmail.com +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 +Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") +Signed-off-by: Phil Sutter +(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) +--- + extensions/iptables.t | 5 +++++ + iptables/xshared.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extensions/iptables.t b/extensions/iptables.t +index b4b6d677abab1..5d6d3d15cc5fd 100644 +--- a/extensions/iptables.t ++++ b/extensions/iptables.t +@@ -4,3 +4,8 @@ + -i eth+ -o alongifacename+;=;OK + ! -i eth0;=;OK + ! -o eth+;=;OK ++-c "";;FAIL ++-c ,3;;FAIL ++-c 3,;;FAIL ++-c ,;;FAIL ++-c 2,3 -j ACCEPT;-j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 690502c457dd0..f2e3bc03a2824 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], + set_option(&cs->options, OPT_COUNTERS, &args->invflags, + invert); + args->pcnt = optarg; +- args->bcnt = strchr(args->pcnt + 1, ','); ++ args->bcnt = strchr(args->pcnt, ','); + if (args->bcnt) + args->bcnt++; + if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/iptables.spec b/iptables.spec index 83b972c..bc0675d 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 8%{?dist} +Release: 9%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -30,6 +30,19 @@ Patch007: 0007-man-Do-not-escape-exclamation-marks.patch Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch +Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch +Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch +Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch +Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -37,7 +50,7 @@ License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) -# libnfnetlink-devel is requires for nfnl_osf +# libnfnetlink-devel is required for nfnl_osf BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers @@ -427,6 +440,9 @@ fi %changelog +* Wed Jul 03 2024 Phil Sutter - 1.8.10-9 +- Backport fixes from upstream + * Tue May 21 2024 Phil Sutter - 1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables From 4be8ae789abd28ae701aca4f05897a1a0f65b018 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:34:58 +0200 Subject: [PATCH 073/100] iptables-1.8.10-10 - Verify tarball GPG signature --- .gitignore | 1 + coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 +++++++++++++++++++++++++ iptables.spec | 40 +++++++++------- sources | 1 + 4 files changed, 89 insertions(+), 17 deletions(-) create mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt diff --git a/.gitignore b/.gitignore index 4cb5d7a..b61615f 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz +/iptables-1.8.10.tar.xz.sig diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt new file mode 100644 index 0000000..2d3b902 --- /dev/null +++ b/coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded +660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi +V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 +zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t +Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh +KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 +dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi +WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg +9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj ++IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR +U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 ++ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd +RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 +4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN +IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w +bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf +Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj +QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 +wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb +4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET +tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP +n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV +oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 +o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S +ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU +tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp +HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM +FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ +diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid +R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK +uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv +Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl +UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q +KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO +RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc +wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 +0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ +q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU +k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk +pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY +plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC +qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu +iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p +jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O +ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 +CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag +8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB +bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM +jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR +rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg +3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ +7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 +7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ +yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 +leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 +U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ +rlbu70nh2kSJrg== +=wukb +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index bc0675d..9d817f5 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,14 +11,16 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 9%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.xz -Source1: iptables.init -Source2: iptables-config -Source3: iptables.service -Source4: sysconfig_iptables -Source5: sysconfig_ip6tables -Source6: arptables-nft-helper +Release: 10%{?dist} +Source0: %{url}/files/%{name}-%{version}.tar.xz +source1: %{url}/files/%{name}-%{version}.tar.xz.sig +Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source3: iptables.init +Source4: iptables-config +Source5: iptables.service +Source6: sysconfig_iptables +Source7: sysconfig_ip6tables +Source8: arptables-nft-helper Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -179,6 +181,7 @@ Provides: ebtables nftables compatibility for iptables, arptables and ebtables. %prep +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 %build @@ -201,20 +204,20 @@ rm -f %{buildroot}%{_libdir}/*.la # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} -install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init +install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig -install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config +install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config -install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables -install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables +install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir} -sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service +install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} # install legacy actions for service command @@ -240,7 +243,7 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ +install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ touch %{buildroot}%{_libexecdir}/arptables-helper # prepare for alternatives @@ -440,6 +443,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-10 +- Verify tarball GPG signature + * Wed Jul 03 2024 Phil Sutter - 1.8.10-9 - Backport fixes from upstream diff --git a/sources b/sources index 59e259b..6015b94 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 +SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 From f61dd7d5ce88be4c6b9442a2eedaa598e6c6065f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:43:00 +0200 Subject: [PATCH 074/100] iptables-1.8.10-11 - Add missing build dependency --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 9d817f5..906c6f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -69,6 +69,7 @@ BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make +BuildRequires: gnupg2 %description The iptables utility controls the network packet filtering code in the @@ -443,6 +444,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-11 +- Add missing build dependency + * Fri Jul 05 2024 Phil Sutter - 1.8.10-10 - Verify tarball GPG signature From fdb7f30ead0154d756382d5523101154f1e7fc5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 14 Apr 2024 14:38:45 +0200 Subject: [PATCH 075/100] Fix build with %_sbindir==%_bindir and add compat sbin Provides For https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. nsntrace requires /usr/sbin/iptables. --- iptables.spec | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 906c6f4..ee41fa8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -178,6 +178,13 @@ Provides: iptables Provides: arptables Provides: ebtables +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description nft nftables compatibility for iptables, arptables and ebtables. @@ -254,8 +261,7 @@ touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink -rm -f %{buildroot}%{_bindir}/iptables-xml -ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %ldconfig_scriptlets @@ -444,6 +450,9 @@ fi %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-12 +- Rebuilt for the bin-sbin merge + * Fri Jul 05 2024 Phil Sutter - 1.8.10-11 - Add missing build dependency From d710b74abd664ed3cb4cb9d75ba59b5eea6d7404 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:46:20 +0200 Subject: [PATCH 076/100] Call alternatives without full path As part of https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin, alternatives is moved from /usr/sbin/alternatives to /usr/bin/alternatives. (This happened when alternatives rpm was rebuilt in a build environment with the updated definitions.) On traditional systems a compat symlink is created, so both paths work. This means that packages that use paths into /usr/sbin do not need to be rebuilt and will continue to work fine. Unfortunately, on ostree systems, the compat symlinks are missing, so calls to /usr/sbin/alternatives fail. There is no benefit from specifying the full path to binaries in scriptlets because the scriptlets are called with a well-defined $PATH. So drop the full path, so that the package works fine no matter where exactly alternatives is installed. --- iptables.spec | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/iptables.spec b/iptables.spec index ee41fa8..4d5876c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -268,7 +268,7 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -278,7 +278,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - /usr/sbin/update-alternatives --remove \ + update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -294,7 +294,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -320,7 +320,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -338,7 +338,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -358,7 +358,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -370,8 +370,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - /usr/sbin/update-alternatives --remove \ - $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi From 9ddeac8b47f05cbca9b732f176fb5ccf95da7f6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:50:40 +0200 Subject: [PATCH 077/100] Add changelog entry and bump release --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 4d5876c..fadaa3e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 12%{?dist} +Release: 13%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -449,6 +449,9 @@ fi %changelog +* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-13 +- Bump release and add changelog entry + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-12 - Rebuilt for the bin-sbin merge From 4d531018fe7b7c7b143fe1e28ffc6baa9ac8fec7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 11:27:43 +0200 Subject: [PATCH 078/100] Add unmerged-sbin compat also for -legacy subpackage There are two subpackages which provide /usr/s?bin/iptables: -nft and -legacy. In mock, for whatever reason, iptables-legacy was being installed, from the rebuild with merged-sbin, but since there was no dependency on the updated filesystem, an old version of filesystem was left, and only /usr/bin/iptables would available. --- iptables.spec | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fadaa3e..2737ddf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 13%{?dist} +Release: 14%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -89,6 +89,13 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description legacy The iptables utility controls the network packet filtering code in the Linux kernel. This package contains the legacy tools which are obsoleted by @@ -449,6 +456,9 @@ fi %changelog +* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-14 +- Add unmerged-sbin compat also for -legacy subpackage + * Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-13 - Bump release and add changelog entry From d9521ce9d679ccedc2d85f0892827d96b1919e53 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 10:33:34 +0000 Subject: [PATCH 079/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 2737ddf..90ba23e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 14%{?dist} +Release: 15%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -456,6 +456,9 @@ fi %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-14 - Add unmerged-sbin compat also for -legacy subpackage From bf80e3901433c9d04166e8ebbac18529f1b360d8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 8 Nov 2024 16:28:18 +0100 Subject: [PATCH 080/100] iptables-1.8.11-1 - new version --- .gitignore | 2 + ...another-segfault-due-to-chain-index-.patch | 81 ----- ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 ----- ...-Fix-corner-case-noflush-restore-bug.patch | 63 ---- ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 --- ...ants-support-v-update-OPTSTRING_COMM.patch | 31 -- ...n-line-number-formatting-with-legacy.patch | 28 -- ...-man-Do-not-escape-exclamation-marks.patch | 44 --- ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 --- ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ------- ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 --- ...se-Add-missing-braces-around-ternary.patch | 36 --- ...xtables-Fix-memleak-of-matches-udata.patch | 32 -- ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ------------ ...frag-Save-xlate-inverted-full-ranges.patch | 117 ------- ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 ------- ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 -------- ...-esp-Save-xlate-inverted-full-ranges.patch | 119 ------- ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 --- ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ---- ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ------------------ ...t-Fix-for-broken-recover_rule_compat.patch | 89 ----- ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 --- ...sing-of-empty-string-arg-in-c-option.patch | 48 --- coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 ---- coreteam-gpg-key-0xD70D1A666ACF2B21.txt | 64 ++++ iptables.spec | 35 +- sources | 4 +- 28 files changed, 76 insertions(+), 2018 deletions(-) delete mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch delete mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch delete mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch delete mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch delete mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch delete mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch delete mode 100644 0007-man-Do-not-escape-exclamation-marks.patch delete mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch delete mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch delete mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch delete mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch delete mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch delete mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch delete mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch delete mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch delete mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch delete mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch delete mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch delete mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch delete mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch delete mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch delete mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt create mode 100644 coreteam-gpg-key-0xD70D1A666ACF2B21.txt diff --git a/.gitignore b/.gitignore index b61615f..3814395 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz /iptables-1.8.10.tar.xz.sig +/iptables-1.8.11.tar.xz +/iptables-1.8.11.tar.xz.sig diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch deleted file mode 100644 index 35b5973..0000000 --- a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Oct 2023 17:27:42 +0200 -Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL - pointer - -Chain rename code missed to adjust the num_chains value which is used to -calculate the number of chain index buckets to allocate during an index -rebuild. So with the right number of chains present, the last chain in a -middle bucket being renamed (and ending up in another bucket) triggers -an index rebuild based on false data. The resulting NULL pointer index -bucket then causes a segfault upon reinsertion. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 -Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") -(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) ---- - .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ - libiptc/libiptc.c | 4 +++ - 2 files changed, 36 insertions(+) - create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 - -diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -new file mode 100755 -index 0000000000000..bc473d2511bbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -@@ -0,0 +1,32 @@ -+#!/bin/bash -+# -+# Another funny rename bug in libiptc: -+# If there is a chain index bucket with only a single chain in it and it is not -+# the last one and that chain is renamed, a chain index rebuild is triggered. -+# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an -+# extra index is allocated and remains NULL. The following insert of renamed -+# chain then segfaults. -+ -+( -+ echo "*filter" -+ # first bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-a-$i - [0:0]" -+ done -+ # second bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-b-$i - [0:0]" -+ done -+ # third bucket, just make sure it exists -+ echo ":chain-c-0 - [0:0]" -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore -+ -+# rename all chains of the middle bucket -+( -+ echo "*filter" -+ for ((i = 0; i < 40; i++)); do -+ echo "-E chain-b-$i chain-d-$i" -+ done -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore --noflush -diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c -index e475063367c26..9712a36353b9a 100644 ---- a/libiptc/libiptc.c -+++ b/libiptc/libiptc.c -@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, - return 0; - } - -+ handle->num_chains--; -+ - /* This only unlinks "c" from the list, thus no free(c) */ - iptcc_chain_index_delete_chain(c, handle); - - /* Change the name of the chain */ - strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); - -+ handle->num_chains++; -+ - /* Insert sorted into to list again */ - iptc_insert_chain(handle, c); - diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch deleted file mode 100644 index c384e4b..0000000 --- a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Fri, 3 Nov 2023 17:33:22 +0100 -Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage - -ARPT_ and IPT_INV flags are not interchangeable, e.g.: -define IPT_INV_SRCDEVADDR 0x0080 -define ARPT_INV_SRCDEVADDR 0x0010 - -as these flags can be tested by libarp_foo.so such checks can yield -incorrect results. - -Because arptables-nft uses existing code, e.g. xt_mark, it makes -sense to unify this completely by converting the last users of -ARPT_INV_ constants. - -Note that arptables-legacy does not do run-time module loading via -dlopen(). Functionaliy implemented by "extensions" in the -arptables-legacy git tree are built-in, so this doesn't break -arptables-legacy binaries. - -Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") -Signed-off-by: Florian Westphal -Signed-off-by: Phil Sutter -(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) ---- - extensions/libarpt_mangle.c | 4 ++-- - iptables/nft-arp.c | 2 +- - iptables/xshared.h | 4 +++- - 3 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c -index 765edf34781f3..a846e97ec8f27 100644 ---- a/extensions/libarpt_mangle.c -+++ b/extensions/libarpt_mangle.c -@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! --h-length not allowed for " - "--mangle-mac-s"); -@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! hln not allowed for --mangle-mac-d"); - if (e->arp.arhln != 6) -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index aed39ebdd5166..535dd6b83237b 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, - &args->d.naddrs); - - if ((args->s.naddrs > 1 || args->d.naddrs > 1) && -- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) -+ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) - xtables_error(PARAMETER_PROBLEM, - "! not allowed with multiple" - " source or destination IP addresses"); -diff --git a/iptables/xshared.h b/iptables/xshared.h -index a200e0d620ad3..5586385456a4d 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -80,7 +80,9 @@ struct xtables_target; - #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ - #define EBT_OPTSTRING OPTSTRING_COMMON "hv" - --/* define invflags which won't collide with IPT ones */ -+/* define invflags which won't collide with IPT ones. -+ * arptables-nft does NOT use the legacy ARPT_INV_* defines. -+ */ - #define IPT_INV_SRCDEVADDR 0x0080 - #define IPT_INV_TGTDEVADDR 0x0100 - #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch deleted file mode 100644 index 3386925..0000000 --- a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +++ /dev/null @@ -1,63 +0,0 @@ -From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 7 Nov 2023 19:12:14 +0100 -Subject: [PATCH] ebtables: Fix corner-case noflush restore bug - -Report came from firwalld, but this is actually rather hard to trigger. -Since a regular chain line prevents it, typical dump/restore use-cases -are unaffected. - -Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") -Cc: Eric Garver -Signed-off-by: Phil Sutter -(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) ---- - .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ - iptables/xtables-eb.c | 2 ++ - 2 files changed, 27 insertions(+) - create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 - -diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -new file mode 100755 -index 0000000000000..0def0ac58e7be ---- /dev/null -+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -@@ -0,0 +1,25 @@ -+#!/bin/sh -+# -+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: -+# - with --noflush -+# - a second table after the broute one -+# - A policy command but no chain line for BROUTING chain -+ -+set -e -+ -+case "$XT_MULTI" in -+*xtables-nft-multi) -+ ;; -+*) -+ echo "skip $XT_MULTI" -+ exit 0 -+ ;; -+esac -+ -+$XT_MULTI ebtables-restore --noflush < -Date: Sun, 19 Nov 2023 13:18:26 +0100 -Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused - -Drop the boolean, it was meant to disable some existence checks in -do_parse() prior to the caching rework. Now that do_parse() runs before -any caching is done, the checks in question don't exist anymore so drop -this relict. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) ---- - iptables/xshared.h | 1 - - iptables/xtables-translate.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index 5586385456a4d..c77556a1987dc 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -284,7 +284,6 @@ struct xt_cmd_parse { - bool restore; - int line; - int verbose; -- bool xlate; - struct xt_cmd_parse_ops *ops; - }; - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 88e0a6b639494..c019cd2991305 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - .table = *table, - .restore = restore, - .line = line, -- .xlate = true, - .ops = &h->ops->cmd_parse, - }; - struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch deleted file mode 100644 index c743e75..0000000 --- a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 19 Nov 2023 13:25:36 +0100 -Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON - -Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") -Signed-off-by: Phil Sutter -(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) ---- - iptables/xshared.h | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index c77556a1987dc..815b9d3e98726 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -75,10 +75,10 @@ struct xtables_globals; - struct xtables_rule_match; - struct xtables_target; - --#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" --#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" --#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ --#define EBT_OPTSTRING OPTSTRING_COMMON "hv" -+#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" -+#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" -+#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ -+#define EBT_OPTSTRING OPTSTRING_COMMON "h" - - /* define invflags which won't collide with IPT ones. - * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch deleted file mode 100644 index 07bea3a..0000000 --- a/0006-ebtables-Align-line-number-formatting-with-legacy.patch +++ /dev/null @@ -1,28 +0,0 @@ -From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 21 Nov 2023 22:58:47 +0100 -Subject: [PATCH] ebtables: Align line number formatting with legacy - -Legacy ebtables appends a dot to the number printed in first column if ---Ln flag was given. - -Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") -Signed-off-by: Phil Sutter -(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) ---- - iptables/nft-bridge.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index d9a8ad2b0f373..e414ef5584392 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, - struct iptables_command_state cs = {}; - - if (format & FMT_LINENUMBERS) -- printf("%d ", num); -+ printf("%d. ", num); - - nft_rule_to_ebtables_command_state(h, r, &cs); - __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch deleted file mode 100644 index b088c63..0000000 --- a/0007-man-Do-not-escape-exclamation-marks.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 13:29:17 +0100 -Subject: [PATCH] man: Do not escape exclamation marks - -This appears to be not necessary, also mandoc complains about it: - -| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! - -Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") -Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") -Signed-off-by: Phil Sutter -(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) ---- - extensions/libip6t_DNPT.man | 2 +- - extensions/libip6t_SNPT.man | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man -index 9b060f5b7179b..72c6ae5d422a2 100644 ---- a/extensions/libip6t_DNPT.man -+++ b/extensions/libip6t_DNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the SNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 -diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man -index 97e0071b43cc1..0c926978377a7 100644 ---- a/extensions/libip6t_SNPT.man -+++ b/extensions/libip6t_SNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the DNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch deleted file mode 100644 index c0bbec2..0000000 --- a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 20:21:49 +0100 -Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks - -In order to parse the mask, xtopt_parse_hostmask() calls -xtopt_parse_plenmask() thereby limiting netmask support to prefix -lengths (alternatively specified in IP address notation). - -In order to lift this impractical restriction, make -xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may -fall back to xtopt_parse_mask() which correctly initializes val.hmask -itself and indicates non-CIDR-compatible masks by setting val.hlen to --1. - -So in order to support these odd masks, it is sufficient for -xtopt_parse_plenmask() to skip its mask building from val.hlen value and -take whatever val.hmask contains. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) ---- - libxtables/xtoptions.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index b16bbfbe32311..d91a78f470eda 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - - xtopt_parse_plen(cb); - -+ /* may not be convertible to CIDR notation */ -+ if (cb->val.hlen == (uint8_t)-1) -+ goto out_put; -+ - memset(mask, 0xFF, sizeof(union nf_inet_addr)); - /* This shifting is AF-independent. */ - if (cb->val.hlen == 0) { -@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - mask[1] = htonl(mask[1]); - mask[2] = htonl(mask[2]); - mask[3] = htonl(mask[3]); -+out_put: - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); - } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch deleted file mode 100644 index 7745634..0000000 --- a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 19 Dec 2023 00:56:07 +0100 -Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting - -Parameter 'wait' passed to xtables_lock() signals three modes of -operation, depending on its value: - - 0: --wait not specified, do not wait if lock is busy --1: --wait specified without value, wait indefinitely until lock becomes - free ->0: Wait for 'wait' seconds for lock to become free, abort otherwise - -Since fixed commit, the first two cases were treated the same apart from -calling alarm(0), but that is a nop if no alarm is pending. Fix the code -by requesting a non-blocking flock() in the second case. While at it, -restrict the alarm setup to the third case only. - -Cc: Jethro Beekman -Cc: howardjohn@google.com -Cc: Antonio Ojea -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 -Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") -Signed-off-by: Phil Sutter -(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) ---- - .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ - iptables/xshared.c | 4 +- - 2 files changed, 57 insertions(+), 2 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 -new file mode 100755 -index 0000000000000..4481f966ce435 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 -@@ -0,0 +1,55 @@ -+#!/bin/bash -+ -+case "$XT_MULTI" in -+*xtables-legacy-multi) -+ ;; -+*) -+ echo skip $XT_MULTI -+ exit 0 -+ ;; -+esac -+ -+coproc RESTORE { $XT_MULTI iptables-restore; } -+echo "*filter" >&${RESTORE[1]} -+ -+ -+$XT_MULTI iptables -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 1 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "process waits when it should not" -+ exit 1 -+} -+wait $ipt_pid -+[[ $? -eq 0 ]] && { -+ echo "process exited 0 despite busy lock" -+ exit 1 -+} -+ -+t0=$(date +%s) -+$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT -+t1=$(date +%s) -+[[ $((t1 - t0)) -ge 3 ]] || { -+ echo "wait time not expired" -+ exit 1 -+} -+ -+$XT_MULTI iptables -w -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] || { -+ echo "no indefinite wait" -+ exit 1 -+} -+kill $ipt_pid -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "killed waiting iptables call did not exit in time" -+ exit 1 -+} -+ -+kill $RESTORE_PID -+wait -+exit 0 -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 5f75a0a57a023..690502c457dd0 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -270,7 +270,7 @@ static int xtables_lock(int wait) - return XT_LOCK_FAILED; - } - -- if (wait != -1) { -+ if (wait > 0) { - sigact_alarm.sa_handler = alarm_ignore; - sigact_alarm.sa_flags = SA_RESETHAND; - sigemptyset(&sigact_alarm.sa_mask); -@@ -278,7 +278,7 @@ static int xtables_lock(int wait) - alarm(wait); - } - -- if (flock(fd, LOCK_EX) == 0) -+ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) - return fd; - - if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch deleted file mode 100644 index ea88fa3..0000000 --- a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 17 Dec 2023 13:02:36 +0100 -Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK - -Do as the comment in xtopt_parse_hostmask() claims and omit -XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() -will catch the incompatibility. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) ---- - include/xtables.h | 1 - - libxtables/xtoptions.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/include/xtables.h b/include/xtables.h -index 087a1d600f9ae..9def9b43b6e58 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -61,7 +61,6 @@ struct in_addr; - * %XTTYPE_SYSLOGLEVEL: syslog level by name or number - * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) - * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length -- * (ptr: union nf_inet_addr; only host portion is stored) - * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) - * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) - * %XTTYPE_PORTRC: colon-separated port range (names acceptable), -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d91a78f470eda..ba68056dc99f7 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { - [XTTYPE_STRING] = -1, - [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), - [XTTYPE_HOST] = sizeof(union nf_inet_addr), -- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), - [XTTYPE_PROTOCOL] = sizeof(uint8_t), - [XTTYPE_PORT] = sizeof(uint16_t), - [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch deleted file mode 100644 index f348d59..0000000 --- a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 26 Jan 2024 18:43:10 +0100 -Subject: [PATCH] nft: ruleparse: Add missing braces around ternary - -The expression evaluated the sum before the ternay, consequently not -adding target->size if tgsize was zero. - -Identified by ASAN for a simple rule using standard target: -| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN -| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN -| ================================================================= -| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 -| READ of size 8 at 0x603000000120 thread T0 -| [...] - -Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") -Signed-off-by: Phil Sutter -(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) ---- - iptables/nft-ruleparse.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c -index c8322f936acd9..57fe27276de35 100644 ---- a/iptables/nft-ruleparse.c -+++ b/iptables/nft-ruleparse.c -@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) - if (!target) - return NULL; - -- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; -+ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); - - target->t = xtables_calloc(1, size); - target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch deleted file mode 100644 index 7d9c51f..0000000 --- a/0012-libxtables-Fix-memleak-of-matches-udata.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 31 Jan 2024 14:58:17 +0100 -Subject: [PATCH] libxtables: Fix memleak of matches' udata - -If the extension specifies a non-zero udata_size, field 'udata' points -to an allocated buffer which needs to be freed upon extension deinit. - -Interestingly, this bug was identified by ASAN and missed by valgrind. - -Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") -Signed-off-by: Phil Sutter -(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) ---- - libxtables/xtables.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index ba9ceaeb3da41..0f617d80ae37e 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) - free(matchp->match->m); - matchp->match->m = NULL; - } -+ if (matchp->match->udata_size) { -+ free(matchp->match->udata); -+ matchp->match->udata = NULL; -+ } - if (matchp->match == matchp->match->next) { - free(matchp->match); - matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index e9c3cb0..0000000 --- a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,200 +0,0 @@ -From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:27:03 +0100 -Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges - -While at it, fix xlate output for plain '-m ah' matches: With -ip6tables-translate, one should emit an extdhr exists match since -ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, -a simple 'meta l4proto ah' was missing. - -Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") -Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) - -Conflicts: - extensions/libip6t_ah.t - extensions/libip6t_ah.txlate - extensions/libipt_ah.t - extensions/libipt_ah.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_ah.c | 22 +++++++++++++--------- - extensions/libip6t_ah.t | 1 + - extensions/libip6t_ah.txlate | 6 ++++++ - extensions/libipt_ah.c | 22 ++++++++++++++-------- - extensions/libipt_ah.t | 1 + - extensions/libipt_ah.txlate | 6 ++++++ - 6 files changed, 41 insertions(+), 17 deletions(-) - -diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c -index f35982f379d76..0f95c4735eabd 100644 ---- a/extensions/libip6t_ah.c -+++ b/extensions/libip6t_ah.c -@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) - } - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - if (min == max) - printf("%s:%s%u", name, inv, min); - else -@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - char *space = ""; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); -@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, - } - - if (!space[0]) /* plain '-m ah' */ -- xt_xlate_add(xl, "meta l4proto ah"); -+ xt_xlate_add(xl, "exthdr ah exists"); - - return 1; - } -diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t -index c1898d44cf193..9099bdc9259c3 100644 ---- a/extensions/libip6t_ah.t -+++ b/extensions/libip6t_ah.t -@@ -13,3 +13,4 @@ - -m ah --ahspi 0:invalid;;FAIL - -m ah --ahspi;;FAIL - -m ah;=;OK -+-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate -index cc33ac2718c0c..32c6b7de00937 100644 ---- a/extensions/libip6t_ah.txlate -+++ b/extensions/libip6t_ah.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' - - ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT - nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' -+ -+ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr ah exists counter' -+ -+ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' -diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c -index fec5705ce6f53..39e3013d3e74b 100644 ---- a/extensions/libipt_ah.c -+++ b/extensions/libipt_ah.c -@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) - ahinfo->invflags |= IPT_AH_INV_SPI; - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - printf("%s", name); - if (min == max) { - printf(":%s", inv); -@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); - else - xt_xlate_add(xl, "%u", ahinfo->spis[0]); -+ } else { -+ xt_xlate_add(xl, "meta l4proto ah"); - } - - return 1; -diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t -index cd853865638e8..1aeb607e9e986 100644 ---- a/extensions/libipt_ah.t -+++ b/extensions/libipt_ah.t -@@ -11,3 +11,4 @@ - -m ah --ahspi;;FAIL - -m ah;;FAIL - -p ah -m ah;=;OK -+-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate -index 897c82b5f95c6..baf5a0ae6182a 100644 ---- a/extensions/libipt_ah.txlate -+++ b/extensions/libipt_ah.txlate -@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' - - iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP - nft 'add rule ip filter INPUT ah spi != 50 counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto ah counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 902ade1..0000000 --- a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,117 +0,0 @@ -From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:39:52 +0100 -Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges - -Also translate plain '-m frag' match into an exthdr exists one. - -Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) - -Conflicts: - extensions/libip6t_frag.t - extensions/libip6t_frag.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- - extensions/libip6t_frag.t | 1 + - extensions/libip6t_frag.txlate | 6 ++++++ - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c -index 49c787e709a9e..ed7fe10a4716d 100644 ---- a/extensions/libip6t_frag.c -+++ b/extensions/libip6t_frag.c -@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) - } - } - -+static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_ids(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_ids_match(min, max, invert)) { - printf("%s", name); - if (min == max) - printf(":%s%u", inv, min); -@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, - static void frag_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 -- && fraginfo->ids[1] == 0xFFFFFFFF)) { -- printf("%s --fragid ", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ printf("%s --fragid ", inv_ids ? " !" : ""); - if (fraginfo->ids[0] - != fraginfo->ids[1]) - printf("%u:%u", -@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) - printf(" --fraglast"); - } - -+#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ -+ IP6T_FRAG_MF | IP6T_FRAG_NMF) -+ - static int frag_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_frag *fraginfo = - (struct ip6t_frag *)params->match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "frag id %s", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? -- "!= " : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); - if (fraginfo->ids[0] != fraginfo->ids[1]) - xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], - fraginfo->ids[1]); - else - xt_xlate_add(xl, "%u", fraginfo->ids[0]); - -+ } else if (!(fraginfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr frag exists"); -+ return 1; - } - - /* ignore ineffective IP6T_FRAG_LEN bit */ -diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t -index 299fa03f8845b..58417c90e9217 100644 ---- a/extensions/libip6t_frag.t -+++ b/extensions/libip6t_frag.t -@@ -1,4 +1,5 @@ - :INPUT,FORWARD,OUTPUT -+-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK - -m frag --fragid 1:42;=;OK - -m frag --fraglen 42;=;OK - -m frag --fragres;=;OK -diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate -index 33fc0631dc792..e250587e7682c 100644 ---- a/extensions/libip6t_frag.txlate -+++ b/extensions/libip6t_frag.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' - - ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT - nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' -+ -+ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr frag exists counter' -+ -+ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 1afcc54..0000000 --- a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,111 +0,0 @@ -From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:42:10 +0100 -Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges - -Also translate '-m mh' into an exthdr exists match unless '-p mh' is -also present. The latter is converted into 'meta l4proto mh' which might -need fixing itself at a later point. - -Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) - -Conflicts: - extensions/libip6t_mh.t - extensions/libip6t_mh.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_mh.c | 20 ++++++++++++++++---- - extensions/libip6t_mh.t | 1 + - extensions/libip6t_mh.txlate | 9 +++++++++ - 3 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 1410d324b5d42..3f80e28ec94c8 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - enum { - O_MH_TYPE = 0, -@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) - printf("%s", name); - } - -+static bool skip_types_match(uint8_t min, uint8_t max, bool inv) -+{ -+ return min == 0 && max == UINT8_MAX && !inv; -+} -+ - static void print_types(uint8_t min, uint8_t max, int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFF || invert) { -+ if (!skip_types_match(min, max, invert)) { - printf(" "); - if (min == max) { - printf("%s", inv); -@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, - static void mh_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) - return; - -- if (mhinfo->invflags & IP6T_MH_INV_TYPE) -+ if (inv_type) - printf(" !"); - - if (mhinfo->types[0] != mhinfo->types[1]) -@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -+ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -+ if (proto != IPPROTO_MH) -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; -+ } - - if (mhinfo->types[0] != mhinfo->types[1]) - xt_xlate_add(xl, "mh type %s%u-%u", -diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t -index 6b76d13d0a00f..be5439edc9520 100644 ---- a/extensions/libip6t_mh.t -+++ b/extensions/libip6t_mh.t -@@ -4,3 +4,4 @@ - -p mobility-header -m mh --mh-type 1;=;OK - -p mobility-header -m mh ! --mh-type 4;=;OK - -p mobility-header -m mh --mh-type 4:123;=;OK -+-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 4dfaf46a2b8d7..3364ce574468f 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac - - ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' -+ -+ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+ -+ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' -+ -+ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index c9ec110..0000000 --- a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:45:42 +0100 -Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges - -Also translate plain '-m rt' match into an exthdr exists one. - -Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) - -Conflicts: - extensions/libip6t_rt.t - extensions/libip6t_rt.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- - extensions/libip6t_rt.t | 1 + - extensions/libip6t_rt.txlate | 9 +++++++++ - 3 files changed, 30 insertions(+), 8 deletions(-) - -diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c -index d5b0458bb397e..6db09f0b2cdc8 100644 ---- a/extensions/libip6t_rt.c -+++ b/extensions/libip6t_rt.c -@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) - } - } - -+static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_nums(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_segsleft_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, - static void rt_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - printf("%s --rt-type %u", -@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 -- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- printf("%s --rt-segsleft ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); - if (rtinfo->segsleft[0] - != rtinfo->segsleft[1]) - printf("%u:%u", -@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - - } - -+#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ -+ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) -+ - static int rt_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - xt_xlate_add(xl, "rt type%s %u", -@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "rt seg-left%s ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); - - if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) - xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], - rtinfo->segsleft[1]); - else - xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); -+ } else if (!(rtinfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr rt exists"); -+ return 1; - } - - if (rtinfo->flags & IP6T_RT_LEN) { -diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t -index 3c7b2d981324a..047b6880e354d 100644 ---- a/extensions/libip6t_rt.t -+++ b/extensions/libip6t_rt.t -@@ -3,3 +3,4 @@ - -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK - -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK - -m rt;=;OK -+-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK -diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate -index 3578bcba0157e..1c2f74a588750 100644 ---- a/extensions/libip6t_rt.txlate -+++ b/extensions/libip6t_rt.txlate -@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' - - ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT - nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' -+ -+ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 318d9eb..0000000 --- a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,119 +0,0 @@ -From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:47:09 +0100 -Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges - -Also add a translation for plain '-m esp' match which depends on the -address family: While ip6tables-translate may emit an exthdr exists -match, iptables-translate must stick to meta l4proto. - -Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) - -Conflicts: - extensions/libxt_esp.t - extensions/libxt_esp.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_esp.c | 26 ++++++++++++++++++-------- - extensions/libxt_esp.t | 1 + - extensions/libxt_esp.txlate | 12 ++++++++++++ - 3 files changed, 31 insertions(+), 8 deletions(-) - -diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c -index 2c7ff942cb9e0..8e9766d71ed57 100644 ---- a/extensions/libxt_esp.c -+++ b/extensions/libxt_esp.c -@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) - espinfo->invflags |= XT_ESP_INV_SPI; - } - -+static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spis_match(min, max, invert)) { - if (min == max) - printf(" %s:%s%u", name, inv, min); - else -@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void esp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_esp *espinfo = (struct xt_esp *)match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 -- && espinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --espspi ", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ printf("%s --espspi ", inv_spi ? " !" : ""); - if (espinfo->spis[0] - != espinfo->spis[1]) - printf("%u:%u", -@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "esp spi%s", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); - if (espinfo->spis[0] != espinfo->spis[1]) - xt_xlate_add(xl, " %u-%u", espinfo->spis[0], - espinfo->spis[1]); - else - xt_xlate_add(xl, " %u", espinfo->spis[0]); -+ } else if (afinfo->family == NFPROTO_IPV4) { -+ xt_xlate_add(xl, "meta l4proto esp"); -+ } else if (afinfo->family == NFPROTO_IPV6) { -+ xt_xlate_add(xl, "exthdr esp exists"); -+ } else { -+ return 0; - } - - return 1; -diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t -index 92c5779f860f1..37259d6b3a08f 100644 ---- a/extensions/libxt_esp.t -+++ b/extensions/libxt_esp.t -@@ -4,5 +4,6 @@ - -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK - -p esp -m esp ! --espspi 0:4294967294;=;OK - -p esp -m esp --espspi -1;;FAIL -+-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK - -p esp -m esp;=;OK - -m esp;;FAIL -diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate -index f6aba52f52235..5e8fb241beaf4 100644 ---- a/extensions/libxt_esp.txlate -+++ b/extensions/libxt_esp.txlate -@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' - - iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP - nft 'add rule ip filter INPUT esp spi 500-600 counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto esp counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch deleted file mode 100644 index 316e5dd..0000000 --- a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:57:46 +0100 -Subject: [PATCH] extensions: ipcomp: Save inverted full ranges - -Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") -Signed-off-by: Phil Sutter -(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) - -Conflicts: - extensions/libxt_ipcomp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_ipcomp.c | 7 ++++--- - extensions/libxt_ipcomp.t | 1 + - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c -index 4171c4a1c4eb7..961c17e584933 100644 ---- a/extensions/libxt_ipcomp.c -+++ b/extensions/libxt_ipcomp.c -@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, - static void comp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; -+ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; - - if (!(compinfo->spis[0] == 0 -- && compinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ipcompspi ", -- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); -+ && compinfo->spis[1] == UINT32_MAX -+ && !inv_spi)) { -+ printf("%s --ipcompspi ", inv_spi ? " !" : ""); - if (compinfo->spis[0] - != compinfo->spis[1]) - printf("%u:%u", -diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t -index 8546ba9ce416f..47c1fbc220c6a 100644 ---- a/extensions/libxt_ipcomp.t -+++ b/extensions/libxt_ipcomp.t -@@ -1,3 +1,4 @@ - :INPUT,OUTPUT - -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK - -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK -+-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch deleted file mode 100644 index cfeacd5..0000000 --- a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 2 Feb 2024 13:14:29 +0100 -Subject: [PATCH] nft: Do not omit full ranges if inverted - -Otherwise this turns a never matching rule into an always matching one. - -Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") -Signed-off-by: Phil Sutter -(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_udp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_tcp.t | 2 ++ - extensions/libxt_udp.t | 2 ++ - iptables/nft.c | 4 ++-- - 3 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 7a3bbd08952f0..3caa3e3f50271 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,6 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index f534770191a6e..aa2c91770e63f 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,6 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK -+-p udp -m udp ! --sport :;-p udp -m udp;OK -+-p udp -m udp ! --dport :;-p udp -m udp;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/iptables/nft.c b/iptables/nft.c -index 97fd4f49fdb4c..8e7a38ac93a3e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return 0; - } - -- if (src[0] || src[1] < 0xffff) { -+ if (src[0] || src[1] < UINT16_MAX || invert_src) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); - if (!expr) - return -ENOMEM; -@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return ret; - } - -- if (dst[0] || dst[1] < 0xffff) { -+ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); - if (!expr) - return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 326544f..0000000 --- a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 17:42:12 +0100 -Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges - -Also translate a bare '-m tcp/udp' to 'meta l4proto' match. - -Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") -Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_tcp.txlate - extensions/libxt_udp.t - extensions/libxt_udp.txlate -- Context change due to Missing commits adding test cases. ---- - extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- - extensions/libxt_tcp.t | 4 ++-- - extensions/libxt_tcp.txlate | 6 +++++ - extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- - extensions/libxt_udp.t | 4 ++-- - extensions/libxt_udp.txlate | 6 +++++ - 6 files changed, 72 insertions(+), 39 deletions(-) - -diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c -index f82572828649b..32bbd684fd5d7 100644 ---- a/extensions/libxt_tcp.c -+++ b/extensions/libxt_tcp.c -@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void tcp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; - -- if (tcpinfo->spts[0] != 0 -- || tcpinfo->spts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (tcpinfo->spts[0] - != tcpinfo->spts[1]) -@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) - tcpinfo->spts[0]); - } - -- if (tcpinfo->dpts[0] != 0 -- || tcpinfo->dpts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (tcpinfo->dpts[0] - != tcpinfo->dpts[1]) -@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, - { - const struct xt_tcp *tcpinfo = - (const struct xt_tcp *)params->match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; -+ bool xlated = false; - -- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { - if (tcpinfo->spts[0] != tcpinfo->spts[1]) { - xt_xlate_add(xl, "tcp sport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0], tcpinfo->spts[1]); - } else { - xt_xlate_add(xl, "tcp sport %s%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { - if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { - xt_xlate_add(xl, "tcp dport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0], tcpinfo->dpts[1]); - } else { - xt_xlate_add(xl, "tcp dport %s%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->option) -+ if (tcpinfo->option) { - xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, - tcpinfo->invflags & XT_TCP_INV_OPTION ? - "missing" : "exists"); -+ xlated = true; -+ } - - if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "tcp flags %s", -@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, - print_tcp_xlate(xl, tcpinfo->flg_cmp); - xt_xlate_add(xl, " / "); - print_tcp_xlate(xl, tcpinfo->flg_mask); -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto tcp"); -+ - return 1; - } - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 3caa3e3f50271..8baeeff2fc94b 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,8 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ---p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ---p tcp -m tcp ! --dport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate -index 9802ddfe0039e..b3ddcc15833cf 100644 ---- a/extensions/libxt_tcp.txlate -+++ b/extensions/libxt_tcp.txlate -@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' - - iptables-translate -A INPUT -p tcp ! --tcp-option 23 - nft 'add rule ip filter INPUT tcp option 23 missing counter' -+ -+iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' -+ -+iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' -diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c -index ba1c3eb768592..748d418039c3a 100644 ---- a/extensions/libxt_udp.c -+++ b/extensions/libxt_udp.c -@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void udp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_udp *udpinfo = (struct xt_udp *)match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; - -- if (udpinfo->spts[0] != 0 -- || udpinfo->spts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_SRCPT) -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (udpinfo->spts[0] - != udpinfo->spts[1]) -@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) - udpinfo->spts[0]); - } - -- if (udpinfo->dpts[0] != 0 -- || udpinfo->dpts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_DSTPT) -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (udpinfo->dpts[0] - != udpinfo->dpts[1]) -@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; -+ bool xlated = false; - -- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { - if (udpinfo->spts[0] != udpinfo->spts[1]) { - xt_xlate_add(xl,"udp sport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0], udpinfo->spts[1]); - } else { - xt_xlate_add(xl, "udp sport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0]); - } -+ xlated = true; - } - -- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { - if (udpinfo->dpts[0] != udpinfo->dpts[1]) { - xt_xlate_add(xl,"udp dport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0], udpinfo->dpts[1]); - } else { - xt_xlate_add(xl,"udp dport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0]); - } -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto udp"); -+ - return 1; - } - -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index aa2c91770e63f..0cde6ac30cc15 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,8 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ---p udp -m udp ! --sport :;-p udp -m udp;OK ---p udp -m udp ! --dport :;-p udp -m udp;OK -+-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK -+-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate -index 28e7ca206b26b..d6bbb96f5d744 100644 ---- a/extensions/libxt_udp.txlate -+++ b/extensions/libxt_udp.txlate -@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep - - iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT - nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' -+ -+iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' -+ -+iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch deleted file mode 100644 index 46c636c..0000000 --- a/0021-nft-Fix-for-broken-recover_rule_compat.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 27 Feb 2024 18:47:39 +0100 -Subject: [PATCH] nft: Fix for broken recover_rule_compat() - -When IPv4 rule generator was changed to emit payload instead of -meta expressions for l4proto matches, the code reinserting -NFTNL_RULE_COMPAT_* attributes into rules being reused for counter -zeroing was broken by accident. - -Make rule compat recovery aware of the alternative match, basically -reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules -with NFTA_RULE_COMPAT") but add a test case this time to make sure -things stay intact. - -Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") -Signed-off-by: Phil Sutter -(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) ---- - iptables/nft.c | 27 ++++++++++++++++--- - .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ - 2 files changed, 35 insertions(+), 4 deletions(-) - create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8e7a38ac93a3e..42907a431a99e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) - return strerror(err); - } - -+static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) -+{ -+ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); -+ uint32_t poff = offsetof(struct iphdr, protocol); -+ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; -+ -+ if (!strcmp(name, "payload") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); -+ return 0; -+ } -+ if (!strcmp(name, "meta") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -+ return 0; -+ } -+ return -1; -+} -+ - static int recover_rule_compat(struct nftnl_rule *r) - { - struct nftnl_expr_iter *iter; -@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) - if (!e) - goto out; - -- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || -- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) -+ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ -+ if (l4proto_expr_get_dreg(e, ®) < 0) - goto next_expr; - -- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -- - e = nftnl_expr_iter_next(iter); - if (!e) - goto out; -diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -new file mode 100755 -index 0000000000000..e276a953234cf ---- /dev/null -+++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -@@ -0,0 +1,12 @@ -+#!/bin/bash -+ -+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } -+ -+set -e -+ -+rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" -+for cmd in iptables ip6tables; do -+ $XT_MULTI $cmd -t mangle -A PREROUTING $rule -+ $XT_MULTI $cmd -t mangle -Z -+ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" -+done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch deleted file mode 100644 index 0be13ca..0000000 --- a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 5 Mar 2024 17:02:56 +0100 -Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match - -Since core xlate code now ignores '-p mh' if an mh extension is also -present in the rule, mh extension has to emit the l4proto match itself. -Therefore emit the exthdr match irrespective of '-p' argument value just -like other IPv6 extension header matches do. - -Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") -Signed-off-by: Phil Sutter -(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) ---- - extensions/libip6t_mh.c | 4 +--- - extensions/libip6t_mh.txlate | 2 +- - 2 files changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 3f80e28ec94c8..1a1cee832b584 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; - bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - - if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -- if (proto != IPPROTO_MH) -- xt_xlate_add(xl, "exthdr mh exists"); -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; - } - -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 3364ce574468f..7eeaeefab6116 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' - - ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT --nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' - - ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT - nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch deleted file mode 100644 index a5e7994..0000000 --- a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 9 Apr 2024 13:18:12 +0200 -Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option - -Calling iptables with '-c ""' resulted in a call to strchr() with an -invalid pointer as 'optarg + 1' points to past the buffer. The most -simple fix is to drop the offset: The global optstring part specifies a -single colon after 'c', so getopt() enforces a valid pointer in optarg. -If it contains a comma at first position, packet counter value parsing -will fail so all cases are covered. - -Reported-by: gorbanev.es@gmail.com -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 -Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") -Signed-off-by: Phil Sutter -(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) ---- - extensions/iptables.t | 5 +++++ - iptables/xshared.c | 2 +- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/extensions/iptables.t b/extensions/iptables.t -index b4b6d677abab1..5d6d3d15cc5fd 100644 ---- a/extensions/iptables.t -+++ b/extensions/iptables.t -@@ -4,3 +4,8 @@ - -i eth+ -o alongifacename+;=;OK - ! -i eth0;=;OK - ! -o eth+;=;OK -+-c "";;FAIL -+-c ,3;;FAIL -+-c 3,;;FAIL -+-c ,;;FAIL -+-c 2,3 -j ACCEPT;-j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 690502c457dd0..f2e3bc03a2824 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], - set_option(&cs->options, OPT_COUNTERS, &args->invflags, - invert); - args->pcnt = optarg; -- args->bcnt = strchr(args->pcnt + 1, ','); -+ args->bcnt = strchr(args->pcnt, ','); - if (args->bcnt) - args->bcnt++; - if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt deleted file mode 100644 index 2d3b902..0000000 --- a/coreteam-gpg-key-0xD55D978A8A1420E4.txt +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded -660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi -V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 -zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t -Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh -KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 -dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi -WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg -9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj -+IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR -U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB -tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC -VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ -CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 -+ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd -RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 -4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN -IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w -bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf -Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj -QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 -wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb -4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET -tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP -n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV -oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 -o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S -ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU -tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp -HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM -FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ -diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid -R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK -uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv -Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl -UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q -KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO -RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc -wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 -0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ -q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU -k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk -pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY -plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC -qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu -iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p -jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O -ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 -CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag -8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB -bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM -jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR -rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg -3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ -7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 -7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ -yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 -leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 -U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ -rlbu70nh2kSJrg== -=wukb ------END PGP PUBLIC KEY BLOCK----- diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt new file mode 100644 index 0000000..cd4a35b --- /dev/null +++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E +o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+ +2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w +nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ +P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF +qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK +5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz +ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX +u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT +/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b +cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L +LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF +8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL +5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK +AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi +Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR +VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF +RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B +uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE +zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq +ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v +3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X +iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi +wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/ +UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj +M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm +97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E +FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW +IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb +0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF +GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu +bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8 +QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD +Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU +3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR +yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS +C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K +klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I +zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST +Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM +X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh +5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB +woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT +njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl +yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU +hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv +BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj +ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh +hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP +tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s +E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H +fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv +CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT +EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ +gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC +9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W +oD8ElPP+m/v6iA== +=70vD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index 90ba23e..edea0ae 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,11 +10,11 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.10 -Release: 15%{?dist} +Version: 1.8.11 +Release: 1%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig -Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt Source3: iptables.init Source4: iptables-config Source5: iptables.service @@ -22,30 +22,6 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-nft-helper -Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch -Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch -Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch -Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch -Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch -Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch -Patch007: 0007-man-Do-not-escape-exclamation-marks.patch -Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch -Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch -Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch -Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch -Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch -Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch -Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch -Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch -Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch -Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch -Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch -Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch -Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch -Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch -Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch -Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -440,6 +416,7 @@ fi %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %{_sbindir}/ebtables-translate +%{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -448,6 +425,7 @@ fi %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* +%{_mandir}/man8/arptables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -456,6 +434,9 @@ fi %changelog +* Fri Nov 08 2024 Phil Sutter - 1.8.11-1 +- new version + * Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 6015b94..1f7b750 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 -SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 +SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2 From f8d67dc298024ae283e050e7af6b1afc23f26bed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 18:27:10 +0200 Subject: [PATCH 081/100] Use %sbin_merge_compat macro for brevity --- iptables.spec | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index edea0ae..c94f3d7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,12 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -161,12 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. From e18ea14e5e3c134b44d50e6456f249f6f3ee6860 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:31:44 +0100 Subject: [PATCH 082/100] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c94f3d7..cb9c4e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 1%{?dist} +Release: 2%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -424,6 +424,9 @@ fi %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Fri Nov 08 2024 Phil Sutter - 1.8.11-1 - new version From 43696a4be35ecb64b596d1db368cb736a91316e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 14 Jan 2025 14:59:44 +0100 Subject: [PATCH 083/100] Keep alternatives symlinks under /usr/sbin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit update-alternatives becomes unhappy when called with paths under /usr/bin and /usr/sbin that are mixed: >>> Non-critical error in post-install scriptlet: iptables-legacy-0:1.8.11-3.fc42.x86_64 >>> Scriptlet output: >>> the primary link for iptables must be /usr/sbin/iptables >>> >>> [RPM] %post(iptables-legacy-1.8.11-3.fc42.x86_64) scriptlet failed, exit status 2 Things will mostly work if we keep using the old path: * On new installs, /usr/sbin will be a symlink, so the /usr/sbin paths will just point to /usr/bin and both sets of paths will work equivalently. * On upgrades, we'll maintain the /usr/sbin paths, which should be fine also, since everything must support using those paths for compatiblity. * The only thing that will not work is the merging of /usr/sbin to ./bin once /usr/sbin only contains symlinks. The scriptlets in filesystem.rpm would need to be adjusted to handle that case (i.e. allow symlinks /usr/sbin/foo → ../bin/foo and /usr/sbin/foo → /etc/alternatives/foo to be removed). This special case can be handled later. --- iptables.spec | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index cb9c4e6..66f245a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 2%{?dist} +Release: 3%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -236,11 +236,17 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +%if "%{_sbindir}" == "%{_bindir}" +# We keep those symlinks in /usr/sbin for compatibility +mkdir -p %{buildroot}/usr/sbin +mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +%endif + %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -252,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables /usr/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -265,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -291,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -301,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=/usr/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -317,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=/usr/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -343,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd /usr/sbin/$cmd-nft done fi @@ -355,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -416,14 +422,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 +- Keep symlinks managed by alternatives under /usr/sbin + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-2 - Rebuilt for the bin-sbin merge (2nd attempt) From 2533c217e52cbe658e05afb25fc6bc2f912fca59 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 07:22:06 +0000 Subject: [PATCH 084/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 66f245a..b170a43 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 3%{?dist} +Release: 4%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -430,6 +430,9 @@ fi %changelog +* Fri Jan 17 2025 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 - Keep symlinks managed by alternatives under /usr/sbin From c8015c16af9b2260f1fda5ccd6920774fc4d2efc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 26 Mar 2025 14:03:28 -0400 Subject: [PATCH 085/100] Flatpak fix for "Keep alternatives symlinks under /usr/sbin" Even if specific %_*dir macros cannot be used, %_prefix must be used at a minimum to refer to the installation path of files from the given package. This is a requirement for flatpak builds. --- iptables.spec | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/iptables.spec b/iptables.spec index b170a43..f211aa9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,7 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -156,7 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -238,15 +238,15 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %if "%{_sbindir}" == "%{_bindir}" # We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +mkdir -p %{buildroot}%{_prefix}/sbin +mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ %endif %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -258,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -271,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -307,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -323,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -349,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -361,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -422,8 +422,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From a1603c18de94a6d18aa110c640ea27941ca5927c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 2 Apr 2025 15:01:46 +0200 Subject: [PATCH 086/100] Assimilate arptables-services Provide the service as part of iptables-services. The arptables-nft-helper was already quite similar to arptables-legacy-helper, it should serve fine for legacy arptables, too. --- arptables-nft-helper => arptables-helper | 0 arptables.service | 12 +++++++++ iptables.spec | 32 ++++++++++++++---------- 3 files changed, 31 insertions(+), 13 deletions(-) rename arptables-nft-helper => arptables-helper (100%) create mode 100644 arptables.service diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index f211aa9..d195a2c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -20,7 +20,8 @@ Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-nft-helper +Source8: arptables-helper +Source9: arptables.service # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -125,6 +126,10 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} BuildArch: noarch %description services @@ -155,6 +160,9 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 %sbin_merge_compat %{_prefix}/sbin/iptables @@ -188,16 +196,18 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -224,9 +234,6 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 @@ -285,14 +292,14 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post iptables.service ip6tables.service +%systemd_post arptables.service iptables.service ip6tables.service %preun services -%systemd_preun iptables.service ip6tables.service +%systemd_preun arptables.service iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun iptables.service ip6tables.service +%systemd_postun arptables.service iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -343,8 +350,7 @@ update-alternatives --install \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} %postun nft if [ $1 -eq 0 ]; then @@ -390,9 +396,11 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%{_unitdir}/{arp,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/arptables-helper %files utils %license COPYING @@ -415,7 +423,6 @@ fi %{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* @@ -424,7 +431,6 @@ fi %{_mandir}/man8/arptables-translate* %ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From 347e497e7205a827bf52674e20c05d5595c100e0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 02:05:13 +0200 Subject: [PATCH 087/100] Assimilate ebtables-services Provide the service as part of iptables-services. --- ebtables-config | 11 +++++ ebtables-helper | 102 +++++++++++++++++++++++++++++++++++++++++++++++ ebtables.service | 11 +++++ iptables.spec | 28 +++++++++---- 4 files changed, 145 insertions(+), 7 deletions(-) create mode 100644 ebtables-config create mode 100644 ebtables-helper create mode 100644 ebtables.service diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index d195a2c..2144ee0 100644 --- a/iptables.spec +++ b/iptables.spec @@ -22,6 +22,9 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-helper Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -130,6 +133,10 @@ Obsoletes: %{name}-ipv6 < 1.4.11.1 Conflicts: %{name}-nft < 1.8.11-5 Obsoletes: arptables-services < 0.0.5-16 Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -196,7 +203,7 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init -install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config @@ -204,10 +211,12 @@ install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6table install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -292,14 +301,17 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post arptables.service iptables.service ip6tables.service +%systemd_post arptables.service ebtables.service +%systemd_post iptables.service ip6tables.service %preun services -%systemd_preun arptables.service iptables.service ip6tables.service +%systemd_preun arptables.service ebtables.service +%systemd_preun iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun arptables.service iptables.service ip6tables.service +%systemd_postun arptables.service ebtables.service +%systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -397,10 +409,12 @@ fi %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} %config(noreplace) %{_sysconfdir}/sysconfig/arptables -%{_unitdir}/{arp,ip,ip6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} -%{_libexecdir}/arptables-helper +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING From 45128b30b581863eee82c03977fd0d57cd301acc Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:50:18 +0200 Subject: [PATCH 088/100] rpmlint: Fix for E: description-line-too-long --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 2144ee0..ce9a1ee 100644 --- a/iptables.spec +++ b/iptables.spec @@ -93,9 +93,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 From e71883b551ebfba9eb6cd16095612d43ad878547 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:52:40 +0200 Subject: [PATCH 089/100] rpmlint: Fix for W: dangling-relative-symlink The %ghost directives in %files sections pick up the symlinks installed by the iptables build system, when in fact these are maintained in Fedora by alternatives. To avoid the confusion, remove them. To avoid causing 'W: zero-perms-ghost', add a %attr statement to the respective %ghost lines. --- iptables.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/iptables.spec b/iptables.spec index ce9a1ee..5efa959 100644 --- a/iptables.spec +++ b/iptables.spec @@ -247,16 +247,11 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}%{_prefix}/sbin -mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ -%endif - %ldconfig_scriptlets %post legacy @@ -378,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -442,8 +437,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From b2d1af398f3799020bc82f5f71a999ccd9dba432 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 11:43:34 +0200 Subject: [PATCH 090/100] spec: Merge common non-symlink removal loops --- iptables.spec | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5efa959..c8927c8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -310,6 +310,23 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_prefix}/sbin/iptables pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ @@ -322,14 +339,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ @@ -338,18 +347,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ From ac4331ac14f14b40c09d5009ca958697c7b8d1a0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 13:15:57 +0200 Subject: [PATCH 091/100] iptables-1.8.11-5 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c8927c8..93641a9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 4%{?dist} +Release: 5%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -441,6 +441,9 @@ fi %changelog +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From b56d83fa63cfe3b2db4f9d3f2e367b17cec36d23 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 20 Apr 2025 09:15:04 -0700 Subject: [PATCH 092/100] Add patch to fix -C handling ( fixes rhbz#2360423 ) --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ++++++++++++++++++ iptables.spec | 8 +- 2 files changed, 179 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 93641a9..177c6fd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 5%{?dist} +Release: 6%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -25,6 +25,9 @@ Source9: arptables.service Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch: iptables-1.8.11-fix-interface-comparisons.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -441,6 +444,9 @@ fi %changelog +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + * Thu Apr 03 2025 Phil Sutter - 1.8.11-5 - iptables-services to assimilate arptables- and ebtables-services From 046b2467b46a166204cecce9a6adc5ccfbd09031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 12 Mar 2025 16:06:49 +0100 Subject: [PATCH 093/100] Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit 43696a4be35ecb64b596d1db368cb736a91316e8 and also the follow-up work from c8015c16af9b2260f1fda5ccd6920774fc4d2efc. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected. Issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2361004. --- iptables.spec | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/iptables.spec b/iptables.spec index 177c6fd..bc9f667 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 6%{?dist} +Release: 7%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -271,7 +272,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -315,7 +316,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_prefix}/sbin/{eb,arp}tables; do +for pfx in %{_sbindir}/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -330,8 +331,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +341,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +349,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -361,7 +362,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +374,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +438,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + * Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 - Add patch to fix -C handling ( fixes rhbz#2360423 ) From 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Sat, 3 May 2025 23:22:49 +0200 Subject: [PATCH 094/100] Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit 046b2467b46a166204cecce9a6adc5ccfbd09031. These changes break systems, see bz#2362648 and bz#2362808 for details. --- iptables.spec | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/iptables.spec b/iptables.spec index bc9f667..fac1bbf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 7%{?dist} +Release: 8%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,7 +64,6 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -259,8 +258,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -272,7 +271,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -285,8 +284,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -316,7 +315,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_sbindir}/{eb,arp}tables; do +for pfx in %{_prefix}/sbin/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -331,8 +330,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -341,7 +340,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -349,7 +348,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -362,7 +361,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -374,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -438,13 +437,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + * Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 - Keep symlinks managed by alternatives under /usr/bin From 90a211ef7302c29a98a674de8afb3f6c7a0ab3ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 7 May 2025 16:30:51 +0200 Subject: [PATCH 095/100] Move iptables symlinks to /usr/bin again This partially reverts commit 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems. --- iptables.spec | 60 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index fac1bbf..edcea9a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 8%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -268,10 +269,19 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +294,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,6 +307,15 @@ alternatives --set iptables $(/dev/null || : +done +%endif + %post services %systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service @@ -330,8 +349,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +359,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +367,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -358,10 +377,19 @@ update-alternatives --install \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +401,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +465,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + * Sat May 03 2025 Phil Sutter - 1.8.11-8 - Revert last release, it breaks alternatives symlinks From 6f0696f58a45a6c3265c6d9837e06da2ffce5270 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 13 May 2025 10:55:45 +0200 Subject: [PATCH 096/100] Use modern option name for "follower" symlinks --- iptables.spec | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/iptables.spec b/iptables.spec index edcea9a..b5d83c1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -263,11 +263,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -298,11 +298,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $( Date: Tue, 20 May 2025 23:54:42 +0200 Subject: [PATCH 097/100] Fix for ghost files not present in iptables-nft RPM When fixing for rpmlint warnings, the standard symlinks installed by package's 'make install' were removed but they are in fact necessary for the globbing in %files section to happen. Replace them by empty files after removal to fix this. Fixes: e71883b551ebfba9eb6cd16095612d43ad878547 --- iptables.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index b5d83c1..c7216fb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -251,7 +251,8 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml From cc26decabc00149c006f76fc10450ce15d707077 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 20 May 2025 23:59:29 +0200 Subject: [PATCH 098/100] iptables-1.8.11-10 - Fix for ghost files not present in iptables-nft RPM Resolves: rhbz#2365424 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c7216fb..cdf4f66 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 9%{?dist} +Release: 10%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + * Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged. From 8ce4421d204c44131cbdc96465cafcb1f5f71288 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:46:02 +0000 Subject: [PATCH 099/100] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index cdf4f66..837bf0a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Phil Sutter - 1.8.11-10 - Fix for ghost files not present in iptables-nft RPM From 6a017827bbf2ff7454a8f3f45937124175c05e43 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Oct 2025 11:21:29 -0400 Subject: [PATCH 100/100] - Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. --- iptables-1.8.11-command-options-fix.patch | 27 +++++++++++++++++++++++ iptables.spec | 10 +++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 iptables-1.8.11-command-options-fix.patch diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables.spec b/iptables.spec index 837bf0a..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -27,7 +27,10 @@ Source11: ebtables-helper Source12: ebtables-config # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch: iptables-1.8.11-fix-interface-comparisons.patch +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -473,6 +476,9 @@ fi %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + * Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild