From fb677ca83cc1a1ad64e67ae869318c8909650c47 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Aug 2020 17:57:13 +0200 Subject: [PATCH 01/79] iptables-1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message --- ...eck-consistency-with-NFT_CL_FAKE-too.patch | 40 +++++++++++++++++ ...mand-name-in-ip6tables-error-message.patch | 45 +++++++++++++++++++ iptables.spec | 8 +++- 3 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch create mode 100644 0004-nft-Fix-command-name-in-ip6tables-error-message.patch diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch new file mode 100644 index 0000000..abe95fe --- /dev/null +++ b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch @@ -0,0 +1,40 @@ +From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Jul 2020 15:39:31 +0200 +Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too + +Athough this cache level fetches table names only, it shouldn't skip the +consistency check. + +Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") +Signed-off-by: Phil Sutter +(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd) +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 638b18bc7e382..434cc10b82ce7 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -511,14 +511,14 @@ retry: + if (req->level >= NFT_CL_TABLES) + fetch_table_cache(h); + if (req->level == NFT_CL_FAKE) +- return; ++ goto genid_check; + if (req->level >= NFT_CL_CHAINS) + fetch_chain_cache(h, t, chains); + if (req->level >= NFT_CL_SETS) + fetch_set_cache(h, t, NULL); + if (req->level >= NFT_CL_RULES) + fetch_rule_cache(h, t); +- ++genid_check: + mnl_genid_get(h, &genid_check); + if (h->nft_genid != genid_check) { + flush_cache(h, h->cache, NULL); +-- +2.27.0 + diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch new file mode 100644 index 0000000..b9a83f6 --- /dev/null +++ b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch @@ -0,0 +1,45 @@ +From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 7 Aug 2020 13:48:28 +0200 +Subject: [PATCH] nft: Fix command name in ip6tables error message + +Upon errors, ip6tables-nft would prefix its error messages with +'iptables:' instead of 'ip6tables:'. Turns out the command name was +hard-coded, use 'progname' variable instead. +While being at it, merge the two mostly identical fprintf() calls into +one. + +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) +Signed-off-by: Phil Sutter +--- + iptables/xtables-standalone.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c +index dd6fb7919d2e1..7b71db62f1ea6 100644 +--- a/iptables/xtables-standalone.c ++++ b/iptables/xtables-standalone.c +@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + xtables_fini(); + + if (!ret) { +- if (errno == EINVAL) { +- fprintf(stderr, "iptables: %s. " +- "Run `dmesg' for more information.\n", +- nft_strerror(errno)); +- } else { +- fprintf(stderr, "iptables: %s.\n", +- nft_strerror(errno)); +- } ++ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), ++ (errno == EINVAL ? ++ " Run `dmesg' for more information." : "")); ++ + if (errno == EAGAIN) + exit(RESOURCE_PROBLEM); + } +-- +2.27.0 + diff --git a/iptables.spec b/iptables.spec index e20e38c..42ce8c2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -34,6 +34,8 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch +Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch +Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -446,6 +448,10 @@ fi %changelog +* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 +- nft: cache: Check consistency with NFT_CL_FAKE, too +- nft: Fix command name in ip6tables error message + * Tue Jul 28 2020 Fedora Release Engineering - 1.8.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 6e5ffdcd277f85c7b7c7b7ee7814f40dbe4dda9f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Aug 2020 17:57:13 +0200 Subject: [PATCH 02/79] iptables-1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message --- ...eck-consistency-with-NFT_CL_FAKE-too.patch | 40 +++++++++++++++++ ...mand-name-in-ip6tables-error-message.patch | 45 +++++++++++++++++++ iptables.spec | 8 +++- 3 files changed, 92 insertions(+), 1 deletion(-) create mode 100644 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch create mode 100644 0004-nft-Fix-command-name-in-ip6tables-error-message.patch diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch new file mode 100644 index 0000000..abe95fe --- /dev/null +++ b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch @@ -0,0 +1,40 @@ +From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Jul 2020 15:39:31 +0200 +Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too + +Athough this cache level fetches table names only, it shouldn't skip the +consistency check. + +Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") +Signed-off-by: Phil Sutter +(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd) +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 638b18bc7e382..434cc10b82ce7 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -511,14 +511,14 @@ retry: + if (req->level >= NFT_CL_TABLES) + fetch_table_cache(h); + if (req->level == NFT_CL_FAKE) +- return; ++ goto genid_check; + if (req->level >= NFT_CL_CHAINS) + fetch_chain_cache(h, t, chains); + if (req->level >= NFT_CL_SETS) + fetch_set_cache(h, t, NULL); + if (req->level >= NFT_CL_RULES) + fetch_rule_cache(h, t); +- ++genid_check: + mnl_genid_get(h, &genid_check); + if (h->nft_genid != genid_check) { + flush_cache(h, h->cache, NULL); +-- +2.27.0 + diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch new file mode 100644 index 0000000..b9a83f6 --- /dev/null +++ b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch @@ -0,0 +1,45 @@ +From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 7 Aug 2020 13:48:28 +0200 +Subject: [PATCH] nft: Fix command name in ip6tables error message + +Upon errors, ip6tables-nft would prefix its error messages with +'iptables:' instead of 'ip6tables:'. Turns out the command name was +hard-coded, use 'progname' variable instead. +While being at it, merge the two mostly identical fprintf() calls into +one. + +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) +Signed-off-by: Phil Sutter +--- + iptables/xtables-standalone.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c +index dd6fb7919d2e1..7b71db62f1ea6 100644 +--- a/iptables/xtables-standalone.c ++++ b/iptables/xtables-standalone.c +@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + xtables_fini(); + + if (!ret) { +- if (errno == EINVAL) { +- fprintf(stderr, "iptables: %s. " +- "Run `dmesg' for more information.\n", +- nft_strerror(errno)); +- } else { +- fprintf(stderr, "iptables: %s.\n", +- nft_strerror(errno)); +- } ++ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), ++ (errno == EINVAL ? ++ " Run `dmesg' for more information." : "")); ++ + if (errno == EAGAIN) + exit(RESOURCE_PROBLEM); + } +-- +2.27.0 + diff --git a/iptables.spec b/iptables.spec index e20e38c..42ce8c2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -34,6 +34,8 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch +Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch +Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -446,6 +448,10 @@ fi %changelog +* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 +- nft: cache: Check consistency with NFT_CL_FAKE, too +- nft: Fix command name in ip6tables error message + * Tue Jul 28 2020 Fedora Release Engineering - 1.8.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 730c58d40441a3e02712919ad84548d819a7d1bd Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 31 Oct 2020 16:49:52 -0700 Subject: [PATCH 03/79] Update to 1.8.6. Fixes bug #1893453 --- .gitignore | 1 + ...iptables-apply-not-getting-installed.patch | 42 ------------- ...mat-security-fixes-in-libip-6-t_icmp.patch | 60 ------------------- ...ate-don-t-fail-if-help-was-requested.patch | 58 ------------------ ...eck-consistency-with-NFT_CL_FAKE-too.patch | 40 ------------- ...mand-name-in-ip6tables-error-message.patch | 45 -------------- iptables.spec | 12 ++-- sources | 2 +- 8 files changed, 7 insertions(+), 253 deletions(-) delete mode 100644 0001-build-resolve-iptables-apply-not-getting-installed.patch delete mode 100644 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch delete mode 100644 0002-xtables-translate-don-t-fail-if-help-was-requested.patch delete mode 100644 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch delete mode 100644 0004-nft-Fix-command-name-in-ip6tables-error-message.patch diff --git a/.gitignore b/.gitignore index ae4c970..a72e3b2 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /iptables-1.8.3.tar.bz2 /iptables-1.8.4.tar.bz2 /iptables-1.8.5.tar.bz2 +/iptables-1.8.6.tar.bz2 diff --git a/0001-build-resolve-iptables-apply-not-getting-installed.patch b/0001-build-resolve-iptables-apply-not-getting-installed.patch deleted file mode 100644 index 26e08db..0000000 --- a/0001-build-resolve-iptables-apply-not-getting-installed.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001 -From: Jan Engelhardt -Date: Wed, 3 Jun 2020 15:38:48 +0200 -Subject: [PATCH] build: resolve iptables-apply not getting installed -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -ip6tables-apply gets installed but iptables-apply does not. -That is wrong. - -» make install DESTDIR=$PWD/r -» find r -name "*app*" -r/usr/local/sbin/ip6tables-apply -r/usr/local/share/man/man8/iptables-apply.8 -r/usr/local/share/man/man8/ip6tables-apply.8 - -Fixes: v1.8.5~87 -Signed-off-by: Jan Engelhardt -Signed-off-by: Pablo Neira Ayuso -(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b) -Signed-off-by: Phil Sutter ---- - iptables/Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/Makefile.am b/iptables/Makefile.am -index dc66b3cc09c08..2024dbf5cb88c 100644 ---- a/iptables/Makefile.am -+++ b/iptables/Makefile.am -@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ - ip6tables-save.8 iptables-extensions.8 \ - iptables-apply.8 ip6tables-apply.8 - --sbin_SCRIPT = iptables-apply -+sbin_SCRIPTS = iptables-apply - - if ENABLE_NFTABLES - man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ --- -2.27.0 - diff --git a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch b/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch deleted file mode 100644 index 1bdbbd1..0000000 --- a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= -Date: Wed, 14 Nov 2018 07:35:28 +0100 -Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") -introduced support for gcc feature to check format string against passed -argument. This commit adds missing bits to extenstions's libipt_icmp.c -and libip6t_icmp6.c that were causing build to fail. - -Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add") -Signed-off-by: Adam Gołębiowski -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Phil Sutter ---- - extensions/libip6t_icmp6.c | 4 ++-- - extensions/libipt_icmp.c | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c -index 45a71875722c4..cc7bfaeb72fd7 100644 ---- a/extensions/libip6t_icmp6.c -+++ b/extensions/libip6t_icmp6.c -@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, - type_name = icmp6_type_xlate(icmptype); - - if (type_name) { -- xt_xlate_add(xl, type_name); -+ xt_xlate_add(xl, "%s", type_name); - } else { - for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i) - if (icmpv6_codes[i].type == icmptype && -@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, - break; - - if (i != ARRAY_SIZE(icmpv6_codes)) -- xt_xlate_add(xl, icmpv6_codes[i].name); -+ xt_xlate_add(xl, "%s", icmpv6_codes[i].name); - else - return 0; - } -diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c -index 5418997668d4c..e76257c54708c 100644 ---- a/extensions/libipt_icmp.c -+++ b/extensions/libipt_icmp.c -@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype, - if (icmp_codes[i].type == icmptype && - icmp_codes[i].code_min == code_min && - icmp_codes[i].code_max == code_max) { -- xt_xlate_add(xl, icmp_codes[i].name); -+ xt_xlate_add(xl, "%s", icmp_codes[i].name); - return 1; - } - } --- -2.21.0 - diff --git a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch deleted file mode 100644 index 4fcb549..0000000 --- a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001 -From: Arturo Borrero Gonzalez -Date: Tue, 16 Jun 2020 11:20:42 +0200 -Subject: [PATCH] xtables-translate: don't fail if help was requested - -If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle -this case in do_command_xlate(). - -Before this patch, you would see: - - user@debian:~$ sudo iptables-translate -h - [..] - nft Unsupported command? - user@debian:~$ echo $? - 1 - -After this patch: - - user@debian:~$ sudo iptables-translate -h - [..] - user@debian:~$ echo $? - 0 - -Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") -Acked-by: Phil Sutter -Signed-off-by: Arturo Borrero Gonzalez -(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069) -Signed-off-by: Phil Sutter ---- - iptables/xtables-translate.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 5aa42496b5a48..363c8be15b3fa 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - - cs.restore = restore; - -- if (!restore) -+ if (!restore && p.command != CMD_NONE) - printf("nft "); - - switch (p.command) { -@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - break; - case CMD_SET_POLICY: - break; -+ case CMD_NONE: -+ ret = 1; -+ break; - default: - /* We should never reach this... */ - printf("Unsupported command?\n"); --- -2.27.0 - diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch deleted file mode 100644 index abe95fe..0000000 --- a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch +++ /dev/null @@ -1,40 +0,0 @@ -From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Jul 2020 15:39:31 +0200 -Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too - -Athough this cache level fetches table names only, it shouldn't skip the -consistency check. - -Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check") -Signed-off-by: Phil Sutter -(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd) -Signed-off-by: Phil Sutter ---- - iptables/nft-cache.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c -index 638b18bc7e382..434cc10b82ce7 100644 ---- a/iptables/nft-cache.c -+++ b/iptables/nft-cache.c -@@ -511,14 +511,14 @@ retry: - if (req->level >= NFT_CL_TABLES) - fetch_table_cache(h); - if (req->level == NFT_CL_FAKE) -- return; -+ goto genid_check; - if (req->level >= NFT_CL_CHAINS) - fetch_chain_cache(h, t, chains); - if (req->level >= NFT_CL_SETS) - fetch_set_cache(h, t, NULL); - if (req->level >= NFT_CL_RULES) - fetch_rule_cache(h, t); -- -+genid_check: - mnl_genid_get(h, &genid_check); - if (h->nft_genid != genid_check) { - flush_cache(h, h->cache, NULL); --- -2.27.0 - diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch deleted file mode 100644 index b9a83f6..0000000 --- a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch +++ /dev/null @@ -1,45 +0,0 @@ -From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 7 Aug 2020 13:48:28 +0200 -Subject: [PATCH] nft: Fix command name in ip6tables error message - -Upon errors, ip6tables-nft would prefix its error messages with -'iptables:' instead of 'ip6tables:'. Turns out the command name was -hard-coded, use 'progname' variable instead. -While being at it, merge the two mostly identical fprintf() calls into -one. - -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) -Signed-off-by: Phil Sutter ---- - iptables/xtables-standalone.c | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - -diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c -index dd6fb7919d2e1..7b71db62f1ea6 100644 ---- a/iptables/xtables-standalone.c -+++ b/iptables/xtables-standalone.c -@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) - xtables_fini(); - - if (!ret) { -- if (errno == EINVAL) { -- fprintf(stderr, "iptables: %s. " -- "Run `dmesg' for more information.\n", -- nft_strerror(errno)); -- } else { -- fprintf(stderr, "iptables: %s.\n", -- nft_strerror(errno)); -- } -+ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), -+ (errno == EINVAL ? -+ " Run `dmesg' for more information." : "")); -+ - if (errno == EAGAIN) - exit(RESOURCE_PROBLEM); - } --- -2.27.0 - diff --git a/iptables.spec b/iptables.spec index 42ce8c2..21cd8f1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.5 -Release: 3%{?dist} +Version: 1.8.6 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,11 +32,6 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch -Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch -Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch -Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -448,6 +443,9 @@ fi %changelog +* Sat Oct 31 2020 Kevin Fenzi - 1.8.6-1 +- Update to 1.8.6. Fixes bug #1893453 + * Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message diff --git a/sources b/sources index a7e9f94..ece3ae2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8 +SHA512 (iptables-1.8.6.tar.bz2) = d06e4cddb69822c4618664a35877fc5811992936cade2040bb0e4eb25a4d879eadc7c84401c40fb39ffac7888568505adcb1cfe995cd166a15c702237daf6acf From e922d284f823879ec8985b305b345963aa8c9f7e Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Thu, 5 Nov 2020 11:55:03 +0100 Subject: [PATCH 04/79] Remove build dependency on autogen --- iptables.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 21cd8f1..3d7f652 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -51,7 +51,6 @@ BuildRequires: pkgconfig(libmnl) >= 1.0 BuildRequires: pkgconfig(libnftnl) >= 1.1.5 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel -BuildRequires: autogen BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool @@ -443,6 +442,9 @@ fi %changelog +* Thu Nov 5 2020 Florian Weimer - 1.8.6-2 +- Remove build dependency on autogen + * Sat Oct 31 2020 Kevin Fenzi - 1.8.6-1 - Update to 1.8.6. Fixes bug #1893453 From d2237b3900401f30d610639c08f9477e0d28e9b3 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 16 Nov 2020 13:57:14 +0100 Subject: [PATCH 05/79] iptables-1.8.6-3 - Drop obsolete StandardOutput setting from unit file - Remove StandardError setting from unit file, its value is default --- iptables.service | 2 -- iptables.spec | 6 +++++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/iptables.service b/iptables.service index 6722c7a..342ac93 100644 --- a/iptables.service +++ b/iptables.service @@ -11,8 +11,6 @@ ExecReload=/usr/libexec/iptables/iptables.init reload ExecStop=/usr/libexec/iptables/iptables.init stop Environment=BOOTUP=serial Environment=CONSOLETYPE=serial -StandardOutput=syslog -StandardError=syslog [Install] WantedBy=basic.target diff --git a/iptables.spec b/iptables.spec index 3d7f652..6fd5eef 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -442,6 +442,10 @@ fi %changelog +* Mon Nov 16 13:39:22 CET 2020 Phil Sutter - 1.8.6-3 +- Drop obsolete StandardOutput setting from unit file +- Remove StandardError setting from unit file, its value is default + * Thu Nov 5 2020 Florian Weimer - 1.8.6-2 - Remove build dependency on autogen From 4ef8aaebbe6d2223197a3ce86a056949368aca86 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 17 Nov 2020 14:27:08 +0100 Subject: [PATCH 06/79] iptables-1.8.6-4 - ebtables: Fix for broken chain renaming --- ...tables-Fix-for-broken-chain-renaming.patch | 60 +++++++++++++++++++ iptables.spec | 7 ++- 2 files changed, 66 insertions(+), 1 deletion(-) create mode 100644 0001-ebtables-Fix-for-broken-chain-renaming.patch diff --git a/0001-ebtables-Fix-for-broken-chain-renaming.patch b/0001-ebtables-Fix-for-broken-chain-renaming.patch new file mode 100644 index 0000000..b7c0afe --- /dev/null +++ b/0001-ebtables-Fix-for-broken-chain-renaming.patch @@ -0,0 +1,60 @@ +From 55b7c71dce7144f4dc0297c17abf0f04879ee247 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Nov 2020 11:38:27 +0100 +Subject: [iptables PATCH] ebtables: Fix for broken chain renaming + +Loading extensions pollutes 'errno' value, hence before using it to +indicate failure it should be sanitized. This was done by the called +function before the parsing/netlink split and not migrated by accident. +Move it into calling code to clarify the connection. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 3 --- + iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++ + iptables/xtables-eb.c | 1 + + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 39882a443a974..411e2597205c9 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1896,9 +1896,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain, + return 0; + } + +- /* Config load changed errno. Ensure genuine info for our callers. */ +- errno = 0; +- + /* Find the old chain to be renamed */ + c = nft_chain_find(h, table, chain); + if (c == NULL) { +diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +index 0c1eb4ca66f52..6f11bd12593dd 100755 +--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 ++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then + exit 1 + fi + ++$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 ++ + $XT_MULTI ebtables -t $t -F || exit 0 +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 6641a21a72d32..5e4184b8e80de 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + else if (strchr(argv[optind], ' ') != NULL) + xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); + ++ errno = 0; + ret = nft_cmd_chain_user_rename(h, chain, *table, + argv[optind]); + if (ret != 0 && errno == ENOENT) +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index 6fd5eef..f80a798 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,6 +32,8 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif +Patch1: 0001-ebtables-Fix-for-broken-chain-renaming.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -442,6 +444,9 @@ fi %changelog +* Tue Nov 17 14:05:30 CET 2020 Phil Sutter - 1.8.6-4 +- ebtables: Fix for broken chain renaming + * Mon Nov 16 13:39:22 CET 2020 Phil Sutter - 1.8.6-3 - Drop obsolete StandardOutput setting from unit file - Remove StandardError setting from unit file, its value is default From 5ce62f1362cc63eed17018582871fa2de94e8e24 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 17 Nov 2020 15:40:28 +0100 Subject: [PATCH 07/79] iptables-1.8.5-4 - ebtables: Fix for broken chain renaming --- ...tables-Fix-for-broken-chain-renaming.patch | 66 +++++++++++++++++++ iptables.spec | 6 +- 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 0005-ebtables-Fix-for-broken-chain-renaming.patch diff --git a/0005-ebtables-Fix-for-broken-chain-renaming.patch b/0005-ebtables-Fix-for-broken-chain-renaming.patch new file mode 100644 index 0000000..2ad2518 --- /dev/null +++ b/0005-ebtables-Fix-for-broken-chain-renaming.patch @@ -0,0 +1,66 @@ +From 1b7ca0bdd7284d750f894f59e48f9a8b0da82076 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Nov 2020 11:38:27 +0100 +Subject: [PATCH] ebtables: Fix for broken chain renaming + +Loading extensions pollutes 'errno' value, hence before using it to +indicate failure it should be sanitized. This was done by the called +function before the parsing/netlink split and not migrated by accident. +Move it into calling code to clarify the connection. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247) + + Conflicts: + iptables/nft.c + +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 3 --- + iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++ + iptables/xtables-eb.c | 1 + + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 0c5a74fc232c6..2e4b91916b332 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1936,9 +1936,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain, + + nft_xt_builtin_init(h, table); + +- /* Config load changed errno. Ensure genuine info for our callers. */ +- errno = 0; +- + /* Find the old chain to be renamed */ + c = nft_chain_find(h, table, chain); + if (c == NULL) { +diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +index 0c1eb4ca66f52..6f11bd12593dd 100755 +--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 ++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then + exit 1 + fi + ++$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 ++ + $XT_MULTI ebtables -t $t -F || exit 0 +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 375a95d1d5c75..6df5839f07436 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + else if (strchr(argv[optind], ' ') != NULL) + xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); + ++ errno = 0; + ret = nft_cmd_chain_user_rename(h, chain, *table, + argv[optind]); + if (ret != 0 && errno == ENOENT) +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index 42ce8c2..dcba8eb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -36,6 +36,7 @@ Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch +Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -448,6 +449,9 @@ fi %changelog +* Tue Nov 17 14:37:49 CET 2020 Phil Sutter - 1.8.5-4 +- ebtables: Fix for broken chain renaming + * Tue Aug 25 15:56:10 GMT 2020 Phil Sutter - 1.8.5-3 - nft: cache: Check consistency with NFT_CL_FAKE, too - nft: Fix command name in ip6tables error message From 706150b129c945e887c203d96492d03046199bd2 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Mon, 13 Jul 2020 20:18:37 +0000 Subject: [PATCH 08/79] Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro --- iptables.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/iptables.spec b/iptables.spec index f80a798..23d5e98 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.6 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -151,7 +151,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool rm -f include/linux/types.h -make %{?_smp_mflags} +%make_build %if 0%{?bootstrap} pushd bootstrap_ver @@ -165,7 +165,7 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool rm -f include/linux/types.h -make %{?_smp_mflags} +%make_build popd %endif @@ -178,7 +178,7 @@ popd -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print %endif -make install DESTDIR=%{buildroot} +%make_install # remove la file(s) rm -f %{buildroot}/%{_libdir}/*.la @@ -444,6 +444,9 @@ fi %changelog +* Thu Nov 19 17:32:24 CET 2020 Tom Stellard - 1.8.6-5 +- Use make macros + * Tue Nov 17 14:05:30 CET 2020 Phil Sutter - 1.8.6-4 - ebtables: Fix for broken chain renaming From ab5d74c2b9d2a4c783f27e3c3f104ace4e3a3786 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 19 Dec 2020 00:54:33 +0000 Subject: [PATCH 09/79] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- iptables.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/iptables.spec b/iptables.spec index 23d5e98..2ff73b5 100644 --- a/iptables.spec +++ b/iptables.spec @@ -56,6 +56,7 @@ BuildRequires: libpcap-devel BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool +BuildRequires: make Requires: %{name}-libs%{?_isa} = %{version}-%{release} %if 0%{?fedora} > 24 Conflicts: setup < 2.10.4-1 From 1c2b75e472ee9d0aa4807a450d61f4bec138b664 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 16 Jan 2021 13:35:56 -0800 Subject: [PATCH 10/79] Update to 1.8.7. Fixes rhbz#1916948 --- .gitignore | 1 + ...tables-Fix-for-broken-chain-renaming.patch | 60 ------------------- iptables.spec | 9 +-- sources | 2 +- 4 files changed, 7 insertions(+), 65 deletions(-) delete mode 100644 0001-ebtables-Fix-for-broken-chain-renaming.patch diff --git a/.gitignore b/.gitignore index a72e3b2..d5a31d9 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /iptables-1.8.4.tar.bz2 /iptables-1.8.5.tar.bz2 /iptables-1.8.6.tar.bz2 +/iptables-1.8.7.tar.bz2 diff --git a/0001-ebtables-Fix-for-broken-chain-renaming.patch b/0001-ebtables-Fix-for-broken-chain-renaming.patch deleted file mode 100644 index b7c0afe..0000000 --- a/0001-ebtables-Fix-for-broken-chain-renaming.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55b7c71dce7144f4dc0297c17abf0f04879ee247 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Nov 2020 11:38:27 +0100 -Subject: [iptables PATCH] ebtables: Fix for broken chain renaming - -Loading extensions pollutes 'errno' value, hence before using it to -indicate failure it should be sanitized. This was done by the called -function before the parsing/netlink split and not migrated by accident. -Move it into calling code to clarify the connection. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter ---- - iptables/nft.c | 3 --- - iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++ - iptables/xtables-eb.c | 1 + - 3 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 39882a443a974..411e2597205c9 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1896,9 +1896,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain, - return 0; - } - -- /* Config load changed errno. Ensure genuine info for our callers. */ -- errno = 0; -- - /* Find the old chain to be renamed */ - c = nft_chain_find(h, table, chain); - if (c == NULL) { -diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 -index 0c1eb4ca66f52..6f11bd12593dd 100755 ---- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 -+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 -@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then - exit 1 - fi - -+$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1 -+$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1 -+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 -+ - $XT_MULTI ebtables -t $t -F || exit 0 -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 6641a21a72d32..5e4184b8e80de 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - else if (strchr(argv[optind], ' ') != NULL) - xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); - -+ errno = 0; - ret = nft_cmd_chain_user_rename(h, chain, *table, - argv[optind]); - if (ret != 0 && errno == ENOENT) --- -2.28.0 - diff --git a/iptables.spec b/iptables.spec index 2ff73b5..3057989 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.6 -Release: 5%{?dist} +Version: 1.8.7 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,8 +32,6 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-ebtables-Fix-for-broken-chain-renaming.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -445,6 +443,9 @@ fi %changelog +* Sat Jan 16 2021 Kevin Fenzi - 1.8.7-1 +- Update to 1.8.7. Fixes rhbz#1916948 + * Thu Nov 19 17:32:24 CET 2020 Tom Stellard - 1.8.6-5 - Use make macros diff --git a/sources b/sources index ece3ae2..e9a1323 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.6.tar.bz2) = d06e4cddb69822c4618664a35877fc5811992936cade2040bb0e4eb25a4d879eadc7c84401c40fb39ffac7888568505adcb1cfe995cd166a15c702237daf6acf +SHA512 (iptables-1.8.7.tar.bz2) = c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75 From 4ee1618a2fc6d4c1ae8eb4ffdfe43d38e699b45c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 14:28:12 +0000 Subject: [PATCH 11/79] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 3057989..c218724 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -443,6 +443,9 @@ fi %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.8.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sat Jan 16 2021 Kevin Fenzi - 1.8.7-1 - Update to 1.8.7. Fixes rhbz#1916948 From 0075af4c46a40dbda2381d3a4515aa53fac399a2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 27 Jan 2021 19:07:17 +0100 Subject: [PATCH 12/79] tests: Disable invalid test Since Fedora moved to cgroupsv2, this test does not apply anymore. --- tests/tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/tests.yml b/tests/tests.yml index dead758..a0b531d 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -21,7 +21,7 @@ roles: - role: standard-test-rhts tests: - - backport-iptables-add-libxt-cgroup-frontend +# - backport-iptables-add-libxt-cgroup-frontend - initscript-sanity - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets - ip6tables-service-does-not-allow-dhcpv6-client-by From 648ffbc31613acd9f9015892c0820df9be00cb89 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 28 Jan 2021 14:44:50 +0100 Subject: [PATCH 13/79] ebtables: Exit gracefully on invalid table names --- ...it-gracefully-on-invalid-table-names.patch | 51 +++++++++++++++++++ iptables.spec | 7 ++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch diff --git a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch new file mode 100644 index 0000000..ba625a2 --- /dev/null +++ b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -0,0 +1,51 @@ +From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 Jan 2021 01:09:56 +0100 +Subject: [PATCH] ebtables: Exit gracefully on invalid table names + +Users are able to cause program abort by passing a table name that +doesn't exist: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. +| Aborted + +Avoid this by checking table existence just like iptables-nft does upon +parsing '-t' optarg. Since the list of tables is known and fixed, +checking the given name's length is pointless. So just drop that check +in return. + +With this patch in place, output looks much better: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist +| Perhaps iptables or your kernel needs to be upgraded. + +Signed-off-by: Phil Sutter +Signed-off-by: Phil Sutter +--- + iptables/xtables-eb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index cfa9317c78e94..5bb34d6d292a9 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -914,10 +914,10 @@ print_zero: + xtables_error(PARAMETER_PROBLEM, + "The -t option (seen in line %u) cannot be used in %s.\n", + line, xt_params->program_name); +- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) +- xtables_error(PARAMETER_PROBLEM, +- "Table name length cannot exceed %d characters", +- EBT_TABLE_MAXNAMELEN - 1); ++ if (!nft_table_builtin_find(h, optarg)) ++ xtables_error(VERSION_PROBLEM, ++ "table '%s' does not exist", ++ optarg); + *table = optarg; + table_set = true; + break; +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index c218724..eb8e3e2 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,6 +32,8 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif +Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -443,6 +445,9 @@ fi %changelog +* Thu Jan 28 2021 Phil Sutter - 1.8.7-3 +- ebtables: Exit gracefully on invalid table names + * Tue Jan 26 2021 Fedora Release Engineering - 1.8.7-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 180cccf6eafd120c50470d70fec579077f0e173b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 28 Jan 2021 15:25:20 +0100 Subject: [PATCH 14/79] iptables-1.8.5-5 - ebtables: Exit gracefully on invalid table names Resolves: RHBZ#1908259 --- ...it-gracefully-on-invalid-table-names.patch | 51 +++++++++++++++++++ iptables.spec | 6 ++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch diff --git a/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch new file mode 100644 index 0000000..ba625a2 --- /dev/null +++ b/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -0,0 +1,51 @@ +From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 Jan 2021 01:09:56 +0100 +Subject: [PATCH] ebtables: Exit gracefully on invalid table names + +Users are able to cause program abort by passing a table name that +doesn't exist: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. +| Aborted + +Avoid this by checking table existence just like iptables-nft does upon +parsing '-t' optarg. Since the list of tables is known and fixed, +checking the given name's length is pointless. So just drop that check +in return. + +With this patch in place, output looks much better: + +| # ebtables-nft -t dummy -P INPUT ACCEPT +| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist +| Perhaps iptables or your kernel needs to be upgraded. + +Signed-off-by: Phil Sutter +Signed-off-by: Phil Sutter +--- + iptables/xtables-eb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index cfa9317c78e94..5bb34d6d292a9 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -914,10 +914,10 @@ print_zero: + xtables_error(PARAMETER_PROBLEM, + "The -t option (seen in line %u) cannot be used in %s.\n", + line, xt_params->program_name); +- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) +- xtables_error(PARAMETER_PROBLEM, +- "Table name length cannot exceed %d characters", +- EBT_TABLE_MAXNAMELEN - 1); ++ if (!nft_table_builtin_find(h, optarg)) ++ xtables_error(VERSION_PROBLEM, ++ "table '%s' does not exist", ++ optarg); + *table = optarg; + table_set = true; + break; +-- +2.28.0 + diff --git a/iptables.spec b/iptables.spec index dcba8eb..4a30653 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -37,6 +37,7 @@ Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch +Patch6: 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -449,6 +450,9 @@ fi %changelog +* Thu Jan 28 2021 Phil Sutter - 1.8.5-5 +- ebtables: Exit gracefully on invalid table names + * Tue Nov 17 14:37:49 CET 2020 Phil Sutter - 1.8.5-4 - ebtables: Fix for broken chain renaming From bc305c871c0d19690cd0be598a55b56a565d0886 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Mon, 1 Feb 2021 17:38:05 +0100 Subject: [PATCH 15/79] Disable failing test in role standard-test-beakerlib as well Missed this one in previous commit. --- tests/tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/tests.yml b/tests/tests.yml index a0b531d..97069b7 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -43,7 +43,7 @@ roles: - role: standard-test-beakerlib tests: - - backport-iptables-add-libxt-cgroup-frontend +# - backport-iptables-add-libxt-cgroup-frontend - initscript-sanity - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets - ip6tables-service-does-not-allow-dhcpv6-client-by From cf6ddaf2539e452b7606b10454ff0cadee5dfcc1 Mon Sep 17 00:00:00 2001 From: Robert Scheck Date: Sat, 30 Jan 2021 22:59:17 +0100 Subject: [PATCH 16/79] Spec file cleanup --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index eb8e3e2..b0ed611 100644 --- a/iptables.spec +++ b/iptables.spec @@ -17,7 +17,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities -URL: http://www.netfilter.org/projects/iptables +URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 @@ -181,7 +181,7 @@ popd %make_install # remove la file(s) -rm -f %{buildroot}/%{_libdir}/*.la +rm -f %{buildroot}%{_libdir}/*.la # install ip*tables.h header files install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/ @@ -332,7 +332,6 @@ if [ $1 -eq 0 ]; then fi %files -%{!?_licensedir:%global license %%doc} %license COPYING %doc INCOMPATIBILITIES %if 0%{?fedora} <= 24 From f04bde23a01002f45c03863516e994c7332a37b3 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 17 Feb 2021 02:45:05 +0100 Subject: [PATCH 17/79] iptables-1.8.7-4 - Drop bootstrap code again - Drop workarounds for F24 and lower - Fix iptables-utils summary - Ship iptables-apply with iptables-utils - Reduce files sections by use of globbing - Ship common man pages with iptables-libs - Ship *-translate man pages with iptables-nft - Move legacy iptables binaries, libraries and headers into sub-packages - Introduce compat sub-package to help with above transitions - Drop libipulog header from devel package, this belongs to libnetfilter_log - Do not ship internal headers in devel package --- iptables.spec | 245 +++++++++++++++++++++----------------------------- 1 file changed, 102 insertions(+), 143 deletions(-) diff --git a/iptables.spec b/iptables.spec index b0ed611..09ac10c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -4,14 +4,6 @@ # service legacy actions (RHBZ#748134) %global legacy_actions %{_libexecdir}/initscripts/legacy-actions -# Bootstrap mode providing old and new versions of libip{4,6}tc in parallel -%global bootstrap 0 - -%if 0%{?bootstrap} -%global version_old 1.8.2 -%global iptc_so_ver_old 0 -%global ipXtc_so_ver_old 0 -%endif %global iptc_so_ver 0 %global ipXtc_so_ver 2 @@ -19,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -27,10 +19,6 @@ Source3: iptables.service Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -%if 0%{?bootstrap} -Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 -Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch -%endif Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -57,22 +45,54 @@ BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make -Requires: %{name}-libs%{?_isa} = %{version}-%{release} -%if 0%{?fedora} > 24 -Conflicts: setup < 2.10.4-1 -%endif -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives %description The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. +%package compat +Summary: Temporary transitioning package +Obsoletes: %{name} < 1.8.7-4 +Requires: %{name}-legacy = %{version}-%{release} +Requires: %{name}-utils = %{version}-%{release} + +%description compat +This package only exists to help transition iptables users to the new +package split. It will be removed after one distribution release cycle, please +do not reference it or depend on it in any way. + +%package legacy +Summary: Legacy tools for managing Linux kernel packet filtering capabilities +Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Conflicts: setup < 2.10.4-1 +Requires(post): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives +%if 0%{?rhel} < 9 +Provides: iptables +%endif + +%description legacy +The iptables utility controls the network packet filtering code in the +Linux kernel. This package contains the legacy tools which are obsoleted by +nft-variants in iptables-nft package for backwards compatibility reasons. +If you need to set up firewalls and/or IP masquerading, you should not install +this package but either nftables or iptables-nft instead. + %package libs -Summary: iptables libraries +Summary: libxtables and iptables extensions userspace support %description libs +libxtables and associated shared object files + +Libxtables provides unified access to iptables extensions in userspace. Data +and logic for those is kept in per-extension shared object files. + +%package legacy-libs +Summary: iptables legacy libraries + +%description legacy-libs iptables libraries. Please remember that libip*tc libraries do neither have a stable API nor a real so version. @@ -81,14 +101,23 @@ For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 - %package devel Summary: Development package for iptables -Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} +# XXX: Drop this after two releases or so +Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release} Requires: pkgconfig %description devel -iptables development headers and libraries. +libxtables development headers and pkgconfig files + +%package legacy-devel +Summary: Development package for legacy iptables +Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} +Requires: pkgconfig + +%description legacy-devel +Legacy iptables development headers and pkgconfig files The iptc libraries are marked as not public by upstream. The interface is not stable and may change with every new version. It is therefore unsupported. @@ -109,14 +138,15 @@ This package provides the services iptables and ip6tables that have been split out of the base package since they are not active by default anymore. %package utils -Summary: iptables and ip6tables services for iptables +Summary: iptables and ip6tables misc utilities Requires: %{name} = %{version}-%{release} %description utils Utils for iptables This package provides nfnl_osf with the pf.os database and nfbpf_compile, -a bytecode generator for use with xt_bpf. +a bytecode generator for use with xt_bpf. Also included is iptables-apply, +a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables @@ -133,14 +163,6 @@ nftables compatibility for iptables, arptables and ebtables. %prep %autosetup -p1 -%if 0%{?bootstrap} -%{__mkdir} -p bootstrap_ver -pushd bootstrap_ver -%{__tar} --strip-components=1 -xf %{SOURCE7} -%{__patch} -p1 <%{SOURCE8} -popd -%endif - %build ./autogen.sh CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ @@ -154,44 +176,11 @@ rm -f include/linux/types.h %make_build -%if 0%{?bootstrap} -pushd bootstrap_ver -./autogen.sh -CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \ -%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr - -# do not use rpath -sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool -sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool - -rm -f include/linux/types.h - -%make_build -popd -%endif - %install -%if 0%{?bootstrap} -%make_install -C bootstrap_ver -%{_bindir}/find %{buildroot} -xtype f -not \ - -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print -%{_bindir}/find %{buildroot} -type l -not \ - -name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print -%endif - %make_install # remove la file(s) rm -f %{buildroot}%{_libdir}/*.la -# install ip*tables.h header files -install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/ -install -d -m 755 %{buildroot}%{_includedir}/iptables -install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/ - -# install ipulog header file -install -d -m 755 %{buildroot}%{_includedir}/libipulog/ -install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/ - # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init @@ -230,10 +219,8 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic -%if 0%{?fedora} > 24 # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -%endif install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ touch %{buildroot}%{_libexecdir}/arptables-helper @@ -246,7 +233,7 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 %ldconfig_scriptlets -%post +%post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ @@ -257,7 +244,7 @@ pfx6=%{_sbindir}/ip6tables --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save -%postun +%postun legacy if [ $1 -eq 0 ]; then %{_sbindir}/update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy @@ -331,119 +318,91 @@ if [ $1 -eq 0 ]; then done fi -%files +%files compat + +%files legacy %license COPYING %doc INCOMPATIBILITIES -%if 0%{?fedora} <= 24 -%{_sysconfdir}/ethertypes -%endif -%{_sbindir}/iptables-apply -%{_sbindir}/ip6tables-apply -%{_sbindir}/iptables-legacy* -%{_sbindir}/ip6tables-legacy* +%{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* -%{_mandir}/man8/iptables* -%{_mandir}/man8/ip6tables* %{_mandir}/man8/xtables-legacy* -%ghost %{_sbindir}/iptables -%ghost %{_sbindir}/iptables-restore -%ghost %{_sbindir}/iptables-save -%ghost %{_sbindir}/ip6tables -%ghost %{_sbindir}/ip6tables-restore -%ghost %{_sbindir}/ip6tables-save +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs -%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}* -%if 0%{?bootstrap} -%{_libdir}/libiptc.so.%{iptc_so_ver_old}* -%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}* -%endif %{_libdir}/libxtables.so.12* %dir %{_libdir}/xtables -%{_libdir}/xtables/libipt* -%{_libdir}/xtables/libip6t* -%{_libdir}/xtables/libxt* +%{_libdir}/xtables/lib{ip,ip6,x}t* +%{_mandir}/man8/ip{,6}tables.8.gz +%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz + +%files legacy-libs +%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}* %files devel -%dir %{_includedir}/iptables -%{_includedir}/iptables/*.h -%{_includedir}/*.h +%{_includedir}/xtables{,-version}.h +%{_libdir}/libxtables.so +%{_libdir}/pkgconfig/xtables.pc + +%files legacy-devel %dir %{_includedir}/libiptc %{_includedir}/libiptc/*.h -%dir %{_includedir}/libipulog -%{_includedir}/libipulog/*.h %{_libdir}/libip*tc.so -%{_libdir}/libxtables.so -%{_libdir}/pkgconfig/libiptc.pc -%{_libdir}/pkgconfig/libip4tc.pc -%{_libdir}/pkgconfig/libip6tc.pc -%{_libdir}/pkgconfig/xtables.pc +%{_libdir}/pkgconfig/libip{,4,6}tc.pc %files services %dir %{script_path} -%{script_path}/iptables.init -%{script_path}/ip6tables.init -%config(noreplace) %{_sysconfdir}/sysconfig/iptables -%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables -%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config -%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config -%{_unitdir}/iptables.service -%{_unitdir}/ip6tables.service -%dir %{legacy_actions}/iptables -%{legacy_actions}/iptables/save -%{legacy_actions}/iptables/panic -%dir %{legacy_actions}/ip6tables -%{legacy_actions}/ip6tables/save -%{legacy_actions}/ip6tables/panic +%{script_path}/ip{,6}tables.init +%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} +%{_unitdir}/ip{,6}tables.service +%dir %{legacy_actions}/ip{,6}tables +%{legacy_actions}/ip{,6}tables/{save,panic} %files utils %{_sbindir}/nfnl_osf %{_sbindir}/nfbpf_compile +%{_sbindir}/ip{,6}tables-apply %dir %{_datadir}/xtables %{_datadir}/xtables/pf.os %{_mandir}/man8/nfnl_osf* %{_mandir}/man8/nfbpf_compile* +%{_mandir}/man8/ip{,6}tables-apply* %files nft -%{_sbindir}/iptables-nft* -%{_sbindir}/iptables-restore-translate -%{_sbindir}/iptables-translate -%{_sbindir}/ip6tables-nft* -%{_sbindir}/ip6tables-restore-translate -%{_sbindir}/ip6tables-translate -%{_sbindir}/ebtables-nft* -%{_sbindir}/arptables-nft* +%{_sbindir}/ip{,6}tables-nft* +%{_sbindir}/ip{,6}tables{,-restore}-translate +%{_sbindir}/{eb,arp}tables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %dir %{_libdir}/xtables -%{_libdir}/xtables/libarpt* -%{_libdir}/xtables/libebt* +%{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* -%ghost %{_sbindir}/iptables -%ghost %{_sbindir}/iptables-restore -%ghost %{_sbindir}/iptables-save -%ghost %{_sbindir}/ip6tables -%ghost %{_sbindir}/ip6tables-restore -%ghost %{_sbindir}/ip6tables-save -%ghost %{_sbindir}/ebtables -%ghost %{_sbindir}/ebtables-save -%ghost %{_sbindir}/ebtables-restore -%ghost %{_sbindir}/arptables -%ghost %{_sbindir}/arptables-save -%ghost %{_sbindir}/arptables-restore +%{_mandir}/man8/ip{,6}tables{,-restore}-translate* +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper -%ghost %{_mandir}/man8/arptables.8.gz -%ghost %{_mandir}/man8/arptables-save.8.gz -%ghost %{_mandir}/man8/arptables-restore.8.gz +%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Feb 16 2021 Phil Sutter - 1.8.7-4 +- Drop bootstrap code again +- Drop workarounds for F24 and lower +- Fix iptables-utils summary +- Ship iptables-apply with iptables-utils +- Reduce files sections by use of globbing +- Ship common man pages with iptables-libs +- Ship *-translate man pages with iptables-nft +- Move legacy iptables binaries, libraries and headers into sub-packages +- Introduce compat sub-package to help with above transitions +- Drop libipulog header from devel package, this belongs to libnetfilter_log +- Do not ship internal headers in devel package + * Thu Jan 28 2021 Phil Sutter - 1.8.7-3 - ebtables: Exit gracefully on invalid table names From 3fe153906e430df5053b185f2c36474b2729df2f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Mar 2021 12:33:45 +0100 Subject: [PATCH 18/79] iptables-1.8.7-5 - Fix upgrade path with package rename - Add missing dependencies to iptables-nft package --- iptables.spec | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 09ac10c..6c55721 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -151,6 +151,8 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} +Requires(post): %{_sbindir}/update-alternatives +Requires(postun): %{_sbindir}/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -250,6 +252,20 @@ if [ $1 -eq 0 ]; then iptables %{_sbindir}/iptables-legacy fi +# iptables-1.8.0-1 introduced the use of alternatives +# when upgrading, its %postun script runs due to the package renaming +# fix this by repeating the install into alternatives +%triggerpostun legacy -- iptables > 1.8.0 +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables +%{_sbindir}/update-alternatives --install \ + $pfx iptables $pfx-legacy 10 \ + --slave $pfx6 ip6tables $pfx6-legacy \ + --slave $pfx-restore iptables-restore $pfx-legacy-restore \ + --slave $pfx-save iptables-save $pfx-legacy-save \ + --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --slave $pfx6-save ip6tables-save $pfx6-legacy-save + %post services %systemd_post iptables.service ip6tables.service @@ -390,6 +406,10 @@ fi %changelog +* Tue Mar 23 2021 Phil Sutter - 1.8.7-5 +- Fix upgrade path with package rename +- Add missing dependencies to iptables-nft package + * Tue Feb 16 2021 Phil Sutter - 1.8.7-4 - Drop bootstrap code again - Drop workarounds for F24 and lower From ad1732dc5dde9d655d66d4639dc2f1edff5e529c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Mar 2021 21:16:19 +0100 Subject: [PATCH 19/79] iptables-1.8.7-6 - Restore alternatives configuration after upgrade - Fix license location --- iptables.spec | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 6c55721..258f9dc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -255,6 +255,12 @@ fi # iptables-1.8.0-1 introduced the use of alternatives # when upgrading, its %postun script runs due to the package renaming # fix this by repeating the install into alternatives +# also keep the old alternatives configuration to not change the system +%triggerun legacy -- iptables > 1.8.0 +alternatives --list | awk '/^iptables/{print $3; exit}' \ + >/var/tmp/alternatives.iptables.current +cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup + %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables @@ -265,6 +271,9 @@ pfx6=%{_sbindir}/ip6tables --slave $pfx-save iptables-save $pfx-legacy-save \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +alternatives --set iptables $( - 1.8.7-6 +- Restore alternatives configuration after upgrade +- Fix license location + * Tue Mar 23 2021 Phil Sutter - 1.8.7-5 - Fix upgrade path with package rename - Add missing dependencies to iptables-nft package From a9e873591dca2c3e17a94c51c6084a1db9032911 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 24 Mar 2021 16:12:15 +0100 Subject: [PATCH 20/79] iptables-1.8.5-6 - iptables: accept lock file name at runtime Resolves: RHBZ#1932157 --- ...les-accept-lock-file-name-at-runtime.patch | 94 +++++++++++++++++++ iptables.spec | 6 +- 2 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 0007-iptables-accept-lock-file-name-at-runtime.patch diff --git a/0007-iptables-accept-lock-file-name-at-runtime.patch b/0007-iptables-accept-lock-file-name-at-runtime.patch new file mode 100644 index 0000000..2aced55 --- /dev/null +++ b/0007-iptables-accept-lock-file-name-at-runtime.patch @@ -0,0 +1,94 @@ +From 05b2a86662ad732ecfbec1c2ef597dbedf54cf9c Mon Sep 17 00:00:00 2001 +From: Giuseppe Scrivano +Date: Fri, 17 Jul 2020 10:39:40 +0200 +Subject: [PATCH] iptables: accept lock file name at runtime + +allow users to override at runtime the lock file to use through the +XTABLES_LOCKFILE environment variable. + +It allows to use iptables when the user has granted enough +capabilities (e.g. a user+network namespace) to configure the network +but that lacks access to the XT_LOCK_NAME (by default placed under +/run). + +$ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ... + +Signed-off-by: Giuseppe Scrivano +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit 5105e844c2ff6a3e320bf8cdadc5094d4eaef2b7) +--- + configure.ac | 1 + + iptables/iptables.8.in | 8 ++++++++ + iptables/xshared.c | 11 ++++++++--- + 3 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 31a8bb261c437..d37752a20afd2 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -219,6 +219,7 @@ AC_SUBST([libxtables_vmajor]) + + AC_DEFINE_UNQUOTED([XT_LOCK_NAME], "${xt_lock_name}", + [Location of the iptables lock file]) ++AC_SUBST([XT_LOCK_NAME], "${xt_lock_name}") + + AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile + iptables/Makefile iptables/xtables.pc +diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in +index 054564b3df91e..999cf339845f9 100644 +--- a/iptables/iptables.8.in ++++ b/iptables/iptables.8.in +@@ -397,6 +397,14 @@ corresponding to that rule's position in the chain. + \fB\-\-modprobe=\fP\fIcommand\fP + When adding or inserting rules into a chain, use \fIcommand\fP + to load any necessary modules (targets, match extensions, etc). ++ ++.SH LOCK FILE ++iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at ++launch. ++ ++The \fBXTABLES_LOCKFILE\fP environment variable can be used to override ++the default setting. ++ + .SH MATCH AND TARGET EXTENSIONS + .PP + iptables can use extended packet matching and target modules. +diff --git a/iptables/xshared.c b/iptables/xshared.c +index c1d1371a6d54a..7d97637f7e129 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -249,15 +249,20 @@ void xs_init_match(struct xtables_match *match) + static int xtables_lock(int wait, struct timeval *wait_interval) + { + struct timeval time_left, wait_time; ++ const char *lock_file; + int fd, i = 0; + + time_left.tv_sec = wait; + time_left.tv_usec = 0; + +- fd = open(XT_LOCK_NAME, O_CREAT, 0600); ++ lock_file = getenv("XTABLES_LOCKFILE"); ++ if (lock_file == NULL || lock_file[0] == '\0') ++ lock_file = XT_LOCK_NAME; ++ ++ fd = open(lock_file, O_CREAT, 0600); + if (fd < 0) { + fprintf(stderr, "Fatal: can't open lock file %s: %s\n", +- XT_LOCK_NAME, strerror(errno)); ++ lock_file, strerror(errno)); + return XT_LOCK_FAILED; + } + +@@ -265,7 +270,7 @@ static int xtables_lock(int wait, struct timeval *wait_interval) + if (flock(fd, LOCK_EX) == 0) + return fd; + +- fprintf(stderr, "Can't lock %s: %s\n", XT_LOCK_NAME, ++ fprintf(stderr, "Can't lock %s: %s\n", lock_file, + strerror(errno)); + return XT_LOCK_BUSY; + } +-- +2.31.0 + diff --git a/iptables.spec b/iptables.spec index 4a30653..19941e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.5 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -38,6 +38,7 @@ Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch Patch6: 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch +Patch7: 0007-iptables-accept-lock-file-name-at-runtime.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -450,6 +451,9 @@ fi %changelog +* Wed Mar 24 2021 Phil Sutter - 1.8.5-6 +- iptables: accept lock file name at runtime + * Thu Jan 28 2021 Phil Sutter - 1.8.5-5 - ebtables: Exit gracefully on invalid table names From 2eea62dd86d3eafe7938a922f0dca0bc722b0674 Mon Sep 17 00:00:00 2001 From: Damian Wrobel Date: Sun, 28 Mar 2021 19:04:41 +0200 Subject: [PATCH 21/79] Add missing readlink required for iptables-nft(post) The following is observed while creating fedora-server image: Running scriptlet: iptables-nft-1.8.5-5.fc33.armv7hl /var/tmp/rpm-tmp.5nTAii: line 14: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 14: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 18: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 31: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 34: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 31: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 34: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 31: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 34: readlink: command not found /var/tmp/rpm-tmp.5nTAii: line 38: readlink: command not found --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 258f9dc..64f594f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -152,6 +152,7 @@ a safer way to update iptables remotely. Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} Requires(post): %{_sbindir}/update-alternatives +Requires(post): %{_bindir}/readlink Requires(postun): %{_sbindir}/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper @@ -417,6 +418,9 @@ fi %changelog +* Mon Mar 29 2021 Damian Wrobel - 1.8.7-7 +- Add missing readlink required for iptables-nft(post) + * Tue Mar 23 2021 Phil Sutter - 1.8.7-6 - Restore alternatives configuration after upgrade - Fix license location From 1f406341515f590a695a7c1bb7fb8253c6a7f37d Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 7 May 2021 18:33:08 +0200 Subject: [PATCH 22/79] iptables-1.8.7-8 - iptables.init: Fix functionality for iptables-nft - iptables.init: Ignore sysctl files not suffixed '.conf' - iptables.init: Drop unused NEW_MODUTILS check - iptables.init: Drop some trailing whitespace --- iptables.init | 51 +++++++++++++++++++++++++++++++++------------------ iptables.spec | 8 +++++++- 2 files changed, 40 insertions(+), 19 deletions(-) diff --git a/iptables.init b/iptables.init index 51155b0..ffbd742 100755 --- a/iptables.init +++ b/iptables.init @@ -55,11 +55,6 @@ if [ ! -x /sbin/$IPTABLES ]; then exit 5 fi -# Old or new modutils -/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \ - && NEW_MODUTILS=1 \ - || NEW_MODUTILS=0 - # Default firewall configuration: IPTABLES_MODULES="" IPTABLES_SAVE_ON_STOP="no" @@ -75,13 +70,33 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000 # Load firewall configuration. [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG" +is_iptables_nft() { + iptables --version | grep -q '(nf_tables)' +} + +netfilter_active() { + is_iptables_nft && return 0 + [ -e "$PROC_IPTABLES_NAMES" ] +} + +netfilter_tables() { + netfilter_active || return 1 + is_iptables_nft && { + # explicitly omit security table from this list as + # it should be reserved for SELinux use + echo "raw mangle filter nat" + return 0 + } + cat "$PROC_IPTABLES_NAMES" 2>/dev/null +} + # Get active tables -NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null) +NF_TABLES=$(netfilter_tables) flush_n_delete() { # Flush firewall rules and delete chains. - [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0 + netfilter_active || return 0 # Check if firewall is configured (has tables) [ -z "$NF_TABLES" ] && return 1 @@ -113,10 +128,10 @@ set_policy() { policy=$1 # Check if iptable module is loaded - [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0 + netfilter_active || return 0 # Check if firewall is configured (has tables) - tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null) + tables=$(netfilter_tables) [ -z "$tables" ] && return 1 echo -n $"${IPTABLES}: Setting chains to policy $policy: " @@ -166,7 +181,7 @@ load_sysctl() { echo -n $"Loading sysctl settings: " ret=0 for item in $IPTABLES_SYSCTL_LOAD_LIST; do - fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null + fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null let ret+=$?; done [ $ret -eq 0 ] && success || failure @@ -217,7 +232,7 @@ start() { return 1 fi fi - + # Load additional modules (helpers) if [ -n "$IPTABLES_MODULES" ]; then echo -n $"${IPTABLES}: Loading additional modules: " @@ -230,7 +245,7 @@ start() { [ $ret -eq 0 ] && success || failure echo fi - + # Load sysctl settings load_sysctl @@ -240,7 +255,7 @@ start() { stop() { # Do not stop if iptables module is not loaded. - [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0 + netfilter_active || return 0 # Set default chain policy to ACCEPT, in order to not break shutdown # on systems where the default policy is DROP and root device is @@ -248,14 +263,14 @@ stop() { set_policy ACCEPT # And then, flush the rules and delete chains flush_n_delete - + rm -f $VAR_SUBSYS_IPTABLES return $ret } save() { # Check if iptable module is loaded - if [ ! -e "$PROC_IPTABLES_NAMES" ]; then + if ! netfilter_active; then echo -n $"${IPTABLES}: Nothing to save."; warning; echo return 0 fi @@ -298,7 +313,7 @@ save() { } status() { - if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then + if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then echo $"${IPTABLES}: Firewall is not running." return 3 fi @@ -306,7 +321,7 @@ status() { # Do not print status if lockfile is missing and iptables modules are not # loaded. # Check if iptable modules are loaded - if [ ! -e "$PROC_IPTABLES_NAMES" ]; then + if ! netfilter_active; then echo $"${IPTABLES}: Firewall modules are not loaded." return 3 fi @@ -319,7 +334,7 @@ status() { NUM= [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n" - VERBOSE= + VERBOSE= [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose" COUNT= [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers" diff --git a/iptables.spec b/iptables.spec index 64f594f..498fc7f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -418,6 +418,12 @@ fi %changelog +* Fri May 07 2021 Phil Sutter - 1.8.7-8 +- iptables.init: Fix functionality for iptables-nft +- iptables.init: Ignore sysctl files not suffixed '.conf' +- iptables.init: Drop unused NEW_MODUTILS check +- iptables.init: Drop some trailing whitespace + * Mon Mar 29 2021 Damian Wrobel - 1.8.7-7 - Add missing readlink required for iptables-nft(post) From ff526cce7ecff7cdf76451cedb1f526bef526ec8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 16 Jun 2021 11:24:21 +0200 Subject: [PATCH 23/79] iptables-1.8.7-9 - Remove bashisms from arptables-nft-helper - tests: Use iproute instead of bridge-utils --- arptables-nft-helper | 17 +++++++---------- iptables.spec | 5 ++++- .../Makefile | 2 +- .../runtest.sh | 4 ++-- tests/tests.yml | 1 - 5 files changed, 14 insertions(+), 15 deletions(-) diff --git a/arptables-nft-helper b/arptables-nft-helper index 7380abf..913298d 100644 --- a/arptables-nft-helper +++ b/arptables-nft-helper @@ -5,12 +5,12 @@ ARPTABLES_CONFIG=/etc/sysconfig/arptables # compat for removed initscripts dependency success() { - echo -n "[ OK ]" + echo "[ OK ]" return 0 } failure() { - echo -n "[FAILED]" + echo "[FAILED]" return 1 } @@ -21,31 +21,28 @@ start() { # don't do squat if we don't have the config file if [ -f $ARPTABLES_CONFIG ]; then - echo -n $"Applying arptables firewall rules: " + printf "Applying arptables firewall rules: " /usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \ success || \ failure - echo touch /var/lock/subsys/arptables else failure - echo - echo $"Configuration file /etc/sysconfig/arptables missing" + echo "Configuration file /etc/sysconfig/arptables missing" exit 6 fi } stop() { - echo -n $"Removing user defined chains:" + printf "Removing user defined chains: " arptables -X && success || failure - echo -n $"Flushing all chains:" + printf "Flushing all chains: " arptables -F && success || failure - echo -n $"Resetting built-in chains to the default ACCEPT policy:" + printf "Resetting built-in chains to the default ACCEPT policy: " arptables -P INPUT ACCEPT && \ arptables -P OUTPUT ACCEPT && \ success || \ failure - echo rm -f /var/lock/subsys/arptables } diff --git a/iptables.spec b/iptables.spec index 498fc7f..368e429 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 8%{?dist} +Release: 9%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -418,6 +418,9 @@ fi %changelog +* Wed Jun 16 2021 Phil Sutter - 1.8.7-9 +- Remove bashisms from arptables-nft-helper + * Fri May 07 2021 Phil Sutter - 1.8.7-8 - iptables.init: Fix functionality for iptables-nft - iptables.init: Ignore sysctl files not suffixed '.conf' diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile index 5b7f979..3d9ade1 100644 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: iptables" >> $(METADATA) - @echo "Requires: iptables bridge-utils ipset" >> $(METADATA) + @echo "Requires: iptables iproute ipset" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 75f7413..004d568 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -38,7 +38,7 @@ rlJournalStart rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" rlRun "iptables-save > iptables.backup" - rlRun "brctl addbr testbr" 0 "create bridge iface" + rlRun "ip link add dev testbr type bridge" 0 "create bridge iface" rlPhaseEnd rlPhaseStartTest @@ -75,7 +75,7 @@ rlJournalStart rlRun "ip6tables-restore < ip6tables.backup" rlRun "iptables-restore < iptables.backup" rlRun "ip link set down dev testbr" - rlRun "brctl delbr testbr" 0 "remove bridge iface" + rlRun "ip link del testbr" 0 "remove bridge iface" rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset" rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset" rlRun "popd" diff --git a/tests/tests.yml b/tests/tests.yml index 97069b7..8bac1f4 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,7 +10,6 @@ - iptables-services # multiple tests need iptables/ip6tables config files - initscripts # multiple tests need system command - libcgroup-tools # backport-iptables-add-libxt-cgroup-frontend needs cg* commands - - bridge-utils # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command - ipset # multiple tests need ipset command - strace # xtables-tools-locking-vulnerable-to-local-DoS needs strace command - policycoreutils # initscript-sanity needs restorecon command From 18074ebc22491d0b58d1c08f88799deea2e4c801 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 16 Jun 2021 11:24:21 +0200 Subject: [PATCH 24/79] iptables-1.8.7-10 - Backport fixes from upstream --- ...it-gracefully-on-invalid-table-names.patch | 6 +- 0002-iptables-nft-fix-Z-option.patch | 104 ++++++++++++++++++ ...twise-expression-avoidance-detection.patch | 73 ++++++++++++ ...nsions-sctp-Fix-nftables-translation.patch | 80 ++++++++++++++ ...leftover-variable-in-xtables_numeric.patch | 33 ++++++ ...ons-libebt_ip6-Drop-unused-variables.patch | 49 +++++++++ ...-Fix-memleak-in-xtopt_parse_hostmask.patch | 29 +++++ ...memleak-in-error-path-of-nft_cmd_new.patch | 34 ++++++ ...-iptables-apply-Drop-unused-variable.patch | 29 +++++ iptables.spec | 15 ++- 10 files changed, 447 insertions(+), 5 deletions(-) create mode 100644 0002-iptables-nft-fix-Z-option.patch create mode 100644 0003-nft-Fix-bitwise-expression-avoidance-detection.patch create mode 100644 0004-extensions-sctp-Fix-nftables-translation.patch create mode 100644 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch create mode 100644 0006-extensions-libebt_ip6-Drop-unused-variables.patch create mode 100644 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch create mode 100644 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch create mode 100644 0009-iptables-apply-Drop-unused-variable.patch diff --git a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch index ba625a2..93191ca 100644 --- a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +++ b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch @@ -1,4 +1,4 @@ -From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001 +From df7ed83da048317d344b34e9c38e31035e508f24 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 28 Jan 2021 01:09:56 +0100 Subject: [PATCH] ebtables: Exit gracefully on invalid table names @@ -22,7 +22,7 @@ With this patch in place, output looks much better: | Perhaps iptables or your kernel needs to be upgraded. Signed-off-by: Phil Sutter -Signed-off-by: Phil Sutter +(cherry picked from commit 30c1d443896311e69762d6b51b63908ec602574f) --- iptables/xtables-eb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) @@ -47,5 +47,5 @@ index cfa9317c78e94..5bb34d6d292a9 100644 table_set = true; break; -- -2.28.0 +2.31.1 diff --git a/0002-iptables-nft-fix-Z-option.patch b/0002-iptables-nft-fix-Z-option.patch new file mode 100644 index 0000000..d7f4a6a --- /dev/null +++ b/0002-iptables-nft-fix-Z-option.patch @@ -0,0 +1,104 @@ +From 56f5ee8dee86d4ceaeac7eb6e1eaaa2ac3a1d0f8 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Wed, 24 Feb 2021 11:08:02 +0100 +Subject: [PATCH] iptables-nft: fix -Z option + +it zeroes the rule counters, so it needs fully populated cache. +Add a test case to cover this. + +Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands") +Signed-off-by: Florian Westphal +Acked-by: Phil Sutter +(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2) +--- + iptables/nft-cmd.c | 2 +- + .../testcases/iptables/0007-zero-counters_0 | 64 +++++++++++++++++++ + 2 files changed, 65 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0 + +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index 5d33f1f00f574..f2b935c57dab4 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain, + if (!cmd) + return 0; + +- nft_cache_level_set(h, NFT_CL_CHAINS, cmd); ++ nft_cache_level_set(h, NFT_CL_RULES, cmd); + + return 1; + } +diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 +new file mode 100755 +index 0000000000000..36da1907e3b22 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 +@@ -0,0 +1,64 @@ ++#!/bin/bash ++ ++RC=0 ++COUNTR=$RANDOM$RANDOM ++ ++$XT_MULTI iptables-restore -c < +Date: Fri, 19 Feb 2021 16:54:57 +0100 +Subject: [PATCH] nft: Fix bitwise expression avoidance detection + +Byte-boundary prefix detection was too sloppy: Any data following the +first zero-byte was ignored. Add a follow-up loop making sure there are +no stray bits in the designated host part. + +Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") +Signed-off-by: Phil Sutter +(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba) +--- + iptables/nft-shared.c | 4 +++- + .../testcases/ip6tables/0004-address-masks_0 | 24 +++++++++++++++++++ + 2 files changed, 27 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 10553ab26823b..c1664b50f9383 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, + { + const unsigned char *m = mask; + bool bitwise = false; +- int i; ++ int i, j; + + for (i = 0; i < len; i++) { + if (m[i] != 0xff) { +@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, + break; + } + } ++ for (j = i + 1; !bitwise && j < len; j++) ++ bitwise = !!m[j]; + + if (!bitwise) + len = i; +diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 +new file mode 100755 +index 0000000000000..7eb42f08da975 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 +@@ -0,0 +1,24 @@ ++#!/bin/bash ++ ++set -e ++ ++$XT_MULTI ip6tables-restore < +Date: Tue, 4 May 2021 16:03:24 +0200 +Subject: [PATCH] extensions: sctp: Fix nftables translation + +If both sport and dport was present, incorrect nft syntax was generated. + +Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a61282ec6a1697bfb40f19d13a28a74559050167) +--- + extensions/libxt_sctp.c | 10 ++++------ + extensions/libxt_sctp.txlate | 10 +++++----- + 2 files changed, 9 insertions(+), 11 deletions(-) + +diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c +index 140de2653b1ef..ee4e99ebf11bf 100644 +--- a/extensions/libxt_sctp.c ++++ b/extensions/libxt_sctp.c +@@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl, + if (!einfo->flags) + return 0; + +- xt_xlate_add(xl, "sctp "); +- + if (einfo->flags & XT_SCTP_SRC_PORTS) { + if (einfo->spts[0] != einfo->spts[1]) +- xt_xlate_add(xl, "sport%s %u-%u", ++ xt_xlate_add(xl, "sctp sport%s %u-%u", + einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", + einfo->spts[0], einfo->spts[1]); + else +- xt_xlate_add(xl, "sport%s %u", ++ xt_xlate_add(xl, "sctp sport%s %u", + einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", + einfo->spts[0]); + space = " "; +@@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl, + + if (einfo->flags & XT_SCTP_DEST_PORTS) { + if (einfo->dpts[0] != einfo->dpts[1]) +- xt_xlate_add(xl, "%sdport%s %u-%u", space, ++ xt_xlate_add(xl, "%ssctp dport%s %u-%u", space, + einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", + einfo->dpts[0], einfo->dpts[1]); + else +- xt_xlate_add(xl, "%sdport%s %u", space, ++ xt_xlate_add(xl, "%ssctp dport%s %u", space, + einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", + einfo->dpts[0]); + } +diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate +index 72f4641ab021c..0d6c59e183675 100644 +--- a/extensions/libxt_sctp.txlate ++++ b/extensions/libxt_sctp.txlate +@@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT + nft add rule ip filter INPUT sctp dport != 50-56 counter accept + + iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept ++nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept + + iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept ++nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept + + iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept ++nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept + + iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT +-nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept ++nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept + + iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT +-nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept ++nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept +-- +2.31.1 + diff --git a/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch b/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch new file mode 100644 index 0000000..a97305a --- /dev/null +++ b/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch @@ -0,0 +1,33 @@ +From bdd9eb3bcce460815eecc39decf0cceb3fb0949b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 Nov 2020 21:04:39 +0100 +Subject: [PATCH] libxtables: Drop leftover variable in + xtables_numeric_to_ip6addr() + +Variable 'err' was only used in removed debug code, so drop it as well. + +Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code") +Signed-off-by: Phil Sutter +(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc) +--- + libxtables/xtables.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index bc42ba8221f3a..6947441fec659 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) + struct in6_addr *xtables_numeric_to_ip6addr(const char *num) + { + static struct in6_addr ap; +- int err; + +- if ((err = inet_pton(AF_INET6, num, &ap)) == 1) ++ if (inet_pton(AF_INET6, num, &ap) == 1) + return ≈ + + return NULL; +-- +2.31.1 + diff --git a/0006-extensions-libebt_ip6-Drop-unused-variables.patch b/0006-extensions-libebt_ip6-Drop-unused-variables.patch new file mode 100644 index 0000000..5b40690 --- /dev/null +++ b/0006-extensions-libebt_ip6-Drop-unused-variables.patch @@ -0,0 +1,49 @@ +From 8724e4edb3630f17ddf1897172953f2dc97ef6a1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 Nov 2020 21:13:50 +0100 +Subject: [PATCH] extensions: libebt_ip6: Drop unused variables + +They are being assigned to but never read. + +Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc) +--- + extensions/libebt_ip6.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c +index b8a5a5d8c3a92..301bed9aadefd 100644 +--- a/extensions/libebt_ip6.c ++++ b/extensions/libebt_ip6.c +@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match) + static struct in6_addr *numeric_to_addr(const char *num) + { + static struct in6_addr ap; +- int err; + +- if ((err=inet_pton(AF_INET6, num, &ap)) == 1) ++ if (inet_pton(AF_INET6, num, &ap) == 1) + return ≈ + return (struct in6_addr *)NULL; + } +@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i + char buf[256]; + char *p; + int i; +- int err; + + strncpy(buf, address, sizeof(buf) - 1); + /* first the mask */ +@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i + if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any))) + strcpy(buf, "::"); + +- if ((err=inet_pton(AF_INET6, buf, addr)) < 1) { ++ if (inet_pton(AF_INET6, buf, addr) < 1) { + xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf); + return; + } +-- +2.31.1 + diff --git a/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch b/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch new file mode 100644 index 0000000..8b7829b --- /dev/null +++ b/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch @@ -0,0 +1,29 @@ +From 81e5a32b0369d44a3319b76395ef76950884ecce Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Jun 2021 11:04:30 +0200 +Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask() + +The allocated hostmask duplicate needs to be freed again. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +Signed-off-by: Phil Sutter +(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e) +--- + libxtables/xtoptions.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index d329f2ff7979e..0dcdf607f4678 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb) + cb->arg = p; + xtopt_parse_plenmask(cb); + cb->arg = orig_arg; ++ free(work); + } + + static void xtopt_parse_ethermac(struct xt_option_call *cb) +-- +2.31.1 + diff --git a/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch b/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch new file mode 100644 index 0000000..2006ef2 --- /dev/null +++ b/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch @@ -0,0 +1,34 @@ +From bf931f3213cc66f798a1a9966220816fd3259a2f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Jun 2021 11:55:20 +0200 +Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new() + +If rule allocation fails, free the allocated 'cmd' before returning to +caller. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3) +--- + iptables/nft-cmd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index f2b935c57dab4..c3f6c14e0b99e 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + + if (state) { + rule = nft_rule_new(h, chain, table, state); +- if (!rule) ++ if (!rule) { ++ nft_cmd_free(cmd); + return NULL; ++ } + + cmd->obj.rule = rule; + +-- +2.31.1 + diff --git a/0009-iptables-apply-Drop-unused-variable.patch b/0009-iptables-apply-Drop-unused-variable.patch new file mode 100644 index 0000000..be088c2 --- /dev/null +++ b/0009-iptables-apply-Drop-unused-variable.patch @@ -0,0 +1,29 @@ +From fa0569c3d701d929393def1851421a4cacf251cc Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Jun 2021 12:50:57 +0200 +Subject: [PATCH] iptables-apply: Drop unused variable + +It was assigned to but never read. + +Fixes: b45b4e3903414 ("iptables-apply: script and manpage update") +Signed-off-by: Phil Sutter +(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764) +--- + iptables/iptables-apply | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/iptables/iptables-apply b/iptables/iptables-apply +index 4683b1b402d08..3a7df5e3cbc1f 100755 +--- a/iptables/iptables-apply ++++ b/iptables/iptables-apply +@@ -231,7 +231,6 @@ case "$MODE" in + "$RUNCMD" & + CMD_PID=$! + ( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) & +- CMDTIMEOUT_PID=$! + if ! wait "$CMD_PID"; then + echo "failed." + echo "Error: unknown error running command: $RUNCMD" >&2 +-- +2.31.1 + diff --git a/iptables.spec b/iptables.spec index 368e429..e02c24d 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 9%{?dist} +Release: 10%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -20,7 +20,15 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +Patch01: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +Patch02: 0002-iptables-nft-fix-Z-option.patch +Patch03: 0003-nft-Fix-bitwise-expression-avoidance-detection.patch +Patch04: 0004-extensions-sctp-Fix-nftables-translation.patch +Patch05: 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch +Patch06: 0006-extensions-libebt_ip6-Drop-unused-variables.patch +Patch07: 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch +Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch +Patch09: 0009-iptables-apply-Drop-unused-variable.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -418,6 +426,9 @@ fi %changelog +* Wed Jun 16 2021 Phil Sutter - 1.8.7-10 +- Backport fixes from upstream + * Wed Jun 16 2021 Phil Sutter - 1.8.7-9 - Remove bashisms from arptables-nft-helper From 36833ea1e0189b0445d46d42f84ac7dc0aeed5fe Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 1 Jul 2021 18:31:01 +0200 Subject: [PATCH 25/79] iptables-1.8.7-11 - Fix performance restoring large rulesets - Review unit file --- ...nft-cache-Sort-chains-on-demand-only.patch | 211 ++++++++++++++++++ ...CH_PAGE_SIZE-to-support-huge-ruleset.patch | 56 +++++ iptables.service | 5 +- iptables.spec | 8 +- 4 files changed, 277 insertions(+), 3 deletions(-) create mode 100644 0010-nft-cache-Sort-chains-on-demand-only.patch create mode 100644 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch diff --git a/0010-nft-cache-Sort-chains-on-demand-only.patch b/0010-nft-cache-Sort-chains-on-demand-only.patch new file mode 100644 index 0000000..2a57862 --- /dev/null +++ b/0010-nft-cache-Sort-chains-on-demand-only.patch @@ -0,0 +1,211 @@ +From b7582864a4cb71d4dcde752a3a2203c81159d6e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 25 Mar 2021 16:24:39 +0100 +Subject: [PATCH] nft: cache: Sort chains on demand only + +Mandatory sorted insert of chains into cache significantly slows down +restoring of large rulesets. Since the sorted list of user-defined +chains is needed for listing and verbose output only, introduce +nft_cache_sort_chains() and call it where needed. + +Signed-off-by: Phil Sutter +(cherry picked from commit fdf64dcdace989589bac441805082e3b1fe6a915) +--- + iptables/nft-cache.c | 71 +++++++++++++++++++++++++++++++++-------- + iptables/nft-cache.h | 1 + + iptables/nft.c | 12 +++++++ + iptables/nft.h | 1 + + iptables/xtables-save.c | 1 + + 5 files changed, 73 insertions(+), 13 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 6b6e6da40a826..8fbf9727826d8 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -223,24 +223,67 @@ int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, + + h->cache->table[t->type].base_chains[hooknum] = nc; + } else { +- struct nft_chain_list *clist = h->cache->table[t->type].chains; +- struct list_head *pos = &clist->list; +- struct nft_chain *cur; +- const char *n; +- +- list_for_each_entry(cur, &clist->list, head) { +- n = nftnl_chain_get_str(cur->nftnl, NFTNL_CHAIN_NAME); +- if (strcmp(cname, n) <= 0) { +- pos = &cur->head; +- break; +- } +- } +- list_add_tail(&nc->head, pos); ++ list_add_tail(&nc->head, ++ &h->cache->table[t->type].chains->list); + } + hlist_add_head(&nc->hnode, chain_name_hlist(h, t, cname)); + return 0; + } + ++static void __nft_chain_list_sort(struct list_head *list, ++ int (*cmp)(struct nft_chain *a, ++ struct nft_chain *b)) ++{ ++ struct nft_chain *pivot, *cur, *sav; ++ LIST_HEAD(sublist); ++ ++ if (list_empty(list)) ++ return; ++ ++ /* grab first item as pivot (dividing) value */ ++ pivot = list_entry(list->next, struct nft_chain, head); ++ list_del(&pivot->head); ++ ++ /* move any smaller value into sublist */ ++ list_for_each_entry_safe(cur, sav, list, head) { ++ if (cmp(pivot, cur) > 0) { ++ list_del(&cur->head); ++ list_add_tail(&cur->head, &sublist); ++ } ++ } ++ /* conquer divided */ ++ __nft_chain_list_sort(&sublist, cmp); ++ __nft_chain_list_sort(list, cmp); ++ ++ /* merge divided and pivot again */ ++ list_add_tail(&pivot->head, &sublist); ++ list_splice(&sublist, list); ++} ++ ++static int nft_chain_cmp_byname(struct nft_chain *a, struct nft_chain *b) ++{ ++ const char *aname = nftnl_chain_get_str(a->nftnl, NFTNL_CHAIN_NAME); ++ const char *bname = nftnl_chain_get_str(b->nftnl, NFTNL_CHAIN_NAME); ++ ++ return strcmp(aname, bname); ++} ++ ++int nft_cache_sort_chains(struct nft_handle *h, const char *table) ++{ ++ const struct builtin_table *t = nft_table_builtin_find(h, table); ++ ++ if (!t) ++ return -1; ++ ++ if (h->cache->table[t->type].sorted) ++ return 0; ++ ++ __nft_chain_list_sort(&h->cache->table[t->type].chains->list, ++ nft_chain_cmp_byname); ++ h->cache->table[t->type].sorted = true; ++ return 0; ++} ++ + struct nftnl_chain_list_cb_data { + struct nft_handle *h; + const struct builtin_table *t; +@@ -663,6 +706,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, + + flush_base_chain_cache(c->table[table->type].base_chains); + nft_chain_foreach(h, tablename, __flush_chain_cache, NULL); ++ c->table[table->type].sorted = false; + + if (c->table[table->type].sets) + nftnl_set_list_foreach(c->table[table->type].sets, +@@ -678,6 +722,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, + if (c->table[i].chains) { + nft_chain_list_free(c->table[i].chains); + c->table[i].chains = NULL; ++ c->table[i].sorted = false; + } + + if (c->table[i].sets) { +diff --git a/iptables/nft-cache.h b/iptables/nft-cache.h +index 20d96beede876..58a015265056c 100644 +--- a/iptables/nft-cache.h ++++ b/iptables/nft-cache.h +@@ -16,6 +16,7 @@ int flush_rule_cache(struct nft_handle *h, const char *table, + void nft_cache_build(struct nft_handle *h); + int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, + struct nftnl_chain *c); ++int nft_cache_sort_chains(struct nft_handle *h, const char *table); + + struct nft_chain * + nft_chain_find(struct nft_handle *h, const char *table, const char *chain); +diff --git a/iptables/nft.c b/iptables/nft.c +index bde4ca72d3fcc..8b14daeaed610 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1754,6 +1754,8 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table, + return 1; + } + ++ nft_cache_sort_chains(h, table); ++ + ret = nft_chain_foreach(h, table, nft_rule_flush_cb, &d); + + /* the core expects 1 for success and 0 for error */ +@@ -1900,6 +1902,9 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain, + goto out; + } + ++ if (verbose) ++ nft_cache_sort_chains(h, table); ++ + ret = nft_chain_foreach(h, table, __nft_chain_user_del, &d); + out: + /* the core expects 1 for success and 0 for error */ +@@ -2437,6 +2442,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table, + return 1; + } + ++ nft_cache_sort_chains(h, table); ++ + if (ops->print_table_header) + ops->print_table_header(table); + +@@ -2540,6 +2547,8 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain, + return nft_rule_list_cb(c, &d); + } + ++ nft_cache_sort_chains(h, table); ++ + /* Dump policies and custom chains first */ + nft_chain_foreach(h, table, nft_rule_list_chain_save, &counters); + +@@ -3431,6 +3440,9 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain, + goto err; + } + ++ if (verbose) ++ nft_cache_sort_chains(h, table); ++ + ret = nft_chain_foreach(h, table, __nft_chain_zero_counters, &d); + err: + /* the core expects 1 for success and 0 for error */ +diff --git a/iptables/nft.h b/iptables/nft.h +index 0910f82a2773c..4ac7e0099d567 100644 +--- a/iptables/nft.h ++++ b/iptables/nft.h +@@ -44,6 +44,7 @@ struct nft_cache { + struct nft_chain_list *chains; + struct nftnl_set_list *sets; + bool exists; ++ bool sorted; + } table[NFT_TABLE_MAX]; + }; + +diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c +index d7901c650ea70..cfce0472f3ee8 100644 +--- a/iptables/xtables-save.c ++++ b/iptables/xtables-save.c +@@ -87,6 +87,7 @@ __do_output(struct nft_handle *h, const char *tablename, void *data) + printf("*%s\n", tablename); + /* Dump out chain names first, + * thereby preventing dependency conflicts */ ++ nft_cache_sort_chains(h, tablename); + nft_chain_foreach(h, tablename, nft_chain_save, h); + nft_rule_save(h, tablename, d->format); + if (d->commit) +-- +2.31.1 + diff --git a/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch b/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch new file mode 100644 index 0000000..863206e --- /dev/null +++ b/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch @@ -0,0 +1,56 @@ +From 8086d05bb16e75a23b49bf1accef615193e726e6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 6 Apr 2021 10:51:20 +0200 +Subject: [PATCH] nft: Increase BATCH_PAGE_SIZE to support huge rulesets + +In order to support the same ruleset sizes as legacy iptables, the +kernel's limit of 1024 iovecs has to be overcome. Therefore increase +each iovec's size from 128KB to 2MB. + +While being at it, add a log message for failing sendmsg() call. This is +not supposed to happen, even if the transaction fails. Yet if it does, +users are left with only a "line XXX failed" message (with line number +being the COMMIT line). + +Signed-off-by: Phil Sutter +Signed-off-by: Florian Westphal +(cherry picked from commit a3e81c62e8c5abb4158f1f66df6bbcffd1b33240) +--- + iptables/nft.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8b14daeaed610..f1deb82f87576 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -88,11 +88,11 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh, + + #define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize()) + +-/* selected batch page is 256 Kbytes long to load ruleset of +- * half a million rules without hitting -EMSGSIZE due to large +- * iovec. ++/* Selected batch page is 2 Mbytes long to support loading a ruleset of 3.5M ++ * rules matching on source and destination address as well as input and output ++ * interfaces. This is what legacy iptables supports. + */ +-#define BATCH_PAGE_SIZE getpagesize() * 32 ++#define BATCH_PAGE_SIZE 2 * 1024 * 1024 + + static struct nftnl_batch *mnl_batch_init(void) + { +@@ -220,8 +220,10 @@ static int mnl_batch_talk(struct nft_handle *h, int numcmds) + int err = 0; + + ret = mnl_nft_socket_sendmsg(h, numcmds); +- if (ret == -1) ++ if (ret == -1) { ++ fprintf(stderr, "sendmsg() failed: %s\n", strerror(errno)); + return -1; ++ } + + FD_ZERO(&readfds); + FD_SET(fd, &readfds); +-- +2.31.1 + diff --git a/iptables.service b/iptables.service index 342ac93..6b996d1 100644 --- a/iptables.service +++ b/iptables.service @@ -1,7 +1,8 @@ [Unit] Description=IPv4 firewall with iptables -After=syslog.target AssertPathExists=/etc/sysconfig/iptables +Before=network-pre.target +Wants=network-pre.target [Service] Type=oneshot @@ -13,4 +14,4 @@ Environment=BOOTUP=serial Environment=CONSOLETYPE=serial [Install] -WantedBy=basic.target +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index e02c24d..ba0d1dd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 10%{?dist} +Release: 11%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -29,6 +29,8 @@ Patch06: 0006-extensions-libebt_ip6-Drop-unused-variables.patch Patch07: 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch Patch09: 0009-iptables-apply-Drop-unused-variable.patch +Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch +Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -426,6 +428,10 @@ fi %changelog +* Thu Jul 01 2021 Phil Sutter - 1.8.7-11 +- Fix performance restoring large rulesets +- Review unit file + * Wed Jun 16 2021 Phil Sutter - 1.8.7-10 - Backport fixes from upstream From 19e3e9da9802c1232bf754fea0edd93564eb0445 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 08:42:28 +0000 Subject: [PATCH 26/79] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index ba0d1dd..9546dc3 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 11%{?dist} +Release: 12%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -428,6 +428,9 @@ fi %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 1.8.7-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Thu Jul 01 2021 Phil Sutter - 1.8.7-11 - Fix performance restoring large rulesets - Review unit file From cf09f27f9106977bf789c267deb2b03416d90db5 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Aug 2021 14:19:53 +0200 Subject: [PATCH 27/79] iptables-1.8.7-13 - doc: ebtables-nft.8: Adjust for missing atomic-options - nft: Fix for non-verbose check command - Build services sub-package as noarch --- ....8-Adjust-for-missing-atomic-options.patch | 130 ++++++++++++++++++ ...ft-Fix-for-non-verbose-check-command.patch | 31 +++++ iptables.spec | 10 +- 3 files changed, 170 insertions(+), 1 deletion(-) create mode 100644 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch create mode 100644 0013-nft-Fix-for-non-verbose-check-command.patch diff --git a/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch b/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch new file mode 100644 index 0000000..d07e50f --- /dev/null +++ b/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch @@ -0,0 +1,130 @@ +From 172a84516d3311733cf2a11acc7a86203ad38156 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 28 Jul 2021 17:53:53 +0200 +Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options + +Drop any reference to them (and the environment variable) but list them +in BUGS section hinting at ebtables-save and -restore tools. + +Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 765bf04ecc228783cb88c810c85bc0c769579c39) +--- + iptables/ebtables-nft.8 | 64 ++++++----------------------------------- + 1 file changed, 8 insertions(+), 56 deletions(-) + +diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 +index 1fa5ad9388cc0..08e9766f2cc74 100644 +--- a/iptables/ebtables-nft.8 ++++ b/iptables/ebtables-nft.8 +@@ -44,12 +44,6 @@ ebtables \- Ethernet bridge frame table administration (nft-based) + .br + .BR "ebtables " [ -t " table ] " --init-table + .br +-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit +-.br +-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init +-.br +-.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save +-.br + + .SH DESCRIPTION + .B ebtables +@@ -149,11 +143,9 @@ a table, the commands apply to the default filter table. + Only one command may be used on the command line at a time, except when + the commands + .BR -L " and " -Z +-are combined, the commands ++are combined or the commands + .BR -N " and " -P +-are combined, or when +-.B --atomic-file +-is used. ++are combined. + .TP + .B "-A, --append" + Append a rule to the end of the selected chain. +@@ -313,39 +305,6 @@ of the ebtables kernel table. + .TP + .B "--init-table" + Replace the current table data by the initial table data. +-.TP +-.B "--atomic-init" +-Copy the kernel's initial data of the table to the specified +-file. This can be used as the first action, after which rules are added +-to the file. The file can be specified using the +-.B --atomic-file +-command or through the +-.IR EBTABLES_ATOMIC_FILE " environment variable." +-.TP +-.B "--atomic-save" +-Copy the kernel's current data of the table to the specified +-file. This can be used as the first action, after which rules are added +-to the file. The file can be specified using the +-.B --atomic-file +-command or through the +-.IR EBTABLES_ATOMIC_FILE " environment variable." +-.TP +-.B "--atomic-commit" +-Replace the kernel table data with the data contained in the specified +-file. This is a useful command that allows you to load all your rules of a +-certain table into the kernel at once, saving the kernel a lot of precious +-time and allowing atomic updates of the tables. The file which contains +-the table data is constructed by using either the +-.B "--atomic-init" +-or the +-.B "--atomic-save" +-command to generate a starting file. After that, using the +-.B "--atomic-file" +-command when constructing rules or setting the +-.IR EBTABLES_ATOMIC_FILE " environment variable" +-allows you to extend the file and build the complete table before +-committing it to the kernel. This command can be very useful in boot scripts +-to populate the ebtables tables in a fast way. + .SS MISCELLANOUS COMMANDS + .TP + .B "-V, --version" +@@ -371,16 +330,6 @@ a target extension (see + .BR "TARGET EXTENSIONS" ")" + or a user-defined chain name. + .TP +-.B --atomic-file "\fIfile\fP" +-Let the command operate on the specified +-.IR file . +-The data of the table to +-operate on will be extracted from the file and the result of the operation +-will be saved back into the file. If specified, this option should come +-before the command specification. An alternative that should be preferred, +-is setting the +-.IR EBTABLES_ATOMIC_FILE " environment variable." +-.TP + .B -M, --modprobe "\fIprogram\fP" + When talking to the kernel, use this + .I program +@@ -1100,8 +1049,6 @@ arp message and the hardware address length in the arp header is 6 bytes. + .br + .SH FILES + .I /etc/ethertypes +-.SH ENVIRONMENT VARIABLES +-.I EBTABLES_ATOMIC_FILE + .SH MAILINGLISTS + .BR "" "See " http://netfilter.org/mailinglists.html + .SH BUGS +@@ -1109,7 +1056,12 @@ The version of ebtables this man page ships with does not support the + .B broute + table. Also there is no support for + .B string +-match. And finally, this list is probably not complete. ++match. Further, support for atomic-options ++.RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit ) ++has not been implemented, although ++.BR ebtables-save " and " ebtables-restore ++might replace them entirely given the inherent atomicity of nftables. ++Finally, this list is probably not complete. + .SH SEE ALSO + .BR xtables-nft "(8), " iptables "(8), " ip (8) + .PP +-- +2.32.0 + diff --git a/0013-nft-Fix-for-non-verbose-check-command.patch b/0013-nft-Fix-for-non-verbose-check-command.patch new file mode 100644 index 0000000..3d9d27d --- /dev/null +++ b/0013-nft-Fix-for-non-verbose-check-command.patch @@ -0,0 +1,31 @@ +From f3d74895be5847db13af403067c28385356376df Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 3 Aug 2021 10:55:20 +0200 +Subject: [PATCH] nft: Fix for non-verbose check command + +Check command was unconditionally verbose since v1.8.5. Make it respect +--verbose option again. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit 57d1422dbbc41c36ed2e9f6c67aa040c65a429a0) +--- + iptables/nft.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index f1deb82f87576..795dff8605404 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3126,7 +3126,7 @@ static int nft_prepare(struct nft_handle *h) + case NFT_COMPAT_RULE_CHECK: + assert_chain_exists(h, cmd->table, cmd->jumpto); + ret = nft_rule_check(h, cmd->chain, cmd->table, +- cmd->obj.rule, cmd->rulenum); ++ cmd->obj.rule, cmd->verbose); + break; + case NFT_COMPAT_RULE_ZERO: + ret = nft_rule_zero_counters(h, cmd->chain, cmd->table, +-- +2.32.0 + diff --git a/iptables.spec b/iptables.spec index 9546dc3..5af268f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 12%{?dist} +Release: 13%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -31,6 +31,8 @@ Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch Patch09: 0009-iptables-apply-Drop-unused-variable.patch Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch +Patch12: 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch +Patch13: 0013-nft-Fix-for-non-verbose-check-command.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -140,6 +142,7 @@ Requires: %{name} = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +BuildArch: noarch %description services iptables services for IPv4 and IPv6 @@ -428,6 +431,11 @@ fi %changelog +* Thu Aug 05 2021 Phil Sutter - 1.8.7-13 +- doc: ebtables-nft.8: Adjust for missing atomic-options +- nft: Fix for non-verbose check command +- Build services sub-package as noarch + * Thu Jul 22 2021 Fedora Release Engineering - 1.8.7-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 3f23334d0e73ae9aba392f94a2bfbc6a6cba4a2d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 27 Nov 2021 16:54:53 -0800 Subject: [PATCH 28/79] Rebuild for new libnftnl. --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 5af268f..1a87186 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 13%{?dist} +Release: 14%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -431,6 +431,9 @@ fi %changelog +* Sat Nov 27 2021 Kevin Fenzi - 1.8.7-14 +- Rebuild for new libnftnl. + * Thu Aug 05 2021 Phil Sutter - 1.8.7-13 - doc: ebtables-nft.8: Adjust for missing atomic-options - nft: Fix for non-verbose check command From c2fb2d6c94706eac7aa0ce571d58842d12810cea Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 13:25:32 +0000 Subject: [PATCH 29/79] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 1a87186..f5f0e31 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 14%{?dist} +Release: 15%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -431,6 +431,9 @@ fi %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.8.7-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 27 2021 Kevin Fenzi - 1.8.7-14 - Rebuild for new libnftnl. From 0f9f220b6715c18ad71c66c3aa0a740ec4cac1c9 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Mar 2022 13:28:15 +0100 Subject: [PATCH 30/79] iptables-1.8.7-16 - Improve error messages for unsupported extensions - xshared: Fix response to unprivileged users - libxtables: Register only the highest revision extension - Ignore typical 'fedpkg local' results in .gitignore --- .gitignore | 5 + ...ter-only-the-highest-revision-extens.patch | 64 +++++++++ ...d-Fix-response-to-unprivileged-users.patch | 134 ++++++++++++++++++ ...-messages-for-unsupported-extensions.patch | 84 +++++++++++ iptables.spec | 11 +- 5 files changed, 297 insertions(+), 1 deletion(-) create mode 100644 0014-libxtables-Register-only-the-highest-revision-extens.patch create mode 100644 0015-xshared-Fix-response-to-unprivileged-users.patch create mode 100644 0016-Improve-error-messages-for-unsupported-extensions.patch diff --git a/.gitignore b/.gitignore index d5a31d9..550d2b4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,8 @@ +/.build-*.log +/iptables-*.src.rpm +/noarch/ +/x86_64/ +/iptables.spec.orig /iptables-1.6.2.tar.bz2 /iptables-1.8.0.tar.bz2 /iptables-1.8.2.tar.bz2 diff --git a/0014-libxtables-Register-only-the-highest-revision-extens.patch b/0014-libxtables-Register-only-the-highest-revision-extens.patch new file mode 100644 index 0000000..a27d151 --- /dev/null +++ b/0014-libxtables-Register-only-the-highest-revision-extens.patch @@ -0,0 +1,64 @@ +From 3ffbffeb5193bf7259b04fcd2297a0d3e218b7a2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 11 Feb 2022 17:39:24 +0100 +Subject: [PATCH] libxtables: Register only the highest revision extension + +When fully registering extensions, ignore all consecutive ones with same +name and family value. Since commit b3ac87038f4e4 ("libxtables: Make +sure extensions register in revision order"), one may safely assume the +list of pending extensions has highest revision numbers first. Since +iptables is only interested in the highest revision the kernel supports, +registration and compatibility checks may be skipped once the first +matching extension in pending list has validated. + +Signed-off-by: Phil Sutter +(cherry picked from commit 2dbb49d15fb44ddd521a734eca3be3f940b7c1ba) +--- + libxtables/xtables.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index 6947441fec659..b0c969676bc85 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -668,6 +668,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, + struct xtables_match **dptr; + struct xtables_match *ptr; + const char *icmp6 = "icmp6"; ++ bool found = false; + + if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) + xtables_error(PARAMETER_PROBLEM, +@@ -686,7 +687,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, + if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { + ptr = *dptr; + *dptr = (*dptr)->next; +- if (xtables_fully_register_pending_match(ptr, prev)) { ++ if (!found && ++ xtables_fully_register_pending_match(ptr, prev)) { ++ found = true; + prev = ptr; + continue; + } else if (prev) { +@@ -788,6 +791,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) + struct xtables_target *prev = NULL; + struct xtables_target **dptr; + struct xtables_target *ptr; ++ bool found = false; + + /* Standard target? */ + if (strcmp(name, "") == 0 +@@ -802,7 +806,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) + if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { + ptr = *dptr; + *dptr = (*dptr)->next; +- if (xtables_fully_register_pending_target(ptr, prev)) { ++ if (!found && ++ xtables_fully_register_pending_target(ptr, prev)) { ++ found = true; + prev = ptr; + continue; + } else if (prev) { +-- +2.34.1 + diff --git a/0015-xshared-Fix-response-to-unprivileged-users.patch b/0015-xshared-Fix-response-to-unprivileged-users.patch new file mode 100644 index 0000000..fa28fde --- /dev/null +++ b/0015-xshared-Fix-response-to-unprivileged-users.patch @@ -0,0 +1,134 @@ +From eec7fd187a9eeda1250c1a35b32c92eff074dff6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 18 Jan 2022 22:39:08 +0100 +Subject: [PATCH] xshared: Fix response to unprivileged users + +Expected behaviour in both variants is: + +* Print help without error, append extension help if -m and/or -j + options are present +* Indicate lack of permissions in an error message for anything else + +With iptables-nft, this was broken basically from day 1. Shared use of +do_parse() then somewhat broke legacy: it started complaining about +inability to create a lock file. + +Fix this by making iptables-nft assume extension revision 0 is present +if permissions don't allow to verify. This is consistent with legacy. + +Second part is to exit directly after printing help - this avoids having +to make the following code "nop-aware" to prevent privileged actions. + +Signed-off-by: Phil Sutter +Reviewed-by: Florian Westphal +(cherry picked from commit 26ecdf53960658771c0fc582f72a4025e2887f75) + +Conflicts: + iptables/xshared.c +-> Apply direct exit from do_parse() to xtables.c, upstream merged + do_parse() functions. +--- + iptables/nft.c | 5 ++ + .../testcases/iptables/0008-unprivileged_0 | 60 +++++++++++++++++++ + iptables/xtables.c | 2 +- + 3 files changed, 66 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0 + +diff --git a/iptables/nft.c b/iptables/nft.c +index 795dff8605404..5aa14aebeb31e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3256,6 +3256,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) + err: + mnl_socket_close(nl); + ++ /* pretend revision 0 is valid if not permitted to check - ++ * this is required for printing extension help texts as user */ ++ if (ret < 0 && errno == EPERM && rev == 0) ++ return 1; ++ + return ret < 0 ? 0 : 1; + } + +diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 +new file mode 100755 +index 0000000000000..43e3bc8721dbd +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 +@@ -0,0 +1,60 @@ ++#!/bin/bash ++ ++# iptables may print match/target specific help texts ++# help output should work for unprivileged users ++ ++run() { ++ echo "running: $*" >&2 ++ runuser -u nobody -- "$@" ++} ++ ++grep_or_rc() { ++ declare -g rc ++ grep -q "$*" && return 0 ++ echo "missing in output: $*" >&2 ++ return 1 ++} ++ ++out=$(run $XT_MULTI iptables --help) ++let "rc+=$?" ++grep_or_rc "iptables -h (print this help information)" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -m limit --help) ++let "rc+=$?" ++grep_or_rc "limit match options:" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -p tcp --help) ++let "rc+=$?" ++grep_or_rc "tcp match options:" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -j DNAT --help) ++let "rc+=$?" ++grep_or_rc "DNAT target options:" <<< "$out" ++let "rc+=$?" ++ ++out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) ++let "rc+=$?" ++grep_or_rc "tcp match options:" <<< "$out" ++let "rc+=$?" ++out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) ++let "rc+=$?" ++grep_or_rc "DNAT target options:" <<< "$out" ++let "rc+=$?" ++ ++ ++run $XT_MULTI iptables -L 2>&1 | \ ++ grep_or_rc "Permission denied" ++let "rc+=$?" ++ ++run $XT_MULTI iptables -A FORWARD -p tcp --dport 123 2>&1 | \ ++ grep_or_rc "Permission denied" ++let "rc+=$?" ++ ++run $XT_MULTI iptables -A FORWARD -j DNAT --to-destination 1.2.3.4 2>&1 | \ ++ grep_or_rc "Permission denied" ++let "rc+=$?" ++ ++exit $rc +diff --git a/iptables/xtables.c b/iptables/xtables.c +index 9779bd83d53b3..a16bba74dc578 100644 +--- a/iptables/xtables.c ++++ b/iptables/xtables.c +@@ -645,7 +645,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], + + printhelp(cs->matches); + p->command = CMD_NONE; +- return; ++ exit(0); + + /* + * Option selection +-- +2.34.1 + diff --git a/0016-Improve-error-messages-for-unsupported-extensions.patch b/0016-Improve-error-messages-for-unsupported-extensions.patch new file mode 100644 index 0000000..bd8282c --- /dev/null +++ b/0016-Improve-error-messages-for-unsupported-extensions.patch @@ -0,0 +1,84 @@ +From 721af7dfbfd5dc18af86e00d30de108dbf1687fb Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 11 Feb 2022 17:47:22 +0100 +Subject: [PATCH] Improve error messages for unsupported extensions + +If a given extension was not supported by the kernel, iptables would +print a rather confusing error message if extension parameters were +given: + +| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko +| # iptables -A FORWARD -j LOG --log-prefix foo +| iptables v1.8.7 (legacy): unknown option "--log-prefix" + +Avoid this by pretending extension revision 0 is always supported. It is +the same hack as used to successfully print extension help texts as +unprivileged user, extended to all error codes to serve privileged ones +as well. + +In addition, print a warning if kernel rejected revision 0 and it's not +a permissions problem. This helps users find out which extension in a +rule the kernel didn't like. + +Finally, the above commands result in these messages: + +| Warning: Extension LOG revision 0 not supported, missing kernel module? +| iptables: No chain/target/match by that name. + +Or, for iptables-nft: + +| Warning: Extension LOG revision 0 not supported, missing kernel module? +| iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD + +Signed-off-by: Phil Sutter +(cherry picked from commit 17534cb18ed0a5052dc45c117401251359dba6aa) +--- + iptables/nft.c | 12 +++++++++--- + libxtables/xtables.c | 7 ++++++- + 2 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 5aa14aebeb31e..0b1759c3e35ea 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3256,10 +3256,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) + err: + mnl_socket_close(nl); + +- /* pretend revision 0 is valid if not permitted to check - +- * this is required for printing extension help texts as user */ +- if (ret < 0 && errno == EPERM && rev == 0) ++ /* pretend revision 0 is valid - ++ * this is required for printing extension help texts as user, also ++ * helps error messaging on unavailable kernel extension */ ++ if (ret < 0 && rev == 0) { ++ if (errno != EPERM) ++ fprintf(stderr, ++ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", ++ name); + return 1; ++ } + + return ret < 0 ? 0 : 1; + } +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index b0c969676bc85..10b985b7c3a79 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -929,7 +929,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt) + /* Definitely don't support this? */ + if (errno == ENOENT || errno == EPROTONOSUPPORT) { + close(sockfd); +- return 0; ++ /* Pretend revision 0 support for better error messaging */ ++ if (revision == 0) ++ fprintf(stderr, ++ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", ++ name); ++ return (revision == 0); + } else if (errno == ENOPROTOOPT) { + close(sockfd); + /* Assume only revision 0 support (old kernel) */ +-- +2.34.1 + diff --git a/iptables.spec b/iptables.spec index f5f0e31..d8c8823 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.7 -Release: 15%{?dist} +Release: 16%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -33,6 +33,9 @@ Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch Patch12: 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch Patch13: 0013-nft-Fix-for-non-verbose-check-command.patch +Patch14: 0014-libxtables-Register-only-the-highest-revision-extens.patch +Patch15: 0015-xshared-Fix-response-to-unprivileged-users.patch +Patch16: 0016-Improve-error-messages-for-unsupported-extensions.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -431,6 +434,12 @@ fi %changelog +* Thu Mar 03 2022 Phil Sutter - 1.8.7-16 +- Improve error messages for unsupported extensions +- xshared: Fix response to unprivileged users +- libxtables: Register only the highest revision extension +- Ignore typical 'fedpkg local' results in .gitignore + * Thu Jan 20 2022 Fedora Release Engineering - 1.8.7-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 8e6fc4330b4fa78c1da8b03341765ef1adf79689 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 13 May 2022 16:48:39 +0200 Subject: [PATCH 31/79] Update to 1.8.8. Fixes rhbz#2085503 --- .gitignore | 1 + ...it-gracefully-on-invalid-table-names.patch | 51 ----- ...Fix-build-for-Werror-format-security.patch | 29 +++ 0002-iptables-nft-fix-Z-option.patch | 104 --------- ...twise-expression-avoidance-detection.patch | 73 ------ ...nsions-sctp-Fix-nftables-translation.patch | 80 ------- ...leftover-variable-in-xtables_numeric.patch | 33 --- ...ons-libebt_ip6-Drop-unused-variables.patch | 49 ---- ...-Fix-memleak-in-xtopt_parse_hostmask.patch | 29 --- ...memleak-in-error-path-of-nft_cmd_new.patch | 34 --- ...-iptables-apply-Drop-unused-variable.patch | 29 --- ...nft-cache-Sort-chains-on-demand-only.patch | 211 ------------------ ...CH_PAGE_SIZE-to-support-huge-ruleset.patch | 56 ----- ....8-Adjust-for-missing-atomic-options.patch | 130 ----------- ...ft-Fix-for-non-verbose-check-command.patch | 31 --- ...ter-only-the-highest-revision-extens.patch | 64 ------ ...d-Fix-response-to-unprivileged-users.patch | 134 ----------- ...-messages-for-unsupported-extensions.patch | 84 ------- iptables.spec | 26 +-- sources | 2 +- 20 files changed, 38 insertions(+), 1212 deletions(-) delete mode 100644 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch create mode 100644 0001-xshared-Fix-build-for-Werror-format-security.patch delete mode 100644 0002-iptables-nft-fix-Z-option.patch delete mode 100644 0003-nft-Fix-bitwise-expression-avoidance-detection.patch delete mode 100644 0004-extensions-sctp-Fix-nftables-translation.patch delete mode 100644 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch delete mode 100644 0006-extensions-libebt_ip6-Drop-unused-variables.patch delete mode 100644 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch delete mode 100644 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch delete mode 100644 0009-iptables-apply-Drop-unused-variable.patch delete mode 100644 0010-nft-cache-Sort-chains-on-demand-only.patch delete mode 100644 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch delete mode 100644 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch delete mode 100644 0013-nft-Fix-for-non-verbose-check-command.patch delete mode 100644 0014-libxtables-Register-only-the-highest-revision-extens.patch delete mode 100644 0015-xshared-Fix-response-to-unprivileged-users.patch delete mode 100644 0016-Improve-error-messages-for-unsupported-extensions.patch diff --git a/.gitignore b/.gitignore index 550d2b4..d0729c1 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /iptables-1.8.5.tar.bz2 /iptables-1.8.6.tar.bz2 /iptables-1.8.7.tar.bz2 +/iptables-1.8.8.tar.bz2 diff --git a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch deleted file mode 100644 index 93191ca..0000000 --- a/0001-ebtables-Exit-gracefully-on-invalid-table-names.patch +++ /dev/null @@ -1,51 +0,0 @@ -From df7ed83da048317d344b34e9c38e31035e508f24 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 28 Jan 2021 01:09:56 +0100 -Subject: [PATCH] ebtables: Exit gracefully on invalid table names - -Users are able to cause program abort by passing a table name that -doesn't exist: - -| # ebtables-nft -t dummy -P INPUT ACCEPT -| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed. -| Aborted - -Avoid this by checking table existence just like iptables-nft does upon -parsing '-t' optarg. Since the list of tables is known and fixed, -checking the given name's length is pointless. So just drop that check -in return. - -With this patch in place, output looks much better: - -| # ebtables-nft -t dummy -P INPUT ACCEPT -| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist -| Perhaps iptables or your kernel needs to be upgraded. - -Signed-off-by: Phil Sutter -(cherry picked from commit 30c1d443896311e69762d6b51b63908ec602574f) ---- - iptables/xtables-eb.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index cfa9317c78e94..5bb34d6d292a9 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -914,10 +914,10 @@ print_zero: - xtables_error(PARAMETER_PROBLEM, - "The -t option (seen in line %u) cannot be used in %s.\n", - line, xt_params->program_name); -- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1) -- xtables_error(PARAMETER_PROBLEM, -- "Table name length cannot exceed %d characters", -- EBT_TABLE_MAXNAMELEN - 1); -+ if (!nft_table_builtin_find(h, optarg)) -+ xtables_error(VERSION_PROBLEM, -+ "table '%s' does not exist", -+ optarg); - *table = optarg; - table_set = true; - break; --- -2.31.1 - diff --git a/0001-xshared-Fix-build-for-Werror-format-security.patch b/0001-xshared-Fix-build-for-Werror-format-security.patch new file mode 100644 index 0000000..ba6d2db --- /dev/null +++ b/0001-xshared-Fix-build-for-Werror-format-security.patch @@ -0,0 +1,29 @@ +From fe9bd3b29dd7661e6f74c24db8356014798d1d78 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 May 2022 16:51:58 +0200 +Subject: [PATCH] xshared: Fix build for -Werror=format-security + +Gcc complains about the omitted format string. + +Signed-off-by: Phil Sutter +(cherry picked from commit b72eb12ea5a61df0655ad99d5048994e916be83a) +--- + iptables/xshared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index fae5ddd5df93e..a8512d3808154 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) + return; + + if (args->family != NFPROTO_ARP) +- xtables_error(PARAMETER_PROBLEM, msg); ++ xtables_error(PARAMETER_PROBLEM, "%s", msg); + + fprintf(stderr, "%s", msg); + } +-- +2.34.1 + diff --git a/0002-iptables-nft-fix-Z-option.patch b/0002-iptables-nft-fix-Z-option.patch deleted file mode 100644 index d7f4a6a..0000000 --- a/0002-iptables-nft-fix-Z-option.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 56f5ee8dee86d4ceaeac7eb6e1eaaa2ac3a1d0f8 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Wed, 24 Feb 2021 11:08:02 +0100 -Subject: [PATCH] iptables-nft: fix -Z option - -it zeroes the rule counters, so it needs fully populated cache. -Add a test case to cover this. - -Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands") -Signed-off-by: Florian Westphal -Acked-by: Phil Sutter -(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2) ---- - iptables/nft-cmd.c | 2 +- - .../testcases/iptables/0007-zero-counters_0 | 64 +++++++++++++++++++ - 2 files changed, 65 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0 - -diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c -index 5d33f1f00f574..f2b935c57dab4 100644 ---- a/iptables/nft-cmd.c -+++ b/iptables/nft-cmd.c -@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain, - if (!cmd) - return 0; - -- nft_cache_level_set(h, NFT_CL_CHAINS, cmd); -+ nft_cache_level_set(h, NFT_CL_RULES, cmd); - - return 1; - } -diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 -new file mode 100755 -index 0000000000000..36da1907e3b22 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 -@@ -0,0 +1,64 @@ -+#!/bin/bash -+ -+RC=0 -+COUNTR=$RANDOM$RANDOM -+ -+$XT_MULTI iptables-restore -c < -Date: Fri, 19 Feb 2021 16:54:57 +0100 -Subject: [PATCH] nft: Fix bitwise expression avoidance detection - -Byte-boundary prefix detection was too sloppy: Any data following the -first zero-byte was ignored. Add a follow-up loop making sure there are -no stray bits in the designated host part. - -Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches") -Signed-off-by: Phil Sutter -(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba) ---- - iptables/nft-shared.c | 4 +++- - .../testcases/ip6tables/0004-address-masks_0 | 24 +++++++++++++++++++ - 2 files changed, 27 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 10553ab26823b..c1664b50f9383 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, - { - const unsigned char *m = mask; - bool bitwise = false; -- int i; -+ int i, j; - - for (i = 0; i < len; i++) { - if (m[i] != 0xff) { -@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset, - break; - } - } -+ for (j = i + 1; !bitwise && j < len; j++) -+ bitwise = !!m[j]; - - if (!bitwise) - len = i; -diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 -new file mode 100755 -index 0000000000000..7eb42f08da975 ---- /dev/null -+++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 -@@ -0,0 +1,24 @@ -+#!/bin/bash -+ -+set -e -+ -+$XT_MULTI ip6tables-restore < -Date: Tue, 4 May 2021 16:03:24 +0200 -Subject: [PATCH] extensions: sctp: Fix nftables translation - -If both sport and dport was present, incorrect nft syntax was generated. - -Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a61282ec6a1697bfb40f19d13a28a74559050167) ---- - extensions/libxt_sctp.c | 10 ++++------ - extensions/libxt_sctp.txlate | 10 +++++----- - 2 files changed, 9 insertions(+), 11 deletions(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index 140de2653b1ef..ee4e99ebf11bf 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl, - if (!einfo->flags) - return 0; - -- xt_xlate_add(xl, "sctp "); -- - if (einfo->flags & XT_SCTP_SRC_PORTS) { - if (einfo->spts[0] != einfo->spts[1]) -- xt_xlate_add(xl, "sport%s %u-%u", -+ xt_xlate_add(xl, "sctp sport%s %u-%u", - einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", - einfo->spts[0], einfo->spts[1]); - else -- xt_xlate_add(xl, "sport%s %u", -+ xt_xlate_add(xl, "sctp sport%s %u", - einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "", - einfo->spts[0]); - space = " "; -@@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl, - - if (einfo->flags & XT_SCTP_DEST_PORTS) { - if (einfo->dpts[0] != einfo->dpts[1]) -- xt_xlate_add(xl, "%sdport%s %u-%u", space, -+ xt_xlate_add(xl, "%ssctp dport%s %u-%u", space, - einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", - einfo->dpts[0], einfo->dpts[1]); - else -- xt_xlate_add(xl, "%sdport%s %u", space, -+ xt_xlate_add(xl, "%ssctp dport%s %u", space, - einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "", - einfo->dpts[0]); - } -diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate -index 72f4641ab021c..0d6c59e183675 100644 ---- a/extensions/libxt_sctp.txlate -+++ b/extensions/libxt_sctp.txlate -@@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT - nft add rule ip filter INPUT sctp dport != 50-56 counter accept - - iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept -+nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept - - iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept -+nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept - - iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept -+nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept - - iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT --nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept -+nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept - - iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT --nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept -+nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept --- -2.31.1 - diff --git a/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch b/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch deleted file mode 100644 index a97305a..0000000 --- a/0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch +++ /dev/null @@ -1,33 +0,0 @@ -From bdd9eb3bcce460815eecc39decf0cceb3fb0949b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 Nov 2020 21:04:39 +0100 -Subject: [PATCH] libxtables: Drop leftover variable in - xtables_numeric_to_ip6addr() - -Variable 'err' was only used in removed debug code, so drop it as well. - -Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code") -Signed-off-by: Phil Sutter -(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc) ---- - libxtables/xtables.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index bc42ba8221f3a..6947441fec659 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) - struct in6_addr *xtables_numeric_to_ip6addr(const char *num) - { - static struct in6_addr ap; -- int err; - -- if ((err = inet_pton(AF_INET6, num, &ap)) == 1) -+ if (inet_pton(AF_INET6, num, &ap) == 1) - return ≈ - - return NULL; --- -2.31.1 - diff --git a/0006-extensions-libebt_ip6-Drop-unused-variables.patch b/0006-extensions-libebt_ip6-Drop-unused-variables.patch deleted file mode 100644 index 5b40690..0000000 --- a/0006-extensions-libebt_ip6-Drop-unused-variables.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 8724e4edb3630f17ddf1897172953f2dc97ef6a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 Nov 2020 21:13:50 +0100 -Subject: [PATCH] extensions: libebt_ip6: Drop unused variables - -They are being assigned to but never read. - -Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc) ---- - extensions/libebt_ip6.c | 6 ++---- - 1 file changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c -index b8a5a5d8c3a92..301bed9aadefd 100644 ---- a/extensions/libebt_ip6.c -+++ b/extensions/libebt_ip6.c -@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match) - static struct in6_addr *numeric_to_addr(const char *num) - { - static struct in6_addr ap; -- int err; - -- if ((err=inet_pton(AF_INET6, num, &ap)) == 1) -+ if (inet_pton(AF_INET6, num, &ap) == 1) - return ≈ - return (struct in6_addr *)NULL; - } -@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i - char buf[256]; - char *p; - int i; -- int err; - - strncpy(buf, address, sizeof(buf) - 1); - /* first the mask */ -@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i - if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any))) - strcpy(buf, "::"); - -- if ((err=inet_pton(AF_INET6, buf, addr)) < 1) { -+ if (inet_pton(AF_INET6, buf, addr) < 1) { - xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf); - return; - } --- -2.31.1 - diff --git a/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch b/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch deleted file mode 100644 index 8b7829b..0000000 --- a/0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 81e5a32b0369d44a3319b76395ef76950884ecce Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Jun 2021 11:04:30 +0200 -Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask() - -The allocated hostmask duplicate needs to be freed again. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e) ---- - libxtables/xtoptions.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d329f2ff7979e..0dcdf607f4678 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb) - cb->arg = p; - xtopt_parse_plenmask(cb); - cb->arg = orig_arg; -+ free(work); - } - - static void xtopt_parse_ethermac(struct xt_option_call *cb) --- -2.31.1 - diff --git a/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch b/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch deleted file mode 100644 index 2006ef2..0000000 --- a/0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch +++ /dev/null @@ -1,34 +0,0 @@ -From bf931f3213cc66f798a1a9966220816fd3259a2f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Jun 2021 11:55:20 +0200 -Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new() - -If rule allocation fails, free the allocated 'cmd' before returning to -caller. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3) ---- - iptables/nft-cmd.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c -index f2b935c57dab4..c3f6c14e0b99e 100644 ---- a/iptables/nft-cmd.c -+++ b/iptables/nft-cmd.c -@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, - - if (state) { - rule = nft_rule_new(h, chain, table, state); -- if (!rule) -+ if (!rule) { -+ nft_cmd_free(cmd); - return NULL; -+ } - - cmd->obj.rule = rule; - --- -2.31.1 - diff --git a/0009-iptables-apply-Drop-unused-variable.patch b/0009-iptables-apply-Drop-unused-variable.patch deleted file mode 100644 index be088c2..0000000 --- a/0009-iptables-apply-Drop-unused-variable.patch +++ /dev/null @@ -1,29 +0,0 @@ -From fa0569c3d701d929393def1851421a4cacf251cc Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Jun 2021 12:50:57 +0200 -Subject: [PATCH] iptables-apply: Drop unused variable - -It was assigned to but never read. - -Fixes: b45b4e3903414 ("iptables-apply: script and manpage update") -Signed-off-by: Phil Sutter -(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764) ---- - iptables/iptables-apply | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/iptables-apply b/iptables/iptables-apply -index 4683b1b402d08..3a7df5e3cbc1f 100755 ---- a/iptables/iptables-apply -+++ b/iptables/iptables-apply -@@ -231,7 +231,6 @@ case "$MODE" in - "$RUNCMD" & - CMD_PID=$! - ( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) & -- CMDTIMEOUT_PID=$! - if ! wait "$CMD_PID"; then - echo "failed." - echo "Error: unknown error running command: $RUNCMD" >&2 --- -2.31.1 - diff --git a/0010-nft-cache-Sort-chains-on-demand-only.patch b/0010-nft-cache-Sort-chains-on-demand-only.patch deleted file mode 100644 index 2a57862..0000000 --- a/0010-nft-cache-Sort-chains-on-demand-only.patch +++ /dev/null @@ -1,211 +0,0 @@ -From b7582864a4cb71d4dcde752a3a2203c81159d6e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 25 Mar 2021 16:24:39 +0100 -Subject: [PATCH] nft: cache: Sort chains on demand only - -Mandatory sorted insert of chains into cache significantly slows down -restoring of large rulesets. Since the sorted list of user-defined -chains is needed for listing and verbose output only, introduce -nft_cache_sort_chains() and call it where needed. - -Signed-off-by: Phil Sutter -(cherry picked from commit fdf64dcdace989589bac441805082e3b1fe6a915) ---- - iptables/nft-cache.c | 71 +++++++++++++++++++++++++++++++++-------- - iptables/nft-cache.h | 1 + - iptables/nft.c | 12 +++++++ - iptables/nft.h | 1 + - iptables/xtables-save.c | 1 + - 5 files changed, 73 insertions(+), 13 deletions(-) - -diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c -index 6b6e6da40a826..8fbf9727826d8 100644 ---- a/iptables/nft-cache.c -+++ b/iptables/nft-cache.c -@@ -223,24 +223,67 @@ int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, - - h->cache->table[t->type].base_chains[hooknum] = nc; - } else { -- struct nft_chain_list *clist = h->cache->table[t->type].chains; -- struct list_head *pos = &clist->list; -- struct nft_chain *cur; -- const char *n; -- -- list_for_each_entry(cur, &clist->list, head) { -- n = nftnl_chain_get_str(cur->nftnl, NFTNL_CHAIN_NAME); -- if (strcmp(cname, n) <= 0) { -- pos = &cur->head; -- break; -- } -- } -- list_add_tail(&nc->head, pos); -+ list_add_tail(&nc->head, -+ &h->cache->table[t->type].chains->list); - } - hlist_add_head(&nc->hnode, chain_name_hlist(h, t, cname)); - return 0; - } - -+static void __nft_chain_list_sort(struct list_head *list, -+ int (*cmp)(struct nft_chain *a, -+ struct nft_chain *b)) -+{ -+ struct nft_chain *pivot, *cur, *sav; -+ LIST_HEAD(sublist); -+ -+ if (list_empty(list)) -+ return; -+ -+ /* grab first item as pivot (dividing) value */ -+ pivot = list_entry(list->next, struct nft_chain, head); -+ list_del(&pivot->head); -+ -+ /* move any smaller value into sublist */ -+ list_for_each_entry_safe(cur, sav, list, head) { -+ if (cmp(pivot, cur) > 0) { -+ list_del(&cur->head); -+ list_add_tail(&cur->head, &sublist); -+ } -+ } -+ /* conquer divided */ -+ __nft_chain_list_sort(&sublist, cmp); -+ __nft_chain_list_sort(list, cmp); -+ -+ /* merge divided and pivot again */ -+ list_add_tail(&pivot->head, &sublist); -+ list_splice(&sublist, list); -+} -+ -+static int nft_chain_cmp_byname(struct nft_chain *a, struct nft_chain *b) -+{ -+ const char *aname = nftnl_chain_get_str(a->nftnl, NFTNL_CHAIN_NAME); -+ const char *bname = nftnl_chain_get_str(b->nftnl, NFTNL_CHAIN_NAME); -+ -+ return strcmp(aname, bname); -+} -+ -+int nft_cache_sort_chains(struct nft_handle *h, const char *table) -+{ -+ const struct builtin_table *t = nft_table_builtin_find(h, table); -+ -+ if (!t) -+ return -1; -+ -+ if (h->cache->table[t->type].sorted) -+ return 0; -+ -+ __nft_chain_list_sort(&h->cache->table[t->type].chains->list, -+ nft_chain_cmp_byname); -+ h->cache->table[t->type].sorted = true; -+ return 0; -+} -+ - struct nftnl_chain_list_cb_data { - struct nft_handle *h; - const struct builtin_table *t; -@@ -663,6 +706,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, - - flush_base_chain_cache(c->table[table->type].base_chains); - nft_chain_foreach(h, tablename, __flush_chain_cache, NULL); -+ c->table[table->type].sorted = false; - - if (c->table[table->type].sets) - nftnl_set_list_foreach(c->table[table->type].sets, -@@ -678,6 +722,7 @@ static int flush_cache(struct nft_handle *h, struct nft_cache *c, - if (c->table[i].chains) { - nft_chain_list_free(c->table[i].chains); - c->table[i].chains = NULL; -+ c->table[i].sorted = false; - } - - if (c->table[i].sets) { -diff --git a/iptables/nft-cache.h b/iptables/nft-cache.h -index 20d96beede876..58a015265056c 100644 ---- a/iptables/nft-cache.h -+++ b/iptables/nft-cache.h -@@ -16,6 +16,7 @@ int flush_rule_cache(struct nft_handle *h, const char *table, - void nft_cache_build(struct nft_handle *h); - int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t, - struct nftnl_chain *c); -+int nft_cache_sort_chains(struct nft_handle *h, const char *table); - - struct nft_chain * - nft_chain_find(struct nft_handle *h, const char *table, const char *chain); -diff --git a/iptables/nft.c b/iptables/nft.c -index bde4ca72d3fcc..8b14daeaed610 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1754,6 +1754,8 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table, - return 1; - } - -+ nft_cache_sort_chains(h, table); -+ - ret = nft_chain_foreach(h, table, nft_rule_flush_cb, &d); - - /* the core expects 1 for success and 0 for error */ -@@ -1900,6 +1902,9 @@ int nft_chain_user_del(struct nft_handle *h, const char *chain, - goto out; - } - -+ if (verbose) -+ nft_cache_sort_chains(h, table); -+ - ret = nft_chain_foreach(h, table, __nft_chain_user_del, &d); - out: - /* the core expects 1 for success and 0 for error */ -@@ -2437,6 +2442,8 @@ int nft_rule_list(struct nft_handle *h, const char *chain, const char *table, - return 1; - } - -+ nft_cache_sort_chains(h, table); -+ - if (ops->print_table_header) - ops->print_table_header(table); - -@@ -2540,6 +2547,8 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain, - return nft_rule_list_cb(c, &d); - } - -+ nft_cache_sort_chains(h, table); -+ - /* Dump policies and custom chains first */ - nft_chain_foreach(h, table, nft_rule_list_chain_save, &counters); - -@@ -3431,6 +3440,9 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain, - goto err; - } - -+ if (verbose) -+ nft_cache_sort_chains(h, table); -+ - ret = nft_chain_foreach(h, table, __nft_chain_zero_counters, &d); - err: - /* the core expects 1 for success and 0 for error */ -diff --git a/iptables/nft.h b/iptables/nft.h -index 0910f82a2773c..4ac7e0099d567 100644 ---- a/iptables/nft.h -+++ b/iptables/nft.h -@@ -44,6 +44,7 @@ struct nft_cache { - struct nft_chain_list *chains; - struct nftnl_set_list *sets; - bool exists; -+ bool sorted; - } table[NFT_TABLE_MAX]; - }; - -diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c -index d7901c650ea70..cfce0472f3ee8 100644 ---- a/iptables/xtables-save.c -+++ b/iptables/xtables-save.c -@@ -87,6 +87,7 @@ __do_output(struct nft_handle *h, const char *tablename, void *data) - printf("*%s\n", tablename); - /* Dump out chain names first, - * thereby preventing dependency conflicts */ -+ nft_cache_sort_chains(h, tablename); - nft_chain_foreach(h, tablename, nft_chain_save, h); - nft_rule_save(h, tablename, d->format); - if (d->commit) --- -2.31.1 - diff --git a/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch b/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch deleted file mode 100644 index 863206e..0000000 --- a/0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 8086d05bb16e75a23b49bf1accef615193e726e6 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 6 Apr 2021 10:51:20 +0200 -Subject: [PATCH] nft: Increase BATCH_PAGE_SIZE to support huge rulesets - -In order to support the same ruleset sizes as legacy iptables, the -kernel's limit of 1024 iovecs has to be overcome. Therefore increase -each iovec's size from 128KB to 2MB. - -While being at it, add a log message for failing sendmsg() call. This is -not supposed to happen, even if the transaction fails. Yet if it does, -users are left with only a "line XXX failed" message (with line number -being the COMMIT line). - -Signed-off-by: Phil Sutter -Signed-off-by: Florian Westphal -(cherry picked from commit a3e81c62e8c5abb4158f1f66df6bbcffd1b33240) ---- - iptables/nft.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8b14daeaed610..f1deb82f87576 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -88,11 +88,11 @@ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh, - - #define NFT_NLMSG_MAXSIZE (UINT16_MAX + getpagesize()) - --/* selected batch page is 256 Kbytes long to load ruleset of -- * half a million rules without hitting -EMSGSIZE due to large -- * iovec. -+/* Selected batch page is 2 Mbytes long to support loading a ruleset of 3.5M -+ * rules matching on source and destination address as well as input and output -+ * interfaces. This is what legacy iptables supports. - */ --#define BATCH_PAGE_SIZE getpagesize() * 32 -+#define BATCH_PAGE_SIZE 2 * 1024 * 1024 - - static struct nftnl_batch *mnl_batch_init(void) - { -@@ -220,8 +220,10 @@ static int mnl_batch_talk(struct nft_handle *h, int numcmds) - int err = 0; - - ret = mnl_nft_socket_sendmsg(h, numcmds); -- if (ret == -1) -+ if (ret == -1) { -+ fprintf(stderr, "sendmsg() failed: %s\n", strerror(errno)); - return -1; -+ } - - FD_ZERO(&readfds); - FD_SET(fd, &readfds); --- -2.31.1 - diff --git a/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch b/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch deleted file mode 100644 index d07e50f..0000000 --- a/0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch +++ /dev/null @@ -1,130 +0,0 @@ -From 172a84516d3311733cf2a11acc7a86203ad38156 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 28 Jul 2021 17:53:53 +0200 -Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options - -Drop any reference to them (and the environment variable) but list them -in BUGS section hinting at ebtables-save and -restore tools. - -Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page") -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit 765bf04ecc228783cb88c810c85bc0c769579c39) ---- - iptables/ebtables-nft.8 | 64 ++++++----------------------------------- - 1 file changed, 8 insertions(+), 56 deletions(-) - -diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8 -index 1fa5ad9388cc0..08e9766f2cc74 100644 ---- a/iptables/ebtables-nft.8 -+++ b/iptables/ebtables-nft.8 -@@ -44,12 +44,6 @@ ebtables \- Ethernet bridge frame table administration (nft-based) - .br - .BR "ebtables " [ -t " table ] " --init-table - .br --.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit --.br --.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init --.br --.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save --.br - - .SH DESCRIPTION - .B ebtables -@@ -149,11 +143,9 @@ a table, the commands apply to the default filter table. - Only one command may be used on the command line at a time, except when - the commands - .BR -L " and " -Z --are combined, the commands -+are combined or the commands - .BR -N " and " -P --are combined, or when --.B --atomic-file --is used. -+are combined. - .TP - .B "-A, --append" - Append a rule to the end of the selected chain. -@@ -313,39 +305,6 @@ of the ebtables kernel table. - .TP - .B "--init-table" - Replace the current table data by the initial table data. --.TP --.B "--atomic-init" --Copy the kernel's initial data of the table to the specified --file. This can be used as the first action, after which rules are added --to the file. The file can be specified using the --.B --atomic-file --command or through the --.IR EBTABLES_ATOMIC_FILE " environment variable." --.TP --.B "--atomic-save" --Copy the kernel's current data of the table to the specified --file. This can be used as the first action, after which rules are added --to the file. The file can be specified using the --.B --atomic-file --command or through the --.IR EBTABLES_ATOMIC_FILE " environment variable." --.TP --.B "--atomic-commit" --Replace the kernel table data with the data contained in the specified --file. This is a useful command that allows you to load all your rules of a --certain table into the kernel at once, saving the kernel a lot of precious --time and allowing atomic updates of the tables. The file which contains --the table data is constructed by using either the --.B "--atomic-init" --or the --.B "--atomic-save" --command to generate a starting file. After that, using the --.B "--atomic-file" --command when constructing rules or setting the --.IR EBTABLES_ATOMIC_FILE " environment variable" --allows you to extend the file and build the complete table before --committing it to the kernel. This command can be very useful in boot scripts --to populate the ebtables tables in a fast way. - .SS MISCELLANOUS COMMANDS - .TP - .B "-V, --version" -@@ -371,16 +330,6 @@ a target extension (see - .BR "TARGET EXTENSIONS" ")" - or a user-defined chain name. - .TP --.B --atomic-file "\fIfile\fP" --Let the command operate on the specified --.IR file . --The data of the table to --operate on will be extracted from the file and the result of the operation --will be saved back into the file. If specified, this option should come --before the command specification. An alternative that should be preferred, --is setting the --.IR EBTABLES_ATOMIC_FILE " environment variable." --.TP - .B -M, --modprobe "\fIprogram\fP" - When talking to the kernel, use this - .I program -@@ -1100,8 +1049,6 @@ arp message and the hardware address length in the arp header is 6 bytes. - .br - .SH FILES - .I /etc/ethertypes --.SH ENVIRONMENT VARIABLES --.I EBTABLES_ATOMIC_FILE - .SH MAILINGLISTS - .BR "" "See " http://netfilter.org/mailinglists.html - .SH BUGS -@@ -1109,7 +1056,12 @@ The version of ebtables this man page ships with does not support the - .B broute - table. Also there is no support for - .B string --match. And finally, this list is probably not complete. -+match. Further, support for atomic-options -+.RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit ) -+has not been implemented, although -+.BR ebtables-save " and " ebtables-restore -+might replace them entirely given the inherent atomicity of nftables. -+Finally, this list is probably not complete. - .SH SEE ALSO - .BR xtables-nft "(8), " iptables "(8), " ip (8) - .PP --- -2.32.0 - diff --git a/0013-nft-Fix-for-non-verbose-check-command.patch b/0013-nft-Fix-for-non-verbose-check-command.patch deleted file mode 100644 index 3d9d27d..0000000 --- a/0013-nft-Fix-for-non-verbose-check-command.patch +++ /dev/null @@ -1,31 +0,0 @@ -From f3d74895be5847db13af403067c28385356376df Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 3 Aug 2021 10:55:20 +0200 -Subject: [PATCH] nft: Fix for non-verbose check command - -Check command was unconditionally verbose since v1.8.5. Make it respect ---verbose option again. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit 57d1422dbbc41c36ed2e9f6c67aa040c65a429a0) ---- - iptables/nft.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index f1deb82f87576..795dff8605404 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3126,7 +3126,7 @@ static int nft_prepare(struct nft_handle *h) - case NFT_COMPAT_RULE_CHECK: - assert_chain_exists(h, cmd->table, cmd->jumpto); - ret = nft_rule_check(h, cmd->chain, cmd->table, -- cmd->obj.rule, cmd->rulenum); -+ cmd->obj.rule, cmd->verbose); - break; - case NFT_COMPAT_RULE_ZERO: - ret = nft_rule_zero_counters(h, cmd->chain, cmd->table, --- -2.32.0 - diff --git a/0014-libxtables-Register-only-the-highest-revision-extens.patch b/0014-libxtables-Register-only-the-highest-revision-extens.patch deleted file mode 100644 index a27d151..0000000 --- a/0014-libxtables-Register-only-the-highest-revision-extens.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 3ffbffeb5193bf7259b04fcd2297a0d3e218b7a2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 11 Feb 2022 17:39:24 +0100 -Subject: [PATCH] libxtables: Register only the highest revision extension - -When fully registering extensions, ignore all consecutive ones with same -name and family value. Since commit b3ac87038f4e4 ("libxtables: Make -sure extensions register in revision order"), one may safely assume the -list of pending extensions has highest revision numbers first. Since -iptables is only interested in the highest revision the kernel supports, -registration and compatibility checks may be skipped once the first -matching extension in pending list has validated. - -Signed-off-by: Phil Sutter -(cherry picked from commit 2dbb49d15fb44ddd521a734eca3be3f940b7c1ba) ---- - libxtables/xtables.c | 10 ++++++++-- - 1 file changed, 8 insertions(+), 2 deletions(-) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index 6947441fec659..b0c969676bc85 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -668,6 +668,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, - struct xtables_match **dptr; - struct xtables_match *ptr; - const char *icmp6 = "icmp6"; -+ bool found = false; - - if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) - xtables_error(PARAMETER_PROBLEM, -@@ -686,7 +687,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload, - if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { - ptr = *dptr; - *dptr = (*dptr)->next; -- if (xtables_fully_register_pending_match(ptr, prev)) { -+ if (!found && -+ xtables_fully_register_pending_match(ptr, prev)) { -+ found = true; - prev = ptr; - continue; - } else if (prev) { -@@ -788,6 +791,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) - struct xtables_target *prev = NULL; - struct xtables_target **dptr; - struct xtables_target *ptr; -+ bool found = false; - - /* Standard target? */ - if (strcmp(name, "") == 0 -@@ -802,7 +806,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload) - if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) { - ptr = *dptr; - *dptr = (*dptr)->next; -- if (xtables_fully_register_pending_target(ptr, prev)) { -+ if (!found && -+ xtables_fully_register_pending_target(ptr, prev)) { -+ found = true; - prev = ptr; - continue; - } else if (prev) { --- -2.34.1 - diff --git a/0015-xshared-Fix-response-to-unprivileged-users.patch b/0015-xshared-Fix-response-to-unprivileged-users.patch deleted file mode 100644 index fa28fde..0000000 --- a/0015-xshared-Fix-response-to-unprivileged-users.patch +++ /dev/null @@ -1,134 +0,0 @@ -From eec7fd187a9eeda1250c1a35b32c92eff074dff6 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 18 Jan 2022 22:39:08 +0100 -Subject: [PATCH] xshared: Fix response to unprivileged users - -Expected behaviour in both variants is: - -* Print help without error, append extension help if -m and/or -j - options are present -* Indicate lack of permissions in an error message for anything else - -With iptables-nft, this was broken basically from day 1. Shared use of -do_parse() then somewhat broke legacy: it started complaining about -inability to create a lock file. - -Fix this by making iptables-nft assume extension revision 0 is present -if permissions don't allow to verify. This is consistent with legacy. - -Second part is to exit directly after printing help - this avoids having -to make the following code "nop-aware" to prevent privileged actions. - -Signed-off-by: Phil Sutter -Reviewed-by: Florian Westphal -(cherry picked from commit 26ecdf53960658771c0fc582f72a4025e2887f75) - -Conflicts: - iptables/xshared.c --> Apply direct exit from do_parse() to xtables.c, upstream merged - do_parse() functions. ---- - iptables/nft.c | 5 ++ - .../testcases/iptables/0008-unprivileged_0 | 60 +++++++++++++++++++ - iptables/xtables.c | 2 +- - 3 files changed, 66 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 795dff8605404..5aa14aebeb31e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3256,6 +3256,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) - err: - mnl_socket_close(nl); - -+ /* pretend revision 0 is valid if not permitted to check - -+ * this is required for printing extension help texts as user */ -+ if (ret < 0 && errno == EPERM && rev == 0) -+ return 1; -+ - return ret < 0 ? 0 : 1; - } - -diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 -new file mode 100755 -index 0000000000000..43e3bc8721dbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 -@@ -0,0 +1,60 @@ -+#!/bin/bash -+ -+# iptables may print match/target specific help texts -+# help output should work for unprivileged users -+ -+run() { -+ echo "running: $*" >&2 -+ runuser -u nobody -- "$@" -+} -+ -+grep_or_rc() { -+ declare -g rc -+ grep -q "$*" && return 0 -+ echo "missing in output: $*" >&2 -+ return 1 -+} -+ -+out=$(run $XT_MULTI iptables --help) -+let "rc+=$?" -+grep_or_rc "iptables -h (print this help information)" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -m limit --help) -+let "rc+=$?" -+grep_or_rc "limit match options:" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -p tcp --help) -+let "rc+=$?" -+grep_or_rc "tcp match options:" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -j DNAT --help) -+let "rc+=$?" -+grep_or_rc "DNAT target options:" <<< "$out" -+let "rc+=$?" -+ -+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) -+let "rc+=$?" -+grep_or_rc "tcp match options:" <<< "$out" -+let "rc+=$?" -+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help) -+let "rc+=$?" -+grep_or_rc "DNAT target options:" <<< "$out" -+let "rc+=$?" -+ -+ -+run $XT_MULTI iptables -L 2>&1 | \ -+ grep_or_rc "Permission denied" -+let "rc+=$?" -+ -+run $XT_MULTI iptables -A FORWARD -p tcp --dport 123 2>&1 | \ -+ grep_or_rc "Permission denied" -+let "rc+=$?" -+ -+run $XT_MULTI iptables -A FORWARD -j DNAT --to-destination 1.2.3.4 2>&1 | \ -+ grep_or_rc "Permission denied" -+let "rc+=$?" -+ -+exit $rc -diff --git a/iptables/xtables.c b/iptables/xtables.c -index 9779bd83d53b3..a16bba74dc578 100644 ---- a/iptables/xtables.c -+++ b/iptables/xtables.c -@@ -645,7 +645,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], - - printhelp(cs->matches); - p->command = CMD_NONE; -- return; -+ exit(0); - - /* - * Option selection --- -2.34.1 - diff --git a/0016-Improve-error-messages-for-unsupported-extensions.patch b/0016-Improve-error-messages-for-unsupported-extensions.patch deleted file mode 100644 index bd8282c..0000000 --- a/0016-Improve-error-messages-for-unsupported-extensions.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 721af7dfbfd5dc18af86e00d30de108dbf1687fb Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 11 Feb 2022 17:47:22 +0100 -Subject: [PATCH] Improve error messages for unsupported extensions - -If a given extension was not supported by the kernel, iptables would -print a rather confusing error message if extension parameters were -given: - -| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko -| # iptables -A FORWARD -j LOG --log-prefix foo -| iptables v1.8.7 (legacy): unknown option "--log-prefix" - -Avoid this by pretending extension revision 0 is always supported. It is -the same hack as used to successfully print extension help texts as -unprivileged user, extended to all error codes to serve privileged ones -as well. - -In addition, print a warning if kernel rejected revision 0 and it's not -a permissions problem. This helps users find out which extension in a -rule the kernel didn't like. - -Finally, the above commands result in these messages: - -| Warning: Extension LOG revision 0 not supported, missing kernel module? -| iptables: No chain/target/match by that name. - -Or, for iptables-nft: - -| Warning: Extension LOG revision 0 not supported, missing kernel module? -| iptables v1.8.7 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain FORWARD - -Signed-off-by: Phil Sutter -(cherry picked from commit 17534cb18ed0a5052dc45c117401251359dba6aa) ---- - iptables/nft.c | 12 +++++++++--- - libxtables/xtables.c | 7 ++++++- - 2 files changed, 15 insertions(+), 4 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 5aa14aebeb31e..0b1759c3e35ea 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3256,10 +3256,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt) - err: - mnl_socket_close(nl); - -- /* pretend revision 0 is valid if not permitted to check - -- * this is required for printing extension help texts as user */ -- if (ret < 0 && errno == EPERM && rev == 0) -+ /* pretend revision 0 is valid - -+ * this is required for printing extension help texts as user, also -+ * helps error messaging on unavailable kernel extension */ -+ if (ret < 0 && rev == 0) { -+ if (errno != EPERM) -+ fprintf(stderr, -+ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", -+ name); - return 1; -+ } - - return ret < 0 ? 0 : 1; - } -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index b0c969676bc85..10b985b7c3a79 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -929,7 +929,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt) - /* Definitely don't support this? */ - if (errno == ENOENT || errno == EPROTONOSUPPORT) { - close(sockfd); -- return 0; -+ /* Pretend revision 0 support for better error messaging */ -+ if (revision == 0) -+ fprintf(stderr, -+ "Warning: Extension %s revision 0 not supported, missing kernel module?\n", -+ name); -+ return (revision == 0); - } else if (errno == ENOPROTOOPT) { - close(sockfd); - /* Assume only revision 0 support (old kernel) */ --- -2.34.1 - diff --git a/iptables.spec b/iptables.spec index d8c8823..0d443bf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.7 -Release: 16%{?dist} +Version: 1.8.8 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -20,22 +20,7 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch -Patch02: 0002-iptables-nft-fix-Z-option.patch -Patch03: 0003-nft-Fix-bitwise-expression-avoidance-detection.patch -Patch04: 0004-extensions-sctp-Fix-nftables-translation.patch -Patch05: 0005-libxtables-Drop-leftover-variable-in-xtables_numeric.patch -Patch06: 0006-extensions-libebt_ip6-Drop-unused-variables.patch -Patch07: 0007-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch -Patch08: 0008-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch -Patch09: 0009-iptables-apply-Drop-unused-variable.patch -Patch10: 0010-nft-cache-Sort-chains-on-demand-only.patch -Patch11: 0011-nft-Increase-BATCH_PAGE_SIZE-to-support-huge-ruleset.patch -Patch12: 0012-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch -Patch13: 0013-nft-Fix-for-non-verbose-check-command.patch -Patch14: 0014-libxtables-Register-only-the-highest-revision-extens.patch -Patch15: 0015-xshared-Fix-response-to-unprivileged-users.patch -Patch16: 0016-Improve-error-messages-for-unsupported-extensions.patch +Patch01: 0001-xshared-Fix-build-for-Werror-format-security.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -53,7 +38,7 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.5 +BuildRequires: pkgconfig(libnftnl) >= 1.1.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf @@ -434,6 +419,9 @@ fi %changelog +* Fri May 13 2022 Phil Sutter - 1.8.8-1 +- Update to 1.8.8. Fixes rhbz#2085503 + * Thu Mar 03 2022 Phil Sutter - 1.8.7-16 - Improve error messages for unsupported extensions - xshared: Fix response to unprivileged users diff --git a/sources b/sources index e9a1323..014f6c0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.7.tar.bz2) = c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75 +SHA512 (iptables-1.8.8.tar.bz2) = f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59 From b28381ff810cfbf46a5c89a7d1cec2c9ae2eb588 Mon Sep 17 00:00:00 2001 From: Peter Robinson Date: Fri, 8 Jul 2022 11:48:31 +0100 Subject: [PATCH 32/79] iptables-services requires iptables-apply in utils to apply rules --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 0d443bf..d50d748 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.8 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -125,6 +125,7 @@ stable and may change with every new version. It is therefore unsupported. %package services Summary: iptables and ip6tables services for iptables Requires: %{name} = %{version}-%{release} +Requires: %{name}-utils = %{version}-%{release} %{?systemd_ordering} # obsolete old main package Obsoletes: %{name} < 1.4.16.1 @@ -419,6 +420,9 @@ fi %changelog +* Fri Jul 08 2022 Peter Robinson - 1.8.8-2 +- iptables-services requires iptables-apply in utils to apply rules + * Fri May 13 2022 Phil Sutter - 1.8.8-1 - Update to 1.8.8. Fixes rhbz#2085503 From 565364658d1907f178f2c412e6e7c0d9bcb4dbf9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 14:49:19 +0000 Subject: [PATCH 33/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d50d748..7a51dd4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.8 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -420,6 +420,9 @@ fi %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 1.8.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Fri Jul 08 2022 Peter Robinson - 1.8.8-2 - iptables-services requires iptables-apply in utils to apply rules From 4ee5eabf2a57eeb5750ca7bfc6befcba39aad965 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 12 Jan 2023 14:16:58 +0100 Subject: [PATCH 34/79] New version 1.8.9 - Make iptables-xml a relative symlink - Drop not needed xtables.conf - Ship iptables.xslt with iptables-legacy package - Ship ebtables-translate tool with iptables-nft package Resolves: rhbz#2160427 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 29 +++++++++++++++++++ ...Fix-build-for-Werror-format-security.patch | 29 ------------------- iptables.spec | 26 +++++++++++++---- sources | 2 +- 5 files changed, 52 insertions(+), 35 deletions(-) create mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0001-xshared-Fix-build-for-Werror-format-security.patch diff --git a/.gitignore b/.gitignore index d0729c1..141b2e8 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /iptables-1.8.6.tar.bz2 /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 +/iptables-1.8.9.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch new file mode 100644 index 0000000..ff8adfb --- /dev/null +++ b/0001-extensions-NAT-Fix-for-Werror-format-security.patch @@ -0,0 +1,29 @@ +From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Jan 2023 14:38:44 +0100 +Subject: [iptables PATCH] extensions: NAT: Fix for -Werror=format-security + +Have to pass either a string literal or format string to xt_xlate_add(). + +Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") +Signed-off-by: Phil Sutter +--- + extensions/libxt_NAT.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c +index da9f22012c5d6..2a6343986d54f 100644 +--- a/extensions/libxt_NAT.c ++++ b/extensions/libxt_NAT.c +@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, + if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) + return 0; + +- xt_xlate_add(xl, tgt); ++ xt_xlate_add(xl, "%s", tgt); + if (strlen(range_str)) + xt_xlate_add(xl, " to %s", range_str); + if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { +-- +2.38.0 + diff --git a/0001-xshared-Fix-build-for-Werror-format-security.patch b/0001-xshared-Fix-build-for-Werror-format-security.patch deleted file mode 100644 index ba6d2db..0000000 --- a/0001-xshared-Fix-build-for-Werror-format-security.patch +++ /dev/null @@ -1,29 +0,0 @@ -From fe9bd3b29dd7661e6f74c24db8356014798d1d78 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 13 May 2022 16:51:58 +0200 -Subject: [PATCH] xshared: Fix build for -Werror=format-security - -Gcc complains about the omitted format string. - -Signed-off-by: Phil Sutter -(cherry picked from commit b72eb12ea5a61df0655ad99d5048994e916be83a) ---- - iptables/xshared.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/xshared.c b/iptables/xshared.c -index fae5ddd5df93e..a8512d3808154 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - return; - - if (args->family != NFPROTO_ARP) -- xtables_error(PARAMETER_PROBLEM, msg); -+ xtables_error(PARAMETER_PROBLEM, "%s", msg); - - fprintf(stderr, "%s", msg); - } --- -2.34.1 - diff --git a/iptables.spec b/iptables.spec index 7a51dd4..40ac8cd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,9 +10,9 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.8 -Release: 3%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.bz2 +Version: 1.8.9 +Release: 1%{?dist} +Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config Source3: iptables.service @@ -20,7 +20,7 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-xshared-Fix-build-for-Werror-format-security.patch +Patch01: 0001-extensions-NAT-Fix-for-Werror-format-security.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -236,6 +236,13 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +# Drop xtables.conf, it's not used +rm -f %{buildroot}%{_sysconfdir}/xtables.conf + +# fix absolute symlink +rm -f %{buildroot}%{_bindir}/iptables-xml +ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml + %ldconfig_scriptlets %post legacy @@ -349,12 +356,12 @@ fi %files compat %files legacy -%doc INCOMPATIBILITIES %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs @@ -405,6 +412,7 @@ fi %{_sbindir}/{eb,arp}tables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor +%{_sbindir}/ebtables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -412,6 +420,7 @@ fi %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* +%{_mandir}/man8/ebtables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -420,6 +429,13 @@ fi %changelog +* Thu Jan 12 2023 Phil Sutter - 1.8.9-1 +- Make iptables-xml a relative symlink +- Drop not needed xtables.conf +- Ship iptables.xslt with iptables-legacy package +- Ship ebtables-translate tool with iptables-nft package +- Update to 1.8.9. + * Thu Jul 21 2022 Fedora Release Engineering - 1.8.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 014f6c0..fef1030 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.8.tar.bz2) = f21df23279a77531a23f3fcb1b8f0f8ec0c726bda236dd0e33af74b06753baff6ce3f26fb9fcceb6fada560656ba901e68fc6452eb840ac1b206bc4654950f59 +SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 From c7a1e984df7cbbd25916b84a2adbf662377bc689 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:19:17 +0000 Subject: [PATCH 35/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 40ac8cd..5860791 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -429,6 +429,9 @@ fi %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 1.8.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jan 12 2023 Phil Sutter - 1.8.9-1 - Make iptables-xml a relative symlink - Drop not needed xtables.conf From 7ae7437d5fc5e096749a942c73337d41c7a07d67 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 20 Apr 2023 13:16:15 +0200 Subject: [PATCH 36/79] iptables-1.8.9-3 - Support %%_excludedocs macro in alternatives installation --- iptables.spec | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5860791..1a8054f 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -295,7 +295,9 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %?ldconfig %systemd_postun iptables.service ip6tables.service -%post nft +%post -e nft +[[ %%{_excludedocs} == 1 ]] || do_man=true + pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ @@ -320,7 +322,7 @@ fi $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ - --slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz + ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables @@ -340,9 +342,9 @@ fi $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ - --slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \ - --slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \ - --slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \ + ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ + ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ --slave $lepfx-helper arptables-helper $lepfx-nft-helper %postun nft @@ -429,6 +431,9 @@ fi %changelog +* Thu Apr 20 2023 Phil Sutter - 1.8.9-3 +- Support %%_excludedocs macro in alternatives installation + * Thu Jan 19 2023 Fedora Release Engineering - 1.8.9-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 5463f77d3b7c37f6b637e4ab5c70c0eb2fc1aa30 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 24 May 2023 13:03:08 +0200 Subject: [PATCH 37/79] iptables-1.8.9-4 - Backport fixes from upstream --- ...s-NAT-Fix-for-Werror-format-security.patch | 7 +- 0002-etc-Drop-xtables.conf.patch | 132 ++++++++++ ...x-for-unknown-argument-error-message.patch | 148 +++++++++++ ...es-Refuse-unselected-targets-options.patch | 232 ++++++++++++++++++ ...-Properly-split-input-in-replay-mode.patch | 31 +++ ...bebt_redirect-Fix-target-translation.patch | 48 ++++ ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ++++ ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ++++ ...t_ip-Translation-has-to-match-on-eth.patch | 85 +++++++ ...the-missing-chunk-types-in-sctp_help.patch | 36 +++ ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 ++++++++ ...-for-deletion-of-new-referenced-rule.patch | 67 +++++ ...ables-Fix-checking-existence-of-rule.patch | 33 +++ 0014-nft-shared-Drop-unused-include.patch | 29 +++ ...rsing-of-inverted-arp-operation-matc.patch | 31 +++ ...-t-omit-standard-matches-if-inverted.patch | 42 ++++ ...ing-of-option-arguments-in-same-word.patch | 211 ++++++++++++++++ iptables.spec | 23 +- 18 files changed, 1349 insertions(+), 5 deletions(-) create mode 100644 0002-etc-Drop-xtables.conf.patch create mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch create mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch create mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch create mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch create mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch create mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch create mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch create mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch create mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch create mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch create mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch create mode 100644 0014-nft-shared-Drop-unused-include.patch create mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch create mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch create mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch index ff8adfb..cecd191 100644 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ b/0001-extensions-NAT-Fix-for-Werror-format-security.patch @@ -1,12 +1,13 @@ -From ed4082a7405a5838c205a34c1559e289949200cc Mon Sep 17 00:00:00 2001 +From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [iptables PATCH] extensions: NAT: Fix for -Werror=format-security +Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security Have to pass either a string literal or format string to xt_xlate_add(). Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") Signed-off-by: Phil Sutter +(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) --- extensions/libxt_NAT.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) @@ -25,5 +26,5 @@ index da9f22012c5d6..2a6343986d54f 100644 xt_xlate_add(xl, " to %s", range_str); if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { -- -2.38.0 +2.40.0 diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch new file mode 100644 index 0000000..e676561 --- /dev/null +++ b/0002-etc-Drop-xtables.conf.patch @@ -0,0 +1,132 @@ +From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 17 Jan 2023 16:38:43 +0100 +Subject: [PATCH] etc: Drop xtables.conf + +The file is not used since the commit this one fixes. Also it wasn't +installed until recently, when commit 3822a992bc277 ("Makefile: Fix for +'make distcheck'") added it in the wrong spot in an attempt to reduce +differences between tarballs generated by 'make tarball' and 'make +dist'. + +While being at it, drop stale xtables_config_main() prototype from +xtables-multi.h. + +Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") +Signed-off-by: Phil Sutter +(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) +--- + Makefile.am | 2 +- + etc/xtables.conf | 74 ---------------------------------------- + iptables/xtables-multi.h | 1 - + 3 files changed, 1 insertion(+), 76 deletions(-) + delete mode 100644 etc/xtables.conf + +diff --git a/Makefile.am b/Makefile.am +index 451c3cb2d5887..299ab46d7b8e2 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py + + if ENABLE_NFTABLES + confdir = $(sysconfdir) +-dist_conf_DATA = etc/ethertypes etc/xtables.conf ++dist_conf_DATA = etc/ethertypes + endif + + .PHONY: tarball +diff --git a/etc/xtables.conf b/etc/xtables.conf +deleted file mode 100644 +index 3c54ced043d82..0000000000000 +--- a/etc/xtables.conf ++++ /dev/null +@@ -1,74 +0,0 @@ +-family ipv4 { +- table raw { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 +- } +- +- table mangle { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 +- chain INPUT hook NF_INET_LOCAL_IN prio -150 +- chain FORWARD hook NF_INET_FORWARD prio -150 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 +- } +- +- table filter { +- chain INPUT hook NF_INET_LOCAL_IN prio 0 +- chain FORWARD hook NF_INET_FORWARD prio 0 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 +- } +- +- table nat { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 +- chain INPUT hook NF_INET_LOCAL_IN prio 100 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 +- } +- +- table security { +- chain INPUT hook NF_INET_LOCAL_IN prio 50 +- chain FORWARD hook NF_INET_FORWARD prio 50 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 +- } +-} +- +-family ipv6 { +- table raw { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 +- } +- +- table mangle { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 +- chain INPUT hook NF_INET_LOCAL_IN prio -150 +- chain FORWARD hook NF_INET_FORWARD prio -150 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 +- } +- +- table filter { +- chain INPUT hook NF_INET_LOCAL_IN prio 0 +- chain FORWARD hook NF_INET_FORWARD prio 0 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 +- } +- +- table nat { +- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 +- chain INPUT hook NF_INET_LOCAL_IN prio 100 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 +- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 +- } +- +- table security { +- chain INPUT hook NF_INET_LOCAL_IN prio 50 +- chain FORWARD hook NF_INET_FORWARD prio 50 +- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 +- } +-} +- +-family arp { +- table filter { +- chain INPUT hook NF_ARP_IN prio 0 +- chain OUTPUT hook NF_ARP_OUT prio 0 +- } +-} +diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h +index 94c24d5a22c7e..833c11a2ac914 100644 +--- a/iptables/xtables-multi.h ++++ b/iptables/xtables-multi.h +@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); + extern int xtables_eb_main(int, char **); + extern int xtables_eb_restore_main(int, char **); + extern int xtables_eb_save_main(int, char **); +-extern int xtables_config_main(int, char **); + extern int xtables_monitor_main(int, char **); + + extern struct xtables_globals arptables_globals; +-- +2.40.0 + diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch new file mode 100644 index 0000000..d807c54 --- /dev/null +++ b/0003-Proper-fix-for-unknown-argument-error-message.patch @@ -0,0 +1,148 @@ +From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 25 Jan 2023 01:51:43 +0100 +Subject: [PATCH] Proper fix for "unknown argument" error message + +While commit 1b8210f848631 kind of fixed the corner-case of invalid +short-options packed with others, it broke error reporting for +long-options. Revert it and deploy a proper solution: + +When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long +sets the variable 'optopt' to the invalid character's value. Use it for +reporting instead of optind if set. + +To distinguish between invalid options and missing option arguments, +ebtables-translate optstring needs adjustment. + +Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") +Signed-off-by: Phil Sutter +(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) +--- + .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ + iptables/xshared.c | 9 ++++-- + iptables/xtables-eb-translate.c | 8 ++--- + iptables/xtables-eb.c | 17 ++++++---- + 4 files changed, 50 insertions(+), 15 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 +new file mode 100755 +index 0000000000000..ac6e743966196 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 +@@ -0,0 +1,31 @@ ++#!/bin/bash ++ ++rc=0 ++ ++check() { ++ local cmd="$1" ++ local msg="$2" ++ ++ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { ++ echo "cmd: $XT_MULTI $1" ++ echo "exp: $msg" ++ echo "res: $($XT_MULTI $cmd 2>&1)" ++ rc=1 ++ } ++} ++ ++cmds="iptables ip6tables" ++[[ $XT_MULTI == *xtables-nft-multi ]] && { ++ cmds+=" ebtables" ++ cmds+=" iptables-translate" ++ cmds+=" ip6tables-translate" ++ cmds+=" ebtables-translate" ++} ++ ++for cmd in $cmds; do ++ check "${cmd} --foo" 'unknown option "--foo"' ++ check "${cmd} -A" 'option "-A" requires an argument' ++ check "${cmd} -aL" 'unknown option "-a"' ++done ++ ++exit $rc +diff --git a/iptables/xshared.c b/iptables/xshared.c +index f93529b11a319..ac51fac5ce9ed 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, + if (cs->c == ':') + xtables_error(PARAMETER_PROBLEM, "option \"%s\" " + "requires an argument", cs->argv[optind-1]); +- if (cs->c == '?') +- xtables_error(PARAMETER_PROBLEM, "unknown option " +- "\"%s\"", cs->argv[optind-1]); ++ if (cs->c == '?') { ++ char optoptstr[3] = {'-', optopt, '\0'}; ++ ++ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", ++ optopt ? optoptstr : cs->argv[optind - 1]); ++ } + xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); + } + +diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c +index 13b6b864a5f24..0c35272051752 100644 +--- a/iptables/xtables-eb-translate.c ++++ b/iptables/xtables-eb-translate.c +@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char + printf("nft "); + /* Getopt saves the day */ + while ((c = getopt_long(argc, argv, +- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { ++ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { + cs.c = c; + switch (c) { + case 'A': /* Add a rule */ +@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char + continue; + default: + ebt_check_inverse2(optarg, argc, argv); +- +- if (ebt_command_default(&cs)) +- xtables_error(PARAMETER_PROBLEM, +- "Unknown argument: '%s'", +- argv[optind - 1]); ++ ebt_command_default(&cs); + + if (command != 'A' && command != 'I' && + command != 'D') +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 7214a767ffe96..412b5cccdc46a 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) + return 0; + } + } +- return 1; ++ if (cs->c == ':') ++ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " ++ "requires an argument", cs->argv[optind - 1]); ++ if (cs->c == '?') { ++ char optoptstr[3] = {'-', optopt, '\0'}; ++ ++ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", ++ optopt ? optoptstr : cs->argv[optind - 1]); ++ } ++ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); + } + + int nft_init_eb(struct nft_handle *h, const char *pname) +@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + continue; + default: + ebt_check_inverse2(optarg, argc, argv); +- +- if (ebt_command_default(&cs)) +- xtables_error(PARAMETER_PROBLEM, +- "Unknown argument: '%s'", +- argv[optind]); ++ ebt_command_default(&cs); + + if (command != 'A' && command != 'I' && + command != 'D' && command != 'C' && command != 14) +-- +2.40.0 + diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch new file mode 100644 index 0000000..c41ba45 --- /dev/null +++ b/0004-ebtables-Refuse-unselected-targets-options.patch @@ -0,0 +1,232 @@ +From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 25 Jan 2023 02:01:56 +0100 +Subject: [PATCH] ebtables: Refuse unselected targets' options + +Unlike legacy, ebtables-nft would allow e.g.: + +| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be + +While the result is correct, it may mislead users into believing +multiple targets are possible per rule. Better follow legacy's behaviour +and reject target options unless they have been "enabled" by a previous +'-j' option. + +To achieve this, one needs to distinguish targets from watchers also +attached to 'xtables_targets' and otherwise behaving like regular +matches. Introduce XTABLES_EXT_WATCHER to mark the two. + +The above works already, but error messages are misleading when using +the now unsupported syntax since target options have been merged +already. Solve this by not pre-loading the targets at all, code will +just fall back to loading ad '-j' parsing time as iptables does. + +Note how this also fixes for 'counter' statement being in wrong position +of ebtables-translate output. + +Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") +Signed-off-by: Phil Sutter +(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) +--- + extensions/libebt_dnat.txlate | 12 ++++---- + extensions/libebt_log.c | 1 + + extensions/libebt_mark.txlate | 16 +++++----- + extensions/libebt_nflog.c | 1 + + extensions/libebt_snat.txlate | 8 ++--- + include/xtables.h | 1 + + .../ebtables/0002-ebtables-save-restore_0 | 4 +-- + iptables/xtables-eb.c | 29 +++++++------------ + 8 files changed, 33 insertions(+), 39 deletions(-) + +diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate +index 9f305c76c954f..531a22aa3e14f 100644 +--- a/extensions/libebt_dnat.txlate ++++ b/extensions/libebt_dnat.txlate +@@ -1,8 +1,8 @@ +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE +-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' ++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE ++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' +diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c +index 045062196d20d..9f8d158956802 100644 +--- a/extensions/libebt_log.c ++++ b/extensions/libebt_log.c +@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, + static struct xtables_target brlog_target = { + .name = "log", + .revision = 0, ++ .ext_flags = XTABLES_EXT_WATCHER, + .version = XTABLES_VERSION, + .family = NFPROTO_BRIDGE, + .size = XT_ALIGN(sizeof(struct ebt_log_info)), +diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate +index d006e8ac94008..4ace1a1f5cfde 100644 +--- a/extensions/libebt_mark.txlate ++++ b/extensions/libebt_mark.txlate +@@ -1,11 +1,11 @@ +-ebtables-translate -A INPUT --mark-set 42 +-nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' ++ebtables-translate -A INPUT -j mark --mark-set 42 ++nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' + +-ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN +-nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' ++ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN ++nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' + +-ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT +-nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' ++ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT ++nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' + +-ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP +-nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' ++ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP ++nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' +diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c +index 115e15da45845..762d6d5d8bbe2 100644 +--- a/extensions/libebt_nflog.c ++++ b/extensions/libebt_nflog.c +@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, + static struct xtables_target brnflog_watcher = { + .name = "nflog", + .revision = 0, ++ .ext_flags = XTABLES_EXT_WATCHER, + .version = XTABLES_VERSION, + .family = NFPROTO_BRIDGE, + .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), +diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate +index 857a6052aed1a..37343d3a14754 100644 +--- a/extensions/libebt_snat.txlate ++++ b/extensions/libebt_snat.txlate +@@ -1,5 +1,5 @@ +-ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff +-nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' ++ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff ++nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' + +-ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE +-nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' ++ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE ++nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' +diff --git a/include/xtables.h b/include/xtables.h +index 4ffc8ec5a17e9..087a1d600f9ae 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -203,6 +203,7 @@ struct xtables_lmap { + + enum xtables_ext_flags { + XTABLES_EXT_ALIAS = 1 << 0, ++ XTABLES_EXT_WATCHER = 1 << 1, + }; + + struct xt_xlate; +diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +index 1091a4e80bebe..b4f9728bb9b6f 100755 +--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 ++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT + + $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT + $XT_MULTI ebtables -A foo --log +-$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT ++$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT + $XT_MULTI ebtables -A foo --nflog + $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT + $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT +@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo + $XT_MULTI ebtables -N bar + $XT_MULTI ebtables -P bar RETURN + +-$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT ++$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT + #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 + + $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 412b5cccdc46a..3a73e79725489 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) + xtables_error(OTHER_PROBLEM, "Can't alloc memory"); + } + +-static void __ebt_load_watcher(const char *name, const char *typename) ++static void ebt_load_watcher(const char *name) + { + struct xtables_target *watcher; + size_t size; + + watcher = xtables_find_target(name, XTF_TRY_LOAD); + if (!watcher) { +- fprintf(stderr, "Unable to load %s %s\n", name, typename); ++ fprintf(stderr, "Unable to load %s watcher\n", name); + return; + } + +@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) + xtables_error(OTHER_PROBLEM, "Can't alloc memory"); + } + +-static void ebt_load_watcher(const char *name) +-{ +- return __ebt_load_watcher(name, "watcher"); +-} +- +-static void ebt_load_target(const char *name) +-{ +- return __ebt_load_watcher(name, "target"); +-} +- + void ebt_load_match_extensions(void) + { + opts = ebt_original_options; +@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) + + ebt_load_watcher("log"); + ebt_load_watcher("nflog"); +- +- ebt_load_target("mark"); +- ebt_load_target("dnat"); +- ebt_load_target("snat"); +- ebt_load_target("arpreply"); +- ebt_load_target("redirect"); +- ebt_load_target("standard"); + } + + void ebt_add_match(struct xtables_match *m, +@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) + + /* Is it a watcher option? */ + for (t = xtables_targets; t; t = t->next) { ++ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) ++ continue; ++ + if (t->parse && + t->parse(cs->c - t->option_offset, cs->argv, + ebt_invert, &t->tflags, NULL, &t->t)) { +@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + optind = 0; + opterr = false; + ++ for (t = xtables_targets; t; t = t->next) { ++ t->tflags = 0; ++ t->used = 0; ++ } ++ + /* Getopt saves the day */ + while ((c = getopt_long(argc, argv, EBT_OPTSTRING, + opts, NULL)) != -1) { +-- +2.40.0 + diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch new file mode 100644 index 0000000..dd58948 --- /dev/null +++ b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch @@ -0,0 +1,31 @@ +From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 18:48:33 +0100 +Subject: [PATCH] tests: xlate: Properly split input in replay mode + +Source command may contain quotes, using shlex.split() does the right +thing there. + +Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") +Signed-off-by: Phil Sutter +(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) +--- + xlate-test.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/xlate-test.py b/xlate-test.py +index 4cb1401b71677..217d2f0062682 100755 +--- a/xlate-test.py ++++ b/xlate-test.py +@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' + if sourceline.find(';') >= 0: + sourceline, searchline = sourceline.split(';') + +- srcwords = sourceline.split() ++ srcwords = shlex.split(sourceline) + + srccmd = srcwords[0] + ipt = srccmd.split('-')[0] +-- +2.40.0 + diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch new file mode 100644 index 0000000..b2f5481 --- /dev/null +++ b/0006-extensions-libebt_redirect-Fix-target-translation.patch @@ -0,0 +1,48 @@ +From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 31 Jan 2023 22:28:24 +0100 +Subject: [PATCH] extensions: libebt_redirect: Fix target translation + +While EBT_ACCEPT is the default verdict for ebtables targets, omitting +it from translation implicitly converts it into 'continue'. Omit the +non-default EBT_CONTINUE instead. + +Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) +--- + extensions/libebt_redirect.c | 2 +- + extensions/libebt_redirect.txlate | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + create mode 100644 extensions/libebt_redirect.txlate + +diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c +index 4d4c7a02cea89..389f3ccb53f60 100644 +--- a/extensions/libebt_redirect.c ++++ b/extensions/libebt_redirect.c +@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, + const struct ebt_redirect_info *red = (const void*)params->target->data; + + xt_xlate_add(xl, "meta set pkttype host"); +- if (red->target != EBT_ACCEPT) ++ if (red->target != EBT_CONTINUE) + xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); + return 1; + } +diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate +new file mode 100644 +index 0000000000000..f0dd5deaf6406 +--- /dev/null ++++ b/extensions/libebt_redirect.txlate +@@ -0,0 +1,8 @@ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' ++ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' ++ ++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' +-- +2.40.0 + diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch new file mode 100644 index 0000000..8f8dcf6 --- /dev/null +++ b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch @@ -0,0 +1,48 @@ +From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 31 Jan 2023 23:32:50 +0100 +Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in + translation + +Meta key comes before 'set' in meta statement. + +Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") +Signed-off-by: Phil Sutter +(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) +--- + extensions/libebt_redirect.c | 2 +- + extensions/libebt_redirect.txlate | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c +index 389f3ccb53f60..7821935e137aa 100644 +--- a/extensions/libebt_redirect.c ++++ b/extensions/libebt_redirect.c +@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, + { + const struct ebt_redirect_info *red = (const void*)params->target->data; + +- xt_xlate_add(xl, "meta set pkttype host"); ++ xt_xlate_add(xl, "meta pkttype set host"); + if (red->target != EBT_CONTINUE) + xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); + return 1; +diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate +index f0dd5deaf6406..d073ec774c4fa 100644 +--- a/extensions/libebt_redirect.txlate ++++ b/extensions/libebt_redirect.txlate +@@ -1,8 +1,8 @@ + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' + + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' + + ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE +-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' ++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' +-- +2.40.0 + diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch new file mode 100644 index 0000000..ad5a3ee --- /dev/null +++ b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch @@ -0,0 +1,50 @@ +From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 18:58:36 +0100 +Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation + +Converting from TOS field match to DSCP one is irreversible, so replay +testing is not possible. Use a raw payload expression to produce +something that translates 1:1 back into an 'ip' match. + +Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") +Signed-off-by: Phil Sutter +(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) +--- + extensions/libebt_ip.c | 4 ++-- + extensions/libebt_ip.txlate | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c +index fd87dae7e2c62..8b381aa10b5b7 100644 +--- a/extensions/libebt_ip.c ++++ b/extensions/libebt_ip.c +@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, + brip_xlate_nh(xl, info, EBT_IP_DEST); + + if (info->bitmask & EBT_IP_TOS) { +- xt_xlate_add(xl, "ip dscp "); ++ xt_xlate_add(xl, "@nh,8,8 "); + if (info->invflags & EBT_IP_TOS) + xt_xlate_add(xl, "!= "); +- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ ++ xt_xlate_add(xl, "0x%02x ", info->tos); + } + if (info->bitmask & EBT_IP_PROTO) { + struct protoent *pe; +diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate +index 75c1db246fb81..562e3157d7b92 100644 +--- a/extensions/libebt_ip.txlate ++++ b/extensions/libebt_ip.txlate +@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 + nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' + + ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff +-nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' ++nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' + + ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 + nft 'add rule bridge filter FORWARD tcp dport 22 counter' +-- +2.40.0 + diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch new file mode 100644 index 0000000..96cb5ad --- /dev/null +++ b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch @@ -0,0 +1,85 @@ +From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 17:37:40 +0100 +Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type + +On one hand, nft refuses th expression in bridge family if layer3 +protocol has not been assured by a previous match. On the other, ebt_ip +kernel module will only match on IPv4 packets, so there might be a +functional change in the translation versus the original. + +Instead of just always emitting an 'ether type' match, decide whether +it's actually needed - explicit "ip " payload matches (or +icmp ones) cause implicit creation of a match on IPv4 by nft. + +Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") +Signed-off-by: Phil Sutter +(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) +--- + extensions/libebt_ip.c | 21 +++++++++++++++++++++ + extensions/libebt_ip.txlate | 6 +++--- + 2 files changed, 24 insertions(+), 3 deletions(-) + +diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c +index 8b381aa10b5b7..68f34bff97deb 100644 +--- a/extensions/libebt_ip.c ++++ b/extensions/libebt_ip.c +@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, + xtables_ipmask_to_numeric(maskp)); + } + ++static bool may_skip_ether_type_dep(uint8_t flags) ++{ ++ /* these convert to "ip (s|d)addr" matches */ ++ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) ++ return true; ++ ++ /* icmp match triggers implicit ether type dependency in nft */ ++ if (flags & EBT_IP_ICMP) ++ return true; ++ ++ /* allow if "ip protocol" match is created by brip_xlate() */ ++ if (flags & EBT_IP_PROTO && ++ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) ++ return true; ++ ++ return false; ++} ++ + static int brip_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { +@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, + brip_xlate_nh(xl, info, EBT_IP_SOURCE); + brip_xlate_nh(xl, info, EBT_IP_DEST); + ++ if (!may_skip_ether_type_dep(info->bitmask)) ++ xt_xlate_add(xl, "ether type ip "); ++ + if (info->bitmask & EBT_IP_TOS) { + xt_xlate_add(xl, "@nh,8,8 "); + if (info->invflags & EBT_IP_TOS) +diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate +index 562e3157d7b92..28996832225cb 100644 +--- a/extensions/libebt_ip.txlate ++++ b/extensions/libebt_ip.txlate +@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 + nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' + + ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff +-nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' ++nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' + + ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 +-nft 'add rule bridge filter FORWARD tcp dport 22 counter' ++nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' + + ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 +-nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' ++nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' + + ebtables-translate -A FORWARD -p ip --ip-proto 253 + nft 'add rule bridge filter FORWARD ip protocol 253 counter' +-- +2.40.0 + diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch new file mode 100644 index 0000000..410a831 --- /dev/null +++ b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch @@ -0,0 +1,36 @@ +From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Tue, 21 Feb 2023 12:19:42 -0500 +Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help + +Add the missing chunk types in sctp_help(), so that the help cmd can +display these chunk types as below: + + # iptables -p sctp --help + + chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE + +Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") +Signed-off-by: Xin Long +Signed-off-by: Phil Sutter +(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) +--- + extensions/libxt_sctp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c +index fe5f5621a033d..6e2b2745dcbd5 100644 +--- a/extensions/libxt_sctp.c ++++ b/extensions/libxt_sctp.c +@@ -50,7 +50,7 @@ static void sctp_help(void) + " --dport ...\n" + "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" + " chunktypes are present\n" +-"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); ++"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); + } + + static const struct option sctp_opts[] = { +-- +2.40.0 + diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch new file mode 100644 index 0000000..e0915f5 --- /dev/null +++ b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch @@ -0,0 +1,101 @@ +From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 22 Feb 2023 16:36:16 +0100 +Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h + +When merging IP-version-specific LOG extensions, a dependency to that +header was introduced without caching it. Fix this and drop the now +unused ip{,6}t_LOG.h files. + +Reported-by: Thomas Devoogdt +Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") +Signed-off-by: Phil Sutter +(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) +--- + include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ + include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- + include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- + 3 files changed, 20 insertions(+), 38 deletions(-) + create mode 100644 include/linux/netfilter/xt_LOG.h + delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h + delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h + +diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h +new file mode 100644 +index 0000000000000..167d4ddd2476b +--- /dev/null ++++ b/include/linux/netfilter/xt_LOG.h +@@ -0,0 +1,20 @@ ++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ ++#ifndef _XT_LOG_H ++#define _XT_LOG_H ++ ++/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ ++#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ ++#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ ++#define XT_LOG_IPOPT 0x04 /* Log IP options */ ++#define XT_LOG_UID 0x08 /* Log UID owning local socket */ ++#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ ++#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ ++#define XT_LOG_MASK 0x2f ++ ++struct xt_log_info { ++ unsigned char level; ++ unsigned char logflags; ++ char prefix[30]; ++}; ++ ++#endif /* _XT_LOG_H */ +diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h +deleted file mode 100644 +index dcdbadf9fd4a9..0000000000000 +--- a/include/linux/netfilter_ipv4/ipt_LOG.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-#ifndef _IPT_LOG_H +-#define _IPT_LOG_H +- +-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ +-#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ +-#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ +-#define IPT_LOG_IPOPT 0x04 /* Log IP options */ +-#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ +-#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ +-#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ +-#define IPT_LOG_MASK 0x2f +- +-struct ipt_log_info { +- unsigned char level; +- unsigned char logflags; +- char prefix[30]; +-}; +- +-#endif /*_IPT_LOG_H*/ +diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h +deleted file mode 100644 +index 9dd5579e02ec7..0000000000000 +--- a/include/linux/netfilter_ipv6/ip6t_LOG.h ++++ /dev/null +@@ -1,19 +0,0 @@ +-#ifndef _IP6T_LOG_H +-#define _IP6T_LOG_H +- +-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ +-#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ +-#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ +-#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ +-#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ +-#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ +-#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ +-#define IP6T_LOG_MASK 0x2f +- +-struct ip6t_log_info { +- unsigned char level; +- unsigned char logflags; +- char prefix[30]; +-}; +- +-#endif /*_IPT_LOG_H*/ +-- +2.40.0 + diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch new file mode 100644 index 0000000..8b20709 --- /dev/null +++ b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch @@ -0,0 +1,67 @@ +From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Feb 2023 18:09:25 +0100 +Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule + +Combining multiple corner-cases here: + +* Insert a rule before another new one which is not the first. Triggers + NFTNL_RULE_ID assignment of the latter. + +* Delete the referenced new rule in the same batch again. Causes + overwriting of the previously assigned RULE_ID. + +Consequently, iptables-nft-restore fails during *insert*, because the +reference is dangling. + +Reported-by: Eric Garver +Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") +Signed-off-by: Phil Sutter +Tested-by: Eric Garver +(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) +--- + iptables/nft.c | 3 ++- + .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ + 2 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 63468cf3b1344..5896fd410ca78 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) + + nftnl_rule_list_del(r); + +- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) ++ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && ++ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) + nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); + + obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); +diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +index 3f1d229e915ff..5482b7ea17298 100755 +--- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 ++++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 +@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT + -A FORWARD -m comment --comment "rule 3" -j ACCEPT' + + diff -u -Z <(echo -e "$EXPECT") <(ipt_show) ++ ++# test adding, referencing and deleting the same rule in a batch ++ ++$XT_MULTI iptables-restore < +Date: Mon, 3 Apr 2023 23:13:47 +0200 +Subject: [PATCH] ip6tables: Fix checking existence of rule + +Pass the proper entry size when creating a match mask for checking the +existence of a rule. Failing to do so causes wrong results. + +Reported-by: Jonathan Caicedo +Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") +Signed-off-by: Markus Boehme +Signed-off-by: Phil Sutter +(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) +--- + iptables/ip6tables.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c +index 345af4519bfe7..9afc32c1a21ed 100644 +--- a/iptables/ip6tables.c ++++ b/iptables/ip6tables.c +@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, + int ret = 1; + unsigned char *mask; + +- mask = make_delete_mask(matches, target, sizeof(fw)); ++ mask = make_delete_mask(matches, target, sizeof(*fw)); + for (i = 0; i < nsaddrs; i++) { + fw->ipv6.src = saddrs[i]; + fw->ipv6.smsk = smasks[i]; +-- +2.40.0 + diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch new file mode 100644 index 0000000..c4274ca --- /dev/null +++ b/0014-nft-shared-Drop-unused-include.patch @@ -0,0 +1,29 @@ +From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Mar 2023 16:22:16 +0200 +Subject: [PATCH] nft-shared: Drop unused include + +Code does not refer to struct xt_comment_info anymore. + +Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") +Signed-off-by: Phil Sutter +(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) +--- + iptables/nft-shared.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 4a7b5406892c4..4ba44a4aa4d17 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -22,7 +22,6 @@ + #include + + #include +-#include + #include + #include + #include +-- +2.40.0 + diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch new file mode 100644 index 0000000..5474f8a --- /dev/null +++ b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch @@ -0,0 +1,31 @@ +From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:33:43 +0200 +Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match + +The wrong bit was set in 'invflags', probably due to copy'n'paste from +the previous case. + +Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") +Signed-off-by: Phil Sutter +(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) +--- + iptables/nft-arp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 210f43d2cefbe..8fae5adc50216 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, + fw->arp.arhln = ar_hln; + fw->arp.arhln_mask = 0xff; + if (inv) +- fw->arp.invflags |= IPT_INV_ARPOP; ++ fw->arp.invflags |= IPT_INV_ARPHLN; + break; + case offsetof(struct arphdr, ar_pln): + get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); +-- +2.40.0 + diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch new file mode 100644 index 0000000..1efb846 --- /dev/null +++ b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch @@ -0,0 +1,42 @@ +From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:37:47 +0200 +Subject: [PATCH] arptables: Don't omit standard matches if inverted + +Inverted --h-len and --h-type matches were omitted from output by +accident if they matched on their standard value. + +Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") +Signed-off-by: Phil Sutter +(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) +--- + iptables/nft-arp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 8fae5adc50216..df3ad430cf701 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, + + after_devdst: + +- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { ++ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || ++ fw->arp.invflags & IPT_INV_ARPHLN) { + printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN + ? "! " : ""); + printf("--h-length %d", fw->arp.arhln); +@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, + sep = " "; + } + +- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { ++ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || ++ fw->arp.invflags & IPT_INV_ARPHRD) { + uint16_t tmp = ntohs(fw->arp.arhrd); + + printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD +-- +2.40.0 + diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch new file mode 100644 index 0000000..9c5cbd2 --- /dev/null +++ b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch @@ -0,0 +1,211 @@ +From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Apr 2023 14:41:08 +0200 +Subject: [PATCH] xshared: Fix parsing of option arguments in same word + +When merging commandline parsers, a decision between 'argv[optind - 1]' +and 'optarg' had to be made in some spots. While the implementation of +check_inverse() required the former, use of the latter allows for the +common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at +the suffix while 'argv[optind - 1]' will just point at the following +option. + +Fix the mess by making check_inverse() update optarg pointer if needed +so calling code may refer to and always correct 'optarg'. + +Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 +Signed-off-by: Phil Sutter +(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) +--- + extensions/libarpt_standard.t | 2 ++ + extensions/libxt_standard.t | 3 ++ + iptables/xshared.c | 61 +++++++++++++++++------------------ + 3 files changed, 35 insertions(+), 31 deletions(-) + +diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t +index e84a00b780488..007fa2b8335e8 100644 +--- a/extensions/libarpt_standard.t ++++ b/extensions/libarpt_standard.t +@@ -12,3 +12,5 @@ + -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK + --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK + ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK ++--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK ++--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK +diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t +index 56d6da2e5884e..6ed978e442b80 100644 +--- a/extensions/libxt_standard.t ++++ b/extensions/libxt_standard.t +@@ -21,3 +21,6 @@ + -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK + -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK + -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK ++:FORWARD ++--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK ++-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index ac51fac5ce9ed..17aed04e02b09 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) + } + + static void check_inverse(struct xtables_args *args, const char option[], +- bool *invert, int *optidx, int argc) ++ bool *invert, int argc, char **argv) + { + switch (args->family) { + case NFPROTO_ARP: +@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], + xtables_error(PARAMETER_PROBLEM, + "Multiple `!' flags not allowed"); + *invert = true; +- if (optidx) { +- *optidx = *optidx + 1; +- if (argc && *optidx > argc) +- xtables_error(PARAMETER_PROBLEM, +- "no argument following `!'"); +- } ++ optind++; ++ if (optind > argc) ++ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); ++ ++ optarg = argv[optind - 1]; + } + + static const char *optstring_lookup(int family) +@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], + * Option selection + */ + case 'p': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_PROTOCOL, + &args->invflags, invert); + + /* Canonicalize into lower case */ +- for (cs->protocol = argv[optind - 1]; ++ for (cs->protocol = optarg; + *cs->protocol; cs->protocol++) + *cs->protocol = tolower(*cs->protocol); + +- cs->protocol = argv[optind - 1]; ++ cs->protocol = optarg; + args->proto = xtables_parse_protocol(cs->protocol); + + if (args->proto == 0 && +@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], + break; + + case 's': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_SOURCE, + &args->invflags, invert); +- args->shostnetworkmask = argv[optind - 1]; ++ args->shostnetworkmask = optarg; + break; + + case 'd': +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_DESTINATION, + &args->invflags, invert); +- args->dhostnetworkmask = argv[optind - 1]; ++ args->dhostnetworkmask = optarg; + break; + + #ifdef IPT_F_GOTO +@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], + #endif + + case 2:/* src-mac */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_S_MAC, &args->invflags, + invert); +- args->src_mac = argv[optind - 1]; ++ args->src_mac = optarg; + break; + + case 3:/* dst-mac */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_D_MAC, &args->invflags, + invert); +- args->dst_mac = argv[optind - 1]; ++ args->dst_mac = optarg; + break; + + case 'l':/* hardware length */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_H_LENGTH, &args->invflags, + invert); +- args->arp_hlen = argv[optind - 1]; ++ args->arp_hlen = optarg; + break; + + case 8: /* was never supported, not even in arptables-legacy */ + xtables_error(PARAMETER_PROBLEM, "not supported"); + case 4:/* opcode */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_OPCODE, &args->invflags, + invert); +- args->arp_opcode = argv[optind - 1]; ++ args->arp_opcode = optarg; + break; + + case 5:/* h-type */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_H_TYPE, &args->invflags, + invert); +- args->arp_htype = argv[optind - 1]; ++ args->arp_htype = optarg; + break; + + case 6:/* proto-type */ +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_P_TYPE, &args->invflags, + invert); +- args->arp_ptype = argv[optind - 1]; ++ args->arp_ptype = optarg; + break; + + case 'j': + set_option(&cs->options, OPT_JUMP, &args->invflags, + invert); +- command_jump(cs, argv[optind - 1]); ++ command_jump(cs, optarg); + break; + + case 'i': + check_empty_interface(args, optarg); +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_VIANAMEIN, + &args->invflags, invert); +- xtables_parse_interface(argv[optind - 1], ++ xtables_parse_interface(optarg, + args->iniface, + args->iniface_mask); + break; + + case 'o': + check_empty_interface(args, optarg); +- check_inverse(args, optarg, &invert, &optind, argc); ++ check_inverse(args, optarg, &invert, argc, argv); + set_option(&cs->options, OPT_VIANAMEOUT, + &args->invflags, invert); +- xtables_parse_interface(argv[optind - 1], ++ xtables_parse_interface(optarg, + args->outiface, + args->outiface_mask); + break; +-- +2.40.0 + diff --git a/iptables.spec b/iptables.spec index 1a8054f..d779895 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,7 +20,23 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch01: 0001-extensions-NAT-Fix-for-Werror-format-security.patch +Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch +Patch002: 0002-etc-Drop-xtables.conf.patch +Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch +Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch +Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch +Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch +Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch +Patch014: 0014-nft-shared-Drop-unused-include.patch +Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -431,6 +447,9 @@ fi %changelog +* Wed May 24 2023 Phil Sutter - 1.8.9-4 +- Backport fixes from upstream + * Thu Apr 20 2023 Phil Sutter - 1.8.9-3 - Support %%_excludedocs macro in alternatives installation From 21624d30276597c18535a0ea0fb582d95dbbf062 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 07:35:31 +0000 Subject: [PATCH 38/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d779895..34455fc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -447,6 +447,9 @@ fi %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream From dc297257aab2e1372cf34d97a1ffdd5e5241733b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 15 Aug 2023 11:39:21 +0200 Subject: [PATCH 39/79] Convert license to SPDX format Signed-off-by: Phil Sutter --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 34455fc..57a50f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -40,7 +40,7 @@ Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 -License: GPLv2 and Artistic Licence 2.0 and ISC +License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) @@ -447,6 +447,9 @@ fi %changelog +* Tue Aug 15 2023 Phil Sutter - 1.8.9-6 +- Convert license to SPDX format + * Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 97407d1230d0860c3660855169def22be7749da7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 17:33:55 +0200 Subject: [PATCH 40/79] iptables-1.8.10-1 - New version 1.8.10 - Drop compat sub-package Resolves: rhbz#2243041 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 30 --- 0002-etc-Drop-xtables.conf.patch | 132 ---------- ...x-for-unknown-argument-error-message.patch | 148 ----------- ...es-Refuse-unselected-targets-options.patch | 232 ------------------ ...-Properly-split-input-in-replay-mode.patch | 31 --- ...bebt_redirect-Fix-target-translation.patch | 48 ---- ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ---- ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ---- ...t_ip-Translation-has-to-match-on-eth.patch | 85 ------- ...the-missing-chunk-types-in-sctp_help.patch | 36 --- ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 -------- ...-for-deletion-of-new-referenced-rule.patch | 67 ----- ...ables-Fix-checking-existence-of-rule.patch | 33 --- 0014-nft-shared-Drop-unused-include.patch | 29 --- ...rsing-of-inverted-arp-operation-matc.patch | 31 --- ...-t-omit-standard-matches-if-inverted.patch | 42 ---- ...ing-of-option-arguments-in-same-word.patch | 211 ---------------- iptables.spec | 44 +--- sources | 2 +- 20 files changed, 9 insertions(+), 1392 deletions(-) delete mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0002-etc-Drop-xtables.conf.patch delete mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch delete mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch delete mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch delete mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch delete mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch delete mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch delete mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch delete mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch delete mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch delete mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch delete mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch delete mode 100644 0014-nft-shared-Drop-unused-include.patch delete mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch delete mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch delete mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/.gitignore b/.gitignore index 141b2e8..4cb5d7a 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz +/iptables-1.8.10.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch deleted file mode 100644 index cecd191..0000000 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ /dev/null @@ -1,30 +0,0 @@ -From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security - -Have to pass either a string literal or format string to xt_xlate_add(). - -Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") -Signed-off-by: Phil Sutter -(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) ---- - extensions/libxt_NAT.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c -index da9f22012c5d6..2a6343986d54f 100644 ---- a/extensions/libxt_NAT.c -+++ b/extensions/libxt_NAT.c -@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, - if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) - return 0; - -- xt_xlate_add(xl, tgt); -+ xt_xlate_add(xl, "%s", tgt); - if (strlen(range_str)) - xt_xlate_add(xl, " to %s", range_str); - if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { --- -2.40.0 - diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch deleted file mode 100644 index e676561..0000000 --- a/0002-etc-Drop-xtables.conf.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Jan 2023 16:38:43 +0100 -Subject: [PATCH] etc: Drop xtables.conf - -The file is not used since the commit this one fixes. Also it wasn't -installed until recently, when commit 3822a992bc277 ("Makefile: Fix for -'make distcheck'") added it in the wrong spot in an attempt to reduce -differences between tarballs generated by 'make tarball' and 'make -dist'. - -While being at it, drop stale xtables_config_main() prototype from -xtables-multi.h. - -Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") -Signed-off-by: Phil Sutter -(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) ---- - Makefile.am | 2 +- - etc/xtables.conf | 74 ---------------------------------------- - iptables/xtables-multi.h | 1 - - 3 files changed, 1 insertion(+), 76 deletions(-) - delete mode 100644 etc/xtables.conf - -diff --git a/Makefile.am b/Makefile.am -index 451c3cb2d5887..299ab46d7b8e2 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py - - if ENABLE_NFTABLES - confdir = $(sysconfdir) --dist_conf_DATA = etc/ethertypes etc/xtables.conf -+dist_conf_DATA = etc/ethertypes - endif - - .PHONY: tarball -diff --git a/etc/xtables.conf b/etc/xtables.conf -deleted file mode 100644 -index 3c54ced043d82..0000000000000 ---- a/etc/xtables.conf -+++ /dev/null -@@ -1,74 +0,0 @@ --family ipv4 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family ipv6 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family arp { -- table filter { -- chain INPUT hook NF_ARP_IN prio 0 -- chain OUTPUT hook NF_ARP_OUT prio 0 -- } --} -diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h -index 94c24d5a22c7e..833c11a2ac914 100644 ---- a/iptables/xtables-multi.h -+++ b/iptables/xtables-multi.h -@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); - extern int xtables_eb_main(int, char **); - extern int xtables_eb_restore_main(int, char **); - extern int xtables_eb_save_main(int, char **); --extern int xtables_config_main(int, char **); - extern int xtables_monitor_main(int, char **); - - extern struct xtables_globals arptables_globals; --- -2.40.0 - diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch deleted file mode 100644 index d807c54..0000000 --- a/0003-Proper-fix-for-unknown-argument-error-message.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 01:51:43 +0100 -Subject: [PATCH] Proper fix for "unknown argument" error message - -While commit 1b8210f848631 kind of fixed the corner-case of invalid -short-options packed with others, it broke error reporting for -long-options. Revert it and deploy a proper solution: - -When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long -sets the variable 'optopt' to the invalid character's value. Use it for -reporting instead of optind if set. - -To distinguish between invalid options and missing option arguments, -ebtables-translate optstring needs adjustment. - -Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") -Signed-off-by: Phil Sutter -(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) ---- - .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ - iptables/xshared.c | 9 ++++-- - iptables/xtables-eb-translate.c | 8 ++--- - iptables/xtables-eb.c | 17 ++++++---- - 4 files changed, 50 insertions(+), 15 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -new file mode 100755 -index 0000000000000..ac6e743966196 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -@@ -0,0 +1,31 @@ -+#!/bin/bash -+ -+rc=0 -+ -+check() { -+ local cmd="$1" -+ local msg="$2" -+ -+ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { -+ echo "cmd: $XT_MULTI $1" -+ echo "exp: $msg" -+ echo "res: $($XT_MULTI $cmd 2>&1)" -+ rc=1 -+ } -+} -+ -+cmds="iptables ip6tables" -+[[ $XT_MULTI == *xtables-nft-multi ]] && { -+ cmds+=" ebtables" -+ cmds+=" iptables-translate" -+ cmds+=" ip6tables-translate" -+ cmds+=" ebtables-translate" -+} -+ -+for cmd in $cmds; do -+ check "${cmd} --foo" 'unknown option "--foo"' -+ check "${cmd} -A" 'option "-A" requires an argument' -+ check "${cmd} -aL" 'unknown option "-a"' -+done -+ -+exit $rc -diff --git a/iptables/xshared.c b/iptables/xshared.c -index f93529b11a319..ac51fac5ce9ed 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, - if (cs->c == ':') - xtables_error(PARAMETER_PROBLEM, "option \"%s\" " - "requires an argument", cs->argv[optind-1]); -- if (cs->c == '?') -- xtables_error(PARAMETER_PROBLEM, "unknown option " -- "\"%s\"", cs->argv[optind-1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } - xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - -diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c -index 13b6b864a5f24..0c35272051752 100644 ---- a/iptables/xtables-eb-translate.c -+++ b/iptables/xtables-eb-translate.c -@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - printf("nft "); - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, -- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { -+ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { - cs.c = c; - switch (c) { - case 'A': /* Add a rule */ -@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind - 1]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D') -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 7214a767ffe96..412b5cccdc46a 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) - return 0; - } - } -- return 1; -+ if (cs->c == ':') -+ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " -+ "requires an argument", cs->argv[optind - 1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } -+ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - - int nft_init_eb(struct nft_handle *h, const char *pname) -@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D' && command != 'C' && command != 14) --- -2.40.0 - diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch deleted file mode 100644 index c41ba45..0000000 --- a/0004-ebtables-Refuse-unselected-targets-options.patch +++ /dev/null @@ -1,232 +0,0 @@ -From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 02:01:56 +0100 -Subject: [PATCH] ebtables: Refuse unselected targets' options - -Unlike legacy, ebtables-nft would allow e.g.: - -| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be - -While the result is correct, it may mislead users into believing -multiple targets are possible per rule. Better follow legacy's behaviour -and reject target options unless they have been "enabled" by a previous -'-j' option. - -To achieve this, one needs to distinguish targets from watchers also -attached to 'xtables_targets' and otherwise behaving like regular -matches. Introduce XTABLES_EXT_WATCHER to mark the two. - -The above works already, but error messages are misleading when using -the now unsupported syntax since target options have been merged -already. Solve this by not pre-loading the targets at all, code will -just fall back to loading ad '-j' parsing time as iptables does. - -Note how this also fixes for 'counter' statement being in wrong position -of ebtables-translate output. - -Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") -Signed-off-by: Phil Sutter -(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) ---- - extensions/libebt_dnat.txlate | 12 ++++---- - extensions/libebt_log.c | 1 + - extensions/libebt_mark.txlate | 16 +++++----- - extensions/libebt_nflog.c | 1 + - extensions/libebt_snat.txlate | 8 ++--- - include/xtables.h | 1 + - .../ebtables/0002-ebtables-save-restore_0 | 4 +-- - iptables/xtables-eb.c | 29 +++++++------------ - 8 files changed, 33 insertions(+), 39 deletions(-) - -diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate -index 9f305c76c954f..531a22aa3e14f 100644 ---- a/extensions/libebt_dnat.txlate -+++ b/extensions/libebt_dnat.txlate -@@ -1,8 +1,8 @@ --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' -diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c -index 045062196d20d..9f8d158956802 100644 ---- a/extensions/libebt_log.c -+++ b/extensions/libebt_log.c -@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, - static struct xtables_target brlog_target = { - .name = "log", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_log_info)), -diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate -index d006e8ac94008..4ace1a1f5cfde 100644 ---- a/extensions/libebt_mark.txlate -+++ b/extensions/libebt_mark.txlate -@@ -1,11 +1,11 @@ --ebtables-translate -A INPUT --mark-set 42 --nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-set 42 -+nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' - --ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN --nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' -+ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN -+nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' - --ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT --nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT -+nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' - --ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP --nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' -+ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP -+nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' -diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c -index 115e15da45845..762d6d5d8bbe2 100644 ---- a/extensions/libebt_nflog.c -+++ b/extensions/libebt_nflog.c -@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, - static struct xtables_target brnflog_watcher = { - .name = "nflog", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), -diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate -index 857a6052aed1a..37343d3a14754 100644 ---- a/extensions/libebt_snat.txlate -+++ b/extensions/libebt_snat.txlate -@@ -1,5 +1,5 @@ --ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff --nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff -+nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE --nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE -+nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' -diff --git a/include/xtables.h b/include/xtables.h -index 4ffc8ec5a17e9..087a1d600f9ae 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -203,6 +203,7 @@ struct xtables_lmap { - - enum xtables_ext_flags { - XTABLES_EXT_ALIAS = 1 << 0, -+ XTABLES_EXT_WATCHER = 1 << 1, - }; - - struct xt_xlate; -diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -index 1091a4e80bebe..b4f9728bb9b6f 100755 ---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT - - $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT - $XT_MULTI ebtables -A foo --log --$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT -+$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT - $XT_MULTI ebtables -A foo --nflog - $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT - $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT -@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo - $XT_MULTI ebtables -N bar - $XT_MULTI ebtables -P bar RETURN - --$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT -+$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT - #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 - - $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 412b5cccdc46a..3a73e79725489 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void __ebt_load_watcher(const char *name, const char *typename) -+static void ebt_load_watcher(const char *name) - { - struct xtables_target *watcher; - size_t size; - - watcher = xtables_find_target(name, XTF_TRY_LOAD); - if (!watcher) { -- fprintf(stderr, "Unable to load %s %s\n", name, typename); -+ fprintf(stderr, "Unable to load %s watcher\n", name); - return; - } - -@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void ebt_load_watcher(const char *name) --{ -- return __ebt_load_watcher(name, "watcher"); --} -- --static void ebt_load_target(const char *name) --{ -- return __ebt_load_watcher(name, "target"); --} -- - void ebt_load_match_extensions(void) - { - opts = ebt_original_options; -@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) - - ebt_load_watcher("log"); - ebt_load_watcher("nflog"); -- -- ebt_load_target("mark"); -- ebt_load_target("dnat"); -- ebt_load_target("snat"); -- ebt_load_target("arpreply"); -- ebt_load_target("redirect"); -- ebt_load_target("standard"); - } - - void ebt_add_match(struct xtables_match *m, -@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) - - /* Is it a watcher option? */ - for (t = xtables_targets; t; t = t->next) { -+ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) -+ continue; -+ - if (t->parse && - t->parse(cs->c - t->option_offset, cs->argv, - ebt_invert, &t->tflags, NULL, &t->t)) { -@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - optind = 0; - opterr = false; - -+ for (t = xtables_targets; t; t = t->next) { -+ t->tflags = 0; -+ t->used = 0; -+ } -+ - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, EBT_OPTSTRING, - opts, NULL)) != -1) { --- -2.40.0 - diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch deleted file mode 100644 index dd58948..0000000 --- a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:48:33 +0100 -Subject: [PATCH] tests: xlate: Properly split input in replay mode - -Source command may contain quotes, using shlex.split() does the right -thing there. - -Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") -Signed-off-by: Phil Sutter -(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) ---- - xlate-test.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/xlate-test.py b/xlate-test.py -index 4cb1401b71677..217d2f0062682 100755 ---- a/xlate-test.py -+++ b/xlate-test.py -@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' - if sourceline.find(';') >= 0: - sourceline, searchline = sourceline.split(';') - -- srcwords = sourceline.split() -+ srcwords = shlex.split(sourceline) - - srccmd = srcwords[0] - ipt = srccmd.split('-')[0] --- -2.40.0 - diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch deleted file mode 100644 index b2f5481..0000000 --- a/0006-extensions-libebt_redirect-Fix-target-translation.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 22:28:24 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix target translation - -While EBT_ACCEPT is the default verdict for ebtables targets, omitting -it from translation implicitly converts it into 'continue'. Omit the -non-default EBT_CONTINUE instead. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 8 ++++++++ - 2 files changed, 9 insertions(+), 1 deletion(-) - create mode 100644 extensions/libebt_redirect.txlate - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 4d4c7a02cea89..389f3ccb53f60 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, - const struct ebt_redirect_info *red = (const void*)params->target->data; - - xt_xlate_add(xl, "meta set pkttype host"); -- if (red->target != EBT_ACCEPT) -+ if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; - } -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -new file mode 100644 -index 0000000000000..f0dd5deaf6406 ---- /dev/null -+++ b/extensions/libebt_redirect.txlate -@@ -0,0 +1,8 @@ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' --- -2.40.0 - diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch deleted file mode 100644 index 8f8dcf6..0000000 --- a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 23:32:50 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in - translation - -Meta key comes before 'set' in meta statement. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 6 +++--- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 389f3ccb53f60..7821935e137aa 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, - { - const struct ebt_redirect_info *red = (const void*)params->target->data; - -- xt_xlate_add(xl, "meta set pkttype host"); -+ xt_xlate_add(xl, "meta pkttype set host"); - if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -index f0dd5deaf6406..d073ec774c4fa 100644 ---- a/extensions/libebt_redirect.txlate -+++ b/extensions/libebt_redirect.txlate -@@ -1,8 +1,8 @@ - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' --- -2.40.0 - diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch deleted file mode 100644 index ad5a3ee..0000000 --- a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:58:36 +0100 -Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation - -Converting from TOS field match to DSCP one is irreversible, so replay -testing is not possible. Use a raw payload expression to produce -something that translates 1:1 back into an 'ip' match. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) ---- - extensions/libebt_ip.c | 4 ++-- - extensions/libebt_ip.txlate | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index fd87dae7e2c62..8b381aa10b5b7 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_DEST); - - if (info->bitmask & EBT_IP_TOS) { -- xt_xlate_add(xl, "ip dscp "); -+ xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) - xt_xlate_add(xl, "!= "); -- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ -+ xt_xlate_add(xl, "0x%02x ", info->tos); - } - if (info->bitmask & EBT_IP_PROTO) { - struct protoent *pe; -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 75c1db246fb81..562e3157d7b92 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 - nft 'add rule bridge filter FORWARD tcp dport 22 counter' --- -2.40.0 - diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch deleted file mode 100644 index 96cb5ad..0000000 --- a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 17:37:40 +0100 -Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type - -On one hand, nft refuses th expression in bridge family if layer3 -protocol has not been assured by a previous match. On the other, ebt_ip -kernel module will only match on IPv4 packets, so there might be a -functional change in the translation versus the original. - -Instead of just always emitting an 'ether type' match, decide whether -it's actually needed - explicit "ip " payload matches (or -icmp ones) cause implicit creation of a match on IPv4 by nft. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) ---- - extensions/libebt_ip.c | 21 +++++++++++++++++++++ - extensions/libebt_ip.txlate | 6 +++--- - 2 files changed, 24 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index 8b381aa10b5b7..68f34bff97deb 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, - xtables_ipmask_to_numeric(maskp)); - } - -+static bool may_skip_ether_type_dep(uint8_t flags) -+{ -+ /* these convert to "ip (s|d)addr" matches */ -+ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) -+ return true; -+ -+ /* icmp match triggers implicit ether type dependency in nft */ -+ if (flags & EBT_IP_ICMP) -+ return true; -+ -+ /* allow if "ip protocol" match is created by brip_xlate() */ -+ if (flags & EBT_IP_PROTO && -+ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) -+ return true; -+ -+ return false; -+} -+ - static int brip_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { -@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_SOURCE); - brip_xlate_nh(xl, info, EBT_IP_DEST); - -+ if (!may_skip_ether_type_dep(info->bitmask)) -+ xt_xlate_add(xl, "ether type ip "); -+ - if (info->bitmask & EBT_IP_TOS) { - xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 562e3157d7b92..28996832225cb 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 --nft 'add rule bridge filter FORWARD tcp dport 22 counter' -+nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 --nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' -+nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto 253 - nft 'add rule bridge filter FORWARD ip protocol 253 counter' --- -2.40.0 - diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch deleted file mode 100644 index 410a831..0000000 --- a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Tue, 21 Feb 2023 12:19:42 -0500 -Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help - -Add the missing chunk types in sctp_help(), so that the help cmd can -display these chunk types as below: - - # iptables -p sctp --help - - chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE - -Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") -Signed-off-by: Xin Long -Signed-off-by: Phil Sutter -(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) ---- - extensions/libxt_sctp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index fe5f5621a033d..6e2b2745dcbd5 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -50,7 +50,7 @@ static void sctp_help(void) - " --dport ...\n" - "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" - " chunktypes are present\n" --"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); -+"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); - } - - static const struct option sctp_opts[] = { --- -2.40.0 - diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch deleted file mode 100644 index e0915f5..0000000 --- a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 22 Feb 2023 16:36:16 +0100 -Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h - -When merging IP-version-specific LOG extensions, a dependency to that -header was introduced without caching it. Fix this and drop the now -unused ip{,6}t_LOG.h files. - -Reported-by: Thomas Devoogdt -Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") -Signed-off-by: Phil Sutter -(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) ---- - include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ - include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- - include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- - 3 files changed, 20 insertions(+), 38 deletions(-) - create mode 100644 include/linux/netfilter/xt_LOG.h - delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h - delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h - -diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h -new file mode 100644 -index 0000000000000..167d4ddd2476b ---- /dev/null -+++ b/include/linux/netfilter/xt_LOG.h -@@ -0,0 +1,20 @@ -+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -+#ifndef _XT_LOG_H -+#define _XT_LOG_H -+ -+/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ -+#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ -+#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ -+#define XT_LOG_IPOPT 0x04 /* Log IP options */ -+#define XT_LOG_UID 0x08 /* Log UID owning local socket */ -+#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ -+#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ -+#define XT_LOG_MASK 0x2f -+ -+struct xt_log_info { -+ unsigned char level; -+ unsigned char logflags; -+ char prefix[30]; -+}; -+ -+#endif /* _XT_LOG_H */ -diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h -deleted file mode 100644 -index dcdbadf9fd4a9..0000000000000 ---- a/include/linux/netfilter_ipv4/ipt_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IPT_LOG_H --#define _IPT_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IPT_LOG_IPOPT 0x04 /* Log IP options */ --#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ --#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ --#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IPT_LOG_MASK 0x2f -- --struct ipt_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ -diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h -deleted file mode 100644 -index 9dd5579e02ec7..0000000000000 ---- a/include/linux/netfilter_ipv6/ip6t_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IP6T_LOG_H --#define _IP6T_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ --#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ --#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ --#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IP6T_LOG_MASK 0x2f -- --struct ip6t_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ --- -2.40.0 - diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch deleted file mode 100644 index 8b20709..0000000 --- a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Feb 2023 18:09:25 +0100 -Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule - -Combining multiple corner-cases here: - -* Insert a rule before another new one which is not the first. Triggers - NFTNL_RULE_ID assignment of the latter. - -* Delete the referenced new rule in the same batch again. Causes - overwriting of the previously assigned RULE_ID. - -Consequently, iptables-nft-restore fails during *insert*, because the -reference is dangling. - -Reported-by: Eric Garver -Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") -Signed-off-by: Phil Sutter -Tested-by: Eric Garver -(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) ---- - iptables/nft.c | 3 ++- - .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ - 2 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 63468cf3b1344..5896fd410ca78 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) - - nftnl_rule_list_del(r); - -- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) -+ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && -+ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) - nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); - - obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); -diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -index 3f1d229e915ff..5482b7ea17298 100755 ---- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -+++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT - -A FORWARD -m comment --comment "rule 3" -j ACCEPT' - - diff -u -Z <(echo -e "$EXPECT") <(ipt_show) -+ -+# test adding, referencing and deleting the same rule in a batch -+ -+$XT_MULTI iptables-restore < -Date: Mon, 3 Apr 2023 23:13:47 +0200 -Subject: [PATCH] ip6tables: Fix checking existence of rule - -Pass the proper entry size when creating a match mask for checking the -existence of a rule. Failing to do so causes wrong results. - -Reported-by: Jonathan Caicedo -Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") -Signed-off-by: Markus Boehme -Signed-off-by: Phil Sutter -(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) ---- - iptables/ip6tables.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c -index 345af4519bfe7..9afc32c1a21ed 100644 ---- a/iptables/ip6tables.c -+++ b/iptables/ip6tables.c -@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, - int ret = 1; - unsigned char *mask; - -- mask = make_delete_mask(matches, target, sizeof(fw)); -+ mask = make_delete_mask(matches, target, sizeof(*fw)); - for (i = 0; i < nsaddrs; i++) { - fw->ipv6.src = saddrs[i]; - fw->ipv6.smsk = smasks[i]; --- -2.40.0 - diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch deleted file mode 100644 index c4274ca..0000000 --- a/0014-nft-shared-Drop-unused-include.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Mar 2023 16:22:16 +0200 -Subject: [PATCH] nft-shared: Drop unused include - -Code does not refer to struct xt_comment_info anymore. - -Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") -Signed-off-by: Phil Sutter -(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) ---- - iptables/nft-shared.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 4a7b5406892c4..4ba44a4aa4d17 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -22,7 +22,6 @@ - #include - - #include --#include - #include - #include - #include --- -2.40.0 - diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch deleted file mode 100644 index 5474f8a..0000000 --- a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:33:43 +0200 -Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match - -The wrong bit was set in 'invflags', probably due to copy'n'paste from -the previous case. - -Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") -Signed-off-by: Phil Sutter -(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) ---- - iptables/nft-arp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 210f43d2cefbe..8fae5adc50216 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, - fw->arp.arhln = ar_hln; - fw->arp.arhln_mask = 0xff; - if (inv) -- fw->arp.invflags |= IPT_INV_ARPOP; -+ fw->arp.invflags |= IPT_INV_ARPHLN; - break; - case offsetof(struct arphdr, ar_pln): - get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); --- -2.40.0 - diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch deleted file mode 100644 index 1efb846..0000000 --- a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:37:47 +0200 -Subject: [PATCH] arptables: Don't omit standard matches if inverted - -Inverted --h-len and --h-type matches were omitted from output by -accident if they matched on their standard value. - -Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") -Signed-off-by: Phil Sutter -(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) ---- - iptables/nft-arp.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 8fae5adc50216..df3ad430cf701 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - - after_devdst: - -- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { -+ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || -+ fw->arp.invflags & IPT_INV_ARPHLN) { - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN - ? "! " : ""); - printf("--h-length %d", fw->arp.arhln); -@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - sep = " "; - } - -- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { -+ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || -+ fw->arp.invflags & IPT_INV_ARPHRD) { - uint16_t tmp = ntohs(fw->arp.arhrd); - - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD --- -2.40.0 - diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch deleted file mode 100644 index 9c5cbd2..0000000 --- a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +++ /dev/null @@ -1,211 +0,0 @@ -From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:41:08 +0200 -Subject: [PATCH] xshared: Fix parsing of option arguments in same word - -When merging commandline parsers, a decision between 'argv[optind - 1]' -and 'optarg' had to be made in some spots. While the implementation of -check_inverse() required the former, use of the latter allows for the -common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at -the suffix while 'argv[optind - 1]' will just point at the following -option. - -Fix the mess by making check_inverse() update optarg pointer if needed -so calling code may refer to and always correct 'optarg'. - -Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 -Signed-off-by: Phil Sutter -(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) ---- - extensions/libarpt_standard.t | 2 ++ - extensions/libxt_standard.t | 3 ++ - iptables/xshared.c | 61 +++++++++++++++++------------------ - 3 files changed, 35 insertions(+), 31 deletions(-) - -diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t -index e84a00b780488..007fa2b8335e8 100644 ---- a/extensions/libarpt_standard.t -+++ b/extensions/libarpt_standard.t -@@ -12,3 +12,5 @@ - -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK - --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK - ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK -+--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK -+--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK -diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t -index 56d6da2e5884e..6ed978e442b80 100644 ---- a/extensions/libxt_standard.t -+++ b/extensions/libxt_standard.t -@@ -21,3 +21,6 @@ - -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK - -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK - -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK -+:FORWARD -+--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -+-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index ac51fac5ce9ed..17aed04e02b09 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - } - - static void check_inverse(struct xtables_args *args, const char option[], -- bool *invert, int *optidx, int argc) -+ bool *invert, int argc, char **argv) - { - switch (args->family) { - case NFPROTO_ARP: -@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], - xtables_error(PARAMETER_PROBLEM, - "Multiple `!' flags not allowed"); - *invert = true; -- if (optidx) { -- *optidx = *optidx + 1; -- if (argc && *optidx > argc) -- xtables_error(PARAMETER_PROBLEM, -- "no argument following `!'"); -- } -+ optind++; -+ if (optind > argc) -+ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); -+ -+ optarg = argv[optind - 1]; - } - - static const char *optstring_lookup(int family) -@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], - * Option selection - */ - case 'p': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_PROTOCOL, - &args->invflags, invert); - - /* Canonicalize into lower case */ -- for (cs->protocol = argv[optind - 1]; -+ for (cs->protocol = optarg; - *cs->protocol; cs->protocol++) - *cs->protocol = tolower(*cs->protocol); - -- cs->protocol = argv[optind - 1]; -+ cs->protocol = optarg; - args->proto = xtables_parse_protocol(cs->protocol); - - if (args->proto == 0 && -@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], - break; - - case 's': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_SOURCE, - &args->invflags, invert); -- args->shostnetworkmask = argv[optind - 1]; -+ args->shostnetworkmask = optarg; - break; - - case 'd': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_DESTINATION, - &args->invflags, invert); -- args->dhostnetworkmask = argv[optind - 1]; -+ args->dhostnetworkmask = optarg; - break; - - #ifdef IPT_F_GOTO -@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], - #endif - - case 2:/* src-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_S_MAC, &args->invflags, - invert); -- args->src_mac = argv[optind - 1]; -+ args->src_mac = optarg; - break; - - case 3:/* dst-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_D_MAC, &args->invflags, - invert); -- args->dst_mac = argv[optind - 1]; -+ args->dst_mac = optarg; - break; - - case 'l':/* hardware length */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_LENGTH, &args->invflags, - invert); -- args->arp_hlen = argv[optind - 1]; -+ args->arp_hlen = optarg; - break; - - case 8: /* was never supported, not even in arptables-legacy */ - xtables_error(PARAMETER_PROBLEM, "not supported"); - case 4:/* opcode */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_OPCODE, &args->invflags, - invert); -- args->arp_opcode = argv[optind - 1]; -+ args->arp_opcode = optarg; - break; - - case 5:/* h-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_TYPE, &args->invflags, - invert); -- args->arp_htype = argv[optind - 1]; -+ args->arp_htype = optarg; - break; - - case 6:/* proto-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_P_TYPE, &args->invflags, - invert); -- args->arp_ptype = argv[optind - 1]; -+ args->arp_ptype = optarg; - break; - - case 'j': - set_option(&cs->options, OPT_JUMP, &args->invflags, - invert); -- command_jump(cs, argv[optind - 1]); -+ command_jump(cs, optarg); - break; - - case 'i': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEIN, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->iniface, - args->iniface_mask); - break; - - case 'o': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEOUT, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->outiface, - args->outiface_mask); - break; --- -2.40.0 - diff --git a/iptables.spec b/iptables.spec index 57a50f4..e37c5e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.9 -Release: 6%{?dist} +Version: 1.8.10 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,24 +20,6 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch -Patch002: 0002-etc-Drop-xtables.conf.patch -Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch -Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch -Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch -Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch -Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch -Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch -Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch -Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch -Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch -Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch -Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch -Patch014: 0014-nft-shared-Drop-unused-include.patch -Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch -Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch -Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -54,7 +36,7 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.6 +BuildRequires: pkgconfig(libnftnl) >= 1.2.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf @@ -67,17 +49,6 @@ The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. -%package compat -Summary: Temporary transitioning package -Obsoletes: %{name} < 1.8.7-4 -Requires: %{name}-legacy = %{version}-%{release} -Requires: %{name}-utils = %{version}-%{release} - -%description compat -This package only exists to help transition iptables users to the new -package split. It will be removed after one distribution release cycle, please -do not reference it or depend on it in any way. - %package legacy Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} @@ -252,9 +223,6 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -# Drop xtables.conf, it's not used -rm -f %{buildroot}%{_sysconfdir}/xtables.conf - # fix absolute symlink rm -f %{buildroot}%{_bindir}/iptables-xml ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml @@ -371,8 +339,6 @@ if [ $1 -eq 0 ]; then done fi -%files compat - %files legacy %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -447,6 +413,10 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-1 +- New version 1.8.10 +- Drop compat sub-package + * Tue Aug 15 2023 Phil Sutter - 1.8.9-6 - Convert license to SPDX format diff --git a/sources b/sources index fef1030..59e259b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 +SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 From 4407a0239cd14b500c225119639ca72d98da6d13 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:23:45 +0200 Subject: [PATCH 41/79] tests: Drop checks for iptables RPM On one hand, the test will fail as the RPM is called 'iptables-nft' (or 'iptables-legacy', but that's not the default). On the other, if iptables RPM is missing the commands will fail as well so this check happens implicitly anyway. --- tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh | 2 -- .../RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh | 2 -- tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh | 2 -- tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh | 2 -- tests/initscript-sanity/runtest.sh | 3 --- .../runtest.sh | 3 --- .../runtest.sh | 3 --- .../ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh | 2 -- .../iptables-rule-deletion-fails-for-rules-that-use/runtest.sh | 2 -- tests/iptables-save-cuts-space-before-j/runtest.sh | 3 --- tests/iptables-save-modprobe-option/runtest.sh | 3 --- tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh | 3 --- 12 files changed, 30 deletions(-) diff --git a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh index 32eab99..952cd4c 100755 --- a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh +++ b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET=testset6 rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh index 438468d..26a667e 100755 --- a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh +++ b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" TESTD=$PWD rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "source $TESTD/rules.in" 0 "read ruleset" diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 889c1b6..5021458 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" prepare_page() { @@ -42,7 +41,6 @@ prepare_page() { rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlLogInfo $(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" diff --git a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh index 888dfbd..0b4032e 100755 --- a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh +++ b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" CGNUM="15" CGNAME="15" CGDIR="/sys/fs/cgroup/net_cls/$CGNAME" @@ -41,7 +40,6 @@ SKIP6=false rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel-$(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/initscript-sanity/runtest.sh b/tests/initscript-sanity/runtest.sh index e270b78..b132033 100755 --- a/tests/initscript-sanity/runtest.sh +++ b/tests/initscript-sanity/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 004d568..f68925c 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" diff --git a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh index f59a908..d06fc4a 100755 --- a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh +++ b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "cp /etc/sysconfig/ip6tables ." diff --git a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh index 79b2696..2daddb3 100755 --- a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh +++ b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" for svc in $SERVICES; do diff --git a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh index d17e693..f409501 100755 --- a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh +++ b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh @@ -29,13 +29,11 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET4="ipsetv4" IPSET6="ipsetv6" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ipset create $IPSET4 hash:ip" diff --git a/tests/iptables-save-cuts-space-before-j/runtest.sh b/tests/iptables-save-cuts-space-before-j/runtest.sh index a6a5099..bba6bf2 100755 --- a/tests/iptables-save-cuts-space-before-j/runtest.sh +++ b/tests/iptables-save-cuts-space-before-j/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlServiceStart iptables diff --git a/tests/iptables-save-modprobe-option/runtest.sh b/tests/iptables-save-modprobe-option/runtest.sh index 22951c4..240c76e 100755 --- a/tests/iptables-save-modprobe-option/runtest.sh +++ b/tests/iptables-save-modprobe-option/runtest.sh @@ -30,11 +30,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartTest - rlAssertRpm $PACKAGE rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported" rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported" rlPhaseEnd diff --git a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh index c3223b5..abfb03a 100755 --- a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh +++ b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd From c61918e30991a3b5c4c3e4b6988a0a99440034be Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:40:51 +0200 Subject: [PATCH 42/79] iptables-1.8.10-2 - Obsolete dropped compat package --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index e37c5e6..5d5240b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,6 +59,7 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif +Obsoletes: %{name}-compat < 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -413,6 +414,9 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-2 +- Obsolete dropped compat package + * Tue Oct 10 2023 Phil Sutter - 1.8.10-1 - New version 1.8.10 - Drop compat sub-package From 9272a9e4cc5f169c98f61123116df93c02f315b2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 14:56:09 +0100 Subject: [PATCH 43/79] iptables-1.8.10-3 - Fix compat sub-package obsoletion Resolves: rhbz#2248494 --- iptables.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5d5240b..a4506d4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,7 +59,8 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif -Obsoletes: %{name}-compat < 1.8.9-6 +Provides: %{name}-compat = %{version}-%{release} +Obsoletes: %{name}-compat <= 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -414,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-3 +- Fix compat sub-package obsoletion + * Tue Oct 10 2023 Phil Sutter - 1.8.10-2 - Obsolete dropped compat package From 452b549ac6e57bca853fd99096f5bcefaeec7f49 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 21:43:47 +0100 Subject: [PATCH 44/79] iptables-1.8.10-4 - The actual obsoletes fix Resolves: rhbz#2248494 --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index a4506d4..05ac24b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -60,7 +60,7 @@ Requires(postun): %{_sbindir}/update-alternatives Provides: iptables %endif Provides: %{name}-compat = %{version}-%{release} -Obsoletes: %{name}-compat <= 1.8.9-6 +Obsoletes: %{name}-compat < 1.8.9-7 %description legacy The iptables utility controls the network packet filtering code in the @@ -415,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-4 +- The actual obsoletes fix + * Tue Nov 07 2023 Phil Sutter - 1.8.10-3 - Fix compat sub-package obsoletion From d10a06dda4a10de64ad3fa230e2ec1828cf1766c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 8 Nov 2023 00:07:03 +0100 Subject: [PATCH 45/79] tests/TRACE-target-of-iptables-can-t-work-in: Unload modules only if loaded Apply the same kernel version check to cleanup phase and omit module unloading. --- .../runtest.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 5021458..86652af 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -119,10 +119,14 @@ rlJournalStart rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6" rlRun "iptables -t raw -F" rlRun "ip6tables -t raw -F" - rlRun "rmmod nf_log_ipv4" - rlRun "rmmod nf_log_ipv6" - rlRun "rmmod nf_log_common" - rlRun "rmmod nfnetlink_log" 0,1 + if rlTestVersion "$(uname -r)" "<" "4.6"; then + rlRun "rmmod nf_log_ipv4" + rlRun "rmmod nf_log_ipv6" + rlRun "rmmod nf_log_common" + rlRun "rmmod nfnetlink_log" 0,1 + else + rlLogInfo "new kernel detected: skipping unloading modules" + fi rlLogInfo "restoring services" for svc in $SERVICES; do rlServiceRestore $svc From 3611a44057b5cfdb4641c2370784a37ae4d56c26 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 8 Jan 2024 09:02:09 -0500 Subject: [PATCH 46/79] Fix flatpak build Installation path macros must not be used for file dependencies: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies --- iptables.spec | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index 05ac24b..cc4091e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -54,8 +54,8 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif @@ -142,9 +142,9 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} -Requires(post): %{_sbindir}/update-alternatives -Requires(post): %{_bindir}/readlink -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(post): /usr/bin/readlink +Requires(postun): /usr/sbin/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -234,7 +234,7 @@ ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -244,7 +244,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -260,7 +260,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -286,7 +286,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -304,7 +304,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -324,7 +324,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -336,7 +336,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ $cmd %{_sbindir}/$cmd-nft done fi From 86e59a1ef9148016f717558dda3478f5740c1a06 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Jan 2024 17:47:08 +0100 Subject: [PATCH 47/79] iptables-1.8.10-5 - Backport fixes from upstream - Fix flatpak build --- ...another-segfault-due-to-chain-index-.patch | 81 +++++++++++++ ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 +++++++++++++ ...-Fix-corner-case-noflush-restore-bug.patch | 63 ++++++++++ ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 +++++++ ...ants-support-v-update-OPTSTRING_COMM.patch | 31 +++++ ...n-line-number-formatting-with-legacy.patch | 28 +++++ ...-man-Do-not-escape-exclamation-marks.patch | 44 +++++++ ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 ++++++++ ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ++++++++++++++++++ ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 ++++++ iptables.spec | 17 ++- 11 files changed, 589 insertions(+), 1 deletion(-) create mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch create mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch create mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch create mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch create mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch create mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch create mode 100644 0007-man-Do-not-escape-exclamation-marks.patch create mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch create mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch create mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch new file mode 100644 index 0000000..35b5973 --- /dev/null +++ b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch @@ -0,0 +1,81 @@ +From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Oct 2023 17:27:42 +0200 +Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL + pointer + +Chain rename code missed to adjust the num_chains value which is used to +calculate the number of chain index buckets to allocate during an index +rebuild. So with the right number of chains present, the last chain in a +middle bucket being renamed (and ending up in another bucket) triggers +an index rebuild based on false data. The resulting NULL pointer index +bucket then causes a segfault upon reinsertion. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 +Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") +(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) +--- + .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ + libiptc/libiptc.c | 4 +++ + 2 files changed, 36 insertions(+) + create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 + +diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +new file mode 100755 +index 0000000000000..bc473d2511bbd +--- /dev/null ++++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +@@ -0,0 +1,32 @@ ++#!/bin/bash ++# ++# Another funny rename bug in libiptc: ++# If there is a chain index bucket with only a single chain in it and it is not ++# the last one and that chain is renamed, a chain index rebuild is triggered. ++# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an ++# extra index is allocated and remains NULL. The following insert of renamed ++# chain then segfaults. ++ ++( ++ echo "*filter" ++ # first bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-a-$i - [0:0]" ++ done ++ # second bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-b-$i - [0:0]" ++ done ++ # third bucket, just make sure it exists ++ echo ":chain-c-0 - [0:0]" ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore ++ ++# rename all chains of the middle bucket ++( ++ echo "*filter" ++ for ((i = 0; i < 40; i++)); do ++ echo "-E chain-b-$i chain-d-$i" ++ done ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore --noflush +diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c +index e475063367c26..9712a36353b9a 100644 +--- a/libiptc/libiptc.c ++++ b/libiptc/libiptc.c +@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, + return 0; + } + ++ handle->num_chains--; ++ + /* This only unlinks "c" from the list, thus no free(c) */ + iptcc_chain_index_delete_chain(c, handle); + + /* Change the name of the chain */ + strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); + ++ handle->num_chains++; ++ + /* Insert sorted into to list again */ + iptc_insert_chain(handle, c); + diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch new file mode 100644 index 0000000..c384e4b --- /dev/null +++ b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -0,0 +1,81 @@ +From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 3 Nov 2023 17:33:22 +0100 +Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage + +ARPT_ and IPT_INV flags are not interchangeable, e.g.: +define IPT_INV_SRCDEVADDR 0x0080 +define ARPT_INV_SRCDEVADDR 0x0010 + +as these flags can be tested by libarp_foo.so such checks can yield +incorrect results. + +Because arptables-nft uses existing code, e.g. xt_mark, it makes +sense to unify this completely by converting the last users of +ARPT_INV_ constants. + +Note that arptables-legacy does not do run-time module loading via +dlopen(). Functionaliy implemented by "extensions" in the +arptables-legacy git tree are built-in, so this doesn't break +arptables-legacy binaries. + +Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") +Signed-off-by: Florian Westphal +Signed-off-by: Phil Sutter +(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) +--- + extensions/libarpt_mangle.c | 4 ++-- + iptables/nft-arp.c | 2 +- + iptables/xshared.h | 4 +++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c +index 765edf34781f3..a846e97ec8f27 100644 +--- a/extensions/libarpt_mangle.c ++++ b/extensions/libarpt_mangle.c +@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! --h-length not allowed for " + "--mangle-mac-s"); +@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! hln not allowed for --mangle-mac-d"); + if (e->arp.arhln != 6) +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index aed39ebdd5166..535dd6b83237b 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, + &args->d.naddrs); + + if ((args->s.naddrs > 1 || args->d.naddrs > 1) && +- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) ++ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) + xtables_error(PARAMETER_PROBLEM, + "! not allowed with multiple" + " source or destination IP addresses"); +diff --git a/iptables/xshared.h b/iptables/xshared.h +index a200e0d620ad3..5586385456a4d 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -80,7 +80,9 @@ struct xtables_target; + #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ + #define EBT_OPTSTRING OPTSTRING_COMMON "hv" + +-/* define invflags which won't collide with IPT ones */ ++/* define invflags which won't collide with IPT ones. ++ * arptables-nft does NOT use the legacy ARPT_INV_* defines. ++ */ + #define IPT_INV_SRCDEVADDR 0x0080 + #define IPT_INV_TGTDEVADDR 0x0100 + #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch new file mode 100644 index 0000000..3386925 --- /dev/null +++ b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch @@ -0,0 +1,63 @@ +From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 7 Nov 2023 19:12:14 +0100 +Subject: [PATCH] ebtables: Fix corner-case noflush restore bug + +Report came from firwalld, but this is actually rather hard to trigger. +Since a regular chain line prevents it, typical dump/restore use-cases +are unaffected. + +Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") +Cc: Eric Garver +Signed-off-by: Phil Sutter +(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) +--- + .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ + iptables/xtables-eb.c | 2 ++ + 2 files changed, 27 insertions(+) + create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 + +diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +new file mode 100755 +index 0000000000000..0def0ac58e7be +--- /dev/null ++++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +@@ -0,0 +1,25 @@ ++#!/bin/sh ++# ++# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: ++# - with --noflush ++# - a second table after the broute one ++# - A policy command but no chain line for BROUTING chain ++ ++set -e ++ ++case "$XT_MULTI" in ++*xtables-nft-multi) ++ ;; ++*) ++ echo "skip $XT_MULTI" ++ exit 0 ++ ;; ++esac ++ ++$XT_MULTI ebtables-restore --noflush < +Date: Sun, 19 Nov 2023 13:18:26 +0100 +Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused + +Drop the boolean, it was meant to disable some existence checks in +do_parse() prior to the caching rework. Now that do_parse() runs before +any caching is done, the checks in question don't exist anymore so drop +this relict. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) +--- + iptables/xshared.h | 1 - + iptables/xtables-translate.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index 5586385456a4d..c77556a1987dc 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -284,7 +284,6 @@ struct xt_cmd_parse { + bool restore; + int line; + int verbose; +- bool xlate; + struct xt_cmd_parse_ops *ops; + }; + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 88e0a6b639494..c019cd2991305 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + .table = *table, + .restore = restore, + .line = line, +- .xlate = true, + .ops = &h->ops->cmd_parse, + }; + struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch new file mode 100644 index 0000000..c743e75 --- /dev/null +++ b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch @@ -0,0 +1,31 @@ +From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 19 Nov 2023 13:25:36 +0100 +Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON + +Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") +Signed-off-by: Phil Sutter +(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) +--- + iptables/xshared.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index c77556a1987dc..815b9d3e98726 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -75,10 +75,10 @@ struct xtables_globals; + struct xtables_rule_match; + struct xtables_target; + +-#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" +-#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" +-#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ +-#define EBT_OPTSTRING OPTSTRING_COMMON "hv" ++#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" ++#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" ++#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ ++#define EBT_OPTSTRING OPTSTRING_COMMON "h" + + /* define invflags which won't collide with IPT ones. + * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch new file mode 100644 index 0000000..07bea3a --- /dev/null +++ b/0006-ebtables-Align-line-number-formatting-with-legacy.patch @@ -0,0 +1,28 @@ +From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 21 Nov 2023 22:58:47 +0100 +Subject: [PATCH] ebtables: Align line number formatting with legacy + +Legacy ebtables appends a dot to the number printed in first column if +--Ln flag was given. + +Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") +Signed-off-by: Phil Sutter +(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) +--- + iptables/nft-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index d9a8ad2b0f373..e414ef5584392 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, + struct iptables_command_state cs = {}; + + if (format & FMT_LINENUMBERS) +- printf("%d ", num); ++ printf("%d. ", num); + + nft_rule_to_ebtables_command_state(h, r, &cs); + __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch new file mode 100644 index 0000000..b088c63 --- /dev/null +++ b/0007-man-Do-not-escape-exclamation-marks.patch @@ -0,0 +1,44 @@ +From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 13:29:17 +0100 +Subject: [PATCH] man: Do not escape exclamation marks + +This appears to be not necessary, also mandoc complains about it: + +| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! + +Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") +Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") +Signed-off-by: Phil Sutter +(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) +--- + extensions/libip6t_DNPT.man | 2 +- + extensions/libip6t_SNPT.man | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man +index 9b060f5b7179b..72c6ae5d422a2 100644 +--- a/extensions/libip6t_DNPT.man ++++ b/extensions/libip6t_DNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the SNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 +diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man +index 97e0071b43cc1..0c926978377a7 100644 +--- a/extensions/libip6t_SNPT.man ++++ b/extensions/libip6t_SNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the DNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch new file mode 100644 index 0000000..c0bbec2 --- /dev/null +++ b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch @@ -0,0 +1,49 @@ +From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 20:21:49 +0100 +Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks + +In order to parse the mask, xtopt_parse_hostmask() calls +xtopt_parse_plenmask() thereby limiting netmask support to prefix +lengths (alternatively specified in IP address notation). + +In order to lift this impractical restriction, make +xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may +fall back to xtopt_parse_mask() which correctly initializes val.hmask +itself and indicates non-CIDR-compatible masks by setting val.hlen to +-1. + +So in order to support these odd masks, it is sufficient for +xtopt_parse_plenmask() to skip its mask building from val.hlen value and +take whatever val.hmask contains. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +Signed-off-by: Phil Sutter +(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) +--- + libxtables/xtoptions.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index b16bbfbe32311..d91a78f470eda 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + + xtopt_parse_plen(cb); + ++ /* may not be convertible to CIDR notation */ ++ if (cb->val.hlen == (uint8_t)-1) ++ goto out_put; ++ + memset(mask, 0xFF, sizeof(union nf_inet_addr)); + /* This shifting is AF-independent. */ + if (cb->val.hlen == 0) { +@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + mask[1] = htonl(mask[1]); + mask[2] = htonl(mask[2]); + mask[3] = htonl(mask[3]); ++out_put: + if (entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); + } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch new file mode 100644 index 0000000..7745634 --- /dev/null +++ b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch @@ -0,0 +1,114 @@ +From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 19 Dec 2023 00:56:07 +0100 +Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting + +Parameter 'wait' passed to xtables_lock() signals three modes of +operation, depending on its value: + + 0: --wait not specified, do not wait if lock is busy +-1: --wait specified without value, wait indefinitely until lock becomes + free +>0: Wait for 'wait' seconds for lock to become free, abort otherwise + +Since fixed commit, the first two cases were treated the same apart from +calling alarm(0), but that is a nop if no alarm is pending. Fix the code +by requesting a non-blocking flock() in the second case. While at it, +restrict the alarm setup to the third case only. + +Cc: Jethro Beekman +Cc: howardjohn@google.com +Cc: Antonio Ojea +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 +Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") +Signed-off-by: Phil Sutter +(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) +--- + .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ + iptables/xshared.c | 4 +- + 2 files changed, 57 insertions(+), 2 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 +new file mode 100755 +index 0000000000000..4481f966ce435 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 +@@ -0,0 +1,55 @@ ++#!/bin/bash ++ ++case "$XT_MULTI" in ++*xtables-legacy-multi) ++ ;; ++*) ++ echo skip $XT_MULTI ++ exit 0 ++ ;; ++esac ++ ++coproc RESTORE { $XT_MULTI iptables-restore; } ++echo "*filter" >&${RESTORE[1]} ++ ++ ++$XT_MULTI iptables -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 1 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "process waits when it should not" ++ exit 1 ++} ++wait $ipt_pid ++[[ $? -eq 0 ]] && { ++ echo "process exited 0 despite busy lock" ++ exit 1 ++} ++ ++t0=$(date +%s) ++$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT ++t1=$(date +%s) ++[[ $((t1 - t0)) -ge 3 ]] || { ++ echo "wait time not expired" ++ exit 1 ++} ++ ++$XT_MULTI iptables -w -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] || { ++ echo "no indefinite wait" ++ exit 1 ++} ++kill $ipt_pid ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "killed waiting iptables call did not exit in time" ++ exit 1 ++} ++ ++kill $RESTORE_PID ++wait ++exit 0 +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 5f75a0a57a023..690502c457dd0 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -270,7 +270,7 @@ static int xtables_lock(int wait) + return XT_LOCK_FAILED; + } + +- if (wait != -1) { ++ if (wait > 0) { + sigact_alarm.sa_handler = alarm_ignore; + sigact_alarm.sa_flags = SA_RESETHAND; + sigemptyset(&sigact_alarm.sa_mask); +@@ -278,7 +278,7 @@ static int xtables_lock(int wait) + alarm(wait); + } + +- if (flock(fd, LOCK_EX) == 0) ++ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) + return fd; + + if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch new file mode 100644 index 0000000..ea88fa3 --- /dev/null +++ b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch @@ -0,0 +1,40 @@ +From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 17 Dec 2023 13:02:36 +0100 +Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK + +Do as the comment in xtopt_parse_hostmask() claims and omit +XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() +will catch the incompatibility. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) +--- + include/xtables.h | 1 - + libxtables/xtoptions.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/include/xtables.h b/include/xtables.h +index 087a1d600f9ae..9def9b43b6e58 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -61,7 +61,6 @@ struct in_addr; + * %XTTYPE_SYSLOGLEVEL: syslog level by name or number + * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) + * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length +- * (ptr: union nf_inet_addr; only host portion is stored) + * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) + * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) + * %XTTYPE_PORTRC: colon-separated port range (names acceptable), +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index d91a78f470eda..ba68056dc99f7 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { + [XTTYPE_STRING] = -1, + [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), + [XTTYPE_HOST] = sizeof(union nf_inet_addr), +- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), + [XTTYPE_PROTOCOL] = sizeof(uint8_t), + [XTTYPE_PORT] = sizeof(uint16_t), + [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/iptables.spec b/iptables.spec index cc4091e..fcc549e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,6 +20,17 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper +Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch +Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch +Patch007: 0007-man-Do-not-escape-exclamation-marks.patch +Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -415,6 +426,10 @@ fi %changelog +* Thu Jan 11 2024 Phil Sutter - 1.8.10-5 +- Backport fixes from upstream +- Fix flatpak build + * Tue Nov 07 2023 Phil Sutter - 1.8.10-4 - The actual obsoletes fix From 62720fedc38312a84687cf1632042f22dcf99b32 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:15:08 +0000 Subject: [PATCH 48/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fcc549e..dd8c7cc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 11 2024 Phil Sutter - 1.8.10-5 - Backport fixes from upstream - Fix flatpak build From 4f6c4554627cf2633bc8944cb1240ab0c8074515 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 22:54:06 +0000 Subject: [PATCH 49/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index dd8c7cc..7c995da 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d55ae5d9f184b1b93fd57c73e8cb9f12bdcfd792 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 21 May 2024 15:07:37 +0200 Subject: [PATCH 50/79] iptables-1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables Resolves: rhbz#2281595 --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 7c995da..83b972c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -358,6 +358,7 @@ fi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} @@ -426,6 +427,9 @@ fi %changelog +* Tue May 21 2024 Phil Sutter - 1.8.10-8 +- Make iptables-legacy own %%{_datadir}/xtables + * Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From de779a4b439abe447aedc2c32e4e61f1e115ace7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 3 Jul 2024 12:57:08 +0200 Subject: [PATCH 51/79] iptables-1.8.10-9 - Backport fixes from upstream --- ...se-Add-missing-braces-around-ternary.patch | 36 +++ ...xtables-Fix-memleak-of-matches-udata.patch | 32 ++ ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ++++++++++++ ...frag-Save-xlate-inverted-full-ranges.patch | 117 +++++++ ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 +++++++ ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 ++++++++ ...-esp-Save-xlate-inverted-full-ranges.patch | 119 +++++++ ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 +++ ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ++++ ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ++++++++++++++++++ ...t-Fix-for-broken-recover_rule_compat.patch | 89 +++++ ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 +++ ...sing-of-empty-string-arg-in-c-option.patch | 48 +++ iptables.spec | 20 +- 14 files changed, 1370 insertions(+), 2 deletions(-) create mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch create mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch create mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch create mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch create mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch create mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch create mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch create mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch create mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch create mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch create mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch create mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch create mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch new file mode 100644 index 0000000..f348d59 --- /dev/null +++ b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch @@ -0,0 +1,36 @@ +From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 26 Jan 2024 18:43:10 +0100 +Subject: [PATCH] nft: ruleparse: Add missing braces around ternary + +The expression evaluated the sum before the ternay, consequently not +adding target->size if tgsize was zero. + +Identified by ASAN for a simple rule using standard target: +| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN +| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN +| ================================================================= +| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 +| READ of size 8 at 0x603000000120 thread T0 +| [...] + +Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") +Signed-off-by: Phil Sutter +(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) +--- + iptables/nft-ruleparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c +index c8322f936acd9..57fe27276de35 100644 +--- a/iptables/nft-ruleparse.c ++++ b/iptables/nft-ruleparse.c +@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) + if (!target) + return NULL; + +- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; ++ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); + + target->t = xtables_calloc(1, size); + target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch new file mode 100644 index 0000000..7d9c51f --- /dev/null +++ b/0012-libxtables-Fix-memleak-of-matches-udata.patch @@ -0,0 +1,32 @@ +From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 31 Jan 2024 14:58:17 +0100 +Subject: [PATCH] libxtables: Fix memleak of matches' udata + +If the extension specifies a non-zero udata_size, field 'udata' points +to an allocated buffer which needs to be freed upon extension deinit. + +Interestingly, this bug was identified by ASAN and missed by valgrind. + +Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") +Signed-off-by: Phil Sutter +(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) +--- + libxtables/xtables.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index ba9ceaeb3da41..0f617d80ae37e 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) + free(matchp->match->m); + matchp->match->m = NULL; + } ++ if (matchp->match->udata_size) { ++ free(matchp->match->udata); ++ matchp->match->udata = NULL; ++ } + if (matchp->match == matchp->match->next) { + free(matchp->match); + matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..e9c3cb0 --- /dev/null +++ b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,200 @@ +From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:27:03 +0100 +Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges + +While at it, fix xlate output for plain '-m ah' matches: With +ip6tables-translate, one should emit an extdhr exists match since +ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, +a simple 'meta l4proto ah' was missing. + +Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") +Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) + +Conflicts: + extensions/libip6t_ah.t + extensions/libip6t_ah.txlate + extensions/libipt_ah.t + extensions/libipt_ah.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_ah.c | 22 +++++++++++++--------- + extensions/libip6t_ah.t | 1 + + extensions/libip6t_ah.txlate | 6 ++++++ + extensions/libipt_ah.c | 22 ++++++++++++++-------- + extensions/libipt_ah.t | 1 + + extensions/libipt_ah.txlate | 6 ++++++ + 6 files changed, 41 insertions(+), 17 deletions(-) + +diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c +index f35982f379d76..0f95c4735eabd 100644 +--- a/extensions/libip6t_ah.c ++++ b/extensions/libip6t_ah.c +@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) + } + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + if (min == max) + printf("%s:%s%u", name, inv, min); + else +@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + char *space = ""; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); +@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, + } + + if (!space[0]) /* plain '-m ah' */ +- xt_xlate_add(xl, "meta l4proto ah"); ++ xt_xlate_add(xl, "exthdr ah exists"); + + return 1; + } +diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t +index c1898d44cf193..9099bdc9259c3 100644 +--- a/extensions/libip6t_ah.t ++++ b/extensions/libip6t_ah.t +@@ -13,3 +13,4 @@ + -m ah --ahspi 0:invalid;;FAIL + -m ah --ahspi;;FAIL + -m ah;=;OK ++-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate +index cc33ac2718c0c..32c6b7de00937 100644 +--- a/extensions/libip6t_ah.txlate ++++ b/extensions/libip6t_ah.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' + + ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT + nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' ++ ++ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr ah exists counter' ++ ++ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' +diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c +index fec5705ce6f53..39e3013d3e74b 100644 +--- a/extensions/libipt_ah.c ++++ b/extensions/libipt_ah.c +@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) + ahinfo->invflags |= IPT_AH_INV_SPI; + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); +@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); + else + xt_xlate_add(xl, "%u", ahinfo->spis[0]); ++ } else { ++ xt_xlate_add(xl, "meta l4proto ah"); + } + + return 1; +diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t +index cd853865638e8..1aeb607e9e986 100644 +--- a/extensions/libipt_ah.t ++++ b/extensions/libipt_ah.t +@@ -11,3 +11,4 @@ + -m ah --ahspi;;FAIL + -m ah;;FAIL + -p ah -m ah;=;OK ++-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate +index 897c82b5f95c6..baf5a0ae6182a 100644 +--- a/extensions/libipt_ah.txlate ++++ b/extensions/libipt_ah.txlate +@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' + + iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP + nft 'add rule ip filter INPUT ah spi != 50 counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto ah counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..902ade1 --- /dev/null +++ b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,117 @@ +From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:39:52 +0100 +Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges + +Also translate plain '-m frag' match into an exthdr exists one. + +Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) + +Conflicts: + extensions/libip6t_frag.t + extensions/libip6t_frag.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- + extensions/libip6t_frag.t | 1 + + extensions/libip6t_frag.txlate | 6 ++++++ + 3 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c +index 49c787e709a9e..ed7fe10a4716d 100644 +--- a/extensions/libip6t_frag.c ++++ b/extensions/libip6t_frag.c +@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) + } + } + ++static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_ids(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_ids_match(min, max, invert)) { + printf("%s", name); + if (min == max) + printf(":%s%u", inv, min); +@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, + static void frag_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 +- && fraginfo->ids[1] == 0xFFFFFFFF)) { +- printf("%s --fragid ", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ printf("%s --fragid ", inv_ids ? " !" : ""); + if (fraginfo->ids[0] + != fraginfo->ids[1]) + printf("%u:%u", +@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) + printf(" --fraglast"); + } + ++#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ ++ IP6T_FRAG_MF | IP6T_FRAG_NMF) ++ + static int frag_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_frag *fraginfo = + (struct ip6t_frag *)params->match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "frag id %s", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? +- "!= " : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); + if (fraginfo->ids[0] != fraginfo->ids[1]) + xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], + fraginfo->ids[1]); + else + xt_xlate_add(xl, "%u", fraginfo->ids[0]); + ++ } else if (!(fraginfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr frag exists"); ++ return 1; + } + + /* ignore ineffective IP6T_FRAG_LEN bit */ +diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t +index 299fa03f8845b..58417c90e9217 100644 +--- a/extensions/libip6t_frag.t ++++ b/extensions/libip6t_frag.t +@@ -1,4 +1,5 @@ + :INPUT,FORWARD,OUTPUT ++-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK + -m frag --fragid 1:42;=;OK + -m frag --fraglen 42;=;OK + -m frag --fragres;=;OK +diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate +index 33fc0631dc792..e250587e7682c 100644 +--- a/extensions/libip6t_frag.txlate ++++ b/extensions/libip6t_frag.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' + + ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT + nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' ++ ++ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr frag exists counter' ++ ++ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..1afcc54 --- /dev/null +++ b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,111 @@ +From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:42:10 +0100 +Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges + +Also translate '-m mh' into an exthdr exists match unless '-p mh' is +also present. The latter is converted into 'meta l4proto mh' which might +need fixing itself at a later point. + +Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) + +Conflicts: + extensions/libip6t_mh.t + extensions/libip6t_mh.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_mh.c | 20 ++++++++++++++++---- + extensions/libip6t_mh.t | 1 + + extensions/libip6t_mh.txlate | 9 +++++++++ + 3 files changed, 26 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 1410d324b5d42..3f80e28ec94c8 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + enum { + O_MH_TYPE = 0, +@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) + printf("%s", name); + } + ++static bool skip_types_match(uint8_t min, uint8_t max, bool inv) ++{ ++ return min == 0 && max == UINT8_MAX && !inv; ++} ++ + static void print_types(uint8_t min, uint8_t max, int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFF || invert) { ++ if (!skip_types_match(min, max, invert)) { + printf(" "); + if (min == max) { + printf("%s", inv); +@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, + static void mh_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) + return; + +- if (mhinfo->invflags & IP6T_MH_INV_TYPE) ++ if (inv_type) + printf(" !"); + + if (mhinfo->types[0] != mhinfo->types[1]) +@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; ++ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { ++ if (proto != IPPROTO_MH) ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; ++ } + + if (mhinfo->types[0] != mhinfo->types[1]) + xt_xlate_add(xl, "mh type %s%u-%u", +diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t +index 6b76d13d0a00f..be5439edc9520 100644 +--- a/extensions/libip6t_mh.t ++++ b/extensions/libip6t_mh.t +@@ -4,3 +4,4 @@ + -p mobility-header -m mh --mh-type 1;=;OK + -p mobility-header -m mh ! --mh-type 4;=;OK + -p mobility-header -m mh --mh-type 4:123;=;OK ++-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 4dfaf46a2b8d7..3364ce574468f 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac + + ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' ++ ++ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++ ++ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' ++ ++ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..c9ec110 --- /dev/null +++ b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,131 @@ +From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:45:42 +0100 +Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges + +Also translate plain '-m rt' match into an exthdr exists one. + +Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) + +Conflicts: + extensions/libip6t_rt.t + extensions/libip6t_rt.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- + extensions/libip6t_rt.t | 1 + + extensions/libip6t_rt.txlate | 9 +++++++++ + 3 files changed, 30 insertions(+), 8 deletions(-) + +diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c +index d5b0458bb397e..6db09f0b2cdc8 100644 +--- a/extensions/libip6t_rt.c ++++ b/extensions/libip6t_rt.c +@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) + } + } + ++static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_nums(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_segsleft_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, + static void rt_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + printf("%s --rt-type %u", +@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 +- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- printf("%s --rt-segsleft ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); + if (rtinfo->segsleft[0] + != rtinfo->segsleft[1]) + printf("%u:%u", +@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + + } + ++#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ ++ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) ++ + static int rt_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + xt_xlate_add(xl, "rt type%s %u", +@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "rt seg-left%s ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); + + if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) + xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], + rtinfo->segsleft[1]); + else + xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); ++ } else if (!(rtinfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr rt exists"); ++ return 1; + } + + if (rtinfo->flags & IP6T_RT_LEN) { +diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t +index 3c7b2d981324a..047b6880e354d 100644 +--- a/extensions/libip6t_rt.t ++++ b/extensions/libip6t_rt.t +@@ -3,3 +3,4 @@ + -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK + -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK + -m rt;=;OK ++-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK +diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate +index 3578bcba0157e..1c2f74a588750 100644 +--- a/extensions/libip6t_rt.txlate ++++ b/extensions/libip6t_rt.txlate +@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' + + ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT + nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' ++ ++ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..318d9eb --- /dev/null +++ b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,119 @@ +From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:47:09 +0100 +Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges + +Also add a translation for plain '-m esp' match which depends on the +address family: While ip6tables-translate may emit an exthdr exists +match, iptables-translate must stick to meta l4proto. + +Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) + +Conflicts: + extensions/libxt_esp.t + extensions/libxt_esp.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_esp.c | 26 ++++++++++++++++++-------- + extensions/libxt_esp.t | 1 + + extensions/libxt_esp.txlate | 12 ++++++++++++ + 3 files changed, 31 insertions(+), 8 deletions(-) + +diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c +index 2c7ff942cb9e0..8e9766d71ed57 100644 +--- a/extensions/libxt_esp.c ++++ b/extensions/libxt_esp.c +@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) + espinfo->invflags |= XT_ESP_INV_SPI; + } + ++static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spis_match(min, max, invert)) { + if (min == max) + printf(" %s:%s%u", name, inv, min); + else +@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void esp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_esp *espinfo = (struct xt_esp *)match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 +- && espinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --espspi ", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ printf("%s --espspi ", inv_spi ? " !" : ""); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("%u:%u", +@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "esp spi%s", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); + if (espinfo->spis[0] != espinfo->spis[1]) + xt_xlate_add(xl, " %u-%u", espinfo->spis[0], + espinfo->spis[1]); + else + xt_xlate_add(xl, " %u", espinfo->spis[0]); ++ } else if (afinfo->family == NFPROTO_IPV4) { ++ xt_xlate_add(xl, "meta l4proto esp"); ++ } else if (afinfo->family == NFPROTO_IPV6) { ++ xt_xlate_add(xl, "exthdr esp exists"); ++ } else { ++ return 0; + } + + return 1; +diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t +index 92c5779f860f1..37259d6b3a08f 100644 +--- a/extensions/libxt_esp.t ++++ b/extensions/libxt_esp.t +@@ -4,5 +4,6 @@ + -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK + -p esp -m esp ! --espspi 0:4294967294;=;OK + -p esp -m esp --espspi -1;;FAIL ++-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK + -p esp -m esp;=;OK + -m esp;;FAIL +diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate +index f6aba52f52235..5e8fb241beaf4 100644 +--- a/extensions/libxt_esp.txlate ++++ b/extensions/libxt_esp.txlate +@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' + + iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP + nft 'add rule ip filter INPUT esp spi 500-600 counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto esp counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch new file mode 100644 index 0000000..316e5dd --- /dev/null +++ b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch @@ -0,0 +1,47 @@ +From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:57:46 +0100 +Subject: [PATCH] extensions: ipcomp: Save inverted full ranges + +Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") +Signed-off-by: Phil Sutter +(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) + +Conflicts: + extensions/libxt_ipcomp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_ipcomp.c | 7 ++++--- + extensions/libxt_ipcomp.t | 1 + + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c +index 4171c4a1c4eb7..961c17e584933 100644 +--- a/extensions/libxt_ipcomp.c ++++ b/extensions/libxt_ipcomp.c +@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, + static void comp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; ++ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; + + if (!(compinfo->spis[0] == 0 +- && compinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ipcompspi ", +- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); ++ && compinfo->spis[1] == UINT32_MAX ++ && !inv_spi)) { ++ printf("%s --ipcompspi ", inv_spi ? " !" : ""); + if (compinfo->spis[0] + != compinfo->spis[1]) + printf("%u:%u", +diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t +index 8546ba9ce416f..47c1fbc220c6a 100644 +--- a/extensions/libxt_ipcomp.t ++++ b/extensions/libxt_ipcomp.t +@@ -1,3 +1,4 @@ + :INPUT,OUTPUT + -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK + -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK ++-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch new file mode 100644 index 0000000..cfeacd5 --- /dev/null +++ b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch @@ -0,0 +1,70 @@ +From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 2 Feb 2024 13:14:29 +0100 +Subject: [PATCH] nft: Do not omit full ranges if inverted + +Otherwise this turns a never matching rule into an always matching one. + +Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") +Signed-off-by: Phil Sutter +(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_udp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_tcp.t | 2 ++ + extensions/libxt_udp.t | 2 ++ + iptables/nft.c | 4 ++-- + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 7a3bbd08952f0..3caa3e3f50271 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,6 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index f534770191a6e..aa2c91770e63f 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,6 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ++-p udp -m udp ! --sport :;-p udp -m udp;OK ++-p udp -m udp ! --dport :;-p udp -m udp;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/iptables/nft.c b/iptables/nft.c +index 97fd4f49fdb4c..8e7a38ac93a3e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return 0; + } + +- if (src[0] || src[1] < 0xffff) { ++ if (src[0] || src[1] < UINT16_MAX || invert_src) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); + if (!expr) + return -ENOMEM; +@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return ret; + } + +- if (dst[0] || dst[1] < 0xffff) { ++ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); + if (!expr) + return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..326544f --- /dev/null +++ b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,304 @@ +From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 17:42:12 +0100 +Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges + +Also translate a bare '-m tcp/udp' to 'meta l4proto' match. + +Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") +Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_tcp.txlate + extensions/libxt_udp.t + extensions/libxt_udp.txlate +- Context change due to Missing commits adding test cases. +--- + extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- + extensions/libxt_tcp.t | 4 ++-- + extensions/libxt_tcp.txlate | 6 +++++ + extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- + extensions/libxt_udp.t | 4 ++-- + extensions/libxt_udp.txlate | 6 +++++ + 6 files changed, 72 insertions(+), 39 deletions(-) + +diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c +index f82572828649b..32bbd684fd5d7 100644 +--- a/extensions/libxt_tcp.c ++++ b/extensions/libxt_tcp.c +@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void tcp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; + +- if (tcpinfo->spts[0] != 0 +- || tcpinfo->spts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (tcpinfo->spts[0] + != tcpinfo->spts[1]) +@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) + tcpinfo->spts[0]); + } + +- if (tcpinfo->dpts[0] != 0 +- || tcpinfo->dpts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (tcpinfo->dpts[0] + != tcpinfo->dpts[1]) +@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, + { + const struct xt_tcp *tcpinfo = + (const struct xt_tcp *)params->match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; ++ bool xlated = false; + +- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { + if (tcpinfo->spts[0] != tcpinfo->spts[1]) { + xt_xlate_add(xl, "tcp sport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0], tcpinfo->spts[1]); + } else { + xt_xlate_add(xl, "tcp sport %s%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { + if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { + xt_xlate_add(xl, "tcp dport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0], tcpinfo->dpts[1]); + } else { + xt_xlate_add(xl, "tcp dport %s%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->option) ++ if (tcpinfo->option) { + xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, + tcpinfo->invflags & XT_TCP_INV_OPTION ? + "missing" : "exists"); ++ xlated = true; ++ } + + if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { + xt_xlate_add(xl, "tcp flags %s", +@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, + print_tcp_xlate(xl, tcpinfo->flg_cmp); + xt_xlate_add(xl, " / "); + print_tcp_xlate(xl, tcpinfo->flg_mask); ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto tcp"); ++ + return 1; + } + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 3caa3e3f50271..8baeeff2fc94b 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,8 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK +--p tcp -m tcp ! --sport :;-p tcp -m tcp;OK +--p tcp -m tcp ! --dport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate +index 9802ddfe0039e..b3ddcc15833cf 100644 +--- a/extensions/libxt_tcp.txlate ++++ b/extensions/libxt_tcp.txlate +@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' + + iptables-translate -A INPUT -p tcp ! --tcp-option 23 + nft 'add rule ip filter INPUT tcp option 23 missing counter' ++ ++iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' ++ ++iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' +diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c +index ba1c3eb768592..748d418039c3a 100644 +--- a/extensions/libxt_udp.c ++++ b/extensions/libxt_udp.c +@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void udp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_udp *udpinfo = (struct xt_udp *)match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; + +- if (udpinfo->spts[0] != 0 +- || udpinfo->spts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_SRCPT) ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (udpinfo->spts[0] + != udpinfo->spts[1]) +@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) + udpinfo->spts[0]); + } + +- if (udpinfo->dpts[0] != 0 +- || udpinfo->dpts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_DSTPT) ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (udpinfo->dpts[0] + != udpinfo->dpts[1]) +@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; ++ bool xlated = false; + +- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { + if (udpinfo->spts[0] != udpinfo->spts[1]) { + xt_xlate_add(xl,"udp sport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0], udpinfo->spts[1]); + } else { + xt_xlate_add(xl, "udp sport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0]); + } ++ xlated = true; + } + +- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { + if (udpinfo->dpts[0] != udpinfo->dpts[1]) { + xt_xlate_add(xl,"udp dport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0], udpinfo->dpts[1]); + } else { + xt_xlate_add(xl,"udp dport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0]); + } ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto udp"); ++ + return 1; + } + +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index aa2c91770e63f..0cde6ac30cc15 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,8 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK +--p udp -m udp ! --sport :;-p udp -m udp;OK +--p udp -m udp ! --dport :;-p udp -m udp;OK ++-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK ++-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate +index 28e7ca206b26b..d6bbb96f5d744 100644 +--- a/extensions/libxt_udp.txlate ++++ b/extensions/libxt_udp.txlate +@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep + + iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT + nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' ++ ++iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' ++ ++iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch new file mode 100644 index 0000000..46c636c --- /dev/null +++ b/0021-nft-Fix-for-broken-recover_rule_compat.patch @@ -0,0 +1,89 @@ +From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 27 Feb 2024 18:47:39 +0100 +Subject: [PATCH] nft: Fix for broken recover_rule_compat() + +When IPv4 rule generator was changed to emit payload instead of +meta expressions for l4proto matches, the code reinserting +NFTNL_RULE_COMPAT_* attributes into rules being reused for counter +zeroing was broken by accident. + +Make rule compat recovery aware of the alternative match, basically +reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules +with NFTA_RULE_COMPAT") but add a test case this time to make sure +things stay intact. + +Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") +Signed-off-by: Phil Sutter +(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) +--- + iptables/nft.c | 27 ++++++++++++++++--- + .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ + 2 files changed, 35 insertions(+), 4 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8e7a38ac93a3e..42907a431a99e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) + return strerror(err); + } + ++static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) ++{ ++ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); ++ uint32_t poff = offsetof(struct iphdr, protocol); ++ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; ++ ++ if (!strcmp(name, "payload") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); ++ return 0; ++ } ++ if (!strcmp(name, "meta") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); ++ return 0; ++ } ++ return -1; ++} ++ + static int recover_rule_compat(struct nftnl_rule *r) + { + struct nftnl_expr_iter *iter; +@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) + if (!e) + goto out; + +- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || +- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) ++ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ ++ if (l4proto_expr_get_dreg(e, ®) < 0) + goto next_expr; + +- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); +- + e = nftnl_expr_iter_next(iter); + if (!e) + goto out; +diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +new file mode 100755 +index 0000000000000..e276a953234cf +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +@@ -0,0 +1,12 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++set -e ++ ++rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" ++for cmd in iptables ip6tables; do ++ $XT_MULTI $cmd -t mangle -A PREROUTING $rule ++ $XT_MULTI $cmd -t mangle -Z ++ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" ++done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch new file mode 100644 index 0000000..0be13ca --- /dev/null +++ b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch @@ -0,0 +1,48 @@ +From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 5 Mar 2024 17:02:56 +0100 +Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match + +Since core xlate code now ignores '-p mh' if an mh extension is also +present in the rule, mh extension has to emit the l4proto match itself. +Therefore emit the exthdr match irrespective of '-p' argument value just +like other IPv6 extension header matches do. + +Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") +Signed-off-by: Phil Sutter +(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) +--- + extensions/libip6t_mh.c | 4 +--- + extensions/libip6t_mh.txlate | 2 +- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 3f80e28ec94c8..1a1cee832b584 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; + bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; +- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + + if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { +- if (proto != IPPROTO_MH) +- xt_xlate_add(xl, "exthdr mh exists"); ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; + } + +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 3364ce574468f..7eeaeefab6116 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' + + ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT +-nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' + + ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT + nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch new file mode 100644 index 0000000..a5e7994 --- /dev/null +++ b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch @@ -0,0 +1,48 @@ +From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 9 Apr 2024 13:18:12 +0200 +Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option + +Calling iptables with '-c ""' resulted in a call to strchr() with an +invalid pointer as 'optarg + 1' points to past the buffer. The most +simple fix is to drop the offset: The global optstring part specifies a +single colon after 'c', so getopt() enforces a valid pointer in optarg. +If it contains a comma at first position, packet counter value parsing +will fail so all cases are covered. + +Reported-by: gorbanev.es@gmail.com +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 +Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") +Signed-off-by: Phil Sutter +(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) +--- + extensions/iptables.t | 5 +++++ + iptables/xshared.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extensions/iptables.t b/extensions/iptables.t +index b4b6d677abab1..5d6d3d15cc5fd 100644 +--- a/extensions/iptables.t ++++ b/extensions/iptables.t +@@ -4,3 +4,8 @@ + -i eth+ -o alongifacename+;=;OK + ! -i eth0;=;OK + ! -o eth+;=;OK ++-c "";;FAIL ++-c ,3;;FAIL ++-c 3,;;FAIL ++-c ,;;FAIL ++-c 2,3 -j ACCEPT;-j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 690502c457dd0..f2e3bc03a2824 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], + set_option(&cs->options, OPT_COUNTERS, &args->invflags, + invert); + args->pcnt = optarg; +- args->bcnt = strchr(args->pcnt + 1, ','); ++ args->bcnt = strchr(args->pcnt, ','); + if (args->bcnt) + args->bcnt++; + if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/iptables.spec b/iptables.spec index 83b972c..bc0675d 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 8%{?dist} +Release: 9%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -30,6 +30,19 @@ Patch007: 0007-man-Do-not-escape-exclamation-marks.patch Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch +Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch +Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch +Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch +Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -37,7 +50,7 @@ License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) -# libnfnetlink-devel is requires for nfnl_osf +# libnfnetlink-devel is required for nfnl_osf BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers @@ -427,6 +440,9 @@ fi %changelog +* Wed Jul 03 2024 Phil Sutter - 1.8.10-9 +- Backport fixes from upstream + * Tue May 21 2024 Phil Sutter - 1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables From 4be8ae789abd28ae701aca4f05897a1a0f65b018 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:34:58 +0200 Subject: [PATCH 52/79] iptables-1.8.10-10 - Verify tarball GPG signature --- .gitignore | 1 + coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 +++++++++++++++++++++++++ iptables.spec | 40 +++++++++------- sources | 1 + 4 files changed, 89 insertions(+), 17 deletions(-) create mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt diff --git a/.gitignore b/.gitignore index 4cb5d7a..b61615f 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz +/iptables-1.8.10.tar.xz.sig diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt new file mode 100644 index 0000000..2d3b902 --- /dev/null +++ b/coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded +660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi +V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 +zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t +Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh +KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 +dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi +WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg +9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj ++IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR +U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 ++ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd +RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 +4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN +IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w +bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf +Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj +QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 +wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb +4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET +tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP +n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV +oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 +o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S +ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU +tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp +HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM +FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ +diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid +R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK +uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv +Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl +UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q +KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO +RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc +wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 +0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ +q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU +k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk +pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY +plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC +qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu +iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p +jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O +ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 +CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag +8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB +bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM +jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR +rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg +3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ +7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 +7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ +yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 +leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 +U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ +rlbu70nh2kSJrg== +=wukb +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index bc0675d..9d817f5 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,14 +11,16 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 9%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.xz -Source1: iptables.init -Source2: iptables-config -Source3: iptables.service -Source4: sysconfig_iptables -Source5: sysconfig_ip6tables -Source6: arptables-nft-helper +Release: 10%{?dist} +Source0: %{url}/files/%{name}-%{version}.tar.xz +source1: %{url}/files/%{name}-%{version}.tar.xz.sig +Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source3: iptables.init +Source4: iptables-config +Source5: iptables.service +Source6: sysconfig_iptables +Source7: sysconfig_ip6tables +Source8: arptables-nft-helper Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -179,6 +181,7 @@ Provides: ebtables nftables compatibility for iptables, arptables and ebtables. %prep +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 %build @@ -201,20 +204,20 @@ rm -f %{buildroot}%{_libdir}/*.la # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} -install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init +install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig -install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config +install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config -install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables -install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables +install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir} -sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service +install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} # install legacy actions for service command @@ -240,7 +243,7 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ +install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ touch %{buildroot}%{_libexecdir}/arptables-helper # prepare for alternatives @@ -440,6 +443,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-10 +- Verify tarball GPG signature + * Wed Jul 03 2024 Phil Sutter - 1.8.10-9 - Backport fixes from upstream diff --git a/sources b/sources index 59e259b..6015b94 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 +SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 From f61dd7d5ce88be4c6b9442a2eedaa598e6c6065f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:43:00 +0200 Subject: [PATCH 53/79] iptables-1.8.10-11 - Add missing build dependency --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 9d817f5..906c6f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -69,6 +69,7 @@ BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make +BuildRequires: gnupg2 %description The iptables utility controls the network packet filtering code in the @@ -443,6 +444,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-11 +- Add missing build dependency + * Fri Jul 05 2024 Phil Sutter - 1.8.10-10 - Verify tarball GPG signature From fdb7f30ead0154d756382d5523101154f1e7fc5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 14 Apr 2024 14:38:45 +0200 Subject: [PATCH 54/79] Fix build with %_sbindir==%_bindir and add compat sbin Provides For https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. nsntrace requires /usr/sbin/iptables. --- iptables.spec | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 906c6f4..ee41fa8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -178,6 +178,13 @@ Provides: iptables Provides: arptables Provides: ebtables +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description nft nftables compatibility for iptables, arptables and ebtables. @@ -254,8 +261,7 @@ touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink -rm -f %{buildroot}%{_bindir}/iptables-xml -ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %ldconfig_scriptlets @@ -444,6 +450,9 @@ fi %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-12 +- Rebuilt for the bin-sbin merge + * Fri Jul 05 2024 Phil Sutter - 1.8.10-11 - Add missing build dependency From d710b74abd664ed3cb4cb9d75ba59b5eea6d7404 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:46:20 +0200 Subject: [PATCH 55/79] Call alternatives without full path As part of https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin, alternatives is moved from /usr/sbin/alternatives to /usr/bin/alternatives. (This happened when alternatives rpm was rebuilt in a build environment with the updated definitions.) On traditional systems a compat symlink is created, so both paths work. This means that packages that use paths into /usr/sbin do not need to be rebuilt and will continue to work fine. Unfortunately, on ostree systems, the compat symlinks are missing, so calls to /usr/sbin/alternatives fail. There is no benefit from specifying the full path to binaries in scriptlets because the scriptlets are called with a well-defined $PATH. So drop the full path, so that the package works fine no matter where exactly alternatives is installed. --- iptables.spec | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/iptables.spec b/iptables.spec index ee41fa8..4d5876c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -268,7 +268,7 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -278,7 +278,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - /usr/sbin/update-alternatives --remove \ + update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -294,7 +294,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -320,7 +320,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -338,7 +338,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -358,7 +358,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -370,8 +370,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - /usr/sbin/update-alternatives --remove \ - $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi From 9ddeac8b47f05cbca9b732f176fb5ccf95da7f6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:50:40 +0200 Subject: [PATCH 56/79] Add changelog entry and bump release --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 4d5876c..fadaa3e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 12%{?dist} +Release: 13%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -449,6 +449,9 @@ fi %changelog +* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-13 +- Bump release and add changelog entry + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-12 - Rebuilt for the bin-sbin merge From 4d531018fe7b7c7b143fe1e28ffc6baa9ac8fec7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 11:27:43 +0200 Subject: [PATCH 57/79] Add unmerged-sbin compat also for -legacy subpackage There are two subpackages which provide /usr/s?bin/iptables: -nft and -legacy. In mock, for whatever reason, iptables-legacy was being installed, from the rebuild with merged-sbin, but since there was no dependency on the updated filesystem, an old version of filesystem was left, and only /usr/bin/iptables would available. --- iptables.spec | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fadaa3e..2737ddf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 13%{?dist} +Release: 14%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -89,6 +89,13 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description legacy The iptables utility controls the network packet filtering code in the Linux kernel. This package contains the legacy tools which are obsoleted by @@ -449,6 +456,9 @@ fi %changelog +* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-14 +- Add unmerged-sbin compat also for -legacy subpackage + * Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-13 - Bump release and add changelog entry From d9521ce9d679ccedc2d85f0892827d96b1919e53 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 10:33:34 +0000 Subject: [PATCH 58/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 2737ddf..90ba23e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 14%{?dist} +Release: 15%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -456,6 +456,9 @@ fi %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-14 - Add unmerged-sbin compat also for -legacy subpackage From bf80e3901433c9d04166e8ebbac18529f1b360d8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 8 Nov 2024 16:28:18 +0100 Subject: [PATCH 59/79] iptables-1.8.11-1 - new version --- .gitignore | 2 + ...another-segfault-due-to-chain-index-.patch | 81 ----- ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 ----- ...-Fix-corner-case-noflush-restore-bug.patch | 63 ---- ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 --- ...ants-support-v-update-OPTSTRING_COMM.patch | 31 -- ...n-line-number-formatting-with-legacy.patch | 28 -- ...-man-Do-not-escape-exclamation-marks.patch | 44 --- ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 --- ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ------- ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 --- ...se-Add-missing-braces-around-ternary.patch | 36 --- ...xtables-Fix-memleak-of-matches-udata.patch | 32 -- ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ------------ ...frag-Save-xlate-inverted-full-ranges.patch | 117 ------- ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 ------- ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 -------- ...-esp-Save-xlate-inverted-full-ranges.patch | 119 ------- ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 --- ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ---- ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ------------------ ...t-Fix-for-broken-recover_rule_compat.patch | 89 ----- ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 --- ...sing-of-empty-string-arg-in-c-option.patch | 48 --- coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 ---- coreteam-gpg-key-0xD70D1A666ACF2B21.txt | 64 ++++ iptables.spec | 35 +- sources | 4 +- 28 files changed, 76 insertions(+), 2018 deletions(-) delete mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch delete mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch delete mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch delete mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch delete mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch delete mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch delete mode 100644 0007-man-Do-not-escape-exclamation-marks.patch delete mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch delete mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch delete mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch delete mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch delete mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch delete mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch delete mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch delete mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch delete mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch delete mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch delete mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch delete mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch delete mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch delete mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch delete mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt create mode 100644 coreteam-gpg-key-0xD70D1A666ACF2B21.txt diff --git a/.gitignore b/.gitignore index b61615f..3814395 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz /iptables-1.8.10.tar.xz.sig +/iptables-1.8.11.tar.xz +/iptables-1.8.11.tar.xz.sig diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch deleted file mode 100644 index 35b5973..0000000 --- a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Oct 2023 17:27:42 +0200 -Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL - pointer - -Chain rename code missed to adjust the num_chains value which is used to -calculate the number of chain index buckets to allocate during an index -rebuild. So with the right number of chains present, the last chain in a -middle bucket being renamed (and ending up in another bucket) triggers -an index rebuild based on false data. The resulting NULL pointer index -bucket then causes a segfault upon reinsertion. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 -Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") -(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) ---- - .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ - libiptc/libiptc.c | 4 +++ - 2 files changed, 36 insertions(+) - create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 - -diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -new file mode 100755 -index 0000000000000..bc473d2511bbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -@@ -0,0 +1,32 @@ -+#!/bin/bash -+# -+# Another funny rename bug in libiptc: -+# If there is a chain index bucket with only a single chain in it and it is not -+# the last one and that chain is renamed, a chain index rebuild is triggered. -+# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an -+# extra index is allocated and remains NULL. The following insert of renamed -+# chain then segfaults. -+ -+( -+ echo "*filter" -+ # first bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-a-$i - [0:0]" -+ done -+ # second bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-b-$i - [0:0]" -+ done -+ # third bucket, just make sure it exists -+ echo ":chain-c-0 - [0:0]" -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore -+ -+# rename all chains of the middle bucket -+( -+ echo "*filter" -+ for ((i = 0; i < 40; i++)); do -+ echo "-E chain-b-$i chain-d-$i" -+ done -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore --noflush -diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c -index e475063367c26..9712a36353b9a 100644 ---- a/libiptc/libiptc.c -+++ b/libiptc/libiptc.c -@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, - return 0; - } - -+ handle->num_chains--; -+ - /* This only unlinks "c" from the list, thus no free(c) */ - iptcc_chain_index_delete_chain(c, handle); - - /* Change the name of the chain */ - strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); - -+ handle->num_chains++; -+ - /* Insert sorted into to list again */ - iptc_insert_chain(handle, c); - diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch deleted file mode 100644 index c384e4b..0000000 --- a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Fri, 3 Nov 2023 17:33:22 +0100 -Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage - -ARPT_ and IPT_INV flags are not interchangeable, e.g.: -define IPT_INV_SRCDEVADDR 0x0080 -define ARPT_INV_SRCDEVADDR 0x0010 - -as these flags can be tested by libarp_foo.so such checks can yield -incorrect results. - -Because arptables-nft uses existing code, e.g. xt_mark, it makes -sense to unify this completely by converting the last users of -ARPT_INV_ constants. - -Note that arptables-legacy does not do run-time module loading via -dlopen(). Functionaliy implemented by "extensions" in the -arptables-legacy git tree are built-in, so this doesn't break -arptables-legacy binaries. - -Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") -Signed-off-by: Florian Westphal -Signed-off-by: Phil Sutter -(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) ---- - extensions/libarpt_mangle.c | 4 ++-- - iptables/nft-arp.c | 2 +- - iptables/xshared.h | 4 +++- - 3 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c -index 765edf34781f3..a846e97ec8f27 100644 ---- a/extensions/libarpt_mangle.c -+++ b/extensions/libarpt_mangle.c -@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! --h-length not allowed for " - "--mangle-mac-s"); -@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! hln not allowed for --mangle-mac-d"); - if (e->arp.arhln != 6) -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index aed39ebdd5166..535dd6b83237b 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, - &args->d.naddrs); - - if ((args->s.naddrs > 1 || args->d.naddrs > 1) && -- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) -+ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) - xtables_error(PARAMETER_PROBLEM, - "! not allowed with multiple" - " source or destination IP addresses"); -diff --git a/iptables/xshared.h b/iptables/xshared.h -index a200e0d620ad3..5586385456a4d 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -80,7 +80,9 @@ struct xtables_target; - #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ - #define EBT_OPTSTRING OPTSTRING_COMMON "hv" - --/* define invflags which won't collide with IPT ones */ -+/* define invflags which won't collide with IPT ones. -+ * arptables-nft does NOT use the legacy ARPT_INV_* defines. -+ */ - #define IPT_INV_SRCDEVADDR 0x0080 - #define IPT_INV_TGTDEVADDR 0x0100 - #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch deleted file mode 100644 index 3386925..0000000 --- a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +++ /dev/null @@ -1,63 +0,0 @@ -From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 7 Nov 2023 19:12:14 +0100 -Subject: [PATCH] ebtables: Fix corner-case noflush restore bug - -Report came from firwalld, but this is actually rather hard to trigger. -Since a regular chain line prevents it, typical dump/restore use-cases -are unaffected. - -Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") -Cc: Eric Garver -Signed-off-by: Phil Sutter -(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) ---- - .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ - iptables/xtables-eb.c | 2 ++ - 2 files changed, 27 insertions(+) - create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 - -diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -new file mode 100755 -index 0000000000000..0def0ac58e7be ---- /dev/null -+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -@@ -0,0 +1,25 @@ -+#!/bin/sh -+# -+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: -+# - with --noflush -+# - a second table after the broute one -+# - A policy command but no chain line for BROUTING chain -+ -+set -e -+ -+case "$XT_MULTI" in -+*xtables-nft-multi) -+ ;; -+*) -+ echo "skip $XT_MULTI" -+ exit 0 -+ ;; -+esac -+ -+$XT_MULTI ebtables-restore --noflush < -Date: Sun, 19 Nov 2023 13:18:26 +0100 -Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused - -Drop the boolean, it was meant to disable some existence checks in -do_parse() prior to the caching rework. Now that do_parse() runs before -any caching is done, the checks in question don't exist anymore so drop -this relict. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) ---- - iptables/xshared.h | 1 - - iptables/xtables-translate.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index 5586385456a4d..c77556a1987dc 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -284,7 +284,6 @@ struct xt_cmd_parse { - bool restore; - int line; - int verbose; -- bool xlate; - struct xt_cmd_parse_ops *ops; - }; - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 88e0a6b639494..c019cd2991305 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - .table = *table, - .restore = restore, - .line = line, -- .xlate = true, - .ops = &h->ops->cmd_parse, - }; - struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch deleted file mode 100644 index c743e75..0000000 --- a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 19 Nov 2023 13:25:36 +0100 -Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON - -Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") -Signed-off-by: Phil Sutter -(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) ---- - iptables/xshared.h | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index c77556a1987dc..815b9d3e98726 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -75,10 +75,10 @@ struct xtables_globals; - struct xtables_rule_match; - struct xtables_target; - --#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" --#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" --#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ --#define EBT_OPTSTRING OPTSTRING_COMMON "hv" -+#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" -+#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" -+#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ -+#define EBT_OPTSTRING OPTSTRING_COMMON "h" - - /* define invflags which won't collide with IPT ones. - * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch deleted file mode 100644 index 07bea3a..0000000 --- a/0006-ebtables-Align-line-number-formatting-with-legacy.patch +++ /dev/null @@ -1,28 +0,0 @@ -From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 21 Nov 2023 22:58:47 +0100 -Subject: [PATCH] ebtables: Align line number formatting with legacy - -Legacy ebtables appends a dot to the number printed in first column if ---Ln flag was given. - -Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") -Signed-off-by: Phil Sutter -(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) ---- - iptables/nft-bridge.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index d9a8ad2b0f373..e414ef5584392 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, - struct iptables_command_state cs = {}; - - if (format & FMT_LINENUMBERS) -- printf("%d ", num); -+ printf("%d. ", num); - - nft_rule_to_ebtables_command_state(h, r, &cs); - __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch deleted file mode 100644 index b088c63..0000000 --- a/0007-man-Do-not-escape-exclamation-marks.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 13:29:17 +0100 -Subject: [PATCH] man: Do not escape exclamation marks - -This appears to be not necessary, also mandoc complains about it: - -| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! - -Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") -Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") -Signed-off-by: Phil Sutter -(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) ---- - extensions/libip6t_DNPT.man | 2 +- - extensions/libip6t_SNPT.man | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man -index 9b060f5b7179b..72c6ae5d422a2 100644 ---- a/extensions/libip6t_DNPT.man -+++ b/extensions/libip6t_DNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the SNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 -diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man -index 97e0071b43cc1..0c926978377a7 100644 ---- a/extensions/libip6t_SNPT.man -+++ b/extensions/libip6t_SNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the DNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch deleted file mode 100644 index c0bbec2..0000000 --- a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 20:21:49 +0100 -Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks - -In order to parse the mask, xtopt_parse_hostmask() calls -xtopt_parse_plenmask() thereby limiting netmask support to prefix -lengths (alternatively specified in IP address notation). - -In order to lift this impractical restriction, make -xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may -fall back to xtopt_parse_mask() which correctly initializes val.hmask -itself and indicates non-CIDR-compatible masks by setting val.hlen to --1. - -So in order to support these odd masks, it is sufficient for -xtopt_parse_plenmask() to skip its mask building from val.hlen value and -take whatever val.hmask contains. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) ---- - libxtables/xtoptions.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index b16bbfbe32311..d91a78f470eda 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - - xtopt_parse_plen(cb); - -+ /* may not be convertible to CIDR notation */ -+ if (cb->val.hlen == (uint8_t)-1) -+ goto out_put; -+ - memset(mask, 0xFF, sizeof(union nf_inet_addr)); - /* This shifting is AF-independent. */ - if (cb->val.hlen == 0) { -@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - mask[1] = htonl(mask[1]); - mask[2] = htonl(mask[2]); - mask[3] = htonl(mask[3]); -+out_put: - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); - } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch deleted file mode 100644 index 7745634..0000000 --- a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 19 Dec 2023 00:56:07 +0100 -Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting - -Parameter 'wait' passed to xtables_lock() signals three modes of -operation, depending on its value: - - 0: --wait not specified, do not wait if lock is busy --1: --wait specified without value, wait indefinitely until lock becomes - free ->0: Wait for 'wait' seconds for lock to become free, abort otherwise - -Since fixed commit, the first two cases were treated the same apart from -calling alarm(0), but that is a nop if no alarm is pending. Fix the code -by requesting a non-blocking flock() in the second case. While at it, -restrict the alarm setup to the third case only. - -Cc: Jethro Beekman -Cc: howardjohn@google.com -Cc: Antonio Ojea -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 -Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") -Signed-off-by: Phil Sutter -(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) ---- - .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ - iptables/xshared.c | 4 +- - 2 files changed, 57 insertions(+), 2 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 -new file mode 100755 -index 0000000000000..4481f966ce435 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 -@@ -0,0 +1,55 @@ -+#!/bin/bash -+ -+case "$XT_MULTI" in -+*xtables-legacy-multi) -+ ;; -+*) -+ echo skip $XT_MULTI -+ exit 0 -+ ;; -+esac -+ -+coproc RESTORE { $XT_MULTI iptables-restore; } -+echo "*filter" >&${RESTORE[1]} -+ -+ -+$XT_MULTI iptables -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 1 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "process waits when it should not" -+ exit 1 -+} -+wait $ipt_pid -+[[ $? -eq 0 ]] && { -+ echo "process exited 0 despite busy lock" -+ exit 1 -+} -+ -+t0=$(date +%s) -+$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT -+t1=$(date +%s) -+[[ $((t1 - t0)) -ge 3 ]] || { -+ echo "wait time not expired" -+ exit 1 -+} -+ -+$XT_MULTI iptables -w -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] || { -+ echo "no indefinite wait" -+ exit 1 -+} -+kill $ipt_pid -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "killed waiting iptables call did not exit in time" -+ exit 1 -+} -+ -+kill $RESTORE_PID -+wait -+exit 0 -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 5f75a0a57a023..690502c457dd0 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -270,7 +270,7 @@ static int xtables_lock(int wait) - return XT_LOCK_FAILED; - } - -- if (wait != -1) { -+ if (wait > 0) { - sigact_alarm.sa_handler = alarm_ignore; - sigact_alarm.sa_flags = SA_RESETHAND; - sigemptyset(&sigact_alarm.sa_mask); -@@ -278,7 +278,7 @@ static int xtables_lock(int wait) - alarm(wait); - } - -- if (flock(fd, LOCK_EX) == 0) -+ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) - return fd; - - if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch deleted file mode 100644 index ea88fa3..0000000 --- a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 17 Dec 2023 13:02:36 +0100 -Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK - -Do as the comment in xtopt_parse_hostmask() claims and omit -XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() -will catch the incompatibility. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) ---- - include/xtables.h | 1 - - libxtables/xtoptions.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/include/xtables.h b/include/xtables.h -index 087a1d600f9ae..9def9b43b6e58 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -61,7 +61,6 @@ struct in_addr; - * %XTTYPE_SYSLOGLEVEL: syslog level by name or number - * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) - * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length -- * (ptr: union nf_inet_addr; only host portion is stored) - * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) - * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) - * %XTTYPE_PORTRC: colon-separated port range (names acceptable), -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d91a78f470eda..ba68056dc99f7 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { - [XTTYPE_STRING] = -1, - [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), - [XTTYPE_HOST] = sizeof(union nf_inet_addr), -- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), - [XTTYPE_PROTOCOL] = sizeof(uint8_t), - [XTTYPE_PORT] = sizeof(uint16_t), - [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch deleted file mode 100644 index f348d59..0000000 --- a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 26 Jan 2024 18:43:10 +0100 -Subject: [PATCH] nft: ruleparse: Add missing braces around ternary - -The expression evaluated the sum before the ternay, consequently not -adding target->size if tgsize was zero. - -Identified by ASAN for a simple rule using standard target: -| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN -| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN -| ================================================================= -| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 -| READ of size 8 at 0x603000000120 thread T0 -| [...] - -Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") -Signed-off-by: Phil Sutter -(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) ---- - iptables/nft-ruleparse.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c -index c8322f936acd9..57fe27276de35 100644 ---- a/iptables/nft-ruleparse.c -+++ b/iptables/nft-ruleparse.c -@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) - if (!target) - return NULL; - -- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; -+ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); - - target->t = xtables_calloc(1, size); - target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch deleted file mode 100644 index 7d9c51f..0000000 --- a/0012-libxtables-Fix-memleak-of-matches-udata.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 31 Jan 2024 14:58:17 +0100 -Subject: [PATCH] libxtables: Fix memleak of matches' udata - -If the extension specifies a non-zero udata_size, field 'udata' points -to an allocated buffer which needs to be freed upon extension deinit. - -Interestingly, this bug was identified by ASAN and missed by valgrind. - -Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") -Signed-off-by: Phil Sutter -(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) ---- - libxtables/xtables.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index ba9ceaeb3da41..0f617d80ae37e 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) - free(matchp->match->m); - matchp->match->m = NULL; - } -+ if (matchp->match->udata_size) { -+ free(matchp->match->udata); -+ matchp->match->udata = NULL; -+ } - if (matchp->match == matchp->match->next) { - free(matchp->match); - matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index e9c3cb0..0000000 --- a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,200 +0,0 @@ -From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:27:03 +0100 -Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges - -While at it, fix xlate output for plain '-m ah' matches: With -ip6tables-translate, one should emit an extdhr exists match since -ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, -a simple 'meta l4proto ah' was missing. - -Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") -Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) - -Conflicts: - extensions/libip6t_ah.t - extensions/libip6t_ah.txlate - extensions/libipt_ah.t - extensions/libipt_ah.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_ah.c | 22 +++++++++++++--------- - extensions/libip6t_ah.t | 1 + - extensions/libip6t_ah.txlate | 6 ++++++ - extensions/libipt_ah.c | 22 ++++++++++++++-------- - extensions/libipt_ah.t | 1 + - extensions/libipt_ah.txlate | 6 ++++++ - 6 files changed, 41 insertions(+), 17 deletions(-) - -diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c -index f35982f379d76..0f95c4735eabd 100644 ---- a/extensions/libip6t_ah.c -+++ b/extensions/libip6t_ah.c -@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) - } - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - if (min == max) - printf("%s:%s%u", name, inv, min); - else -@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - char *space = ""; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); -@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, - } - - if (!space[0]) /* plain '-m ah' */ -- xt_xlate_add(xl, "meta l4proto ah"); -+ xt_xlate_add(xl, "exthdr ah exists"); - - return 1; - } -diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t -index c1898d44cf193..9099bdc9259c3 100644 ---- a/extensions/libip6t_ah.t -+++ b/extensions/libip6t_ah.t -@@ -13,3 +13,4 @@ - -m ah --ahspi 0:invalid;;FAIL - -m ah --ahspi;;FAIL - -m ah;=;OK -+-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate -index cc33ac2718c0c..32c6b7de00937 100644 ---- a/extensions/libip6t_ah.txlate -+++ b/extensions/libip6t_ah.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' - - ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT - nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' -+ -+ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr ah exists counter' -+ -+ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' -diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c -index fec5705ce6f53..39e3013d3e74b 100644 ---- a/extensions/libipt_ah.c -+++ b/extensions/libipt_ah.c -@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) - ahinfo->invflags |= IPT_AH_INV_SPI; - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - printf("%s", name); - if (min == max) { - printf(":%s", inv); -@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); - else - xt_xlate_add(xl, "%u", ahinfo->spis[0]); -+ } else { -+ xt_xlate_add(xl, "meta l4proto ah"); - } - - return 1; -diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t -index cd853865638e8..1aeb607e9e986 100644 ---- a/extensions/libipt_ah.t -+++ b/extensions/libipt_ah.t -@@ -11,3 +11,4 @@ - -m ah --ahspi;;FAIL - -m ah;;FAIL - -p ah -m ah;=;OK -+-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate -index 897c82b5f95c6..baf5a0ae6182a 100644 ---- a/extensions/libipt_ah.txlate -+++ b/extensions/libipt_ah.txlate -@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' - - iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP - nft 'add rule ip filter INPUT ah spi != 50 counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto ah counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 902ade1..0000000 --- a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,117 +0,0 @@ -From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:39:52 +0100 -Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges - -Also translate plain '-m frag' match into an exthdr exists one. - -Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) - -Conflicts: - extensions/libip6t_frag.t - extensions/libip6t_frag.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- - extensions/libip6t_frag.t | 1 + - extensions/libip6t_frag.txlate | 6 ++++++ - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c -index 49c787e709a9e..ed7fe10a4716d 100644 ---- a/extensions/libip6t_frag.c -+++ b/extensions/libip6t_frag.c -@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) - } - } - -+static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_ids(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_ids_match(min, max, invert)) { - printf("%s", name); - if (min == max) - printf(":%s%u", inv, min); -@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, - static void frag_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 -- && fraginfo->ids[1] == 0xFFFFFFFF)) { -- printf("%s --fragid ", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ printf("%s --fragid ", inv_ids ? " !" : ""); - if (fraginfo->ids[0] - != fraginfo->ids[1]) - printf("%u:%u", -@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) - printf(" --fraglast"); - } - -+#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ -+ IP6T_FRAG_MF | IP6T_FRAG_NMF) -+ - static int frag_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_frag *fraginfo = - (struct ip6t_frag *)params->match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "frag id %s", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? -- "!= " : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); - if (fraginfo->ids[0] != fraginfo->ids[1]) - xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], - fraginfo->ids[1]); - else - xt_xlate_add(xl, "%u", fraginfo->ids[0]); - -+ } else if (!(fraginfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr frag exists"); -+ return 1; - } - - /* ignore ineffective IP6T_FRAG_LEN bit */ -diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t -index 299fa03f8845b..58417c90e9217 100644 ---- a/extensions/libip6t_frag.t -+++ b/extensions/libip6t_frag.t -@@ -1,4 +1,5 @@ - :INPUT,FORWARD,OUTPUT -+-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK - -m frag --fragid 1:42;=;OK - -m frag --fraglen 42;=;OK - -m frag --fragres;=;OK -diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate -index 33fc0631dc792..e250587e7682c 100644 ---- a/extensions/libip6t_frag.txlate -+++ b/extensions/libip6t_frag.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' - - ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT - nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' -+ -+ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr frag exists counter' -+ -+ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 1afcc54..0000000 --- a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,111 +0,0 @@ -From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:42:10 +0100 -Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges - -Also translate '-m mh' into an exthdr exists match unless '-p mh' is -also present. The latter is converted into 'meta l4proto mh' which might -need fixing itself at a later point. - -Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) - -Conflicts: - extensions/libip6t_mh.t - extensions/libip6t_mh.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_mh.c | 20 ++++++++++++++++---- - extensions/libip6t_mh.t | 1 + - extensions/libip6t_mh.txlate | 9 +++++++++ - 3 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 1410d324b5d42..3f80e28ec94c8 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - enum { - O_MH_TYPE = 0, -@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) - printf("%s", name); - } - -+static bool skip_types_match(uint8_t min, uint8_t max, bool inv) -+{ -+ return min == 0 && max == UINT8_MAX && !inv; -+} -+ - static void print_types(uint8_t min, uint8_t max, int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFF || invert) { -+ if (!skip_types_match(min, max, invert)) { - printf(" "); - if (min == max) { - printf("%s", inv); -@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, - static void mh_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) - return; - -- if (mhinfo->invflags & IP6T_MH_INV_TYPE) -+ if (inv_type) - printf(" !"); - - if (mhinfo->types[0] != mhinfo->types[1]) -@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -+ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -+ if (proto != IPPROTO_MH) -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; -+ } - - if (mhinfo->types[0] != mhinfo->types[1]) - xt_xlate_add(xl, "mh type %s%u-%u", -diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t -index 6b76d13d0a00f..be5439edc9520 100644 ---- a/extensions/libip6t_mh.t -+++ b/extensions/libip6t_mh.t -@@ -4,3 +4,4 @@ - -p mobility-header -m mh --mh-type 1;=;OK - -p mobility-header -m mh ! --mh-type 4;=;OK - -p mobility-header -m mh --mh-type 4:123;=;OK -+-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 4dfaf46a2b8d7..3364ce574468f 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac - - ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' -+ -+ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+ -+ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' -+ -+ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index c9ec110..0000000 --- a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:45:42 +0100 -Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges - -Also translate plain '-m rt' match into an exthdr exists one. - -Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) - -Conflicts: - extensions/libip6t_rt.t - extensions/libip6t_rt.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- - extensions/libip6t_rt.t | 1 + - extensions/libip6t_rt.txlate | 9 +++++++++ - 3 files changed, 30 insertions(+), 8 deletions(-) - -diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c -index d5b0458bb397e..6db09f0b2cdc8 100644 ---- a/extensions/libip6t_rt.c -+++ b/extensions/libip6t_rt.c -@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) - } - } - -+static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_nums(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_segsleft_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, - static void rt_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - printf("%s --rt-type %u", -@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 -- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- printf("%s --rt-segsleft ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); - if (rtinfo->segsleft[0] - != rtinfo->segsleft[1]) - printf("%u:%u", -@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - - } - -+#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ -+ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) -+ - static int rt_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - xt_xlate_add(xl, "rt type%s %u", -@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "rt seg-left%s ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); - - if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) - xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], - rtinfo->segsleft[1]); - else - xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); -+ } else if (!(rtinfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr rt exists"); -+ return 1; - } - - if (rtinfo->flags & IP6T_RT_LEN) { -diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t -index 3c7b2d981324a..047b6880e354d 100644 ---- a/extensions/libip6t_rt.t -+++ b/extensions/libip6t_rt.t -@@ -3,3 +3,4 @@ - -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK - -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK - -m rt;=;OK -+-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK -diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate -index 3578bcba0157e..1c2f74a588750 100644 ---- a/extensions/libip6t_rt.txlate -+++ b/extensions/libip6t_rt.txlate -@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' - - ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT - nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' -+ -+ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 318d9eb..0000000 --- a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,119 +0,0 @@ -From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:47:09 +0100 -Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges - -Also add a translation for plain '-m esp' match which depends on the -address family: While ip6tables-translate may emit an exthdr exists -match, iptables-translate must stick to meta l4proto. - -Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) - -Conflicts: - extensions/libxt_esp.t - extensions/libxt_esp.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_esp.c | 26 ++++++++++++++++++-------- - extensions/libxt_esp.t | 1 + - extensions/libxt_esp.txlate | 12 ++++++++++++ - 3 files changed, 31 insertions(+), 8 deletions(-) - -diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c -index 2c7ff942cb9e0..8e9766d71ed57 100644 ---- a/extensions/libxt_esp.c -+++ b/extensions/libxt_esp.c -@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) - espinfo->invflags |= XT_ESP_INV_SPI; - } - -+static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spis_match(min, max, invert)) { - if (min == max) - printf(" %s:%s%u", name, inv, min); - else -@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void esp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_esp *espinfo = (struct xt_esp *)match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 -- && espinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --espspi ", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ printf("%s --espspi ", inv_spi ? " !" : ""); - if (espinfo->spis[0] - != espinfo->spis[1]) - printf("%u:%u", -@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "esp spi%s", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); - if (espinfo->spis[0] != espinfo->spis[1]) - xt_xlate_add(xl, " %u-%u", espinfo->spis[0], - espinfo->spis[1]); - else - xt_xlate_add(xl, " %u", espinfo->spis[0]); -+ } else if (afinfo->family == NFPROTO_IPV4) { -+ xt_xlate_add(xl, "meta l4proto esp"); -+ } else if (afinfo->family == NFPROTO_IPV6) { -+ xt_xlate_add(xl, "exthdr esp exists"); -+ } else { -+ return 0; - } - - return 1; -diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t -index 92c5779f860f1..37259d6b3a08f 100644 ---- a/extensions/libxt_esp.t -+++ b/extensions/libxt_esp.t -@@ -4,5 +4,6 @@ - -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK - -p esp -m esp ! --espspi 0:4294967294;=;OK - -p esp -m esp --espspi -1;;FAIL -+-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK - -p esp -m esp;=;OK - -m esp;;FAIL -diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate -index f6aba52f52235..5e8fb241beaf4 100644 ---- a/extensions/libxt_esp.txlate -+++ b/extensions/libxt_esp.txlate -@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' - - iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP - nft 'add rule ip filter INPUT esp spi 500-600 counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto esp counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch deleted file mode 100644 index 316e5dd..0000000 --- a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:57:46 +0100 -Subject: [PATCH] extensions: ipcomp: Save inverted full ranges - -Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") -Signed-off-by: Phil Sutter -(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) - -Conflicts: - extensions/libxt_ipcomp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_ipcomp.c | 7 ++++--- - extensions/libxt_ipcomp.t | 1 + - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c -index 4171c4a1c4eb7..961c17e584933 100644 ---- a/extensions/libxt_ipcomp.c -+++ b/extensions/libxt_ipcomp.c -@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, - static void comp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; -+ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; - - if (!(compinfo->spis[0] == 0 -- && compinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ipcompspi ", -- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); -+ && compinfo->spis[1] == UINT32_MAX -+ && !inv_spi)) { -+ printf("%s --ipcompspi ", inv_spi ? " !" : ""); - if (compinfo->spis[0] - != compinfo->spis[1]) - printf("%u:%u", -diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t -index 8546ba9ce416f..47c1fbc220c6a 100644 ---- a/extensions/libxt_ipcomp.t -+++ b/extensions/libxt_ipcomp.t -@@ -1,3 +1,4 @@ - :INPUT,OUTPUT - -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK - -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK -+-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch deleted file mode 100644 index cfeacd5..0000000 --- a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 2 Feb 2024 13:14:29 +0100 -Subject: [PATCH] nft: Do not omit full ranges if inverted - -Otherwise this turns a never matching rule into an always matching one. - -Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") -Signed-off-by: Phil Sutter -(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_udp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_tcp.t | 2 ++ - extensions/libxt_udp.t | 2 ++ - iptables/nft.c | 4 ++-- - 3 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 7a3bbd08952f0..3caa3e3f50271 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,6 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index f534770191a6e..aa2c91770e63f 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,6 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK -+-p udp -m udp ! --sport :;-p udp -m udp;OK -+-p udp -m udp ! --dport :;-p udp -m udp;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/iptables/nft.c b/iptables/nft.c -index 97fd4f49fdb4c..8e7a38ac93a3e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return 0; - } - -- if (src[0] || src[1] < 0xffff) { -+ if (src[0] || src[1] < UINT16_MAX || invert_src) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); - if (!expr) - return -ENOMEM; -@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return ret; - } - -- if (dst[0] || dst[1] < 0xffff) { -+ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); - if (!expr) - return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 326544f..0000000 --- a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 17:42:12 +0100 -Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges - -Also translate a bare '-m tcp/udp' to 'meta l4proto' match. - -Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") -Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_tcp.txlate - extensions/libxt_udp.t - extensions/libxt_udp.txlate -- Context change due to Missing commits adding test cases. ---- - extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- - extensions/libxt_tcp.t | 4 ++-- - extensions/libxt_tcp.txlate | 6 +++++ - extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- - extensions/libxt_udp.t | 4 ++-- - extensions/libxt_udp.txlate | 6 +++++ - 6 files changed, 72 insertions(+), 39 deletions(-) - -diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c -index f82572828649b..32bbd684fd5d7 100644 ---- a/extensions/libxt_tcp.c -+++ b/extensions/libxt_tcp.c -@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void tcp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; - -- if (tcpinfo->spts[0] != 0 -- || tcpinfo->spts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (tcpinfo->spts[0] - != tcpinfo->spts[1]) -@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) - tcpinfo->spts[0]); - } - -- if (tcpinfo->dpts[0] != 0 -- || tcpinfo->dpts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (tcpinfo->dpts[0] - != tcpinfo->dpts[1]) -@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, - { - const struct xt_tcp *tcpinfo = - (const struct xt_tcp *)params->match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; -+ bool xlated = false; - -- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { - if (tcpinfo->spts[0] != tcpinfo->spts[1]) { - xt_xlate_add(xl, "tcp sport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0], tcpinfo->spts[1]); - } else { - xt_xlate_add(xl, "tcp sport %s%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { - if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { - xt_xlate_add(xl, "tcp dport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0], tcpinfo->dpts[1]); - } else { - xt_xlate_add(xl, "tcp dport %s%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->option) -+ if (tcpinfo->option) { - xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, - tcpinfo->invflags & XT_TCP_INV_OPTION ? - "missing" : "exists"); -+ xlated = true; -+ } - - if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "tcp flags %s", -@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, - print_tcp_xlate(xl, tcpinfo->flg_cmp); - xt_xlate_add(xl, " / "); - print_tcp_xlate(xl, tcpinfo->flg_mask); -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto tcp"); -+ - return 1; - } - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 3caa3e3f50271..8baeeff2fc94b 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,8 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ---p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ---p tcp -m tcp ! --dport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate -index 9802ddfe0039e..b3ddcc15833cf 100644 ---- a/extensions/libxt_tcp.txlate -+++ b/extensions/libxt_tcp.txlate -@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' - - iptables-translate -A INPUT -p tcp ! --tcp-option 23 - nft 'add rule ip filter INPUT tcp option 23 missing counter' -+ -+iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' -+ -+iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' -diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c -index ba1c3eb768592..748d418039c3a 100644 ---- a/extensions/libxt_udp.c -+++ b/extensions/libxt_udp.c -@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void udp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_udp *udpinfo = (struct xt_udp *)match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; - -- if (udpinfo->spts[0] != 0 -- || udpinfo->spts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_SRCPT) -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (udpinfo->spts[0] - != udpinfo->spts[1]) -@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) - udpinfo->spts[0]); - } - -- if (udpinfo->dpts[0] != 0 -- || udpinfo->dpts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_DSTPT) -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (udpinfo->dpts[0] - != udpinfo->dpts[1]) -@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; -+ bool xlated = false; - -- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { - if (udpinfo->spts[0] != udpinfo->spts[1]) { - xt_xlate_add(xl,"udp sport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0], udpinfo->spts[1]); - } else { - xt_xlate_add(xl, "udp sport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0]); - } -+ xlated = true; - } - -- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { - if (udpinfo->dpts[0] != udpinfo->dpts[1]) { - xt_xlate_add(xl,"udp dport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0], udpinfo->dpts[1]); - } else { - xt_xlate_add(xl,"udp dport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0]); - } -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto udp"); -+ - return 1; - } - -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index aa2c91770e63f..0cde6ac30cc15 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,8 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ---p udp -m udp ! --sport :;-p udp -m udp;OK ---p udp -m udp ! --dport :;-p udp -m udp;OK -+-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK -+-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate -index 28e7ca206b26b..d6bbb96f5d744 100644 ---- a/extensions/libxt_udp.txlate -+++ b/extensions/libxt_udp.txlate -@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep - - iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT - nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' -+ -+iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' -+ -+iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch deleted file mode 100644 index 46c636c..0000000 --- a/0021-nft-Fix-for-broken-recover_rule_compat.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 27 Feb 2024 18:47:39 +0100 -Subject: [PATCH] nft: Fix for broken recover_rule_compat() - -When IPv4 rule generator was changed to emit payload instead of -meta expressions for l4proto matches, the code reinserting -NFTNL_RULE_COMPAT_* attributes into rules being reused for counter -zeroing was broken by accident. - -Make rule compat recovery aware of the alternative match, basically -reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules -with NFTA_RULE_COMPAT") but add a test case this time to make sure -things stay intact. - -Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") -Signed-off-by: Phil Sutter -(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) ---- - iptables/nft.c | 27 ++++++++++++++++--- - .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ - 2 files changed, 35 insertions(+), 4 deletions(-) - create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8e7a38ac93a3e..42907a431a99e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) - return strerror(err); - } - -+static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) -+{ -+ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); -+ uint32_t poff = offsetof(struct iphdr, protocol); -+ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; -+ -+ if (!strcmp(name, "payload") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); -+ return 0; -+ } -+ if (!strcmp(name, "meta") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -+ return 0; -+ } -+ return -1; -+} -+ - static int recover_rule_compat(struct nftnl_rule *r) - { - struct nftnl_expr_iter *iter; -@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) - if (!e) - goto out; - -- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || -- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) -+ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ -+ if (l4proto_expr_get_dreg(e, ®) < 0) - goto next_expr; - -- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -- - e = nftnl_expr_iter_next(iter); - if (!e) - goto out; -diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -new file mode 100755 -index 0000000000000..e276a953234cf ---- /dev/null -+++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -@@ -0,0 +1,12 @@ -+#!/bin/bash -+ -+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } -+ -+set -e -+ -+rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" -+for cmd in iptables ip6tables; do -+ $XT_MULTI $cmd -t mangle -A PREROUTING $rule -+ $XT_MULTI $cmd -t mangle -Z -+ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" -+done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch deleted file mode 100644 index 0be13ca..0000000 --- a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 5 Mar 2024 17:02:56 +0100 -Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match - -Since core xlate code now ignores '-p mh' if an mh extension is also -present in the rule, mh extension has to emit the l4proto match itself. -Therefore emit the exthdr match irrespective of '-p' argument value just -like other IPv6 extension header matches do. - -Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") -Signed-off-by: Phil Sutter -(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) ---- - extensions/libip6t_mh.c | 4 +--- - extensions/libip6t_mh.txlate | 2 +- - 2 files changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 3f80e28ec94c8..1a1cee832b584 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; - bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - - if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -- if (proto != IPPROTO_MH) -- xt_xlate_add(xl, "exthdr mh exists"); -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; - } - -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 3364ce574468f..7eeaeefab6116 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' - - ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT --nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' - - ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT - nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch deleted file mode 100644 index a5e7994..0000000 --- a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 9 Apr 2024 13:18:12 +0200 -Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option - -Calling iptables with '-c ""' resulted in a call to strchr() with an -invalid pointer as 'optarg + 1' points to past the buffer. The most -simple fix is to drop the offset: The global optstring part specifies a -single colon after 'c', so getopt() enforces a valid pointer in optarg. -If it contains a comma at first position, packet counter value parsing -will fail so all cases are covered. - -Reported-by: gorbanev.es@gmail.com -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 -Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") -Signed-off-by: Phil Sutter -(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) ---- - extensions/iptables.t | 5 +++++ - iptables/xshared.c | 2 +- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/extensions/iptables.t b/extensions/iptables.t -index b4b6d677abab1..5d6d3d15cc5fd 100644 ---- a/extensions/iptables.t -+++ b/extensions/iptables.t -@@ -4,3 +4,8 @@ - -i eth+ -o alongifacename+;=;OK - ! -i eth0;=;OK - ! -o eth+;=;OK -+-c "";;FAIL -+-c ,3;;FAIL -+-c 3,;;FAIL -+-c ,;;FAIL -+-c 2,3 -j ACCEPT;-j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 690502c457dd0..f2e3bc03a2824 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], - set_option(&cs->options, OPT_COUNTERS, &args->invflags, - invert); - args->pcnt = optarg; -- args->bcnt = strchr(args->pcnt + 1, ','); -+ args->bcnt = strchr(args->pcnt, ','); - if (args->bcnt) - args->bcnt++; - if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt deleted file mode 100644 index 2d3b902..0000000 --- a/coreteam-gpg-key-0xD55D978A8A1420E4.txt +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded -660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi -V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 -zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t -Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh -KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 -dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi -WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg -9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj -+IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR -U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB -tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC -VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ -CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 -+ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd -RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 -4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN -IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w -bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf -Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj -QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 -wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb -4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET -tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP -n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV -oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 -o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S -ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU -tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp -HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM -FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ -diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid -R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK -uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv -Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl -UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q -KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO -RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc -wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 -0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ -q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU -k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk -pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY -plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC -qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu -iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p -jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O -ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 -CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag -8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB -bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM -jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR -rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg -3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ -7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 -7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ -yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 -leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 -U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ -rlbu70nh2kSJrg== -=wukb ------END PGP PUBLIC KEY BLOCK----- diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt new file mode 100644 index 0000000..cd4a35b --- /dev/null +++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E +o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+ +2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w +nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ +P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF +qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK +5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz +ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX +u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT +/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b +cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L +LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF +8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL +5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK +AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi +Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR +VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF +RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B +uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE +zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq +ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v +3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X +iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi +wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/ +UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj +M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm +97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E +FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW +IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb +0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF +GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu +bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8 +QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD +Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU +3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR +yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS +C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K +klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I +zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST +Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM +X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh +5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB +woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT +njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl +yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU +hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv +BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj +ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh +hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP +tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s +E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H +fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv +CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT +EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ +gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC +9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W +oD8ElPP+m/v6iA== +=70vD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index 90ba23e..edea0ae 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,11 +10,11 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.10 -Release: 15%{?dist} +Version: 1.8.11 +Release: 1%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig -Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt Source3: iptables.init Source4: iptables-config Source5: iptables.service @@ -22,30 +22,6 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-nft-helper -Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch -Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch -Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch -Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch -Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch -Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch -Patch007: 0007-man-Do-not-escape-exclamation-marks.patch -Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch -Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch -Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch -Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch -Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch -Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch -Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch -Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch -Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch -Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch -Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch -Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch -Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch -Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch -Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch -Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -440,6 +416,7 @@ fi %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %{_sbindir}/ebtables-translate +%{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -448,6 +425,7 @@ fi %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* +%{_mandir}/man8/arptables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -456,6 +434,9 @@ fi %changelog +* Fri Nov 08 2024 Phil Sutter - 1.8.11-1 +- new version + * Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 6015b94..1f7b750 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 -SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 +SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2 From f8d67dc298024ae283e050e7af6b1afc23f26bed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 18:27:10 +0200 Subject: [PATCH 60/79] Use %sbin_merge_compat macro for brevity --- iptables.spec | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index edea0ae..c94f3d7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,12 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -161,12 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. From e18ea14e5e3c134b44d50e6456f249f6f3ee6860 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:31:44 +0100 Subject: [PATCH 61/79] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c94f3d7..cb9c4e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 1%{?dist} +Release: 2%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -424,6 +424,9 @@ fi %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Fri Nov 08 2024 Phil Sutter - 1.8.11-1 - new version From 43696a4be35ecb64b596d1db368cb736a91316e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 14 Jan 2025 14:59:44 +0100 Subject: [PATCH 62/79] Keep alternatives symlinks under /usr/sbin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit update-alternatives becomes unhappy when called with paths under /usr/bin and /usr/sbin that are mixed: >>> Non-critical error in post-install scriptlet: iptables-legacy-0:1.8.11-3.fc42.x86_64 >>> Scriptlet output: >>> the primary link for iptables must be /usr/sbin/iptables >>> >>> [RPM] %post(iptables-legacy-1.8.11-3.fc42.x86_64) scriptlet failed, exit status 2 Things will mostly work if we keep using the old path: * On new installs, /usr/sbin will be a symlink, so the /usr/sbin paths will just point to /usr/bin and both sets of paths will work equivalently. * On upgrades, we'll maintain the /usr/sbin paths, which should be fine also, since everything must support using those paths for compatiblity. * The only thing that will not work is the merging of /usr/sbin to ./bin once /usr/sbin only contains symlinks. The scriptlets in filesystem.rpm would need to be adjusted to handle that case (i.e. allow symlinks /usr/sbin/foo → ../bin/foo and /usr/sbin/foo → /etc/alternatives/foo to be removed). This special case can be handled later. --- iptables.spec | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index cb9c4e6..66f245a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 2%{?dist} +Release: 3%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -236,11 +236,17 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +%if "%{_sbindir}" == "%{_bindir}" +# We keep those symlinks in /usr/sbin for compatibility +mkdir -p %{buildroot}/usr/sbin +mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +%endif + %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -252,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables /usr/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -265,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -291,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -301,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=/usr/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -317,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=/usr/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -343,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd /usr/sbin/$cmd-nft done fi @@ -355,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -416,14 +422,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 +- Keep symlinks managed by alternatives under /usr/sbin + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-2 - Rebuilt for the bin-sbin merge (2nd attempt) From 2533c217e52cbe658e05afb25fc6bc2f912fca59 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 07:22:06 +0000 Subject: [PATCH 63/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 66f245a..b170a43 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 3%{?dist} +Release: 4%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -430,6 +430,9 @@ fi %changelog +* Fri Jan 17 2025 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 - Keep symlinks managed by alternatives under /usr/sbin From c8015c16af9b2260f1fda5ccd6920774fc4d2efc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 26 Mar 2025 14:03:28 -0400 Subject: [PATCH 64/79] Flatpak fix for "Keep alternatives symlinks under /usr/sbin" Even if specific %_*dir macros cannot be used, %_prefix must be used at a minimum to refer to the installation path of files from the given package. This is a requirement for flatpak builds. --- iptables.spec | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/iptables.spec b/iptables.spec index b170a43..f211aa9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,7 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -156,7 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -238,15 +238,15 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %if "%{_sbindir}" == "%{_bindir}" # We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +mkdir -p %{buildroot}%{_prefix}/sbin +mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ %endif %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -258,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -271,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -307,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -323,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -349,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -361,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -422,8 +422,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From a1603c18de94a6d18aa110c640ea27941ca5927c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 2 Apr 2025 15:01:46 +0200 Subject: [PATCH 65/79] Assimilate arptables-services Provide the service as part of iptables-services. The arptables-nft-helper was already quite similar to arptables-legacy-helper, it should serve fine for legacy arptables, too. --- arptables-nft-helper => arptables-helper | 0 arptables.service | 12 +++++++++ iptables.spec | 32 ++++++++++++++---------- 3 files changed, 31 insertions(+), 13 deletions(-) rename arptables-nft-helper => arptables-helper (100%) create mode 100644 arptables.service diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index f211aa9..d195a2c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -20,7 +20,8 @@ Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-nft-helper +Source8: arptables-helper +Source9: arptables.service # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -125,6 +126,10 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} BuildArch: noarch %description services @@ -155,6 +160,9 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 %sbin_merge_compat %{_prefix}/sbin/iptables @@ -188,16 +196,18 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -224,9 +234,6 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 @@ -285,14 +292,14 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post iptables.service ip6tables.service +%systemd_post arptables.service iptables.service ip6tables.service %preun services -%systemd_preun iptables.service ip6tables.service +%systemd_preun arptables.service iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun iptables.service ip6tables.service +%systemd_postun arptables.service iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -343,8 +350,7 @@ update-alternatives --install \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} %postun nft if [ $1 -eq 0 ]; then @@ -390,9 +396,11 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%{_unitdir}/{arp,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/arptables-helper %files utils %license COPYING @@ -415,7 +423,6 @@ fi %{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* @@ -424,7 +431,6 @@ fi %{_mandir}/man8/arptables-translate* %ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From 347e497e7205a827bf52674e20c05d5595c100e0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 02:05:13 +0200 Subject: [PATCH 66/79] Assimilate ebtables-services Provide the service as part of iptables-services. --- ebtables-config | 11 +++++ ebtables-helper | 102 +++++++++++++++++++++++++++++++++++++++++++++++ ebtables.service | 11 +++++ iptables.spec | 28 +++++++++---- 4 files changed, 145 insertions(+), 7 deletions(-) create mode 100644 ebtables-config create mode 100644 ebtables-helper create mode 100644 ebtables.service diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index d195a2c..2144ee0 100644 --- a/iptables.spec +++ b/iptables.spec @@ -22,6 +22,9 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-helper Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -130,6 +133,10 @@ Obsoletes: %{name}-ipv6 < 1.4.11.1 Conflicts: %{name}-nft < 1.8.11-5 Obsoletes: arptables-services < 0.0.5-16 Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -196,7 +203,7 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init -install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config @@ -204,10 +211,12 @@ install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6table install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -292,14 +301,17 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post arptables.service iptables.service ip6tables.service +%systemd_post arptables.service ebtables.service +%systemd_post iptables.service ip6tables.service %preun services -%systemd_preun arptables.service iptables.service ip6tables.service +%systemd_preun arptables.service ebtables.service +%systemd_preun iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun arptables.service iptables.service ip6tables.service +%systemd_postun arptables.service ebtables.service +%systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -397,10 +409,12 @@ fi %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} %config(noreplace) %{_sysconfdir}/sysconfig/arptables -%{_unitdir}/{arp,ip,ip6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} -%{_libexecdir}/arptables-helper +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING From 45128b30b581863eee82c03977fd0d57cd301acc Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:50:18 +0200 Subject: [PATCH 67/79] rpmlint: Fix for E: description-line-too-long --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 2144ee0..ce9a1ee 100644 --- a/iptables.spec +++ b/iptables.spec @@ -93,9 +93,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 From e71883b551ebfba9eb6cd16095612d43ad878547 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:52:40 +0200 Subject: [PATCH 68/79] rpmlint: Fix for W: dangling-relative-symlink The %ghost directives in %files sections pick up the symlinks installed by the iptables build system, when in fact these are maintained in Fedora by alternatives. To avoid the confusion, remove them. To avoid causing 'W: zero-perms-ghost', add a %attr statement to the respective %ghost lines. --- iptables.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/iptables.spec b/iptables.spec index ce9a1ee..5efa959 100644 --- a/iptables.spec +++ b/iptables.spec @@ -247,16 +247,11 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}%{_prefix}/sbin -mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ -%endif - %ldconfig_scriptlets %post legacy @@ -378,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -442,8 +437,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From b2d1af398f3799020bc82f5f71a999ccd9dba432 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 11:43:34 +0200 Subject: [PATCH 69/79] spec: Merge common non-symlink removal loops --- iptables.spec | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5efa959..c8927c8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -310,6 +310,23 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_prefix}/sbin/iptables pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ @@ -322,14 +339,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ @@ -338,18 +347,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ From ac4331ac14f14b40c09d5009ca958697c7b8d1a0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 13:15:57 +0200 Subject: [PATCH 70/79] iptables-1.8.11-5 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c8927c8..93641a9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 4%{?dist} +Release: 5%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -441,6 +441,9 @@ fi %changelog +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From b56d83fa63cfe3b2db4f9d3f2e367b17cec36d23 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 20 Apr 2025 09:15:04 -0700 Subject: [PATCH 71/79] Add patch to fix -C handling ( fixes rhbz#2360423 ) --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ++++++++++++++++++ iptables.spec | 8 +- 2 files changed, 179 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 93641a9..177c6fd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 5%{?dist} +Release: 6%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -25,6 +25,9 @@ Source9: arptables.service Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch: iptables-1.8.11-fix-interface-comparisons.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -441,6 +444,9 @@ fi %changelog +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + * Thu Apr 03 2025 Phil Sutter - 1.8.11-5 - iptables-services to assimilate arptables- and ebtables-services From 046b2467b46a166204cecce9a6adc5ccfbd09031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 12 Mar 2025 16:06:49 +0100 Subject: [PATCH 72/79] Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit 43696a4be35ecb64b596d1db368cb736a91316e8 and also the follow-up work from c8015c16af9b2260f1fda5ccd6920774fc4d2efc. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected. Issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2361004. --- iptables.spec | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/iptables.spec b/iptables.spec index 177c6fd..bc9f667 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 6%{?dist} +Release: 7%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -271,7 +272,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -315,7 +316,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_prefix}/sbin/{eb,arp}tables; do +for pfx in %{_sbindir}/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -330,8 +331,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +341,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +349,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -361,7 +362,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +374,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +438,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + * Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 - Add patch to fix -C handling ( fixes rhbz#2360423 ) From 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Sat, 3 May 2025 23:22:49 +0200 Subject: [PATCH 73/79] Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit 046b2467b46a166204cecce9a6adc5ccfbd09031. These changes break systems, see bz#2362648 and bz#2362808 for details. --- iptables.spec | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/iptables.spec b/iptables.spec index bc9f667..fac1bbf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 7%{?dist} +Release: 8%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,7 +64,6 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -259,8 +258,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -272,7 +271,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -285,8 +284,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -316,7 +315,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_sbindir}/{eb,arp}tables; do +for pfx in %{_prefix}/sbin/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -331,8 +330,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -341,7 +340,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -349,7 +348,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -362,7 +361,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -374,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -438,13 +437,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + * Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 - Keep symlinks managed by alternatives under /usr/bin From 90a211ef7302c29a98a674de8afb3f6c7a0ab3ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 7 May 2025 16:30:51 +0200 Subject: [PATCH 74/79] Move iptables symlinks to /usr/bin again This partially reverts commit 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems. --- iptables.spec | 60 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index fac1bbf..edcea9a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 8%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -268,10 +269,19 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +294,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,6 +307,15 @@ alternatives --set iptables $(/dev/null || : +done +%endif + %post services %systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service @@ -330,8 +349,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +359,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +367,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -358,10 +377,19 @@ update-alternatives --install \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +401,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +465,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + * Sat May 03 2025 Phil Sutter - 1.8.11-8 - Revert last release, it breaks alternatives symlinks From 6f0696f58a45a6c3265c6d9837e06da2ffce5270 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 13 May 2025 10:55:45 +0200 Subject: [PATCH 75/79] Use modern option name for "follower" symlinks --- iptables.spec | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/iptables.spec b/iptables.spec index edcea9a..b5d83c1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -263,11 +263,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -298,11 +298,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $( Date: Tue, 20 May 2025 23:54:42 +0200 Subject: [PATCH 76/79] Fix for ghost files not present in iptables-nft RPM When fixing for rpmlint warnings, the standard symlinks installed by package's 'make install' were removed but they are in fact necessary for the globbing in %files section to happen. Replace them by empty files after removal to fix this. Fixes: e71883b551ebfba9eb6cd16095612d43ad878547 --- iptables.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index b5d83c1..c7216fb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -251,7 +251,8 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml From cc26decabc00149c006f76fc10450ce15d707077 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 20 May 2025 23:59:29 +0200 Subject: [PATCH 77/79] iptables-1.8.11-10 - Fix for ghost files not present in iptables-nft RPM Resolves: rhbz#2365424 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c7216fb..cdf4f66 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 9%{?dist} +Release: 10%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + * Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged. From 8ce4421d204c44131cbdc96465cafcb1f5f71288 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:46:02 +0000 Subject: [PATCH 78/79] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index cdf4f66..837bf0a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Phil Sutter - 1.8.11-10 - Fix for ghost files not present in iptables-nft RPM From 6a017827bbf2ff7454a8f3f45937124175c05e43 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Oct 2025 11:21:29 -0400 Subject: [PATCH 79/79] - Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. --- iptables-1.8.11-command-options-fix.patch | 27 +++++++++++++++++++++++ iptables.spec | 10 +++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 iptables-1.8.11-command-options-fix.patch diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables.spec b/iptables.spec index 837bf0a..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -27,7 +27,10 @@ Source11: ebtables-helper Source12: ebtables-config # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch: iptables-1.8.11-fix-interface-comparisons.patch +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -473,6 +476,9 @@ fi %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + * Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild