From d7a6e51ad5dab7cefc107f21bf010806c74b8f9c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 12 Feb 2020 19:21:32 +0100 Subject: [PATCH 1/5] iptables-1.8.4-7 - Move nft-specific extensions into iptables-nft package - Move remaining extensions into iptables-libs package - Make iptables-nft depend on iptables-libs instead of iptables - Add upstream-suggested fixes --- ...apply-Use-mktemp-instead-of-tempfile.patch | 4 +- 0002-Fix-DEBUG-build.patch | 33 ++++++++ ...ore-Fix-parser-feed-from-line-buffer.patch | 59 ++++++++++++++ ...e-Avoid-access-of-uninitialized-data.patch | 31 ++++++++ ...xtensions-time-Avoid-undefined-shift.patch | 31 ++++++++ ...nsions-cluster-Avoid-undefined-shift.patch | 31 ++++++++ ...te-Guard-strcpy-call-in-xlate_ifname.patch | 40 ++++++++++ ...extensions-among-Check-call-to-fstat.patch | 41 ++++++++++ ...tore-fix-for-noflush-and-empty-lines.patch | 78 +++++++++++++++++++ iptables.spec | 32 ++++++-- 10 files changed, 370 insertions(+), 10 deletions(-) create mode 100644 0002-Fix-DEBUG-build.patch create mode 100644 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch create mode 100644 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch create mode 100644 0005-extensions-time-Avoid-undefined-shift.patch create mode 100644 0006-extensions-cluster-Avoid-undefined-shift.patch create mode 100644 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch create mode 100644 0008-extensions-among-Check-call-to-fstat.patch create mode 100644 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch index b6e1712..970370d 100644 --- a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +++ b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch @@ -1,4 +1,4 @@ -From 1dba0d0a2c9c269dc5ed9e7d841b8ecb9dc060af Mon Sep 17 00:00:00 2001 +From 6455a8201fab45194413b326aecc1d764033db0b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Apr 2019 18:02:19 +0200 Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile @@ -31,5 +31,5 @@ index 819ca4a459c42..a685b6bbcd7dc 100755 FPE USR1 SEGV USR2 PIPE ALRM TERM -- -2.21.0 +2.24.1 diff --git a/0002-Fix-DEBUG-build.patch b/0002-Fix-DEBUG-build.patch new file mode 100644 index 0000000..f95306b --- /dev/null +++ b/0002-Fix-DEBUG-build.patch @@ -0,0 +1,33 @@ +From a7eb134ce97d873c0fe5d30ac1ddce447aba576c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Dec 2019 09:36:59 +0100 +Subject: [PATCH] Fix DEBUG build + +Fixed commit missed to update this conditional call to +nft_rule_print_save(). + +Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d) +Signed-off-by: Phil Sutter +--- + iptables/nft-shared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 78e422781723f..426765641cff6 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data) + + DEBUGP("comparing with... "); + #ifdef DEBUG_DEL +- nft_rule_print_save(r, NFT_RULE_APPEND, 0); ++ nft_rule_print_save(h, r, NFT_RULE_APPEND, 0); + #endif + if (!h->ops->is_same(cs, &this)) + goto out; +-- +2.24.1 + diff --git a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch new file mode 100644 index 0000000..85a760b --- /dev/null +++ b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch @@ -0,0 +1,59 @@ +From f587011318fd47b18d0f0174b6594485a546ca8f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Dec 2019 09:56:06 +0100 +Subject: [PATCH] xtables-restore: Fix parser feed from line buffer + +When called with --noflush, xtables-restore would trip over chain lines: +Parser uses strtok() to separate chain name, policy and counters which +inserts nul-chars into the source string. Therefore strlen() can't be +used anymore to find end of line. Fix this by caching line length before +calling xtables_restore_parse_line(). + +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c) +Signed-off-by: Phil Sutter +--- + .../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++ + iptables/xtables-restore.c | 4 +++- + 2 files changed, 13 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +new file mode 100755 +index 0000000000000..739e684a21183 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +@@ -0,0 +1,10 @@ ++#!/bin/sh -e ++ ++# assert input feed from buffer doesn't trip over ++# added nul-chars from parsing chain line. ++ ++$XT_MULTI iptables-restore --noflush <error.lineno = ++line; + DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr); + xtables_restore_parse_line(h, p, &state, ptr); +- ptr += strlen(ptr) + 1; ++ ptr += len + 1; + } + if (*buffer) { + h->error.lineno = ++line; +-- +2.24.1 + diff --git a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch new file mode 100644 index 0000000..d640ab6 --- /dev/null +++ b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch @@ -0,0 +1,31 @@ +From 79aea9da9108323922dce0820d362c23619371f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 11:40:26 +0100 +Subject: [PATCH] xtables-restore: Avoid access of uninitialized data + +When flushing, 'buffer' is not written to prior to checking its first +byte's value. Therefore it needs to be initialized upon declaration. + +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08) +Signed-off-by: Phil Sutter +--- + iptables/xtables-restore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c +index dd907e0b8ddd5..63cc15cee9621 100644 +--- a/iptables/xtables-restore.c ++++ b/iptables/xtables-restore.c +@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h, + const struct nft_xt_restore_parse *p) + { + struct nft_xt_restore_state state = {}; +- char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr; ++ char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr; + + if (!h->noflush) { + nft_fake_cache(h); +-- +2.24.1 + diff --git a/0005-extensions-time-Avoid-undefined-shift.patch b/0005-extensions-time-Avoid-undefined-shift.patch new file mode 100644 index 0000000..8af492d --- /dev/null +++ b/0005-extensions-time-Avoid-undefined-shift.patch @@ -0,0 +1,31 @@ +From cf6d2d3892f62d60fa029a94867a99e87e2ab175 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:15:01 +0100 +Subject: [PATCH] extensions: time: Avoid undefined shift + +Value 1 is signed by default and left-shifting by 31 is undefined for +those. Fix this by marking the value as unsigned. + +Fixes: ad326ef9f734a ("Add the libxt_time iptables match") +(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b) +Signed-off-by: Phil Sutter +--- + extensions/libxt_time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c +index 5a8cc5de13031..d001f5b7f448f 100644 +--- a/extensions/libxt_time.c ++++ b/extensions/libxt_time.c +@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable) + + printf(" "); + for (i = 1; i <= 31; ++i) +- if (mask & (1 << i)) { ++ if (mask & (1u << i)) { + if (nbdays++ > 0) + printf(","); + printf("%u", i); +-- +2.24.1 + diff --git a/0006-extensions-cluster-Avoid-undefined-shift.patch b/0006-extensions-cluster-Avoid-undefined-shift.patch new file mode 100644 index 0000000..f9c429f --- /dev/null +++ b/0006-extensions-cluster-Avoid-undefined-shift.patch @@ -0,0 +1,31 @@ +From adfa4a0a95d26b7aaae0c1754f77a863bcd05120 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:36:31 +0100 +Subject: [PATCH] extensions: cluster: Avoid undefined shift + +Value 1 is signed by default and left-shifting by 31 is undefined for +those. Fix this by marking the value as unsigned. + +Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft") +(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694) +Signed-off-by: Phil Sutter +--- + extensions/libxt_cluster.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c +index c9c35ee22e3df..d164bf6960166 100644 +--- a/extensions/libxt_cluster.c ++++ b/extensions/libxt_cluster.c +@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl, + xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st, + info->total_nodes, info->hash_seed); + for (node = 0; node < 32; node++) { +- if (info->node_mask & (1 << node)) { ++ if (info->node_mask & (1u << node)) { + if (needs_set == 0) { + xt_xlate_add(xl, "{ "); + needs_set = 1; +-- +2.24.1 + diff --git a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch new file mode 100644 index 0000000..cfc0235 --- /dev/null +++ b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch @@ -0,0 +1,40 @@ +From 24e3defb866ecd391ee92417129df96402e1867c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 16:01:29 +0100 +Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname() + +The function potentially fed overlong strings to strcpy(). Given that +everything needed to avoid this is there, reorder code a bit to prevent +those inputs, too. + +Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft") +(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652) +Signed-off-by: Phil Sutter +--- + iptables/xtables-translate.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index a42c60a3b64c6..77a186b905d73 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -32,14 +32,13 @@ + void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert) + { ++ int ifaclen = strlen(ifname); + char iface[IFNAMSIZ]; +- int ifaclen; + +- if (ifname[0] == '\0') ++ if (ifaclen < 1 || ifaclen >= IFNAMSIZ) + return; + + strcpy(iface, ifname); +- ifaclen = strlen(iface); + if (iface[ifaclen - 1] == '+') + iface[ifaclen - 1] = '*'; + +-- +2.24.1 + diff --git a/0008-extensions-among-Check-call-to-fstat.patch b/0008-extensions-among-Check-call-to-fstat.patch new file mode 100644 index 0000000..ca84456 --- /dev/null +++ b/0008-extensions-among-Check-call-to-fstat.patch @@ -0,0 +1,41 @@ +From 10b51ba86b63a4d7afa208ea206c7c9872bc6e0a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 16:35:51 +0100 +Subject: [PATCH] extensions: among: Check call to fstat() + +If this fails, a bogus length value may be passed to mmap(). + +Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") +(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968) +Signed-off-by: Phil Sutter +--- + extensions/libebt_among.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c +index 2e87db3bc06fa..715d559f432c2 100644 +--- a/extensions/libebt_among.c ++++ b/extensions/libebt_among.c +@@ -6,6 +6,7 @@ + * August, 2003 + */ + ++#include + #include + #include + #include +@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert, + if ((fd = open(optarg, O_RDONLY)) == -1) + xtables_error(PARAMETER_PROBLEM, + "Couldn't open file '%s'", optarg); +- fstat(fd, &stats); ++ if (fstat(fd, &stats) < 0) ++ xtables_error(PARAMETER_PROBLEM, ++ "fstat(%s) failed: '%s'", ++ optarg, strerror(errno)); + flen = stats.st_size; + /* use mmap because the file will probably be big */ + optarg = mmap(0, flen, PROT_READ | PROT_WRITE, +-- +2.24.1 + diff --git a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch new file mode 100644 index 0000000..aca04fa --- /dev/null +++ b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch @@ -0,0 +1,78 @@ +From 17b62e149147f05d419103dbbde9dca361c2bd5d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 11 Feb 2020 16:52:59 +0100 +Subject: [PATCH] xtables-restore: fix for --noflush and empty lines + +Lookahead buffer used for cache requirements estimate in restore +--noflush separates individual lines with nul-chars. Two consecutive +nul-chars are interpreted as end of buffer and remaining buffer content +is skipped. + +Sadly, reading an empty line (i.e., one containing a newline character +only) caused double nul-chars to appear in buffer as well, leading to +premature stop when reading cached lines from buffer. + +To fix that, make use of xtables_restore_parse_line() skipping empty +lines without calling strtok() and just leave the newline character in +place. A more intuitive approach, namely skipping empty lines while +buffering, is deliberately not chosen as that would cause wrong values +in 'line' variable. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400 +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +Signed-off-by: Phil Sutter +Acked-by: Arturo Borrero Gonzalez +(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29) +Signed-off-by: Phil Sutter +--- + .../ipt-restore/0011-noflush-empty-line_0 | 16 ++++++++++++++++ + iptables/xtables-restore.c | 8 +++++--- + 2 files changed, 21 insertions(+), 3 deletions(-) + create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 +new file mode 100755 +index 0000000000000..bea1a690bb624 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 +@@ -0,0 +1,16 @@ ++#!/bin/bash -e ++ ++# make sure empty lines won't break --noflush ++ ++cat <in)) { + size_t blen = strlen(buffer); + +- /* drop trailing newline; xtables_restore_parse_line() ++ /* Drop trailing newline; xtables_restore_parse_line() + * uses strtok() which replaces them by nul-characters, + * causing unpredictable string delimiting in +- * preload_buffer */ +- if (buffer[blen - 1] == '\n') ++ * preload_buffer. ++ * Unless this is an empty line which would fold into a ++ * spurious EoB indicator (double nul-char). */ ++ if (buffer[blen - 1] == '\n' && blen > 1) + buffer[blen - 1] = '\0'; + else + blen++; +-- +2.24.1 + diff --git a/iptables.spec b/iptables.spec index caa83bc..b6c3780 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -33,6 +33,15 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +Patch2: 0002-Fix-DEBUG-build.patch +Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch +Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch +Patch5: 0005-extensions-time-Avoid-undefined-shift.patch +Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch +Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch +Patch8: 0008-extensions-among-Check-call-to-fstat.patch +Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPLv2 and Artistic Licence 2.0 and ISC @@ -119,7 +128,7 @@ a bytecode generator for use with xt_bpf. %package nft Summary: nftables compatibility for iptables, arptables and ebtables -Requires: %{name} = %{version}-%{release} +Requires: %{name}-libs%{?_isa} = %{version}-%{release} Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -350,12 +359,6 @@ fi %{_mandir}/man8/iptables* %{_mandir}/man8/ip6tables* %{_mandir}/man8/xtables-legacy* -%dir %{_libdir}/xtables -%{_libdir}/xtables/libarpt* -%{_libdir}/xtables/libebt* -%{_libdir}/xtables/libipt* -%{_libdir}/xtables/libip6t* -%{_libdir}/xtables/libxt* %ghost %{_sbindir}/iptables %ghost %{_sbindir}/iptables-restore %ghost %{_sbindir}/iptables-save @@ -370,6 +373,10 @@ fi %{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}* %endif %{_libdir}/libxtables.so.12* +%dir %{_libdir}/xtables +%{_libdir}/xtables/libipt* +%{_libdir}/xtables/libip6t* +%{_libdir}/xtables/libxt* %files devel %dir %{_includedir}/iptables @@ -422,6 +429,9 @@ fi %{_sbindir}/arptables-nft* %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor +%dir %{_libdir}/xtables +%{_libdir}/xtables/libarpt* +%{_libdir}/xtables/libebt* %{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* @@ -446,6 +456,12 @@ fi %changelog +* Wed Feb 12 2020 Phil Sutter - 1.8.4-7 +- Move nft-specific extensions into iptables-nft package +- Move remaining extensions into iptables-libs package +- Make iptables-nft depend on iptables-libs instead of iptables +- Add upstream-suggested fixes + * Wed Jan 29 2020 Fedora Release Engineering - 1.8.4-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 7ceca608476e15f0594fbdbd02be8b95ac98bea4 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Jun 2020 12:01:10 +0200 Subject: [PATCH 2/5] iptables-1.8.5-1 - Rebase onto upstream version 1.8.5 plus two late fixes - Drop explicit iptables-apply installation, upstream fixed that - Ship ip6tables-apply along with iptables package --- .gitignore | 1 + ...iptables-apply-not-getting-installed.patch | 42 ++++++++++ ...apply-Use-mktemp-instead-of-tempfile.patch | 35 --------- 0002-Fix-DEBUG-build.patch | 33 -------- ...ate-don-t-fail-if-help-was-requested.patch | 58 ++++++++++++++ ...ore-Fix-parser-feed-from-line-buffer.patch | 59 -------------- ...e-Avoid-access-of-uninitialized-data.patch | 31 -------- ...xtensions-time-Avoid-undefined-shift.patch | 31 -------- ...nsions-cluster-Avoid-undefined-shift.patch | 31 -------- ...te-Guard-strcpy-call-in-xlate_ifname.patch | 40 ---------- ...extensions-among-Check-call-to-fstat.patch | 41 ---------- ...tore-fix-for-noflush-and-empty-lines.patch | 78 ------------------- iptables.spec | 25 +++--- sources | 2 +- 14 files changed, 112 insertions(+), 395 deletions(-) create mode 100644 0001-build-resolve-iptables-apply-not-getting-installed.patch delete mode 100644 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch delete mode 100644 0002-Fix-DEBUG-build.patch create mode 100644 0002-xtables-translate-don-t-fail-if-help-was-requested.patch delete mode 100644 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch delete mode 100644 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch delete mode 100644 0005-extensions-time-Avoid-undefined-shift.patch delete mode 100644 0006-extensions-cluster-Avoid-undefined-shift.patch delete mode 100644 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch delete mode 100644 0008-extensions-among-Check-call-to-fstat.patch delete mode 100644 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch diff --git a/.gitignore b/.gitignore index 55b0b32..ae4c970 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /iptables-1.8.2.tar.bz2 /iptables-1.8.3.tar.bz2 /iptables-1.8.4.tar.bz2 +/iptables-1.8.5.tar.bz2 diff --git a/0001-build-resolve-iptables-apply-not-getting-installed.patch b/0001-build-resolve-iptables-apply-not-getting-installed.patch new file mode 100644 index 0000000..26e08db --- /dev/null +++ b/0001-build-resolve-iptables-apply-not-getting-installed.patch @@ -0,0 +1,42 @@ +From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001 +From: Jan Engelhardt +Date: Wed, 3 Jun 2020 15:38:48 +0200 +Subject: [PATCH] build: resolve iptables-apply not getting installed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +ip6tables-apply gets installed but iptables-apply does not. +That is wrong. + +» make install DESTDIR=$PWD/r +» find r -name "*app*" +r/usr/local/sbin/ip6tables-apply +r/usr/local/share/man/man8/iptables-apply.8 +r/usr/local/share/man/man8/ip6tables-apply.8 + +Fixes: v1.8.5~87 +Signed-off-by: Jan Engelhardt +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b) +Signed-off-by: Phil Sutter +--- + iptables/Makefile.am | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/Makefile.am b/iptables/Makefile.am +index dc66b3cc09c08..2024dbf5cb88c 100644 +--- a/iptables/Makefile.am ++++ b/iptables/Makefile.am +@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ + ip6tables-save.8 iptables-extensions.8 \ + iptables-apply.8 ip6tables-apply.8 + +-sbin_SCRIPT = iptables-apply ++sbin_SCRIPTS = iptables-apply + + if ENABLE_NFTABLES + man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ +-- +2.27.0 + diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch deleted file mode 100644 index 970370d..0000000 --- a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 6455a8201fab45194413b326aecc1d764033db0b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 12 Apr 2019 18:02:19 +0200 -Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile - -Signed-off-by: Phil Sutter ---- - iptables/iptables-apply | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-apply b/iptables/iptables-apply -index 819ca4a459c42..a685b6bbcd7dc 100755 ---- a/iptables/iptables-apply -+++ b/iptables/iptables-apply -@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then - exit 2 - fi - --COMMANDS=(tempfile "$SAVE" "$RESTORE") -+COMMANDS=(mktemp "$SAVE" "$RESTORE") - - for cmd in "${COMMANDS[@]}"; do - if ! command -v $cmd >/dev/null; then -@@ -122,7 +122,7 @@ done - - umask 0700 - --TMPFILE=$(tempfile -p iptap) -+TMPFILE=$(mktemp) - trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \ - FPE USR1 SEGV USR2 PIPE ALRM TERM - --- -2.24.1 - diff --git a/0002-Fix-DEBUG-build.patch b/0002-Fix-DEBUG-build.patch deleted file mode 100644 index f95306b..0000000 --- a/0002-Fix-DEBUG-build.patch +++ /dev/null @@ -1,33 +0,0 @@ -From a7eb134ce97d873c0fe5d30ac1ddce447aba576c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 4 Dec 2019 09:36:59 +0100 -Subject: [PATCH] Fix DEBUG build - -Fixed commit missed to update this conditional call to -nft_rule_print_save(). - -Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback") -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d) -Signed-off-by: Phil Sutter ---- - iptables/nft-shared.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 78e422781723f..426765641cff6 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data) - - DEBUGP("comparing with... "); - #ifdef DEBUG_DEL -- nft_rule_print_save(r, NFT_RULE_APPEND, 0); -+ nft_rule_print_save(h, r, NFT_RULE_APPEND, 0); - #endif - if (!h->ops->is_same(cs, &this)) - goto out; --- -2.24.1 - diff --git a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch new file mode 100644 index 0000000..4fcb549 --- /dev/null +++ b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch @@ -0,0 +1,58 @@ +From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001 +From: Arturo Borrero Gonzalez +Date: Tue, 16 Jun 2020 11:20:42 +0200 +Subject: [PATCH] xtables-translate: don't fail if help was requested + +If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle +this case in do_command_xlate(). + +Before this patch, you would see: + + user@debian:~$ sudo iptables-translate -h + [..] + nft Unsupported command? + user@debian:~$ echo $? + 1 + +After this patch: + + user@debian:~$ sudo iptables-translate -h + [..] + user@debian:~$ echo $? + 0 + +Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") +Acked-by: Phil Sutter +Signed-off-by: Arturo Borrero Gonzalez +(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069) +Signed-off-by: Phil Sutter +--- + iptables/xtables-translate.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 5aa42496b5a48..363c8be15b3fa 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + + cs.restore = restore; + +- if (!restore) ++ if (!restore && p.command != CMD_NONE) + printf("nft "); + + switch (p.command) { +@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + break; + case CMD_SET_POLICY: + break; ++ case CMD_NONE: ++ ret = 1; ++ break; + default: + /* We should never reach this... */ + printf("Unsupported command?\n"); +-- +2.27.0 + diff --git a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch deleted file mode 100644 index 85a760b..0000000 --- a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch +++ /dev/null @@ -1,59 +0,0 @@ -From f587011318fd47b18d0f0174b6594485a546ca8f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 4 Dec 2019 09:56:06 +0100 -Subject: [PATCH] xtables-restore: Fix parser feed from line buffer - -When called with --noflush, xtables-restore would trip over chain lines: -Parser uses strtok() to separate chain name, policy and counters which -inserts nul-chars into the source string. Therefore strlen() can't be -used anymore to find end of line. Fix this by caching line length before -calling xtables_restore_parse_line(). - -Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") -Signed-off-by: Phil Sutter -Acked-by: Pablo Neira Ayuso -(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c) -Signed-off-by: Phil Sutter ---- - .../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++ - iptables/xtables-restore.c | 4 +++- - 2 files changed, 13 insertions(+), 1 deletion(-) - create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 - -diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 -new file mode 100755 -index 0000000000000..739e684a21183 ---- /dev/null -+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 -@@ -0,0 +1,10 @@ -+#!/bin/sh -e -+ -+# assert input feed from buffer doesn't trip over -+# added nul-chars from parsing chain line. -+ -+$XT_MULTI iptables-restore --noflush <error.lineno = ++line; - DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr); - xtables_restore_parse_line(h, p, &state, ptr); -- ptr += strlen(ptr) + 1; -+ ptr += len + 1; - } - if (*buffer) { - h->error.lineno = ++line; --- -2.24.1 - diff --git a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch deleted file mode 100644 index d640ab6..0000000 --- a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 79aea9da9108323922dce0820d362c23619371f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 11:40:26 +0100 -Subject: [PATCH] xtables-restore: Avoid access of uninitialized data - -When flushing, 'buffer' is not written to prior to checking its first -byte's value. Therefore it needs to be initialized upon declaration. - -Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") -(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08) -Signed-off-by: Phil Sutter ---- - iptables/xtables-restore.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c -index dd907e0b8ddd5..63cc15cee9621 100644 ---- a/iptables/xtables-restore.c -+++ b/iptables/xtables-restore.c -@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h, - const struct nft_xt_restore_parse *p) - { - struct nft_xt_restore_state state = {}; -- char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr; -+ char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr; - - if (!h->noflush) { - nft_fake_cache(h); --- -2.24.1 - diff --git a/0005-extensions-time-Avoid-undefined-shift.patch b/0005-extensions-time-Avoid-undefined-shift.patch deleted file mode 100644 index 8af492d..0000000 --- a/0005-extensions-time-Avoid-undefined-shift.patch +++ /dev/null @@ -1,31 +0,0 @@ -From cf6d2d3892f62d60fa029a94867a99e87e2ab175 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 13:15:01 +0100 -Subject: [PATCH] extensions: time: Avoid undefined shift - -Value 1 is signed by default and left-shifting by 31 is undefined for -those. Fix this by marking the value as unsigned. - -Fixes: ad326ef9f734a ("Add the libxt_time iptables match") -(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b) -Signed-off-by: Phil Sutter ---- - extensions/libxt_time.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c -index 5a8cc5de13031..d001f5b7f448f 100644 ---- a/extensions/libxt_time.c -+++ b/extensions/libxt_time.c -@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable) - - printf(" "); - for (i = 1; i <= 31; ++i) -- if (mask & (1 << i)) { -+ if (mask & (1u << i)) { - if (nbdays++ > 0) - printf(","); - printf("%u", i); --- -2.24.1 - diff --git a/0006-extensions-cluster-Avoid-undefined-shift.patch b/0006-extensions-cluster-Avoid-undefined-shift.patch deleted file mode 100644 index f9c429f..0000000 --- a/0006-extensions-cluster-Avoid-undefined-shift.patch +++ /dev/null @@ -1,31 +0,0 @@ -From adfa4a0a95d26b7aaae0c1754f77a863bcd05120 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 13:36:31 +0100 -Subject: [PATCH] extensions: cluster: Avoid undefined shift - -Value 1 is signed by default and left-shifting by 31 is undefined for -those. Fix this by marking the value as unsigned. - -Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft") -(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694) -Signed-off-by: Phil Sutter ---- - extensions/libxt_cluster.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c -index c9c35ee22e3df..d164bf6960166 100644 ---- a/extensions/libxt_cluster.c -+++ b/extensions/libxt_cluster.c -@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl, - xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st, - info->total_nodes, info->hash_seed); - for (node = 0; node < 32; node++) { -- if (info->node_mask & (1 << node)) { -+ if (info->node_mask & (1u << node)) { - if (needs_set == 0) { - xt_xlate_add(xl, "{ "); - needs_set = 1; --- -2.24.1 - diff --git a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch deleted file mode 100644 index cfc0235..0000000 --- a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 24e3defb866ecd391ee92417129df96402e1867c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 16:01:29 +0100 -Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname() - -The function potentially fed overlong strings to strcpy(). Given that -everything needed to avoid this is there, reorder code a bit to prevent -those inputs, too. - -Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft") -(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652) -Signed-off-by: Phil Sutter ---- - iptables/xtables-translate.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index a42c60a3b64c6..77a186b905d73 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -32,14 +32,13 @@ - void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, - bool invert) - { -+ int ifaclen = strlen(ifname); - char iface[IFNAMSIZ]; -- int ifaclen; - -- if (ifname[0] == '\0') -+ if (ifaclen < 1 || ifaclen >= IFNAMSIZ) - return; - - strcpy(iface, ifname); -- ifaclen = strlen(iface); - if (iface[ifaclen - 1] == '+') - iface[ifaclen - 1] = '*'; - --- -2.24.1 - diff --git a/0008-extensions-among-Check-call-to-fstat.patch b/0008-extensions-among-Check-call-to-fstat.patch deleted file mode 100644 index ca84456..0000000 --- a/0008-extensions-among-Check-call-to-fstat.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 10b51ba86b63a4d7afa208ea206c7c9872bc6e0a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 5 Dec 2019 16:35:51 +0100 -Subject: [PATCH] extensions: among: Check call to fstat() - -If this fails, a bogus length value may be passed to mmap(). - -Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") -(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968) -Signed-off-by: Phil Sutter ---- - extensions/libebt_among.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c -index 2e87db3bc06fa..715d559f432c2 100644 ---- a/extensions/libebt_among.c -+++ b/extensions/libebt_among.c -@@ -6,6 +6,7 @@ - * August, 2003 - */ - -+#include - #include - #include - #include -@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert, - if ((fd = open(optarg, O_RDONLY)) == -1) - xtables_error(PARAMETER_PROBLEM, - "Couldn't open file '%s'", optarg); -- fstat(fd, &stats); -+ if (fstat(fd, &stats) < 0) -+ xtables_error(PARAMETER_PROBLEM, -+ "fstat(%s) failed: '%s'", -+ optarg, strerror(errno)); - flen = stats.st_size; - /* use mmap because the file will probably be big */ - optarg = mmap(0, flen, PROT_READ | PROT_WRITE, --- -2.24.1 - diff --git a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch deleted file mode 100644 index aca04fa..0000000 --- a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 17b62e149147f05d419103dbbde9dca361c2bd5d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 11 Feb 2020 16:52:59 +0100 -Subject: [PATCH] xtables-restore: fix for --noflush and empty lines - -Lookahead buffer used for cache requirements estimate in restore ---noflush separates individual lines with nul-chars. Two consecutive -nul-chars are interpreted as end of buffer and remaining buffer content -is skipped. - -Sadly, reading an empty line (i.e., one containing a newline character -only) caused double nul-chars to appear in buffer as well, leading to -premature stop when reading cached lines from buffer. - -To fix that, make use of xtables_restore_parse_line() skipping empty -lines without calling strtok() and just leave the newline character in -place. A more intuitive approach, namely skipping empty lines while -buffering, is deliberately not chosen as that would cause wrong values -in 'line' variable. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400 -Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") -Signed-off-by: Phil Sutter -Acked-by: Arturo Borrero Gonzalez -(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29) -Signed-off-by: Phil Sutter ---- - .../ipt-restore/0011-noflush-empty-line_0 | 16 ++++++++++++++++ - iptables/xtables-restore.c | 8 +++++--- - 2 files changed, 21 insertions(+), 3 deletions(-) - create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 - -diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 -new file mode 100755 -index 0000000000000..bea1a690bb624 ---- /dev/null -+++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 -@@ -0,0 +1,16 @@ -+#!/bin/bash -e -+ -+# make sure empty lines won't break --noflush -+ -+cat <in)) { - size_t blen = strlen(buffer); - -- /* drop trailing newline; xtables_restore_parse_line() -+ /* Drop trailing newline; xtables_restore_parse_line() - * uses strtok() which replaces them by nul-characters, - * causing unpredictable string delimiting in -- * preload_buffer */ -- if (buffer[blen - 1] == '\n') -+ * preload_buffer. -+ * Unless this is an empty line which would fold into a -+ * spurious EoB indicator (double nul-char). */ -+ if (buffer[blen - 1] == '\n' && blen > 1) - buffer[blen - 1] = '\0'; - else - blen++; --- -2.24.1 - diff --git a/iptables.spec b/iptables.spec index b6c3780..638aecd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.4 -Release: 7%{?dist} +Version: 1.8.5 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,15 +32,8 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch -Patch2: 0002-Fix-DEBUG-build.patch -Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch -Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch -Patch5: 0005-extensions-time-Avoid-undefined-shift.patch -Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch -Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch -Patch8: 0008-extensions-among-Check-call-to-fstat.patch -Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch +Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch +Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -238,10 +231,6 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic -# install iptables-apply with man page -install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/ -install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/ - %if 0%{?fedora} > 24 # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes @@ -351,6 +340,7 @@ fi %{_sysconfdir}/ethertypes %endif %{_sbindir}/iptables-apply +%{_sbindir}/ip6tables-apply %{_sbindir}/iptables-legacy* %{_sbindir}/ip6tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -456,6 +446,11 @@ fi %changelog +* Tue Jun 23 2020 Phil Sutter - 1.8.5-1 +- Rebase onto upstream version 1.8.5 plus two late fixes +- Drop explicit iptables-apply installation, upstream fixed that +- Ship ip6tables-apply along with iptables package + * Wed Feb 12 2020 Phil Sutter - 1.8.4-7 - Move nft-specific extensions into iptables-nft package - Move remaining extensions into iptables-libs package diff --git a/sources b/sources index 34b13bd..a7e9f94 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.4.tar.bz2) = a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb +SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8 From 2a5e6415c70d9cebdb6444ea779a7f057d03dbad Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Jun 2020 16:25:28 +0200 Subject: [PATCH 3/5] Revert "iptables-1.8.5-1" This reverts commit 7ceca608476e15f0594fbdbd02be8b95ac98bea4. Required libnftnl version is not available in f32. --- .gitignore | 1 - ...iptables-apply-not-getting-installed.patch | 42 ---------- ...apply-Use-mktemp-instead-of-tempfile.patch | 35 +++++++++ 0002-Fix-DEBUG-build.patch | 33 ++++++++ ...ate-don-t-fail-if-help-was-requested.patch | 58 -------------- ...ore-Fix-parser-feed-from-line-buffer.patch | 59 ++++++++++++++ ...e-Avoid-access-of-uninitialized-data.patch | 31 ++++++++ ...xtensions-time-Avoid-undefined-shift.patch | 31 ++++++++ ...nsions-cluster-Avoid-undefined-shift.patch | 31 ++++++++ ...te-Guard-strcpy-call-in-xlate_ifname.patch | 40 ++++++++++ ...extensions-among-Check-call-to-fstat.patch | 41 ++++++++++ ...tore-fix-for-noflush-and-empty-lines.patch | 78 +++++++++++++++++++ iptables.spec | 25 +++--- sources | 2 +- 14 files changed, 395 insertions(+), 112 deletions(-) delete mode 100644 0001-build-resolve-iptables-apply-not-getting-installed.patch create mode 100644 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch create mode 100644 0002-Fix-DEBUG-build.patch delete mode 100644 0002-xtables-translate-don-t-fail-if-help-was-requested.patch create mode 100644 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch create mode 100644 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch create mode 100644 0005-extensions-time-Avoid-undefined-shift.patch create mode 100644 0006-extensions-cluster-Avoid-undefined-shift.patch create mode 100644 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch create mode 100644 0008-extensions-among-Check-call-to-fstat.patch create mode 100644 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch diff --git a/.gitignore b/.gitignore index ae4c970..55b0b32 100644 --- a/.gitignore +++ b/.gitignore @@ -3,4 +3,3 @@ /iptables-1.8.2.tar.bz2 /iptables-1.8.3.tar.bz2 /iptables-1.8.4.tar.bz2 -/iptables-1.8.5.tar.bz2 diff --git a/0001-build-resolve-iptables-apply-not-getting-installed.patch b/0001-build-resolve-iptables-apply-not-getting-installed.patch deleted file mode 100644 index 26e08db..0000000 --- a/0001-build-resolve-iptables-apply-not-getting-installed.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001 -From: Jan Engelhardt -Date: Wed, 3 Jun 2020 15:38:48 +0200 -Subject: [PATCH] build: resolve iptables-apply not getting installed -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -ip6tables-apply gets installed but iptables-apply does not. -That is wrong. - -» make install DESTDIR=$PWD/r -» find r -name "*app*" -r/usr/local/sbin/ip6tables-apply -r/usr/local/share/man/man8/iptables-apply.8 -r/usr/local/share/man/man8/ip6tables-apply.8 - -Fixes: v1.8.5~87 -Signed-off-by: Jan Engelhardt -Signed-off-by: Pablo Neira Ayuso -(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b) -Signed-off-by: Phil Sutter ---- - iptables/Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/Makefile.am b/iptables/Makefile.am -index dc66b3cc09c08..2024dbf5cb88c 100644 ---- a/iptables/Makefile.am -+++ b/iptables/Makefile.am -@@ -56,7 +56,7 @@ man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ - ip6tables-save.8 iptables-extensions.8 \ - iptables-apply.8 ip6tables-apply.8 - --sbin_SCRIPT = iptables-apply -+sbin_SCRIPTS = iptables-apply - - if ENABLE_NFTABLES - man_MANS += xtables-nft.8 xtables-translate.8 xtables-legacy.8 \ --- -2.27.0 - diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch new file mode 100644 index 0000000..970370d --- /dev/null +++ b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch @@ -0,0 +1,35 @@ +From 6455a8201fab45194413b326aecc1d764033db0b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 12 Apr 2019 18:02:19 +0200 +Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile + +Signed-off-by: Phil Sutter +--- + iptables/iptables-apply | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-apply b/iptables/iptables-apply +index 819ca4a459c42..a685b6bbcd7dc 100755 +--- a/iptables/iptables-apply ++++ b/iptables/iptables-apply +@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then + exit 2 + fi + +-COMMANDS=(tempfile "$SAVE" "$RESTORE") ++COMMANDS=(mktemp "$SAVE" "$RESTORE") + + for cmd in "${COMMANDS[@]}"; do + if ! command -v $cmd >/dev/null; then +@@ -122,7 +122,7 @@ done + + umask 0700 + +-TMPFILE=$(tempfile -p iptap) ++TMPFILE=$(mktemp) + trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \ + FPE USR1 SEGV USR2 PIPE ALRM TERM + +-- +2.24.1 + diff --git a/0002-Fix-DEBUG-build.patch b/0002-Fix-DEBUG-build.patch new file mode 100644 index 0000000..f95306b --- /dev/null +++ b/0002-Fix-DEBUG-build.patch @@ -0,0 +1,33 @@ +From a7eb134ce97d873c0fe5d30ac1ddce447aba576c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Dec 2019 09:36:59 +0100 +Subject: [PATCH] Fix DEBUG build + +Fixed commit missed to update this conditional call to +nft_rule_print_save(). + +Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d) +Signed-off-by: Phil Sutter +--- + iptables/nft-shared.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 78e422781723f..426765641cff6 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data) + + DEBUGP("comparing with... "); + #ifdef DEBUG_DEL +- nft_rule_print_save(r, NFT_RULE_APPEND, 0); ++ nft_rule_print_save(h, r, NFT_RULE_APPEND, 0); + #endif + if (!h->ops->is_same(cs, &this)) + goto out; +-- +2.24.1 + diff --git a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch deleted file mode 100644 index 4fcb549..0000000 --- a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001 -From: Arturo Borrero Gonzalez -Date: Tue, 16 Jun 2020 11:20:42 +0200 -Subject: [PATCH] xtables-translate: don't fail if help was requested - -If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle -this case in do_command_xlate(). - -Before this patch, you would see: - - user@debian:~$ sudo iptables-translate -h - [..] - nft Unsupported command? - user@debian:~$ echo $? - 1 - -After this patch: - - user@debian:~$ sudo iptables-translate -h - [..] - user@debian:~$ echo $? - 0 - -Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts") -Acked-by: Phil Sutter -Signed-off-by: Arturo Borrero Gonzalez -(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069) -Signed-off-by: Phil Sutter ---- - iptables/xtables-translate.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 5aa42496b5a48..363c8be15b3fa 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - - cs.restore = restore; - -- if (!restore) -+ if (!restore && p.command != CMD_NONE) - printf("nft "); - - switch (p.command) { -@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - break; - case CMD_SET_POLICY: - break; -+ case CMD_NONE: -+ ret = 1; -+ break; - default: - /* We should never reach this... */ - printf("Unsupported command?\n"); --- -2.27.0 - diff --git a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch new file mode 100644 index 0000000..85a760b --- /dev/null +++ b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch @@ -0,0 +1,59 @@ +From f587011318fd47b18d0f0174b6594485a546ca8f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Dec 2019 09:56:06 +0100 +Subject: [PATCH] xtables-restore: Fix parser feed from line buffer + +When called with --noflush, xtables-restore would trip over chain lines: +Parser uses strtok() to separate chain name, policy and counters which +inserts nul-chars into the source string. Therefore strlen() can't be +used anymore to find end of line. Fix this by caching line length before +calling xtables_restore_parse_line(). + +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c) +Signed-off-by: Phil Sutter +--- + .../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++ + iptables/xtables-restore.c | 4 +++- + 2 files changed, 13 insertions(+), 1 deletion(-) + create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +new file mode 100755 +index 0000000000000..739e684a21183 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +@@ -0,0 +1,10 @@ ++#!/bin/sh -e ++ ++# assert input feed from buffer doesn't trip over ++# added nul-chars from parsing chain line. ++ ++$XT_MULTI iptables-restore --noflush <error.lineno = ++line; + DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr); + xtables_restore_parse_line(h, p, &state, ptr); +- ptr += strlen(ptr) + 1; ++ ptr += len + 1; + } + if (*buffer) { + h->error.lineno = ++line; +-- +2.24.1 + diff --git a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch new file mode 100644 index 0000000..d640ab6 --- /dev/null +++ b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch @@ -0,0 +1,31 @@ +From 79aea9da9108323922dce0820d362c23619371f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 11:40:26 +0100 +Subject: [PATCH] xtables-restore: Avoid access of uninitialized data + +When flushing, 'buffer' is not written to prior to checking its first +byte's value. Therefore it needs to be initialized upon declaration. + +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08) +Signed-off-by: Phil Sutter +--- + iptables/xtables-restore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c +index dd907e0b8ddd5..63cc15cee9621 100644 +--- a/iptables/xtables-restore.c ++++ b/iptables/xtables-restore.c +@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h, + const struct nft_xt_restore_parse *p) + { + struct nft_xt_restore_state state = {}; +- char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr; ++ char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr; + + if (!h->noflush) { + nft_fake_cache(h); +-- +2.24.1 + diff --git a/0005-extensions-time-Avoid-undefined-shift.patch b/0005-extensions-time-Avoid-undefined-shift.patch new file mode 100644 index 0000000..8af492d --- /dev/null +++ b/0005-extensions-time-Avoid-undefined-shift.patch @@ -0,0 +1,31 @@ +From cf6d2d3892f62d60fa029a94867a99e87e2ab175 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:15:01 +0100 +Subject: [PATCH] extensions: time: Avoid undefined shift + +Value 1 is signed by default and left-shifting by 31 is undefined for +those. Fix this by marking the value as unsigned. + +Fixes: ad326ef9f734a ("Add the libxt_time iptables match") +(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b) +Signed-off-by: Phil Sutter +--- + extensions/libxt_time.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c +index 5a8cc5de13031..d001f5b7f448f 100644 +--- a/extensions/libxt_time.c ++++ b/extensions/libxt_time.c +@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable) + + printf(" "); + for (i = 1; i <= 31; ++i) +- if (mask & (1 << i)) { ++ if (mask & (1u << i)) { + if (nbdays++ > 0) + printf(","); + printf("%u", i); +-- +2.24.1 + diff --git a/0006-extensions-cluster-Avoid-undefined-shift.patch b/0006-extensions-cluster-Avoid-undefined-shift.patch new file mode 100644 index 0000000..f9c429f --- /dev/null +++ b/0006-extensions-cluster-Avoid-undefined-shift.patch @@ -0,0 +1,31 @@ +From adfa4a0a95d26b7aaae0c1754f77a863bcd05120 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:36:31 +0100 +Subject: [PATCH] extensions: cluster: Avoid undefined shift + +Value 1 is signed by default and left-shifting by 31 is undefined for +those. Fix this by marking the value as unsigned. + +Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft") +(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694) +Signed-off-by: Phil Sutter +--- + extensions/libxt_cluster.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c +index c9c35ee22e3df..d164bf6960166 100644 +--- a/extensions/libxt_cluster.c ++++ b/extensions/libxt_cluster.c +@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl, + xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st, + info->total_nodes, info->hash_seed); + for (node = 0; node < 32; node++) { +- if (info->node_mask & (1 << node)) { ++ if (info->node_mask & (1u << node)) { + if (needs_set == 0) { + xt_xlate_add(xl, "{ "); + needs_set = 1; +-- +2.24.1 + diff --git a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch new file mode 100644 index 0000000..cfc0235 --- /dev/null +++ b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch @@ -0,0 +1,40 @@ +From 24e3defb866ecd391ee92417129df96402e1867c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 16:01:29 +0100 +Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname() + +The function potentially fed overlong strings to strcpy(). Given that +everything needed to avoid this is there, reorder code a bit to prevent +those inputs, too. + +Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft") +(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652) +Signed-off-by: Phil Sutter +--- + iptables/xtables-translate.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index a42c60a3b64c6..77a186b905d73 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -32,14 +32,13 @@ + void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert) + { ++ int ifaclen = strlen(ifname); + char iface[IFNAMSIZ]; +- int ifaclen; + +- if (ifname[0] == '\0') ++ if (ifaclen < 1 || ifaclen >= IFNAMSIZ) + return; + + strcpy(iface, ifname); +- ifaclen = strlen(iface); + if (iface[ifaclen - 1] == '+') + iface[ifaclen - 1] = '*'; + +-- +2.24.1 + diff --git a/0008-extensions-among-Check-call-to-fstat.patch b/0008-extensions-among-Check-call-to-fstat.patch new file mode 100644 index 0000000..ca84456 --- /dev/null +++ b/0008-extensions-among-Check-call-to-fstat.patch @@ -0,0 +1,41 @@ +From 10b51ba86b63a4d7afa208ea206c7c9872bc6e0a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 16:35:51 +0100 +Subject: [PATCH] extensions: among: Check call to fstat() + +If this fails, a bogus length value may be passed to mmap(). + +Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") +(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968) +Signed-off-by: Phil Sutter +--- + extensions/libebt_among.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c +index 2e87db3bc06fa..715d559f432c2 100644 +--- a/extensions/libebt_among.c ++++ b/extensions/libebt_among.c +@@ -6,6 +6,7 @@ + * August, 2003 + */ + ++#include + #include + #include + #include +@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert, + if ((fd = open(optarg, O_RDONLY)) == -1) + xtables_error(PARAMETER_PROBLEM, + "Couldn't open file '%s'", optarg); +- fstat(fd, &stats); ++ if (fstat(fd, &stats) < 0) ++ xtables_error(PARAMETER_PROBLEM, ++ "fstat(%s) failed: '%s'", ++ optarg, strerror(errno)); + flen = stats.st_size; + /* use mmap because the file will probably be big */ + optarg = mmap(0, flen, PROT_READ | PROT_WRITE, +-- +2.24.1 + diff --git a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch new file mode 100644 index 0000000..aca04fa --- /dev/null +++ b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch @@ -0,0 +1,78 @@ +From 17b62e149147f05d419103dbbde9dca361c2bd5d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 11 Feb 2020 16:52:59 +0100 +Subject: [PATCH] xtables-restore: fix for --noflush and empty lines + +Lookahead buffer used for cache requirements estimate in restore +--noflush separates individual lines with nul-chars. Two consecutive +nul-chars are interpreted as end of buffer and remaining buffer content +is skipped. + +Sadly, reading an empty line (i.e., one containing a newline character +only) caused double nul-chars to appear in buffer as well, leading to +premature stop when reading cached lines from buffer. + +To fix that, make use of xtables_restore_parse_line() skipping empty +lines without calling strtok() and just leave the newline character in +place. A more intuitive approach, namely skipping empty lines while +buffering, is deliberately not chosen as that would cause wrong values +in 'line' variable. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400 +Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation") +Signed-off-by: Phil Sutter +Acked-by: Arturo Borrero Gonzalez +(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29) +Signed-off-by: Phil Sutter +--- + .../ipt-restore/0011-noflush-empty-line_0 | 16 ++++++++++++++++ + iptables/xtables-restore.c | 8 +++++--- + 2 files changed, 21 insertions(+), 3 deletions(-) + create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 +new file mode 100755 +index 0000000000000..bea1a690bb624 +--- /dev/null ++++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 +@@ -0,0 +1,16 @@ ++#!/bin/bash -e ++ ++# make sure empty lines won't break --noflush ++ ++cat <in)) { + size_t blen = strlen(buffer); + +- /* drop trailing newline; xtables_restore_parse_line() ++ /* Drop trailing newline; xtables_restore_parse_line() + * uses strtok() which replaces them by nul-characters, + * causing unpredictable string delimiting in +- * preload_buffer */ +- if (buffer[blen - 1] == '\n') ++ * preload_buffer. ++ * Unless this is an empty line which would fold into a ++ * spurious EoB indicator (double nul-char). */ ++ if (buffer[blen - 1] == '\n' && blen > 1) + buffer[blen - 1] = '\0'; + else + blen++; +-- +2.24.1 + diff --git a/iptables.spec b/iptables.spec index 638aecd..b6c3780 100644 --- a/iptables.spec +++ b/iptables.spec @@ -18,8 +18,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables -Version: 1.8.5 -Release: 1%{?dist} +Version: 1.8.4 +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -32,8 +32,15 @@ Source7: %{url}/files/%{name}-%{version_old}.tar.bz2 Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch %endif -Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch -Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch +Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +Patch2: 0002-Fix-DEBUG-build.patch +Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch +Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch +Patch5: 0005-extensions-time-Avoid-undefined-shift.patch +Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch +Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch +Patch8: 0008-extensions-among-Check-call-to-fstat.patch +Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -231,6 +238,10 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic +# install iptables-apply with man page +install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/ +install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/ + %if 0%{?fedora} > 24 # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes @@ -340,7 +351,6 @@ fi %{_sysconfdir}/ethertypes %endif %{_sbindir}/iptables-apply -%{_sbindir}/ip6tables-apply %{_sbindir}/iptables-legacy* %{_sbindir}/ip6tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -446,11 +456,6 @@ fi %changelog -* Tue Jun 23 2020 Phil Sutter - 1.8.5-1 -- Rebase onto upstream version 1.8.5 plus two late fixes -- Drop explicit iptables-apply installation, upstream fixed that -- Ship ip6tables-apply along with iptables package - * Wed Feb 12 2020 Phil Sutter - 1.8.4-7 - Move nft-specific extensions into iptables-nft package - Move remaining extensions into iptables-libs package diff --git a/sources b/sources index a7e9f94..34b13bd 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8 +SHA512 (iptables-1.8.4.tar.bz2) = a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb From bf5cb46f731f0b5a56cad040c24e16c5a93c30d2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 23 Jun 2020 16:42:15 +0200 Subject: [PATCH 4/5] iptables-1.8.4-8 - Add further fixes from upstream --- ...-buffer-overrun-in-xtables_compatibl.patch | 32 ++ ...void-undefined-left-shift-in-xt_sctp.patch | 44 +++ ...e-Fix-for-interface-name-corner-case.patch | 98 +++++++ 0013-xtables-translate-Fix-for-iface.patch | 60 ++++ 0014-xtables-Review-nft_init.patch | 274 ++++++++++++++++++ ...e-Fix-nft_release_cache-under-stress.patch | 49 ++++ ...-iptables-save-segfault-under-stress.patch | 84 ++++++ ...-Fix-broken-conversion-to-nfnl_query.patch | 42 +++ 0018-nfnl_osf-Improve-error-handling.patch | 80 +++++ ...he-Reset-genid-when-rebuilding-cache.patch | 37 +++ iptables.spec | 16 +- 11 files changed, 815 insertions(+), 1 deletion(-) create mode 100644 0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch create mode 100644 0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch create mode 100644 0012-xtables-translate-Fix-for-interface-name-corner-case.patch create mode 100644 0013-xtables-translate-Fix-for-iface.patch create mode 100644 0014-xtables-Review-nft_init.patch create mode 100644 0015-nft-cache-Fix-nft_release_cache-under-stress.patch create mode 100644 0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch create mode 100644 0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch create mode 100644 0018-nfnl_osf-Improve-error-handling.patch create mode 100644 0019-nft-cache-Reset-genid-when-rebuilding-cache.patch diff --git a/0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch b/0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch new file mode 100644 index 0000000..bcb973d --- /dev/null +++ b/0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch @@ -0,0 +1,32 @@ +From 604b7f0cf8dfeb25db7d739995e49f88fd9dbd45 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 5 Dec 2019 13:57:18 +0100 +Subject: [PATCH] libxtables: Avoid buffer overrun in + xtables_compatible_revision() + +The function is exported and accepts arbitrary strings as input. Calling +strcpy() without length checks is not OK. + +(cherry picked from commit f7d3dbb82e7ed94ccbf10cf70a3c7b3f3aaef1a1) +Signed-off-by: Phil Sutter +--- + libxtables/xtables.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index 895f6988eaf57..777c2b08e9896 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -856,7 +856,8 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt) + + xtables_load_ko(xtables_modprobe_program, true); + +- strcpy(rev.name, name); ++ strncpy(rev.name, name, XT_EXTENSION_MAXNAMELEN - 1); ++ rev.name[XT_EXTENSION_MAXNAMELEN - 1] = '\0'; + rev.revision = revision; + + max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); +-- +2.27.0 + diff --git a/0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch b/0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch new file mode 100644 index 0000000..419b246 --- /dev/null +++ b/0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch @@ -0,0 +1,44 @@ +From 347fdad75554acc0a356f976920946aec6ab52a5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 10 Dec 2019 12:27:13 +0100 +Subject: [PATCH] uapi: netfilter: Avoid undefined left-shift in xt_sctp.h + +This is a backport of kernel commit 164166558aace ("netfilter: uapi: +Avoid undefined left-shift in xt_sctp.h"). + +(cherry picked from commit fe1ac5eaa8ae482c9112aed6b89f9f2e529f4516) +Signed-off-by: Phil Sutter +--- + include/linux/netfilter/xt_sctp.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/netfilter/xt_sctp.h b/include/linux/netfilter/xt_sctp.h +index a501e6196905d..5b28525a2482a 100644 +--- a/include/linux/netfilter/xt_sctp.h ++++ b/include/linux/netfilter/xt_sctp.h +@@ -40,19 +40,19 @@ struct xt_sctp_info { + #define SCTP_CHUNKMAP_SET(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] |= \ +- 1 << (type % bytes(__u32)); \ ++ 1u << (type % bytes(__u32)); \ + } while (0) + + #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] &= \ +- ~(1 << (type % bytes(__u32))); \ ++ ~(1u << (type % bytes(__u32))); \ + } while (0) + + #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \ + ({ \ + ((chunkmap)[type / bytes (__u32)] & \ +- (1 << (type % bytes (__u32)))) ? 1: 0; \ ++ (1u << (type % bytes (__u32)))) ? 1: 0; \ + }) + + #define SCTP_CHUNKMAP_RESET(chunkmap) \ +-- +2.27.0 + diff --git a/0012-xtables-translate-Fix-for-interface-name-corner-case.patch b/0012-xtables-translate-Fix-for-interface-name-corner-case.patch new file mode 100644 index 0000000..ea991a5 --- /dev/null +++ b/0012-xtables-translate-Fix-for-interface-name-corner-case.patch @@ -0,0 +1,98 @@ +From 1af5c5eacd8cbfe1d942ac5c59fce9ca007aa43a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 6 Feb 2020 15:08:41 +0100 +Subject: [PATCH] xtables-translate: Fix for interface name corner-cases + +There are two special situations xlate_ifname() didn't cover for: + +* Interface name containing '*': This went unchanged, creating a command + nft wouldn't accept. Instead translate into '\*' which doesn't change + semantics. + +* Interface name being '+': Can't translate into nft wildcard character + as nft doesn't accept asterisk-only interface names. Instead decide + what to do based on 'invert' value: Skip match creation if false, + match against an invalid interface name if true. + +Also add a test to make sure future changes to this behaviour are +noticed. + +Signed-off-by: Phil Sutter +(cherry picked from commit e179e87a1179e272a9bdabb0220b17d61d099ee3) +Signed-off-by: Phil Sutter +--- + extensions/generic.txlate | 12 ++++++++++++ + iptables/xtables-translate.c | 33 ++++++++++++++++++++++++++++----- + 2 files changed, 40 insertions(+), 5 deletions(-) + +diff --git a/extensions/generic.txlate b/extensions/generic.txlate +index b38fbd1fe113b..c92d082abea78 100644 +--- a/extensions/generic.txlate ++++ b/extensions/generic.txlate +@@ -18,3 +18,15 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi + + ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00 + nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter ++ ++# asterisk is not special in iptables and it is even a valid interface name ++iptables-translate -A FORWARD -i '*' -o 'eth*foo' ++nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter ++ ++# skip for always matching interface names ++iptables-translate -A FORWARD -i '+' ++nft add rule ip filter FORWARD counter ++ ++# match against invalid interface name to simulate never matching rule ++iptables-translate -A FORWARD ! -i '+' ++nft add rule ip filter FORWARD iifname "INVAL/D" counter +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 77a186b905d73..c4e177c0d63ba 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -32,15 +32,38 @@ + void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + bool invert) + { +- int ifaclen = strlen(ifname); +- char iface[IFNAMSIZ]; ++ int ifaclen = strlen(ifname), i, j; ++ char iface[IFNAMSIZ * 2]; + + if (ifaclen < 1 || ifaclen >= IFNAMSIZ) + return; + +- strcpy(iface, ifname); +- if (iface[ifaclen - 1] == '+') +- iface[ifaclen - 1] = '*'; ++ for (i = 0, j = 0; i < ifaclen + 1; i++, j++) { ++ switch (ifname[i]) { ++ case '+': ++ iface[j] = '*'; ++ break; ++ case '*': ++ iface[j++] = '\\'; ++ /* fall through */ ++ default: ++ iface[j] = ifname[i]; ++ break; ++ } ++ } ++ ++ if (ifaclen == 1 && ifname[0] == '+') { ++ /* Nftables does not support wildcard only string. Workaround ++ * is easy, given that this will match always or never ++ * depending on 'invert' value. To match always, simply don't ++ * generate an expression. To match never, use an invalid ++ * interface name (kernel doesn't accept '/' in names) to match ++ * against. */ ++ if (!invert) ++ return; ++ strcpy(iface, "INVAL/D"); ++ invert = false; ++ } + + xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface); + } +-- +2.27.0 + diff --git a/0013-xtables-translate-Fix-for-iface.patch b/0013-xtables-translate-Fix-for-iface.patch new file mode 100644 index 0000000..9790ccb --- /dev/null +++ b/0013-xtables-translate-Fix-for-iface.patch @@ -0,0 +1,60 @@ +From 027cdbb0e64904aac90f878c2491059443f92b60 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 13 Feb 2020 14:01:50 +0100 +Subject: [PATCH] xtables-translate: Fix for iface++ + +In legacy iptables, only the last plus sign remains special, any +previous ones are taken literally. Therefore xtables-translate must not +replace all of them with asterisk but just the last one. + +Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases") +Signed-off-by: Phil Sutter +(cherry picked from commit 94488d4eb912f5af4c88d148b39b38eb8a3c1f0b) +Signed-off-by: Phil Sutter +--- + extensions/generic.txlate | 4 ++++ + iptables/xtables-translate.c | 6 +++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/extensions/generic.txlate b/extensions/generic.txlate +index c92d082abea78..0e256c3727559 100644 +--- a/extensions/generic.txlate ++++ b/extensions/generic.txlate +@@ -23,6 +23,10 @@ nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00: + iptables-translate -A FORWARD -i '*' -o 'eth*foo' + nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter + ++# escape all asterisks but translate only the first plus character ++iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++' ++nft add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter ++ + # skip for always matching interface names + iptables-translate -A FORWARD -i '+' + nft add rule ip filter FORWARD counter +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index c4e177c0d63ba..0f95855b41aa4 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -40,9 +40,6 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + + for (i = 0, j = 0; i < ifaclen + 1; i++, j++) { + switch (ifname[i]) { +- case '+': +- iface[j] = '*'; +- break; + case '*': + iface[j++] = '\\'; + /* fall through */ +@@ -65,6 +62,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname, + invert = false; + } + ++ if (iface[j - 2] == '+') ++ iface[j - 2] = '*'; ++ + xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface); + } + +-- +2.27.0 + diff --git a/0014-xtables-Review-nft_init.patch b/0014-xtables-Review-nft_init.patch new file mode 100644 index 0000000..0ccfffc --- /dev/null +++ b/0014-xtables-Review-nft_init.patch @@ -0,0 +1,274 @@ +From 60206ee04840303b4b8e7edc8fa0359633aabcbe Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 21 Feb 2020 14:55:52 +0100 +Subject: [PATCH] xtables: Review nft_init() + +Move common code into nft_init(), such as: + +* initial zeroing nft_handle fields +* family ops lookup and assignment to 'ops' field +* setting of 'family' field + +This requires minor adjustments in xtables_restore_main() so extra field +initialization doesn't happen before nft_init() call. + +As a side-effect, this fixes segfaulting xtables-monitor binary when +printing rules for trace event as in that code-path 'ops' field wasn't +initialized. + +Signed-off-by: Phil Sutter +(cherry picked from commit d0446ab11182f6ca2adc486a124895f09a220c6e) +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 9 ++++++++- + iptables/nft.h | 2 +- + iptables/xtables-arp.c | 9 +-------- + iptables/xtables-eb.c | 9 +-------- + iptables/xtables-monitor.c | 2 +- + iptables/xtables-restore.c | 14 +++++++------- + iptables/xtables-save.c | 9 ++------- + iptables/xtables-standalone.c | 6 ++---- + iptables/xtables-translate.c | 2 +- + iptables/xtables.c | 4 ---- + 10 files changed, 24 insertions(+), 42 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 3f2a62ae12c07..0287add3fb21f 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -789,8 +789,10 @@ int nft_restart(struct nft_handle *h) + return 0; + } + +-int nft_init(struct nft_handle *h, const struct builtin_table *t) ++int nft_init(struct nft_handle *h, int family, const struct builtin_table *t) + { ++ memset(h, 0, sizeof(*h)); ++ + h->nl = mnl_socket_open(NETLINK_NETFILTER); + if (h->nl == NULL) + return -1; +@@ -800,9 +802,14 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t) + return -1; + } + ++ h->ops = nft_family_ops_lookup(family); ++ if (!h->ops) ++ xtables_error(PARAMETER_PROBLEM, "Unknown family"); ++ + h->portid = mnl_socket_get_portid(h->nl); + h->tables = t; + h->cache = &h->__cache[0]; ++ h->family = family; + + INIT_LIST_HEAD(&h->obj_list); + INIT_LIST_HEAD(&h->err_list); +diff --git a/iptables/nft.h b/iptables/nft.h +index 51b5660314c0c..5cf260a6d2cd3 100644 +--- a/iptables/nft.h ++++ b/iptables/nft.h +@@ -80,7 +80,7 @@ extern const struct builtin_table xtables_bridge[NFT_TABLE_MAX]; + int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh, + int (*cb)(const struct nlmsghdr *nlh, void *data), + void *data); +-int nft_init(struct nft_handle *h, const struct builtin_table *t); ++int nft_init(struct nft_handle *h, int family, const struct builtin_table *t); + void nft_fini(struct nft_handle *h); + int nft_restart(struct nft_handle *h); + +diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c +index 9cfad76263d32..c8196f08baa59 100644 +--- a/iptables/xtables-arp.c ++++ b/iptables/xtables-arp.c +@@ -500,17 +500,10 @@ int nft_init_arp(struct nft_handle *h, const char *pname) + init_extensionsa(); + #endif + +- memset(h, 0, sizeof(*h)); +- h->family = NFPROTO_ARP; +- +- if (nft_init(h, xtables_arp) < 0) ++ if (nft_init(h, NFPROTO_ARP, xtables_arp) < 0) + xtables_error(OTHER_PROBLEM, + "Could not initialize nftables layer."); + +- h->ops = nft_family_ops_lookup(h->family); +- if (h->ops == NULL) +- xtables_error(PARAMETER_PROBLEM, "Unknown family"); +- + return 0; + } + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 15b971da3d425..c006bc95ac681 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -739,16 +739,9 @@ int nft_init_eb(struct nft_handle *h, const char *pname) + init_extensionsb(); + #endif + +- memset(h, 0, sizeof(*h)); +- +- h->family = NFPROTO_BRIDGE; +- +- if (nft_init(h, xtables_bridge) < 0) ++ if (nft_init(h, NFPROTO_BRIDGE, xtables_bridge) < 0) + xtables_error(OTHER_PROBLEM, + "Could not initialize nftables layer."); +- h->ops = nft_family_ops_lookup(h->family); +- if (!h->ops) +- xtables_error(PARAMETER_PROBLEM, "Unknown family"); + + /* manually registering ebt matches, given the original ebtables parser + * don't use '-m matchname' and the match can't be loaded dynamically when +diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c +index a5245d1422af9..c2b31dbaa0795 100644 +--- a/iptables/xtables-monitor.c ++++ b/iptables/xtables-monitor.c +@@ -615,7 +615,7 @@ int xtables_monitor_main(int argc, char *argv[]) + init_extensions4(); + #endif + +- if (nft_init(&h, xtables_ipv4)) { ++ if (nft_init(&h, AF_INET, xtables_ipv4)) { + fprintf(stderr, "%s/%s Failed to initialize nft: %s\n", + xtables_globals.program_name, + xtables_globals.program_version, +diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c +index fb2ac8b5c12a3..11834c0ea98c5 100644 +--- a/iptables/xtables-restore.c ++++ b/iptables/xtables-restore.c +@@ -360,15 +360,13 @@ static int + xtables_restore_main(int family, const char *progname, int argc, char *argv[]) + { + const struct builtin_table *tables; +- struct nft_handle h = { +- .family = family, +- .restore = true, +- }; +- int c; + struct nft_xt_restore_parse p = { + .commit = true, + .cb = &restore_cb, + }; ++ bool noflush = false; ++ struct nft_handle h; ++ int c; + + line = 0; + +@@ -402,7 +400,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) + print_usage(prog_name, PACKAGE_VERSION); + exit(0); + case 'n': +- h.noflush = 1; ++ noflush = true; + break; + case 'M': + xtables_modprobe_program = optarg; +@@ -464,13 +462,15 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[]) + return 1; + } + +- if (nft_init(&h, tables) < 0) { ++ if (nft_init(&h, family, tables) < 0) { + fprintf(stderr, "%s/%s Failed to initialize nft: %s\n", + xtables_globals.program_name, + xtables_globals.program_version, + strerror(errno)); + exit(EXIT_FAILURE); + } ++ h.noflush = noflush; ++ h.restore = true; + + xtables_restore_parse(&h, &p); + +diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c +index 3a52f8c3d8209..228282deaed07 100644 +--- a/iptables/xtables-save.c ++++ b/iptables/xtables-save.c +@@ -139,10 +139,8 @@ xtables_save_main(int family, int argc, char *argv[], + struct do_output_data d = { + .format = FMT_NOCOUNTS, + }; ++ struct nft_handle h; + bool dump = false; +- struct nft_handle h = { +- .family = family, +- }; + FILE *file = NULL; + int ret, c; + +@@ -242,16 +240,13 @@ xtables_save_main(int family, int argc, char *argv[], + return 1; + } + +- if (nft_init(&h, tables) < 0) { ++ if (nft_init(&h, family, tables) < 0) { + fprintf(stderr, "%s/%s Failed to initialize nft: %s\n", + xtables_globals.program_name, + xtables_globals.program_version, + strerror(errno)); + exit(EXIT_FAILURE); + } +- h.ops = nft_family_ops_lookup(h.family); +- if (!h.ops) +- xtables_error(PARAMETER_PROBLEM, "Unknown family"); + + ret = do_output(&h, tablename, &d); + nft_fini(&h); +diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c +index 1a28c5480629f..022d5dd44abbf 100644 +--- a/iptables/xtables-standalone.c ++++ b/iptables/xtables-standalone.c +@@ -44,9 +44,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + { + int ret; + char *table = "filter"; +- struct nft_handle h = { +- .family = family, +- }; ++ struct nft_handle h; + + xtables_globals.program_name = progname; + ret = xtables_init_all(&xtables_globals, family); +@@ -61,7 +59,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + init_extensions4(); + #endif + +- if (nft_init(&h, xtables_ipv4) < 0) { ++ if (nft_init(&h, family, xtables_ipv4) < 0) { + fprintf(stderr, "%s/%s Failed to initialize nft: %s\n", + xtables_globals.program_name, + xtables_globals.program_version, +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 0f95855b41aa4..76ad7eb69eca9 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -480,7 +480,7 @@ static int xtables_xlate_main_common(struct nft_handle *h, + return 1; + } + +- if (nft_init(h, tables) < 0) { ++ if (nft_init(h, family, tables) < 0) { + fprintf(stderr, "%s/%s Failed to initialize nft: %s\n", + xtables_globals.program_name, + xtables_globals.program_version, +diff --git a/iptables/xtables.c b/iptables/xtables.c +index 8f9dc628d0029..4b24d15c46295 100644 +--- a/iptables/xtables.c ++++ b/iptables/xtables.c +@@ -571,10 +571,6 @@ void do_parse(struct nft_handle *h, int argc, char *argv[], + demand-load a protocol. */ + opterr = 0; + +- h->ops = nft_family_ops_lookup(h->family); +- if (h->ops == NULL) +- xtables_error(PARAMETER_PROBLEM, "Unknown family"); +- + opts = xt_params->orig_opts; + while ((cs->c = getopt_long(argc, argv, + "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvw::W::nt:m:xc:g:46", +-- +2.27.0 + diff --git a/0015-nft-cache-Fix-nft_release_cache-under-stress.patch b/0015-nft-cache-Fix-nft_release_cache-under-stress.patch new file mode 100644 index 0000000..6fd1cf2 --- /dev/null +++ b/0015-nft-cache-Fix-nft_release_cache-under-stress.patch @@ -0,0 +1,49 @@ +From 381597830058c20cce350a705265fb2ab0150f2f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Feb 2020 20:32:13 +0100 +Subject: [PATCH] nft: cache: Fix nft_release_cache() under stress + +iptables-nft-restore calls nft_action(h, NFT_COMPAT_COMMIT) for each +COMMIT line in input. When restoring a dump containing multiple large +tables, chances are nft_rebuild_cache() has to run multiple times. + +If the above happens, consecutive table contents are added to __cache[1] +which nft_rebuild_cache() then frees, so next commit attempt accesses +invalid memory. + +Fix this by making nft_release_cache() (called after each successful +commit) return things into pre-rebuild state again, but keeping the +fresh cache copy. + +Fixes: f6ad231d698c7 ("nft: keep original cache in case of ERESTART") +Signed-off-by: Phil Sutter +(cherry picked from commit c550c81fd373e5753103d20f7902171f0fa79807) +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 7345a27e2894b..6f21f2283e0fb 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -647,8 +647,14 @@ void nft_rebuild_cache(struct nft_handle *h) + + void nft_release_cache(struct nft_handle *h) + { +- if (h->cache_index) +- flush_cache(h, &h->__cache[0], NULL); ++ if (!h->cache_index) ++ return; ++ ++ flush_cache(h, &h->__cache[0], NULL); ++ memcpy(&h->__cache[0], &h->__cache[1], sizeof(h->__cache[0])); ++ memset(&h->__cache[1], 0, sizeof(h->__cache[1])); ++ h->cache_index = 0; ++ h->cache = &h->__cache[0]; + } + + struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h) +-- +2.27.0 + diff --git a/0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch b/0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch new file mode 100644 index 0000000..81ff821 --- /dev/null +++ b/0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch @@ -0,0 +1,84 @@ +From 02460350debd34be4342b87cac91d70240c7c431 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 13 Mar 2020 13:02:12 +0100 +Subject: [PATCH] nft: cache: Fix iptables-save segfault under stress + +If kernel ruleset is constantly changing, code called by +nft_is_table_compatible() may crash: For each item in table's chain +list, nft_is_chain_compatible() is called. This in turn calls +nft_build_cache() to fetch chain's rules. Though if kernel genid has changed +meanwhile, cache is flushed and rebuilt from scratch, thereby freeing +table's chain list - the foreach loop in nft_is_table_compatible() then +operates on freed memory. + +A simple reproducer (may need a few calls): + +| RULESET='*filter +| :INPUT ACCEPT [10517:1483527] +| :FORWARD ACCEPT [0:0] +| :OUTPUT ACCEPT [1714:105671] +| COMMIT +| ' +| +| for ((i = 0; i < 100; i++)); do +| iptables-nft-restore <<< "$RULESET" & +| done & +| iptables-nft-save + +To fix the problem, basically revert commit ab1cd3b510fa5 ("nft: ensure +cache consistency") so that __nft_build_cache() no longer flushes the +cache. Instead just record kernel's genid when fetching for the first +time. If kernel rule set changes until the changes are committed, the +commit simply fails and local cache is being rebuilt. + +Signed-off-by: Phil Sutter +(cherry picked from commit 200bc399651499f502ac0de45f4d4aa4c9d37ab6) +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 16 ++-------------- + 1 file changed, 2 insertions(+), 14 deletions(-) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 6f21f2283e0fb..07265b7795e4f 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -452,15 +452,11 @@ __nft_build_cache(struct nft_handle *h, enum nft_cache_level level, + const struct builtin_table *t, const char *set, + const char *chain) + { +- uint32_t genid_start, genid_stop; +- + if (level <= h->cache_level) + return; +-retry: +- mnl_genid_get(h, &genid_start); + +- if (h->cache_level && genid_start != h->nft_genid) +- flush_chain_cache(h, NULL); ++ if (!h->nft_genid) ++ mnl_genid_get(h, &h->nft_genid); + + switch (h->cache_level) { + case NFT_CL_NONE: +@@ -487,18 +483,10 @@ retry: + break; + } + +- mnl_genid_get(h, &genid_stop); +- if (genid_start != genid_stop) { +- flush_chain_cache(h, NULL); +- goto retry; +- } +- + if (!t && !chain) + h->cache_level = level; + else if (h->cache_level < NFT_CL_TABLES) + h->cache_level = NFT_CL_TABLES; +- +- h->nft_genid = genid_start; + } + + void nft_build_cache(struct nft_handle *h, struct nftnl_chain *c) +-- +2.27.0 + diff --git a/0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch b/0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch new file mode 100644 index 0000000..3655af9 --- /dev/null +++ b/0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch @@ -0,0 +1,42 @@ +From 8a48c88b9cfa643e9c2783f41c6a79fd42514e6f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sat, 9 May 2020 13:36:49 +0200 +Subject: [PATCH] nfnl_osf: Fix broken conversion to nfnl_query() + +Due to missing NLM_F_ACK flag in request, nfnetlink code in kernel +didn't create an own ACK message but left it upon subsystem to ACK or +not. Since nfnetlink_osf doesn't ACK by itself, nfnl_query() got stuck +waiting for a reply. + +Whoever did the conversion from deprecated nfnl_talk() obviously didn't +even test basic functionality of the tool. + +Fixes: 52aa15098ebd6 ("nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query()") +Signed-off-by: Phil Sutter +(cherry picked from commit c8332553caf48132403895bae750b3cd09a2efd8) +Signed-off-by: Phil Sutter +--- + utils/nfnl_osf.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c +index 15d531975e11d..922d90ac135b7 100644 +--- a/utils/nfnl_osf.c ++++ b/utils/nfnl_osf.c +@@ -378,9 +378,11 @@ static int osf_load_line(char *buffer, int len, int del) + memset(buf, 0, sizeof(buf)); + + if (del) +- nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE, NLM_F_REQUEST); ++ nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE, ++ NLM_F_ACK | NLM_F_REQUEST); + else +- nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD, NLM_F_REQUEST | NLM_F_CREATE); ++ nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD, ++ NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE); + + nfnl_addattr_l(nmh, sizeof(buf), OSF_ATTR_FINGER, &f, sizeof(struct xt_osf_user_finger)); + +-- +2.27.0 + diff --git a/0018-nfnl_osf-Improve-error-handling.patch b/0018-nfnl_osf-Improve-error-handling.patch new file mode 100644 index 0000000..0098057 --- /dev/null +++ b/0018-nfnl_osf-Improve-error-handling.patch @@ -0,0 +1,80 @@ +From ef30ce26ceb48402f9c028802127151e962f51cd Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sat, 9 May 2020 13:42:56 +0200 +Subject: [PATCH] nfnl_osf: Improve error handling + +For some error cases, no log message was created - hence apart from the +return code there was no indication of failing execution. + +If a line load fails, don't abort but continue with the remaining +file contents. The current pf.os file in this repository serves as +proof-of-concept: + +Lines 700 and 701: Duplicates of lines 698 and 699 because 'W*' and 'W0' +parse into the same data. + +Line 704: Duplicate of line 702 because apart from 'W*' and 'W0', only +the first three fields on right-hand side are sent to the kernel. + +When loading, these dups are ignored (they would bounce if NLM_F_EXCL +was given). Upon deletion, they cause ENOENT response from kernel. In +order to align duplicate-tolerance in both modes, just ignore that +ENOENT. + +Signed-off-by: Phil Sutter +(cherry picked from commit 3e09bd1888575cfec136574d2b0e810ba33f1cfb) +Signed-off-by: Phil Sutter +--- + utils/nfnl_osf.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c +index 922d90ac135b7..8008e83d8af4b 100644 +--- a/utils/nfnl_osf.c ++++ b/utils/nfnl_osf.c +@@ -392,7 +392,7 @@ static int osf_load_line(char *buffer, int len, int del) + static int osf_load_entries(char *path, int del) + { + FILE *inf; +- int err = 0; ++ int err = 0, lineno = 0; + char buf[1024]; + + inf = fopen(path, "r"); +@@ -402,7 +402,9 @@ static int osf_load_entries(char *path, int del) + } + + while(fgets(buf, sizeof(buf), inf)) { +- int len; ++ int len, rc; ++ ++ lineno++; + + if (buf[0] == '#' || buf[0] == '\n' || buf[0] == '\r') + continue; +@@ -414,9 +416,11 @@ static int osf_load_entries(char *path, int del) + + buf[len] = '\0'; + +- err = osf_load_line(buf, len, del); +- if (err) +- break; ++ rc = osf_load_line(buf, len, del); ++ if (rc && (!del || errno != ENOENT)) { ++ ulog_err("Failed to load line %d", lineno); ++ err = rc; ++ } + + memset(buf, 0, sizeof(buf)); + } +@@ -448,6 +452,7 @@ int main(int argc, char *argv[]) + + if (!fingerprints) { + err = -ENOENT; ++ ulog("Missing fingerprints file argument.\n"); + goto err_out_exit; + } + +-- +2.27.0 + diff --git a/0019-nft-cache-Reset-genid-when-rebuilding-cache.patch b/0019-nft-cache-Reset-genid-when-rebuilding-cache.patch new file mode 100644 index 0000000..071a8d1 --- /dev/null +++ b/0019-nft-cache-Reset-genid-when-rebuilding-cache.patch @@ -0,0 +1,37 @@ +From d7ac1f62d953ea2136df4bef247b635db93a537b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 29 May 2020 19:33:22 +0200 +Subject: [PATCH] nft: cache: Reset genid when rebuilding cache + +This is required in order to avoid a cache rebuild loop if +iptables-nft-restore is called with '--test' parameter and a dump +containing more than a single table. + +If non-zero, __nft_build_cache() never updates genid and therefore the +incorrect genid (caused by increment in nft_action()) is never +corrected. + +This is a Fedora-only fix, upstream rewrote the whole cache logic which +implicitly resolved this problem. + +Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress") +Signed-off-by: Phil Sutter +--- + iptables/nft-cache.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c +index 07265b7795e4f..bc6e7f7eaebfb 100644 +--- a/iptables/nft-cache.c ++++ b/iptables/nft-cache.c +@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h) + if (h->cache_level) + __nft_flush_cache(h); + ++ h->nft_genid = 0; + h->cache_level = NFT_CL_NONE; + __nft_build_cache(h, level, NULL, NULL, NULL); + } +-- +2.27.0 + diff --git a/iptables.spec b/iptables.spec index b6c3780..7cd12ed 100644 --- a/iptables.spec +++ b/iptables.spec @@ -19,7 +19,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -41,6 +41,17 @@ Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch Patch8: 0008-extensions-among-Check-call-to-fstat.patch Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch +Patch10: 0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch +Patch11: 0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch +Patch12: 0012-xtables-translate-Fix-for-interface-name-corner-case.patch +Patch13: 0013-xtables-translate-Fix-for-iface.patch +Patch14: 0014-xtables-Review-nft_init.patch +Patch15: 0015-nft-cache-Fix-nft_release_cache-under-stress.patch +Patch16: 0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch +Patch17: 0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch +Patch18: 0018-nfnl_osf-Improve-error-handling.patch +Patch19: 0019-nft-cache-Reset-genid-when-rebuilding-cache.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -456,6 +467,9 @@ fi %changelog +* Tue Jun 23 2020 Phil Sutter - 1.8.4-8 +- Add further fixes from upstream + * Wed Feb 12 2020 Phil Sutter - 1.8.4-7 - Move nft-specific extensions into iptables-nft package - Move remaining extensions into iptables-libs package From 88cf200031f6ebb2ed75e7715e87d06f011b2048 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 25 Aug 2020 17:28:06 +0200 Subject: [PATCH 5/5] iptables-1.8.4-9 - Fix for wrong prefix in ip6tables error messages - Add further fixes from upstream --- ...apply-Use-mktemp-instead-of-tempfile.patch | 4 +- 0002-Fix-DEBUG-build.patch | 4 +- ...ore-Fix-parser-feed-from-line-buffer.patch | 4 +- ...e-Avoid-access-of-uninitialized-data.patch | 4 +- ...xtensions-time-Avoid-undefined-shift.patch | 4 +- ...nsions-cluster-Avoid-undefined-shift.patch | 4 +- ...te-Guard-strcpy-call-in-xlate_ifname.patch | 4 +- ...extensions-among-Check-call-to-fstat.patch | 4 +- ...tore-fix-for-noflush-and-empty-lines.patch | 4 +- ...mand-name-in-ip6tables-error-message.patch | 45 +++ ...shell-Fix-skip-checks-with-host-mode.patch | 366 ++++++++++++++++++ 0022-nft-Drop-pointless-assignment.patch | 31 ++ 0023-iptables-test.py-Fix-host-mode.patch | 43 ++ ...numeric-labels-even-if-connlabel.con.patch | 54 +++ ...nft-Fix-leaks-in-ebt_add_policy_rule.patch | 73 ++++ 0026-nft-Fix-leak-when-replacing-a-rule.patch | 35 ++ ...-libxt_MARK-OUTPUT-chain-is-fine-too.patch | 34 ++ ...syntax-in-ipt-restore-0010-noflush-n.patch | 29 ++ iptables.spec | 16 +- 19 files changed, 742 insertions(+), 20 deletions(-) create mode 100644 0020-nft-Fix-command-name-in-ip6tables-error-message.patch create mode 100644 0021-tests-shell-Fix-skip-checks-with-host-mode.patch create mode 100644 0022-nft-Drop-pointless-assignment.patch create mode 100644 0023-iptables-test.py-Fix-host-mode.patch create mode 100644 0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch create mode 100644 0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch create mode 100644 0026-nft-Fix-leak-when-replacing-a-rule.patch create mode 100644 0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch create mode 100644 0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch diff --git a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch index 970370d..611b9ac 100644 --- a/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch +++ b/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch @@ -1,4 +1,4 @@ -From 6455a8201fab45194413b326aecc1d764033db0b Mon Sep 17 00:00:00 2001 +From ef37183c65bc1c69c8fdb198d9ee500cb7b394e5 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Apr 2019 18:02:19 +0200 Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile @@ -31,5 +31,5 @@ index 819ca4a459c42..a685b6bbcd7dc 100755 FPE USR1 SEGV USR2 PIPE ALRM TERM -- -2.24.1 +2.27.0 diff --git a/0002-Fix-DEBUG-build.patch b/0002-Fix-DEBUG-build.patch index f95306b..f2e71a2 100644 --- a/0002-Fix-DEBUG-build.patch +++ b/0002-Fix-DEBUG-build.patch @@ -1,4 +1,4 @@ -From a7eb134ce97d873c0fe5d30ac1ddce447aba576c Mon Sep 17 00:00:00 2001 +From 1c05f5907661207a61767db6b0d8e5e7bb60f5be Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 4 Dec 2019 09:36:59 +0100 Subject: [PATCH] Fix DEBUG build @@ -29,5 +29,5 @@ index 78e422781723f..426765641cff6 100644 if (!h->ops->is_same(cs, &this)) goto out; -- -2.24.1 +2.27.0 diff --git a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch index 85a760b..975336f 100644 --- a/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch +++ b/0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch @@ -1,4 +1,4 @@ -From f587011318fd47b18d0f0174b6594485a546ca8f Mon Sep 17 00:00:00 2001 +From d46cba8bb28f3f57969ae36355801b1aade26983 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 4 Dec 2019 09:56:06 +0100 Subject: [PATCH] xtables-restore: Fix parser feed from line buffer @@ -55,5 +55,5 @@ index 2f0fe7d439d94..dd907e0b8ddd5 100644 if (*buffer) { h->error.lineno = ++line; -- -2.24.1 +2.27.0 diff --git a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch index d640ab6..460a797 100644 --- a/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch +++ b/0004-xtables-restore-Avoid-access-of-uninitialized-data.patch @@ -1,4 +1,4 @@ -From 79aea9da9108323922dce0820d362c23619371f4 Mon Sep 17 00:00:00 2001 +From 6ecf9d7f0ed60afdbd3637cc40e91a0b2d86d21c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Dec 2019 11:40:26 +0100 Subject: [PATCH] xtables-restore: Avoid access of uninitialized data @@ -27,5 +27,5 @@ index dd907e0b8ddd5..63cc15cee9621 100644 if (!h->noflush) { nft_fake_cache(h); -- -2.24.1 +2.27.0 diff --git a/0005-extensions-time-Avoid-undefined-shift.patch b/0005-extensions-time-Avoid-undefined-shift.patch index 8af492d..6bbf435 100644 --- a/0005-extensions-time-Avoid-undefined-shift.patch +++ b/0005-extensions-time-Avoid-undefined-shift.patch @@ -1,4 +1,4 @@ -From cf6d2d3892f62d60fa029a94867a99e87e2ab175 Mon Sep 17 00:00:00 2001 +From 51ec6fb324ae61a1c4e6ee8514f8b13efb14b4fd Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Dec 2019 13:15:01 +0100 Subject: [PATCH] extensions: time: Avoid undefined shift @@ -27,5 +27,5 @@ index 5a8cc5de13031..d001f5b7f448f 100644 printf(","); printf("%u", i); -- -2.24.1 +2.27.0 diff --git a/0006-extensions-cluster-Avoid-undefined-shift.patch b/0006-extensions-cluster-Avoid-undefined-shift.patch index f9c429f..c60cbb0 100644 --- a/0006-extensions-cluster-Avoid-undefined-shift.patch +++ b/0006-extensions-cluster-Avoid-undefined-shift.patch @@ -1,4 +1,4 @@ -From adfa4a0a95d26b7aaae0c1754f77a863bcd05120 Mon Sep 17 00:00:00 2001 +From b32190bee5a3b9fef63a32fa7f43edd1021e2ee9 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Dec 2019 13:36:31 +0100 Subject: [PATCH] extensions: cluster: Avoid undefined shift @@ -27,5 +27,5 @@ index c9c35ee22e3df..d164bf6960166 100644 xt_xlate_add(xl, "{ "); needs_set = 1; -- -2.24.1 +2.27.0 diff --git a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch index cfc0235..45b8d17 100644 --- a/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch +++ b/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch @@ -1,4 +1,4 @@ -From 24e3defb866ecd391ee92417129df96402e1867c Mon Sep 17 00:00:00 2001 +From 3d43932ba38f041c72902b894f9f90486a1a200f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Dec 2019 16:01:29 +0100 Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname() @@ -36,5 +36,5 @@ index a42c60a3b64c6..77a186b905d73 100644 iface[ifaclen - 1] = '*'; -- -2.24.1 +2.27.0 diff --git a/0008-extensions-among-Check-call-to-fstat.patch b/0008-extensions-among-Check-call-to-fstat.patch index ca84456..9bbb380 100644 --- a/0008-extensions-among-Check-call-to-fstat.patch +++ b/0008-extensions-among-Check-call-to-fstat.patch @@ -1,4 +1,4 @@ -From 10b51ba86b63a4d7afa208ea206c7c9872bc6e0a Mon Sep 17 00:00:00 2001 +From b1b60022ea6ece431f372e5c850c62ede97e61ad Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 5 Dec 2019 16:35:51 +0100 Subject: [PATCH] extensions: among: Check call to fstat() @@ -37,5 +37,5 @@ index 2e87db3bc06fa..715d559f432c2 100644 /* use mmap because the file will probably be big */ optarg = mmap(0, flen, PROT_READ | PROT_WRITE, -- -2.24.1 +2.27.0 diff --git a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch index aca04fa..94acc18 100644 --- a/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch +++ b/0009-xtables-restore-fix-for-noflush-and-empty-lines.patch @@ -1,4 +1,4 @@ -From 17b62e149147f05d419103dbbde9dca361c2bd5d Mon Sep 17 00:00:00 2001 +From 8c54e14a9d7e1fcfd30481cb50ec577edce5ce34 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 11 Feb 2020 16:52:59 +0100 Subject: [PATCH] xtables-restore: fix for --noflush and empty lines @@ -74,5 +74,5 @@ index 63cc15cee9621..fb2ac8b5c12a3 100644 else blen++; -- -2.24.1 +2.27.0 diff --git a/0020-nft-Fix-command-name-in-ip6tables-error-message.patch b/0020-nft-Fix-command-name-in-ip6tables-error-message.patch new file mode 100644 index 0000000..3480b16 --- /dev/null +++ b/0020-nft-Fix-command-name-in-ip6tables-error-message.patch @@ -0,0 +1,45 @@ +From 6036d70408b1d4e8760e47cdf862cc73c1de727d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 7 Aug 2020 13:48:28 +0200 +Subject: [PATCH] nft: Fix command name in ip6tables error message + +Upon errors, ip6tables-nft would prefix its error messages with +'iptables:' instead of 'ip6tables:'. Turns out the command name was +hard-coded, use 'progname' variable instead. +While being at it, merge the two mostly identical fprintf() calls into +one. + +Signed-off-by: Phil Sutter +Acked-by: Pablo Neira Ayuso +(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13) +Signed-off-by: Phil Sutter +--- + iptables/xtables-standalone.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c +index 022d5dd44abbf..b5b7ccaf4e660 100644 +--- a/iptables/xtables-standalone.c ++++ b/iptables/xtables-standalone.c +@@ -74,14 +74,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[]) + nft_fini(&h); + + if (!ret) { +- if (errno == EINVAL) { +- fprintf(stderr, "iptables: %s. " +- "Run `dmesg' for more information.\n", +- nft_strerror(errno)); +- } else { +- fprintf(stderr, "iptables: %s.\n", +- nft_strerror(errno)); +- } ++ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno), ++ (errno == EINVAL ? ++ " Run `dmesg' for more information." : "")); ++ + if (errno == EAGAIN) + exit(RESOURCE_PROBLEM); + } +-- +2.27.0 + diff --git a/0021-tests-shell-Fix-skip-checks-with-host-mode.patch b/0021-tests-shell-Fix-skip-checks-with-host-mode.patch new file mode 100644 index 0000000..3e66457 --- /dev/null +++ b/0021-tests-shell-Fix-skip-checks-with-host-mode.patch @@ -0,0 +1,366 @@ +From 5d22e14bad69933519ddcc6bb39817bf7ae09db8 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 12 Feb 2020 21:26:06 +0100 +Subject: [PATCH] tests: shell: Fix skip checks with --host mode + +When testing host binaries, XT_MULTI variable contains just the program +name without path component which most skip checks didn't expect. Fix +them, and while being at it also reduce indenting level in two scripts +by moving the skip check up front with an early exit call. + +Fixes: 416898e335322 ("tests/shell: Support testing host binaries") +Signed-off-by: Phil Sutter +(cherry picked from commit 2b2b7948c1960ba4680677664ff58477be869de6) +Signed-off-by: Phil Sutter +--- + .../arptables/0001-arptables-save-restore_0 | 2 +- + .../0002-arptables-restore-defaults_0 | 2 +- + .../arptables/0003-arptables-verbose-output_0 | 2 +- + .../testcases/ebtables/0001-ebtables-basic_0 | 135 +++++++++--------- + .../ebtables/0002-ebtables-save-restore_0 | 2 +- + .../ebtables/0003-ebtables-restore-defaults_0 | 2 +- + .../testcases/ebtables/0004-save-counters_0 | 2 +- + .../testcases/ebtables/0005-ifnamechecks_0 | 2 +- + .../firewalld-restore/0001-firewalld_0 | 2 +- + .../testcases/ipt-restore/0004-restore-race_0 | 2 +- + .../shell/testcases/nft-only/0001compat_0 | 15 +- + .../shell/testcases/nft-only/0002invflags_0 | 2 +- + .../nft-only/0003delete-with-comment_0 | 2 +- + 13 files changed, 88 insertions(+), 84 deletions(-) + +diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 +index bf04dc0a3e15a..e64e9142ee98b 100755 +--- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 ++++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 +@@ -4,7 +4,7 @@ set -e + #set -x + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + # fill arptables manually + +diff --git a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 +index 38d387f327ebb..afd0fcb460d85 100755 +--- a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 ++++ b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 +@@ -3,7 +3,7 @@ + set -e + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + # arptables-restore reuses preloaded targets and matches, make sure defaults + # apply to consecutive rules using the same target/match as a previous one +diff --git a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 +index 10c5ec33ada2c..952cfa7898371 100755 +--- a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 ++++ b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 +@@ -4,7 +4,7 @@ set -e + set -x + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + $XT_MULTI arptables -N foo + +diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +index c7f24a383f698..0c1eb4ca66f52 100755 +--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 ++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 +@@ -1,86 +1,89 @@ + #!/bin/sh + ++case "$XT_MULTI" in ++*xtables-nft-multi) ++ ;; ++*) ++ echo "skip $XT_MULTI" ++ exit 0 ++ ;; ++esac ++ + get_entries_count() { # (chain) + $XT_MULTI ebtables -L $1 | sed -n 's/.*entries: \([0-9]*\).*/\1/p' + } + + set -x +-case "$XT_MULTI" in +-*/xtables-nft-multi) +- for t in filter nat;do +- $XT_MULTI ebtables -t $t -L || exit 1 +- $XT_MULTI ebtables -t $t -X || exit 1 +- $XT_MULTI ebtables -t $t -F || exit 1 +- done +- +- for t in broute foobar ;do +- $XT_MULTI ebtables -t $t -L && +- $XT_MULTI ebtables -t $t -X && +- $XT_MULTI ebtables -t $t -F +- if [ $? -eq 0 ]; then +- echo "Expect nonzero return for unsupported table" +- exit 1 +- fi +- done + ++for t in filter nat;do ++ $XT_MULTI ebtables -t $t -L || exit 1 ++ $XT_MULTI ebtables -t $t -X || exit 1 ++ $XT_MULTI ebtables -t $t -F || exit 1 ++done + +- $XT_MULTI ebtables -t filter -N FOO || exit 1 +- $XT_MULTI ebtables -t filter -N FOO ++for t in broute foobar ;do ++ $XT_MULTI ebtables -t $t -L && ++ $XT_MULTI ebtables -t $t -X && ++ $XT_MULTI ebtables -t $t -F + if [ $? -eq 0 ]; then +- echo "Duplicate chain FOO" +- $XT_MULTI ebtables -t filter -L ++ echo "Expect nonzero return for unsupported table" + exit 1 + fi ++done + +- entries=$(get_entries_count FOO) +- if [ $entries -ne 0 ]; then +- echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)" +- $XT_MULTI ebtables -L +- exit 1 +- fi + +- $XT_MULTI ebtables -A FORWARD -j FOO +- entries=$(get_entries_count FORWARD) +- if [ $entries -ne 1 ]; then +- echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)" +- $XT_MULTI ebtables -L +- exit 1 +- fi ++$XT_MULTI ebtables -t filter -N FOO || exit 1 ++$XT_MULTI ebtables -t filter -N FOO ++if [ $? -eq 0 ]; then ++ echo "Duplicate chain FOO" ++ $XT_MULTI ebtables -t filter -L ++ exit 1 ++fi + +- entries=$(get_entries_count FOO) +- if [ $entries -ne 0 ]; then +- echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)" +- $XT_MULTI ebtables -L +- exit 1 +- fi ++entries=$(get_entries_count FOO) ++if [ $entries -ne 0 ]; then ++ echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)" ++ $XT_MULTI ebtables -L ++ exit 1 ++fi + +- $XT_MULTI ebtables -A FOO -j ACCEPT +- entries=$(get_entries_count FOO) +- if [ $entries -ne 1 ]; then +- echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)" +- $XT_MULTI ebtables -L +- exit 1 +- fi ++$XT_MULTI ebtables -A FORWARD -j FOO ++entries=$(get_entries_count FORWARD) ++if [ $entries -ne 1 ]; then ++ echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)" ++ $XT_MULTI ebtables -L ++ exit 1 ++fi + +- $XT_MULTI ebtables -t filter -N BAR || exit 1 +- $XT_MULTI ebtables -t filter -N BAZ || exit 1 ++entries=$(get_entries_count FOO) ++if [ $entries -ne 0 ]; then ++ echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)" ++ $XT_MULTI ebtables -L ++ exit 1 ++fi + +- $XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1 +- $XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1 +- $XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 ++$XT_MULTI ebtables -A FOO -j ACCEPT ++entries=$(get_entries_count FOO) ++if [ $entries -ne 1 ]; then ++ echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)" ++ $XT_MULTI ebtables -L ++ exit 1 ++fi + +- $XT_MULTI ebtables -t filter -L BAZ || exit 1 +- $XT_MULTI ebtables -t filter -X BAZ || exit 1 +- $XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ +- if [ $? -eq 0 ]; then +- echo "Deleted chain -L BAZ ok, expected failure" +- $XT_MULTI ebtables -t filter -L +- exit 1 +- fi ++$XT_MULTI ebtables -t filter -N BAR || exit 1 ++$XT_MULTI ebtables -t filter -N BAZ || exit 1 + +- $XT_MULTI ebtables -t $t -F || exit 0 +- ;; +-*) +- echo "skip $XT_MULTI" +- ;; +-esac ++$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1 ++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1 ++ ++$XT_MULTI ebtables -t filter -L BAZ || exit 1 ++$XT_MULTI ebtables -t filter -X BAZ || exit 1 ++$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ ++if [ $? -eq 0 ]; then ++ echo "Deleted chain -L BAZ ok, expected failure" ++ $XT_MULTI ebtables -t filter -L ++ exit 1 ++fi ++ ++$XT_MULTI ebtables -t $t -F || exit 0 +diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +index e18d46551509d..b84f63a7c3672 100755 +--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 ++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +@@ -4,7 +4,7 @@ set -e + #set -x + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + # fill ebtables manually + +diff --git a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 +index 62d224134456b..63891c1bb731a 100755 +--- a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 ++++ b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 +@@ -3,7 +3,7 @@ + set -e + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + # ebtables-restore reuses preloaded targets and matches, make sure defaults + # apply to consecutive rules using the same target/match as a previous one +diff --git a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 +index 46966f433139a..d52db900604ef 100755 +--- a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 ++++ b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 +@@ -3,7 +3,7 @@ + set -e + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + $XT_MULTI ebtables --init-table + $XT_MULTI ebtables -A FORWARD -i nodev123 -o nodev432 -j ACCEPT +diff --git a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 +index 2163d364b318b..0b3acfd7613db 100755 +--- a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 ++++ b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 +@@ -3,7 +3,7 @@ + set -e + + # there is no legacy backend to test +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + EXPECT='*filter + :INPUT ACCEPT +diff --git a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 +index 8bf0c2c6c194e..0174b03f4ebc7 100755 +--- a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 ++++ b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 +@@ -231,7 +231,7 @@ for table in nat mangle raw filter;do + done + + case "$XT_MULTI" in +-*/xtables-nft-multi) ++*xtables-nft-multi) + # nft-multi displays chain names in different order, work around this for now + tmpfile2=$(mktemp) + sort "$tmpfile" > "$tmpfile2" +diff --git a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 +index 96a5e66d0ab81..9fc50615b8926 100755 +--- a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 ++++ b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 +@@ -86,7 +86,7 @@ if [ $LINES1 -ne $LINES2 ]; then + fi + + case "$XT_MULTI" in +-*/xtables-nft-multi) ++*xtables-nft-multi) + attempts=$((RANDOM%10)) + attempts=$((attempts+1)) + ;; +diff --git a/iptables/tests/shell/testcases/nft-only/0001compat_0 b/iptables/tests/shell/testcases/nft-only/0001compat_0 +index 4319ea5a6a797..a617c52f53695 100755 +--- a/iptables/tests/shell/testcases/nft-only/0001compat_0 ++++ b/iptables/tests/shell/testcases/nft-only/0001compat_0 +@@ -5,17 +5,18 @@ + # xtables: avoid bogus 'is incompatible' warning + + case "$XT_MULTI" in +-*/xtables-nft-multi) +- nft -v >/dev/null || exit 0 +- nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42; }' || exit 1 +- nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42; }' || exit 1 +- +- $XT_MULTI iptables -L -t filter || exit 1 +- $XT_MULTI ip6tables -L -t filter || exit 1 ++*xtables-nft-multi) + ;; + *) + echo skip $XT_MULTI ++ exit 0 + ;; + esac + ++nft -v >/dev/null || exit 0 ++nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42; }' || exit 1 ++nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42; }' || exit 1 ++ ++$XT_MULTI iptables -L -t filter || exit 1 ++$XT_MULTI ip6tables -L -t filter || exit 1 + exit 0 +diff --git a/iptables/tests/shell/testcases/nft-only/0002invflags_0 b/iptables/tests/shell/testcases/nft-only/0002invflags_0 +index 406b6081a98a4..fe33874dde7f2 100755 +--- a/iptables/tests/shell/testcases/nft-only/0002invflags_0 ++++ b/iptables/tests/shell/testcases/nft-only/0002invflags_0 +@@ -2,7 +2,7 @@ + + set -e + +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + $XT_MULTI iptables -A INPUT -p tcp --dport 53 ! -s 192.168.0.1 -j ACCEPT + $XT_MULTI ip6tables -A INPUT -p tcp --dport 53 ! -s feed:babe::1 -j ACCEPT +diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 +index 67af9fd897410..ccb009e469076 100755 +--- a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 ++++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 +@@ -2,7 +2,7 @@ + + set -e + +-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } + + comment1="foo bar" + comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" +-- +2.27.0 + diff --git a/0022-nft-Drop-pointless-assignment.patch b/0022-nft-Drop-pointless-assignment.patch new file mode 100644 index 0000000..03664c3 --- /dev/null +++ b/0022-nft-Drop-pointless-assignment.patch @@ -0,0 +1,31 @@ +From 056fc7c35441f666952f4fd1d5cf09a6f83e7b89 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Mon, 17 Feb 2020 12:56:24 +0100 +Subject: [PATCH] nft: Drop pointless assignment + +No need to set 'i' to zero here, it is not used before the next +assignment. + +Fixes: 77e6a93d5c9dc ("xtables: add and set "implict" flag on transaction objects") +Signed-off-by: Phil Sutter +(cherry picked from commit ef10c1b8fc1e1f4d4019b2df4fcfb93f71430c85) +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 0287add3fb21f..eb517e0264e5b 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -2810,7 +2810,6 @@ retry: + + nft_refresh_transaction(h); + +- i=0; + list_for_each_entry_safe(err, ne, &h->err_list, head) + mnl_err_list_free(err); + +-- +2.27.0 + diff --git a/0023-iptables-test.py-Fix-host-mode.patch b/0023-iptables-test.py-Fix-host-mode.patch new file mode 100644 index 0000000..32b213a --- /dev/null +++ b/0023-iptables-test.py-Fix-host-mode.patch @@ -0,0 +1,43 @@ +From 109208e73d7448556e62a29f65b9fc0ef2837b32 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 18 Feb 2020 16:43:16 +0100 +Subject: [PATCH] iptables-test.py: Fix --host mode + +In some cases, the script still called repo binaries. Avoid this when in +--host mode to allow testing without the need to compile sources in +beforehand. + +Fixes: 1b5d762c1865e ("iptables-test: Support testing host binaries") +Signed-off-by: Phil Sutter +(cherry picked from commit ba2af278e8836977a8cfb35c54dac60ca9b40000) +Signed-off-by: Phil Sutter +--- + iptables-test.py | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/iptables-test.py b/iptables-test.py +index fdb4e6a3644e4..e986d7a318218 100755 +--- a/iptables-test.py ++++ b/iptables-test.py +@@ -119,8 +119,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns): + elif splitted[0] == EBTABLES: + command = EBTABLES_SAVE + +- path = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE +- command = path + " " + command ++ command = EXECUTEABLE + " " + command + + if netns: + command = "ip netns exec ____iptables-container-test " + command +@@ -165,7 +164,7 @@ def execute_cmd(cmd, filename, lineno): + ''' + global log_file + if cmd.startswith('iptables ') or cmd.startswith('ip6tables ') or cmd.startswith('ebtables ') or cmd.startswith('arptables '): +- cmd = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE + " " + cmd ++ cmd = EXECUTEABLE + " " + cmd + + print("command: {}".format(cmd), file=log_file) + ret = subprocess.call(cmd, shell=True, universal_newlines=True, +-- +2.27.0 + diff --git a/0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch b/0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch new file mode 100644 index 0000000..547424e --- /dev/null +++ b/0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch @@ -0,0 +1,54 @@ +From e0c60af65b142a3c954a9f489bfdfcb1e09125db Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 4 Mar 2020 02:43:27 +0100 +Subject: [PATCH] connlabel: Allow numeric labels even if connlabel.conf exists + +Existing code is a bit quirky: If no connlabel.conf was found, the local +function connlabel_value_parse() is called which tries to interpret +given label as a number. If the config exists though, +nfct_labelmap_get_bit() is called instead which doesn't care about +"undefined" connlabel names. So unless installed connlabel.conf contains +entries for all possible numeric labels, rules added by users may stop +working if a connlabel.conf is created. + +Related man page snippet states: "Using a number always overrides +connlabel.conf", so try numeric parsing and fall back to nfct only if +that failed. + +Fixes: 51340f7b6a110 ("extensions: libxt_connlabel: use libnetfilter_conntrack") +Fixes: 3a3bb480a738a ("extensions: connlabel: Fallback on missing connlabel.conf") +Signed-off-by: Phil Sutter +(cherry picked from commit f56d91bd80f0e86aaad56a32ddc84f373bb80745) +Signed-off-by: Phil Sutter +--- + extensions/libxt_connlabel.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c +index 5a01fe7237bd8..565b8c796b017 100644 +--- a/extensions/libxt_connlabel.c ++++ b/extensions/libxt_connlabel.c +@@ -70,18 +70,15 @@ static int connlabel_value_parse(const char *in) + static void connlabel_mt_parse(struct xt_option_call *cb) + { + struct xt_connlabel_mtinfo *info = cb->data; +- bool have_labelmap = !connlabel_open(); + int tmp; + + xtables_option_parse(cb); + + switch (cb->entry->id) { + case O_LABEL: +- if (have_labelmap) ++ tmp = connlabel_value_parse(cb->arg); ++ if (tmp < 0 && !connlabel_open()) + tmp = nfct_labelmap_get_bit(map, cb->arg); +- else +- tmp = connlabel_value_parse(cb->arg); +- + if (tmp < 0) + xtables_error(PARAMETER_PROBLEM, + "label '%s' not found or invalid value", +-- +2.27.0 + diff --git a/0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch b/0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch new file mode 100644 index 0000000..f8e2d3c --- /dev/null +++ b/0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch @@ -0,0 +1,73 @@ +From ceeef92ea4d1ede8f6a2481fae977b9aba443e00 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Mon, 4 May 2020 19:30:29 +0200 +Subject: [PATCH] nft: Fix leaks in ebt_add_policy_rule() + +The function leaked memory allocated in temporary struct +iptables_command_state, clean it immediately after use. + +In any of the udata-related error cases, allocated nftnl_rule would +leak, fix this by introducing a common error path to goto. + +In regular code path, the allocated nftnl_rule would still leak: +batch_obj_del() does not free rules in NFT_COMPAT_RULE_APPEND jobs, as +they typically sit in cache as well. Policy rules in turn weren't added +to cache: They are created immediately before commit and never +referenced from other rules. Add them now so they are freed just like +regular rules. + +Fixes: aff1162b3e4b7 ("ebtables-nft: Support user-defined chain policies") +Signed-off-by: Phil Sutter +(cherry picked from commit 5fdb447fdfe877bd6236830b4a2507d4d61bc1a1) +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index eb517e0264e5b..a5816824f09d6 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -2884,27 +2884,33 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) + + r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), + nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs); ++ ebt_cs_clean(&cs); ++ + if (!r) + return -1; + + udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN); + if (!udata) +- return -1; ++ goto err_free_rule; + + if (!nftnl_udata_put_u32(udata, UDATA_TYPE_EBTABLES_POLICY, 1)) +- return -1; ++ goto err_free_rule; + + nftnl_rule_set_data(r, NFTNL_RULE_USERDATA, + nftnl_udata_buf_data(udata), + nftnl_udata_buf_len(udata)); + nftnl_udata_buf_free(udata); + +- if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r)) { +- nftnl_rule_free(r); +- return -1; +- } ++ if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r)) ++ goto err_free_rule; ++ ++ /* add the rule to chain so it is freed later */ ++ nftnl_chain_rule_add_tail(r, c); + + return 0; ++err_free_rule: ++ nftnl_rule_free(r); ++ return -1; + } + + int ebt_set_user_chain_policy(struct nft_handle *h, const char *table, +-- +2.27.0 + diff --git a/0026-nft-Fix-leak-when-replacing-a-rule.patch b/0026-nft-Fix-leak-when-replacing-a-rule.patch new file mode 100644 index 0000000..40a81fc --- /dev/null +++ b/0026-nft-Fix-leak-when-replacing-a-rule.patch @@ -0,0 +1,35 @@ +From bb8d1b774e42d56a303f99723410608db3e25ff6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 6 May 2020 13:33:20 +0200 +Subject: [PATCH] nft: Fix leak when replacing a rule + +If nft_rule_append() is called with a reference rule, it is supposed to +insert the new rule at the reference position and then remove the +reference from cache. Instead, it removed the new rule from cache again +right after inserting it. Also, it missed to free the removed rule. + +Fixes: 5ca9acf51adf9 ("xtables: Fix position of replaced rules in cache") +Signed-off-by: Phil Sutter +(cherry picked from commit b199aca80da5741add50cce244492cc005230b66) +Signed-off-by: Phil Sutter +--- + iptables/nft.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index a5816824f09d6..b5bfcf64e51a4 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1376,7 +1376,8 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table, + + if (ref) { + nftnl_chain_rule_insert_at(r, ref); +- nftnl_chain_rule_del(r); ++ nftnl_chain_rule_del(ref); ++ nftnl_rule_free(ref); + } else { + c = nft_chain_find(h, table, chain); + if (!c) { +-- +2.27.0 + diff --git a/0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch b/0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch new file mode 100644 index 0000000..f3bcc98 --- /dev/null +++ b/0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch @@ -0,0 +1,34 @@ +From 9e2217200016ff23bf8646fbd6119eff5079434e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 20 May 2020 01:00:57 +0200 +Subject: [PATCH] doc: libxt_MARK: OUTPUT chain is fine, too + +In order to route packets originating from the host itself based on +fwmark, mangle table's OUTPUT chain must be used. Mention this chain as +alternative to PREROUTING. + +Fixes: c9be7f153f7bf ("doc: libxt_MARK: no longer restricted to mangle table") +Signed-off-by: Phil Sutter +(cherry picked from commit 7f0a69c8fe78da130cc52ea9fc35ffb9cbc2b8ef) +Signed-off-by: Phil Sutter +--- + extensions/libxt_MARK.man | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_MARK.man b/extensions/libxt_MARK.man +index 712fb76f7340c..b2408597e98f1 100644 +--- a/extensions/libxt_MARK.man ++++ b/extensions/libxt_MARK.man +@@ -1,7 +1,7 @@ + This target is used to set the Netfilter mark value associated with the packet. + It can, for example, be used in conjunction with routing based on fwmark (needs +-iproute2). If you plan on doing so, note that the mark needs to be set in the +-PREROUTING chain of the mangle table to affect routing. ++iproute2). If you plan on doing so, note that the mark needs to be set in ++either the PREROUTING or the OUTPUT chain of the mangle table to affect routing. + The mark field is 32 bits wide. + .TP + \fB\-\-set\-xmark\fP \fIvalue\fP[\fB/\fP\fImask\fP] +-- +2.27.0 + diff --git a/0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch b/0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch new file mode 100644 index 0000000..b171345 --- /dev/null +++ b/0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch @@ -0,0 +1,29 @@ +From e6abc8bc94bcbb2de0784fe9cd3a8fd7560726e5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 29 May 2020 16:39:31 +0200 +Subject: [PATCH] tests: shell: Fix syntax in + ipt-restore/0010-noflush-new-chain_0 + +The here-doc statement missed the final delimiter. Worked anyways +because end-of-file would do the trick. + +Fixes: a103fbfadf4c1 ("xtables-restore: Fix parser feed from line buffer") +Signed-off-by: Phil Sutter +(cherry picked from commit fe1cfd89c239cb6ce54f0c7b99ec2eb517db5f12) +Signed-off-by: Phil Sutter +--- + .../tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +index 739e684a21183..2817376ed913e 100755 +--- a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 ++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 +@@ -8,3 +8,4 @@ $XT_MULTI iptables-restore --noflush < - 1.8.4-9 +- Fix for wrong prefix in ip6tables error messages +- Add further fixes from upstream + * Tue Jun 23 2020 Phil Sutter - 1.8.4-8 - Add further fixes from upstream