diff --git a/.gitignore b/.gitignore index b61615f..3814395 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz /iptables-1.8.10.tar.xz.sig +/iptables-1.8.11.tar.xz +/iptables-1.8.11.tar.xz.sig diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch deleted file mode 100644 index 35b5973..0000000 --- a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Oct 2023 17:27:42 +0200 -Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL - pointer - -Chain rename code missed to adjust the num_chains value which is used to -calculate the number of chain index buckets to allocate during an index -rebuild. So with the right number of chains present, the last chain in a -middle bucket being renamed (and ending up in another bucket) triggers -an index rebuild based on false data. The resulting NULL pointer index -bucket then causes a segfault upon reinsertion. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 -Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") -(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) ---- - .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ - libiptc/libiptc.c | 4 +++ - 2 files changed, 36 insertions(+) - create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 - -diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -new file mode 100755 -index 0000000000000..bc473d2511bbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -@@ -0,0 +1,32 @@ -+#!/bin/bash -+# -+# Another funny rename bug in libiptc: -+# If there is a chain index bucket with only a single chain in it and it is not -+# the last one and that chain is renamed, a chain index rebuild is triggered. -+# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an -+# extra index is allocated and remains NULL. The following insert of renamed -+# chain then segfaults. -+ -+( -+ echo "*filter" -+ # first bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-a-$i - [0:0]" -+ done -+ # second bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-b-$i - [0:0]" -+ done -+ # third bucket, just make sure it exists -+ echo ":chain-c-0 - [0:0]" -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore -+ -+# rename all chains of the middle bucket -+( -+ echo "*filter" -+ for ((i = 0; i < 40; i++)); do -+ echo "-E chain-b-$i chain-d-$i" -+ done -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore --noflush -diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c -index e475063367c26..9712a36353b9a 100644 ---- a/libiptc/libiptc.c -+++ b/libiptc/libiptc.c -@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, - return 0; - } - -+ handle->num_chains--; -+ - /* This only unlinks "c" from the list, thus no free(c) */ - iptcc_chain_index_delete_chain(c, handle); - - /* Change the name of the chain */ - strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); - -+ handle->num_chains++; -+ - /* Insert sorted into to list again */ - iptc_insert_chain(handle, c); - diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch deleted file mode 100644 index c384e4b..0000000 --- a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Fri, 3 Nov 2023 17:33:22 +0100 -Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage - -ARPT_ and IPT_INV flags are not interchangeable, e.g.: -define IPT_INV_SRCDEVADDR 0x0080 -define ARPT_INV_SRCDEVADDR 0x0010 - -as these flags can be tested by libarp_foo.so such checks can yield -incorrect results. - -Because arptables-nft uses existing code, e.g. xt_mark, it makes -sense to unify this completely by converting the last users of -ARPT_INV_ constants. - -Note that arptables-legacy does not do run-time module loading via -dlopen(). Functionaliy implemented by "extensions" in the -arptables-legacy git tree are built-in, so this doesn't break -arptables-legacy binaries. - -Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") -Signed-off-by: Florian Westphal -Signed-off-by: Phil Sutter -(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) ---- - extensions/libarpt_mangle.c | 4 ++-- - iptables/nft-arp.c | 2 +- - iptables/xshared.h | 4 +++- - 3 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c -index 765edf34781f3..a846e97ec8f27 100644 ---- a/extensions/libarpt_mangle.c -+++ b/extensions/libarpt_mangle.c -@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! --h-length not allowed for " - "--mangle-mac-s"); -@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! hln not allowed for --mangle-mac-d"); - if (e->arp.arhln != 6) -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index aed39ebdd5166..535dd6b83237b 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, - &args->d.naddrs); - - if ((args->s.naddrs > 1 || args->d.naddrs > 1) && -- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) -+ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) - xtables_error(PARAMETER_PROBLEM, - "! not allowed with multiple" - " source or destination IP addresses"); -diff --git a/iptables/xshared.h b/iptables/xshared.h -index a200e0d620ad3..5586385456a4d 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -80,7 +80,9 @@ struct xtables_target; - #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ - #define EBT_OPTSTRING OPTSTRING_COMMON "hv" - --/* define invflags which won't collide with IPT ones */ -+/* define invflags which won't collide with IPT ones. -+ * arptables-nft does NOT use the legacy ARPT_INV_* defines. -+ */ - #define IPT_INV_SRCDEVADDR 0x0080 - #define IPT_INV_TGTDEVADDR 0x0100 - #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch deleted file mode 100644 index 3386925..0000000 --- a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +++ /dev/null @@ -1,63 +0,0 @@ -From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 7 Nov 2023 19:12:14 +0100 -Subject: [PATCH] ebtables: Fix corner-case noflush restore bug - -Report came from firwalld, but this is actually rather hard to trigger. -Since a regular chain line prevents it, typical dump/restore use-cases -are unaffected. - -Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") -Cc: Eric Garver -Signed-off-by: Phil Sutter -(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) ---- - .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ - iptables/xtables-eb.c | 2 ++ - 2 files changed, 27 insertions(+) - create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 - -diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -new file mode 100755 -index 0000000000000..0def0ac58e7be ---- /dev/null -+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -@@ -0,0 +1,25 @@ -+#!/bin/sh -+# -+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: -+# - with --noflush -+# - a second table after the broute one -+# - A policy command but no chain line for BROUTING chain -+ -+set -e -+ -+case "$XT_MULTI" in -+*xtables-nft-multi) -+ ;; -+*) -+ echo "skip $XT_MULTI" -+ exit 0 -+ ;; -+esac -+ -+$XT_MULTI ebtables-restore --noflush < -Date: Sun, 19 Nov 2023 13:18:26 +0100 -Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused - -Drop the boolean, it was meant to disable some existence checks in -do_parse() prior to the caching rework. Now that do_parse() runs before -any caching is done, the checks in question don't exist anymore so drop -this relict. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) ---- - iptables/xshared.h | 1 - - iptables/xtables-translate.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index 5586385456a4d..c77556a1987dc 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -284,7 +284,6 @@ struct xt_cmd_parse { - bool restore; - int line; - int verbose; -- bool xlate; - struct xt_cmd_parse_ops *ops; - }; - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 88e0a6b639494..c019cd2991305 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - .table = *table, - .restore = restore, - .line = line, -- .xlate = true, - .ops = &h->ops->cmd_parse, - }; - struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch deleted file mode 100644 index c743e75..0000000 --- a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 19 Nov 2023 13:25:36 +0100 -Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON - -Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") -Signed-off-by: Phil Sutter -(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) ---- - iptables/xshared.h | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index c77556a1987dc..815b9d3e98726 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -75,10 +75,10 @@ struct xtables_globals; - struct xtables_rule_match; - struct xtables_target; - --#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" --#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" --#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ --#define EBT_OPTSTRING OPTSTRING_COMMON "hv" -+#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" -+#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" -+#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ -+#define EBT_OPTSTRING OPTSTRING_COMMON "h" - - /* define invflags which won't collide with IPT ones. - * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch deleted file mode 100644 index 07bea3a..0000000 --- a/0006-ebtables-Align-line-number-formatting-with-legacy.patch +++ /dev/null @@ -1,28 +0,0 @@ -From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 21 Nov 2023 22:58:47 +0100 -Subject: [PATCH] ebtables: Align line number formatting with legacy - -Legacy ebtables appends a dot to the number printed in first column if ---Ln flag was given. - -Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") -Signed-off-by: Phil Sutter -(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) ---- - iptables/nft-bridge.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index d9a8ad2b0f373..e414ef5584392 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, - struct iptables_command_state cs = {}; - - if (format & FMT_LINENUMBERS) -- printf("%d ", num); -+ printf("%d. ", num); - - nft_rule_to_ebtables_command_state(h, r, &cs); - __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch deleted file mode 100644 index b088c63..0000000 --- a/0007-man-Do-not-escape-exclamation-marks.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 13:29:17 +0100 -Subject: [PATCH] man: Do not escape exclamation marks - -This appears to be not necessary, also mandoc complains about it: - -| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! - -Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") -Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") -Signed-off-by: Phil Sutter -(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) ---- - extensions/libip6t_DNPT.man | 2 +- - extensions/libip6t_SNPT.man | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man -index 9b060f5b7179b..72c6ae5d422a2 100644 ---- a/extensions/libip6t_DNPT.man -+++ b/extensions/libip6t_DNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the SNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 -diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man -index 97e0071b43cc1..0c926978377a7 100644 ---- a/extensions/libip6t_SNPT.man -+++ b/extensions/libip6t_SNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the DNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch deleted file mode 100644 index c0bbec2..0000000 --- a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 20:21:49 +0100 -Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks - -In order to parse the mask, xtopt_parse_hostmask() calls -xtopt_parse_plenmask() thereby limiting netmask support to prefix -lengths (alternatively specified in IP address notation). - -In order to lift this impractical restriction, make -xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may -fall back to xtopt_parse_mask() which correctly initializes val.hmask -itself and indicates non-CIDR-compatible masks by setting val.hlen to --1. - -So in order to support these odd masks, it is sufficient for -xtopt_parse_plenmask() to skip its mask building from val.hlen value and -take whatever val.hmask contains. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) ---- - libxtables/xtoptions.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index b16bbfbe32311..d91a78f470eda 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - - xtopt_parse_plen(cb); - -+ /* may not be convertible to CIDR notation */ -+ if (cb->val.hlen == (uint8_t)-1) -+ goto out_put; -+ - memset(mask, 0xFF, sizeof(union nf_inet_addr)); - /* This shifting is AF-independent. */ - if (cb->val.hlen == 0) { -@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - mask[1] = htonl(mask[1]); - mask[2] = htonl(mask[2]); - mask[3] = htonl(mask[3]); -+out_put: - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); - } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch deleted file mode 100644 index 7745634..0000000 --- a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 19 Dec 2023 00:56:07 +0100 -Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting - -Parameter 'wait' passed to xtables_lock() signals three modes of -operation, depending on its value: - - 0: --wait not specified, do not wait if lock is busy --1: --wait specified without value, wait indefinitely until lock becomes - free ->0: Wait for 'wait' seconds for lock to become free, abort otherwise - -Since fixed commit, the first two cases were treated the same apart from -calling alarm(0), but that is a nop if no alarm is pending. Fix the code -by requesting a non-blocking flock() in the second case. While at it, -restrict the alarm setup to the third case only. - -Cc: Jethro Beekman -Cc: howardjohn@google.com -Cc: Antonio Ojea -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 -Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") -Signed-off-by: Phil Sutter -(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) ---- - .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ - iptables/xshared.c | 4 +- - 2 files changed, 57 insertions(+), 2 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 -new file mode 100755 -index 0000000000000..4481f966ce435 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 -@@ -0,0 +1,55 @@ -+#!/bin/bash -+ -+case "$XT_MULTI" in -+*xtables-legacy-multi) -+ ;; -+*) -+ echo skip $XT_MULTI -+ exit 0 -+ ;; -+esac -+ -+coproc RESTORE { $XT_MULTI iptables-restore; } -+echo "*filter" >&${RESTORE[1]} -+ -+ -+$XT_MULTI iptables -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 1 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "process waits when it should not" -+ exit 1 -+} -+wait $ipt_pid -+[[ $? -eq 0 ]] && { -+ echo "process exited 0 despite busy lock" -+ exit 1 -+} -+ -+t0=$(date +%s) -+$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT -+t1=$(date +%s) -+[[ $((t1 - t0)) -ge 3 ]] || { -+ echo "wait time not expired" -+ exit 1 -+} -+ -+$XT_MULTI iptables -w -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] || { -+ echo "no indefinite wait" -+ exit 1 -+} -+kill $ipt_pid -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "killed waiting iptables call did not exit in time" -+ exit 1 -+} -+ -+kill $RESTORE_PID -+wait -+exit 0 -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 5f75a0a57a023..690502c457dd0 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -270,7 +270,7 @@ static int xtables_lock(int wait) - return XT_LOCK_FAILED; - } - -- if (wait != -1) { -+ if (wait > 0) { - sigact_alarm.sa_handler = alarm_ignore; - sigact_alarm.sa_flags = SA_RESETHAND; - sigemptyset(&sigact_alarm.sa_mask); -@@ -278,7 +278,7 @@ static int xtables_lock(int wait) - alarm(wait); - } - -- if (flock(fd, LOCK_EX) == 0) -+ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) - return fd; - - if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch deleted file mode 100644 index ea88fa3..0000000 --- a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 17 Dec 2023 13:02:36 +0100 -Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK - -Do as the comment in xtopt_parse_hostmask() claims and omit -XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() -will catch the incompatibility. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) ---- - include/xtables.h | 1 - - libxtables/xtoptions.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/include/xtables.h b/include/xtables.h -index 087a1d600f9ae..9def9b43b6e58 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -61,7 +61,6 @@ struct in_addr; - * %XTTYPE_SYSLOGLEVEL: syslog level by name or number - * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) - * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length -- * (ptr: union nf_inet_addr; only host portion is stored) - * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) - * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) - * %XTTYPE_PORTRC: colon-separated port range (names acceptable), -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d91a78f470eda..ba68056dc99f7 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { - [XTTYPE_STRING] = -1, - [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), - [XTTYPE_HOST] = sizeof(union nf_inet_addr), -- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), - [XTTYPE_PROTOCOL] = sizeof(uint8_t), - [XTTYPE_PORT] = sizeof(uint16_t), - [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch deleted file mode 100644 index f348d59..0000000 --- a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 26 Jan 2024 18:43:10 +0100 -Subject: [PATCH] nft: ruleparse: Add missing braces around ternary - -The expression evaluated the sum before the ternay, consequently not -adding target->size if tgsize was zero. - -Identified by ASAN for a simple rule using standard target: -| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN -| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN -| ================================================================= -| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 -| READ of size 8 at 0x603000000120 thread T0 -| [...] - -Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") -Signed-off-by: Phil Sutter -(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) ---- - iptables/nft-ruleparse.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c -index c8322f936acd9..57fe27276de35 100644 ---- a/iptables/nft-ruleparse.c -+++ b/iptables/nft-ruleparse.c -@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) - if (!target) - return NULL; - -- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; -+ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); - - target->t = xtables_calloc(1, size); - target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch deleted file mode 100644 index 7d9c51f..0000000 --- a/0012-libxtables-Fix-memleak-of-matches-udata.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 31 Jan 2024 14:58:17 +0100 -Subject: [PATCH] libxtables: Fix memleak of matches' udata - -If the extension specifies a non-zero udata_size, field 'udata' points -to an allocated buffer which needs to be freed upon extension deinit. - -Interestingly, this bug was identified by ASAN and missed by valgrind. - -Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") -Signed-off-by: Phil Sutter -(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) ---- - libxtables/xtables.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index ba9ceaeb3da41..0f617d80ae37e 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) - free(matchp->match->m); - matchp->match->m = NULL; - } -+ if (matchp->match->udata_size) { -+ free(matchp->match->udata); -+ matchp->match->udata = NULL; -+ } - if (matchp->match == matchp->match->next) { - free(matchp->match); - matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index e9c3cb0..0000000 --- a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,200 +0,0 @@ -From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:27:03 +0100 -Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges - -While at it, fix xlate output for plain '-m ah' matches: With -ip6tables-translate, one should emit an extdhr exists match since -ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, -a simple 'meta l4proto ah' was missing. - -Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") -Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) - -Conflicts: - extensions/libip6t_ah.t - extensions/libip6t_ah.txlate - extensions/libipt_ah.t - extensions/libipt_ah.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_ah.c | 22 +++++++++++++--------- - extensions/libip6t_ah.t | 1 + - extensions/libip6t_ah.txlate | 6 ++++++ - extensions/libipt_ah.c | 22 ++++++++++++++-------- - extensions/libipt_ah.t | 1 + - extensions/libipt_ah.txlate | 6 ++++++ - 6 files changed, 41 insertions(+), 17 deletions(-) - -diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c -index f35982f379d76..0f95c4735eabd 100644 ---- a/extensions/libip6t_ah.c -+++ b/extensions/libip6t_ah.c -@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) - } - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - if (min == max) - printf("%s:%s%u", name, inv, min); - else -@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - char *space = ""; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); -@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, - } - - if (!space[0]) /* plain '-m ah' */ -- xt_xlate_add(xl, "meta l4proto ah"); -+ xt_xlate_add(xl, "exthdr ah exists"); - - return 1; - } -diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t -index c1898d44cf193..9099bdc9259c3 100644 ---- a/extensions/libip6t_ah.t -+++ b/extensions/libip6t_ah.t -@@ -13,3 +13,4 @@ - -m ah --ahspi 0:invalid;;FAIL - -m ah --ahspi;;FAIL - -m ah;=;OK -+-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate -index cc33ac2718c0c..32c6b7de00937 100644 ---- a/extensions/libip6t_ah.txlate -+++ b/extensions/libip6t_ah.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' - - ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT - nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' -+ -+ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr ah exists counter' -+ -+ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' -diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c -index fec5705ce6f53..39e3013d3e74b 100644 ---- a/extensions/libipt_ah.c -+++ b/extensions/libipt_ah.c -@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) - ahinfo->invflags |= IPT_AH_INV_SPI; - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - printf("%s", name); - if (min == max) { - printf(":%s", inv); -@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); - else - xt_xlate_add(xl, "%u", ahinfo->spis[0]); -+ } else { -+ xt_xlate_add(xl, "meta l4proto ah"); - } - - return 1; -diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t -index cd853865638e8..1aeb607e9e986 100644 ---- a/extensions/libipt_ah.t -+++ b/extensions/libipt_ah.t -@@ -11,3 +11,4 @@ - -m ah --ahspi;;FAIL - -m ah;;FAIL - -p ah -m ah;=;OK -+-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate -index 897c82b5f95c6..baf5a0ae6182a 100644 ---- a/extensions/libipt_ah.txlate -+++ b/extensions/libipt_ah.txlate -@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' - - iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP - nft 'add rule ip filter INPUT ah spi != 50 counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto ah counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 902ade1..0000000 --- a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,117 +0,0 @@ -From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:39:52 +0100 -Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges - -Also translate plain '-m frag' match into an exthdr exists one. - -Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) - -Conflicts: - extensions/libip6t_frag.t - extensions/libip6t_frag.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- - extensions/libip6t_frag.t | 1 + - extensions/libip6t_frag.txlate | 6 ++++++ - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c -index 49c787e709a9e..ed7fe10a4716d 100644 ---- a/extensions/libip6t_frag.c -+++ b/extensions/libip6t_frag.c -@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) - } - } - -+static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_ids(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_ids_match(min, max, invert)) { - printf("%s", name); - if (min == max) - printf(":%s%u", inv, min); -@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, - static void frag_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 -- && fraginfo->ids[1] == 0xFFFFFFFF)) { -- printf("%s --fragid ", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ printf("%s --fragid ", inv_ids ? " !" : ""); - if (fraginfo->ids[0] - != fraginfo->ids[1]) - printf("%u:%u", -@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) - printf(" --fraglast"); - } - -+#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ -+ IP6T_FRAG_MF | IP6T_FRAG_NMF) -+ - static int frag_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_frag *fraginfo = - (struct ip6t_frag *)params->match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "frag id %s", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? -- "!= " : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); - if (fraginfo->ids[0] != fraginfo->ids[1]) - xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], - fraginfo->ids[1]); - else - xt_xlate_add(xl, "%u", fraginfo->ids[0]); - -+ } else if (!(fraginfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr frag exists"); -+ return 1; - } - - /* ignore ineffective IP6T_FRAG_LEN bit */ -diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t -index 299fa03f8845b..58417c90e9217 100644 ---- a/extensions/libip6t_frag.t -+++ b/extensions/libip6t_frag.t -@@ -1,4 +1,5 @@ - :INPUT,FORWARD,OUTPUT -+-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK - -m frag --fragid 1:42;=;OK - -m frag --fraglen 42;=;OK - -m frag --fragres;=;OK -diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate -index 33fc0631dc792..e250587e7682c 100644 ---- a/extensions/libip6t_frag.txlate -+++ b/extensions/libip6t_frag.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' - - ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT - nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' -+ -+ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr frag exists counter' -+ -+ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 1afcc54..0000000 --- a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,111 +0,0 @@ -From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:42:10 +0100 -Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges - -Also translate '-m mh' into an exthdr exists match unless '-p mh' is -also present. The latter is converted into 'meta l4proto mh' which might -need fixing itself at a later point. - -Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) - -Conflicts: - extensions/libip6t_mh.t - extensions/libip6t_mh.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_mh.c | 20 ++++++++++++++++---- - extensions/libip6t_mh.t | 1 + - extensions/libip6t_mh.txlate | 9 +++++++++ - 3 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 1410d324b5d42..3f80e28ec94c8 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - enum { - O_MH_TYPE = 0, -@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) - printf("%s", name); - } - -+static bool skip_types_match(uint8_t min, uint8_t max, bool inv) -+{ -+ return min == 0 && max == UINT8_MAX && !inv; -+} -+ - static void print_types(uint8_t min, uint8_t max, int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFF || invert) { -+ if (!skip_types_match(min, max, invert)) { - printf(" "); - if (min == max) { - printf("%s", inv); -@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, - static void mh_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) - return; - -- if (mhinfo->invflags & IP6T_MH_INV_TYPE) -+ if (inv_type) - printf(" !"); - - if (mhinfo->types[0] != mhinfo->types[1]) -@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -+ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -+ if (proto != IPPROTO_MH) -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; -+ } - - if (mhinfo->types[0] != mhinfo->types[1]) - xt_xlate_add(xl, "mh type %s%u-%u", -diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t -index 6b76d13d0a00f..be5439edc9520 100644 ---- a/extensions/libip6t_mh.t -+++ b/extensions/libip6t_mh.t -@@ -4,3 +4,4 @@ - -p mobility-header -m mh --mh-type 1;=;OK - -p mobility-header -m mh ! --mh-type 4;=;OK - -p mobility-header -m mh --mh-type 4:123;=;OK -+-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 4dfaf46a2b8d7..3364ce574468f 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac - - ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' -+ -+ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+ -+ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' -+ -+ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index c9ec110..0000000 --- a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:45:42 +0100 -Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges - -Also translate plain '-m rt' match into an exthdr exists one. - -Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) - -Conflicts: - extensions/libip6t_rt.t - extensions/libip6t_rt.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- - extensions/libip6t_rt.t | 1 + - extensions/libip6t_rt.txlate | 9 +++++++++ - 3 files changed, 30 insertions(+), 8 deletions(-) - -diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c -index d5b0458bb397e..6db09f0b2cdc8 100644 ---- a/extensions/libip6t_rt.c -+++ b/extensions/libip6t_rt.c -@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) - } - } - -+static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_nums(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_segsleft_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, - static void rt_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - printf("%s --rt-type %u", -@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 -- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- printf("%s --rt-segsleft ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); - if (rtinfo->segsleft[0] - != rtinfo->segsleft[1]) - printf("%u:%u", -@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - - } - -+#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ -+ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) -+ - static int rt_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - xt_xlate_add(xl, "rt type%s %u", -@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "rt seg-left%s ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); - - if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) - xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], - rtinfo->segsleft[1]); - else - xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); -+ } else if (!(rtinfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr rt exists"); -+ return 1; - } - - if (rtinfo->flags & IP6T_RT_LEN) { -diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t -index 3c7b2d981324a..047b6880e354d 100644 ---- a/extensions/libip6t_rt.t -+++ b/extensions/libip6t_rt.t -@@ -3,3 +3,4 @@ - -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK - -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK - -m rt;=;OK -+-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK -diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate -index 3578bcba0157e..1c2f74a588750 100644 ---- a/extensions/libip6t_rt.txlate -+++ b/extensions/libip6t_rt.txlate -@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' - - ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT - nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' -+ -+ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 318d9eb..0000000 --- a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,119 +0,0 @@ -From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:47:09 +0100 -Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges - -Also add a translation for plain '-m esp' match which depends on the -address family: While ip6tables-translate may emit an exthdr exists -match, iptables-translate must stick to meta l4proto. - -Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) - -Conflicts: - extensions/libxt_esp.t - extensions/libxt_esp.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_esp.c | 26 ++++++++++++++++++-------- - extensions/libxt_esp.t | 1 + - extensions/libxt_esp.txlate | 12 ++++++++++++ - 3 files changed, 31 insertions(+), 8 deletions(-) - -diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c -index 2c7ff942cb9e0..8e9766d71ed57 100644 ---- a/extensions/libxt_esp.c -+++ b/extensions/libxt_esp.c -@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) - espinfo->invflags |= XT_ESP_INV_SPI; - } - -+static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spis_match(min, max, invert)) { - if (min == max) - printf(" %s:%s%u", name, inv, min); - else -@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void esp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_esp *espinfo = (struct xt_esp *)match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 -- && espinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --espspi ", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ printf("%s --espspi ", inv_spi ? " !" : ""); - if (espinfo->spis[0] - != espinfo->spis[1]) - printf("%u:%u", -@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "esp spi%s", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); - if (espinfo->spis[0] != espinfo->spis[1]) - xt_xlate_add(xl, " %u-%u", espinfo->spis[0], - espinfo->spis[1]); - else - xt_xlate_add(xl, " %u", espinfo->spis[0]); -+ } else if (afinfo->family == NFPROTO_IPV4) { -+ xt_xlate_add(xl, "meta l4proto esp"); -+ } else if (afinfo->family == NFPROTO_IPV6) { -+ xt_xlate_add(xl, "exthdr esp exists"); -+ } else { -+ return 0; - } - - return 1; -diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t -index 92c5779f860f1..37259d6b3a08f 100644 ---- a/extensions/libxt_esp.t -+++ b/extensions/libxt_esp.t -@@ -4,5 +4,6 @@ - -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK - -p esp -m esp ! --espspi 0:4294967294;=;OK - -p esp -m esp --espspi -1;;FAIL -+-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK - -p esp -m esp;=;OK - -m esp;;FAIL -diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate -index f6aba52f52235..5e8fb241beaf4 100644 ---- a/extensions/libxt_esp.txlate -+++ b/extensions/libxt_esp.txlate -@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' - - iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP - nft 'add rule ip filter INPUT esp spi 500-600 counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto esp counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch deleted file mode 100644 index 316e5dd..0000000 --- a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:57:46 +0100 -Subject: [PATCH] extensions: ipcomp: Save inverted full ranges - -Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") -Signed-off-by: Phil Sutter -(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) - -Conflicts: - extensions/libxt_ipcomp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_ipcomp.c | 7 ++++--- - extensions/libxt_ipcomp.t | 1 + - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c -index 4171c4a1c4eb7..961c17e584933 100644 ---- a/extensions/libxt_ipcomp.c -+++ b/extensions/libxt_ipcomp.c -@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, - static void comp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; -+ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; - - if (!(compinfo->spis[0] == 0 -- && compinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ipcompspi ", -- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); -+ && compinfo->spis[1] == UINT32_MAX -+ && !inv_spi)) { -+ printf("%s --ipcompspi ", inv_spi ? " !" : ""); - if (compinfo->spis[0] - != compinfo->spis[1]) - printf("%u:%u", -diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t -index 8546ba9ce416f..47c1fbc220c6a 100644 ---- a/extensions/libxt_ipcomp.t -+++ b/extensions/libxt_ipcomp.t -@@ -1,3 +1,4 @@ - :INPUT,OUTPUT - -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK - -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK -+-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch deleted file mode 100644 index cfeacd5..0000000 --- a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 2 Feb 2024 13:14:29 +0100 -Subject: [PATCH] nft: Do not omit full ranges if inverted - -Otherwise this turns a never matching rule into an always matching one. - -Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") -Signed-off-by: Phil Sutter -(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_udp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_tcp.t | 2 ++ - extensions/libxt_udp.t | 2 ++ - iptables/nft.c | 4 ++-- - 3 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 7a3bbd08952f0..3caa3e3f50271 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,6 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index f534770191a6e..aa2c91770e63f 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,6 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK -+-p udp -m udp ! --sport :;-p udp -m udp;OK -+-p udp -m udp ! --dport :;-p udp -m udp;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/iptables/nft.c b/iptables/nft.c -index 97fd4f49fdb4c..8e7a38ac93a3e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return 0; - } - -- if (src[0] || src[1] < 0xffff) { -+ if (src[0] || src[1] < UINT16_MAX || invert_src) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); - if (!expr) - return -ENOMEM; -@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return ret; - } - -- if (dst[0] || dst[1] < 0xffff) { -+ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); - if (!expr) - return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 326544f..0000000 --- a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 17:42:12 +0100 -Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges - -Also translate a bare '-m tcp/udp' to 'meta l4proto' match. - -Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") -Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_tcp.txlate - extensions/libxt_udp.t - extensions/libxt_udp.txlate -- Context change due to Missing commits adding test cases. ---- - extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- - extensions/libxt_tcp.t | 4 ++-- - extensions/libxt_tcp.txlate | 6 +++++ - extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- - extensions/libxt_udp.t | 4 ++-- - extensions/libxt_udp.txlate | 6 +++++ - 6 files changed, 72 insertions(+), 39 deletions(-) - -diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c -index f82572828649b..32bbd684fd5d7 100644 ---- a/extensions/libxt_tcp.c -+++ b/extensions/libxt_tcp.c -@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void tcp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; - -- if (tcpinfo->spts[0] != 0 -- || tcpinfo->spts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (tcpinfo->spts[0] - != tcpinfo->spts[1]) -@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) - tcpinfo->spts[0]); - } - -- if (tcpinfo->dpts[0] != 0 -- || tcpinfo->dpts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (tcpinfo->dpts[0] - != tcpinfo->dpts[1]) -@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, - { - const struct xt_tcp *tcpinfo = - (const struct xt_tcp *)params->match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; -+ bool xlated = false; - -- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { - if (tcpinfo->spts[0] != tcpinfo->spts[1]) { - xt_xlate_add(xl, "tcp sport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0], tcpinfo->spts[1]); - } else { - xt_xlate_add(xl, "tcp sport %s%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { - if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { - xt_xlate_add(xl, "tcp dport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0], tcpinfo->dpts[1]); - } else { - xt_xlate_add(xl, "tcp dport %s%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->option) -+ if (tcpinfo->option) { - xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, - tcpinfo->invflags & XT_TCP_INV_OPTION ? - "missing" : "exists"); -+ xlated = true; -+ } - - if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "tcp flags %s", -@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, - print_tcp_xlate(xl, tcpinfo->flg_cmp); - xt_xlate_add(xl, " / "); - print_tcp_xlate(xl, tcpinfo->flg_mask); -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto tcp"); -+ - return 1; - } - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 3caa3e3f50271..8baeeff2fc94b 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,8 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ---p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ---p tcp -m tcp ! --dport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate -index 9802ddfe0039e..b3ddcc15833cf 100644 ---- a/extensions/libxt_tcp.txlate -+++ b/extensions/libxt_tcp.txlate -@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' - - iptables-translate -A INPUT -p tcp ! --tcp-option 23 - nft 'add rule ip filter INPUT tcp option 23 missing counter' -+ -+iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' -+ -+iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' -diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c -index ba1c3eb768592..748d418039c3a 100644 ---- a/extensions/libxt_udp.c -+++ b/extensions/libxt_udp.c -@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void udp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_udp *udpinfo = (struct xt_udp *)match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; - -- if (udpinfo->spts[0] != 0 -- || udpinfo->spts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_SRCPT) -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (udpinfo->spts[0] - != udpinfo->spts[1]) -@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) - udpinfo->spts[0]); - } - -- if (udpinfo->dpts[0] != 0 -- || udpinfo->dpts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_DSTPT) -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (udpinfo->dpts[0] - != udpinfo->dpts[1]) -@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; -+ bool xlated = false; - -- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { - if (udpinfo->spts[0] != udpinfo->spts[1]) { - xt_xlate_add(xl,"udp sport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0], udpinfo->spts[1]); - } else { - xt_xlate_add(xl, "udp sport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0]); - } -+ xlated = true; - } - -- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { - if (udpinfo->dpts[0] != udpinfo->dpts[1]) { - xt_xlate_add(xl,"udp dport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0], udpinfo->dpts[1]); - } else { - xt_xlate_add(xl,"udp dport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0]); - } -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto udp"); -+ - return 1; - } - -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index aa2c91770e63f..0cde6ac30cc15 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,8 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ---p udp -m udp ! --sport :;-p udp -m udp;OK ---p udp -m udp ! --dport :;-p udp -m udp;OK -+-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK -+-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate -index 28e7ca206b26b..d6bbb96f5d744 100644 ---- a/extensions/libxt_udp.txlate -+++ b/extensions/libxt_udp.txlate -@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep - - iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT - nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' -+ -+iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' -+ -+iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch deleted file mode 100644 index 46c636c..0000000 --- a/0021-nft-Fix-for-broken-recover_rule_compat.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 27 Feb 2024 18:47:39 +0100 -Subject: [PATCH] nft: Fix for broken recover_rule_compat() - -When IPv4 rule generator was changed to emit payload instead of -meta expressions for l4proto matches, the code reinserting -NFTNL_RULE_COMPAT_* attributes into rules being reused for counter -zeroing was broken by accident. - -Make rule compat recovery aware of the alternative match, basically -reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules -with NFTA_RULE_COMPAT") but add a test case this time to make sure -things stay intact. - -Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") -Signed-off-by: Phil Sutter -(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) ---- - iptables/nft.c | 27 ++++++++++++++++--- - .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ - 2 files changed, 35 insertions(+), 4 deletions(-) - create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8e7a38ac93a3e..42907a431a99e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) - return strerror(err); - } - -+static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) -+{ -+ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); -+ uint32_t poff = offsetof(struct iphdr, protocol); -+ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; -+ -+ if (!strcmp(name, "payload") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); -+ return 0; -+ } -+ if (!strcmp(name, "meta") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -+ return 0; -+ } -+ return -1; -+} -+ - static int recover_rule_compat(struct nftnl_rule *r) - { - struct nftnl_expr_iter *iter; -@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) - if (!e) - goto out; - -- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || -- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) -+ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ -+ if (l4proto_expr_get_dreg(e, ®) < 0) - goto next_expr; - -- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -- - e = nftnl_expr_iter_next(iter); - if (!e) - goto out; -diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -new file mode 100755 -index 0000000000000..e276a953234cf ---- /dev/null -+++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -@@ -0,0 +1,12 @@ -+#!/bin/bash -+ -+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } -+ -+set -e -+ -+rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" -+for cmd in iptables ip6tables; do -+ $XT_MULTI $cmd -t mangle -A PREROUTING $rule -+ $XT_MULTI $cmd -t mangle -Z -+ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" -+done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch deleted file mode 100644 index 0be13ca..0000000 --- a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 5 Mar 2024 17:02:56 +0100 -Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match - -Since core xlate code now ignores '-p mh' if an mh extension is also -present in the rule, mh extension has to emit the l4proto match itself. -Therefore emit the exthdr match irrespective of '-p' argument value just -like other IPv6 extension header matches do. - -Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") -Signed-off-by: Phil Sutter -(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) ---- - extensions/libip6t_mh.c | 4 +--- - extensions/libip6t_mh.txlate | 2 +- - 2 files changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 3f80e28ec94c8..1a1cee832b584 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; - bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - - if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -- if (proto != IPPROTO_MH) -- xt_xlate_add(xl, "exthdr mh exists"); -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; - } - -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 3364ce574468f..7eeaeefab6116 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' - - ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT --nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' - - ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT - nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch deleted file mode 100644 index a5e7994..0000000 --- a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 9 Apr 2024 13:18:12 +0200 -Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option - -Calling iptables with '-c ""' resulted in a call to strchr() with an -invalid pointer as 'optarg + 1' points to past the buffer. The most -simple fix is to drop the offset: The global optstring part specifies a -single colon after 'c', so getopt() enforces a valid pointer in optarg. -If it contains a comma at first position, packet counter value parsing -will fail so all cases are covered. - -Reported-by: gorbanev.es@gmail.com -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 -Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") -Signed-off-by: Phil Sutter -(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) ---- - extensions/iptables.t | 5 +++++ - iptables/xshared.c | 2 +- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/extensions/iptables.t b/extensions/iptables.t -index b4b6d677abab1..5d6d3d15cc5fd 100644 ---- a/extensions/iptables.t -+++ b/extensions/iptables.t -@@ -4,3 +4,8 @@ - -i eth+ -o alongifacename+;=;OK - ! -i eth0;=;OK - ! -o eth+;=;OK -+-c "";;FAIL -+-c ,3;;FAIL -+-c 3,;;FAIL -+-c ,;;FAIL -+-c 2,3 -j ACCEPT;-j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 690502c457dd0..f2e3bc03a2824 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], - set_option(&cs->options, OPT_COUNTERS, &args->invflags, - invert); - args->pcnt = optarg; -- args->bcnt = strchr(args->pcnt + 1, ','); -+ args->bcnt = strchr(args->pcnt, ','); - if (args->bcnt) - args->bcnt++; - if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt deleted file mode 100644 index 2d3b902..0000000 --- a/coreteam-gpg-key-0xD55D978A8A1420E4.txt +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded -660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi -V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 -zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t -Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh -KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 -dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi -WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg -9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj -+IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR -U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB -tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC -VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ -CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 -+ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd -RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 -4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN -IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w -bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf -Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj -QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 -wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb -4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET -tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP -n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV -oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 -o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S -ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU -tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp -HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM -FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ -diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid -R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK -uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv -Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl -UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q -KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO -RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc -wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 -0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ -q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU -k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk -pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY -plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC -qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu -iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p -jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O -ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 -CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag -8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB -bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM -jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR -rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg -3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ -7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 -7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ -yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 -leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 -U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ -rlbu70nh2kSJrg== -=wukb ------END PGP PUBLIC KEY BLOCK----- diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt new file mode 100644 index 0000000..cd4a35b --- /dev/null +++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E +o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+ +2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w +nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ +P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF +qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK +5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz +ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX +u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT +/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b +cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L +LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF +8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL +5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK +AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi +Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR +VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF +RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B +uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE +zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq +ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v +3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X +iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi +wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/ +UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj +M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm +97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E +FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW +IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb +0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF +GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu +bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8 +QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD +Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU +3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR +yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS +C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K +klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I +zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST +Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM +X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh +5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB +woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT +njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl +yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU +hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv +BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj +ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh +hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP +tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s +E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H +fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv +CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT +EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ +gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC +9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W +oD8ElPP+m/v6iA== +=70vD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 90ba23e..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,41 +10,27 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.10 -Release: 15%{?dist} +Version: 1.8.11 +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig -Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt Source3: iptables.init Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-nft-helper - -Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch -Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch -Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch -Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch -Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch -Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch -Patch007: 0007-man-Do-not-escape-exclamation-marks.patch -Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch -Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch -Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch -Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch -Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch -Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch -Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch -Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch -Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch -Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch -Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch -Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch -Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch -Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch -Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch -Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch +Source8: arptables-helper +Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -81,6 +67,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -89,12 +76,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -118,9 +100,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 @@ -154,6 +135,14 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -184,13 +173,11 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -222,16 +209,20 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -258,14 +249,13 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml @@ -277,11 +267,20 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save + +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif %postun legacy if [ $1 -eq 0 ]; then @@ -303,76 +302,93 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $(/dev/null || : +done +%endif + %post services +%systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service %preun services +%systemd_preun arptables.service ebtables.service %systemd_preun iptables.service ip6tables.service %postun services %?ldconfig +%systemd_postun arptables.service ebtables.service %systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ - --slave $pfx6 ip6tables $pfx6-nft \ - --slave $pfx-restore iptables-restore $pfx-nft-restore \ - --slave $pfx-save iptables-save $pfx-nft-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ - --slave $pfx6-save ip6tables-save $pfx6-nft-save + --follower $pfx6 ip6tables $pfx6-nft \ + --follower $pfx-restore iptables-restore $pfx-nft-restore \ + --follower $pfx-save iptables-save $pfx-nft-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \ + --follower $pfx6-save ip6tables-save $pfx6-nft-save pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ - --slave $pfx-save ebtables-save $pfx-nft-save \ - --slave $pfx-restore ebtables-restore $pfx-nft-restore \ - ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} + --follower $pfx-save ebtables-save $pfx-nft-save \ + --follower $pfx-restore ebtables-restore $pfx-nft-restore \ + ${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ - --slave $pfx-save arptables-save $pfx-nft-save \ - --slave $pfx-restore arptables-restore $pfx-nft-restore \ - ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ - ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + --follower $pfx-save arptables-save $pfx-nft-save \ + --follower $pfx-restore arptables-restore $pfx-nft-restore \ + ${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ + ${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ + ${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} + +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif %postun nft if [ $1 -eq 0 ]; then @@ -389,7 +405,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -418,9 +434,13 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING @@ -440,22 +460,59 @@ fi %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %{_sbindir}/ebtables-translate +%{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper +%{_mandir}/man8/arptables-translate* +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + +* Fri Jan 17 2025 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 +- Keep symlinks managed by alternatives under /usr/sbin + +* Sun Jan 12 2025 Zbigniew JÄ™drzejewski-Szmek - 1.8.11-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + +* Fri Nov 08 2024 Phil Sutter - 1.8.11-1 +- new version + * Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 6015b94..1f7b750 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 -SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 +SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2