diff --git a/.gitignore b/.gitignore index 141b2e8..3814395 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,7 @@ /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz +/iptables-1.8.10.tar.xz +/iptables-1.8.10.tar.xz.sig +/iptables-1.8.11.tar.xz +/iptables-1.8.11.tar.xz.sig diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch deleted file mode 100644 index cecd191..0000000 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ /dev/null @@ -1,30 +0,0 @@ -From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security - -Have to pass either a string literal or format string to xt_xlate_add(). - -Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") -Signed-off-by: Phil Sutter -(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) ---- - extensions/libxt_NAT.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c -index da9f22012c5d6..2a6343986d54f 100644 ---- a/extensions/libxt_NAT.c -+++ b/extensions/libxt_NAT.c -@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, - if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) - return 0; - -- xt_xlate_add(xl, tgt); -+ xt_xlate_add(xl, "%s", tgt); - if (strlen(range_str)) - xt_xlate_add(xl, " to %s", range_str); - if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { --- -2.40.0 - diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch deleted file mode 100644 index e676561..0000000 --- a/0002-etc-Drop-xtables.conf.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Jan 2023 16:38:43 +0100 -Subject: [PATCH] etc: Drop xtables.conf - -The file is not used since the commit this one fixes. Also it wasn't -installed until recently, when commit 3822a992bc277 ("Makefile: Fix for -'make distcheck'") added it in the wrong spot in an attempt to reduce -differences between tarballs generated by 'make tarball' and 'make -dist'. - -While being at it, drop stale xtables_config_main() prototype from -xtables-multi.h. - -Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") -Signed-off-by: Phil Sutter -(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) ---- - Makefile.am | 2 +- - etc/xtables.conf | 74 ---------------------------------------- - iptables/xtables-multi.h | 1 - - 3 files changed, 1 insertion(+), 76 deletions(-) - delete mode 100644 etc/xtables.conf - -diff --git a/Makefile.am b/Makefile.am -index 451c3cb2d5887..299ab46d7b8e2 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py - - if ENABLE_NFTABLES - confdir = $(sysconfdir) --dist_conf_DATA = etc/ethertypes etc/xtables.conf -+dist_conf_DATA = etc/ethertypes - endif - - .PHONY: tarball -diff --git a/etc/xtables.conf b/etc/xtables.conf -deleted file mode 100644 -index 3c54ced043d82..0000000000000 ---- a/etc/xtables.conf -+++ /dev/null -@@ -1,74 +0,0 @@ --family ipv4 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family ipv6 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family arp { -- table filter { -- chain INPUT hook NF_ARP_IN prio 0 -- chain OUTPUT hook NF_ARP_OUT prio 0 -- } --} -diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h -index 94c24d5a22c7e..833c11a2ac914 100644 ---- a/iptables/xtables-multi.h -+++ b/iptables/xtables-multi.h -@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); - extern int xtables_eb_main(int, char **); - extern int xtables_eb_restore_main(int, char **); - extern int xtables_eb_save_main(int, char **); --extern int xtables_config_main(int, char **); - extern int xtables_monitor_main(int, char **); - - extern struct xtables_globals arptables_globals; --- -2.40.0 - diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch deleted file mode 100644 index d807c54..0000000 --- a/0003-Proper-fix-for-unknown-argument-error-message.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 01:51:43 +0100 -Subject: [PATCH] Proper fix for "unknown argument" error message - -While commit 1b8210f848631 kind of fixed the corner-case of invalid -short-options packed with others, it broke error reporting for -long-options. Revert it and deploy a proper solution: - -When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long -sets the variable 'optopt' to the invalid character's value. Use it for -reporting instead of optind if set. - -To distinguish between invalid options and missing option arguments, -ebtables-translate optstring needs adjustment. - -Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") -Signed-off-by: Phil Sutter -(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) ---- - .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ - iptables/xshared.c | 9 ++++-- - iptables/xtables-eb-translate.c | 8 ++--- - iptables/xtables-eb.c | 17 ++++++---- - 4 files changed, 50 insertions(+), 15 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -new file mode 100755 -index 0000000000000..ac6e743966196 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -@@ -0,0 +1,31 @@ -+#!/bin/bash -+ -+rc=0 -+ -+check() { -+ local cmd="$1" -+ local msg="$2" -+ -+ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { -+ echo "cmd: $XT_MULTI $1" -+ echo "exp: $msg" -+ echo "res: $($XT_MULTI $cmd 2>&1)" -+ rc=1 -+ } -+} -+ -+cmds="iptables ip6tables" -+[[ $XT_MULTI == *xtables-nft-multi ]] && { -+ cmds+=" ebtables" -+ cmds+=" iptables-translate" -+ cmds+=" ip6tables-translate" -+ cmds+=" ebtables-translate" -+} -+ -+for cmd in $cmds; do -+ check "${cmd} --foo" 'unknown option "--foo"' -+ check "${cmd} -A" 'option "-A" requires an argument' -+ check "${cmd} -aL" 'unknown option "-a"' -+done -+ -+exit $rc -diff --git a/iptables/xshared.c b/iptables/xshared.c -index f93529b11a319..ac51fac5ce9ed 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, - if (cs->c == ':') - xtables_error(PARAMETER_PROBLEM, "option \"%s\" " - "requires an argument", cs->argv[optind-1]); -- if (cs->c == '?') -- xtables_error(PARAMETER_PROBLEM, "unknown option " -- "\"%s\"", cs->argv[optind-1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } - xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - -diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c -index 13b6b864a5f24..0c35272051752 100644 ---- a/iptables/xtables-eb-translate.c -+++ b/iptables/xtables-eb-translate.c -@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - printf("nft "); - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, -- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { -+ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { - cs.c = c; - switch (c) { - case 'A': /* Add a rule */ -@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind - 1]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D') -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 7214a767ffe96..412b5cccdc46a 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) - return 0; - } - } -- return 1; -+ if (cs->c == ':') -+ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " -+ "requires an argument", cs->argv[optind - 1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } -+ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - - int nft_init_eb(struct nft_handle *h, const char *pname) -@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D' && command != 'C' && command != 14) --- -2.40.0 - diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch deleted file mode 100644 index c41ba45..0000000 --- a/0004-ebtables-Refuse-unselected-targets-options.patch +++ /dev/null @@ -1,232 +0,0 @@ -From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 02:01:56 +0100 -Subject: [PATCH] ebtables: Refuse unselected targets' options - -Unlike legacy, ebtables-nft would allow e.g.: - -| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be - -While the result is correct, it may mislead users into believing -multiple targets are possible per rule. Better follow legacy's behaviour -and reject target options unless they have been "enabled" by a previous -'-j' option. - -To achieve this, one needs to distinguish targets from watchers also -attached to 'xtables_targets' and otherwise behaving like regular -matches. Introduce XTABLES_EXT_WATCHER to mark the two. - -The above works already, but error messages are misleading when using -the now unsupported syntax since target options have been merged -already. Solve this by not pre-loading the targets at all, code will -just fall back to loading ad '-j' parsing time as iptables does. - -Note how this also fixes for 'counter' statement being in wrong position -of ebtables-translate output. - -Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") -Signed-off-by: Phil Sutter -(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) ---- - extensions/libebt_dnat.txlate | 12 ++++---- - extensions/libebt_log.c | 1 + - extensions/libebt_mark.txlate | 16 +++++----- - extensions/libebt_nflog.c | 1 + - extensions/libebt_snat.txlate | 8 ++--- - include/xtables.h | 1 + - .../ebtables/0002-ebtables-save-restore_0 | 4 +-- - iptables/xtables-eb.c | 29 +++++++------------ - 8 files changed, 33 insertions(+), 39 deletions(-) - -diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate -index 9f305c76c954f..531a22aa3e14f 100644 ---- a/extensions/libebt_dnat.txlate -+++ b/extensions/libebt_dnat.txlate -@@ -1,8 +1,8 @@ --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' -diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c -index 045062196d20d..9f8d158956802 100644 ---- a/extensions/libebt_log.c -+++ b/extensions/libebt_log.c -@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, - static struct xtables_target brlog_target = { - .name = "log", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_log_info)), -diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate -index d006e8ac94008..4ace1a1f5cfde 100644 ---- a/extensions/libebt_mark.txlate -+++ b/extensions/libebt_mark.txlate -@@ -1,11 +1,11 @@ --ebtables-translate -A INPUT --mark-set 42 --nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-set 42 -+nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' - --ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN --nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' -+ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN -+nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' - --ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT --nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT -+nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' - --ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP --nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' -+ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP -+nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' -diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c -index 115e15da45845..762d6d5d8bbe2 100644 ---- a/extensions/libebt_nflog.c -+++ b/extensions/libebt_nflog.c -@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, - static struct xtables_target brnflog_watcher = { - .name = "nflog", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), -diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate -index 857a6052aed1a..37343d3a14754 100644 ---- a/extensions/libebt_snat.txlate -+++ b/extensions/libebt_snat.txlate -@@ -1,5 +1,5 @@ --ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff --nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff -+nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE --nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE -+nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' -diff --git a/include/xtables.h b/include/xtables.h -index 4ffc8ec5a17e9..087a1d600f9ae 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -203,6 +203,7 @@ struct xtables_lmap { - - enum xtables_ext_flags { - XTABLES_EXT_ALIAS = 1 << 0, -+ XTABLES_EXT_WATCHER = 1 << 1, - }; - - struct xt_xlate; -diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -index 1091a4e80bebe..b4f9728bb9b6f 100755 ---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT - - $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT - $XT_MULTI ebtables -A foo --log --$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT -+$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT - $XT_MULTI ebtables -A foo --nflog - $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT - $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT -@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo - $XT_MULTI ebtables -N bar - $XT_MULTI ebtables -P bar RETURN - --$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT -+$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT - #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 - - $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 412b5cccdc46a..3a73e79725489 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void __ebt_load_watcher(const char *name, const char *typename) -+static void ebt_load_watcher(const char *name) - { - struct xtables_target *watcher; - size_t size; - - watcher = xtables_find_target(name, XTF_TRY_LOAD); - if (!watcher) { -- fprintf(stderr, "Unable to load %s %s\n", name, typename); -+ fprintf(stderr, "Unable to load %s watcher\n", name); - return; - } - -@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void ebt_load_watcher(const char *name) --{ -- return __ebt_load_watcher(name, "watcher"); --} -- --static void ebt_load_target(const char *name) --{ -- return __ebt_load_watcher(name, "target"); --} -- - void ebt_load_match_extensions(void) - { - opts = ebt_original_options; -@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) - - ebt_load_watcher("log"); - ebt_load_watcher("nflog"); -- -- ebt_load_target("mark"); -- ebt_load_target("dnat"); -- ebt_load_target("snat"); -- ebt_load_target("arpreply"); -- ebt_load_target("redirect"); -- ebt_load_target("standard"); - } - - void ebt_add_match(struct xtables_match *m, -@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) - - /* Is it a watcher option? */ - for (t = xtables_targets; t; t = t->next) { -+ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) -+ continue; -+ - if (t->parse && - t->parse(cs->c - t->option_offset, cs->argv, - ebt_invert, &t->tflags, NULL, &t->t)) { -@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - optind = 0; - opterr = false; - -+ for (t = xtables_targets; t; t = t->next) { -+ t->tflags = 0; -+ t->used = 0; -+ } -+ - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, EBT_OPTSTRING, - opts, NULL)) != -1) { --- -2.40.0 - diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch deleted file mode 100644 index dd58948..0000000 --- a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:48:33 +0100 -Subject: [PATCH] tests: xlate: Properly split input in replay mode - -Source command may contain quotes, using shlex.split() does the right -thing there. - -Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") -Signed-off-by: Phil Sutter -(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) ---- - xlate-test.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/xlate-test.py b/xlate-test.py -index 4cb1401b71677..217d2f0062682 100755 ---- a/xlate-test.py -+++ b/xlate-test.py -@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' - if sourceline.find(';') >= 0: - sourceline, searchline = sourceline.split(';') - -- srcwords = sourceline.split() -+ srcwords = shlex.split(sourceline) - - srccmd = srcwords[0] - ipt = srccmd.split('-')[0] --- -2.40.0 - diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch deleted file mode 100644 index b2f5481..0000000 --- a/0006-extensions-libebt_redirect-Fix-target-translation.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 22:28:24 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix target translation - -While EBT_ACCEPT is the default verdict for ebtables targets, omitting -it from translation implicitly converts it into 'continue'. Omit the -non-default EBT_CONTINUE instead. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 8 ++++++++ - 2 files changed, 9 insertions(+), 1 deletion(-) - create mode 100644 extensions/libebt_redirect.txlate - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 4d4c7a02cea89..389f3ccb53f60 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, - const struct ebt_redirect_info *red = (const void*)params->target->data; - - xt_xlate_add(xl, "meta set pkttype host"); -- if (red->target != EBT_ACCEPT) -+ if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; - } -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -new file mode 100644 -index 0000000000000..f0dd5deaf6406 ---- /dev/null -+++ b/extensions/libebt_redirect.txlate -@@ -0,0 +1,8 @@ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' --- -2.40.0 - diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch deleted file mode 100644 index 8f8dcf6..0000000 --- a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 23:32:50 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in - translation - -Meta key comes before 'set' in meta statement. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 6 +++--- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 389f3ccb53f60..7821935e137aa 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, - { - const struct ebt_redirect_info *red = (const void*)params->target->data; - -- xt_xlate_add(xl, "meta set pkttype host"); -+ xt_xlate_add(xl, "meta pkttype set host"); - if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -index f0dd5deaf6406..d073ec774c4fa 100644 ---- a/extensions/libebt_redirect.txlate -+++ b/extensions/libebt_redirect.txlate -@@ -1,8 +1,8 @@ - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' --- -2.40.0 - diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch deleted file mode 100644 index ad5a3ee..0000000 --- a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:58:36 +0100 -Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation - -Converting from TOS field match to DSCP one is irreversible, so replay -testing is not possible. Use a raw payload expression to produce -something that translates 1:1 back into an 'ip' match. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) ---- - extensions/libebt_ip.c | 4 ++-- - extensions/libebt_ip.txlate | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index fd87dae7e2c62..8b381aa10b5b7 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_DEST); - - if (info->bitmask & EBT_IP_TOS) { -- xt_xlate_add(xl, "ip dscp "); -+ xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) - xt_xlate_add(xl, "!= "); -- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ -+ xt_xlate_add(xl, "0x%02x ", info->tos); - } - if (info->bitmask & EBT_IP_PROTO) { - struct protoent *pe; -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 75c1db246fb81..562e3157d7b92 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 - nft 'add rule bridge filter FORWARD tcp dport 22 counter' --- -2.40.0 - diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch deleted file mode 100644 index 96cb5ad..0000000 --- a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 17:37:40 +0100 -Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type - -On one hand, nft refuses th expression in bridge family if layer3 -protocol has not been assured by a previous match. On the other, ebt_ip -kernel module will only match on IPv4 packets, so there might be a -functional change in the translation versus the original. - -Instead of just always emitting an 'ether type' match, decide whether -it's actually needed - explicit "ip " payload matches (or -icmp ones) cause implicit creation of a match on IPv4 by nft. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) ---- - extensions/libebt_ip.c | 21 +++++++++++++++++++++ - extensions/libebt_ip.txlate | 6 +++--- - 2 files changed, 24 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index 8b381aa10b5b7..68f34bff97deb 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, - xtables_ipmask_to_numeric(maskp)); - } - -+static bool may_skip_ether_type_dep(uint8_t flags) -+{ -+ /* these convert to "ip (s|d)addr" matches */ -+ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) -+ return true; -+ -+ /* icmp match triggers implicit ether type dependency in nft */ -+ if (flags & EBT_IP_ICMP) -+ return true; -+ -+ /* allow if "ip protocol" match is created by brip_xlate() */ -+ if (flags & EBT_IP_PROTO && -+ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) -+ return true; -+ -+ return false; -+} -+ - static int brip_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { -@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_SOURCE); - brip_xlate_nh(xl, info, EBT_IP_DEST); - -+ if (!may_skip_ether_type_dep(info->bitmask)) -+ xt_xlate_add(xl, "ether type ip "); -+ - if (info->bitmask & EBT_IP_TOS) { - xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 562e3157d7b92..28996832225cb 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 --nft 'add rule bridge filter FORWARD tcp dport 22 counter' -+nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 --nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' -+nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto 253 - nft 'add rule bridge filter FORWARD ip protocol 253 counter' --- -2.40.0 - diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch deleted file mode 100644 index 410a831..0000000 --- a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Tue, 21 Feb 2023 12:19:42 -0500 -Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help - -Add the missing chunk types in sctp_help(), so that the help cmd can -display these chunk types as below: - - # iptables -p sctp --help - - chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE - -Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") -Signed-off-by: Xin Long -Signed-off-by: Phil Sutter -(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) ---- - extensions/libxt_sctp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index fe5f5621a033d..6e2b2745dcbd5 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -50,7 +50,7 @@ static void sctp_help(void) - " --dport ...\n" - "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" - " chunktypes are present\n" --"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); -+"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); - } - - static const struct option sctp_opts[] = { --- -2.40.0 - diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch deleted file mode 100644 index e0915f5..0000000 --- a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 22 Feb 2023 16:36:16 +0100 -Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h - -When merging IP-version-specific LOG extensions, a dependency to that -header was introduced without caching it. Fix this and drop the now -unused ip{,6}t_LOG.h files. - -Reported-by: Thomas Devoogdt -Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") -Signed-off-by: Phil Sutter -(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) ---- - include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ - include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- - include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- - 3 files changed, 20 insertions(+), 38 deletions(-) - create mode 100644 include/linux/netfilter/xt_LOG.h - delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h - delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h - -diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h -new file mode 100644 -index 0000000000000..167d4ddd2476b ---- /dev/null -+++ b/include/linux/netfilter/xt_LOG.h -@@ -0,0 +1,20 @@ -+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -+#ifndef _XT_LOG_H -+#define _XT_LOG_H -+ -+/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ -+#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ -+#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ -+#define XT_LOG_IPOPT 0x04 /* Log IP options */ -+#define XT_LOG_UID 0x08 /* Log UID owning local socket */ -+#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ -+#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ -+#define XT_LOG_MASK 0x2f -+ -+struct xt_log_info { -+ unsigned char level; -+ unsigned char logflags; -+ char prefix[30]; -+}; -+ -+#endif /* _XT_LOG_H */ -diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h -deleted file mode 100644 -index dcdbadf9fd4a9..0000000000000 ---- a/include/linux/netfilter_ipv4/ipt_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IPT_LOG_H --#define _IPT_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IPT_LOG_IPOPT 0x04 /* Log IP options */ --#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ --#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ --#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IPT_LOG_MASK 0x2f -- --struct ipt_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ -diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h -deleted file mode 100644 -index 9dd5579e02ec7..0000000000000 ---- a/include/linux/netfilter_ipv6/ip6t_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IP6T_LOG_H --#define _IP6T_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ --#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ --#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ --#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IP6T_LOG_MASK 0x2f -- --struct ip6t_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ --- -2.40.0 - diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch deleted file mode 100644 index 8b20709..0000000 --- a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Feb 2023 18:09:25 +0100 -Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule - -Combining multiple corner-cases here: - -* Insert a rule before another new one which is not the first. Triggers - NFTNL_RULE_ID assignment of the latter. - -* Delete the referenced new rule in the same batch again. Causes - overwriting of the previously assigned RULE_ID. - -Consequently, iptables-nft-restore fails during *insert*, because the -reference is dangling. - -Reported-by: Eric Garver -Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") -Signed-off-by: Phil Sutter -Tested-by: Eric Garver -(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) ---- - iptables/nft.c | 3 ++- - .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ - 2 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 63468cf3b1344..5896fd410ca78 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) - - nftnl_rule_list_del(r); - -- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) -+ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && -+ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) - nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); - - obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); -diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -index 3f1d229e915ff..5482b7ea17298 100755 ---- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -+++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT - -A FORWARD -m comment --comment "rule 3" -j ACCEPT' - - diff -u -Z <(echo -e "$EXPECT") <(ipt_show) -+ -+# test adding, referencing and deleting the same rule in a batch -+ -+$XT_MULTI iptables-restore < -Date: Mon, 3 Apr 2023 23:13:47 +0200 -Subject: [PATCH] ip6tables: Fix checking existence of rule - -Pass the proper entry size when creating a match mask for checking the -existence of a rule. Failing to do so causes wrong results. - -Reported-by: Jonathan Caicedo -Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") -Signed-off-by: Markus Boehme -Signed-off-by: Phil Sutter -(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) ---- - iptables/ip6tables.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c -index 345af4519bfe7..9afc32c1a21ed 100644 ---- a/iptables/ip6tables.c -+++ b/iptables/ip6tables.c -@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, - int ret = 1; - unsigned char *mask; - -- mask = make_delete_mask(matches, target, sizeof(fw)); -+ mask = make_delete_mask(matches, target, sizeof(*fw)); - for (i = 0; i < nsaddrs; i++) { - fw->ipv6.src = saddrs[i]; - fw->ipv6.smsk = smasks[i]; --- -2.40.0 - diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch deleted file mode 100644 index c4274ca..0000000 --- a/0014-nft-shared-Drop-unused-include.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Mar 2023 16:22:16 +0200 -Subject: [PATCH] nft-shared: Drop unused include - -Code does not refer to struct xt_comment_info anymore. - -Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") -Signed-off-by: Phil Sutter -(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) ---- - iptables/nft-shared.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 4a7b5406892c4..4ba44a4aa4d17 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -22,7 +22,6 @@ - #include - - #include --#include - #include - #include - #include --- -2.40.0 - diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch deleted file mode 100644 index 5474f8a..0000000 --- a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:33:43 +0200 -Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match - -The wrong bit was set in 'invflags', probably due to copy'n'paste from -the previous case. - -Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") -Signed-off-by: Phil Sutter -(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) ---- - iptables/nft-arp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 210f43d2cefbe..8fae5adc50216 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, - fw->arp.arhln = ar_hln; - fw->arp.arhln_mask = 0xff; - if (inv) -- fw->arp.invflags |= IPT_INV_ARPOP; -+ fw->arp.invflags |= IPT_INV_ARPHLN; - break; - case offsetof(struct arphdr, ar_pln): - get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); --- -2.40.0 - diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch deleted file mode 100644 index 1efb846..0000000 --- a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:37:47 +0200 -Subject: [PATCH] arptables: Don't omit standard matches if inverted - -Inverted --h-len and --h-type matches were omitted from output by -accident if they matched on their standard value. - -Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") -Signed-off-by: Phil Sutter -(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) ---- - iptables/nft-arp.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 8fae5adc50216..df3ad430cf701 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - - after_devdst: - -- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { -+ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || -+ fw->arp.invflags & IPT_INV_ARPHLN) { - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN - ? "! " : ""); - printf("--h-length %d", fw->arp.arhln); -@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - sep = " "; - } - -- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { -+ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || -+ fw->arp.invflags & IPT_INV_ARPHRD) { - uint16_t tmp = ntohs(fw->arp.arhrd); - - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD --- -2.40.0 - diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch deleted file mode 100644 index 9c5cbd2..0000000 --- a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +++ /dev/null @@ -1,211 +0,0 @@ -From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:41:08 +0200 -Subject: [PATCH] xshared: Fix parsing of option arguments in same word - -When merging commandline parsers, a decision between 'argv[optind - 1]' -and 'optarg' had to be made in some spots. While the implementation of -check_inverse() required the former, use of the latter allows for the -common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at -the suffix while 'argv[optind - 1]' will just point at the following -option. - -Fix the mess by making check_inverse() update optarg pointer if needed -so calling code may refer to and always correct 'optarg'. - -Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 -Signed-off-by: Phil Sutter -(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) ---- - extensions/libarpt_standard.t | 2 ++ - extensions/libxt_standard.t | 3 ++ - iptables/xshared.c | 61 +++++++++++++++++------------------ - 3 files changed, 35 insertions(+), 31 deletions(-) - -diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t -index e84a00b780488..007fa2b8335e8 100644 ---- a/extensions/libarpt_standard.t -+++ b/extensions/libarpt_standard.t -@@ -12,3 +12,5 @@ - -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK - --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK - ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK -+--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK -+--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK -diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t -index 56d6da2e5884e..6ed978e442b80 100644 ---- a/extensions/libxt_standard.t -+++ b/extensions/libxt_standard.t -@@ -21,3 +21,6 @@ - -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK - -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK - -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK -+:FORWARD -+--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -+-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index ac51fac5ce9ed..17aed04e02b09 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - } - - static void check_inverse(struct xtables_args *args, const char option[], -- bool *invert, int *optidx, int argc) -+ bool *invert, int argc, char **argv) - { - switch (args->family) { - case NFPROTO_ARP: -@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], - xtables_error(PARAMETER_PROBLEM, - "Multiple `!' flags not allowed"); - *invert = true; -- if (optidx) { -- *optidx = *optidx + 1; -- if (argc && *optidx > argc) -- xtables_error(PARAMETER_PROBLEM, -- "no argument following `!'"); -- } -+ optind++; -+ if (optind > argc) -+ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); -+ -+ optarg = argv[optind - 1]; - } - - static const char *optstring_lookup(int family) -@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], - * Option selection - */ - case 'p': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_PROTOCOL, - &args->invflags, invert); - - /* Canonicalize into lower case */ -- for (cs->protocol = argv[optind - 1]; -+ for (cs->protocol = optarg; - *cs->protocol; cs->protocol++) - *cs->protocol = tolower(*cs->protocol); - -- cs->protocol = argv[optind - 1]; -+ cs->protocol = optarg; - args->proto = xtables_parse_protocol(cs->protocol); - - if (args->proto == 0 && -@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], - break; - - case 's': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_SOURCE, - &args->invflags, invert); -- args->shostnetworkmask = argv[optind - 1]; -+ args->shostnetworkmask = optarg; - break; - - case 'd': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_DESTINATION, - &args->invflags, invert); -- args->dhostnetworkmask = argv[optind - 1]; -+ args->dhostnetworkmask = optarg; - break; - - #ifdef IPT_F_GOTO -@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], - #endif - - case 2:/* src-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_S_MAC, &args->invflags, - invert); -- args->src_mac = argv[optind - 1]; -+ args->src_mac = optarg; - break; - - case 3:/* dst-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_D_MAC, &args->invflags, - invert); -- args->dst_mac = argv[optind - 1]; -+ args->dst_mac = optarg; - break; - - case 'l':/* hardware length */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_LENGTH, &args->invflags, - invert); -- args->arp_hlen = argv[optind - 1]; -+ args->arp_hlen = optarg; - break; - - case 8: /* was never supported, not even in arptables-legacy */ - xtables_error(PARAMETER_PROBLEM, "not supported"); - case 4:/* opcode */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_OPCODE, &args->invflags, - invert); -- args->arp_opcode = argv[optind - 1]; -+ args->arp_opcode = optarg; - break; - - case 5:/* h-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_TYPE, &args->invflags, - invert); -- args->arp_htype = argv[optind - 1]; -+ args->arp_htype = optarg; - break; - - case 6:/* proto-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_P_TYPE, &args->invflags, - invert); -- args->arp_ptype = argv[optind - 1]; -+ args->arp_ptype = optarg; - break; - - case 'j': - set_option(&cs->options, OPT_JUMP, &args->invflags, - invert); -- command_jump(cs, argv[optind - 1]); -+ command_jump(cs, optarg); - break; - - case 'i': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEIN, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->iniface, - args->iniface_mask); - break; - - case 'o': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEOUT, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->outiface, - args->outiface_mask); - break; --- -2.40.0 - diff --git a/0018-iptables-Fix-setting-of-ipv6-counters.patch b/0018-iptables-Fix-setting-of-ipv6-counters.patch deleted file mode 100644 index ec72c5e..0000000 --- a/0018-iptables-Fix-setting-of-ipv6-counters.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 935dddbb219eb09a289507e609ff8e9b4429c1ea Mon Sep 17 00:00:00 2001 -From: Jacek Tomasiak -Date: Mon, 19 Jun 2023 12:44:54 +0200 -Subject: [PATCH] iptables: Fix setting of ipv6 counters - -When setting counters using ip6tables-nft -c X Y the X and Y values were -not stored. - -This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but -applied to the nft variant of ipv6 not the legacy. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647 -Fixes: 0391677c1a0b2 ("xtables: add IPv6 support") -Signed-off-by: Jacek Tomasiak -Signed-off-by: Jacek Tomasiak -Signed-off-by: Phil Sutter -(cherry picked from commit ed839159edf8bda8e9196f1056c4038c22d78bfd) ---- - iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 | 6 +++--- - iptables/tests/shell/testcases/iptables/0003-list-rules_0 | 6 +++--- - iptables/xshared.c | 3 +++ - 3 files changed, 9 insertions(+), 6 deletions(-) - -diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 -index c98bdd6e501aa..09e39927ef390 100755 ---- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 -+++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 -@@ -3,7 +3,7 @@ - set -e - - $XT_MULTI ip6tables -N foo --$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -+$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42 - $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo - $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT - -@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0 - -P FORWARD ACCEPT -c 0 0 - -P OUTPUT ACCEPT -c 0 0 - -N foo ---A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT -+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT - -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' - - diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S) -@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT - diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD) - - EXPECT='-P FORWARD ACCEPT -c 0 0 ---A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT -+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT - -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' - - diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD) -diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 -index d335d44257a49..d07bd151be76b 100755 ---- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 -+++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 -@@ -3,7 +3,7 @@ - set -e - - $XT_MULTI iptables -N foo --$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -+$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42 - $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo - $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT - -@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0 - -P FORWARD ACCEPT -c 0 0 - -P OUTPUT ACCEPT -c 0 0 - -N foo ---A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT -+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT - -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' - - diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S) -@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT - diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD) - - EXPECT='-P FORWARD ACCEPT -c 0 0 ---A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT -+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT - -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' - - diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD) -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 17aed04e02b09..71ee94d6f2f83 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1992,6 +1992,9 @@ void ipv6_post_parse(int command, struct iptables_command_state *cs, - if (args->goto_set) - cs->fw6.ipv6.flags |= IP6T_F_GOTO; - -+ /* nft-variants use cs->counters, legacy uses cs->fw6.counters */ -+ cs->counters.pcnt = args->pcnt_cnt; -+ cs->counters.bcnt = args->bcnt_cnt; - cs->fw6.counters.pcnt = args->pcnt_cnt; - cs->fw6.counters.bcnt = args->bcnt_cnt; - --- -2.41.0 - diff --git a/0019-iptables-Fix-handling-of-non-existent-chains.patch b/0019-iptables-Fix-handling-of-non-existent-chains.patch deleted file mode 100644 index 9964ba5..0000000 --- a/0019-iptables-Fix-handling-of-non-existent-chains.patch +++ /dev/null @@ -1,53 +0,0 @@ -From cd3a8274e9e904d227b81ae7158d6e82b1311bf8 Mon Sep 17 00:00:00 2001 -From: Jacek Tomasiak -Date: Mon, 19 Jun 2023 13:46:36 +0200 -Subject: [PATCH] iptables: Fix handling of non-existent chains - -Since 694612adf87 the "compatibility" check considers non-existent -chains as "incompatible". This broke some scripts which used calls -like `iptables -L CHAIN404` to test for chain existence and expect -"No chain/target/match by that name." in the output. - -This patch changes the logic of `nft_is_table_compatible()` to -report non-existent chains as "compatible" which restores the old -behavior. - -Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 -Signed-off-by: Jacek Tomasiak -Signed-off-by: Jacek Tomasiak -Signed-off-by: Phil Sutter -(cherry picked from commit 82ccfb488eeac5507471099b9b4e6d136cc06e3b) ---- - iptables/nft.c | 2 +- - iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 + - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 5896fd410ca78..5e4cd76b05504 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3847,7 +3847,7 @@ bool nft_is_table_compatible(struct nft_handle *h, - if (chain) { - struct nft_chain *c = nft_chain_find(h, table, chain); - -- return c && !nft_is_chain_compatible(c, h); -+ return !c || !nft_is_chain_compatible(c, h); - } - - return !nft_chain_foreach(h, table, nft_is_chain_compatible, h); -diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 -index 33c5f1f35d17f..234f3040516e1 100755 ---- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 -+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 -@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar - cmd 0 -E foo bar - cmd 1 "$EEXIST_F" -E foo bar - cmd 1 "$ENOENT" -E foo bar2 -+cmd 1 "$ENOENT" -L foo - cmd 0 -N foo2 - cmd 1 "$EEXIST_F" -E foo2 bar - --- -2.41.0 - diff --git a/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch b/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch deleted file mode 100644 index e08b22f..0000000 --- a/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 90ca86dfed56510ebc52ab2924800eb28ce0d951 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 20:08:09 +0100 -Subject: [PATCH] ebtables: ip and ip6 matches depend on protocol match - -This is consistent with legacy ebtables, also avoids invalid -combinations like '-p IPv6 --ip-source 1.2.3.4'. - -Signed-off-by: Phil Sutter -(cherry picked from commit 267a26363826553280a5928043df30a07cdc63bb) ---- - iptables/nft-bridge.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index 83cbe31559d4b..b9983b203f6d0 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -104,11 +104,18 @@ static int - nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, - struct nftnl_rule *r, struct xt_entry_match *m) - { -- if (!strcmp(m->u.user.name, "802_3") && -- !(fw->bitmask & EBT_802_3)) -+ if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) - xtables_error(PARAMETER_PROBLEM, - "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH"); - -+ if (!strcmp(m->u.user.name, "ip") && fw->ethproto != htons(ETH_P_IP)) -+ xtables_error(PARAMETER_PROBLEM, -+ "For IP filtering the protocol must be specified as IPv4."); -+ -+ if (!strcmp(m->u.user.name, "ip6") && fw->ethproto != htons(ETH_P_IPV6)) -+ xtables_error(PARAMETER_PROBLEM, -+ "For IPv6 filtering the protocol must be specified as IPv6."); -+ - return add_match(h, r, m); - } - --- -2.41.0 - diff --git a/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch b/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch deleted file mode 100644 index cb23eb3..0000000 --- a/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch +++ /dev/null @@ -1,348 +0,0 @@ -From a61cac5cdd4332cf84b9e2f554a1c8852d40dc0a Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Tue, 11 Jul 2023 22:06:44 +0200 -Subject: [PATCH] nft-bridge: pass context structure to ops->add() to improve - anonymous set support - -Add context structure to improve bridge among support which creates an -anonymous set. This context structure specifies the command and it -allows to optionally store a anonymous set. - -Use this context to generate native bytecode only if this is an -add/insert/replace command. - -This fixes a dangling anonymous set that is created on rule removal. - -Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") -Reported-and-tested-by: Igor Raits -Signed-off-by: Pablo Neira Ayuso -(cherry picked from commit 4e95200ded923f0eb5579c33b91176193c59dbe0) ---- - iptables/nft-arp.c | 4 ++-- - iptables/nft-bridge.c | 9 ++++---- - iptables/nft-cmd.c | 6 ++++- - iptables/nft-ipv4.c | 6 ++--- - iptables/nft-ipv6.c | 6 ++--- - iptables/nft-shared.h | 5 ++-- - iptables/nft.c | 54 ++++++++++++++++++++++++++++--------------- - iptables/nft.h | 9 +++++--- - 8 files changed, 62 insertions(+), 37 deletions(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index df3ad430cf701..889387e4db592 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -40,8 +40,8 @@ static bool need_devaddr(struct arpt_devaddr_info *info) - return false; - } - --static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, -- struct iptables_command_state *cs) -+static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx, -+ struct nftnl_rule *r, struct iptables_command_state *cs) - { - struct arpt_entry *fw = &cs->arp; - uint32_t op; -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index b9983b203f6d0..a41f411fbba14 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -102,7 +102,8 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) - - static int - nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, -- struct nftnl_rule *r, struct xt_entry_match *m) -+ struct nft_rule_ctx *ctx, struct nftnl_rule *r, -+ struct xt_entry_match *m) - { - if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) - xtables_error(PARAMETER_PROBLEM, -@@ -116,10 +117,10 @@ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, - xtables_error(PARAMETER_PROBLEM, - "For IPv6 filtering the protocol must be specified as IPv6."); - -- return add_match(h, r, m); -+ return add_match(h, ctx, r, m); - } - --static int nft_bridge_add(struct nft_handle *h, -+static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, - struct nftnl_rule *r, - struct iptables_command_state *cs) - { -@@ -181,7 +182,7 @@ static int nft_bridge_add(struct nft_handle *h, - - for (iter = cs->match_list; iter; iter = iter->next) { - if (iter->ismatch) { -- if (nft_bridge_add_match(h, fw, r, iter->u.match->m)) -+ if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m)) - break; - } else { - if (add_target(r, iter->u.watcher->t)) -diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c -index f16ea0e6eaf8b..8cf8027e7465d 100644 ---- a/iptables/nft-cmd.c -+++ b/iptables/nft-cmd.c -@@ -14,12 +14,16 @@ - #include - #include "nft.h" - #include "nft-cmd.h" -+#include - - struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, - const char *table, const char *chain, - struct iptables_command_state *state, - int rulenum, bool verbose) - { -+ struct nft_rule_ctx ctx = { -+ .command = command, -+ }; - struct nftnl_rule *rule; - struct nft_cmd *cmd; - -@@ -33,7 +37,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, - cmd->verbose = verbose; - - if (state) { -- rule = nft_rule_new(h, chain, table, state); -+ rule = nft_rule_new(h, &ctx, chain, table, state); - if (!rule) { - nft_cmd_free(cmd); - return NULL; -diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c -index dcc4a8edfc87f..fb62103fd38d7 100644 ---- a/iptables/nft-ipv4.c -+++ b/iptables/nft-ipv4.c -@@ -26,8 +26,8 @@ - #include "nft.h" - #include "nft-shared.h" - --static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, -- struct iptables_command_state *cs) -+static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx, -+ struct nftnl_rule *r, struct iptables_command_state *cs) - { - struct xtables_rule_match *matchp; - uint32_t op; -@@ -81,7 +81,7 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, - add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO); - - for (matchp = cs->matches; matchp; matchp = matchp->next) { -- ret = add_match(h, r, matchp->match->m); -+ ret = add_match(h, ctx, r, matchp->match->m); - if (ret < 0) - return ret; - } -diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c -index e98921856c75d..d36e06812e08d 100644 ---- a/iptables/nft-ipv6.c -+++ b/iptables/nft-ipv6.c -@@ -25,8 +25,8 @@ - #include "nft.h" - #include "nft-shared.h" - --static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, -- struct iptables_command_state *cs) -+static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx, -+ struct nftnl_rule *r, struct iptables_command_state *cs) - { - struct xtables_rule_match *matchp; - uint32_t op; -@@ -68,7 +68,7 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, - add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO); - - for (matchp = cs->matches; matchp; matchp = matchp->next) { -- ret = add_match(h, r, matchp->match->m); -+ ret = add_match(h, ctx, r, matchp->match->m); - if (ret < 0) - return ret; - } -diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h -index 07d39131cb0d6..9065e52f669e1 100644 ---- a/iptables/nft-shared.h -+++ b/iptables/nft-shared.h -@@ -34,6 +34,7 @@ - | FMT_NUMERIC | FMT_NOTABLE) - #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) - -+struct nft_rule_ctx; - struct xtables_args; - struct nft_handle; - struct xt_xlate; -@@ -126,8 +127,8 @@ static inline struct nft_xt_ctx_reg *nft_xt_ctx_get_dreg(struct nft_xt_ctx *ctx, - } - - struct nft_family_ops { -- int (*add)(struct nft_handle *h, struct nftnl_rule *r, -- struct iptables_command_state *cs); -+ int (*add)(struct nft_handle *h, struct nft_rule_ctx *ctx, -+ struct nftnl_rule *r, struct iptables_command_state *cs); - bool (*is_same)(const struct iptables_command_state *cs_a, - const struct iptables_command_state *cs_b); - void (*print_payload)(struct nftnl_expr *e, -diff --git a/iptables/nft.c b/iptables/nft.c -index 5e4cd76b05504..8029d70a7fbae 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1141,7 +1141,8 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags) - #define NFT_DATATYPE_ETHERADDR 9 - - static int __add_nft_among(struct nft_handle *h, const char *table, -- struct nftnl_rule *r, struct nft_among_pair *pairs, -+ struct nft_rule_ctx *ctx, struct nftnl_rule *r, -+ struct nft_among_pair *pairs, - int cnt, bool dst, bool inv, bool ip) - { - uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN; -@@ -1222,7 +1223,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table, - return 0; - } - --static int add_nft_among(struct nft_handle *h, -+static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, - struct nftnl_rule *r, struct xt_entry_match *m) - { - struct nft_among_data *data = (struct nft_among_data *)m->data; -@@ -1238,10 +1239,10 @@ static int add_nft_among(struct nft_handle *h, - } - - if (data->src.cnt) -- __add_nft_among(h, table, r, data->pairs, data->src.cnt, -+ __add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt, - false, data->src.inv, data->src.ip); - if (data->dst.cnt) -- __add_nft_among(h, table, r, data->pairs + data->src.cnt, -+ __add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt, - data->dst.cnt, true, data->dst.inv, - data->dst.ip); - return 0; -@@ -1449,22 +1450,30 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r, - return 0; - } - --int add_match(struct nft_handle *h, -+int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, - struct nftnl_rule *r, struct xt_entry_match *m) - { - struct nftnl_expr *expr; - int ret; - -- if (!strcmp(m->u.user.name, "limit")) -- return add_nft_limit(r, m); -- else if (!strcmp(m->u.user.name, "among")) -- return add_nft_among(h, r, m); -- else if (!strcmp(m->u.user.name, "udp")) -- return add_nft_udp(h, r, m); -- else if (!strcmp(m->u.user.name, "tcp")) -- return add_nft_tcp(h, r, m); -- else if (!strcmp(m->u.user.name, "mark")) -- return add_nft_mark(h, r, m); -+ switch (ctx->command) { -+ case NFT_COMPAT_RULE_APPEND: -+ case NFT_COMPAT_RULE_INSERT: -+ case NFT_COMPAT_RULE_REPLACE: -+ if (!strcmp(m->u.user.name, "limit")) -+ return add_nft_limit(r, m); -+ else if (!strcmp(m->u.user.name, "among")) -+ return add_nft_among(h, ctx, r, m); -+ else if (!strcmp(m->u.user.name, "udp")) -+ return add_nft_udp(h, r, m); -+ else if (!strcmp(m->u.user.name, "tcp")) -+ return add_nft_tcp(h, r, m); -+ else if (!strcmp(m->u.user.name, "mark")) -+ return add_nft_mark(h, r, m); -+ break; -+ default: -+ break; -+ } - - expr = nftnl_expr_alloc("match"); - if (expr == NULL) -@@ -1692,7 +1701,8 @@ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv) - } - - struct nftnl_rule * --nft_rule_new(struct nft_handle *h, const char *chain, const char *table, -+nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *ctx, -+ const char *chain, const char *table, - struct iptables_command_state *cs) - { - struct nftnl_rule *r; -@@ -1705,7 +1715,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table, - nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table); - nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain); - -- if (h->ops->add(h, r, cs) < 0) -+ if (h->ops->add(h, ctx, r, cs) < 0) - goto err; - - return r; -@@ -2865,6 +2875,9 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, - { - struct iptables_command_state cs = {}; - struct nftnl_rule *r, *new_rule; -+ struct nft_rule_ctx ctx = { -+ .command = NFT_COMPAT_RULE_APPEND, -+ }; - struct nft_chain *c; - int ret = 0; - -@@ -2883,7 +2896,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, - - h->ops->rule_to_cs(h, r, &cs); - cs.counters.pcnt = cs.counters.bcnt = 0; -- new_rule = nft_rule_new(h, chain, table, &cs); -+ new_rule = nft_rule_new(h, &ctx, chain, table, &cs); - h->ops->clear_cs(&cs); - - if (!new_rule) -@@ -3261,6 +3274,9 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) - .eb.bitmask = EBT_NOPROTO, - }; - struct nftnl_udata_buf *udata; -+ struct nft_rule_ctx ctx = { -+ .command = NFT_COMPAT_RULE_APPEND, -+ }; - struct nft_handle *h = data; - struct nftnl_rule *r; - const char *pname; -@@ -3288,7 +3304,7 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) - - command_jump(&cs, pname); - -- r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), -+ r = nft_rule_new(h, &ctx, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), - nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs); - ebt_cs_clean(&cs); - -diff --git a/iptables/nft.h b/iptables/nft.h -index caff1fdeff92e..1c479fce3fc2e 100644 ---- a/iptables/nft.h -+++ b/iptables/nft.h -@@ -171,9 +171,11 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h, - /* - * Operations with rule-set. - */ --struct nftnl_rule; -+struct nft_rule_ctx { -+ int command; -+}; - --struct nftnl_rule *nft_rule_new(struct nft_handle *h, const char *chain, const char *table, struct iptables_command_state *cs); -+struct nftnl_rule *nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *rule, const char *chain, const char *table, struct iptables_command_state *cs); - int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, struct nftnl_rule *ref, bool verbose); - int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, int rulenum, bool verbose); - int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, bool verbose); -@@ -191,7 +193,8 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char * - */ - int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes); - int add_verdict(struct nftnl_rule *r, int verdict); --int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match *m); -+int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, -+ struct nftnl_rule *r, struct xt_entry_match *m); - int add_target(struct nftnl_rule *r, struct xt_entry_target *t); - int add_jumpto(struct nftnl_rule *r, const char *name, int verdict); - int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set); --- -2.41.0 - diff --git a/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch b/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch deleted file mode 100644 index 2b1e058..0000000 --- a/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 48f29413f7db0e3e889733705be368915a16a228 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 19 Jul 2023 14:58:11 +0200 -Subject: [PATCH] tests: shell: Sanitize nft-only/0009-needless-bitwise_0 - -Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the -non-debug ruleset listing's empty lines, causing the diff to fail. Catch -this by exiting upon seeing the first table heading. For the sake of -comparing bytecode, the actual ruleset listing is not interesting, -anyway. - -Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0") -Signed-off-by: Phil Sutter -(cherry picked from commit 2746726e03d9017d4c940a247590f8d5c5d5a73e) ---- - iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 -index 41588a10863ec..34802cc26aad4 100755 ---- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 -+++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 -@@ -340,7 +340,7 @@ bridge filter OUTPUT 10 9 - # - lines with bytecode (starting with ' [') - # - empty lines (so printed diff is not a complete mess) - filter() { -- awk '/^( \[|$)/{print}' -+ awk '/^table /{exit} /^( \[|$)/{print}' - } - - diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter) --- -2.41.0 - diff --git a/0023-nft-Special-casing-for-among-match-in-compare_matche.patch b/0023-nft-Special-casing-for-among-match-in-compare_matche.patch deleted file mode 100644 index 7b7e492..0000000 --- a/0023-nft-Special-casing-for-among-match-in-compare_matche.patch +++ /dev/null @@ -1,46 +0,0 @@ -From da02d12210c4be7bcc6a5c3141ef96d3c68f6e49 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 21 Jul 2023 13:14:36 +0200 -Subject: [PATCH] nft: Special casing for among match in compare_matches() - -When other extensions may have "garbage" appended to their data which -should not be considered for match comparison, among match is the -opposite in that it extends its data beyond the value in 'size' field. -Add special casing to cover for this, avoiding false-positive rule -comparison. - -Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") -Signed-off-by: Phil Sutter -(cherry picked from commit 10583537004f7ecd4aa11f6c12b7ba73fb77fc11) ---- - iptables/nft-shared.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 4ba44a4aa4d17..413503ed86932 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -1505,6 +1505,7 @@ bool compare_matches(struct xtables_rule_match *mt1, - for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) { - struct xt_entry_match *m1 = mp1->match->m; - struct xt_entry_match *m2 = mp2->match->m; -+ size_t cmplen = mp1->match->userspacesize; - - if (strcmp(m1->u.user.name, m2->u.user.name) != 0) { - DEBUGP("mismatching match name\n"); -@@ -1516,8 +1517,10 @@ bool compare_matches(struct xtables_rule_match *mt1, - return false; - } - -- if (memcmp(m1->data, m2->data, -- mp1->match->userspacesize) != 0) { -+ if (!strcmp(m1->u.user.name, "among")) -+ cmplen = m1->u.match_size - sizeof(*m1); -+ -+ if (memcmp(m1->data, m2->data, cmplen) != 0) { - DEBUGP("mismatch match data\n"); - return false; - } --- -2.41.0 - diff --git a/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch b/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch deleted file mode 100644 index 8864560..0000000 --- a/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 009e5643a6e6d4ee395d8956f418bbcef0f960a8 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sat, 15 Jul 2023 01:35:39 +0200 -Subject: [PATCH] nft: Do not pass nft_rule_ctx to add_nft_among() - -It is not used, must be a left-over from an earlier version of the fixed -commit. - -Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support") -Signed-off-by: Phil Sutter -(cherry picked from commit bd71c11a95ab2b44794843fd8a3698039a7db211) ---- - iptables/nft.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8029d70a7fbae..66b47d72e3ae8 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1141,8 +1141,7 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags) - #define NFT_DATATYPE_ETHERADDR 9 - - static int __add_nft_among(struct nft_handle *h, const char *table, -- struct nft_rule_ctx *ctx, struct nftnl_rule *r, -- struct nft_among_pair *pairs, -+ struct nftnl_rule *r, struct nft_among_pair *pairs, - int cnt, bool dst, bool inv, bool ip) - { - uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN; -@@ -1223,7 +1222,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table, - return 0; - } - --static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, -+static int add_nft_among(struct nft_handle *h, - struct nftnl_rule *r, struct xt_entry_match *m) - { - struct nft_among_data *data = (struct nft_among_data *)m->data; -@@ -1239,10 +1238,10 @@ static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, - } - - if (data->src.cnt) -- __add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt, -+ __add_nft_among(h, table, r, data->pairs, data->src.cnt, - false, data->src.inv, data->src.ip); - if (data->dst.cnt) -- __add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt, -+ __add_nft_among(h, table, r, data->pairs + data->src.cnt, - data->dst.cnt, true, data->dst.inv, - data->dst.ip); - return 0; -@@ -1463,7 +1462,7 @@ int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, - if (!strcmp(m->u.user.name, "limit")) - return add_nft_limit(r, m); - else if (!strcmp(m->u.user.name, "among")) -- return add_nft_among(h, ctx, r, m); -+ return add_nft_among(h, r, m); - else if (!strcmp(m->u.user.name, "udp")) - return add_nft_udp(h, r, m); - else if (!strcmp(m->u.user.name, "tcp")) --- -2.41.0 - diff --git a/0025-tables-Reject-invalid-chain-names-when-renaming.patch b/0025-tables-Reject-invalid-chain-names-when-renaming.patch deleted file mode 100644 index 49caa9c..0000000 --- a/0025-tables-Reject-invalid-chain-names-when-renaming.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 2feb8fba886cb9586d6cdc1b5711cff49fe5cf5d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 21 Jul 2023 20:14:09 +0200 -Subject: [PATCH] *tables: Reject invalid chain names when renaming - -While given chain name was sanity checked with --new-chain command, ---rename-chain command allowed to choose an invalid name. Keep things -consistent by adding the missing check. - -Fixes: e6869a8f59d77 ("reorganized tree after kernel merge") -Signed-off-by: Phil Sutter -(cherry picked from commit 344e9b260ba2bbbdd0c32f112273fd552d0b73f4) ---- - iptables/xshared.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 71ee94d6f2f83..6812da501a288 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1521,6 +1521,7 @@ void do_parse(int argc, char *argv[], - "-%c requires old-chain-name and " - "new-chain-name", - cmd2char(CMD_RENAME_CHAIN)); -+ assert_valid_chain_name(p->newname); - break; - - case 'P': --- -2.41.0 - diff --git a/0026-ebtables-Improve-invalid-chain-name-detection.patch b/0026-ebtables-Improve-invalid-chain-name-detection.patch deleted file mode 100644 index 291f73d..0000000 --- a/0026-ebtables-Improve-invalid-chain-name-detection.patch +++ /dev/null @@ -1,94 +0,0 @@ -From d841d7a1f438e56226cc26b2f8e8525d5aeaa5c6 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Jul 2023 13:50:11 +0200 -Subject: [PATCH] ebtables: Improve invalid chain name detection - -Fix several issues: - -- Most importantly, --new-chain command accepted any name. Introduce - ebt_assert_valid_chain_name() for use with both --new-chain and - --rename-chain. -- Restrict maximum name length to what legacy ebtables allows - this is - a bit more than iptables-nft, subject to be unified. -- Like iptables, legacy ebtables rejects names prefixed by '-' or '!'. -- Use xs_has_arg() for consistency, keep the check for extra args for - now. - -Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") -Signed-off-by: Phil Sutter -(cherry picked from commit 687d76937be799a405e63e58861f7e4a965dfa8d) ---- - iptables/xtables-eb.c | 33 ++++++++++++++++++++++++++++----- - 1 file changed, 28 insertions(+), 5 deletions(-) - -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 3a73e79725489..33f55aee32c8f 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -42,6 +42,10 @@ - #include "nft.h" - #include "nft-bridge.h" - -+/* from linux/netfilter_bridge/ebtables.h */ -+#define EBT_TABLE_MAXNAMELEN 32 -+#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN -+ - /* - * From include/ebtables_u.h - */ -@@ -74,6 +78,26 @@ static int ebt_check_inverse2(const char option[], int argc, char **argv) - return ebt_invert; - } - -+/* XXX: merge with assert_valid_chain_name()? */ -+static void ebt_assert_valid_chain_name(const char *chainname) -+{ -+ if (strlen(chainname) >= EBT_CHAIN_MAXNAMELEN) -+ xtables_error(PARAMETER_PROBLEM, -+ "Chain name length can't exceed %d", -+ EBT_CHAIN_MAXNAMELEN - 1); -+ -+ if (*chainname == '-' || *chainname == '!') -+ xtables_error(PARAMETER_PROBLEM, "No chain name specified"); -+ -+ if (xtables_find_target(chainname, XTF_TRY_LOAD)) -+ xtables_error(PARAMETER_PROBLEM, -+ "Target with name %s exists", chainname); -+ -+ if (strchr(chainname, ' ') != NULL) -+ xtables_error(PARAMETER_PROBLEM, -+ "Use of ' ' not allowed in chain names"); -+} -+ - /* - * Glue code to use libxtables - */ -@@ -750,6 +774,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - flags |= OPT_COMMAND; - - if (c == 'N') { -+ ebt_assert_valid_chain_name(chain); - ret = nft_cmd_chain_user_add(h, chain, *table); - break; - } else if (c == 'X') { -@@ -763,14 +788,12 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - } - - if (c == 'E') { -- if (optind >= argc) -+ if (!xs_has_arg(argc, argv)) - xtables_error(PARAMETER_PROBLEM, "No new chain name specified"); - else if (optind < argc - 1) - xtables_error(PARAMETER_PROBLEM, "No extra options allowed with -E"); -- else if (strlen(argv[optind]) >= NFT_CHAIN_MAXNAMELEN) -- xtables_error(PARAMETER_PROBLEM, "Chain name length can't exceed %d"" characters", NFT_CHAIN_MAXNAMELEN - 1); -- else if (strchr(argv[optind], ' ') != NULL) -- xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); -+ -+ ebt_assert_valid_chain_name(argv[optind]); - - errno = 0; - ret = nft_cmd_chain_user_rename(h, chain, *table, --- -2.41.0 - diff --git a/0027-tests-shell-Fix-and-extend-chain-rename-test.patch b/0027-tests-shell-Fix-and-extend-chain-rename-test.patch deleted file mode 100644 index c49d9eb..0000000 --- a/0027-tests-shell-Fix-and-extend-chain-rename-test.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 9ca7dcde885b9dad98761273eecd3921d0064ed2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Jul 2023 13:58:46 +0200 -Subject: [PATCH] tests: shell: Fix and extend chain rename test - -The old version exited unintentionally before testing ip6tables. Replace -it by a more complete variant testing for all tools, creating and -renaming of,chains with various illegal names instead of just renaming -to a clashing name. - -Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases") -Signed-off-by: Phil Sutter -(cherry picked from commit 3bbf5269f25d7bc8cb6ecf2c44e6358579acc459) ---- - .../tests/shell/testcases/chain/0003rename_0 | 40 +++++++++++++++++++ - .../tests/shell/testcases/chain/0003rename_1 | 12 ------ - 2 files changed, 40 insertions(+), 12 deletions(-) - create mode 100755 iptables/tests/shell/testcases/chain/0003rename_0 - delete mode 100755 iptables/tests/shell/testcases/chain/0003rename_1 - -diff --git a/iptables/tests/shell/testcases/chain/0003rename_0 b/iptables/tests/shell/testcases/chain/0003rename_0 -new file mode 100755 -index 0000000000000..4cb2745bc2523 ---- /dev/null -+++ b/iptables/tests/shell/testcases/chain/0003rename_0 -@@ -0,0 +1,40 @@ -+#!/bin/bash -x -+ -+die() { -+ echo "E: $@" -+ exit 1 -+} -+ -+cmds="iptables ip6tables" -+[[ $XT_MULTI == *xtables-nft-multi ]] && cmds+=" arptables ebtables" -+ -+declare -A invnames -+invnames["existing"]="c2" -+invnames["spaced"]="foo bar" -+invnames["dashed"]="-foo" -+invnames["negated"]="!foo" -+# XXX: ebtables-nft accepts 255 chars -+#invnames["overlong"]="thisisquitealongnameforachain" -+invnames["standard target"]="ACCEPT" -+invnames["extension target"]="DNAT" -+ -+for cmd in $cmds; do -+ $XT_MULTI $cmd -N c1 || die "$cmd: can't add chain c1" -+ $XT_MULTI $cmd -N c2 || die "$cmd: can't add chain c2" -+ for key in "${!invnames[@]}"; do -+ val="${invnames[$key]}" -+ if [[ $key == "extension target" ]]; then -+ if [[ $cmd == "arptables" ]]; then -+ val="mangle" -+ elif [[ $cmd == "ebtables" ]]; then -+ val="dnat" -+ fi -+ fi -+ $XT_MULTI $cmd -N "$val" && \ -+ die "$cmd: added chain with $key name" -+ $XT_MULTI $cmd -E c1 "$val" && \ -+ die "$cmd: renamed to $key name" -+ done -+done -+ -+exit 0 -diff --git a/iptables/tests/shell/testcases/chain/0003rename_1 b/iptables/tests/shell/testcases/chain/0003rename_1 -deleted file mode 100755 -index 975c8e196b9f5..0000000000000 ---- a/iptables/tests/shell/testcases/chain/0003rename_1 -+++ /dev/null -@@ -1,12 +0,0 @@ --#!/bin/bash -- --$XT_MULTI iptables -N c1 || exit 0 --$XT_MULTI iptables -N c2 || exit 0 --$XT_MULTI iptables -E c1 c2 || exit 1 -- --$XT_MULTI ip6tables -N c1 || exit 0 --$XT_MULTI ip6tables -N c2 || exit 0 --$XT_MULTI ip6tables -E c1 c2 || exit 1 -- --echo "E: Renamed with existing chain" >&2 --exit 0 --- -2.41.0 - diff --git a/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch b/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch deleted file mode 100644 index 04e661b..0000000 --- a/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 2eb44e79329b713e4eb50f4816beaa6e6babe1da Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 1 Aug 2023 23:28:20 +0200 -Subject: [PATCH] extensions: libipt_icmp: Fix confusion between 255/255 and - any - -Per definition, ICMP type "any" is type 255 and the full range of codes -(0-255). Save callback though ignored the actual code values, printing -"any" for every type 255 match. This at least confuses users as they -can't find their rule added as '--icmp-type 255/255' anymore. - -It is not entirely clear what the fixed commit was trying to establish, -but the save output is certainly not correct (especially since print -callback gets things right). - -Reported-by: Amelia Downs -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 -Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") -Signed-off-by: Phil Sutter -(cherry picked from commit 5b5430d627bbc227a2d51d4312c371f2015834c6) ---- - extensions/libipt_icmp.c | 3 ++- - extensions/libipt_icmp.t | 2 ++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c -index b0318aebc2c57..171b3b3949e54 100644 ---- a/extensions/libipt_icmp.c -+++ b/extensions/libipt_icmp.c -@@ -108,7 +108,8 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) - printf(" !"); - - /* special hack for 'any' case */ -- if (icmp->type == 0xFF) { -+ if (icmp->type == 0xFF && -+ icmp->code[0] == 0 && icmp->code[1] == 0xFF) { - printf(" --icmp-type any"); - } else { - printf(" --icmp-type %u", icmp->type); -diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t -index f4ba65c27f032..ce4a33f9633b5 100644 ---- a/extensions/libipt_icmp.t -+++ b/extensions/libipt_icmp.t -@@ -13,3 +13,5 @@ - # we accept "iptables -I INPUT -p tcp -m tcp", why not this below? - # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp - # -p icmp -m icmp;=;OK -+-p icmp -m icmp --icmp-type 255/255;=;OK -+-p icmp -m icmp --icmp-type 255/0:255;-p icmp -m icmp --icmp-type any;OK --- -2.41.0 - diff --git a/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch b/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch deleted file mode 100644 index 391b3e6..0000000 --- a/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 329a8bb4d4b701b2903b182e8d8950dadbed4752 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 1 Aug 2023 23:42:24 +0200 -Subject: [PATCH] tests: libipt_icmp.t: Enable tests with numeric output - -Unrelated to the question whether numeric (save) output is desired or -not, enable the tests and expect the known format. - -Using --list without --numeric prints the names, BTW. - -Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") -Signed-off-by: Phil Sutter -(cherry picked from commit 99d861c64cda5289e141b2084836663450f1eff0) ---- - extensions/libipt_icmp.t | 9 +++------ - 1 file changed, 3 insertions(+), 6 deletions(-) - -diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t -index ce4a33f9633b5..4ea936217c09a 100644 ---- a/extensions/libipt_icmp.t -+++ b/extensions/libipt_icmp.t -@@ -1,11 +1,8 @@ - :INPUT,FORWARD,OUTPUT - -p icmp -m icmp --icmp-type any;=;OK --# output uses the number, better use the name? --# ERROR: cannot find: iptables -I INPUT -p icmp -m icmp --icmp-type echo-reply --# -p icmp -m icmp --icmp-type echo-reply;=;OK --# output uses the number, better use the name? --# ERROR: annot find: iptables -I INPUT -p icmp -m icmp --icmp-type destination-unreachable --# -p icmp -m icmp --icmp-type destination-unreachable;=;OK -+# XXX: output uses the number, better use the name? -+-p icmp -m icmp --icmp-type echo-reply;-p icmp -m icmp --icmp-type 0;OK -+-p icmp -m icmp --icmp-type destination-unreachable;-p icmp -m icmp --icmp-type 3;OK - # it does not acccept name/name, should we accept this? - # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable - # -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable;=;OK --- -2.41.0 - diff --git a/0030-man-iptables.8-Fix-intra-page-reference.patch b/0030-man-iptables.8-Fix-intra-page-reference.patch deleted file mode 100644 index babf3b0..0000000 --- a/0030-man-iptables.8-Fix-intra-page-reference.patch +++ /dev/null @@ -1,33 +0,0 @@ -From ea90131706ccc3a806d9d0ee0bc196e64690f7e1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 00:23:37 +0200 -Subject: [PATCH] man: iptables.8: Fix intra page reference - -When sections MATCH EXTENSIONS and TARGET EXTENSIONS were combined, the -reference could have been updated to specify the exact title. - -Fixes: 4496801821c01 ("doc: deduplicate extension descriptions into a new manpage") -Signed-off-by: Phil Sutter -(cherry picked from commit 3bda308b32847d08b2c27077fa3c02200b59cdca) ---- - iptables/iptables.8.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in -index f81c632f2be86..c336ddf6e4f95 100644 ---- a/iptables/iptables.8.in -+++ b/iptables/iptables.8.in -@@ -307,8 +307,8 @@ false, evaluation will stop. - This specifies the target of the rule; i.e., what to do if the packet - matches it. The target can be a user-defined chain (other than the - one this rule is in), one of the special builtin targets which decide --the fate of the packet immediately, or an extension (see \fBEXTENSIONS\fP --below). If this -+the fate of the packet immediately, or an extension (see \fBMATCH AND TARGET -+EXTENSIONS\fP below). If this - option is omitted in a rule (and \fB\-g\fP - is not used), then matching the rule will have no - effect on the packet's fate, but the counters on the rule will be --- -2.41.0 - diff --git a/0031-man-iptables.8-Clarify-goto-description.patch b/0031-man-iptables.8-Clarify-goto-description.patch deleted file mode 100644 index f57e2af..0000000 --- a/0031-man-iptables.8-Clarify-goto-description.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 4e13b0b775522b2da8951c01713c47f235af8110 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 00:28:03 +0200 -Subject: [PATCH] man: iptables.8: Clarify --goto description - -Text speaks about behaviour of RETURN target when used in chains -redirected to using --goto instead of --jump, not the difference between ---jump option and "return". - -Fixes: 17fc163babc34 ("add 'goto' support (Henrik Nordstrom )") -Signed-off-by: Phil Sutter -(cherry picked from commit 94c19939744dbbbc6ff0fedf6cdba661769fdc87) ---- - iptables/iptables.8.in | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in -index c336ddf6e4f95..2365380490d52 100644 ---- a/iptables/iptables.8.in -+++ b/iptables/iptables.8.in -@@ -316,7 +316,7 @@ incremented. - .TP - \fB\-g\fP, \fB\-\-goto\fP \fIchain\fP - This specifies that the processing should continue in a user --specified chain. Unlike the \-\-jump option return will not continue -+specified chain. Unlike with the \-\-jump option, \fBRETURN\fP will not continue - processing in this chain but instead in the chain that called us via - \-\-jump. - .TP --- -2.41.0 - diff --git a/0032-man-iptables-restore.8-Fix-modprobe-description.patch b/0032-man-iptables-restore.8-Fix-modprobe-description.patch deleted file mode 100644 index 56d8dae..0000000 --- a/0032-man-iptables-restore.8-Fix-modprobe-description.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 1a62df2225b0d087a417d04455fe1e10384837e0 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 01:27:11 +0200 -Subject: [PATCH] man: iptables-restore.8: Fix --modprobe description - -- Consistently use 'modprobe' as option argument name -- Add a reference to modprobe man page -- Put the path in italics, and the command in bold - -Fixes: 8c46901ff5785 ("doc: document iptables-restore's -M option") -Signed-off-by: Phil Sutter -(cherry picked from commit 0f05f523ac02843ab7bbd09a96ba3fa384ae9523) ---- - iptables/iptables-restore.8.in | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in -index 20216842d8358..f95f00acd8d49 100644 ---- a/iptables/iptables-restore.8.in -+++ b/iptables/iptables-restore.8.in -@@ -67,9 +67,10 @@ the program will exit if the lock cannot be obtained. This option will - make the program wait (indefinitely or for optional \fIseconds\fP) until - the exclusive lock can be obtained. - .TP --\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe_program\fP --Specify the path to the modprobe program. By default, iptables-restore will --inspect /proc/sys/kernel/modprobe to determine the executable's path. -+\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe\fP -+Specify the path to the modprobe(8) program. By default, -+iptables-restore will inspect \fI/proc/sys/kernel/modprobe\fP to -+determine the executable's path. - .TP - \fB\-T\fP, \fB\-\-table\fP \fIname\fP - Restore only the named table even if the input stream contains other ones. --- -2.41.0 - diff --git a/0033-man-iptables-restore.8-Consistently-document-w-optio.patch b/0033-man-iptables-restore.8-Consistently-document-w-optio.patch deleted file mode 100644 index 76b3885..0000000 --- a/0033-man-iptables-restore.8-Consistently-document-w-optio.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 2b2c2310a61d17bf63845e7f70352342a072f08a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 01:33:26 +0200 -Subject: [PATCH] man: iptables-restore.8: Consistently document -w option - -Use the same name for the option's argument. - -Fixes: 65801d02a482b ("iptables-restore.8: document -w/-W options") -Signed-off-by: Phil Sutter -(cherry picked from commit e7bc6cc8aca993b743e83f20b2f579aed2f5d954) ---- - iptables/iptables-restore.8.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in -index f95f00acd8d49..a63a344c0bd72 100644 ---- a/iptables/iptables-restore.8.in -+++ b/iptables/iptables-restore.8.in -@@ -23,11 +23,11 @@ iptables-restore \(em Restore IP Tables - .P - ip6tables-restore \(em Restore IPv6 Tables - .SH SYNOPSIS --\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP] -+\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] - [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] - [\fBfile\fP] - .P --\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP] -+\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] - [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] - [\fBfile\fP] - .SH DESCRIPTION --- -2.41.0 - diff --git a/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch b/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch deleted file mode 100644 index ef01dfd..0000000 --- a/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 41257615e8d30c5969e3639d6ad5cd6f34f9143e Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 01:34:51 +0200 -Subject: [PATCH] man: iptables-restore.8: Drop -W option from synopsis - -The description was dropped already, there is no benefit in still -listing it. - -Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") -Signed-off-by: Phil Sutter -(cherry picked from commit 193107df55541ced2e783bcce9b71b97f88a5398) ---- - iptables/iptables-restore.8.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in -index a63a344c0bd72..bfd2fc355dd49 100644 ---- a/iptables/iptables-restore.8.in -+++ b/iptables/iptables-restore.8.in -@@ -24,11 +24,11 @@ iptables-restore \(em Restore IP Tables - ip6tables-restore \(em Restore IPv6 Tables - .SH SYNOPSIS - \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] --[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] -+[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] - [\fBfile\fP] - .P - \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] --[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] -+[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] - [\fBfile\fP] - .SH DESCRIPTION - .PP --- -2.41.0 - diff --git a/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch b/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch deleted file mode 100644 index 673c6ad..0000000 --- a/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 97baff1f10262947c0feb6d6d14e67f1e7eb1bb0 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 01:37:09 +0200 -Subject: [PATCH] man: iptables-restore.8: Put 'file' in italics in synopsis - -The text has it this way already, be consistent. - -Fixes: 081d57839e91e ("iptables-restore.8: file to read from can be specified as argument") -Signed-off-by: Phil Sutter -(cherry picked from commit b200f0870bc17046d6db64a1a65937ad5f263633) ---- - iptables/iptables-restore.8.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in -index bfd2fc355dd49..ff8179091eeee 100644 ---- a/iptables/iptables-restore.8.in -+++ b/iptables/iptables-restore.8.in -@@ -25,11 +25,11 @@ ip6tables-restore \(em Restore IPv6 Tables - .SH SYNOPSIS - \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] - [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] --[\fBfile\fP] -+[\fIfile\fP] - .P - \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] - [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] --[\fBfile\fP] -+[\fIfile\fP] - .SH DESCRIPTION - .PP - .B iptables-restore --- -2.41.0 - diff --git a/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch b/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch deleted file mode 100644 index badd260..0000000 --- a/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 868d7b3a16741bfa7e0c89ee1c840e4a3e51e2b2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 01:40:17 +0200 -Subject: [PATCH] man: iptables-restore.8: Start paragraphs in upper-case - -Also add a missing full stop in one spot. - -Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") -Signed-off-by: Phil Sutter -(cherry picked from commit 935a5cf8afa96daa1c688efd59b9025e3a78fba4) ---- - iptables/iptables-restore.8.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in -index ff8179091eeee..ce4520e626772 100644 ---- a/iptables/iptables-restore.8.in -+++ b/iptables/iptables-restore.8.in -@@ -40,13 +40,13 @@ are used to restore IP and IPv6 Tables from data specified on STDIN or in - specify \fIfile\fP as an argument. - .TP - \fB\-c\fR, \fB\-\-counters\fR --restore the values of all packet and byte counters -+Restore the values of all packet and byte counters. - .TP - \fB\-h\fP, \fB\-\-help\fP - Print a short option summary. - .TP - \fB\-n\fR, \fB\-\-noflush\fR --don't flush the previous contents of the table. If not specified, -+Don't flush the previous contents of the table. If not specified, - both commands flush (delete) all previous contents of the respective table. - .TP - \fB\-t\fP, \fB\-\-test\fP --- -2.41.0 - diff --git a/0037-man-Trivial-Missing-space-after-comma.patch b/0037-man-Trivial-Missing-space-after-comma.patch deleted file mode 100644 index ade4e0a..0000000 --- a/0037-man-Trivial-Missing-space-after-comma.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 1016392a3d59afcda3eae03efe87353a3706a331 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 01:48:14 +0200 -Subject: [PATCH] man: Trivial: Missing space after comma - -Fixes: 6a79d78986c02 ("iptables: mention iptables-apply(8) in manpages") -Signed-off-by: Phil Sutter -(cherry picked from commit b0092a80656da7cf66f15ce906b17ab040ece12f) ---- - iptables/iptables-restore.8.in | 2 +- - iptables/iptables-save.8.in | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in -index ce4520e626772..aa816f794d6f3 100644 ---- a/iptables/iptables-restore.8.in -+++ b/iptables/iptables-restore.8.in -@@ -82,7 +82,7 @@ from Rusty Russell. - .br - Andras Kis-Szabo contributed ip6tables-restore. - .SH SEE ALSO --\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8) -+\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8) - .PP - The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, - which details NAT, and the netfilter-hacking-HOWTO which details the -diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in -index 7683fd3780f72..253907719acee 100644 ---- a/iptables/iptables-save.8.in -+++ b/iptables/iptables-save.8.in -@@ -62,7 +62,7 @@ Rusty Russell - .br - Andras Kis-Szabo contributed ip6tables-save. - .SH SEE ALSO --\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8) -+\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8) - .PP - The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, - which details NAT, and the netfilter-hacking-HOWTO which details the --- -2.41.0 - diff --git a/0038-man-iptables-save.8-Fix-modprobe-description.patch b/0038-man-iptables-save.8-Fix-modprobe-description.patch deleted file mode 100644 index 11d8cce..0000000 --- a/0038-man-iptables-save.8-Fix-modprobe-description.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 5e144f6fc73baafada7c34779ebaafbbd3ecf45b Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 02:01:59 +0200 -Subject: [PATCH] man: iptables-save.8: Fix --modprobe description - -- Consistently use 'modprobe' as option argument name -- Add a reference to modprobe man page -- Put the path in italics and the command in bold - -Fixes: fbb5639c02218 ("iptables-save: module loading corrections") -Signed-off-by: Phil Sutter -(cherry picked from commit f1fd95ccefe483f0e3f2da593c6d4b671a7de522) ---- - iptables/iptables-save.8.in | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in -index 253907719acee..4a2c90c2f5956 100644 ---- a/iptables/iptables-save.8.in -+++ b/iptables/iptables-save.8.in -@@ -36,9 +36,10 @@ and - are used to dump the contents of IP or IPv6 Table in easily parseable format - either to STDOUT or to a specified file. - .TP --\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP --Specify the path to the modprobe program. By default, iptables-save will --inspect /proc/sys/kernel/modprobe to determine the executable's path. -+\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe\fP -+Specify the path to the modprobe(8) program. By default, -+iptables-save will inspect \fI/proc/sys/kernel/modprobe\fP to determine -+the executable's path. - .TP - \fB\-f\fR, \fB\-\-file\fR \fIfilename\fP - Specify a filename to log the output to. If not specified, iptables-save --- -2.41.0 - diff --git a/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch b/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch deleted file mode 100644 index fd1267a..0000000 --- a/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 13aa85e1a27f50f91d6cfe521cca55cf37f4ac48 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 2 Aug 2023 02:06:00 +0200 -Subject: [PATCH] man: iptables-save.8: Start paragraphs in upper-case - -Also add a missing full stop. - -Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") -Signed-off-by: Phil Sutter -(cherry picked from commit 952186aa0342f6bf3c4614a609525338d057d8d9) ---- - iptables/iptables-save.8.in | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in -index 4a2c90c2f5956..7c0d2552e8b97 100644 ---- a/iptables/iptables-save.8.in -+++ b/iptables/iptables-save.8.in -@@ -46,10 +46,10 @@ Specify a filename to log the output to. If not specified, iptables-save - will log to STDOUT. - .TP - \fB\-c\fR, \fB\-\-counters\fR --include the current values of all packet and byte counters in the output -+Include the current values of all packet and byte counters in the output. - .TP - \fB\-t\fR, \fB\-\-table\fR \fItablename\fP --restrict output to only one table. If the kernel is configured with automatic -+Restrict output to only one table. If the kernel is configured with automatic - module loading, an attempt will be made to load the appropriate module for - that table if it is not already there. - .br --- -2.41.0 - diff --git a/0040-tests-iptables-test-Fix-command-segfault-reports.patch b/0040-tests-iptables-test-Fix-command-segfault-reports.patch deleted file mode 100644 index 5ec3a1d..0000000 --- a/0040-tests-iptables-test-Fix-command-segfault-reports.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 9b0b0db6aa82c8433002880f73a7614bb453320d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 26 Jul 2023 19:43:20 +0200 -Subject: [PATCH] tests: iptables-test: Fix command segfault reports - -Logging produced a stack trace due to undefined variable 'cmd'. - -Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") -Signed-off-by: Phil Sutter -(cherry picked from commit 5412ccba55b2318160d32efec3b8aad162608af9) ---- - iptables-test.py | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/iptables-test.py b/iptables-test.py -index de1e1e95fda55..065c322a173ca 100755 ---- a/iptables-test.py -+++ b/iptables-test.py -@@ -136,7 +136,7 @@ STDERR_IS_TTY = sys.stderr.isatty() - # check for segfaults - # - if proc.returncode == -11: -- reason = "iptables-save segfaults: " + cmd -+ reason = command + " segfaults!" - print_error(reason, filename, lineno) - delete_rule(iptables, rule, filename, lineno, netns) - return -1 -@@ -333,8 +333,11 @@ STDERR_IS_TTY = sys.stderr.isatty() - out, err = proc.communicate(input = restore_data) - - if proc.returncode == -11: -- reason = iptables + "-restore segfaults: " + cmd -+ reason = iptables + "-restore segfaults!" - print_error(reason, filename, lineno) -+ msg = [iptables + "-restore segfault from:"] -+ msg.extend(["input: " + l for l in restore_data.split("\n")]) -+ print("\n".join(msg), file=log_file) - return -1 - - if proc.returncode != 0: -@@ -355,7 +358,7 @@ STDERR_IS_TTY = sys.stderr.isatty() - out, err = proc.communicate() - - if proc.returncode == -11: -- reason = iptables + "-save segfaults: " + cmd -+ reason = iptables + "-save segfaults!" - print_error(reason, filename, lineno) - return -1 - --- -2.41.0 - diff --git a/0041-nft-Create-builtin-chains-with-counters-enabled.patch b/0041-nft-Create-builtin-chains-with-counters-enabled.patch deleted file mode 100644 index 21f9912..0000000 --- a/0041-nft-Create-builtin-chains-with-counters-enabled.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 85746b658b9eedafd5523b5501ce0f8b5f5bdcbf Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 10 Aug 2023 11:30:59 +0200 -Subject: [PATCH] nft: Create builtin chains with counters enabled - -The kernel enables policy counters for nftables chains only if -NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one -has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the -allocated nftnl_chain object. - -The above happened for base chains only with iptables-nft-restore if -called with --counters flag. Since this is very unintuitive to users, -fix the situation by adding counters to base chains in any case. - -Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface") -Signed-off-by: Phil Sutter -(cherry picked from commit 39a067bb3b1b4ffb50a925f66e7db56658c0dfa7) ---- - iptables/nft.c | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 66b47d72e3ae8..2b5a27922a06e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -686,6 +686,9 @@ nft_chain_builtin_alloc(int family, const char *tname, - - nftnl_chain_set_str(c, NFTNL_CHAIN_TYPE, chain->type); - -+ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0); -+ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0); -+ - return c; - } - -@@ -946,6 +949,7 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h, - int policy, - const struct xt_counters *counters) - { -+ static const struct xt_counters zero = {}; - struct nftnl_chain *c; - const struct builtin_table *_t; - const struct builtin_chain *_c; -@@ -970,12 +974,10 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h, - return NULL; - } - -- if (counters) { -- nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, -- counters->bcnt); -- nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, -- counters->pcnt); -- } -+ if (!counters) -+ counters = &zero; -+ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, counters->bcnt); -+ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, counters->pcnt); - - return c; - } --- -2.41.0 - diff --git a/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch b/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch deleted file mode 100644 index 6818a1e..0000000 --- a/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 4cec9d5fec5c5bcc51b84e3ed9ba9619fe8b2909 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 3 Aug 2023 17:59:03 +0200 -Subject: [PATCH] Revert "libiptc: fix wrong maptype of base chain counters on - restore" - -This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4. - -The change can't be right: A simple rule append call will reset all -built-in chains' counters. The old code works fine even given the -mentioned "empty restore" use-case, at least if counters don't change on -the fly in-kernel. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912 -Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore") -Signed-off-by: Phil Sutter -(cherry picked from commit 43f78733059ecd28d8567d8205cab5ed62d93458) ---- - libiptc/libiptc.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c -index f9b7779efdba5..29ff356f2324e 100644 ---- a/libiptc/libiptc.c -+++ b/libiptc/libiptc.c -@@ -822,7 +822,7 @@ static int __iptcc_p_del_policy(struct xtc_handle *h, unsigned int num) - - /* save counter and counter_map information */ - h->chain_iterator_cur->counter_map.maptype = -- COUNTER_MAP_ZEROED; -+ COUNTER_MAP_NORMAL_MAP; - h->chain_iterator_cur->counter_map.mappos = num-1; - memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters, - sizeof(h->chain_iterator_cur->counters)); --- -2.41.0 - diff --git a/0043-doc-fix-example-of-xt_cpu.patch b/0043-doc-fix-example-of-xt_cpu.patch deleted file mode 100644 index bfc6a76..0000000 --- a/0043-doc-fix-example-of-xt_cpu.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 12e7024d3e8d245bb5645167f3aeb4c0187f75fd Mon Sep 17 00:00:00 2001 -From: Victor Julien -Date: Tue, 29 Aug 2023 14:59:32 +0200 -Subject: [PATCH] doc: fix example of xt_cpu - -REDIRECT uses --to-ports instead of --to-port. - -Fixes: 2d59208943a3 ("extension: add xt_cpu match") - -Signed-off-by: Victor Julien -Signed-off-by: Florian Westphal -(cherry picked from commit 63e4a64e943be64a7e0486838071b981074e696d) ---- - extensions/libxt_cpu.man | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/extensions/libxt_cpu.man b/extensions/libxt_cpu.man -index d9ea5c2faa20b..c89ef08afbfbb 100644 ---- a/extensions/libxt_cpu.man -+++ b/extensions/libxt_cpu.man -@@ -7,9 +7,9 @@ multiqueue NICs to spread network traffic on different queues. - Example: - .PP - iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 0 --\-j REDIRECT \-\-to\-port 8080 -+\-j REDIRECT \-\-to\-ports 8080 - .PP - iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 1 --\-j REDIRECT \-\-to\-port 8081 -+\-j REDIRECT \-\-to\-ports 8081 - .PP - Available since Linux 2.6.36. --- -2.41.0 - diff --git a/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch b/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch deleted file mode 100644 index 632021f..0000000 --- a/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 16822c25bf795b54b13ada62da762ee7e9c2b12f Mon Sep 17 00:00:00 2001 -From: Quentin Armitage -Date: Sat, 23 Nov 2013 08:41:58 +0000 -Subject: [PATCH] extensions: Fix checking of conntrack --ctproto 0 - -There are three issues in the code: -1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask -2) in conntrack_mt_parse it is testing (info->invert_flags & - XT_INV_PROTO) before the invert bit has been set. -3) the sense of the error message is the wrong way round - -1) To get the error, ! -ctstatus XXX has to be specified, since - XT_INV_PROTO == XT_CONNTRACK_STATUS e.g. - | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ... - -3) Unlike --proto 0 (where 0 means all protocols), in the conntrack - match --ctproto 0 appears to mean protocol 0, which can never be. - Therefore --ctproto 0 could never match and ! --ctproto 0 will always - match. Both of these should be rejected, since the user clearly - cannot be intending what was specified. - -The attached patch resolves the issue, and also produces an error -message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since ---ctproto 0 will never match, and ! --ctproto 0 will always match. - -[Phil: - Added Fixes: tag - it's a day 1 bug - - Copied patch description from Bugzilla - - Reorganized changes to reduce diff - - Added test cases] - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874 -Fixes: 5054e85be3068 ("general conntrack match module userspace support files") -Signed-off-by: Quentin Armitage -Signed-off-by: Phil Sutter -(cherry picked from commit 2e704f6ddd6d056e360f3d9c11e8b6c56a20cf23) ---- - extensions/libxt_conntrack.c | 17 ++++++++--------- - extensions/libxt_conntrack.t | 2 ++ - 2 files changed, 10 insertions(+), 9 deletions(-) - -diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c -index 09548c297695f..ffbc7467bbf2e 100644 ---- a/extensions/libxt_conntrack.c -+++ b/extensions/libxt_conntrack.c -@@ -346,14 +346,13 @@ static void conntrack_parse(struct xt_option_call *cb) - sinfo->invflags |= XT_CONNTRACK_STATE; - break; - case O_CTPROTO: -+ if (cb->val.protocol == 0) -+ xtables_error(PARAMETER_PROBLEM, cb->invert ? -+ "condition would always match protocol" : -+ "rule would never match protocol"); - sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum = cb->val.protocol; - if (cb->invert) - sinfo->invflags |= XT_CONNTRACK_PROTO; -- if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0 -- && (sinfo->invflags & XT_INV_PROTO)) -- xtables_error(PARAMETER_PROBLEM, -- "rule would never match protocol"); -- - sinfo->flags |= XT_CONNTRACK_PROTO; - break; - case O_CTORIGSRC: -@@ -411,11 +410,11 @@ static void conntrack_mt_parse(struct xt_option_call *cb, uint8_t rev) - info->invert_flags |= XT_CONNTRACK_STATE; - break; - case O_CTPROTO: -+ if (cb->val.protocol == 0) -+ xtables_error(PARAMETER_PROBLEM, cb->invert ? -+ "conntrack: condition would always match protocol" : -+ "conntrack: rule would never match protocol"); - info->l4proto = cb->val.protocol; -- if (info->l4proto == 0 && (info->invert_flags & XT_INV_PROTO)) -- xtables_error(PARAMETER_PROBLEM, "conntrack: rule would " -- "never match protocol"); -- - info->match_flags |= XT_CONNTRACK_PROTO; - if (cb->invert) - info->invert_flags |= XT_CONNTRACK_PROTO; -diff --git a/extensions/libxt_conntrack.t b/extensions/libxt_conntrack.t -index db53147532afd..2b3c5de9cd3ab 100644 ---- a/extensions/libxt_conntrack.t -+++ b/extensions/libxt_conntrack.t -@@ -25,3 +25,5 @@ - -m conntrack --ctstatus EXPECTED;=;OK - -m conntrack --ctstatus SEEN_REPLY;=;OK - -m conntrack;;FAIL -+-m conntrack --ctproto 0;;FAIL -+-m conntrack ! --ctproto 0;;FAIL --- -2.41.0 - diff --git a/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch b/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch deleted file mode 100644 index adf28ca..0000000 --- a/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 73f49fada3a73b321a0c01fc3014d7617180f1ed Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 1 Sep 2023 13:16:56 +0200 -Subject: [PATCH] tests: shell: Fix for ineffective 0007-mid-restore-flush_0 - -The test did not catch non-zero exit status of the spawned coprocess. To -make it happen, Drop the line killing it (it will exit anyway) and pass -its PID to 'wait'. - -While being at it, put the sleep into the correct spot (otherwise the -check for chain 'foo' existence fails as it runs too early) and make -said chain existence check effective. - -Fixes: 4e3c11a6f5a94 ("nft: Fix for ruleset flush while restoring") -Signed-off-by: Phil Sutter -(cherry picked from commit ea12b1d2b191f100a6fdb83af4681364e4dba12a) ---- - .../shell/testcases/nft-only/0007-mid-restore-flush_0 | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 -index 43880ffbc5851..981f007f205b9 100755 ---- a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 -+++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 -@@ -13,11 +13,11 @@ COMMIT - :foo [0:0] - EOF - --$XT_MULTI iptables-save | grep -q ':foo' -+sleep 1 -+$XT_MULTI iptables-save | grep -q ':foo' || exit 1 - nft flush ruleset - - echo "COMMIT" >&"${COPROC[1]}" --sleep 1 -- --[[ -n $COPROC_PID ]] && kill $COPROC_PID --wait -+# close the pipe to make iptables-restore exit if it didn't error out yet -+eval "exec ${COPROC[1]}>&-" -+wait $COPROC_PID --- -2.41.0 - diff --git a/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch b/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch deleted file mode 100644 index 0f367e7..0000000 --- a/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch +++ /dev/null @@ -1,277 +0,0 @@ -From fea09f9273e279d0a18a9db368546897fe3b2edd Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 6 Sep 2023 16:32:47 +0200 -Subject: [PATCH] nft: Fix for useless meta expressions in rule - -A relict of legacy iptables' mandatory matching on interfaces and IP -addresses is support for the '-i +' notation, basically a "match any -input interface". Trying to make things better than its predecessor, -iptables-nft boldly optimizes that nop away - not entirely though, the -meta expression loading the interface name was left in place. While not -a problem (apart from pointless overhead) in current HEAD, v1.8.7 would -trip over this as a following cmp expression (for another match) was -incorrectly linked to that stale meta expression, loading strange values -into the respective interface name field. - -While being at it, merge and generalize the functions into a common one -for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. - -Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 -Signed-off-by: Phil Sutter -(cherry picked from commit 52ed0ac516db9f3a44f61dfd8b65d20631bfa95b) ---- - extensions/libebt_standard.t | 4 ++++ - extensions/libip6t_standard.t | 3 +++ - extensions/libxt_standard.t | 2 ++ - iptables/nft-arp.c | 4 ++-- - iptables/nft-bridge.c | 38 ++++------------------------- - iptables/nft-ipv4.c | 4 ++-- - iptables/nft-ipv6.c | 4 ++-- - iptables/nft-shared.c | 45 ++++++++++++----------------------- - iptables/nft-shared.h | 4 ++-- - 9 files changed, 36 insertions(+), 72 deletions(-) - -diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t -index 97cb3baaf6d21..370a12f4a2cec 100644 ---- a/extensions/libebt_standard.t -+++ b/extensions/libebt_standard.t -@@ -14,6 +14,10 @@ - -o foobar;=;FAIL - --logical-in br0;=;OK - --logical-out br1;=;FAIL -+-i + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK -+-i + -p ip;-p IPv4;OK -+--logical-in + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK -+--logical-in + -p ip;-p IPv4;OK - :FORWARD - -i foobar;=;OK - -o foobar;=;OK -diff --git a/extensions/libip6t_standard.t b/extensions/libip6t_standard.t -index a528af10ea152..0c559cc5021f6 100644 ---- a/extensions/libip6t_standard.t -+++ b/extensions/libip6t_standard.t -@@ -3,3 +3,6 @@ - ! -d ::;! -d ::/128;OK - ! -s ::;! -s ::/128;OK - -s ::/64;=;OK -+:INPUT -+-i + -d c0::fe;-d c0::fe/128;OK -+-i + -p tcp;-p tcp;OK -diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t -index 6ed978e442b80..7c83cfa3ba232 100644 ---- a/extensions/libxt_standard.t -+++ b/extensions/libxt_standard.t -@@ -24,3 +24,5 @@ - :FORWARD - --protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK - -ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -+-i + -d 1.2.3.4;-d 1.2.3.4/32;OK -+-i + -p tcp;-p tcp;OK -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 889387e4db592..54cddbc5f07cc 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -49,12 +49,12 @@ static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx, - - if (fw->arp.iniface[0] != '\0') { - op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN); -- add_iniface(h, r, fw->arp.iniface, op); -+ add_iface(h, r, fw->arp.iniface, NFT_META_IIFNAME, op); - } - - if (fw->arp.outiface[0] != '\0') { - op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT); -- add_outiface(h, r, fw->arp.outiface, op); -+ add_iface(h, r, fw->arp.outiface, NFT_META_OIFNAME, op); - } - - if (fw->arp.arhrd != 0 || -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index a41f411fbba14..9e349813ee5b3 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -65,36 +65,6 @@ static void ebt_print_mac_and_mask(const unsigned char *mac, const unsigned char - xtables_print_mac_and_mask(mac, mask); - } - --static void add_logical_iniface(struct nft_handle *h, struct nftnl_rule *r, -- char *iface, uint32_t op) --{ -- int iface_len; -- uint8_t reg; -- -- iface_len = strlen(iface); -- -- add_meta(h, r, NFT_META_BRI_IIFNAME, ®); -- if (iface[iface_len - 1] == '+') -- add_cmp_ptr(r, op, iface, iface_len - 1, reg); -- else -- add_cmp_ptr(r, op, iface, iface_len + 1, reg); --} -- --static void add_logical_outiface(struct nft_handle *h, struct nftnl_rule *r, -- char *iface, uint32_t op) --{ -- int iface_len; -- uint8_t reg; -- -- iface_len = strlen(iface); -- -- add_meta(h, r, NFT_META_BRI_OIFNAME, ®); -- if (iface[iface_len - 1] == '+') -- add_cmp_ptr(r, op, iface, iface_len - 1, reg); -- else -- add_cmp_ptr(r, op, iface, iface_len + 1, reg); --} -- - static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) - { - return add_action(r, cs, false); -@@ -130,22 +100,22 @@ static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, - - if (fw->in[0] != '\0') { - op = nft_invflags2cmp(fw->invflags, EBT_IIN); -- add_iniface(h, r, fw->in, op); -+ add_iface(h, r, fw->in, NFT_META_IIFNAME, op); - } - - if (fw->out[0] != '\0') { - op = nft_invflags2cmp(fw->invflags, EBT_IOUT); -- add_outiface(h, r, fw->out, op); -+ add_iface(h, r, fw->out, NFT_META_OIFNAME, op); - } - - if (fw->logical_in[0] != '\0') { - op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALIN); -- add_logical_iniface(h, r, fw->logical_in, op); -+ add_iface(h, r, fw->logical_in, NFT_META_BRI_IIFNAME, op); - } - - if (fw->logical_out[0] != '\0') { - op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALOUT); -- add_logical_outiface(h, r, fw->logical_out, op); -+ add_iface(h, r, fw->logical_out, NFT_META_BRI_OIFNAME, op); - } - - if (fw->bitmask & EBT_ISOURCE) { -diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c -index fb62103fd38d7..8449407bd40ed 100644 ---- a/iptables/nft-ipv4.c -+++ b/iptables/nft-ipv4.c -@@ -35,12 +35,12 @@ static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx, - - if (cs->fw.ip.iniface[0] != '\0') { - op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN); -- add_iniface(h, r, cs->fw.ip.iniface, op); -+ add_iface(h, r, cs->fw.ip.iniface, NFT_META_IIFNAME, op); - } - - if (cs->fw.ip.outiface[0] != '\0') { - op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_OUT); -- add_outiface(h, r, cs->fw.ip.outiface, op); -+ add_iface(h, r, cs->fw.ip.outiface, NFT_META_OIFNAME, op); - } - - if (cs->fw.ip.proto != 0) { -diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c -index d36e06812e08d..443815da77acf 100644 ---- a/iptables/nft-ipv6.c -+++ b/iptables/nft-ipv6.c -@@ -34,12 +34,12 @@ static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx, - - if (cs->fw6.ipv6.iniface[0] != '\0') { - op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN); -- add_iniface(h, r, cs->fw6.ipv6.iniface, op); -+ add_iface(h, r, cs->fw6.ipv6.iniface, NFT_META_IIFNAME, op); - } - - if (cs->fw6.ipv6.outiface[0] != '\0') { - op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT); -- add_outiface(h, r, cs->fw6.ipv6.outiface, op); -+ add_iface(h, r, cs->fw6.ipv6.outiface, NFT_META_OIFNAME, op); - } - - if (cs->fw6.ipv6.proto != 0) { -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 413503ed86932..a23a2c8a8fa11 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -155,44 +155,29 @@ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg) - add_cmp_ptr(r, op, &val, sizeof(val), sreg); - } - --void add_iniface(struct nft_handle *h, struct nftnl_rule *r, -- char *iface, uint32_t op) -+void add_iface(struct nft_handle *h, struct nftnl_rule *r, -+ char *iface, uint32_t key, uint32_t op) - { -- int iface_len; -+ int iface_len = strlen(iface); - uint8_t reg; - -- iface_len = strlen(iface); - -- add_meta(h, r, NFT_META_IIFNAME, ®); - if (iface[iface_len - 1] == '+') { -- if (iface_len > 1) -- add_cmp_ptr(r, op, iface, iface_len - 1, reg); -- else if (op != NFT_CMP_EQ) -- add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D", -- strlen("INVAL/D") + 1, reg); -+ if (iface_len > 1) { -+ iface_len -= 1; -+ } else if (op != NFT_CMP_EQ) { -+ op = NFT_CMP_EQ; -+ iface = "INVAL/D"; -+ iface_len = strlen(iface) + 1; -+ } else { -+ return; /* -o + */ -+ } - } else { -- add_cmp_ptr(r, op, iface, iface_len + 1, reg); -+ iface_len += 1; - } --} -- --void add_outiface(struct nft_handle *h, struct nftnl_rule *r, -- char *iface, uint32_t op) --{ -- int iface_len; -- uint8_t reg; - -- iface_len = strlen(iface); -- -- add_meta(h, r, NFT_META_OIFNAME, ®); -- if (iface[iface_len - 1] == '+') { -- if (iface_len > 1) -- add_cmp_ptr(r, op, iface, iface_len - 1, reg); -- else if (op != NFT_CMP_EQ) -- add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D", -- strlen("INVAL/D") + 1, reg); -- } else { -- add_cmp_ptr(r, op, iface, iface_len + 1, reg); -- } -+ add_meta(h, r, key, ®); -+ add_cmp_ptr(r, op, iface, iface_len, reg); - } - - void add_addr(struct nft_handle *h, struct nftnl_rule *r, -diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h -index 9065e52f669e1..94cc295436a27 100644 ---- a/iptables/nft-shared.h -+++ b/iptables/nft-shared.h -@@ -193,8 +193,8 @@ void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len, uint - void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op, uint8_t sreg); - void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op, uint8_t sreg); - void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg); --void add_iniface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); --void add_outiface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); -+void add_iface(struct nft_handle *h, struct nftnl_rule *r, -+ char *iface, uint32_t key, uint32_t op); - void add_addr(struct nft_handle *h, struct nftnl_rule *r, enum nft_payload_bases base, int offset, - void *data, void *mask, size_t len, uint32_t op); - void add_proto(struct nft_handle *h, struct nftnl_rule *r, int offset, size_t len, --- -2.41.0 - diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt new file mode 100644 index 0000000..cd4a35b --- /dev/null +++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E +o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+ +2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w +nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ +P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF +qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK +5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz +ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX +u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT +/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b +cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L +LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF +8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL +5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK +AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi +Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR +VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF +RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B +uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE +zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq +ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v +3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X +iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi +wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/ +UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj +M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm +97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E +FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW +IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb +0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF +GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu +bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8 +QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD +Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU +3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR +yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS +C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K +klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I +zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST +Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM +X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh +5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB +woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT +njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl +yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU +hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv +BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj +ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh +hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP +tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s +E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H +fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv +CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT +EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ +gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC +9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W +oD8ElPP+m/v6iA== +=70vD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index cb64d89..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,70 +10,35 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.9 -Release: 4%{?dist}.1 -Source: %{url}/files/%{name}-%{version}.tar.xz -Source1: iptables.init -Source2: iptables-config -Source3: iptables.service -Source4: sysconfig_iptables -Source5: sysconfig_ip6tables -Source6: arptables-nft-helper - -Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch -Patch002: 0002-etc-Drop-xtables.conf.patch -Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch -Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch -Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch -Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch -Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch -Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch -Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch -Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch -Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch -Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch -Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch -Patch014: 0014-nft-shared-Drop-unused-include.patch -Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch -Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch -Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch -Patch018: 0018-iptables-Fix-setting-of-ipv6-counters.patch -Patch019: 0019-iptables-Fix-handling-of-non-existent-chains.patch -Patch020: 0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch -Patch021: 0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch -Patch022: 0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch -Patch023: 0023-nft-Special-casing-for-among-match-in-compare_matche.patch -Patch024: 0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch -Patch025: 0025-tables-Reject-invalid-chain-names-when-renaming.patch -Patch026: 0026-ebtables-Improve-invalid-chain-name-detection.patch -Patch027: 0027-tests-shell-Fix-and-extend-chain-rename-test.patch -Patch028: 0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch -Patch029: 0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch -Patch030: 0030-man-iptables.8-Fix-intra-page-reference.patch -Patch031: 0031-man-iptables.8-Clarify-goto-description.patch -Patch032: 0032-man-iptables-restore.8-Fix-modprobe-description.patch -Patch033: 0033-man-iptables-restore.8-Consistently-document-w-optio.patch -Patch034: 0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch -Patch035: 0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch -Patch036: 0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch -Patch037: 0037-man-Trivial-Missing-space-after-comma.patch -Patch038: 0038-man-iptables-save.8-Fix-modprobe-description.patch -Patch039: 0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch -Patch040: 0040-tests-iptables-test-Fix-command-segfault-reports.patch -Patch041: 0041-nft-Create-builtin-chains-with-counters-enabled.patch -Patch042: 0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch -Patch043: 0043-doc-fix-example-of-xt_cpu.patch -Patch044: 0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch -Patch045: 0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch -Patch046: 0046-nft-Fix-for-useless-meta-expressions-in-rule.patch +Version: 1.8.11 +Release: 12%{?dist} +Source0: %{url}/files/%{name}-%{version}.tar.xz +source1: %{url}/files/%{name}-%{version}.tar.xz.sig +Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt +Source3: iptables.init +Source4: iptables-config +Source5: iptables.service +Source6: sysconfig_iptables +Source7: sysconfig_ip6tables +Source8: arptables-helper +Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 -License: GPLv2 and Artistic Licence 2.0 and ISC +License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) -# libnfnetlink-devel is requires for nfnl_osf +# libnfnetlink-devel is required for nfnl_osf BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers @@ -83,40 +48,35 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.6 +BuildRequires: pkgconfig(libnftnl) >= 1.2.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make +BuildRequires: gnupg2 %description The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. -%package compat -Summary: Temporary transitioning package -Obsoletes: %{name} < 1.8.7-4 -Requires: %{name}-legacy = %{version}-%{release} -Requires: %{name}-utils = %{version}-%{release} - -%description compat -This package only exists to help transition iptables users to the new -package split. It will be removed after one distribution release cycle, please -do not reference it or depend on it in any way. - %package legacy Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Conflicts: alternatives < 1.32-1 +Requires(post): /usr/sbin/update-alternatives +Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif +Provides: %{name}-compat = %{version}-%{release} +Obsoletes: %{name}-compat < 1.8.9-7 + +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -140,9 +100,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 @@ -176,6 +135,14 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -198,19 +165,25 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} -Requires(post): %{_sbindir}/update-alternatives -Requires(post): %{_bindir}/readlink -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(post): /usr/bin/readlink +Requires(postun): /usr/sbin/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 + +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. %prep +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 %build @@ -233,20 +206,24 @@ rm -f %{buildroot}%{_libdir}/*.la # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} -install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init +install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig -install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config +install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config -install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables -install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables +install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir} -sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} +sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} # install legacy actions for service command @@ -272,38 +249,42 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 - -# Drop xtables.conf, it's not used -rm -f %{buildroot}%{_sysconfdir}/xtables.conf +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink -rm -f %{buildroot}%{_bindir}/iptables-xml -ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %ldconfig_scriptlets %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save + +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif %postun legacy if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives --remove \ + update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -319,97 +300,112 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $(/dev/null || : +done +%endif + %post services +%systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service %preun services +%systemd_preun arptables.service ebtables.service %systemd_preun iptables.service ip6tables.service %postun services %?ldconfig +%systemd_postun arptables.service ebtables.service %systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-nft 10 \ - --slave $pfx6 ip6tables $pfx6-nft \ - --slave $pfx-restore iptables-restore $pfx-nft-restore \ - --slave $pfx-save iptables-save $pfx-nft-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ - --slave $pfx6-save ip6tables-save $pfx6-nft-save + --follower $pfx6 ip6tables $pfx6-nft \ + --follower $pfx-restore iptables-restore $pfx-nft-restore \ + --follower $pfx-save iptables-save $pfx-nft-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \ + --follower $pfx6-save ip6tables-save $pfx6-nft-save pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi -%{_sbindir}/update-alternatives --install \ +update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ - --slave $pfx-save ebtables-save $pfx-nft-save \ - --slave $pfx-restore ebtables-restore $pfx-nft-restore \ - ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} + --follower $pfx-save ebtables-save $pfx-nft-save \ + --follower $pfx-restore ebtables-restore $pfx-nft-restore \ + ${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi -%{_sbindir}/update-alternatives --install \ +update-alternatives --install \ $pfx arptables $pfx-nft 10 \ - --slave $pfx-save arptables-save $pfx-nft-save \ - --slave $pfx-restore arptables-restore $pfx-nft-restore \ - ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ - ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + --follower $pfx-save arptables-save $pfx-nft-save \ + --follower $pfx-restore arptables-restore $pfx-nft-restore \ + ${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ + ${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ + ${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} + +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - %{_sbindir}/update-alternatives --remove \ - $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi -%files compat - %files legacy %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -438,9 +434,13 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING @@ -460,25 +460,112 @@ fi %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %{_sbindir}/ebtables-translate +%{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper +%{_mandir}/man8/arptables-translate* +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog -* Tue Oct 10 2023 Phil Sutter - 1.8.9-4.1 +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + +* Fri Jan 17 2025 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 +- Keep symlinks managed by alternatives under /usr/sbin + +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + +* Fri Nov 08 2024 Phil Sutter - 1.8.11-1 +- new version + +* Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-14 +- Add unmerged-sbin compat also for -legacy subpackage + +* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-13 +- Bump release and add changelog entry + +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 1.8.10-12 +- Rebuilt for the bin-sbin merge + +* Fri Jul 05 2024 Phil Sutter - 1.8.10-11 +- Add missing build dependency + +* Fri Jul 05 2024 Phil Sutter - 1.8.10-10 +- Verify tarball GPG signature + +* Wed Jul 03 2024 Phil Sutter - 1.8.10-9 - Backport fixes from upstream +* Tue May 21 2024 Phil Sutter - 1.8.10-8 +- Make iptables-legacy own %%{_datadir}/xtables + +* Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jan 11 2024 Phil Sutter - 1.8.10-5 +- Backport fixes from upstream +- Fix flatpak build + +* Tue Nov 07 2023 Phil Sutter - 1.8.10-4 +- The actual obsoletes fix + +* Tue Nov 07 2023 Phil Sutter - 1.8.10-3 +- Fix compat sub-package obsoletion + +* Tue Oct 10 2023 Phil Sutter - 1.8.10-2 +- Obsolete dropped compat package + +* Tue Oct 10 2023 Phil Sutter - 1.8.10-1 +- New version 1.8.10 +- Drop compat sub-package + +* Tue Aug 15 2023 Phil Sutter - 1.8.9-6 +- Convert license to SPDX format + +* Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream diff --git a/sources b/sources index fef1030..1f7b750 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 +SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2 diff --git a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh index 32eab99..952cd4c 100755 --- a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh +++ b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET=testset6 rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh index 438468d..26a667e 100755 --- a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh +++ b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" TESTD=$PWD rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "source $TESTD/rules.in" 0 "read ruleset" diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 889c1b6..86652af 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" prepare_page() { @@ -42,7 +41,6 @@ prepare_page() { rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlLogInfo $(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" @@ -121,10 +119,14 @@ rlJournalStart rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6" rlRun "iptables -t raw -F" rlRun "ip6tables -t raw -F" - rlRun "rmmod nf_log_ipv4" - rlRun "rmmod nf_log_ipv6" - rlRun "rmmod nf_log_common" - rlRun "rmmod nfnetlink_log" 0,1 + if rlTestVersion "$(uname -r)" "<" "4.6"; then + rlRun "rmmod nf_log_ipv4" + rlRun "rmmod nf_log_ipv6" + rlRun "rmmod nf_log_common" + rlRun "rmmod nfnetlink_log" 0,1 + else + rlLogInfo "new kernel detected: skipping unloading modules" + fi rlLogInfo "restoring services" for svc in $SERVICES; do rlServiceRestore $svc diff --git a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh index 888dfbd..0b4032e 100755 --- a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh +++ b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" CGNUM="15" CGNAME="15" CGDIR="/sys/fs/cgroup/net_cls/$CGNAME" @@ -41,7 +40,6 @@ SKIP6=false rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel-$(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/initscript-sanity/runtest.sh b/tests/initscript-sanity/runtest.sh index e270b78..b132033 100755 --- a/tests/initscript-sanity/runtest.sh +++ b/tests/initscript-sanity/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 004d568..f68925c 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" diff --git a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh index f59a908..d06fc4a 100755 --- a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh +++ b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "cp /etc/sysconfig/ip6tables ." diff --git a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh index 79b2696..2daddb3 100755 --- a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh +++ b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" for svc in $SERVICES; do diff --git a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh index d17e693..f409501 100755 --- a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh +++ b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh @@ -29,13 +29,11 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET4="ipsetv4" IPSET6="ipsetv6" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ipset create $IPSET4 hash:ip" diff --git a/tests/iptables-save-cuts-space-before-j/runtest.sh b/tests/iptables-save-cuts-space-before-j/runtest.sh index a6a5099..bba6bf2 100755 --- a/tests/iptables-save-cuts-space-before-j/runtest.sh +++ b/tests/iptables-save-cuts-space-before-j/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlServiceStart iptables diff --git a/tests/iptables-save-modprobe-option/runtest.sh b/tests/iptables-save-modprobe-option/runtest.sh index 22951c4..240c76e 100755 --- a/tests/iptables-save-modprobe-option/runtest.sh +++ b/tests/iptables-save-modprobe-option/runtest.sh @@ -30,11 +30,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartTest - rlAssertRpm $PACKAGE rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported" rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported" rlPhaseEnd diff --git a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh index c3223b5..abfb03a 100755 --- a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh +++ b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd