From 21624d30276597c18535a0ea0fb582d95dbbf062 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 07:35:31 +0000 Subject: [PATCH 01/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index d779895..34455fc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -447,6 +447,9 @@ fi %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream From dc297257aab2e1372cf34d97a1ffdd5e5241733b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 15 Aug 2023 11:39:21 +0200 Subject: [PATCH 02/43] Convert license to SPDX format Signed-off-by: Phil Sutter --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 34455fc..57a50f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -40,7 +40,7 @@ Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 -License: GPLv2 and Artistic Licence 2.0 and ISC +License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) @@ -447,6 +447,9 @@ fi %changelog +* Tue Aug 15 2023 Phil Sutter - 1.8.9-6 +- Convert license to SPDX format + * Thu Jul 20 2023 Fedora Release Engineering - 1.8.9-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 97407d1230d0860c3660855169def22be7749da7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 17:33:55 +0200 Subject: [PATCH 03/43] iptables-1.8.10-1 - New version 1.8.10 - Drop compat sub-package Resolves: rhbz#2243041 --- .gitignore | 1 + ...s-NAT-Fix-for-Werror-format-security.patch | 30 --- 0002-etc-Drop-xtables.conf.patch | 132 ---------- ...x-for-unknown-argument-error-message.patch | 148 ----------- ...es-Refuse-unselected-targets-options.patch | 232 ------------------ ...-Properly-split-input-in-replay-mode.patch | 31 --- ...bebt_redirect-Fix-target-translation.patch | 48 ---- ...t_redirect-Fix-for-wrong-syntax-in-t.patch | 48 ---- ...t_ip-Do-not-use-ip-dscp-for-translat.patch | 50 ---- ...t_ip-Translation-has-to-match-on-eth.patch | 85 ------- ...the-missing-chunk-types-in-sctp_help.patch | 36 --- ...Add-missing-linux-netfilter-xt_LOG.h.patch | 101 -------- ...-for-deletion-of-new-referenced-rule.patch | 67 ----- ...ables-Fix-checking-existence-of-rule.patch | 33 --- 0014-nft-shared-Drop-unused-include.patch | 29 --- ...rsing-of-inverted-arp-operation-matc.patch | 31 --- ...-t-omit-standard-matches-if-inverted.patch | 42 ---- ...ing-of-option-arguments-in-same-word.patch | 211 ---------------- iptables.spec | 44 +--- sources | 2 +- 20 files changed, 9 insertions(+), 1392 deletions(-) delete mode 100644 0001-extensions-NAT-Fix-for-Werror-format-security.patch delete mode 100644 0002-etc-Drop-xtables.conf.patch delete mode 100644 0003-Proper-fix-for-unknown-argument-error-message.patch delete mode 100644 0004-ebtables-Refuse-unselected-targets-options.patch delete mode 100644 0005-tests-xlate-Properly-split-input-in-replay-mode.patch delete mode 100644 0006-extensions-libebt_redirect-Fix-target-translation.patch delete mode 100644 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch delete mode 100644 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch delete mode 100644 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch delete mode 100644 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch delete mode 100644 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch delete mode 100644 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch delete mode 100644 0013-ip6tables-Fix-checking-existence-of-rule.patch delete mode 100644 0014-nft-shared-Drop-unused-include.patch delete mode 100644 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch delete mode 100644 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch delete mode 100644 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch diff --git a/.gitignore b/.gitignore index 141b2e8..4cb5d7a 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /iptables-1.8.7.tar.bz2 /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz +/iptables-1.8.10.tar.xz diff --git a/0001-extensions-NAT-Fix-for-Werror-format-security.patch b/0001-extensions-NAT-Fix-for-Werror-format-security.patch deleted file mode 100644 index cecd191..0000000 --- a/0001-extensions-NAT-Fix-for-Werror-format-security.patch +++ /dev/null @@ -1,30 +0,0 @@ -From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Jan 2023 14:38:44 +0100 -Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security - -Have to pass either a string literal or format string to xt_xlate_add(). - -Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE") -Signed-off-by: Phil Sutter -(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc) ---- - extensions/libxt_NAT.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c -index da9f22012c5d6..2a6343986d54f 100644 ---- a/extensions/libxt_NAT.c -+++ b/extensions/libxt_NAT.c -@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r, - if (r->flags & NF_NAT_RANGE_PROTO_OFFSET) - return 0; - -- xt_xlate_add(xl, tgt); -+ xt_xlate_add(xl, "%s", tgt); - if (strlen(range_str)) - xt_xlate_add(xl, " to %s", range_str); - if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) { --- -2.40.0 - diff --git a/0002-etc-Drop-xtables.conf.patch b/0002-etc-Drop-xtables.conf.patch deleted file mode 100644 index e676561..0000000 --- a/0002-etc-Drop-xtables.conf.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 17 Jan 2023 16:38:43 +0100 -Subject: [PATCH] etc: Drop xtables.conf - -The file is not used since the commit this one fixes. Also it wasn't -installed until recently, when commit 3822a992bc277 ("Makefile: Fix for -'make distcheck'") added it in the wrong spot in an attempt to reduce -differences between tarballs generated by 'make tarball' and 'make -dist'. - -While being at it, drop stale xtables_config_main() prototype from -xtables-multi.h. - -Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf") -Signed-off-by: Phil Sutter -(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728) ---- - Makefile.am | 2 +- - etc/xtables.conf | 74 ---------------------------------------- - iptables/xtables-multi.h | 1 - - 3 files changed, 1 insertion(+), 76 deletions(-) - delete mode 100644 etc/xtables.conf - -diff --git a/Makefile.am b/Makefile.am -index 451c3cb2d5887..299ab46d7b8e2 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -20,7 +20,7 @@ EXTRA_DIST = autogen.sh iptables-test.py xlate-test.py - - if ENABLE_NFTABLES - confdir = $(sysconfdir) --dist_conf_DATA = etc/ethertypes etc/xtables.conf -+dist_conf_DATA = etc/ethertypes - endif - - .PHONY: tarball -diff --git a/etc/xtables.conf b/etc/xtables.conf -deleted file mode 100644 -index 3c54ced043d82..0000000000000 ---- a/etc/xtables.conf -+++ /dev/null -@@ -1,74 +0,0 @@ --family ipv4 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family ipv6 { -- table raw { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -300 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -300 -- } -- -- table mangle { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -150 -- chain INPUT hook NF_INET_LOCAL_IN prio -150 -- chain FORWARD hook NF_INET_FORWARD prio -150 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -150 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio -150 -- } -- -- table filter { -- chain INPUT hook NF_INET_LOCAL_IN prio 0 -- chain FORWARD hook NF_INET_FORWARD prio 0 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 0 -- } -- -- table nat { -- chain PREROUTING hook NF_INET_PRE_ROUTING prio -100 -- chain INPUT hook NF_INET_LOCAL_IN prio 100 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio -100 -- chain POSTROUTING hook NF_INET_POST_ROUTING prio 100 -- } -- -- table security { -- chain INPUT hook NF_INET_LOCAL_IN prio 50 -- chain FORWARD hook NF_INET_FORWARD prio 50 -- chain OUTPUT hook NF_INET_LOCAL_OUT prio 50 -- } --} -- --family arp { -- table filter { -- chain INPUT hook NF_ARP_IN prio 0 -- chain OUTPUT hook NF_ARP_OUT prio 0 -- } --} -diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h -index 94c24d5a22c7e..833c11a2ac914 100644 ---- a/iptables/xtables-multi.h -+++ b/iptables/xtables-multi.h -@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **); - extern int xtables_eb_main(int, char **); - extern int xtables_eb_restore_main(int, char **); - extern int xtables_eb_save_main(int, char **); --extern int xtables_config_main(int, char **); - extern int xtables_monitor_main(int, char **); - - extern struct xtables_globals arptables_globals; --- -2.40.0 - diff --git a/0003-Proper-fix-for-unknown-argument-error-message.patch b/0003-Proper-fix-for-unknown-argument-error-message.patch deleted file mode 100644 index d807c54..0000000 --- a/0003-Proper-fix-for-unknown-argument-error-message.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 01:51:43 +0100 -Subject: [PATCH] Proper fix for "unknown argument" error message - -While commit 1b8210f848631 kind of fixed the corner-case of invalid -short-options packed with others, it broke error reporting for -long-options. Revert it and deploy a proper solution: - -When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long -sets the variable 'optopt' to the invalid character's value. Use it for -reporting instead of optind if set. - -To distinguish between invalid options and missing option arguments, -ebtables-translate optstring needs adjustment. - -Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters") -Signed-off-by: Phil Sutter -(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b) ---- - .../testcases/iptables/0009-unknown-arg_0 | 31 +++++++++++++++++++ - iptables/xshared.c | 9 ++++-- - iptables/xtables-eb-translate.c | 8 ++--- - iptables/xtables-eb.c | 17 ++++++---- - 4 files changed, 50 insertions(+), 15 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -new file mode 100755 -index 0000000000000..ac6e743966196 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 -@@ -0,0 +1,31 @@ -+#!/bin/bash -+ -+rc=0 -+ -+check() { -+ local cmd="$1" -+ local msg="$2" -+ -+ $XT_MULTI $cmd 2>&1 | grep -q "$msg" || { -+ echo "cmd: $XT_MULTI $1" -+ echo "exp: $msg" -+ echo "res: $($XT_MULTI $cmd 2>&1)" -+ rc=1 -+ } -+} -+ -+cmds="iptables ip6tables" -+[[ $XT_MULTI == *xtables-nft-multi ]] && { -+ cmds+=" ebtables" -+ cmds+=" iptables-translate" -+ cmds+=" ip6tables-translate" -+ cmds+=" ebtables-translate" -+} -+ -+for cmd in $cmds; do -+ check "${cmd} --foo" 'unknown option "--foo"' -+ check "${cmd} -A" 'option "-A" requires an argument' -+ check "${cmd} -aL" 'unknown option "-a"' -+done -+ -+exit $rc -diff --git a/iptables/xshared.c b/iptables/xshared.c -index f93529b11a319..ac51fac5ce9ed 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs, - if (cs->c == ':') - xtables_error(PARAMETER_PROBLEM, "option \"%s\" " - "requires an argument", cs->argv[optind-1]); -- if (cs->c == '?') -- xtables_error(PARAMETER_PROBLEM, "unknown option " -- "\"%s\"", cs->argv[optind-1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } - xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - -diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c -index 13b6b864a5f24..0c35272051752 100644 ---- a/iptables/xtables-eb-translate.c -+++ b/iptables/xtables-eb-translate.c -@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - printf("nft "); - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, -- "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { -+ "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) { - cs.c = c; - switch (c) { - case 'A': /* Add a rule */ -@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind - 1]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D') -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 7214a767ffe96..412b5cccdc46a 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs) - return 0; - } - } -- return 1; -+ if (cs->c == ':') -+ xtables_error(PARAMETER_PROBLEM, "option \"%s\" " -+ "requires an argument", cs->argv[optind - 1]); -+ if (cs->c == '?') { -+ char optoptstr[3] = {'-', optopt, '\0'}; -+ -+ xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"", -+ optopt ? optoptstr : cs->argv[optind - 1]); -+ } -+ xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg); - } - - int nft_init_eb(struct nft_handle *h, const char *pname) -@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - continue; - default: - ebt_check_inverse2(optarg, argc, argv); -- -- if (ebt_command_default(&cs)) -- xtables_error(PARAMETER_PROBLEM, -- "Unknown argument: '%s'", -- argv[optind]); -+ ebt_command_default(&cs); - - if (command != 'A' && command != 'I' && - command != 'D' && command != 'C' && command != 14) --- -2.40.0 - diff --git a/0004-ebtables-Refuse-unselected-targets-options.patch b/0004-ebtables-Refuse-unselected-targets-options.patch deleted file mode 100644 index c41ba45..0000000 --- a/0004-ebtables-Refuse-unselected-targets-options.patch +++ /dev/null @@ -1,232 +0,0 @@ -From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 25 Jan 2023 02:01:56 +0100 -Subject: [PATCH] ebtables: Refuse unselected targets' options - -Unlike legacy, ebtables-nft would allow e.g.: - -| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be - -While the result is correct, it may mislead users into believing -multiple targets are possible per rule. Better follow legacy's behaviour -and reject target options unless they have been "enabled" by a previous -'-j' option. - -To achieve this, one needs to distinguish targets from watchers also -attached to 'xtables_targets' and otherwise behaving like regular -matches. Introduce XTABLES_EXT_WATCHER to mark the two. - -The above works already, but error messages are misleading when using -the now unsupported syntax since target options have been merged -already. Solve this by not pre-loading the targets at all, code will -just fall back to loading ad '-j' parsing time as iptables does. - -Note how this also fixes for 'counter' statement being in wrong position -of ebtables-translate output. - -Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support") -Signed-off-by: Phil Sutter -(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b) ---- - extensions/libebt_dnat.txlate | 12 ++++---- - extensions/libebt_log.c | 1 + - extensions/libebt_mark.txlate | 16 +++++----- - extensions/libebt_nflog.c | 1 + - extensions/libebt_snat.txlate | 8 ++--- - include/xtables.h | 1 + - .../ebtables/0002-ebtables-save-restore_0 | 4 +-- - iptables/xtables-eb.c | 29 +++++++------------ - 8 files changed, 33 insertions(+), 39 deletions(-) - -diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate -index 9f305c76c954f..531a22aa3e14f 100644 ---- a/extensions/libebt_dnat.txlate -+++ b/extensions/libebt_dnat.txlate -@@ -1,8 +1,8 @@ --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE --nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE -+nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue' -diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c -index 045062196d20d..9f8d158956802 100644 ---- a/extensions/libebt_log.c -+++ b/extensions/libebt_log.c -@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl, - static struct xtables_target brlog_target = { - .name = "log", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_log_info)), -diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate -index d006e8ac94008..4ace1a1f5cfde 100644 ---- a/extensions/libebt_mark.txlate -+++ b/extensions/libebt_mark.txlate -@@ -1,11 +1,11 @@ --ebtables-translate -A INPUT --mark-set 42 --nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-set 42 -+nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept' - --ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN --nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter' -+ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN -+nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return' - --ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT --nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter' -+ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT -+nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept' - --ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP --nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter' -+ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP -+nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop' -diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c -index 115e15da45845..762d6d5d8bbe2 100644 ---- a/extensions/libebt_nflog.c -+++ b/extensions/libebt_nflog.c -@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl, - static struct xtables_target brnflog_watcher = { - .name = "nflog", - .revision = 0, -+ .ext_flags = XTABLES_EXT_WATCHER, - .version = XTABLES_VERSION, - .family = NFPROTO_BRIDGE, - .size = XT_ALIGN(sizeof(struct ebt_nflog_info)), -diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate -index 857a6052aed1a..37343d3a14754 100644 ---- a/extensions/libebt_snat.txlate -+++ b/extensions/libebt_snat.txlate -@@ -1,5 +1,5 @@ --ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff --nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter' -+ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff -+nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept' - --ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE --nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter' -+ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE -+nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue' -diff --git a/include/xtables.h b/include/xtables.h -index 4ffc8ec5a17e9..087a1d600f9ae 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -203,6 +203,7 @@ struct xtables_lmap { - - enum xtables_ext_flags { - XTABLES_EXT_ALIAS = 1 << 0, -+ XTABLES_EXT_WATCHER = 1 << 1, - }; - - struct xt_xlate; -diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -index 1091a4e80bebe..b4f9728bb9b6f 100755 ---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 -@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT - - $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT - $XT_MULTI ebtables -A foo --log --$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT -+$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT - $XT_MULTI ebtables -A foo --nflog - $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT - $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT -@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo - $XT_MULTI ebtables -N bar - $XT_MULTI ebtables -P bar RETURN - --$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT -+$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT - #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01 - - $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT -diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c -index 412b5cccdc46a..3a73e79725489 100644 ---- a/iptables/xtables-eb.c -+++ b/iptables/xtables-eb.c -@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void __ebt_load_watcher(const char *name, const char *typename) -+static void ebt_load_watcher(const char *name) - { - struct xtables_target *watcher; - size_t size; - - watcher = xtables_find_target(name, XTF_TRY_LOAD); - if (!watcher) { -- fprintf(stderr, "Unable to load %s %s\n", name, typename); -+ fprintf(stderr, "Unable to load %s watcher\n", name); - return; - } - -@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename) - xtables_error(OTHER_PROBLEM, "Can't alloc memory"); - } - --static void ebt_load_watcher(const char *name) --{ -- return __ebt_load_watcher(name, "watcher"); --} -- --static void ebt_load_target(const char *name) --{ -- return __ebt_load_watcher(name, "target"); --} -- - void ebt_load_match_extensions(void) - { - opts = ebt_original_options; -@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void) - - ebt_load_watcher("log"); - ebt_load_watcher("nflog"); -- -- ebt_load_target("mark"); -- ebt_load_target("dnat"); -- ebt_load_target("snat"); -- ebt_load_target("arpreply"); -- ebt_load_target("redirect"); -- ebt_load_target("standard"); - } - - void ebt_add_match(struct xtables_match *m, -@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs) - - /* Is it a watcher option? */ - for (t = xtables_targets; t; t = t->next) { -+ if (!(t->ext_flags & XTABLES_EXT_WATCHER)) -+ continue; -+ - if (t->parse && - t->parse(cs->c - t->option_offset, cs->argv, - ebt_invert, &t->tflags, NULL, &t->t)) { -@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, - optind = 0; - opterr = false; - -+ for (t = xtables_targets; t; t = t->next) { -+ t->tflags = 0; -+ t->used = 0; -+ } -+ - /* Getopt saves the day */ - while ((c = getopt_long(argc, argv, EBT_OPTSTRING, - opts, NULL)) != -1) { --- -2.40.0 - diff --git a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch b/0005-tests-xlate-Properly-split-input-in-replay-mode.patch deleted file mode 100644 index dd58948..0000000 --- a/0005-tests-xlate-Properly-split-input-in-replay-mode.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:48:33 +0100 -Subject: [PATCH] tests: xlate: Properly split input in replay mode - -Source command may contain quotes, using shlex.split() does the right -thing there. - -Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay") -Signed-off-by: Phil Sutter -(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf) ---- - xlate-test.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/xlate-test.py b/xlate-test.py -index 4cb1401b71677..217d2f0062682 100755 ---- a/xlate-test.py -+++ b/xlate-test.py -@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi' - if sourceline.find(';') >= 0: - sourceline, searchline = sourceline.split(';') - -- srcwords = sourceline.split() -+ srcwords = shlex.split(sourceline) - - srccmd = srcwords[0] - ipt = srccmd.split('-')[0] --- -2.40.0 - diff --git a/0006-extensions-libebt_redirect-Fix-target-translation.patch b/0006-extensions-libebt_redirect-Fix-target-translation.patch deleted file mode 100644 index b2f5481..0000000 --- a/0006-extensions-libebt_redirect-Fix-target-translation.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 22:28:24 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix target translation - -While EBT_ACCEPT is the default verdict for ebtables targets, omitting -it from translation implicitly converts it into 'continue'. Omit the -non-default EBT_CONTINUE instead. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 8 ++++++++ - 2 files changed, 9 insertions(+), 1 deletion(-) - create mode 100644 extensions/libebt_redirect.txlate - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 4d4c7a02cea89..389f3ccb53f60 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl, - const struct ebt_redirect_info *red = (const void*)params->target->data; - - xt_xlate_add(xl, "meta set pkttype host"); -- if (red->target != EBT_ACCEPT) -+ if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; - } -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -new file mode 100644 -index 0000000000000..f0dd5deaf6406 ---- /dev/null -+++ b/extensions/libebt_redirect.txlate -@@ -0,0 +1,8 @@ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+ -+ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' --- -2.40.0 - diff --git a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch deleted file mode 100644 index 8f8dcf6..0000000 --- a/0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 31 Jan 2023 23:32:50 +0100 -Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in - translation - -Meta key comes before 'set' in meta statement. - -Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension") -Signed-off-by: Phil Sutter -(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d) ---- - extensions/libebt_redirect.c | 2 +- - extensions/libebt_redirect.txlate | 6 +++--- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c -index 389f3ccb53f60..7821935e137aa 100644 ---- a/extensions/libebt_redirect.c -+++ b/extensions/libebt_redirect.c -@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl, - { - const struct ebt_redirect_info *red = (const void*)params->target->data; - -- xt_xlate_add(xl, "meta set pkttype host"); -+ xt_xlate_add(xl, "meta pkttype set host"); - if (red->target != EBT_CONTINUE) - xt_xlate_add(xl, " %s ", brredir_verdict(red->target)); - return 1; -diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate -index f0dd5deaf6406..d073ec774c4fa 100644 ---- a/extensions/libebt_redirect.txlate -+++ b/extensions/libebt_redirect.txlate -@@ -1,8 +1,8 @@ - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return' - - ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE --nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host' -+nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host' --- -2.40.0 - diff --git a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch deleted file mode 100644 index ad5a3ee..0000000 --- a/0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 18:58:36 +0100 -Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation - -Converting from TOS field match to DSCP one is irreversible, so replay -testing is not possible. Use a raw payload expression to produce -something that translates 1:1 back into an 'ip' match. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145) ---- - extensions/libebt_ip.c | 4 ++-- - extensions/libebt_ip.txlate | 2 +- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index fd87dae7e2c62..8b381aa10b5b7 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_DEST); - - if (info->bitmask & EBT_IP_TOS) { -- xt_xlate_add(xl, "ip dscp "); -+ xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) - xt_xlate_add(xl, "!= "); -- xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */ -+ xt_xlate_add(xl, "0x%02x ", info->tos); - } - if (info->bitmask & EBT_IP_PROTO) { - struct protoent *pe; -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 75c1db246fb81..562e3157d7b92 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 - nft 'add rule bridge filter FORWARD tcp dport 22 counter' --- -2.40.0 - diff --git a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch deleted file mode 100644 index 96cb5ad..0000000 --- a/0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 3 Feb 2023 17:37:40 +0100 -Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type - -On one hand, nft refuses th expression in bridge family if layer3 -protocol has not been assured by a previous match. On the other, ebt_ip -kernel module will only match on IPv4 packets, so there might be a -functional change in the translation versus the original. - -Instead of just always emitting an 'ether type' match, decide whether -it's actually needed - explicit "ip " payload matches (or -icmp ones) cause implicit creation of a match on IPv4 by nft. - -Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations") -Signed-off-by: Phil Sutter -(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70) ---- - extensions/libebt_ip.c | 21 +++++++++++++++++++++ - extensions/libebt_ip.txlate | 6 +++--- - 2 files changed, 24 insertions(+), 3 deletions(-) - -diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c -index 8b381aa10b5b7..68f34bff97deb 100644 ---- a/extensions/libebt_ip.c -+++ b/extensions/libebt_ip.c -@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl, - xtables_ipmask_to_numeric(maskp)); - } - -+static bool may_skip_ether_type_dep(uint8_t flags) -+{ -+ /* these convert to "ip (s|d)addr" matches */ -+ if (flags & (EBT_IP_SOURCE | EBT_IP_DEST)) -+ return true; -+ -+ /* icmp match triggers implicit ether type dependency in nft */ -+ if (flags & EBT_IP_ICMP) -+ return true; -+ -+ /* allow if "ip protocol" match is created by brip_xlate() */ -+ if (flags & EBT_IP_PROTO && -+ !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP))) -+ return true; -+ -+ return false; -+} -+ - static int brip_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { -@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl, - brip_xlate_nh(xl, info, EBT_IP_SOURCE); - brip_xlate_nh(xl, info, EBT_IP_DEST); - -+ if (!may_skip_ether_type_dep(info->bitmask)) -+ xt_xlate_add(xl, "ether type ip "); -+ - if (info->bitmask & EBT_IP_TOS) { - xt_xlate_add(xl, "@nh,8,8 "); - if (info->invflags & EBT_IP_TOS) -diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate -index 562e3157d7b92..28996832225cb 100644 ---- a/extensions/libebt_ip.txlate -+++ b/extensions/libebt_ip.txlate -@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1 - nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter' - - ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff --nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter' -+nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter' - - ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22 --nft 'add rule bridge filter FORWARD tcp dport 22 counter' -+nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535 --nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter' -+nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter' - - ebtables-translate -A FORWARD -p ip --ip-proto 253 - nft 'add rule bridge filter FORWARD ip protocol 253 counter' --- -2.40.0 - diff --git a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch b/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch deleted file mode 100644 index 410a831..0000000 --- a/0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Tue, 21 Feb 2023 12:19:42 -0500 -Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help - -Add the missing chunk types in sctp_help(), so that the help cmd can -display these chunk types as below: - - # iptables -p sctp --help - - chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE - -Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types") -Signed-off-by: Xin Long -Signed-off-by: Phil Sutter -(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa) ---- - extensions/libxt_sctp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c -index fe5f5621a033d..6e2b2745dcbd5 100644 ---- a/extensions/libxt_sctp.c -+++ b/extensions/libxt_sctp.c -@@ -50,7 +50,7 @@ static void sctp_help(void) - " --dport ...\n" - "[!] --chunk-types (all|any|none) (chunktype[:flags])+ match if all, any or none of\n" - " chunktypes are present\n" --"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n"); -+"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n"); - } - - static const struct option sctp_opts[] = { --- -2.40.0 - diff --git a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch b/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch deleted file mode 100644 index e0915f5..0000000 --- a/0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 22 Feb 2023 16:36:16 +0100 -Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h - -When merging IP-version-specific LOG extensions, a dependency to that -header was introduced without caching it. Fix this and drop the now -unused ip{,6}t_LOG.h files. - -Reported-by: Thomas Devoogdt -Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions") -Signed-off-by: Phil Sutter -(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147) ---- - include/linux/netfilter/xt_LOG.h | 20 ++++++++++++++++++++ - include/linux/netfilter_ipv4/ipt_LOG.h | 19 ------------------- - include/linux/netfilter_ipv6/ip6t_LOG.h | 19 ------------------- - 3 files changed, 20 insertions(+), 38 deletions(-) - create mode 100644 include/linux/netfilter/xt_LOG.h - delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h - delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h - -diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h -new file mode 100644 -index 0000000000000..167d4ddd2476b ---- /dev/null -+++ b/include/linux/netfilter/xt_LOG.h -@@ -0,0 +1,20 @@ -+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ -+#ifndef _XT_LOG_H -+#define _XT_LOG_H -+ -+/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */ -+#define XT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ -+#define XT_LOG_TCPOPT 0x02 /* Log TCP options */ -+#define XT_LOG_IPOPT 0x04 /* Log IP options */ -+#define XT_LOG_UID 0x08 /* Log UID owning local socket */ -+#define XT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ -+#define XT_LOG_MACDECODE 0x20 /* Decode MAC header */ -+#define XT_LOG_MASK 0x2f -+ -+struct xt_log_info { -+ unsigned char level; -+ unsigned char logflags; -+ char prefix[30]; -+}; -+ -+#endif /* _XT_LOG_H */ -diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h -deleted file mode 100644 -index dcdbadf9fd4a9..0000000000000 ---- a/include/linux/netfilter_ipv4/ipt_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IPT_LOG_H --#define _IPT_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IPT_LOG_IPOPT 0x04 /* Log IP options */ --#define IPT_LOG_UID 0x08 /* Log UID owning local socket */ --#define IPT_LOG_NFLOG 0x10 /* Unsupported, don't reuse */ --#define IPT_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IPT_LOG_MASK 0x2f -- --struct ipt_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ -diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h -deleted file mode 100644 -index 9dd5579e02ec7..0000000000000 ---- a/include/linux/netfilter_ipv6/ip6t_LOG.h -+++ /dev/null -@@ -1,19 +0,0 @@ --#ifndef _IP6T_LOG_H --#define _IP6T_LOG_H -- --/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */ --#define IP6T_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ --#define IP6T_LOG_TCPOPT 0x02 /* Log TCP options */ --#define IP6T_LOG_IPOPT 0x04 /* Log IP options */ --#define IP6T_LOG_UID 0x08 /* Log UID owning local socket */ --#define IP6T_LOG_NFLOG 0x10 /* Unsupported, don't use */ --#define IP6T_LOG_MACDECODE 0x20 /* Decode MAC header */ --#define IP6T_LOG_MASK 0x2f -- --struct ip6t_log_info { -- unsigned char level; -- unsigned char logflags; -- char prefix[30]; --}; -- --#endif /*_IPT_LOG_H*/ --- -2.40.0 - diff --git a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch deleted file mode 100644 index 8b20709..0000000 --- a/0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Feb 2023 18:09:25 +0100 -Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule - -Combining multiple corner-cases here: - -* Insert a rule before another new one which is not the first. Triggers - NFTNL_RULE_ID assignment of the latter. - -* Delete the referenced new rule in the same batch again. Causes - overwriting of the previously assigned RULE_ID. - -Consequently, iptables-nft-restore fails during *insert*, because the -reference is dangling. - -Reported-by: Eric Garver -Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch") -Signed-off-by: Phil Sutter -Tested-by: Eric Garver -(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4) ---- - iptables/nft.c | 3 ++- - .../ipt-restore/0003-restore-ordering_0 | 16 ++++++++++++++++ - 2 files changed, 18 insertions(+), 1 deletion(-) - -diff --git a/iptables/nft.c b/iptables/nft.c -index 63468cf3b1344..5896fd410ca78 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r) - - nftnl_rule_list_del(r); - -- if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE)) -+ if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) && -+ !nftnl_rule_get_u32(r, NFTNL_RULE_ID)) - nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id); - - obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r); -diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -index 3f1d229e915ff..5482b7ea17298 100755 ---- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -+++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 -@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT - -A FORWARD -m comment --comment "rule 3" -j ACCEPT' - - diff -u -Z <(echo -e "$EXPECT") <(ipt_show) -+ -+# test adding, referencing and deleting the same rule in a batch -+ -+$XT_MULTI iptables-restore < -Date: Mon, 3 Apr 2023 23:13:47 +0200 -Subject: [PATCH] ip6tables: Fix checking existence of rule - -Pass the proper entry size when creating a match mask for checking the -existence of a rule. Failing to do so causes wrong results. - -Reported-by: Jonathan Caicedo -Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables") -Signed-off-by: Markus Boehme -Signed-off-by: Phil Sutter -(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48) ---- - iptables/ip6tables.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c -index 345af4519bfe7..9afc32c1a21ed 100644 ---- a/iptables/ip6tables.c -+++ b/iptables/ip6tables.c -@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw, - int ret = 1; - unsigned char *mask; - -- mask = make_delete_mask(matches, target, sizeof(fw)); -+ mask = make_delete_mask(matches, target, sizeof(*fw)); - for (i = 0; i < nsaddrs; i++) { - fw->ipv6.src = saddrs[i]; - fw->ipv6.smsk = smasks[i]; --- -2.40.0 - diff --git a/0014-nft-shared-Drop-unused-include.patch b/0014-nft-shared-Drop-unused-include.patch deleted file mode 100644 index c4274ca..0000000 --- a/0014-nft-shared-Drop-unused-include.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 29 Mar 2023 16:22:16 +0200 -Subject: [PATCH] nft-shared: Drop unused include - -Code does not refer to struct xt_comment_info anymore. - -Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment") -Signed-off-by: Phil Sutter -(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427) ---- - iptables/nft-shared.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c -index 4a7b5406892c4..4ba44a4aa4d17 100644 ---- a/iptables/nft-shared.c -+++ b/iptables/nft-shared.c -@@ -22,7 +22,6 @@ - #include - - #include --#include - #include - #include - #include --- -2.40.0 - diff --git a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch deleted file mode 100644 index 5474f8a..0000000 --- a/0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:33:43 +0200 -Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match - -The wrong bit was set in 'invflags', probably due to copy'n'paste from -the previous case. - -Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables") -Signed-off-by: Phil Sutter -(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08) ---- - iptables/nft-arp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 210f43d2cefbe..8fae5adc50216 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx, - fw->arp.arhln = ar_hln; - fw->arp.arhln_mask = 0xff; - if (inv) -- fw->arp.invflags |= IPT_INV_ARPOP; -+ fw->arp.invflags |= IPT_INV_ARPHLN; - break; - case offsetof(struct arphdr, ar_pln): - get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv); --- -2.40.0 - diff --git a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch b/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch deleted file mode 100644 index 1efb846..0000000 --- a/0016-arptables-Don-t-omit-standard-matches-if-inverted.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:37:47 +0200 -Subject: [PATCH] arptables: Don't omit standard matches if inverted - -Inverted --h-len and --h-type matches were omitted from output by -accident if they matched on their standard value. - -Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values") -Signed-off-by: Phil Sutter -(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e) ---- - iptables/nft-arp.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index 8fae5adc50216..df3ad430cf701 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - - after_devdst: - -- if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) { -+ if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 || -+ fw->arp.invflags & IPT_INV_ARPHLN) { - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN - ? "! " : ""); - printf("--h-length %d", fw->arp.arhln); -@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs, - sep = " "; - } - -- if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) { -+ if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) || -+ fw->arp.invflags & IPT_INV_ARPHRD) { - uint16_t tmp = ntohs(fw->arp.arhrd); - - printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD --- -2.40.0 - diff --git a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch b/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch deleted file mode 100644 index 9c5cbd2..0000000 --- a/0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +++ /dev/null @@ -1,211 +0,0 @@ -From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 28 Apr 2023 14:41:08 +0200 -Subject: [PATCH] xshared: Fix parsing of option arguments in same word - -When merging commandline parsers, a decision between 'argv[optind - 1]' -and 'optarg' had to be made in some spots. While the implementation of -check_inverse() required the former, use of the latter allows for the -common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at -the suffix while 'argv[optind - 1]' will just point at the following -option. - -Fix the mess by making check_inverse() update optarg pointer if needed -so calling code may refer to and always correct 'optarg'. - -Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c") -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677 -Signed-off-by: Phil Sutter -(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60) ---- - extensions/libarpt_standard.t | 2 ++ - extensions/libxt_standard.t | 3 ++ - iptables/xshared.c | 61 +++++++++++++++++------------------ - 3 files changed, 35 insertions(+), 31 deletions(-) - -diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t -index e84a00b780488..007fa2b8335e8 100644 ---- a/extensions/libarpt_standard.t -+++ b/extensions/libarpt_standard.t -@@ -12,3 +12,5 @@ - -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK - --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK - ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK -+--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK -+--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK -diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t -index 56d6da2e5884e..6ed978e442b80 100644 ---- a/extensions/libxt_standard.t -+++ b/extensions/libxt_standard.t -@@ -21,3 +21,6 @@ - -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK - -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK - -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK -+:FORWARD -+--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -+-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index ac51fac5ce9ed..17aed04e02b09 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg) - } - - static void check_inverse(struct xtables_args *args, const char option[], -- bool *invert, int *optidx, int argc) -+ bool *invert, int argc, char **argv) - { - switch (args->family) { - case NFPROTO_ARP: -@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[], - xtables_error(PARAMETER_PROBLEM, - "Multiple `!' flags not allowed"); - *invert = true; -- if (optidx) { -- *optidx = *optidx + 1; -- if (argc && *optidx > argc) -- xtables_error(PARAMETER_PROBLEM, -- "no argument following `!'"); -- } -+ optind++; -+ if (optind > argc) -+ xtables_error(PARAMETER_PROBLEM, "no argument following `!'"); -+ -+ optarg = argv[optind - 1]; - } - - static const char *optstring_lookup(int family) -@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[], - * Option selection - */ - case 'p': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_PROTOCOL, - &args->invflags, invert); - - /* Canonicalize into lower case */ -- for (cs->protocol = argv[optind - 1]; -+ for (cs->protocol = optarg; - *cs->protocol; cs->protocol++) - *cs->protocol = tolower(*cs->protocol); - -- cs->protocol = argv[optind - 1]; -+ cs->protocol = optarg; - args->proto = xtables_parse_protocol(cs->protocol); - - if (args->proto == 0 && -@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[], - break; - - case 's': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_SOURCE, - &args->invflags, invert); -- args->shostnetworkmask = argv[optind - 1]; -+ args->shostnetworkmask = optarg; - break; - - case 'd': -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_DESTINATION, - &args->invflags, invert); -- args->dhostnetworkmask = argv[optind - 1]; -+ args->dhostnetworkmask = optarg; - break; - - #ifdef IPT_F_GOTO -@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[], - #endif - - case 2:/* src-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_S_MAC, &args->invflags, - invert); -- args->src_mac = argv[optind - 1]; -+ args->src_mac = optarg; - break; - - case 3:/* dst-mac */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_D_MAC, &args->invflags, - invert); -- args->dst_mac = argv[optind - 1]; -+ args->dst_mac = optarg; - break; - - case 'l':/* hardware length */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_LENGTH, &args->invflags, - invert); -- args->arp_hlen = argv[optind - 1]; -+ args->arp_hlen = optarg; - break; - - case 8: /* was never supported, not even in arptables-legacy */ - xtables_error(PARAMETER_PROBLEM, "not supported"); - case 4:/* opcode */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_OPCODE, &args->invflags, - invert); -- args->arp_opcode = argv[optind - 1]; -+ args->arp_opcode = optarg; - break; - - case 5:/* h-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_H_TYPE, &args->invflags, - invert); -- args->arp_htype = argv[optind - 1]; -+ args->arp_htype = optarg; - break; - - case 6:/* proto-type */ -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_P_TYPE, &args->invflags, - invert); -- args->arp_ptype = argv[optind - 1]; -+ args->arp_ptype = optarg; - break; - - case 'j': - set_option(&cs->options, OPT_JUMP, &args->invflags, - invert); -- command_jump(cs, argv[optind - 1]); -+ command_jump(cs, optarg); - break; - - case 'i': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEIN, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->iniface, - args->iniface_mask); - break; - - case 'o': - check_empty_interface(args, optarg); -- check_inverse(args, optarg, &invert, &optind, argc); -+ check_inverse(args, optarg, &invert, argc, argv); - set_option(&cs->options, OPT_VIANAMEOUT, - &args->invflags, invert); -- xtables_parse_interface(argv[optind - 1], -+ xtables_parse_interface(optarg, - args->outiface, - args->outiface_mask); - break; --- -2.40.0 - diff --git a/iptables.spec b/iptables.spec index 57a50f4..e37c5e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,8 +10,8 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.9 -Release: 6%{?dist} +Version: 1.8.10 +Release: 1%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,24 +20,6 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper -Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch -Patch002: 0002-etc-Drop-xtables.conf.patch -Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch -Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch -Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch -Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch -Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch -Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch -Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch -Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch -Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch -Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch -Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch -Patch014: 0014-nft-shared-Drop-unused-include.patch -Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch -Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch -Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -54,7 +36,7 @@ BuildRequires: bison BuildRequires: flex BuildRequires: gcc BuildRequires: pkgconfig(libmnl) >= 1.0 -BuildRequires: pkgconfig(libnftnl) >= 1.1.6 +BuildRequires: pkgconfig(libnftnl) >= 1.2.6 # libpcap-devel for nfbpf_compile BuildRequires: libpcap-devel BuildRequires: autoconf @@ -67,17 +49,6 @@ The iptables utility controls the network packet filtering code in the Linux kernel. If you need to set up firewalls and/or IP masquerading, you should install this package. -%package compat -Summary: Temporary transitioning package -Obsoletes: %{name} < 1.8.7-4 -Requires: %{name}-legacy = %{version}-%{release} -Requires: %{name}-utils = %{version}-%{release} - -%description compat -This package only exists to help transition iptables users to the new -package split. It will be removed after one distribution release cycle, please -do not reference it or depend on it in any way. - %package legacy Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} @@ -252,9 +223,6 @@ touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -# Drop xtables.conf, it's not used -rm -f %{buildroot}%{_sysconfdir}/xtables.conf - # fix absolute symlink rm -f %{buildroot}%{_bindir}/iptables-xml ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml @@ -371,8 +339,6 @@ if [ $1 -eq 0 ]; then done fi -%files compat - %files legacy %{_sbindir}/ip{,6}tables-legacy* %{_sbindir}/xtables-legacy-multi @@ -447,6 +413,10 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-1 +- New version 1.8.10 +- Drop compat sub-package + * Tue Aug 15 2023 Phil Sutter - 1.8.9-6 - Convert license to SPDX format diff --git a/sources b/sources index fef1030..59e259b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70 +SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 From ebece83db97ae4758b02c9dca4bd2cac372e8bd6 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 18:41:06 +0200 Subject: [PATCH 04/43] iptables-1.8.9-4.1 - Backport fixes from upstream --- ...ptables-Fix-setting-of-ipv6-counters.patch | 102 +++++ ...-Fix-handling-of-non-existent-chains.patch | 53 +++ ...ip6-matches-depend-on-protocol-match.patch | 42 +++ ...context-structure-to-ops-add-to-impr.patch | 348 ++++++++++++++++++ ...tize-nft-only-0009-needless-bitwise_.patch | 34 ++ ...ng-for-among-match-in-compare_matche.patch | 46 +++ ...t-pass-nft_rule_ctx-to-add_nft_among.patch | 63 ++++ ...ct-invalid-chain-names-when-renaming.patch | 31 ++ ...Improve-invalid-chain-name-detection.patch | 94 +++++ ...ell-Fix-and-extend-chain-rename-test.patch | 87 +++++ ...t_icmp-Fix-confusion-between-255-255.patch | 52 +++ ...p.t-Enable-tests-with-numeric-output.patch | 39 ++ ...-iptables.8-Fix-intra-page-reference.patch | 33 ++ ...-iptables.8-Clarify-goto-description.patch | 32 ++ ...s-restore.8-Fix-modprobe-description.patch | 37 ++ ...tore.8-Consistently-document-w-optio.patch | 35 ++ ...estore.8-Drop-W-option-from-synopsis.patch | 36 ++ ...tore.8-Put-file-in-italics-in-synops.patch | 35 ++ ...tore.8-Start-paragraphs-in-upper-cas.patch | 37 ++ ...an-Trivial-Missing-space-after-comma.patch | 42 +++ ...bles-save.8-Fix-modprobe-description.patch | 37 ++ ...ave.8-Start-paragraphs-in-upper-case.patch | 34 ++ ...es-test-Fix-command-segfault-reports.patch | 52 +++ ...builtin-chains-with-counters-enabled.patch | 63 ++++ ...ix-wrong-maptype-of-base-chain-count.patch | 37 ++ 0043-doc-fix-example-of-xt_cpu.patch | 35 ++ ...-Fix-checking-of-conntrack-ctproto-0.patch | 92 +++++ ...for-ineffective-0007-mid-restore-flu.patch | 44 +++ ...for-useless-meta-expressions-in-rule.patch | 277 ++++++++++++++ iptables.spec | 34 +- 30 files changed, 1982 insertions(+), 1 deletion(-) create mode 100644 0018-iptables-Fix-setting-of-ipv6-counters.patch create mode 100644 0019-iptables-Fix-handling-of-non-existent-chains.patch create mode 100644 0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch create mode 100644 0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch create mode 100644 0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch create mode 100644 0023-nft-Special-casing-for-among-match-in-compare_matche.patch create mode 100644 0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch create mode 100644 0025-tables-Reject-invalid-chain-names-when-renaming.patch create mode 100644 0026-ebtables-Improve-invalid-chain-name-detection.patch create mode 100644 0027-tests-shell-Fix-and-extend-chain-rename-test.patch create mode 100644 0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch create mode 100644 0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch create mode 100644 0030-man-iptables.8-Fix-intra-page-reference.patch create mode 100644 0031-man-iptables.8-Clarify-goto-description.patch create mode 100644 0032-man-iptables-restore.8-Fix-modprobe-description.patch create mode 100644 0033-man-iptables-restore.8-Consistently-document-w-optio.patch create mode 100644 0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch create mode 100644 0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch create mode 100644 0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch create mode 100644 0037-man-Trivial-Missing-space-after-comma.patch create mode 100644 0038-man-iptables-save.8-Fix-modprobe-description.patch create mode 100644 0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch create mode 100644 0040-tests-iptables-test-Fix-command-segfault-reports.patch create mode 100644 0041-nft-Create-builtin-chains-with-counters-enabled.patch create mode 100644 0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch create mode 100644 0043-doc-fix-example-of-xt_cpu.patch create mode 100644 0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch create mode 100644 0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch create mode 100644 0046-nft-Fix-for-useless-meta-expressions-in-rule.patch diff --git a/0018-iptables-Fix-setting-of-ipv6-counters.patch b/0018-iptables-Fix-setting-of-ipv6-counters.patch new file mode 100644 index 0000000..ec72c5e --- /dev/null +++ b/0018-iptables-Fix-setting-of-ipv6-counters.patch @@ -0,0 +1,102 @@ +From 935dddbb219eb09a289507e609ff8e9b4429c1ea Mon Sep 17 00:00:00 2001 +From: Jacek Tomasiak +Date: Mon, 19 Jun 2023 12:44:54 +0200 +Subject: [PATCH] iptables: Fix setting of ipv6 counters + +When setting counters using ip6tables-nft -c X Y the X and Y values were +not stored. + +This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but +applied to the nft variant of ipv6 not the legacy. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647 +Fixes: 0391677c1a0b2 ("xtables: add IPv6 support") +Signed-off-by: Jacek Tomasiak +Signed-off-by: Jacek Tomasiak +Signed-off-by: Phil Sutter +(cherry picked from commit ed839159edf8bda8e9196f1056c4038c22d78bfd) +--- + iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 | 6 +++--- + iptables/tests/shell/testcases/iptables/0003-list-rules_0 | 6 +++--- + iptables/xshared.c | 3 +++ + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 +index c98bdd6e501aa..09e39927ef390 100755 +--- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 ++++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 +@@ -3,7 +3,7 @@ + set -e + + $XT_MULTI ip6tables -N foo +-$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT ++$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42 + $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo + $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT + +@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0 + -P FORWARD ACCEPT -c 0 0 + -P OUTPUT ACCEPT -c 0 0 + -N foo +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S) +@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD) + + EXPECT='-P FORWARD ACCEPT -c 0 0 +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD) +diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 +index d335d44257a49..d07bd151be76b 100755 +--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 ++++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0 +@@ -3,7 +3,7 @@ + set -e + + $XT_MULTI iptables -N foo +-$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT ++$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42 + $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo + $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT + +@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0 + -P FORWARD ACCEPT -c 0 0 + -P OUTPUT ACCEPT -c 0 0 + -N foo +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S) +@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD) + + EXPECT='-P FORWARD ACCEPT -c 0 0 +--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT ++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT + -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo' + + diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD) +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 17aed04e02b09..71ee94d6f2f83 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1992,6 +1992,9 @@ void ipv6_post_parse(int command, struct iptables_command_state *cs, + if (args->goto_set) + cs->fw6.ipv6.flags |= IP6T_F_GOTO; + ++ /* nft-variants use cs->counters, legacy uses cs->fw6.counters */ ++ cs->counters.pcnt = args->pcnt_cnt; ++ cs->counters.bcnt = args->bcnt_cnt; + cs->fw6.counters.pcnt = args->pcnt_cnt; + cs->fw6.counters.bcnt = args->bcnt_cnt; + +-- +2.41.0 + diff --git a/0019-iptables-Fix-handling-of-non-existent-chains.patch b/0019-iptables-Fix-handling-of-non-existent-chains.patch new file mode 100644 index 0000000..9964ba5 --- /dev/null +++ b/0019-iptables-Fix-handling-of-non-existent-chains.patch @@ -0,0 +1,53 @@ +From cd3a8274e9e904d227b81ae7158d6e82b1311bf8 Mon Sep 17 00:00:00 2001 +From: Jacek Tomasiak +Date: Mon, 19 Jun 2023 13:46:36 +0200 +Subject: [PATCH] iptables: Fix handling of non-existent chains + +Since 694612adf87 the "compatibility" check considers non-existent +chains as "incompatible". This broke some scripts which used calls +like `iptables -L CHAIN404` to test for chain existence and expect +"No chain/target/match by that name." in the output. + +This patch changes the logic of `nft_is_table_compatible()` to +report non-existent chains as "compatible" which restores the old +behavior. + +Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 +Signed-off-by: Jacek Tomasiak +Signed-off-by: Jacek Tomasiak +Signed-off-by: Phil Sutter +(cherry picked from commit 82ccfb488eeac5507471099b9b4e6d136cc06e3b) +--- + iptables/nft.c | 2 +- + iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 5896fd410ca78..5e4cd76b05504 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3847,7 +3847,7 @@ bool nft_is_table_compatible(struct nft_handle *h, + if (chain) { + struct nft_chain *c = nft_chain_find(h, table, chain); + +- return c && !nft_is_chain_compatible(c, h); ++ return !c || !nft_is_chain_compatible(c, h); + } + + return !nft_chain_foreach(h, table, nft_is_chain_compatible, h); +diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 +index 33c5f1f35d17f..234f3040516e1 100755 +--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 ++++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 +@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar + cmd 0 -E foo bar + cmd 1 "$EEXIST_F" -E foo bar + cmd 1 "$ENOENT" -E foo bar2 ++cmd 1 "$ENOENT" -L foo + cmd 0 -N foo2 + cmd 1 "$EEXIST_F" -E foo2 bar + +-- +2.41.0 + diff --git a/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch b/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch new file mode 100644 index 0000000..e08b22f --- /dev/null +++ b/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch @@ -0,0 +1,42 @@ +From 90ca86dfed56510ebc52ab2924800eb28ce0d951 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 3 Feb 2023 20:08:09 +0100 +Subject: [PATCH] ebtables: ip and ip6 matches depend on protocol match + +This is consistent with legacy ebtables, also avoids invalid +combinations like '-p IPv6 --ip-source 1.2.3.4'. + +Signed-off-by: Phil Sutter +(cherry picked from commit 267a26363826553280a5928043df30a07cdc63bb) +--- + iptables/nft-bridge.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index 83cbe31559d4b..b9983b203f6d0 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -104,11 +104,18 @@ static int + nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, + struct nftnl_rule *r, struct xt_entry_match *m) + { +- if (!strcmp(m->u.user.name, "802_3") && +- !(fw->bitmask & EBT_802_3)) ++ if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) + xtables_error(PARAMETER_PROBLEM, + "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH"); + ++ if (!strcmp(m->u.user.name, "ip") && fw->ethproto != htons(ETH_P_IP)) ++ xtables_error(PARAMETER_PROBLEM, ++ "For IP filtering the protocol must be specified as IPv4."); ++ ++ if (!strcmp(m->u.user.name, "ip6") && fw->ethproto != htons(ETH_P_IPV6)) ++ xtables_error(PARAMETER_PROBLEM, ++ "For IPv6 filtering the protocol must be specified as IPv6."); ++ + return add_match(h, r, m); + } + +-- +2.41.0 + diff --git a/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch b/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch new file mode 100644 index 0000000..cb23eb3 --- /dev/null +++ b/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch @@ -0,0 +1,348 @@ +From a61cac5cdd4332cf84b9e2f554a1c8852d40dc0a Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 11 Jul 2023 22:06:44 +0200 +Subject: [PATCH] nft-bridge: pass context structure to ops->add() to improve + anonymous set support + +Add context structure to improve bridge among support which creates an +anonymous set. This context structure specifies the command and it +allows to optionally store a anonymous set. + +Use this context to generate native bytecode only if this is an +add/insert/replace command. + +This fixes a dangling anonymous set that is created on rule removal. + +Fixes: 26753888720d ("nft: bridge: Rudimental among extension support") +Reported-and-tested-by: Igor Raits +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit 4e95200ded923f0eb5579c33b91176193c59dbe0) +--- + iptables/nft-arp.c | 4 ++-- + iptables/nft-bridge.c | 9 ++++---- + iptables/nft-cmd.c | 6 ++++- + iptables/nft-ipv4.c | 6 ++--- + iptables/nft-ipv6.c | 6 ++--- + iptables/nft-shared.h | 5 ++-- + iptables/nft.c | 54 ++++++++++++++++++++++++++++--------------- + iptables/nft.h | 9 +++++--- + 8 files changed, 62 insertions(+), 37 deletions(-) + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index df3ad430cf701..889387e4db592 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -40,8 +40,8 @@ static bool need_devaddr(struct arpt_devaddr_info *info) + return false; + } + +-static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs) ++static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs) + { + struct arpt_entry *fw = &cs->arp; + uint32_t op; +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index b9983b203f6d0..a41f411fbba14 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -102,7 +102,8 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) + + static int + nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, +- struct nftnl_rule *r, struct xt_entry_match *m) ++ struct nft_rule_ctx *ctx, struct nftnl_rule *r, ++ struct xt_entry_match *m) + { + if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3)) + xtables_error(PARAMETER_PROBLEM, +@@ -116,10 +117,10 @@ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, + xtables_error(PARAMETER_PROBLEM, + "For IPv6 filtering the protocol must be specified as IPv6."); + +- return add_match(h, r, m); ++ return add_match(h, ctx, r, m); + } + +-static int nft_bridge_add(struct nft_handle *h, ++static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + struct nftnl_rule *r, + struct iptables_command_state *cs) + { +@@ -181,7 +182,7 @@ static int nft_bridge_add(struct nft_handle *h, + + for (iter = cs->match_list; iter; iter = iter->next) { + if (iter->ismatch) { +- if (nft_bridge_add_match(h, fw, r, iter->u.match->m)) ++ if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m)) + break; + } else { + if (add_target(r, iter->u.watcher->t)) +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index f16ea0e6eaf8b..8cf8027e7465d 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -14,12 +14,16 @@ + #include + #include "nft.h" + #include "nft-cmd.h" ++#include + + struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + const char *table, const char *chain, + struct iptables_command_state *state, + int rulenum, bool verbose) + { ++ struct nft_rule_ctx ctx = { ++ .command = command, ++ }; + struct nftnl_rule *rule; + struct nft_cmd *cmd; + +@@ -33,7 +37,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + cmd->verbose = verbose; + + if (state) { +- rule = nft_rule_new(h, chain, table, state); ++ rule = nft_rule_new(h, &ctx, chain, table, state); + if (!rule) { + nft_cmd_free(cmd); + return NULL; +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index dcc4a8edfc87f..fb62103fd38d7 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -26,8 +26,8 @@ + #include "nft.h" + #include "nft-shared.h" + +-static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs) ++static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs) + { + struct xtables_rule_match *matchp; + uint32_t op; +@@ -81,7 +81,7 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, + add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO); + + for (matchp = cs->matches; matchp; matchp = matchp->next) { +- ret = add_match(h, r, matchp->match->m); ++ ret = add_match(h, ctx, r, matchp->match->m); + if (ret < 0) + return ret; + } +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index e98921856c75d..d36e06812e08d 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -25,8 +25,8 @@ + #include "nft.h" + #include "nft-shared.h" + +-static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs) ++static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs) + { + struct xtables_rule_match *matchp; + uint32_t op; +@@ -68,7 +68,7 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, + add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO); + + for (matchp = cs->matches; matchp; matchp = matchp->next) { +- ret = add_match(h, r, matchp->match->m); ++ ret = add_match(h, ctx, r, matchp->match->m); + if (ret < 0) + return ret; + } +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 07d39131cb0d6..9065e52f669e1 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -34,6 +34,7 @@ + | FMT_NUMERIC | FMT_NOTABLE) + #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) + ++struct nft_rule_ctx; + struct xtables_args; + struct nft_handle; + struct xt_xlate; +@@ -126,8 +127,8 @@ static inline struct nft_xt_ctx_reg *nft_xt_ctx_get_dreg(struct nft_xt_ctx *ctx, + } + + struct nft_family_ops { +- int (*add)(struct nft_handle *h, struct nftnl_rule *r, +- struct iptables_command_state *cs); ++ int (*add)(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct iptables_command_state *cs); + bool (*is_same)(const struct iptables_command_state *cs_a, + const struct iptables_command_state *cs_b); + void (*print_payload)(struct nftnl_expr *e, +diff --git a/iptables/nft.c b/iptables/nft.c +index 5e4cd76b05504..8029d70a7fbae 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1141,7 +1141,8 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags) + #define NFT_DATATYPE_ETHERADDR 9 + + static int __add_nft_among(struct nft_handle *h, const char *table, +- struct nftnl_rule *r, struct nft_among_pair *pairs, ++ struct nft_rule_ctx *ctx, struct nftnl_rule *r, ++ struct nft_among_pair *pairs, + int cnt, bool dst, bool inv, bool ip) + { + uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN; +@@ -1222,7 +1223,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table, + return 0; + } + +-static int add_nft_among(struct nft_handle *h, ++static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, + struct nftnl_rule *r, struct xt_entry_match *m) + { + struct nft_among_data *data = (struct nft_among_data *)m->data; +@@ -1238,10 +1239,10 @@ static int add_nft_among(struct nft_handle *h, + } + + if (data->src.cnt) +- __add_nft_among(h, table, r, data->pairs, data->src.cnt, ++ __add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt, + false, data->src.inv, data->src.ip); + if (data->dst.cnt) +- __add_nft_among(h, table, r, data->pairs + data->src.cnt, ++ __add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt, + data->dst.cnt, true, data->dst.inv, + data->dst.ip); + return 0; +@@ -1449,22 +1450,30 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r, + return 0; + } + +-int add_match(struct nft_handle *h, ++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, + struct nftnl_rule *r, struct xt_entry_match *m) + { + struct nftnl_expr *expr; + int ret; + +- if (!strcmp(m->u.user.name, "limit")) +- return add_nft_limit(r, m); +- else if (!strcmp(m->u.user.name, "among")) +- return add_nft_among(h, r, m); +- else if (!strcmp(m->u.user.name, "udp")) +- return add_nft_udp(h, r, m); +- else if (!strcmp(m->u.user.name, "tcp")) +- return add_nft_tcp(h, r, m); +- else if (!strcmp(m->u.user.name, "mark")) +- return add_nft_mark(h, r, m); ++ switch (ctx->command) { ++ case NFT_COMPAT_RULE_APPEND: ++ case NFT_COMPAT_RULE_INSERT: ++ case NFT_COMPAT_RULE_REPLACE: ++ if (!strcmp(m->u.user.name, "limit")) ++ return add_nft_limit(r, m); ++ else if (!strcmp(m->u.user.name, "among")) ++ return add_nft_among(h, ctx, r, m); ++ else if (!strcmp(m->u.user.name, "udp")) ++ return add_nft_udp(h, r, m); ++ else if (!strcmp(m->u.user.name, "tcp")) ++ return add_nft_tcp(h, r, m); ++ else if (!strcmp(m->u.user.name, "mark")) ++ return add_nft_mark(h, r, m); ++ break; ++ default: ++ break; ++ } + + expr = nftnl_expr_alloc("match"); + if (expr == NULL) +@@ -1692,7 +1701,8 @@ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv) + } + + struct nftnl_rule * +-nft_rule_new(struct nft_handle *h, const char *chain, const char *table, ++nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ const char *chain, const char *table, + struct iptables_command_state *cs) + { + struct nftnl_rule *r; +@@ -1705,7 +1715,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table, + nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table); + nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain); + +- if (h->ops->add(h, r, cs) < 0) ++ if (h->ops->add(h, ctx, r, cs) < 0) + goto err; + + return r; +@@ -2865,6 +2875,9 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, + { + struct iptables_command_state cs = {}; + struct nftnl_rule *r, *new_rule; ++ struct nft_rule_ctx ctx = { ++ .command = NFT_COMPAT_RULE_APPEND, ++ }; + struct nft_chain *c; + int ret = 0; + +@@ -2883,7 +2896,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, + + h->ops->rule_to_cs(h, r, &cs); + cs.counters.pcnt = cs.counters.bcnt = 0; +- new_rule = nft_rule_new(h, chain, table, &cs); ++ new_rule = nft_rule_new(h, &ctx, chain, table, &cs); + h->ops->clear_cs(&cs); + + if (!new_rule) +@@ -3261,6 +3274,9 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) + .eb.bitmask = EBT_NOPROTO, + }; + struct nftnl_udata_buf *udata; ++ struct nft_rule_ctx ctx = { ++ .command = NFT_COMPAT_RULE_APPEND, ++ }; + struct nft_handle *h = data; + struct nftnl_rule *r; + const char *pname; +@@ -3288,7 +3304,7 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data) + + command_jump(&cs, pname); + +- r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), ++ r = nft_rule_new(h, &ctx, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME), + nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs); + ebt_cs_clean(&cs); + +diff --git a/iptables/nft.h b/iptables/nft.h +index caff1fdeff92e..1c479fce3fc2e 100644 +--- a/iptables/nft.h ++++ b/iptables/nft.h +@@ -171,9 +171,11 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h, + /* + * Operations with rule-set. + */ +-struct nftnl_rule; ++struct nft_rule_ctx { ++ int command; ++}; + +-struct nftnl_rule *nft_rule_new(struct nft_handle *h, const char *chain, const char *table, struct iptables_command_state *cs); ++struct nftnl_rule *nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *rule, const char *chain, const char *table, struct iptables_command_state *cs); + int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, struct nftnl_rule *ref, bool verbose); + int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, int rulenum, bool verbose); + int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, bool verbose); +@@ -191,7 +193,8 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char * + */ + int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes); + int add_verdict(struct nftnl_rule *r, int verdict); +-int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match *m); ++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, ++ struct nftnl_rule *r, struct xt_entry_match *m); + int add_target(struct nftnl_rule *r, struct xt_entry_target *t); + int add_jumpto(struct nftnl_rule *r, const char *name, int verdict); + int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set); +-- +2.41.0 + diff --git a/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch b/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch new file mode 100644 index 0000000..2b1e058 --- /dev/null +++ b/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch @@ -0,0 +1,34 @@ +From 48f29413f7db0e3e889733705be368915a16a228 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 19 Jul 2023 14:58:11 +0200 +Subject: [PATCH] tests: shell: Sanitize nft-only/0009-needless-bitwise_0 + +Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the +non-debug ruleset listing's empty lines, causing the diff to fail. Catch +this by exiting upon seeing the first table heading. For the sake of +comparing bytecode, the actual ruleset listing is not interesting, +anyway. + +Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0") +Signed-off-by: Phil Sutter +(cherry picked from commit 2746726e03d9017d4c940a247590f8d5c5d5a73e) +--- + iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 +index 41588a10863ec..34802cc26aad4 100755 +--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 ++++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 +@@ -340,7 +340,7 @@ bridge filter OUTPUT 10 9 + # - lines with bytecode (starting with ' [') + # - empty lines (so printed diff is not a complete mess) + filter() { +- awk '/^( \[|$)/{print}' ++ awk '/^table /{exit} /^( \[|$)/{print}' + } + + diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter) +-- +2.41.0 + diff --git a/0023-nft-Special-casing-for-among-match-in-compare_matche.patch b/0023-nft-Special-casing-for-among-match-in-compare_matche.patch new file mode 100644 index 0000000..7b7e492 --- /dev/null +++ b/0023-nft-Special-casing-for-among-match-in-compare_matche.patch @@ -0,0 +1,46 @@ +From da02d12210c4be7bcc6a5c3141ef96d3c68f6e49 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 21 Jul 2023 13:14:36 +0200 +Subject: [PATCH] nft: Special casing for among match in compare_matches() + +When other extensions may have "garbage" appended to their data which +should not be considered for match comparison, among match is the +opposite in that it extends its data beyond the value in 'size' field. +Add special casing to cover for this, avoiding false-positive rule +comparison. + +Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support") +Signed-off-by: Phil Sutter +(cherry picked from commit 10583537004f7ecd4aa11f6c12b7ba73fb77fc11) +--- + iptables/nft-shared.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 4ba44a4aa4d17..413503ed86932 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -1505,6 +1505,7 @@ bool compare_matches(struct xtables_rule_match *mt1, + for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) { + struct xt_entry_match *m1 = mp1->match->m; + struct xt_entry_match *m2 = mp2->match->m; ++ size_t cmplen = mp1->match->userspacesize; + + if (strcmp(m1->u.user.name, m2->u.user.name) != 0) { + DEBUGP("mismatching match name\n"); +@@ -1516,8 +1517,10 @@ bool compare_matches(struct xtables_rule_match *mt1, + return false; + } + +- if (memcmp(m1->data, m2->data, +- mp1->match->userspacesize) != 0) { ++ if (!strcmp(m1->u.user.name, "among")) ++ cmplen = m1->u.match_size - sizeof(*m1); ++ ++ if (memcmp(m1->data, m2->data, cmplen) != 0) { + DEBUGP("mismatch match data\n"); + return false; + } +-- +2.41.0 + diff --git a/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch b/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch new file mode 100644 index 0000000..8864560 --- /dev/null +++ b/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch @@ -0,0 +1,63 @@ +From 009e5643a6e6d4ee395d8956f418bbcef0f960a8 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sat, 15 Jul 2023 01:35:39 +0200 +Subject: [PATCH] nft: Do not pass nft_rule_ctx to add_nft_among() + +It is not used, must be a left-over from an earlier version of the fixed +commit. + +Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support") +Signed-off-by: Phil Sutter +(cherry picked from commit bd71c11a95ab2b44794843fd8a3698039a7db211) +--- + iptables/nft.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8029d70a7fbae..66b47d72e3ae8 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1141,8 +1141,7 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags) + #define NFT_DATATYPE_ETHERADDR 9 + + static int __add_nft_among(struct nft_handle *h, const char *table, +- struct nft_rule_ctx *ctx, struct nftnl_rule *r, +- struct nft_among_pair *pairs, ++ struct nftnl_rule *r, struct nft_among_pair *pairs, + int cnt, bool dst, bool inv, bool ip) + { + uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN; +@@ -1223,7 +1222,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table, + return 0; + } + +-static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, ++static int add_nft_among(struct nft_handle *h, + struct nftnl_rule *r, struct xt_entry_match *m) + { + struct nft_among_data *data = (struct nft_among_data *)m->data; +@@ -1239,10 +1238,10 @@ static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx, + } + + if (data->src.cnt) +- __add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt, ++ __add_nft_among(h, table, r, data->pairs, data->src.cnt, + false, data->src.inv, data->src.ip); + if (data->dst.cnt) +- __add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt, ++ __add_nft_among(h, table, r, data->pairs + data->src.cnt, + data->dst.cnt, true, data->dst.inv, + data->dst.ip); + return 0; +@@ -1463,7 +1462,7 @@ int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx, + if (!strcmp(m->u.user.name, "limit")) + return add_nft_limit(r, m); + else if (!strcmp(m->u.user.name, "among")) +- return add_nft_among(h, ctx, r, m); ++ return add_nft_among(h, r, m); + else if (!strcmp(m->u.user.name, "udp")) + return add_nft_udp(h, r, m); + else if (!strcmp(m->u.user.name, "tcp")) +-- +2.41.0 + diff --git a/0025-tables-Reject-invalid-chain-names-when-renaming.patch b/0025-tables-Reject-invalid-chain-names-when-renaming.patch new file mode 100644 index 0000000..49caa9c --- /dev/null +++ b/0025-tables-Reject-invalid-chain-names-when-renaming.patch @@ -0,0 +1,31 @@ +From 2feb8fba886cb9586d6cdc1b5711cff49fe5cf5d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 21 Jul 2023 20:14:09 +0200 +Subject: [PATCH] *tables: Reject invalid chain names when renaming + +While given chain name was sanity checked with --new-chain command, +--rename-chain command allowed to choose an invalid name. Keep things +consistent by adding the missing check. + +Fixes: e6869a8f59d77 ("reorganized tree after kernel merge") +Signed-off-by: Phil Sutter +(cherry picked from commit 344e9b260ba2bbbdd0c32f112273fd552d0b73f4) +--- + iptables/xshared.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 71ee94d6f2f83..6812da501a288 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1521,6 +1521,7 @@ void do_parse(int argc, char *argv[], + "-%c requires old-chain-name and " + "new-chain-name", + cmd2char(CMD_RENAME_CHAIN)); ++ assert_valid_chain_name(p->newname); + break; + + case 'P': +-- +2.41.0 + diff --git a/0026-ebtables-Improve-invalid-chain-name-detection.patch b/0026-ebtables-Improve-invalid-chain-name-detection.patch new file mode 100644 index 0000000..291f73d --- /dev/null +++ b/0026-ebtables-Improve-invalid-chain-name-detection.patch @@ -0,0 +1,94 @@ +From d841d7a1f438e56226cc26b2f8e8525d5aeaa5c6 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Jul 2023 13:50:11 +0200 +Subject: [PATCH] ebtables: Improve invalid chain name detection + +Fix several issues: + +- Most importantly, --new-chain command accepted any name. Introduce + ebt_assert_valid_chain_name() for use with both --new-chain and + --rename-chain. +- Restrict maximum name length to what legacy ebtables allows - this is + a bit more than iptables-nft, subject to be unified. +- Like iptables, legacy ebtables rejects names prefixed by '-' or '!'. +- Use xs_has_arg() for consistency, keep the check for extra args for + now. + +Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") +Signed-off-by: Phil Sutter +(cherry picked from commit 687d76937be799a405e63e58861f7e4a965dfa8d) +--- + iptables/xtables-eb.c | 33 ++++++++++++++++++++++++++++----- + 1 file changed, 28 insertions(+), 5 deletions(-) + +diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c +index 3a73e79725489..33f55aee32c8f 100644 +--- a/iptables/xtables-eb.c ++++ b/iptables/xtables-eb.c +@@ -42,6 +42,10 @@ + #include "nft.h" + #include "nft-bridge.h" + ++/* from linux/netfilter_bridge/ebtables.h */ ++#define EBT_TABLE_MAXNAMELEN 32 ++#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN ++ + /* + * From include/ebtables_u.h + */ +@@ -74,6 +78,26 @@ static int ebt_check_inverse2(const char option[], int argc, char **argv) + return ebt_invert; + } + ++/* XXX: merge with assert_valid_chain_name()? */ ++static void ebt_assert_valid_chain_name(const char *chainname) ++{ ++ if (strlen(chainname) >= EBT_CHAIN_MAXNAMELEN) ++ xtables_error(PARAMETER_PROBLEM, ++ "Chain name length can't exceed %d", ++ EBT_CHAIN_MAXNAMELEN - 1); ++ ++ if (*chainname == '-' || *chainname == '!') ++ xtables_error(PARAMETER_PROBLEM, "No chain name specified"); ++ ++ if (xtables_find_target(chainname, XTF_TRY_LOAD)) ++ xtables_error(PARAMETER_PROBLEM, ++ "Target with name %s exists", chainname); ++ ++ if (strchr(chainname, ' ') != NULL) ++ xtables_error(PARAMETER_PROBLEM, ++ "Use of ' ' not allowed in chain names"); ++} ++ + /* + * Glue code to use libxtables + */ +@@ -750,6 +774,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + flags |= OPT_COMMAND; + + if (c == 'N') { ++ ebt_assert_valid_chain_name(chain); + ret = nft_cmd_chain_user_add(h, chain, *table); + break; + } else if (c == 'X') { +@@ -763,14 +788,12 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table, + } + + if (c == 'E') { +- if (optind >= argc) ++ if (!xs_has_arg(argc, argv)) + xtables_error(PARAMETER_PROBLEM, "No new chain name specified"); + else if (optind < argc - 1) + xtables_error(PARAMETER_PROBLEM, "No extra options allowed with -E"); +- else if (strlen(argv[optind]) >= NFT_CHAIN_MAXNAMELEN) +- xtables_error(PARAMETER_PROBLEM, "Chain name length can't exceed %d"" characters", NFT_CHAIN_MAXNAMELEN - 1); +- else if (strchr(argv[optind], ' ') != NULL) +- xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names"); ++ ++ ebt_assert_valid_chain_name(argv[optind]); + + errno = 0; + ret = nft_cmd_chain_user_rename(h, chain, *table, +-- +2.41.0 + diff --git a/0027-tests-shell-Fix-and-extend-chain-rename-test.patch b/0027-tests-shell-Fix-and-extend-chain-rename-test.patch new file mode 100644 index 0000000..c49d9eb --- /dev/null +++ b/0027-tests-shell-Fix-and-extend-chain-rename-test.patch @@ -0,0 +1,87 @@ +From 9ca7dcde885b9dad98761273eecd3921d0064ed2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 28 Jul 2023 13:58:46 +0200 +Subject: [PATCH] tests: shell: Fix and extend chain rename test + +The old version exited unintentionally before testing ip6tables. Replace +it by a more complete variant testing for all tools, creating and +renaming of,chains with various illegal names instead of just renaming +to a clashing name. + +Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases") +Signed-off-by: Phil Sutter +(cherry picked from commit 3bbf5269f25d7bc8cb6ecf2c44e6358579acc459) +--- + .../tests/shell/testcases/chain/0003rename_0 | 40 +++++++++++++++++++ + .../tests/shell/testcases/chain/0003rename_1 | 12 ------ + 2 files changed, 40 insertions(+), 12 deletions(-) + create mode 100755 iptables/tests/shell/testcases/chain/0003rename_0 + delete mode 100755 iptables/tests/shell/testcases/chain/0003rename_1 + +diff --git a/iptables/tests/shell/testcases/chain/0003rename_0 b/iptables/tests/shell/testcases/chain/0003rename_0 +new file mode 100755 +index 0000000000000..4cb2745bc2523 +--- /dev/null ++++ b/iptables/tests/shell/testcases/chain/0003rename_0 +@@ -0,0 +1,40 @@ ++#!/bin/bash -x ++ ++die() { ++ echo "E: $@" ++ exit 1 ++} ++ ++cmds="iptables ip6tables" ++[[ $XT_MULTI == *xtables-nft-multi ]] && cmds+=" arptables ebtables" ++ ++declare -A invnames ++invnames["existing"]="c2" ++invnames["spaced"]="foo bar" ++invnames["dashed"]="-foo" ++invnames["negated"]="!foo" ++# XXX: ebtables-nft accepts 255 chars ++#invnames["overlong"]="thisisquitealongnameforachain" ++invnames["standard target"]="ACCEPT" ++invnames["extension target"]="DNAT" ++ ++for cmd in $cmds; do ++ $XT_MULTI $cmd -N c1 || die "$cmd: can't add chain c1" ++ $XT_MULTI $cmd -N c2 || die "$cmd: can't add chain c2" ++ for key in "${!invnames[@]}"; do ++ val="${invnames[$key]}" ++ if [[ $key == "extension target" ]]; then ++ if [[ $cmd == "arptables" ]]; then ++ val="mangle" ++ elif [[ $cmd == "ebtables" ]]; then ++ val="dnat" ++ fi ++ fi ++ $XT_MULTI $cmd -N "$val" && \ ++ die "$cmd: added chain with $key name" ++ $XT_MULTI $cmd -E c1 "$val" && \ ++ die "$cmd: renamed to $key name" ++ done ++done ++ ++exit 0 +diff --git a/iptables/tests/shell/testcases/chain/0003rename_1 b/iptables/tests/shell/testcases/chain/0003rename_1 +deleted file mode 100755 +index 975c8e196b9f5..0000000000000 +--- a/iptables/tests/shell/testcases/chain/0003rename_1 ++++ /dev/null +@@ -1,12 +0,0 @@ +-#!/bin/bash +- +-$XT_MULTI iptables -N c1 || exit 0 +-$XT_MULTI iptables -N c2 || exit 0 +-$XT_MULTI iptables -E c1 c2 || exit 1 +- +-$XT_MULTI ip6tables -N c1 || exit 0 +-$XT_MULTI ip6tables -N c2 || exit 0 +-$XT_MULTI ip6tables -E c1 c2 || exit 1 +- +-echo "E: Renamed with existing chain" >&2 +-exit 0 +-- +2.41.0 + diff --git a/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch b/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch new file mode 100644 index 0000000..04e661b --- /dev/null +++ b/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch @@ -0,0 +1,52 @@ +From 2eb44e79329b713e4eb50f4816beaa6e6babe1da Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 1 Aug 2023 23:28:20 +0200 +Subject: [PATCH] extensions: libipt_icmp: Fix confusion between 255/255 and + any + +Per definition, ICMP type "any" is type 255 and the full range of codes +(0-255). Save callback though ignored the actual code values, printing +"any" for every type 255 match. This at least confuses users as they +can't find their rule added as '--icmp-type 255/255' anymore. + +It is not entirely clear what the fixed commit was trying to establish, +but the save output is certainly not correct (especially since print +callback gets things right). + +Reported-by: Amelia Downs +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600 +Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)") +Signed-off-by: Phil Sutter +(cherry picked from commit 5b5430d627bbc227a2d51d4312c371f2015834c6) +--- + extensions/libipt_icmp.c | 3 ++- + extensions/libipt_icmp.t | 2 ++ + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c +index b0318aebc2c57..171b3b3949e54 100644 +--- a/extensions/libipt_icmp.c ++++ b/extensions/libipt_icmp.c +@@ -108,7 +108,8 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match) + printf(" !"); + + /* special hack for 'any' case */ +- if (icmp->type == 0xFF) { ++ if (icmp->type == 0xFF && ++ icmp->code[0] == 0 && icmp->code[1] == 0xFF) { + printf(" --icmp-type any"); + } else { + printf(" --icmp-type %u", icmp->type); +diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t +index f4ba65c27f032..ce4a33f9633b5 100644 +--- a/extensions/libipt_icmp.t ++++ b/extensions/libipt_icmp.t +@@ -13,3 +13,5 @@ + # we accept "iptables -I INPUT -p tcp -m tcp", why not this below? + # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp + # -p icmp -m icmp;=;OK ++-p icmp -m icmp --icmp-type 255/255;=;OK ++-p icmp -m icmp --icmp-type 255/0:255;-p icmp -m icmp --icmp-type any;OK +-- +2.41.0 + diff --git a/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch b/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch new file mode 100644 index 0000000..391b3e6 --- /dev/null +++ b/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch @@ -0,0 +1,39 @@ +From 329a8bb4d4b701b2903b182e8d8950dadbed4752 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 1 Aug 2023 23:42:24 +0200 +Subject: [PATCH] tests: libipt_icmp.t: Enable tests with numeric output + +Unrelated to the question whether numeric (save) output is desired or +not, enable the tests and expect the known format. + +Using --list without --numeric prints the names, BTW. + +Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test") +Signed-off-by: Phil Sutter +(cherry picked from commit 99d861c64cda5289e141b2084836663450f1eff0) +--- + extensions/libipt_icmp.t | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t +index ce4a33f9633b5..4ea936217c09a 100644 +--- a/extensions/libipt_icmp.t ++++ b/extensions/libipt_icmp.t +@@ -1,11 +1,8 @@ + :INPUT,FORWARD,OUTPUT + -p icmp -m icmp --icmp-type any;=;OK +-# output uses the number, better use the name? +-# ERROR: cannot find: iptables -I INPUT -p icmp -m icmp --icmp-type echo-reply +-# -p icmp -m icmp --icmp-type echo-reply;=;OK +-# output uses the number, better use the name? +-# ERROR: annot find: iptables -I INPUT -p icmp -m icmp --icmp-type destination-unreachable +-# -p icmp -m icmp --icmp-type destination-unreachable;=;OK ++# XXX: output uses the number, better use the name? ++-p icmp -m icmp --icmp-type echo-reply;-p icmp -m icmp --icmp-type 0;OK ++-p icmp -m icmp --icmp-type destination-unreachable;-p icmp -m icmp --icmp-type 3;OK + # it does not acccept name/name, should we accept this? + # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable + # -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable;=;OK +-- +2.41.0 + diff --git a/0030-man-iptables.8-Fix-intra-page-reference.patch b/0030-man-iptables.8-Fix-intra-page-reference.patch new file mode 100644 index 0000000..babf3b0 --- /dev/null +++ b/0030-man-iptables.8-Fix-intra-page-reference.patch @@ -0,0 +1,33 @@ +From ea90131706ccc3a806d9d0ee0bc196e64690f7e1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 00:23:37 +0200 +Subject: [PATCH] man: iptables.8: Fix intra page reference + +When sections MATCH EXTENSIONS and TARGET EXTENSIONS were combined, the +reference could have been updated to specify the exact title. + +Fixes: 4496801821c01 ("doc: deduplicate extension descriptions into a new manpage") +Signed-off-by: Phil Sutter +(cherry picked from commit 3bda308b32847d08b2c27077fa3c02200b59cdca) +--- + iptables/iptables.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in +index f81c632f2be86..c336ddf6e4f95 100644 +--- a/iptables/iptables.8.in ++++ b/iptables/iptables.8.in +@@ -307,8 +307,8 @@ false, evaluation will stop. + This specifies the target of the rule; i.e., what to do if the packet + matches it. The target can be a user-defined chain (other than the + one this rule is in), one of the special builtin targets which decide +-the fate of the packet immediately, or an extension (see \fBEXTENSIONS\fP +-below). If this ++the fate of the packet immediately, or an extension (see \fBMATCH AND TARGET ++EXTENSIONS\fP below). If this + option is omitted in a rule (and \fB\-g\fP + is not used), then matching the rule will have no + effect on the packet's fate, but the counters on the rule will be +-- +2.41.0 + diff --git a/0031-man-iptables.8-Clarify-goto-description.patch b/0031-man-iptables.8-Clarify-goto-description.patch new file mode 100644 index 0000000..f57e2af --- /dev/null +++ b/0031-man-iptables.8-Clarify-goto-description.patch @@ -0,0 +1,32 @@ +From 4e13b0b775522b2da8951c01713c47f235af8110 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 00:28:03 +0200 +Subject: [PATCH] man: iptables.8: Clarify --goto description + +Text speaks about behaviour of RETURN target when used in chains +redirected to using --goto instead of --jump, not the difference between +--jump option and "return". + +Fixes: 17fc163babc34 ("add 'goto' support (Henrik Nordstrom )") +Signed-off-by: Phil Sutter +(cherry picked from commit 94c19939744dbbbc6ff0fedf6cdba661769fdc87) +--- + iptables/iptables.8.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in +index c336ddf6e4f95..2365380490d52 100644 +--- a/iptables/iptables.8.in ++++ b/iptables/iptables.8.in +@@ -316,7 +316,7 @@ incremented. + .TP + \fB\-g\fP, \fB\-\-goto\fP \fIchain\fP + This specifies that the processing should continue in a user +-specified chain. Unlike the \-\-jump option return will not continue ++specified chain. Unlike with the \-\-jump option, \fBRETURN\fP will not continue + processing in this chain but instead in the chain that called us via + \-\-jump. + .TP +-- +2.41.0 + diff --git a/0032-man-iptables-restore.8-Fix-modprobe-description.patch b/0032-man-iptables-restore.8-Fix-modprobe-description.patch new file mode 100644 index 0000000..56d8dae --- /dev/null +++ b/0032-man-iptables-restore.8-Fix-modprobe-description.patch @@ -0,0 +1,37 @@ +From 1a62df2225b0d087a417d04455fe1e10384837e0 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:27:11 +0200 +Subject: [PATCH] man: iptables-restore.8: Fix --modprobe description + +- Consistently use 'modprobe' as option argument name +- Add a reference to modprobe man page +- Put the path in italics, and the command in bold + +Fixes: 8c46901ff5785 ("doc: document iptables-restore's -M option") +Signed-off-by: Phil Sutter +(cherry picked from commit 0f05f523ac02843ab7bbd09a96ba3fa384ae9523) +--- + iptables/iptables-restore.8.in | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index 20216842d8358..f95f00acd8d49 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -67,9 +67,10 @@ the program will exit if the lock cannot be obtained. This option will + make the program wait (indefinitely or for optional \fIseconds\fP) until + the exclusive lock can be obtained. + .TP +-\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe_program\fP +-Specify the path to the modprobe program. By default, iptables-restore will +-inspect /proc/sys/kernel/modprobe to determine the executable's path. ++\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe\fP ++Specify the path to the modprobe(8) program. By default, ++iptables-restore will inspect \fI/proc/sys/kernel/modprobe\fP to ++determine the executable's path. + .TP + \fB\-T\fP, \fB\-\-table\fP \fIname\fP + Restore only the named table even if the input stream contains other ones. +-- +2.41.0 + diff --git a/0033-man-iptables-restore.8-Consistently-document-w-optio.patch b/0033-man-iptables-restore.8-Consistently-document-w-optio.patch new file mode 100644 index 0000000..76b3885 --- /dev/null +++ b/0033-man-iptables-restore.8-Consistently-document-w-optio.patch @@ -0,0 +1,35 @@ +From 2b2c2310a61d17bf63845e7f70352342a072f08a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:33:26 +0200 +Subject: [PATCH] man: iptables-restore.8: Consistently document -w option + +Use the same name for the option's argument. + +Fixes: 65801d02a482b ("iptables-restore.8: document -w/-W options") +Signed-off-by: Phil Sutter +(cherry picked from commit e7bc6cc8aca993b743e83f20b2f579aed2f5d954) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index f95f00acd8d49..a63a344c0bd72 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -23,11 +23,11 @@ iptables-restore \(em Restore IP Tables + .P + ip6tables-restore \(em Restore IPv6 Tables + .SH SYNOPSIS +-\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP] ++\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .P +-\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP] ++\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .SH DESCRIPTION +-- +2.41.0 + diff --git a/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch b/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch new file mode 100644 index 0000000..ef01dfd --- /dev/null +++ b/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch @@ -0,0 +1,36 @@ +From 41257615e8d30c5969e3639d6ad5cd6f34f9143e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:34:51 +0200 +Subject: [PATCH] man: iptables-restore.8: Drop -W option from synopsis + +The description was dropped already, there is no benefit in still +listing it. + +Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") +Signed-off-by: Phil Sutter +(cherry picked from commit 193107df55541ced2e783bcce9b71b97f88a5398) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index a63a344c0bd72..bfd2fc355dd49 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -24,11 +24,11 @@ iptables-restore \(em Restore IP Tables + ip6tables-restore \(em Restore IPv6 Tables + .SH SYNOPSIS + \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] +-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] ++[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .P + \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] +-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] ++[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] + [\fBfile\fP] + .SH DESCRIPTION + .PP +-- +2.41.0 + diff --git a/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch b/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch new file mode 100644 index 0000000..673c6ad --- /dev/null +++ b/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch @@ -0,0 +1,35 @@ +From 97baff1f10262947c0feb6d6d14e67f1e7eb1bb0 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:37:09 +0200 +Subject: [PATCH] man: iptables-restore.8: Put 'file' in italics in synopsis + +The text has it this way already, be consistent. + +Fixes: 081d57839e91e ("iptables-restore.8: file to read from can be specified as argument") +Signed-off-by: Phil Sutter +(cherry picked from commit b200f0870bc17046d6db64a1a65937ad5f263633) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index bfd2fc355dd49..ff8179091eeee 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -25,11 +25,11 @@ ip6tables-restore \(em Restore IPv6 Tables + .SH SYNOPSIS + \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] +-[\fBfile\fP] ++[\fIfile\fP] + .P + \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP] + [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP] +-[\fBfile\fP] ++[\fIfile\fP] + .SH DESCRIPTION + .PP + .B iptables-restore +-- +2.41.0 + diff --git a/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch b/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch new file mode 100644 index 0000000..badd260 --- /dev/null +++ b/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch @@ -0,0 +1,37 @@ +From 868d7b3a16741bfa7e0c89ee1c840e4a3e51e2b2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:40:17 +0200 +Subject: [PATCH] man: iptables-restore.8: Start paragraphs in upper-case + +Also add a missing full stop in one spot. + +Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") +Signed-off-by: Phil Sutter +(cherry picked from commit 935a5cf8afa96daa1c688efd59b9025e3a78fba4) +--- + iptables/iptables-restore.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index ff8179091eeee..ce4520e626772 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -40,13 +40,13 @@ are used to restore IP and IPv6 Tables from data specified on STDIN or in + specify \fIfile\fP as an argument. + .TP + \fB\-c\fR, \fB\-\-counters\fR +-restore the values of all packet and byte counters ++Restore the values of all packet and byte counters. + .TP + \fB\-h\fP, \fB\-\-help\fP + Print a short option summary. + .TP + \fB\-n\fR, \fB\-\-noflush\fR +-don't flush the previous contents of the table. If not specified, ++Don't flush the previous contents of the table. If not specified, + both commands flush (delete) all previous contents of the respective table. + .TP + \fB\-t\fP, \fB\-\-test\fP +-- +2.41.0 + diff --git a/0037-man-Trivial-Missing-space-after-comma.patch b/0037-man-Trivial-Missing-space-after-comma.patch new file mode 100644 index 0000000..ade4e0a --- /dev/null +++ b/0037-man-Trivial-Missing-space-after-comma.patch @@ -0,0 +1,42 @@ +From 1016392a3d59afcda3eae03efe87353a3706a331 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 01:48:14 +0200 +Subject: [PATCH] man: Trivial: Missing space after comma + +Fixes: 6a79d78986c02 ("iptables: mention iptables-apply(8) in manpages") +Signed-off-by: Phil Sutter +(cherry picked from commit b0092a80656da7cf66f15ce906b17ab040ece12f) +--- + iptables/iptables-restore.8.in | 2 +- + iptables/iptables-save.8.in | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in +index ce4520e626772..aa816f794d6f3 100644 +--- a/iptables/iptables-restore.8.in ++++ b/iptables/iptables-restore.8.in +@@ -82,7 +82,7 @@ from Rusty Russell. + .br + Andras Kis-Szabo contributed ip6tables-restore. + .SH SEE ALSO +-\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8) ++\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8) + .PP + The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, + which details NAT, and the netfilter-hacking-HOWTO which details the +diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in +index 7683fd3780f72..253907719acee 100644 +--- a/iptables/iptables-save.8.in ++++ b/iptables/iptables-save.8.in +@@ -62,7 +62,7 @@ Rusty Russell + .br + Andras Kis-Szabo contributed ip6tables-save. + .SH SEE ALSO +-\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8) ++\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8) + .PP + The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, + which details NAT, and the netfilter-hacking-HOWTO which details the +-- +2.41.0 + diff --git a/0038-man-iptables-save.8-Fix-modprobe-description.patch b/0038-man-iptables-save.8-Fix-modprobe-description.patch new file mode 100644 index 0000000..11d8cce --- /dev/null +++ b/0038-man-iptables-save.8-Fix-modprobe-description.patch @@ -0,0 +1,37 @@ +From 5e144f6fc73baafada7c34779ebaafbbd3ecf45b Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 02:01:59 +0200 +Subject: [PATCH] man: iptables-save.8: Fix --modprobe description + +- Consistently use 'modprobe' as option argument name +- Add a reference to modprobe man page +- Put the path in italics and the command in bold + +Fixes: fbb5639c02218 ("iptables-save: module loading corrections") +Signed-off-by: Phil Sutter +(cherry picked from commit f1fd95ccefe483f0e3f2da593c6d4b671a7de522) +--- + iptables/iptables-save.8.in | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in +index 253907719acee..4a2c90c2f5956 100644 +--- a/iptables/iptables-save.8.in ++++ b/iptables/iptables-save.8.in +@@ -36,9 +36,10 @@ and + are used to dump the contents of IP or IPv6 Table in easily parseable format + either to STDOUT or to a specified file. + .TP +-\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP +-Specify the path to the modprobe program. By default, iptables-save will +-inspect /proc/sys/kernel/modprobe to determine the executable's path. ++\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe\fP ++Specify the path to the modprobe(8) program. By default, ++iptables-save will inspect \fI/proc/sys/kernel/modprobe\fP to determine ++the executable's path. + .TP + \fB\-f\fR, \fB\-\-file\fR \fIfilename\fP + Specify a filename to log the output to. If not specified, iptables-save +-- +2.41.0 + diff --git a/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch b/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch new file mode 100644 index 0000000..fd1267a --- /dev/null +++ b/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch @@ -0,0 +1,34 @@ +From 13aa85e1a27f50f91d6cfe521cca55cf37f4ac48 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 2 Aug 2023 02:06:00 +0200 +Subject: [PATCH] man: iptables-save.8: Start paragraphs in upper-case + +Also add a missing full stop. + +Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages") +Signed-off-by: Phil Sutter +(cherry picked from commit 952186aa0342f6bf3c4614a609525338d057d8d9) +--- + iptables/iptables-save.8.in | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in +index 4a2c90c2f5956..7c0d2552e8b97 100644 +--- a/iptables/iptables-save.8.in ++++ b/iptables/iptables-save.8.in +@@ -46,10 +46,10 @@ Specify a filename to log the output to. If not specified, iptables-save + will log to STDOUT. + .TP + \fB\-c\fR, \fB\-\-counters\fR +-include the current values of all packet and byte counters in the output ++Include the current values of all packet and byte counters in the output. + .TP + \fB\-t\fR, \fB\-\-table\fR \fItablename\fP +-restrict output to only one table. If the kernel is configured with automatic ++Restrict output to only one table. If the kernel is configured with automatic + module loading, an attempt will be made to load the appropriate module for + that table if it is not already there. + .br +-- +2.41.0 + diff --git a/0040-tests-iptables-test-Fix-command-segfault-reports.patch b/0040-tests-iptables-test-Fix-command-segfault-reports.patch new file mode 100644 index 0000000..5ec3a1d --- /dev/null +++ b/0040-tests-iptables-test-Fix-command-segfault-reports.patch @@ -0,0 +1,52 @@ +From 9b0b0db6aa82c8433002880f73a7614bb453320d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 26 Jul 2023 19:43:20 +0200 +Subject: [PATCH] tests: iptables-test: Fix command segfault reports + +Logging produced a stack trace due to undefined variable 'cmd'. + +Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode") +Signed-off-by: Phil Sutter +(cherry picked from commit 5412ccba55b2318160d32efec3b8aad162608af9) +--- + iptables-test.py | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/iptables-test.py b/iptables-test.py +index de1e1e95fda55..065c322a173ca 100755 +--- a/iptables-test.py ++++ b/iptables-test.py +@@ -136,7 +136,7 @@ STDERR_IS_TTY = sys.stderr.isatty() + # check for segfaults + # + if proc.returncode == -11: +- reason = "iptables-save segfaults: " + cmd ++ reason = command + " segfaults!" + print_error(reason, filename, lineno) + delete_rule(iptables, rule, filename, lineno, netns) + return -1 +@@ -333,8 +333,11 @@ STDERR_IS_TTY = sys.stderr.isatty() + out, err = proc.communicate(input = restore_data) + + if proc.returncode == -11: +- reason = iptables + "-restore segfaults: " + cmd ++ reason = iptables + "-restore segfaults!" + print_error(reason, filename, lineno) ++ msg = [iptables + "-restore segfault from:"] ++ msg.extend(["input: " + l for l in restore_data.split("\n")]) ++ print("\n".join(msg), file=log_file) + return -1 + + if proc.returncode != 0: +@@ -355,7 +358,7 @@ STDERR_IS_TTY = sys.stderr.isatty() + out, err = proc.communicate() + + if proc.returncode == -11: +- reason = iptables + "-save segfaults: " + cmd ++ reason = iptables + "-save segfaults!" + print_error(reason, filename, lineno) + return -1 + +-- +2.41.0 + diff --git a/0041-nft-Create-builtin-chains-with-counters-enabled.patch b/0041-nft-Create-builtin-chains-with-counters-enabled.patch new file mode 100644 index 0000000..21f9912 --- /dev/null +++ b/0041-nft-Create-builtin-chains-with-counters-enabled.patch @@ -0,0 +1,63 @@ +From 85746b658b9eedafd5523b5501ce0f8b5f5bdcbf Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 10 Aug 2023 11:30:59 +0200 +Subject: [PATCH] nft: Create builtin chains with counters enabled + +The kernel enables policy counters for nftables chains only if +NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one +has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the +allocated nftnl_chain object. + +The above happened for base chains only with iptables-nft-restore if +called with --counters flag. Since this is very unintuitive to users, +fix the situation by adding counters to base chains in any case. + +Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface") +Signed-off-by: Phil Sutter +(cherry picked from commit 39a067bb3b1b4ffb50a925f66e7db56658c0dfa7) +--- + iptables/nft.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 66b47d72e3ae8..2b5a27922a06e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -686,6 +686,9 @@ nft_chain_builtin_alloc(int family, const char *tname, + + nftnl_chain_set_str(c, NFTNL_CHAIN_TYPE, chain->type); + ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0); ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0); ++ + return c; + } + +@@ -946,6 +949,7 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h, + int policy, + const struct xt_counters *counters) + { ++ static const struct xt_counters zero = {}; + struct nftnl_chain *c; + const struct builtin_table *_t; + const struct builtin_chain *_c; +@@ -970,12 +974,10 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h, + return NULL; + } + +- if (counters) { +- nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, +- counters->bcnt); +- nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, +- counters->pcnt); +- } ++ if (!counters) ++ counters = &zero; ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, counters->bcnt); ++ nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, counters->pcnt); + + return c; + } +-- +2.41.0 + diff --git a/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch b/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch new file mode 100644 index 0000000..6818a1e --- /dev/null +++ b/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch @@ -0,0 +1,37 @@ +From 4cec9d5fec5c5bcc51b84e3ed9ba9619fe8b2909 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 3 Aug 2023 17:59:03 +0200 +Subject: [PATCH] Revert "libiptc: fix wrong maptype of base chain counters on + restore" + +This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4. + +The change can't be right: A simple rule append call will reset all +built-in chains' counters. The old code works fine even given the +mentioned "empty restore" use-case, at least if counters don't change on +the fly in-kernel. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912 +Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore") +Signed-off-by: Phil Sutter +(cherry picked from commit 43f78733059ecd28d8567d8205cab5ed62d93458) +--- + libiptc/libiptc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c +index f9b7779efdba5..29ff356f2324e 100644 +--- a/libiptc/libiptc.c ++++ b/libiptc/libiptc.c +@@ -822,7 +822,7 @@ static int __iptcc_p_del_policy(struct xtc_handle *h, unsigned int num) + + /* save counter and counter_map information */ + h->chain_iterator_cur->counter_map.maptype = +- COUNTER_MAP_ZEROED; ++ COUNTER_MAP_NORMAL_MAP; + h->chain_iterator_cur->counter_map.mappos = num-1; + memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters, + sizeof(h->chain_iterator_cur->counters)); +-- +2.41.0 + diff --git a/0043-doc-fix-example-of-xt_cpu.patch b/0043-doc-fix-example-of-xt_cpu.patch new file mode 100644 index 0000000..bfc6a76 --- /dev/null +++ b/0043-doc-fix-example-of-xt_cpu.patch @@ -0,0 +1,35 @@ +From 12e7024d3e8d245bb5645167f3aeb4c0187f75fd Mon Sep 17 00:00:00 2001 +From: Victor Julien +Date: Tue, 29 Aug 2023 14:59:32 +0200 +Subject: [PATCH] doc: fix example of xt_cpu + +REDIRECT uses --to-ports instead of --to-port. + +Fixes: 2d59208943a3 ("extension: add xt_cpu match") + +Signed-off-by: Victor Julien +Signed-off-by: Florian Westphal +(cherry picked from commit 63e4a64e943be64a7e0486838071b981074e696d) +--- + extensions/libxt_cpu.man | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_cpu.man b/extensions/libxt_cpu.man +index d9ea5c2faa20b..c89ef08afbfbb 100644 +--- a/extensions/libxt_cpu.man ++++ b/extensions/libxt_cpu.man +@@ -7,9 +7,9 @@ multiqueue NICs to spread network traffic on different queues. + Example: + .PP + iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 0 +-\-j REDIRECT \-\-to\-port 8080 ++\-j REDIRECT \-\-to\-ports 8080 + .PP + iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 1 +-\-j REDIRECT \-\-to\-port 8081 ++\-j REDIRECT \-\-to\-ports 8081 + .PP + Available since Linux 2.6.36. +-- +2.41.0 + diff --git a/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch b/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch new file mode 100644 index 0000000..632021f --- /dev/null +++ b/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch @@ -0,0 +1,92 @@ +From 16822c25bf795b54b13ada62da762ee7e9c2b12f Mon Sep 17 00:00:00 2001 +From: Quentin Armitage +Date: Sat, 23 Nov 2013 08:41:58 +0000 +Subject: [PATCH] extensions: Fix checking of conntrack --ctproto 0 + +There are three issues in the code: +1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask +2) in conntrack_mt_parse it is testing (info->invert_flags & + XT_INV_PROTO) before the invert bit has been set. +3) the sense of the error message is the wrong way round + +1) To get the error, ! -ctstatus XXX has to be specified, since + XT_INV_PROTO == XT_CONNTRACK_STATUS e.g. + | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ... + +3) Unlike --proto 0 (where 0 means all protocols), in the conntrack + match --ctproto 0 appears to mean protocol 0, which can never be. + Therefore --ctproto 0 could never match and ! --ctproto 0 will always + match. Both of these should be rejected, since the user clearly + cannot be intending what was specified. + +The attached patch resolves the issue, and also produces an error +message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since +--ctproto 0 will never match, and ! --ctproto 0 will always match. + +[Phil: - Added Fixes: tag - it's a day 1 bug + - Copied patch description from Bugzilla + - Reorganized changes to reduce diff + - Added test cases] + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874 +Fixes: 5054e85be3068 ("general conntrack match module userspace support files") +Signed-off-by: Quentin Armitage +Signed-off-by: Phil Sutter +(cherry picked from commit 2e704f6ddd6d056e360f3d9c11e8b6c56a20cf23) +--- + extensions/libxt_conntrack.c | 17 ++++++++--------- + extensions/libxt_conntrack.t | 2 ++ + 2 files changed, 10 insertions(+), 9 deletions(-) + +diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c +index 09548c297695f..ffbc7467bbf2e 100644 +--- a/extensions/libxt_conntrack.c ++++ b/extensions/libxt_conntrack.c +@@ -346,14 +346,13 @@ static void conntrack_parse(struct xt_option_call *cb) + sinfo->invflags |= XT_CONNTRACK_STATE; + break; + case O_CTPROTO: ++ if (cb->val.protocol == 0) ++ xtables_error(PARAMETER_PROBLEM, cb->invert ? ++ "condition would always match protocol" : ++ "rule would never match protocol"); + sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum = cb->val.protocol; + if (cb->invert) + sinfo->invflags |= XT_CONNTRACK_PROTO; +- if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0 +- && (sinfo->invflags & XT_INV_PROTO)) +- xtables_error(PARAMETER_PROBLEM, +- "rule would never match protocol"); +- + sinfo->flags |= XT_CONNTRACK_PROTO; + break; + case O_CTORIGSRC: +@@ -411,11 +410,11 @@ static void conntrack_mt_parse(struct xt_option_call *cb, uint8_t rev) + info->invert_flags |= XT_CONNTRACK_STATE; + break; + case O_CTPROTO: ++ if (cb->val.protocol == 0) ++ xtables_error(PARAMETER_PROBLEM, cb->invert ? ++ "conntrack: condition would always match protocol" : ++ "conntrack: rule would never match protocol"); + info->l4proto = cb->val.protocol; +- if (info->l4proto == 0 && (info->invert_flags & XT_INV_PROTO)) +- xtables_error(PARAMETER_PROBLEM, "conntrack: rule would " +- "never match protocol"); +- + info->match_flags |= XT_CONNTRACK_PROTO; + if (cb->invert) + info->invert_flags |= XT_CONNTRACK_PROTO; +diff --git a/extensions/libxt_conntrack.t b/extensions/libxt_conntrack.t +index db53147532afd..2b3c5de9cd3ab 100644 +--- a/extensions/libxt_conntrack.t ++++ b/extensions/libxt_conntrack.t +@@ -25,3 +25,5 @@ + -m conntrack --ctstatus EXPECTED;=;OK + -m conntrack --ctstatus SEEN_REPLY;=;OK + -m conntrack;;FAIL ++-m conntrack --ctproto 0;;FAIL ++-m conntrack ! --ctproto 0;;FAIL +-- +2.41.0 + diff --git a/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch b/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch new file mode 100644 index 0000000..adf28ca --- /dev/null +++ b/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch @@ -0,0 +1,44 @@ +From 73f49fada3a73b321a0c01fc3014d7617180f1ed Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 1 Sep 2023 13:16:56 +0200 +Subject: [PATCH] tests: shell: Fix for ineffective 0007-mid-restore-flush_0 + +The test did not catch non-zero exit status of the spawned coprocess. To +make it happen, Drop the line killing it (it will exit anyway) and pass +its PID to 'wait'. + +While being at it, put the sleep into the correct spot (otherwise the +check for chain 'foo' existence fails as it runs too early) and make +said chain existence check effective. + +Fixes: 4e3c11a6f5a94 ("nft: Fix for ruleset flush while restoring") +Signed-off-by: Phil Sutter +(cherry picked from commit ea12b1d2b191f100a6fdb83af4681364e4dba12a) +--- + .../shell/testcases/nft-only/0007-mid-restore-flush_0 | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 +index 43880ffbc5851..981f007f205b9 100755 +--- a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 ++++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 +@@ -13,11 +13,11 @@ COMMIT + :foo [0:0] + EOF + +-$XT_MULTI iptables-save | grep -q ':foo' ++sleep 1 ++$XT_MULTI iptables-save | grep -q ':foo' || exit 1 + nft flush ruleset + + echo "COMMIT" >&"${COPROC[1]}" +-sleep 1 +- +-[[ -n $COPROC_PID ]] && kill $COPROC_PID +-wait ++# close the pipe to make iptables-restore exit if it didn't error out yet ++eval "exec ${COPROC[1]}>&-" ++wait $COPROC_PID +-- +2.41.0 + diff --git a/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch b/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch new file mode 100644 index 0000000..0f367e7 --- /dev/null +++ b/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch @@ -0,0 +1,277 @@ +From fea09f9273e279d0a18a9db368546897fe3b2edd Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 6 Sep 2023 16:32:47 +0200 +Subject: [PATCH] nft: Fix for useless meta expressions in rule + +A relict of legacy iptables' mandatory matching on interfaces and IP +addresses is support for the '-i +' notation, basically a "match any +input interface". Trying to make things better than its predecessor, +iptables-nft boldly optimizes that nop away - not entirely though, the +meta expression loading the interface name was left in place. While not +a problem (apart from pointless overhead) in current HEAD, v1.8.7 would +trip over this as a following cmp expression (for another match) was +incorrectly linked to that stale meta expression, loading strange values +into the respective interface name field. + +While being at it, merge and generalize the functions into a common one +for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too. + +Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702 +Signed-off-by: Phil Sutter +(cherry picked from commit 52ed0ac516db9f3a44f61dfd8b65d20631bfa95b) +--- + extensions/libebt_standard.t | 4 ++++ + extensions/libip6t_standard.t | 3 +++ + extensions/libxt_standard.t | 2 ++ + iptables/nft-arp.c | 4 ++-- + iptables/nft-bridge.c | 38 ++++------------------------- + iptables/nft-ipv4.c | 4 ++-- + iptables/nft-ipv6.c | 4 ++-- + iptables/nft-shared.c | 45 ++++++++++++----------------------- + iptables/nft-shared.h | 4 ++-- + 9 files changed, 36 insertions(+), 72 deletions(-) + +diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t +index 97cb3baaf6d21..370a12f4a2cec 100644 +--- a/extensions/libebt_standard.t ++++ b/extensions/libebt_standard.t +@@ -14,6 +14,10 @@ + -o foobar;=;FAIL + --logical-in br0;=;OK + --logical-out br1;=;FAIL ++-i + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK ++-i + -p ip;-p IPv4;OK ++--logical-in + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK ++--logical-in + -p ip;-p IPv4;OK + :FORWARD + -i foobar;=;OK + -o foobar;=;OK +diff --git a/extensions/libip6t_standard.t b/extensions/libip6t_standard.t +index a528af10ea152..0c559cc5021f6 100644 +--- a/extensions/libip6t_standard.t ++++ b/extensions/libip6t_standard.t +@@ -3,3 +3,6 @@ + ! -d ::;! -d ::/128;OK + ! -s ::;! -s ::/128;OK + -s ::/64;=;OK ++:INPUT ++-i + -d c0::fe;-d c0::fe/128;OK ++-i + -p tcp;-p tcp;OK +diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t +index 6ed978e442b80..7c83cfa3ba232 100644 +--- a/extensions/libxt_standard.t ++++ b/extensions/libxt_standard.t +@@ -24,3 +24,5 @@ + :FORWARD + --protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK + -ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK ++-i + -d 1.2.3.4;-d 1.2.3.4/32;OK ++-i + -p tcp;-p tcp;OK +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 889387e4db592..54cddbc5f07cc 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -49,12 +49,12 @@ static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (fw->arp.iniface[0] != '\0') { + op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN); +- add_iniface(h, r, fw->arp.iniface, op); ++ add_iface(h, r, fw->arp.iniface, NFT_META_IIFNAME, op); + } + + if (fw->arp.outiface[0] != '\0') { + op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT); +- add_outiface(h, r, fw->arp.outiface, op); ++ add_iface(h, r, fw->arp.outiface, NFT_META_OIFNAME, op); + } + + if (fw->arp.arhrd != 0 || +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index a41f411fbba14..9e349813ee5b3 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -65,36 +65,6 @@ static void ebt_print_mac_and_mask(const unsigned char *mac, const unsigned char + xtables_print_mac_and_mask(mac, mask); + } + +-static void add_logical_iniface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) +-{ +- int iface_len; +- uint8_t reg; +- +- iface_len = strlen(iface); +- +- add_meta(h, r, NFT_META_BRI_IIFNAME, ®); +- if (iface[iface_len - 1] == '+') +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); +-} +- +-static void add_logical_outiface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) +-{ +- int iface_len; +- uint8_t reg; +- +- iface_len = strlen(iface); +- +- add_meta(h, r, NFT_META_BRI_OIFNAME, ®); +- if (iface[iface_len - 1] == '+') +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); +-} +- + static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) + { + return add_action(r, cs, false); +@@ -130,22 +100,22 @@ static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (fw->in[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_IIN); +- add_iniface(h, r, fw->in, op); ++ add_iface(h, r, fw->in, NFT_META_IIFNAME, op); + } + + if (fw->out[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_IOUT); +- add_outiface(h, r, fw->out, op); ++ add_iface(h, r, fw->out, NFT_META_OIFNAME, op); + } + + if (fw->logical_in[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALIN); +- add_logical_iniface(h, r, fw->logical_in, op); ++ add_iface(h, r, fw->logical_in, NFT_META_BRI_IIFNAME, op); + } + + if (fw->logical_out[0] != '\0') { + op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALOUT); +- add_logical_outiface(h, r, fw->logical_out, op); ++ add_iface(h, r, fw->logical_out, NFT_META_BRI_OIFNAME, op); + } + + if (fw->bitmask & EBT_ISOURCE) { +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index fb62103fd38d7..8449407bd40ed 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -35,12 +35,12 @@ static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (cs->fw.ip.iniface[0] != '\0') { + op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN); +- add_iniface(h, r, cs->fw.ip.iniface, op); ++ add_iface(h, r, cs->fw.ip.iniface, NFT_META_IIFNAME, op); + } + + if (cs->fw.ip.outiface[0] != '\0') { + op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_OUT); +- add_outiface(h, r, cs->fw.ip.outiface, op); ++ add_iface(h, r, cs->fw.ip.outiface, NFT_META_OIFNAME, op); + } + + if (cs->fw.ip.proto != 0) { +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index d36e06812e08d..443815da77acf 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -34,12 +34,12 @@ static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx, + + if (cs->fw6.ipv6.iniface[0] != '\0') { + op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN); +- add_iniface(h, r, cs->fw6.ipv6.iniface, op); ++ add_iface(h, r, cs->fw6.ipv6.iniface, NFT_META_IIFNAME, op); + } + + if (cs->fw6.ipv6.outiface[0] != '\0') { + op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT); +- add_outiface(h, r, cs->fw6.ipv6.outiface, op); ++ add_iface(h, r, cs->fw6.ipv6.outiface, NFT_META_OIFNAME, op); + } + + if (cs->fw6.ipv6.proto != 0) { +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 413503ed86932..a23a2c8a8fa11 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -155,44 +155,29 @@ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg) + add_cmp_ptr(r, op, &val, sizeof(val), sreg); + } + +-void add_iniface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) ++void add_iface(struct nft_handle *h, struct nftnl_rule *r, ++ char *iface, uint32_t key, uint32_t op) + { +- int iface_len; ++ int iface_len = strlen(iface); + uint8_t reg; + +- iface_len = strlen(iface); + +- add_meta(h, r, NFT_META_IIFNAME, ®); + if (iface[iface_len - 1] == '+') { +- if (iface_len > 1) +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else if (op != NFT_CMP_EQ) +- add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D", +- strlen("INVAL/D") + 1, reg); ++ if (iface_len > 1) { ++ iface_len -= 1; ++ } else if (op != NFT_CMP_EQ) { ++ op = NFT_CMP_EQ; ++ iface = "INVAL/D"; ++ iface_len = strlen(iface) + 1; ++ } else { ++ return; /* -o + */ ++ } + } else { +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); ++ iface_len += 1; + } +-} +- +-void add_outiface(struct nft_handle *h, struct nftnl_rule *r, +- char *iface, uint32_t op) +-{ +- int iface_len; +- uint8_t reg; + +- iface_len = strlen(iface); +- +- add_meta(h, r, NFT_META_OIFNAME, ®); +- if (iface[iface_len - 1] == '+') { +- if (iface_len > 1) +- add_cmp_ptr(r, op, iface, iface_len - 1, reg); +- else if (op != NFT_CMP_EQ) +- add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D", +- strlen("INVAL/D") + 1, reg); +- } else { +- add_cmp_ptr(r, op, iface, iface_len + 1, reg); +- } ++ add_meta(h, r, key, ®); ++ add_cmp_ptr(r, op, iface, iface_len, reg); + } + + void add_addr(struct nft_handle *h, struct nftnl_rule *r, +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 9065e52f669e1..94cc295436a27 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -193,8 +193,8 @@ void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len, uint + void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op, uint8_t sreg); + void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op, uint8_t sreg); + void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg); +-void add_iniface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); +-void add_outiface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op); ++void add_iface(struct nft_handle *h, struct nftnl_rule *r, ++ char *iface, uint32_t key, uint32_t op); + void add_addr(struct nft_handle *h, struct nftnl_rule *r, enum nft_payload_bases base, int offset, + void *data, void *mask, size_t len, uint32_t op); + void add_proto(struct nft_handle *h, struct nftnl_rule *r, int offset, size_t len, +-- +2.41.0 + diff --git a/iptables.spec b/iptables.spec index d779895..cb64d89 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.9 -Release: 4%{?dist} +Release: 4%{?dist}.1 Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -37,6 +37,35 @@ Patch014: 0014-nft-shared-Drop-unused-include.patch Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch +Patch018: 0018-iptables-Fix-setting-of-ipv6-counters.patch +Patch019: 0019-iptables-Fix-handling-of-non-existent-chains.patch +Patch020: 0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch +Patch021: 0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch +Patch022: 0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch +Patch023: 0023-nft-Special-casing-for-among-match-in-compare_matche.patch +Patch024: 0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch +Patch025: 0025-tables-Reject-invalid-chain-names-when-renaming.patch +Patch026: 0026-ebtables-Improve-invalid-chain-name-detection.patch +Patch027: 0027-tests-shell-Fix-and-extend-chain-rename-test.patch +Patch028: 0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch +Patch029: 0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch +Patch030: 0030-man-iptables.8-Fix-intra-page-reference.patch +Patch031: 0031-man-iptables.8-Clarify-goto-description.patch +Patch032: 0032-man-iptables-restore.8-Fix-modprobe-description.patch +Patch033: 0033-man-iptables-restore.8-Consistently-document-w-optio.patch +Patch034: 0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch +Patch035: 0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch +Patch036: 0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch +Patch037: 0037-man-Trivial-Missing-space-after-comma.patch +Patch038: 0038-man-iptables-save.8-Fix-modprobe-description.patch +Patch039: 0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch +Patch040: 0040-tests-iptables-test-Fix-command-segfault-reports.patch +Patch041: 0041-nft-Create-builtin-chains-with-counters-enabled.patch +Patch042: 0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch +Patch043: 0043-doc-fix-example-of-xt_cpu.patch +Patch044: 0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch +Patch045: 0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch +Patch046: 0046-nft-Fix-for-useless-meta-expressions-in-rule.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -447,6 +476,9 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.9-4.1 +- Backport fixes from upstream + * Wed May 24 2023 Phil Sutter - 1.8.9-4 - Backport fixes from upstream From 4407a0239cd14b500c225119639ca72d98da6d13 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:23:45 +0200 Subject: [PATCH 05/43] tests: Drop checks for iptables RPM On one hand, the test will fail as the RPM is called 'iptables-nft' (or 'iptables-legacy', but that's not the default). On the other, if iptables RPM is missing the commands will fail as well so this check happens implicitly anyway. --- tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh | 2 -- .../RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh | 2 -- tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh | 2 -- tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh | 2 -- tests/initscript-sanity/runtest.sh | 3 --- .../runtest.sh | 3 --- .../runtest.sh | 3 --- .../ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh | 2 -- .../iptables-rule-deletion-fails-for-rules-that-use/runtest.sh | 2 -- tests/iptables-save-cuts-space-before-j/runtest.sh | 3 --- tests/iptables-save-modprobe-option/runtest.sh | 3 --- tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh | 3 --- 12 files changed, 30 deletions(-) diff --git a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh index 32eab99..952cd4c 100755 --- a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh +++ b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET=testset6 rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh index 438468d..26a667e 100755 --- a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh +++ b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" TESTD=$PWD rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "source $TESTD/rules.in" 0 "read ruleset" diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 889c1b6..5021458 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" prepare_page() { @@ -42,7 +41,6 @@ prepare_page() { rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel rlLogInfo $(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" diff --git a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh index 888dfbd..0b4032e 100755 --- a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh +++ b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh @@ -29,7 +29,6 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" CGNUM="15" CGNAME="15" CGDIR="/sys/fs/cgroup/net_cls/$CGNAME" @@ -41,7 +40,6 @@ SKIP6=false rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE # rlAssertRpm kernel-$(uname -r) rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" diff --git a/tests/initscript-sanity/runtest.sh b/tests/initscript-sanity/runtest.sh index e270b78..b132033 100755 --- a/tests/initscript-sanity/runtest.sh +++ b/tests/initscript-sanity/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh index 004d568..f68925c 100755 --- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh +++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ip6tables-save > ip6tables.backup" diff --git a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh index f59a908..d06fc4a 100755 --- a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh +++ b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "cp /etc/sysconfig/ip6tables ." diff --git a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh index 79b2696..2daddb3 100755 --- a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh +++ b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh @@ -29,12 +29,10 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" SERVICES="iptables ip6tables firewalld" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" for svc in $SERVICES; do diff --git a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh index d17e693..f409501 100755 --- a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh +++ b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh @@ -29,13 +29,11 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" IPSET4="ipsetv4" IPSET6="ipsetv6" rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "ipset create $IPSET4 hash:ip" diff --git a/tests/iptables-save-cuts-space-before-j/runtest.sh b/tests/iptables-save-cuts-space-before-j/runtest.sh index a6a5099..bba6bf2 100755 --- a/tests/iptables-save-cuts-space-before-j/runtest.sh +++ b/tests/iptables-save-cuts-space-before-j/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlServiceStart iptables diff --git a/tests/iptables-save-modprobe-option/runtest.sh b/tests/iptables-save-modprobe-option/runtest.sh index 22951c4..240c76e 100755 --- a/tests/iptables-save-modprobe-option/runtest.sh +++ b/tests/iptables-save-modprobe-option/runtest.sh @@ -30,11 +30,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartTest - rlAssertRpm $PACKAGE rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported" rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported" rlPhaseEnd diff --git a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh index c3223b5..abfb03a 100755 --- a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh +++ b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh @@ -29,11 +29,8 @@ . /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 -PACKAGE="iptables" - rlJournalStart rlPhaseStartSetup - rlAssertRpm $PACKAGE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlPhaseEnd From c61918e30991a3b5c4c3e4b6988a0a99440034be Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 10 Oct 2023 19:40:51 +0200 Subject: [PATCH 06/43] iptables-1.8.10-2 - Obsolete dropped compat package --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index e37c5e6..5d5240b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 1%{?dist} +Release: 2%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,6 +59,7 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif +Obsoletes: %{name}-compat < 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -413,6 +414,9 @@ fi %changelog +* Tue Oct 10 2023 Phil Sutter - 1.8.10-2 +- Obsolete dropped compat package + * Tue Oct 10 2023 Phil Sutter - 1.8.10-1 - New version 1.8.10 - Drop compat sub-package From 9272a9e4cc5f169c98f61123116df93c02f315b2 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 14:56:09 +0100 Subject: [PATCH 07/43] iptables-1.8.10-3 - Fix compat sub-package obsoletion Resolves: rhbz#2248494 --- iptables.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5d5240b..a4506d4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 2%{?dist} +Release: 3%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -59,7 +59,8 @@ Requires(postun): %{_sbindir}/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif -Obsoletes: %{name}-compat < 1.8.9-6 +Provides: %{name}-compat = %{version}-%{release} +Obsoletes: %{name}-compat <= 1.8.9-6 %description legacy The iptables utility controls the network packet filtering code in the @@ -414,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-3 +- Fix compat sub-package obsoletion + * Tue Oct 10 2023 Phil Sutter - 1.8.10-2 - Obsolete dropped compat package From 452b549ac6e57bca853fd99096f5bcefaeec7f49 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 21:43:47 +0100 Subject: [PATCH 08/43] iptables-1.8.10-4 - The actual obsoletes fix Resolves: rhbz#2248494 --- iptables.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/iptables.spec b/iptables.spec index a4506d4..05ac24b 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 3%{?dist} +Release: 4%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -60,7 +60,7 @@ Requires(postun): %{_sbindir}/update-alternatives Provides: iptables %endif Provides: %{name}-compat = %{version}-%{release} -Obsoletes: %{name}-compat <= 1.8.9-6 +Obsoletes: %{name}-compat < 1.8.9-7 %description legacy The iptables utility controls the network packet filtering code in the @@ -415,6 +415,9 @@ fi %changelog +* Tue Nov 07 2023 Phil Sutter - 1.8.10-4 +- The actual obsoletes fix + * Tue Nov 07 2023 Phil Sutter - 1.8.10-3 - Fix compat sub-package obsoletion From d10a06dda4a10de64ad3fa230e2ec1828cf1766c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 8 Nov 2023 00:07:03 +0100 Subject: [PATCH 09/43] tests/TRACE-target-of-iptables-can-t-work-in: Unload modules only if loaded Apply the same kernel version check to cleanup phase and omit module unloading. --- .../runtest.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh index 5021458..86652af 100755 --- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh +++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh @@ -119,10 +119,14 @@ rlJournalStart rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6" rlRun "iptables -t raw -F" rlRun "ip6tables -t raw -F" - rlRun "rmmod nf_log_ipv4" - rlRun "rmmod nf_log_ipv6" - rlRun "rmmod nf_log_common" - rlRun "rmmod nfnetlink_log" 0,1 + if rlTestVersion "$(uname -r)" "<" "4.6"; then + rlRun "rmmod nf_log_ipv4" + rlRun "rmmod nf_log_ipv6" + rlRun "rmmod nf_log_common" + rlRun "rmmod nfnetlink_log" 0,1 + else + rlLogInfo "new kernel detected: skipping unloading modules" + fi rlLogInfo "restoring services" for svc in $SERVICES; do rlServiceRestore $svc From 3611a44057b5cfdb4641c2370784a37ae4d56c26 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Mon, 8 Jan 2024 09:02:09 -0500 Subject: [PATCH 10/43] Fix flatpak build Installation path macros must not be used for file dependencies: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies --- iptables.spec | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index 05ac24b..cc4091e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -54,8 +54,8 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 Provides: iptables %endif @@ -142,9 +142,9 @@ a safer way to update iptables remotely. %package nft Summary: nftables compatibility for iptables, arptables and ebtables Requires: %{name}-libs%{?_isa} = %{version}-%{release} -Requires(post): %{_sbindir}/update-alternatives -Requires(post): %{_bindir}/readlink -Requires(postun): %{_sbindir}/update-alternatives +Requires(post): /usr/sbin/update-alternatives +Requires(post): /usr/bin/readlink +Requires(postun): /usr/sbin/update-alternatives Obsoletes: iptables-compat < 1.6.2-4 Provides: arptables-helper Provides: iptables @@ -234,7 +234,7 @@ ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -244,7 +244,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -260,7 +260,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -286,7 +286,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -304,7 +304,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -324,7 +324,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -%{_sbindir}/update-alternatives --install \ +/usr/sbin/update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -336,7 +336,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - %{_sbindir}/update-alternatives --remove \ + /usr/sbin/update-alternatives --remove \ $cmd %{_sbindir}/$cmd-nft done fi From 86e59a1ef9148016f717558dda3478f5740c1a06 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 12 Jan 2024 17:47:08 +0100 Subject: [PATCH 11/43] iptables-1.8.10-5 - Backport fixes from upstream - Fix flatpak build --- ...another-segfault-due-to-chain-index-.patch | 81 +++++++++++++ ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 +++++++++++++ ...-Fix-corner-case-noflush-restore-bug.patch | 63 ++++++++++ ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 +++++++ ...ants-support-v-update-OPTSTRING_COMM.patch | 31 +++++ ...n-line-number-formatting-with-legacy.patch | 28 +++++ ...-man-Do-not-escape-exclamation-marks.patch | 44 +++++++ ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 ++++++++ ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ++++++++++++++++++ ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 ++++++ iptables.spec | 17 ++- 11 files changed, 589 insertions(+), 1 deletion(-) create mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch create mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch create mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch create mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch create mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch create mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch create mode 100644 0007-man-Do-not-escape-exclamation-marks.patch create mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch create mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch create mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch new file mode 100644 index 0000000..35b5973 --- /dev/null +++ b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch @@ -0,0 +1,81 @@ +From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 12 Oct 2023 17:27:42 +0200 +Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL + pointer + +Chain rename code missed to adjust the num_chains value which is used to +calculate the number of chain index buckets to allocate during an index +rebuild. So with the right number of chains present, the last chain in a +middle bucket being renamed (and ending up in another bucket) triggers +an index rebuild based on false data. The resulting NULL pointer index +bucket then causes a segfault upon reinsertion. + +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 +Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") +(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) +--- + .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ + libiptc/libiptc.c | 4 +++ + 2 files changed, 36 insertions(+) + create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 + +diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +new file mode 100755 +index 0000000000000..bc473d2511bbd +--- /dev/null ++++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 +@@ -0,0 +1,32 @@ ++#!/bin/bash ++# ++# Another funny rename bug in libiptc: ++# If there is a chain index bucket with only a single chain in it and it is not ++# the last one and that chain is renamed, a chain index rebuild is triggered. ++# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an ++# extra index is allocated and remains NULL. The following insert of renamed ++# chain then segfaults. ++ ++( ++ echo "*filter" ++ # first bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-a-$i - [0:0]" ++ done ++ # second bucket ++ for ((i = 0; i < 40; i++)); do ++ echo ":chain-b-$i - [0:0]" ++ done ++ # third bucket, just make sure it exists ++ echo ":chain-c-0 - [0:0]" ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore ++ ++# rename all chains of the middle bucket ++( ++ echo "*filter" ++ for ((i = 0; i < 40; i++)); do ++ echo "-E chain-b-$i chain-d-$i" ++ done ++ echo "COMMIT" ++) | $XT_MULTI iptables-restore --noflush +diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c +index e475063367c26..9712a36353b9a 100644 +--- a/libiptc/libiptc.c ++++ b/libiptc/libiptc.c +@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, + return 0; + } + ++ handle->num_chains--; ++ + /* This only unlinks "c" from the list, thus no free(c) */ + iptcc_chain_index_delete_chain(c, handle); + + /* Change the name of the chain */ + strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); + ++ handle->num_chains++; ++ + /* Insert sorted into to list again */ + iptc_insert_chain(handle, c); + diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch new file mode 100644 index 0000000..c384e4b --- /dev/null +++ b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -0,0 +1,81 @@ +From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 3 Nov 2023 17:33:22 +0100 +Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage + +ARPT_ and IPT_INV flags are not interchangeable, e.g.: +define IPT_INV_SRCDEVADDR 0x0080 +define ARPT_INV_SRCDEVADDR 0x0010 + +as these flags can be tested by libarp_foo.so such checks can yield +incorrect results. + +Because arptables-nft uses existing code, e.g. xt_mark, it makes +sense to unify this completely by converting the last users of +ARPT_INV_ constants. + +Note that arptables-legacy does not do run-time module loading via +dlopen(). Functionaliy implemented by "extensions" in the +arptables-legacy git tree are built-in, so this doesn't break +arptables-legacy binaries. + +Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") +Signed-off-by: Florian Westphal +Signed-off-by: Phil Sutter +(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) +--- + extensions/libarpt_mangle.c | 4 ++-- + iptables/nft-arp.c | 2 +- + iptables/xshared.h | 4 +++- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c +index 765edf34781f3..a846e97ec8f27 100644 +--- a/extensions/libarpt_mangle.c ++++ b/extensions/libarpt_mangle.c +@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! --h-length not allowed for " + "--mangle-mac-s"); +@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, + if (e->arp.arhln_mask == 0) + xtables_error(PARAMETER_PROBLEM, + "no --h-length defined"); +- if (e->arp.invflags & ARPT_INV_ARPHLN) ++ if (e->arp.invflags & IPT_INV_ARPHLN) + xtables_error(PARAMETER_PROBLEM, + "! hln not allowed for --mangle-mac-d"); + if (e->arp.arhln != 6) +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index aed39ebdd5166..535dd6b83237b 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, + &args->d.naddrs); + + if ((args->s.naddrs > 1 || args->d.naddrs > 1) && +- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) ++ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) + xtables_error(PARAMETER_PROBLEM, + "! not allowed with multiple" + " source or destination IP addresses"); +diff --git a/iptables/xshared.h b/iptables/xshared.h +index a200e0d620ad3..5586385456a4d 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -80,7 +80,9 @@ struct xtables_target; + #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ + #define EBT_OPTSTRING OPTSTRING_COMMON "hv" + +-/* define invflags which won't collide with IPT ones */ ++/* define invflags which won't collide with IPT ones. ++ * arptables-nft does NOT use the legacy ARPT_INV_* defines. ++ */ + #define IPT_INV_SRCDEVADDR 0x0080 + #define IPT_INV_TGTDEVADDR 0x0100 + #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch new file mode 100644 index 0000000..3386925 --- /dev/null +++ b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch @@ -0,0 +1,63 @@ +From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 7 Nov 2023 19:12:14 +0100 +Subject: [PATCH] ebtables: Fix corner-case noflush restore bug + +Report came from firwalld, but this is actually rather hard to trigger. +Since a regular chain line prevents it, typical dump/restore use-cases +are unaffected. + +Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") +Cc: Eric Garver +Signed-off-by: Phil Sutter +(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) +--- + .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ + iptables/xtables-eb.c | 2 ++ + 2 files changed, 27 insertions(+) + create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 + +diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +new file mode 100755 +index 0000000000000..0def0ac58e7be +--- /dev/null ++++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 +@@ -0,0 +1,25 @@ ++#!/bin/sh ++# ++# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: ++# - with --noflush ++# - a second table after the broute one ++# - A policy command but no chain line for BROUTING chain ++ ++set -e ++ ++case "$XT_MULTI" in ++*xtables-nft-multi) ++ ;; ++*) ++ echo "skip $XT_MULTI" ++ exit 0 ++ ;; ++esac ++ ++$XT_MULTI ebtables-restore --noflush < +Date: Sun, 19 Nov 2023 13:18:26 +0100 +Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused + +Drop the boolean, it was meant to disable some existence checks in +do_parse() prior to the caching rework. Now that do_parse() runs before +any caching is done, the checks in question don't exist anymore so drop +this relict. + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter +(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) +--- + iptables/xshared.h | 1 - + iptables/xtables-translate.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index 5586385456a4d..c77556a1987dc 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -284,7 +284,6 @@ struct xt_cmd_parse { + bool restore; + int line; + int verbose; +- bool xlate; + struct xt_cmd_parse_ops *ops; + }; + +diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c +index 88e0a6b639494..c019cd2991305 100644 +--- a/iptables/xtables-translate.c ++++ b/iptables/xtables-translate.c +@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], + .table = *table, + .restore = restore, + .line = line, +- .xlate = true, + .ops = &h->ops->cmd_parse, + }; + struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch new file mode 100644 index 0000000..c743e75 --- /dev/null +++ b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch @@ -0,0 +1,31 @@ +From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 19 Nov 2023 13:25:36 +0100 +Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON + +Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") +Signed-off-by: Phil Sutter +(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) +--- + iptables/xshared.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/iptables/xshared.h b/iptables/xshared.h +index c77556a1987dc..815b9d3e98726 100644 +--- a/iptables/xshared.h ++++ b/iptables/xshared.h +@@ -75,10 +75,10 @@ struct xtables_globals; + struct xtables_rule_match; + struct xtables_target; + +-#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" +-#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" +-#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ +-#define EBT_OPTSTRING OPTSTRING_COMMON "hv" ++#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" ++#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" ++#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ ++#define EBT_OPTSTRING OPTSTRING_COMMON "h" + + /* define invflags which won't collide with IPT ones. + * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch new file mode 100644 index 0000000..07bea3a --- /dev/null +++ b/0006-ebtables-Align-line-number-formatting-with-legacy.patch @@ -0,0 +1,28 @@ +From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 21 Nov 2023 22:58:47 +0100 +Subject: [PATCH] ebtables: Align line number formatting with legacy + +Legacy ebtables appends a dot to the number printed in first column if +--Ln flag was given. + +Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") +Signed-off-by: Phil Sutter +(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) +--- + iptables/nft-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index d9a8ad2b0f373..e414ef5584392 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, + struct iptables_command_state cs = {}; + + if (format & FMT_LINENUMBERS) +- printf("%d ", num); ++ printf("%d. ", num); + + nft_rule_to_ebtables_command_state(h, r, &cs); + __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch new file mode 100644 index 0000000..b088c63 --- /dev/null +++ b/0007-man-Do-not-escape-exclamation-marks.patch @@ -0,0 +1,44 @@ +From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 13:29:17 +0100 +Subject: [PATCH] man: Do not escape exclamation marks + +This appears to be not necessary, also mandoc complains about it: + +| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! + +Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") +Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") +Signed-off-by: Phil Sutter +(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) +--- + extensions/libip6t_DNPT.man | 2 +- + extensions/libip6t_SNPT.man | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man +index 9b060f5b7179b..72c6ae5d422a2 100644 +--- a/extensions/libip6t_DNPT.man ++++ b/extensions/libip6t_DNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the SNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 +diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man +index 97e0071b43cc1..0c926978377a7 100644 +--- a/extensions/libip6t_SNPT.man ++++ b/extensions/libip6t_SNPT.man +@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length + .PP + You have to use the DNPT target to undo the translation. Example: + .IP +-ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 ++ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 + \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 + .IP + ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch new file mode 100644 index 0000000..c0bbec2 --- /dev/null +++ b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch @@ -0,0 +1,49 @@ +From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Nov 2023 20:21:49 +0100 +Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks + +In order to parse the mask, xtopt_parse_hostmask() calls +xtopt_parse_plenmask() thereby limiting netmask support to prefix +lengths (alternatively specified in IP address notation). + +In order to lift this impractical restriction, make +xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may +fall back to xtopt_parse_mask() which correctly initializes val.hmask +itself and indicates non-CIDR-compatible masks by setting val.hlen to +-1. + +So in order to support these odd masks, it is sufficient for +xtopt_parse_plenmask() to skip its mask building from val.hlen value and +take whatever val.hmask contains. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +Signed-off-by: Phil Sutter +(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) +--- + libxtables/xtoptions.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index b16bbfbe32311..d91a78f470eda 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + + xtopt_parse_plen(cb); + ++ /* may not be convertible to CIDR notation */ ++ if (cb->val.hlen == (uint8_t)-1) ++ goto out_put; ++ + memset(mask, 0xFF, sizeof(union nf_inet_addr)); + /* This shifting is AF-independent. */ + if (cb->val.hlen == 0) { +@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) + mask[1] = htonl(mask[1]); + mask[2] = htonl(mask[2]); + mask[3] = htonl(mask[3]); ++out_put: + if (entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); + } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch new file mode 100644 index 0000000..7745634 --- /dev/null +++ b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch @@ -0,0 +1,114 @@ +From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 19 Dec 2023 00:56:07 +0100 +Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting + +Parameter 'wait' passed to xtables_lock() signals three modes of +operation, depending on its value: + + 0: --wait not specified, do not wait if lock is busy +-1: --wait specified without value, wait indefinitely until lock becomes + free +>0: Wait for 'wait' seconds for lock to become free, abort otherwise + +Since fixed commit, the first two cases were treated the same apart from +calling alarm(0), but that is a nop if no alarm is pending. Fix the code +by requesting a non-blocking flock() in the second case. While at it, +restrict the alarm setup to the third case only. + +Cc: Jethro Beekman +Cc: howardjohn@google.com +Cc: Antonio Ojea +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 +Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") +Signed-off-by: Phil Sutter +(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) +--- + .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ + iptables/xshared.c | 4 +- + 2 files changed, 57 insertions(+), 2 deletions(-) + create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 + +diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 +new file mode 100755 +index 0000000000000..4481f966ce435 +--- /dev/null ++++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 +@@ -0,0 +1,55 @@ ++#!/bin/bash ++ ++case "$XT_MULTI" in ++*xtables-legacy-multi) ++ ;; ++*) ++ echo skip $XT_MULTI ++ exit 0 ++ ;; ++esac ++ ++coproc RESTORE { $XT_MULTI iptables-restore; } ++echo "*filter" >&${RESTORE[1]} ++ ++ ++$XT_MULTI iptables -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 1 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "process waits when it should not" ++ exit 1 ++} ++wait $ipt_pid ++[[ $? -eq 0 ]] && { ++ echo "process exited 0 despite busy lock" ++ exit 1 ++} ++ ++t0=$(date +%s) ++$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT ++t1=$(date +%s) ++[[ $((t1 - t0)) -ge 3 ]] || { ++ echo "wait time not expired" ++ exit 1 ++} ++ ++$XT_MULTI iptables -w -A FORWARD -j ACCEPT & ++ipt_pid=$! ++ ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] || { ++ echo "no indefinite wait" ++ exit 1 ++} ++kill $ipt_pid ++waitpid -t 3 $ipt_pid ++[[ $? -eq 3 ]] && { ++ echo "killed waiting iptables call did not exit in time" ++ exit 1 ++} ++ ++kill $RESTORE_PID ++wait ++exit 0 +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 5f75a0a57a023..690502c457dd0 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -270,7 +270,7 @@ static int xtables_lock(int wait) + return XT_LOCK_FAILED; + } + +- if (wait != -1) { ++ if (wait > 0) { + sigact_alarm.sa_handler = alarm_ignore; + sigact_alarm.sa_flags = SA_RESETHAND; + sigemptyset(&sigact_alarm.sa_mask); +@@ -278,7 +278,7 @@ static int xtables_lock(int wait) + alarm(wait); + } + +- if (flock(fd, LOCK_EX) == 0) ++ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) + return fd; + + if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch new file mode 100644 index 0000000..ea88fa3 --- /dev/null +++ b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch @@ -0,0 +1,40 @@ +From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Sun, 17 Dec 2023 13:02:36 +0100 +Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK + +Do as the comment in xtopt_parse_hostmask() claims and omit +XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() +will catch the incompatibility. + +Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") +(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) +--- + include/xtables.h | 1 - + libxtables/xtoptions.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/include/xtables.h b/include/xtables.h +index 087a1d600f9ae..9def9b43b6e58 100644 +--- a/include/xtables.h ++++ b/include/xtables.h +@@ -61,7 +61,6 @@ struct in_addr; + * %XTTYPE_SYSLOGLEVEL: syslog level by name or number + * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) + * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length +- * (ptr: union nf_inet_addr; only host portion is stored) + * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) + * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) + * %XTTYPE_PORTRC: colon-separated port range (names acceptable), +diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c +index d91a78f470eda..ba68056dc99f7 100644 +--- a/libxtables/xtoptions.c ++++ b/libxtables/xtoptions.c +@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { + [XTTYPE_STRING] = -1, + [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), + [XTTYPE_HOST] = sizeof(union nf_inet_addr), +- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), + [XTTYPE_PROTOCOL] = sizeof(uint8_t), + [XTTYPE_PORT] = sizeof(uint16_t), + [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/iptables.spec b/iptables.spec index cc4091e..fcc549e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 4%{?dist} +Release: 5%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -20,6 +20,17 @@ Source4: sysconfig_iptables Source5: sysconfig_ip6tables Source6: arptables-nft-helper +Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch +Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch +Patch007: 0007-man-Do-not-escape-exclamation-marks.patch +Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -415,6 +426,10 @@ fi %changelog +* Thu Jan 11 2024 Phil Sutter - 1.8.10-5 +- Backport fixes from upstream +- Fix flatpak build + * Tue Nov 07 2023 Phil Sutter - 1.8.10-4 - The actual obsoletes fix From 62720fedc38312a84687cf1632042f22dcf99b32 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:15:08 +0000 Subject: [PATCH 12/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fcc549e..dd8c7cc 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 5%{?dist} +Release: 6%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 11 2024 Phil Sutter - 1.8.10-5 - Backport fixes from upstream - Fix flatpak build From 4f6c4554627cf2633bc8944cb1240ab0c8074515 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 22:54:06 +0000 Subject: [PATCH 13/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index dd8c7cc..7c995da 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 6%{?dist} +Release: 7%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -426,6 +426,9 @@ fi %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 1.8.10-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d55ae5d9f184b1b93fd57c73e8cb9f12bdcfd792 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 21 May 2024 15:07:37 +0200 Subject: [PATCH 14/43] iptables-1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables Resolves: rhbz#2281595 --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 7c995da..83b972c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 7%{?dist} +Release: 8%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -358,6 +358,7 @@ fi %{_bindir}/iptables-xml %{_mandir}/man1/iptables-xml* %{_mandir}/man8/xtables-legacy* +%dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} @@ -426,6 +427,9 @@ fi %changelog +* Tue May 21 2024 Phil Sutter - 1.8.10-8 +- Make iptables-legacy own %%{_datadir}/xtables + * Wed Jan 24 2024 Fedora Release Engineering - 1.8.10-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From de779a4b439abe447aedc2c32e4e61f1e115ace7 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 3 Jul 2024 12:57:08 +0200 Subject: [PATCH 15/43] iptables-1.8.10-9 - Backport fixes from upstream --- ...se-Add-missing-braces-around-ternary.patch | 36 +++ ...xtables-Fix-memleak-of-matches-udata.patch | 32 ++ ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ++++++++++++ ...frag-Save-xlate-inverted-full-ranges.patch | 117 +++++++ ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 +++++++ ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 ++++++++ ...-esp-Save-xlate-inverted-full-ranges.patch | 119 +++++++ ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 +++ ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ++++ ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ++++++++++++++++++ ...t-Fix-for-broken-recover_rule_compat.patch | 89 +++++ ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 +++ ...sing-of-empty-string-arg-in-c-option.patch | 48 +++ iptables.spec | 20 +- 14 files changed, 1370 insertions(+), 2 deletions(-) create mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch create mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch create mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch create mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch create mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch create mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch create mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch create mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch create mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch create mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch create mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch create mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch create mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch new file mode 100644 index 0000000..f348d59 --- /dev/null +++ b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch @@ -0,0 +1,36 @@ +From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 26 Jan 2024 18:43:10 +0100 +Subject: [PATCH] nft: ruleparse: Add missing braces around ternary + +The expression evaluated the sum before the ternay, consequently not +adding target->size if tgsize was zero. + +Identified by ASAN for a simple rule using standard target: +| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN +| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN +| ================================================================= +| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 +| READ of size 8 at 0x603000000120 thread T0 +| [...] + +Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") +Signed-off-by: Phil Sutter +(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) +--- + iptables/nft-ruleparse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c +index c8322f936acd9..57fe27276de35 100644 +--- a/iptables/nft-ruleparse.c ++++ b/iptables/nft-ruleparse.c +@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) + if (!target) + return NULL; + +- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; ++ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); + + target->t = xtables_calloc(1, size); + target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch new file mode 100644 index 0000000..7d9c51f --- /dev/null +++ b/0012-libxtables-Fix-memleak-of-matches-udata.patch @@ -0,0 +1,32 @@ +From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 31 Jan 2024 14:58:17 +0100 +Subject: [PATCH] libxtables: Fix memleak of matches' udata + +If the extension specifies a non-zero udata_size, field 'udata' points +to an allocated buffer which needs to be freed upon extension deinit. + +Interestingly, this bug was identified by ASAN and missed by valgrind. + +Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") +Signed-off-by: Phil Sutter +(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) +--- + libxtables/xtables.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libxtables/xtables.c b/libxtables/xtables.c +index ba9ceaeb3da41..0f617d80ae37e 100644 +--- a/libxtables/xtables.c ++++ b/libxtables/xtables.c +@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) + free(matchp->match->m); + matchp->match->m = NULL; + } ++ if (matchp->match->udata_size) { ++ free(matchp->match->udata); ++ matchp->match->udata = NULL; ++ } + if (matchp->match == matchp->match->next) { + free(matchp->match); + matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..e9c3cb0 --- /dev/null +++ b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,200 @@ +From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:27:03 +0100 +Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges + +While at it, fix xlate output for plain '-m ah' matches: With +ip6tables-translate, one should emit an extdhr exists match since +ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, +a simple 'meta l4proto ah' was missing. + +Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") +Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) + +Conflicts: + extensions/libip6t_ah.t + extensions/libip6t_ah.txlate + extensions/libipt_ah.t + extensions/libipt_ah.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_ah.c | 22 +++++++++++++--------- + extensions/libip6t_ah.t | 1 + + extensions/libip6t_ah.txlate | 6 ++++++ + extensions/libipt_ah.c | 22 ++++++++++++++-------- + extensions/libipt_ah.t | 1 + + extensions/libipt_ah.txlate | 6 ++++++ + 6 files changed, 41 insertions(+), 17 deletions(-) + +diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c +index f35982f379d76..0f95c4735eabd 100644 +--- a/extensions/libip6t_ah.c ++++ b/extensions/libip6t_ah.c +@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) + } + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + if (min == max) + printf("%s:%s%u", name, inv, min); + else +@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; + char *space = ""; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); +@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, + } + + if (!space[0]) /* plain '-m ah' */ +- xt_xlate_add(xl, "meta l4proto ah"); ++ xt_xlate_add(xl, "exthdr ah exists"); + + return 1; + } +diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t +index c1898d44cf193..9099bdc9259c3 100644 +--- a/extensions/libip6t_ah.t ++++ b/extensions/libip6t_ah.t +@@ -13,3 +13,4 @@ + -m ah --ahspi 0:invalid;;FAIL + -m ah --ahspi;;FAIL + -m ah;=;OK ++-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate +index cc33ac2718c0c..32c6b7de00937 100644 +--- a/extensions/libip6t_ah.txlate ++++ b/extensions/libip6t_ah.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' + + ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT + nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' ++ ++ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr ah exists counter' ++ ++ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 ++nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' +diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c +index fec5705ce6f53..39e3013d3e74b 100644 +--- a/extensions/libipt_ah.c ++++ b/extensions/libipt_ah.c +@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) + ahinfo->invflags |= IPT_AH_INV_SPI; + } + ++static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spi_match(min, max, invert)) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); +@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, + static void ah_save(const void *ip, const struct xt_entry_match *match) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 +- && ahinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ahspi ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ printf("%s --ahspi ", inv_spi ? " !" : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u", +@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; ++ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; + +- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "ah spi%s ", +- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); ++ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); + if (ahinfo->spis[0] != ahinfo->spis[1]) + xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], + ahinfo->spis[1]); + else + xt_xlate_add(xl, "%u", ahinfo->spis[0]); ++ } else { ++ xt_xlate_add(xl, "meta l4proto ah"); + } + + return 1; +diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t +index cd853865638e8..1aeb607e9e986 100644 +--- a/extensions/libipt_ah.t ++++ b/extensions/libipt_ah.t +@@ -11,3 +11,4 @@ + -m ah --ahspi;;FAIL + -m ah;;FAIL + -p ah -m ah;=;OK ++-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK +diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate +index 897c82b5f95c6..baf5a0ae6182a 100644 +--- a/extensions/libipt_ah.txlate ++++ b/extensions/libipt_ah.txlate +@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' + + iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP + nft 'add rule ip filter INPUT ah spi != 50 counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto ah counter drop' ++ ++iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..902ade1 --- /dev/null +++ b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,117 @@ +From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:39:52 +0100 +Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges + +Also translate plain '-m frag' match into an exthdr exists one. + +Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) + +Conflicts: + extensions/libip6t_frag.t + extensions/libip6t_frag.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- + extensions/libip6t_frag.t | 1 + + extensions/libip6t_frag.txlate | 6 ++++++ + 3 files changed, 25 insertions(+), 9 deletions(-) + +diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c +index 49c787e709a9e..ed7fe10a4716d 100644 +--- a/extensions/libip6t_frag.c ++++ b/extensions/libip6t_frag.c +@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) + } + } + ++static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_ids(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_ids_match(min, max, invert)) { + printf("%s", name); + if (min == max) + printf(":%s%u", inv, min); +@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, + static void frag_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 +- && fraginfo->ids[1] == 0xFFFFFFFF)) { +- printf("%s --fragid ", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ printf("%s --fragid ", inv_ids ? " !" : ""); + if (fraginfo->ids[0] + != fraginfo->ids[1]) + printf("%u:%u", +@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) + printf(" --fraglast"); + } + ++#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ ++ IP6T_FRAG_MF | IP6T_FRAG_NMF) ++ + static int frag_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_frag *fraginfo = + (struct ip6t_frag *)params->match->data; ++ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; + +- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "frag id %s", +- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? +- "!= " : ""); ++ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { ++ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); + if (fraginfo->ids[0] != fraginfo->ids[1]) + xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], + fraginfo->ids[1]); + else + xt_xlate_add(xl, "%u", fraginfo->ids[0]); + ++ } else if (!(fraginfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr frag exists"); ++ return 1; + } + + /* ignore ineffective IP6T_FRAG_LEN bit */ +diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t +index 299fa03f8845b..58417c90e9217 100644 +--- a/extensions/libip6t_frag.t ++++ b/extensions/libip6t_frag.t +@@ -1,4 +1,5 @@ + :INPUT,FORWARD,OUTPUT ++-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK + -m frag --fragid 1:42;=;OK + -m frag --fraglen 42;=;OK + -m frag --fragres;=;OK +diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate +index 33fc0631dc792..e250587e7682c 100644 +--- a/extensions/libip6t_frag.txlate ++++ b/extensions/libip6t_frag.txlate +@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' + + ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT + nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' ++ ++ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT exthdr frag exists counter' ++ ++ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 ++nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..1afcc54 --- /dev/null +++ b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,111 @@ +From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:42:10 +0100 +Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges + +Also translate '-m mh' into an exthdr exists match unless '-p mh' is +also present. The latter is converted into 'meta l4proto mh' which might +need fixing itself at a later point. + +Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) + +Conflicts: + extensions/libip6t_mh.t + extensions/libip6t_mh.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_mh.c | 20 ++++++++++++++++---- + extensions/libip6t_mh.t | 1 + + extensions/libip6t_mh.txlate | 9 +++++++++ + 3 files changed, 26 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 1410d324b5d42..3f80e28ec94c8 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + enum { + O_MH_TYPE = 0, +@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) + printf("%s", name); + } + ++static bool skip_types_match(uint8_t min, uint8_t max, bool inv) ++{ ++ return min == 0 && max == UINT8_MAX && !inv; ++} ++ + static void print_types(uint8_t min, uint8_t max, int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFF || invert) { ++ if (!skip_types_match(min, max, invert)) { + printf(" "); + if (min == max) { + printf("%s", inv); +@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, + static void mh_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) + return; + +- if (mhinfo->invflags & IP6T_MH_INV_TYPE) ++ if (inv_type) + printf(" !"); + + if (mhinfo->types[0] != mhinfo->types[1]) +@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; ++ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; ++ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + +- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) ++ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { ++ if (proto != IPPROTO_MH) ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; ++ } + + if (mhinfo->types[0] != mhinfo->types[1]) + xt_xlate_add(xl, "mh type %s%u-%u", +diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t +index 6b76d13d0a00f..be5439edc9520 100644 +--- a/extensions/libip6t_mh.t ++++ b/extensions/libip6t_mh.t +@@ -4,3 +4,4 @@ + -p mobility-header -m mh --mh-type 1;=;OK + -p mobility-header -m mh ! --mh-type 4;=;OK + -p mobility-header -m mh --mh-type 4:123;=;OK ++-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 4dfaf46a2b8d7..3364ce574468f 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac + + ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' ++ ++ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++ ++ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' ++ ++ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT ++nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..c9ec110 --- /dev/null +++ b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,131 @@ +From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:45:42 +0100 +Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges + +Also translate plain '-m rt' match into an exthdr exists one. + +Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) + +Conflicts: + extensions/libip6t_rt.t + extensions/libip6t_rt.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- + extensions/libip6t_rt.t | 1 + + extensions/libip6t_rt.txlate | 9 +++++++++ + 3 files changed, 30 insertions(+), 8 deletions(-) + +diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c +index d5b0458bb397e..6db09f0b2cdc8 100644 +--- a/extensions/libip6t_rt.c ++++ b/extensions/libip6t_rt.c +@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) + } + } + ++static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_nums(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_segsleft_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, + static void rt_save(const void *ip, const struct xt_entry_match *match) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + printf("%s --rt-type %u", +@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 +- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- printf("%s --rt-segsleft ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); + if (rtinfo->segsleft[0] + != rtinfo->segsleft[1]) + printf("%u:%u", +@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) + + } + ++#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ ++ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) ++ + static int rt_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; ++ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; + + if (rtinfo->flags & IP6T_RT_TYP) { + xt_xlate_add(xl, "rt type%s %u", +@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, + rtinfo->rt_type); + } + +- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "rt seg-left%s ", +- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); ++ if (!skip_segsleft_match(rtinfo->segsleft[0], ++ rtinfo->segsleft[1], inv_sgs)) { ++ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); + + if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) + xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], + rtinfo->segsleft[1]); + else + xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); ++ } else if (!(rtinfo->flags & XLATE_FLAGS)) { ++ xt_xlate_add(xl, "exthdr rt exists"); ++ return 1; + } + + if (rtinfo->flags & IP6T_RT_LEN) { +diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t +index 3c7b2d981324a..047b6880e354d 100644 +--- a/extensions/libip6t_rt.t ++++ b/extensions/libip6t_rt.t +@@ -3,3 +3,4 @@ + -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK + -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK + -m rt;=;OK ++-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK +diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate +index 3578bcba0157e..1c2f74a588750 100644 +--- a/extensions/libip6t_rt.txlate ++++ b/extensions/libip6t_rt.txlate +@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' + + ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT + nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' ++ ++ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' ++ ++ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT ++nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..318d9eb --- /dev/null +++ b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,119 @@ +From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:47:09 +0100 +Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges + +Also add a translation for plain '-m esp' match which depends on the +address family: While ip6tables-translate may emit an exthdr exists +match, iptables-translate must stick to meta l4proto. + +Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) + +Conflicts: + extensions/libxt_esp.t + extensions/libxt_esp.txlate +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_esp.c | 26 ++++++++++++++++++-------- + extensions/libxt_esp.t | 1 + + extensions/libxt_esp.txlate | 12 ++++++++++++ + 3 files changed, 31 insertions(+), 8 deletions(-) + +diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c +index 2c7ff942cb9e0..8e9766d71ed57 100644 +--- a/extensions/libxt_esp.c ++++ b/extensions/libxt_esp.c +@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) + espinfo->invflags |= XT_ESP_INV_SPI; + } + ++static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) ++{ ++ return min == 0 && max == UINT32_MAX && !inv; ++} ++ + static void + print_spis(const char *name, uint32_t min, uint32_t max, + int invert) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFFFFFF || invert) { ++ if (!skip_spis_match(min, max, invert)) { + if (min == max) + printf(" %s:%s%u", name, inv, min); + else +@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void esp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_esp *espinfo = (struct xt_esp *)match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 +- && espinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --espspi ", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ printf("%s --espspi ", inv_spi ? " !" : ""); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("%u:%u", +@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; ++ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; + +- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { +- xt_xlate_add(xl, "esp spi%s", +- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); ++ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { ++ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); + if (espinfo->spis[0] != espinfo->spis[1]) + xt_xlate_add(xl, " %u-%u", espinfo->spis[0], + espinfo->spis[1]); + else + xt_xlate_add(xl, " %u", espinfo->spis[0]); ++ } else if (afinfo->family == NFPROTO_IPV4) { ++ xt_xlate_add(xl, "meta l4proto esp"); ++ } else if (afinfo->family == NFPROTO_IPV6) { ++ xt_xlate_add(xl, "exthdr esp exists"); ++ } else { ++ return 0; + } + + return 1; +diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t +index 92c5779f860f1..37259d6b3a08f 100644 +--- a/extensions/libxt_esp.t ++++ b/extensions/libxt_esp.t +@@ -4,5 +4,6 @@ + -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK + -p esp -m esp ! --espspi 0:4294967294;=;OK + -p esp -m esp --espspi -1;;FAIL ++-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK + -p esp -m esp;=;OK + -m esp;;FAIL +diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate +index f6aba52f52235..5e8fb241beaf4 100644 +--- a/extensions/libxt_esp.txlate ++++ b/extensions/libxt_esp.txlate +@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' + + iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP + nft 'add rule ip filter INPUT esp spi 500-600 counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT meta l4proto esp counter drop' ++ ++iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' ++ ++ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP ++nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch new file mode 100644 index 0000000..316e5dd --- /dev/null +++ b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch @@ -0,0 +1,47 @@ +From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 15:57:46 +0100 +Subject: [PATCH] extensions: ipcomp: Save inverted full ranges + +Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") +Signed-off-by: Phil Sutter +(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) + +Conflicts: + extensions/libxt_ipcomp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_ipcomp.c | 7 ++++--- + extensions/libxt_ipcomp.t | 1 + + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c +index 4171c4a1c4eb7..961c17e584933 100644 +--- a/extensions/libxt_ipcomp.c ++++ b/extensions/libxt_ipcomp.c +@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, + static void comp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; ++ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; + + if (!(compinfo->spis[0] == 0 +- && compinfo->spis[1] == 0xFFFFFFFF)) { +- printf("%s --ipcompspi ", +- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); ++ && compinfo->spis[1] == UINT32_MAX ++ && !inv_spi)) { ++ printf("%s --ipcompspi ", inv_spi ? " !" : ""); + if (compinfo->spis[0] + != compinfo->spis[1]) + printf("%u:%u", +diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t +index 8546ba9ce416f..47c1fbc220c6a 100644 +--- a/extensions/libxt_ipcomp.t ++++ b/extensions/libxt_ipcomp.t +@@ -1,3 +1,4 @@ + :INPUT,OUTPUT + -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK + -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK ++-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch new file mode 100644 index 0000000..cfeacd5 --- /dev/null +++ b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch @@ -0,0 +1,70 @@ +From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 2 Feb 2024 13:14:29 +0100 +Subject: [PATCH] nft: Do not omit full ranges if inverted + +Otherwise this turns a never matching rule into an always matching one. + +Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") +Signed-off-by: Phil Sutter +(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_udp.t +- Missing commits adding test cases, add relevant ones manually instead + of adjusting the wrong ones as the original commit does. +--- + extensions/libxt_tcp.t | 2 ++ + extensions/libxt_udp.t | 2 ++ + iptables/nft.c | 4 ++-- + 3 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 7a3bbd08952f0..3caa3e3f50271 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,6 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index f534770191a6e..aa2c91770e63f 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,6 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ++-p udp -m udp ! --sport :;-p udp -m udp;OK ++-p udp -m udp ! --dport :;-p udp -m udp;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/iptables/nft.c b/iptables/nft.c +index 97fd4f49fdb4c..8e7a38ac93a3e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return 0; + } + +- if (src[0] || src[1] < 0xffff) { ++ if (src[0] || src[1] < UINT16_MAX || invert_src) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); + if (!expr) + return -ENOMEM; +@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, + return ret; + } + +- if (dst[0] || dst[1] < 0xffff) { ++ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { + expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); + if (!expr) + return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch new file mode 100644 index 0000000..326544f --- /dev/null +++ b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch @@ -0,0 +1,304 @@ +From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 1 Feb 2024 17:42:12 +0100 +Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges + +Also translate a bare '-m tcp/udp' to 'meta l4proto' match. + +Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") +Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") +Signed-off-by: Phil Sutter +(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) + +Conflicts: + extensions/libxt_tcp.t + extensions/libxt_tcp.txlate + extensions/libxt_udp.t + extensions/libxt_udp.txlate +- Context change due to Missing commits adding test cases. +--- + extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- + extensions/libxt_tcp.t | 4 ++-- + extensions/libxt_tcp.txlate | 6 +++++ + extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- + extensions/libxt_udp.t | 4 ++-- + extensions/libxt_udp.txlate | 6 +++++ + 6 files changed, 72 insertions(+), 39 deletions(-) + +diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c +index f82572828649b..32bbd684fd5d7 100644 +--- a/extensions/libxt_tcp.c ++++ b/extensions/libxt_tcp.c +@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void tcp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; + +- if (tcpinfo->spts[0] != 0 +- || tcpinfo->spts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (tcpinfo->spts[0] + != tcpinfo->spts[1]) +@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) + tcpinfo->spts[0]); + } + +- if (tcpinfo->dpts[0] != 0 +- || tcpinfo->dpts[1] != 0xFFFF) { +- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (tcpinfo->dpts[0] + != tcpinfo->dpts[1]) +@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, + { + const struct xt_tcp *tcpinfo = + (const struct xt_tcp *)params->match->data; ++ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; ++ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; ++ bool xlated = false; + +- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { + if (tcpinfo->spts[0] != tcpinfo->spts[1]) { + xt_xlate_add(xl, "tcp sport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0], tcpinfo->spts[1]); + } else { + xt_xlate_add(xl, "tcp sport %s%u", +- tcpinfo->invflags & XT_TCP_INV_SRCPT ? +- "!= " : "", ++ inv_srcpt ? "!= " : "", + tcpinfo->spts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { ++ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { + if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { + xt_xlate_add(xl, "tcp dport %s%u-%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0], tcpinfo->dpts[1]); + } else { + xt_xlate_add(xl, "tcp dport %s%u", +- tcpinfo->invflags & XT_TCP_INV_DSTPT ? +- "!= " : "", ++ inv_dstpt ? "!= " : "", + tcpinfo->dpts[0]); + } ++ xlated = true; + } + +- if (tcpinfo->option) ++ if (tcpinfo->option) { + xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, + tcpinfo->invflags & XT_TCP_INV_OPTION ? + "missing" : "exists"); ++ xlated = true; ++ } + + if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { + xt_xlate_add(xl, "tcp flags %s", +@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, + print_tcp_xlate(xl, tcpinfo->flg_cmp); + xt_xlate_add(xl, " / "); + print_tcp_xlate(xl, tcpinfo->flg_mask); ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto tcp"); ++ + return 1; + } + +diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t +index 3caa3e3f50271..8baeeff2fc94b 100644 +--- a/extensions/libxt_tcp.t ++++ b/extensions/libxt_tcp.t +@@ -6,8 +6,8 @@ + -p tcp -m tcp --sport 1:1023;=;OK + -p tcp -m tcp --sport 1024:65535;=;OK + -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK +--p tcp -m tcp ! --sport :;-p tcp -m tcp;OK +--p tcp -m tcp ! --dport :;-p tcp -m tcp;OK ++-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK ++-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK + -p tcp -m tcp ! --sport 1;=;OK + -p tcp -m tcp ! --sport 65535;=;OK + -p tcp -m tcp ! --dport 1;=;OK +diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate +index 9802ddfe0039e..b3ddcc15833cf 100644 +--- a/extensions/libxt_tcp.txlate ++++ b/extensions/libxt_tcp.txlate +@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' + + iptables-translate -A INPUT -p tcp ! --tcp-option 23 + nft 'add rule ip filter INPUT tcp option 23 missing counter' ++ ++iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' ++ ++iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' +diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c +index ba1c3eb768592..748d418039c3a 100644 +--- a/extensions/libxt_udp.c ++++ b/extensions/libxt_udp.c +@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) + printf("%s", service); + } + ++static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) ++{ ++ return min == 0 && max == UINT16_MAX && !inv; ++} ++ + static void + print_ports(const char *name, uint16_t min, uint16_t max, + int invert, int numeric) + { + const char *inv = invert ? "!" : ""; + +- if (min != 0 || max != 0xFFFF || invert) { ++ if (!skip_ports_match(min, max, invert)) { + printf(" %s", name); + if (min == max) { + printf(":%s", inv); +@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) + static void udp_save(const void *ip, const struct xt_entry_match *match) + { + const struct xt_udp *udpinfo = (struct xt_udp *)match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; + +- if (udpinfo->spts[0] != 0 +- || udpinfo->spts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_SRCPT) ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { ++ if (inv_srcpt) + printf(" !"); + if (udpinfo->spts[0] + != udpinfo->spts[1]) +@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) + udpinfo->spts[0]); + } + +- if (udpinfo->dpts[0] != 0 +- || udpinfo->dpts[1] != 0xFFFF) { +- if (udpinfo->invflags & XT_UDP_INV_DSTPT) ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { ++ if (inv_dstpt) + printf(" !"); + if (udpinfo->dpts[0] + != udpinfo->dpts[1]) +@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) + { + const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; ++ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; ++ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; ++ bool xlated = false; + +- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { + if (udpinfo->spts[0] != udpinfo->spts[1]) { + xt_xlate_add(xl,"udp sport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0], udpinfo->spts[1]); + } else { + xt_xlate_add(xl, "udp sport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_srcpt ? "!= ": "", + udpinfo->spts[0]); + } ++ xlated = true; + } + +- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { ++ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { + if (udpinfo->dpts[0] != udpinfo->dpts[1]) { + xt_xlate_add(xl,"udp dport %s%u-%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0], udpinfo->dpts[1]); + } else { + xt_xlate_add(xl,"udp dport %s%u", +- udpinfo->invflags & XT_UDP_INV_SRCPT ? +- "!= ": "", ++ inv_dstpt ? "!= ": "", + udpinfo->dpts[0]); + } ++ xlated = true; + } + ++ if (!xlated) ++ xt_xlate_add(xl, "meta l4proto udp"); ++ + return 1; + } + +diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t +index aa2c91770e63f..0cde6ac30cc15 100644 +--- a/extensions/libxt_udp.t ++++ b/extensions/libxt_udp.t +@@ -6,8 +6,8 @@ + -p udp -m udp --sport 1:1023;=;OK + -p udp -m udp --sport 1024:65535;=;OK + -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK +--p udp -m udp ! --sport :;-p udp -m udp;OK +--p udp -m udp ! --dport :;-p udp -m udp;OK ++-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK ++-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK + -p udp -m udp ! --sport 1;=;OK + -p udp -m udp ! --sport 65535;=;OK + -p udp -m udp ! --dport 1;=;OK +diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate +index 28e7ca206b26b..d6bbb96f5d744 100644 +--- a/extensions/libxt_udp.txlate ++++ b/extensions/libxt_udp.txlate +@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep + + iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT + nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' ++ ++iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' ++ ++iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT ++nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch new file mode 100644 index 0000000..46c636c --- /dev/null +++ b/0021-nft-Fix-for-broken-recover_rule_compat.patch @@ -0,0 +1,89 @@ +From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 27 Feb 2024 18:47:39 +0100 +Subject: [PATCH] nft: Fix for broken recover_rule_compat() + +When IPv4 rule generator was changed to emit payload instead of +meta expressions for l4proto matches, the code reinserting +NFTNL_RULE_COMPAT_* attributes into rules being reused for counter +zeroing was broken by accident. + +Make rule compat recovery aware of the alternative match, basically +reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules +with NFTA_RULE_COMPAT") but add a test case this time to make sure +things stay intact. + +Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") +Signed-off-by: Phil Sutter +(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) +--- + iptables/nft.c | 27 ++++++++++++++++--- + .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ + 2 files changed, 35 insertions(+), 4 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 + +diff --git a/iptables/nft.c b/iptables/nft.c +index 8e7a38ac93a3e..42907a431a99e 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) + return strerror(err); + } + ++static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) ++{ ++ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); ++ uint32_t poff = offsetof(struct iphdr, protocol); ++ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; ++ ++ if (!strcmp(name, "payload") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); ++ return 0; ++ } ++ if (!strcmp(name, "meta") && ++ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { ++ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); ++ return 0; ++ } ++ return -1; ++} ++ + static int recover_rule_compat(struct nftnl_rule *r) + { + struct nftnl_expr_iter *iter; +@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) + if (!e) + goto out; + +- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || +- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) ++ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ ++ if (l4proto_expr_get_dreg(e, ®) < 0) + goto next_expr; + +- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); +- + e = nftnl_expr_iter_next(iter); + if (!e) + goto out; +diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +new file mode 100755 +index 0000000000000..e276a953234cf +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 +@@ -0,0 +1,12 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++set -e ++ ++rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" ++for cmd in iptables ip6tables; do ++ $XT_MULTI $cmd -t mangle -A PREROUTING $rule ++ $XT_MULTI $cmd -t mangle -Z ++ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" ++done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch new file mode 100644 index 0000000..0be13ca --- /dev/null +++ b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch @@ -0,0 +1,48 @@ +From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 5 Mar 2024 17:02:56 +0100 +Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match + +Since core xlate code now ignores '-p mh' if an mh extension is also +present in the rule, mh extension has to emit the l4proto match itself. +Therefore emit the exthdr match irrespective of '-p' argument value just +like other IPv6 extension header matches do. + +Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") +Signed-off-by: Phil Sutter +(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) +--- + extensions/libip6t_mh.c | 4 +--- + extensions/libip6t_mh.txlate | 2 +- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c +index 3f80e28ec94c8..1a1cee832b584 100644 +--- a/extensions/libip6t_mh.c ++++ b/extensions/libip6t_mh.c +@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, + { + const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; + bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; +- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; + + if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { +- if (proto != IPPROTO_MH) +- xt_xlate_add(xl, "exthdr mh exists"); ++ xt_xlate_add(xl, "exthdr mh exists"); + return 1; + } + +diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate +index 3364ce574468f..7eeaeefab6116 100644 +--- a/extensions/libip6t_mh.txlate ++++ b/extensions/libip6t_mh.txlate +@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT + nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' + + ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT +-nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' ++nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' + + ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT + nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch new file mode 100644 index 0000000..a5e7994 --- /dev/null +++ b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch @@ -0,0 +1,48 @@ +From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 9 Apr 2024 13:18:12 +0200 +Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option + +Calling iptables with '-c ""' resulted in a call to strchr() with an +invalid pointer as 'optarg + 1' points to past the buffer. The most +simple fix is to drop the offset: The global optstring part specifies a +single colon after 'c', so getopt() enforces a valid pointer in optarg. +If it contains a comma at first position, packet counter value parsing +will fail so all cases are covered. + +Reported-by: gorbanev.es@gmail.com +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 +Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") +Signed-off-by: Phil Sutter +(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) +--- + extensions/iptables.t | 5 +++++ + iptables/xshared.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extensions/iptables.t b/extensions/iptables.t +index b4b6d677abab1..5d6d3d15cc5fd 100644 +--- a/extensions/iptables.t ++++ b/extensions/iptables.t +@@ -4,3 +4,8 @@ + -i eth+ -o alongifacename+;=;OK + ! -i eth0;=;OK + ! -o eth+;=;OK ++-c "";;FAIL ++-c ,3;;FAIL ++-c 3,;;FAIL ++-c ,;;FAIL ++-c 2,3 -j ACCEPT;-j ACCEPT;OK +diff --git a/iptables/xshared.c b/iptables/xshared.c +index 690502c457dd0..f2e3bc03a2824 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], + set_option(&cs->options, OPT_COUNTERS, &args->invflags, + invert); + args->pcnt = optarg; +- args->bcnt = strchr(args->pcnt + 1, ','); ++ args->bcnt = strchr(args->pcnt, ','); + if (args->bcnt) + args->bcnt++; + if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/iptables.spec b/iptables.spec index 83b972c..bc0675d 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 8%{?dist} +Release: 9%{?dist} Source: %{url}/files/%{name}-%{version}.tar.xz Source1: iptables.init Source2: iptables-config @@ -30,6 +30,19 @@ Patch007: 0007-man-Do-not-escape-exclamation-marks.patch Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch +Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch +Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch +Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch +Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -37,7 +50,7 @@ License: GPL-2.0-only AND Artistic-2.0 AND ISC # libnetfilter_conntrack is needed for xt_connlabel BuildRequires: pkgconfig(libnetfilter_conntrack) -# libnfnetlink-devel is requires for nfnl_osf +# libnfnetlink-devel is required for nfnl_osf BuildRequires: pkgconfig(libnfnetlink) BuildRequires: libselinux-devel BuildRequires: kernel-headers @@ -427,6 +440,9 @@ fi %changelog +* Wed Jul 03 2024 Phil Sutter - 1.8.10-9 +- Backport fixes from upstream + * Tue May 21 2024 Phil Sutter - 1.8.10-8 - Make iptables-legacy own %%{_datadir}/xtables From 4be8ae789abd28ae701aca4f05897a1a0f65b018 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:34:58 +0200 Subject: [PATCH 16/43] iptables-1.8.10-10 - Verify tarball GPG signature --- .gitignore | 1 + coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 +++++++++++++++++++++++++ iptables.spec | 40 +++++++++------- sources | 1 + 4 files changed, 89 insertions(+), 17 deletions(-) create mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt diff --git a/.gitignore b/.gitignore index 4cb5d7a..b61615f 100644 --- a/.gitignore +++ b/.gitignore @@ -14,3 +14,4 @@ /iptables-1.8.8.tar.bz2 /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz +/iptables-1.8.10.tar.xz.sig diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt new file mode 100644 index 0000000..2d3b902 --- /dev/null +++ b/coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded +660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi +V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 +zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t +Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh +KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 +dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi +WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg +9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj ++IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR +U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 ++ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd +RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 +4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN +IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w +bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf +Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj +QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 +wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb +4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET +tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP +n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV +oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 +o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S +ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU +tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp +HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM +FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ +diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid +R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK +uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv +Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl +UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q +KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO +RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc +wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 +0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ +q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU +k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk +pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY +plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC +qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu +iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p +jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O +ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 +CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag +8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB +bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM +jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR +rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg +3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ +7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 +7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ +yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 +leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 +U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ +rlbu70nh2kSJrg== +=wukb +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index bc0675d..9d817f5 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,14 +11,16 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 9%{?dist} -Source: %{url}/files/%{name}-%{version}.tar.xz -Source1: iptables.init -Source2: iptables-config -Source3: iptables.service -Source4: sysconfig_iptables -Source5: sysconfig_ip6tables -Source6: arptables-nft-helper +Release: 10%{?dist} +Source0: %{url}/files/%{name}-%{version}.tar.xz +source1: %{url}/files/%{name}-%{version}.tar.xz.sig +Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source3: iptables.init +Source4: iptables-config +Source5: iptables.service +Source6: sysconfig_iptables +Source7: sysconfig_ip6tables +Source8: arptables-nft-helper Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch @@ -179,6 +181,7 @@ Provides: ebtables nftables compatibility for iptables, arptables and ebtables. %prep +%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %autosetup -p1 %build @@ -201,20 +204,20 @@ rm -f %{buildroot}%{_libdir}/*.la # install init scripts and configuration files install -d -m 755 %{buildroot}%{script_path} -install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init +install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig -install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config -sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config +install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config +sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config -install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables -install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables +install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir} -sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service +install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} # install legacy actions for service command @@ -240,7 +243,7 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/ +install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ touch %{buildroot}%{_libexecdir}/arptables-helper # prepare for alternatives @@ -440,6 +443,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-10 +- Verify tarball GPG signature + * Wed Jul 03 2024 Phil Sutter - 1.8.10-9 - Backport fixes from upstream diff --git a/sources b/sources index 59e259b..6015b94 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 +SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 From f61dd7d5ce88be4c6b9442a2eedaa598e6c6065f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 5 Jul 2024 12:43:00 +0200 Subject: [PATCH 17/43] iptables-1.8.10-11 - Add missing build dependency --- iptables.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 9d817f5..906c6f4 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -69,6 +69,7 @@ BuildRequires: autoconf BuildRequires: automake BuildRequires: libtool BuildRequires: make +BuildRequires: gnupg2 %description The iptables utility controls the network packet filtering code in the @@ -443,6 +444,9 @@ fi %changelog +* Fri Jul 05 2024 Phil Sutter - 1.8.10-11 +- Add missing build dependency + * Fri Jul 05 2024 Phil Sutter - 1.8.10-10 - Verify tarball GPG signature From fdb7f30ead0154d756382d5523101154f1e7fc5c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 14 Apr 2024 14:38:45 +0200 Subject: [PATCH 18/43] Fix build with %_sbindir==%_bindir and add compat sbin Provides For https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. nsntrace requires /usr/sbin/iptables. --- iptables.spec | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 906c6f4..ee41fa8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -178,6 +178,13 @@ Provides: iptables Provides: arptables Provides: ebtables +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description nft nftables compatibility for iptables, arptables and ebtables. @@ -254,8 +261,7 @@ touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink -rm -f %{buildroot}%{_bindir}/iptables-xml -ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml %ldconfig_scriptlets @@ -444,6 +450,9 @@ fi %changelog +* Tue Jul 09 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-12 +- Rebuilt for the bin-sbin merge + * Fri Jul 05 2024 Phil Sutter - 1.8.10-11 - Add missing build dependency From d710b74abd664ed3cb4cb9d75ba59b5eea6d7404 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:46:20 +0200 Subject: [PATCH 19/43] Call alternatives without full path As part of https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin, alternatives is moved from /usr/sbin/alternatives to /usr/bin/alternatives. (This happened when alternatives rpm was rebuilt in a build environment with the updated definitions.) On traditional systems a compat symlink is created, so both paths work. This means that packages that use paths into /usr/sbin do not need to be rebuilt and will continue to work fine. Unfortunately, on ostree systems, the compat symlinks are missing, so calls to /usr/sbin/alternatives fail. There is no benefit from specifying the full path to binaries in scriptlets because the scriptlets are called with a well-defined $PATH. So drop the full path, so that the package works fine no matter where exactly alternatives is installed. --- iptables.spec | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/iptables.spec b/iptables.spec index ee41fa8..4d5876c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -268,7 +268,7 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %post legacy pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -278,7 +278,7 @@ pfx6=%{_sbindir}/ip6tables %postun legacy if [ $1 -eq 0 ]; then - /usr/sbin/update-alternatives --remove \ + update-alternatives --remove \ iptables %{_sbindir}/iptables-legacy fi @@ -294,7 +294,7 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ --slave $pfx-restore iptables-restore $pfx-legacy-restore \ @@ -320,7 +320,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ @@ -338,7 +338,7 @@ done if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then rm -f $manpfx.8.gz fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ @@ -358,7 +358,7 @@ done if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then rm -f $lepfx-helper fi -/usr/sbin/update-alternatives --install \ +update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ @@ -370,8 +370,7 @@ fi %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - /usr/sbin/update-alternatives --remove \ - $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi From 9ddeac8b47f05cbca9b732f176fb5ccf95da7f6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Jul 2024 18:50:40 +0200 Subject: [PATCH 20/43] Add changelog entry and bump release --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 4d5876c..fadaa3e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 12%{?dist} +Release: 13%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -449,6 +449,9 @@ fi %changelog +* Fri Jul 12 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-13 +- Bump release and add changelog entry + * Tue Jul 09 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-12 - Rebuilt for the bin-sbin merge From 4d531018fe7b7c7b143fe1e28ffc6baa9ac8fec7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 11:27:43 +0200 Subject: [PATCH 21/43] Add unmerged-sbin compat also for -legacy subpackage There are two subpackages which provide /usr/s?bin/iptables: -nft and -legacy. In mock, for whatever reason, iptables-legacy was being installed, from the rebuild with merged-sbin, but since there was no dependency on the updated filesystem, an old version of filesystem was left, and only /usr/bin/iptables would available. --- iptables.spec | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index fadaa3e..2737ddf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 13%{?dist} +Release: 14%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -89,6 +89,13 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 +%if "%{_sbindir}" == "%{_bindir}" +# Compat symlinks for Requires in other packages. +# We rely on filesystem to create the symlinks for us. +Requires: filesystem(unmerged-sbin-symlinks) +Provides: /usr/sbin/iptables +%endif + %description legacy The iptables utility controls the network packet filtering code in the Linux kernel. This package contains the legacy tools which are obsoleted by @@ -449,6 +456,9 @@ fi %changelog +* Sat Jul 13 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-14 +- Add unmerged-sbin compat also for -legacy subpackage + * Fri Jul 12 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-13 - Bump release and add changelog entry From d9521ce9d679ccedc2d85f0892827d96b1919e53 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 10:33:34 +0000 Subject: [PATCH 22/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 2737ddf..90ba23e 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.10 -Release: 14%{?dist} +Release: 15%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt @@ -456,6 +456,9 @@ fi %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jul 13 2024 Zbigniew JÄ™drzejewski-Szmek - 1.8.10-14 - Add unmerged-sbin compat also for -legacy subpackage From bf80e3901433c9d04166e8ebbac18529f1b360d8 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 8 Nov 2024 16:28:18 +0100 Subject: [PATCH 23/43] iptables-1.8.11-1 - new version --- .gitignore | 2 + ...another-segfault-due-to-chain-index-.patch | 81 ----- ...bles-nft-remove-ARPT_INV-flags-usage.patch | 81 ----- ...-Fix-corner-case-noflush-restore-bug.patch | 63 ---- ...-struct-xt_cmd_parse-xlate-is-unused.patch | 42 --- ...ants-support-v-update-OPTSTRING_COMM.patch | 31 -- ...n-line-number-formatting-with-legacy.patch | 28 -- ...-man-Do-not-escape-exclamation-marks.patch | 44 --- ...ions-Fix-for-non-CIDR-compatible-hos.patch | 49 --- ...egacy-Fix-for-mandatory-lock-waiting.patch | 114 ------- ...ions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch | 40 --- ...se-Add-missing-braces-around-ternary.patch | 36 --- ...xtables-Fix-memleak-of-matches-udata.patch | 32 -- ...s-ah-Save-xlate-inverted-full-ranges.patch | 200 ------------ ...frag-Save-xlate-inverted-full-ranges.patch | 117 ------- ...s-mh-Save-xlate-inverted-full-ranges.patch | 111 ------- ...s-rt-Save-xlate-inverted-full-ranges.patch | 131 -------- ...-esp-Save-xlate-inverted-full-ranges.patch | 119 ------- ...ons-ipcomp-Save-inverted-full-ranges.patch | 47 --- ...-Do-not-omit-full-ranges-if-inverted.patch | 70 ---- ...-udp-Save-xlate-inverted-full-ranges.patch | 304 ------------------ ...t-Fix-for-broken-recover_rule_compat.patch | 89 ----- ...mh-Fix-and-simplify-plain-m-mh-match.patch | 48 --- ...sing-of-empty-string-arg-in-c-option.patch | 48 --- coreteam-gpg-key-0xD55D978A8A1420E4.txt | 64 ---- coreteam-gpg-key-0xD70D1A666ACF2B21.txt | 64 ++++ iptables.spec | 35 +- sources | 4 +- 28 files changed, 76 insertions(+), 2018 deletions(-) delete mode 100644 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch delete mode 100644 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch delete mode 100644 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch delete mode 100644 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch delete mode 100644 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch delete mode 100644 0006-ebtables-Align-line-number-formatting-with-legacy.patch delete mode 100644 0007-man-Do-not-escape-exclamation-marks.patch delete mode 100644 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch delete mode 100644 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch delete mode 100644 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch delete mode 100644 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch delete mode 100644 0012-libxtables-Fix-memleak-of-matches-udata.patch delete mode 100644 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch delete mode 100644 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch delete mode 100644 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch delete mode 100644 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch delete mode 100644 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0018-extensions-ipcomp-Save-inverted-full-ranges.patch delete mode 100644 0019-nft-Do-not-omit-full-ranges-if-inverted.patch delete mode 100644 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch delete mode 100644 0021-nft-Fix-for-broken-recover_rule_compat.patch delete mode 100644 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch delete mode 100644 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch delete mode 100644 coreteam-gpg-key-0xD55D978A8A1420E4.txt create mode 100644 coreteam-gpg-key-0xD70D1A666ACF2B21.txt diff --git a/.gitignore b/.gitignore index b61615f..3814395 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,5 @@ /iptables-1.8.9.tar.xz /iptables-1.8.10.tar.xz /iptables-1.8.10.tar.xz.sig +/iptables-1.8.11.tar.xz +/iptables-1.8.11.tar.xz.sig diff --git a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch b/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch deleted file mode 100644 index 35b5973..0000000 --- a/0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 12 Oct 2023 17:27:42 +0200 -Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL - pointer - -Chain rename code missed to adjust the num_chains value which is used to -calculate the number of chain index buckets to allocate during an index -rebuild. So with the right number of chains present, the last chain in a -middle bucket being renamed (and ending up in another bucket) triggers -an index rebuild based on false data. The resulting NULL pointer index -bucket then causes a segfault upon reinsertion. - -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713 -Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc") -(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620) ---- - .../testcases/chain/0008rename-segfault2_0 | 32 +++++++++++++++++++ - libiptc/libiptc.c | 4 +++ - 2 files changed, 36 insertions(+) - create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0 - -diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -new file mode 100755 -index 0000000000000..bc473d2511bbd ---- /dev/null -+++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 -@@ -0,0 +1,32 @@ -+#!/bin/bash -+# -+# Another funny rename bug in libiptc: -+# If there is a chain index bucket with only a single chain in it and it is not -+# the last one and that chain is renamed, a chain index rebuild is triggered. -+# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an -+# extra index is allocated and remains NULL. The following insert of renamed -+# chain then segfaults. -+ -+( -+ echo "*filter" -+ # first bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-a-$i - [0:0]" -+ done -+ # second bucket -+ for ((i = 0; i < 40; i++)); do -+ echo ":chain-b-$i - [0:0]" -+ done -+ # third bucket, just make sure it exists -+ echo ":chain-c-0 - [0:0]" -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore -+ -+# rename all chains of the middle bucket -+( -+ echo "*filter" -+ for ((i = 0; i < 40; i++)); do -+ echo "-E chain-b-$i chain-d-$i" -+ done -+ echo "COMMIT" -+) | $XT_MULTI iptables-restore --noflush -diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c -index e475063367c26..9712a36353b9a 100644 ---- a/libiptc/libiptc.c -+++ b/libiptc/libiptc.c -@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, - return 0; - } - -+ handle->num_chains--; -+ - /* This only unlinks "c" from the list, thus no free(c) */ - iptcc_chain_index_delete_chain(c, handle); - - /* Change the name of the chain */ - strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1); - -+ handle->num_chains++; -+ - /* Insert sorted into to list again */ - iptc_insert_chain(handle, c); - diff --git a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch b/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch deleted file mode 100644 index c384e4b..0000000 --- a/0002-arptables-nft-remove-ARPT_INV-flags-usage.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Fri, 3 Nov 2023 17:33:22 +0100 -Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage - -ARPT_ and IPT_INV flags are not interchangeable, e.g.: -define IPT_INV_SRCDEVADDR 0x0080 -define ARPT_INV_SRCDEVADDR 0x0010 - -as these flags can be tested by libarp_foo.so such checks can yield -incorrect results. - -Because arptables-nft uses existing code, e.g. xt_mark, it makes -sense to unify this completely by converting the last users of -ARPT_INV_ constants. - -Note that arptables-legacy does not do run-time module loading via -dlopen(). Functionaliy implemented by "extensions" in the -arptables-legacy git tree are built-in, so this doesn't break -arptables-legacy binaries. - -Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*") -Signed-off-by: Florian Westphal -Signed-off-by: Phil Sutter -(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68) ---- - extensions/libarpt_mangle.c | 4 ++-- - iptables/nft-arp.c | 2 +- - iptables/xshared.h | 4 +++- - 3 files changed, 6 insertions(+), 4 deletions(-) - -diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c -index 765edf34781f3..a846e97ec8f27 100644 ---- a/extensions/libarpt_mangle.c -+++ b/extensions/libarpt_mangle.c -@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! --h-length not allowed for " - "--mangle-mac-s"); -@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags, - if (e->arp.arhln_mask == 0) - xtables_error(PARAMETER_PROBLEM, - "no --h-length defined"); -- if (e->arp.invflags & ARPT_INV_ARPHLN) -+ if (e->arp.invflags & IPT_INV_ARPHLN) - xtables_error(PARAMETER_PROBLEM, - "! hln not allowed for --mangle-mac-d"); - if (e->arp.arhln != 6) -diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c -index aed39ebdd5166..535dd6b83237b 100644 ---- a/iptables/nft-arp.c -+++ b/iptables/nft-arp.c -@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command, - &args->d.naddrs); - - if ((args->s.naddrs > 1 || args->d.naddrs > 1) && -- (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP))) -+ (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) - xtables_error(PARAMETER_PROBLEM, - "! not allowed with multiple" - " source or destination IP addresses"); -diff --git a/iptables/xshared.h b/iptables/xshared.h -index a200e0d620ad3..5586385456a4d 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -80,7 +80,9 @@ struct xtables_target; - #define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ - #define EBT_OPTSTRING OPTSTRING_COMMON "hv" - --/* define invflags which won't collide with IPT ones */ -+/* define invflags which won't collide with IPT ones. -+ * arptables-nft does NOT use the legacy ARPT_INV_* defines. -+ */ - #define IPT_INV_SRCDEVADDR 0x0080 - #define IPT_INV_TGTDEVADDR 0x0100 - #define IPT_INV_ARPHLN 0x0200 diff --git a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch b/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch deleted file mode 100644 index 3386925..0000000 --- a/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch +++ /dev/null @@ -1,63 +0,0 @@ -From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 7 Nov 2023 19:12:14 +0100 -Subject: [PATCH] ebtables: Fix corner-case noflush restore bug - -Report came from firwalld, but this is actually rather hard to trigger. -Since a regular chain line prevents it, typical dump/restore use-cases -are unaffected. - -Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") -Cc: Eric Garver -Signed-off-by: Phil Sutter -(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8) ---- - .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ - iptables/xtables-eb.c | 2 ++ - 2 files changed, 27 insertions(+) - create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 - -diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -new file mode 100755 -index 0000000000000..0def0ac58e7be ---- /dev/null -+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 -@@ -0,0 +1,25 @@ -+#!/bin/sh -+# -+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: -+# - with --noflush -+# - a second table after the broute one -+# - A policy command but no chain line for BROUTING chain -+ -+set -e -+ -+case "$XT_MULTI" in -+*xtables-nft-multi) -+ ;; -+*) -+ echo "skip $XT_MULTI" -+ exit 0 -+ ;; -+esac -+ -+$XT_MULTI ebtables-restore --noflush < -Date: Sun, 19 Nov 2023 13:18:26 +0100 -Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused - -Drop the boolean, it was meant to disable some existence checks in -do_parse() prior to the caching rework. Now that do_parse() runs before -any caching is done, the checks in question don't exist anymore so drop -this relict. - -Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") -Signed-off-by: Phil Sutter -(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb) ---- - iptables/xshared.h | 1 - - iptables/xtables-translate.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index 5586385456a4d..c77556a1987dc 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -284,7 +284,6 @@ struct xt_cmd_parse { - bool restore; - int line; - int verbose; -- bool xlate; - struct xt_cmd_parse_ops *ops; - }; - -diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c -index 88e0a6b639494..c019cd2991305 100644 ---- a/iptables/xtables-translate.c -+++ b/iptables/xtables-translate.c -@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[], - .table = *table, - .restore = restore, - .line = line, -- .xlate = true, - .ops = &h->ops->cmd_parse, - }; - struct iptables_command_state cs = { diff --git a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch b/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch deleted file mode 100644 index c743e75..0000000 --- a/0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 19 Nov 2023 13:25:36 +0100 -Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON - -Fixes: 51d9d9e081344 ("ebtables: Support verbose mode") -Signed-off-by: Phil Sutter -(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a) ---- - iptables/xshared.h | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/iptables/xshared.h b/iptables/xshared.h -index c77556a1987dc..815b9d3e98726 100644 ---- a/iptables/xshared.h -+++ b/iptables/xshared.h -@@ -75,10 +75,10 @@ struct xtables_globals; - struct xtables_rule_match; - struct xtables_target; - --#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:" --#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x" --#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */ --#define EBT_OPTSTRING OPTSTRING_COMMON "hv" -+#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v" -+#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x" -+#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */ -+#define EBT_OPTSTRING OPTSTRING_COMMON "h" - - /* define invflags which won't collide with IPT ones. - * arptables-nft does NOT use the legacy ARPT_INV_* defines. diff --git a/0006-ebtables-Align-line-number-formatting-with-legacy.patch b/0006-ebtables-Align-line-number-formatting-with-legacy.patch deleted file mode 100644 index 07bea3a..0000000 --- a/0006-ebtables-Align-line-number-formatting-with-legacy.patch +++ /dev/null @@ -1,28 +0,0 @@ -From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 21 Nov 2023 22:58:47 +0100 -Subject: [PATCH] ebtables: Align line number formatting with legacy - -Legacy ebtables appends a dot to the number printed in first column if ---Ln flag was given. - -Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat") -Signed-off-by: Phil Sutter -(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf) ---- - iptables/nft-bridge.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c -index d9a8ad2b0f373..e414ef5584392 100644 ---- a/iptables/nft-bridge.c -+++ b/iptables/nft-bridge.c -@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r, - struct iptables_command_state cs = {}; - - if (format & FMT_LINENUMBERS) -- printf("%d ", num); -+ printf("%d. ", num); - - nft_rule_to_ebtables_command_state(h, r, &cs); - __nft_bridge_save_rule(&cs, format); diff --git a/0007-man-Do-not-escape-exclamation-marks.patch b/0007-man-Do-not-escape-exclamation-marks.patch deleted file mode 100644 index b088c63..0000000 --- a/0007-man-Do-not-escape-exclamation-marks.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 13:29:17 +0100 -Subject: [PATCH] man: Do not escape exclamation marks - -This appears to be not necessary, also mandoc complains about it: - -| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \! - -Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage") -Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage") -Signed-off-by: Phil Sutter -(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a) ---- - extensions/libip6t_DNPT.man | 2 +- - extensions/libip6t_SNPT.man | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man -index 9b060f5b7179b..72c6ae5d422a2 100644 ---- a/extensions/libip6t_DNPT.man -+++ b/extensions/libip6t_DNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the SNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 -diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man -index 97e0071b43cc1..0c926978377a7 100644 ---- a/extensions/libip6t_SNPT.man -+++ b/extensions/libip6t_SNPT.man -@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length - .PP - You have to use the DNPT target to undo the translation. Example: - .IP --ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0 -+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0 - \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64 - .IP - ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64 diff --git a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch b/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch deleted file mode 100644 index c0bbec2..0000000 --- a/0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch +++ /dev/null @@ -1,49 +0,0 @@ -From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 28 Nov 2023 20:21:49 +0100 -Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks - -In order to parse the mask, xtopt_parse_hostmask() calls -xtopt_parse_plenmask() thereby limiting netmask support to prefix -lengths (alternatively specified in IP address notation). - -In order to lift this impractical restriction, make -xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may -fall back to xtopt_parse_mask() which correctly initializes val.hmask -itself and indicates non-CIDR-compatible masks by setting val.hlen to --1. - -So in order to support these odd masks, it is sufficient for -xtopt_parse_plenmask() to skip its mask building from val.hlen value and -take whatever val.hmask contains. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -Signed-off-by: Phil Sutter -(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232) ---- - libxtables/xtoptions.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index b16bbfbe32311..d91a78f470eda 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - - xtopt_parse_plen(cb); - -+ /* may not be convertible to CIDR notation */ -+ if (cb->val.hlen == (uint8_t)-1) -+ goto out_put; -+ - memset(mask, 0xFF, sizeof(union nf_inet_addr)); - /* This shifting is AF-independent. */ - if (cb->val.hlen == 0) { -@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb) - mask[1] = htonl(mask[1]); - mask[2] = htonl(mask[2]); - mask[3] = htonl(mask[3]); -+out_put: - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); - } diff --git a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch b/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch deleted file mode 100644 index 7745634..0000000 --- a/0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 19 Dec 2023 00:56:07 +0100 -Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting - -Parameter 'wait' passed to xtables_lock() signals three modes of -operation, depending on its value: - - 0: --wait not specified, do not wait if lock is busy --1: --wait specified without value, wait indefinitely until lock becomes - free ->0: Wait for 'wait' seconds for lock to become free, abort otherwise - -Since fixed commit, the first two cases were treated the same apart from -calling alarm(0), but that is a nop if no alarm is pending. Fix the code -by requesting a non-blocking flock() in the second case. While at it, -restrict the alarm setup to the third case only. - -Cc: Jethro Beekman -Cc: howardjohn@google.com -Cc: Antonio Ojea -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728 -Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals") -Signed-off-by: Phil Sutter -(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9) ---- - .../shell/testcases/iptables/0010-wait_0 | 55 +++++++++++++++++++ - iptables/xshared.c | 4 +- - 2 files changed, 57 insertions(+), 2 deletions(-) - create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0 - -diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0 -new file mode 100755 -index 0000000000000..4481f966ce435 ---- /dev/null -+++ b/iptables/tests/shell/testcases/iptables/0010-wait_0 -@@ -0,0 +1,55 @@ -+#!/bin/bash -+ -+case "$XT_MULTI" in -+*xtables-legacy-multi) -+ ;; -+*) -+ echo skip $XT_MULTI -+ exit 0 -+ ;; -+esac -+ -+coproc RESTORE { $XT_MULTI iptables-restore; } -+echo "*filter" >&${RESTORE[1]} -+ -+ -+$XT_MULTI iptables -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 1 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "process waits when it should not" -+ exit 1 -+} -+wait $ipt_pid -+[[ $? -eq 0 ]] && { -+ echo "process exited 0 despite busy lock" -+ exit 1 -+} -+ -+t0=$(date +%s) -+$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT -+t1=$(date +%s) -+[[ $((t1 - t0)) -ge 3 ]] || { -+ echo "wait time not expired" -+ exit 1 -+} -+ -+$XT_MULTI iptables -w -A FORWARD -j ACCEPT & -+ipt_pid=$! -+ -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] || { -+ echo "no indefinite wait" -+ exit 1 -+} -+kill $ipt_pid -+waitpid -t 3 $ipt_pid -+[[ $? -eq 3 ]] && { -+ echo "killed waiting iptables call did not exit in time" -+ exit 1 -+} -+ -+kill $RESTORE_PID -+wait -+exit 0 -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 5f75a0a57a023..690502c457dd0 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -270,7 +270,7 @@ static int xtables_lock(int wait) - return XT_LOCK_FAILED; - } - -- if (wait != -1) { -+ if (wait > 0) { - sigact_alarm.sa_handler = alarm_ignore; - sigact_alarm.sa_flags = SA_RESETHAND; - sigemptyset(&sigact_alarm.sa_mask); -@@ -278,7 +278,7 @@ static int xtables_lock(int wait) - alarm(wait); - } - -- if (flock(fd, LOCK_EX) == 0) -+ if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0) - return fd; - - if (errno == EINTR) { diff --git a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch b/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch deleted file mode 100644 index ea88fa3..0000000 --- a/0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Sun, 17 Dec 2023 13:02:36 +0100 -Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK - -Do as the comment in xtopt_parse_hostmask() claims and omit -XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate() -will catch the incompatibility. - -Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support") -(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31) ---- - include/xtables.h | 1 - - libxtables/xtoptions.c | 1 - - 2 files changed, 2 deletions(-) - -diff --git a/include/xtables.h b/include/xtables.h -index 087a1d600f9ae..9def9b43b6e58 100644 ---- a/include/xtables.h -+++ b/include/xtables.h -@@ -61,7 +61,6 @@ struct in_addr; - * %XTTYPE_SYSLOGLEVEL: syslog level by name or number - * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr) - * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length -- * (ptr: union nf_inet_addr; only host portion is stored) - * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols (ptr: uint8_t) - * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO) - * %XTTYPE_PORTRC: colon-separated port range (names acceptable), -diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c -index d91a78f470eda..ba68056dc99f7 100644 ---- a/libxtables/xtoptions.c -+++ b/libxtables/xtoptions.c -@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = { - [XTTYPE_STRING] = -1, - [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), - [XTTYPE_HOST] = sizeof(union nf_inet_addr), -- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), - [XTTYPE_PROTOCOL] = sizeof(uint8_t), - [XTTYPE_PORT] = sizeof(uint16_t), - [XTTYPE_PORTRC] = sizeof(uint16_t[2]), diff --git a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch b/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch deleted file mode 100644 index f348d59..0000000 --- a/0011-nft-ruleparse-Add-missing-braces-around-ternary.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 26 Jan 2024 18:43:10 +0100 -Subject: [PATCH] nft: ruleparse: Add missing braces around ternary - -The expression evaluated the sum before the ternay, consequently not -adding target->size if tgsize was zero. - -Identified by ASAN for a simple rule using standard target: -| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN -| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN -| ================================================================= -| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928 -| READ of size 8 at 0x603000000120 thread T0 -| [...] - -Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()") -Signed-off-by: Phil Sutter -(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1) ---- - iptables/nft-ruleparse.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c -index c8322f936acd9..57fe27276de35 100644 ---- a/iptables/nft-ruleparse.c -+++ b/iptables/nft-ruleparse.c -@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize) - if (!target) - return NULL; - -- size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size; -+ size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size); - - target->t = xtables_calloc(1, size); - target->t->u.target_size = size; diff --git a/0012-libxtables-Fix-memleak-of-matches-udata.patch b/0012-libxtables-Fix-memleak-of-matches-udata.patch deleted file mode 100644 index 7d9c51f..0000000 --- a/0012-libxtables-Fix-memleak-of-matches-udata.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 31 Jan 2024 14:58:17 +0100 -Subject: [PATCH] libxtables: Fix memleak of matches' udata - -If the extension specifies a non-zero udata_size, field 'udata' points -to an allocated buffer which needs to be freed upon extension deinit. - -Interestingly, this bug was identified by ASAN and missed by valgrind. - -Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space") -Signed-off-by: Phil Sutter -(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280) ---- - libxtables/xtables.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/libxtables/xtables.c b/libxtables/xtables.c -index ba9ceaeb3da41..0f617d80ae37e 100644 ---- a/libxtables/xtables.c -+++ b/libxtables/xtables.c -@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches) - free(matchp->match->m); - matchp->match->m = NULL; - } -+ if (matchp->match->udata_size) { -+ free(matchp->match->udata); -+ matchp->match->udata = NULL; -+ } - if (matchp->match == matchp->match->next) { - free(matchp->match); - matchp->match = NULL; diff --git a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch b/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index e9c3cb0..0000000 --- a/0013-extensions-ah-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,200 +0,0 @@ -From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:27:03 +0100 -Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges - -While at it, fix xlate output for plain '-m ah' matches: With -ip6tables-translate, one should emit an extdhr exists match since -ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate, -a simple 'meta l4proto ah' was missing. - -Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'") -Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622) - -Conflicts: - extensions/libip6t_ah.t - extensions/libip6t_ah.txlate - extensions/libipt_ah.t - extensions/libipt_ah.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_ah.c | 22 +++++++++++++--------- - extensions/libip6t_ah.t | 1 + - extensions/libip6t_ah.txlate | 6 ++++++ - extensions/libipt_ah.c | 22 ++++++++++++++-------- - extensions/libipt_ah.t | 1 + - extensions/libipt_ah.txlate | 6 ++++++ - 6 files changed, 41 insertions(+), 17 deletions(-) - -diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c -index f35982f379d76..0f95c4735eabd 100644 ---- a/extensions/libip6t_ah.c -+++ b/extensions/libip6t_ah.c -@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb) - } - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - if (min == max) - printf("%s:%s%u", name, inv, min); - else -@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI; - char *space = ""; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); -@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl, - } - - if (!space[0]) /* plain '-m ah' */ -- xt_xlate_add(xl, "meta l4proto ah"); -+ xt_xlate_add(xl, "exthdr ah exists"); - - return 1; - } -diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t -index c1898d44cf193..9099bdc9259c3 100644 ---- a/extensions/libip6t_ah.t -+++ b/extensions/libip6t_ah.t -@@ -13,3 +13,4 @@ - -m ah --ahspi 0:invalid;;FAIL - -m ah --ahspi;;FAIL - -m ah;=;OK -+-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate -index cc33ac2718c0c..32c6b7de00937 100644 ---- a/extensions/libip6t_ah.txlate -+++ b/extensions/libip6t_ah.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop' - - ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT - nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept' -+ -+ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr ah exists counter' -+ -+ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295 -+nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter' -diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c -index fec5705ce6f53..39e3013d3e74b 100644 ---- a/extensions/libipt_ah.c -+++ b/extensions/libipt_ah.c -@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb) - ahinfo->invflags |= IPT_AH_INV_SPI; - } - -+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spi_match(min, max, invert)) { - printf("%s", name); - if (min == max) { - printf(":%s", inv); -@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match, - static void ah_save(const void *ip, const struct xt_entry_match *match) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 -- && ahinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ahspi ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ printf("%s --ahspi ", inv_spi ? " !" : ""); - if (ahinfo->spis[0] - != ahinfo->spis[1]) - printf("%u:%u", -@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data; -+ bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI; - -- if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "ah spi%s ", -- (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : ""); -+ if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : ""); - if (ahinfo->spis[0] != ahinfo->spis[1]) - xt_xlate_add(xl, "%u-%u", ahinfo->spis[0], - ahinfo->spis[1]); - else - xt_xlate_add(xl, "%u", ahinfo->spis[0]); -+ } else { -+ xt_xlate_add(xl, "meta l4proto ah"); - } - - return 1; -diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t -index cd853865638e8..1aeb607e9e986 100644 ---- a/extensions/libipt_ah.t -+++ b/extensions/libipt_ah.t -@@ -11,3 +11,4 @@ - -m ah --ahspi;;FAIL - -m ah;;FAIL - -p ah -m ah;=;OK -+-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK -diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate -index 897c82b5f95c6..baf5a0ae6182a 100644 ---- a/extensions/libipt_ah.txlate -+++ b/extensions/libipt_ah.txlate -@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop' - - iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP - nft 'add rule ip filter INPUT ah spi != 50 counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto ah counter drop' -+ -+iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop' diff --git a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch b/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 902ade1..0000000 --- a/0014-extensions-frag-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,117 +0,0 @@ -From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:39:52 +0100 -Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges - -Also translate plain '-m frag' match into an exthdr exists one. - -Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955) - -Conflicts: - extensions/libip6t_frag.t - extensions/libip6t_frag.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_frag.c | 27 ++++++++++++++++++--------- - extensions/libip6t_frag.t | 1 + - extensions/libip6t_frag.txlate | 6 ++++++ - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c -index 49c787e709a9e..ed7fe10a4716d 100644 ---- a/extensions/libip6t_frag.c -+++ b/extensions/libip6t_frag.c -@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb) - } - } - -+static bool skip_ids_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_ids(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_ids_match(min, max, invert)) { - printf("%s", name); - if (min == max) - printf(":%s%u", inv, min); -@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match, - static void frag_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 -- && fraginfo->ids[1] == 0xFFFFFFFF)) { -- printf("%s --fragid ", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ printf("%s --fragid ", inv_ids ? " !" : ""); - if (fraginfo->ids[0] - != fraginfo->ids[1]) - printf("%u:%u", -@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match) - printf(" --fraglast"); - } - -+#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \ -+ IP6T_FRAG_MF | IP6T_FRAG_NMF) -+ - static int frag_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_frag *fraginfo = - (struct ip6t_frag *)params->match->data; -+ bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS; - -- if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "frag id %s", -- (fraginfo->invflags & IP6T_FRAG_INV_IDS) ? -- "!= " : ""); -+ if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) { -+ xt_xlate_add(xl, "frag id %s", inv_ids ? "!= " : ""); - if (fraginfo->ids[0] != fraginfo->ids[1]) - xt_xlate_add(xl, "%u-%u", fraginfo->ids[0], - fraginfo->ids[1]); - else - xt_xlate_add(xl, "%u", fraginfo->ids[0]); - -+ } else if (!(fraginfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr frag exists"); -+ return 1; - } - - /* ignore ineffective IP6T_FRAG_LEN bit */ -diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t -index 299fa03f8845b..58417c90e9217 100644 ---- a/extensions/libip6t_frag.t -+++ b/extensions/libip6t_frag.t -@@ -1,4 +1,5 @@ - :INPUT,FORWARD,OUTPUT -+-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK - -m frag --fragid 1:42;=;OK - -m frag --fraglen 42;=;OK - -m frag --fragres;=;OK -diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate -index 33fc0631dc792..e250587e7682c 100644 ---- a/extensions/libip6t_frag.txlate -+++ b/extensions/libip6t_frag.txlate -@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept' - - ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT - nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept' -+ -+ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT exthdr frag exists counter' -+ -+ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295 -+nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter' diff --git a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch b/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 1afcc54..0000000 --- a/0015-extensions-mh-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,111 +0,0 @@ -From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:42:10 +0100 -Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges - -Also translate '-m mh' into an exthdr exists match unless '-p mh' is -also present. The latter is converted into 'meta l4proto mh' which might -need fixing itself at a later point. - -Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30) - -Conflicts: - extensions/libip6t_mh.t - extensions/libip6t_mh.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_mh.c | 20 ++++++++++++++++---- - extensions/libip6t_mh.t | 1 + - extensions/libip6t_mh.txlate | 9 +++++++++ - 3 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 1410d324b5d42..3f80e28ec94c8 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - enum { - O_MH_TYPE = 0, -@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric) - printf("%s", name); - } - -+static bool skip_types_match(uint8_t min, uint8_t max, bool inv) -+{ -+ return min == 0 && max == UINT8_MAX && !inv; -+} -+ - static void print_types(uint8_t min, uint8_t max, int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFF || invert) { -+ if (!skip_types_match(min, max, invert)) { - printf(" "); - if (min == max) { - printf("%s", inv); -@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match, - static void mh_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) - return; - -- if (mhinfo->invflags & IP6T_MH_INV_TYPE) -+ if (inv_type) - printf(" !"); - - if (mhinfo->types[0] != mhinfo->types[1]) -@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; -+ bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -+ uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - -- if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff) -+ if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -+ if (proto != IPPROTO_MH) -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; -+ } - - if (mhinfo->types[0] != mhinfo->types[1]) - xt_xlate_add(xl, "mh type %s%u-%u", -diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t -index 6b76d13d0a00f..be5439edc9520 100644 ---- a/extensions/libip6t_mh.t -+++ b/extensions/libip6t_mh.t -@@ -4,3 +4,4 @@ - -p mobility-header -m mh --mh-type 1;=;OK - -p mobility-header -m mh ! --mh-type 4;=;OK - -p mobility-header -m mh --mh-type 4:123;=;OK -+-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 4dfaf46a2b8d7..3364ce574468f 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac - - ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' -+ -+ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+ -+ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' -+ -+ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT -+nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept' diff --git a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch b/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index c9ec110..0000000 --- a/0016-extensions-rt-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:45:42 +0100 -Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges - -Also translate plain '-m rt' match into an exthdr exists one. - -Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477) - -Conflicts: - extensions/libip6t_rt.t - extensions/libip6t_rt.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libip6t_rt.c | 28 ++++++++++++++++++++-------- - extensions/libip6t_rt.t | 1 + - extensions/libip6t_rt.txlate | 9 +++++++++ - 3 files changed, 30 insertions(+), 8 deletions(-) - -diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c -index d5b0458bb397e..6db09f0b2cdc8 100644 ---- a/extensions/libip6t_rt.c -+++ b/extensions/libip6t_rt.c -@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb) - } - } - -+static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_nums(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_segsleft_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match, - static void rt_save(const void *ip, const struct xt_entry_match *match) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - printf("%s --rt-type %u", -@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 -- && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- printf("%s --rt-segsleft ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ printf("%s --rt-segsleft ", inv_sgs ? " !" : ""); - if (rtinfo->segsleft[0] - != rtinfo->segsleft[1]) - printf("%u:%u", -@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match) - - } - -+#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \ -+ IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT) -+ - static int rt_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data; -+ bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS; - - if (rtinfo->flags & IP6T_RT_TYP) { - xt_xlate_add(xl, "rt type%s %u", -@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl, - rtinfo->rt_type); - } - -- if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "rt seg-left%s ", -- (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : ""); -+ if (!skip_segsleft_match(rtinfo->segsleft[0], -+ rtinfo->segsleft[1], inv_sgs)) { -+ xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : ""); - - if (rtinfo->segsleft[0] != rtinfo->segsleft[1]) - xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0], - rtinfo->segsleft[1]); - else - xt_xlate_add(xl, "%u", rtinfo->segsleft[0]); -+ } else if (!(rtinfo->flags & XLATE_FLAGS)) { -+ xt_xlate_add(xl, "exthdr rt exists"); -+ return 1; - } - - if (rtinfo->flags & IP6T_RT_LEN) { -diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t -index 3c7b2d981324a..047b6880e354d 100644 ---- a/extensions/libip6t_rt.t -+++ b/extensions/libip6t_rt.t -@@ -3,3 +3,4 @@ - -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK - -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK - -m rt;=;OK -+-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK -diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate -index 3578bcba0157e..1c2f74a588750 100644 ---- a/extensions/libip6t_rt.txlate -+++ b/extensions/libip6t_rt.txlate -@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop' - - ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT - nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept' -+ -+ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT exthdr rt exists counter accept' -+ -+ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT -+nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept' diff --git a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch b/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 318d9eb..0000000 --- a/0017-extensions-esp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,119 +0,0 @@ -From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:47:09 +0100 -Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges - -Also add a translation for plain '-m esp' match which depends on the -address family: While ip6tables-translate may emit an exthdr exists -match, iptables-translate must stick to meta l4proto. - -Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca) - -Conflicts: - extensions/libxt_esp.t - extensions/libxt_esp.txlate -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_esp.c | 26 ++++++++++++++++++-------- - extensions/libxt_esp.t | 1 + - extensions/libxt_esp.txlate | 12 ++++++++++++ - 3 files changed, 31 insertions(+), 8 deletions(-) - -diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c -index 2c7ff942cb9e0..8e9766d71ed57 100644 ---- a/extensions/libxt_esp.c -+++ b/extensions/libxt_esp.c -@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb) - espinfo->invflags |= XT_ESP_INV_SPI; - } - -+static bool skip_spis_match(uint32_t min, uint32_t max, bool inv) -+{ -+ return min == 0 && max == UINT32_MAX && !inv; -+} -+ - static void - print_spis(const char *name, uint32_t min, uint32_t max, - int invert) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFFFFFF || invert) { -+ if (!skip_spis_match(min, max, invert)) { - if (min == max) - printf(" %s:%s%u", name, inv, min); - else -@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void esp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_esp *espinfo = (struct xt_esp *)match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 -- && espinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --espspi ", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ printf("%s --espspi ", inv_spi ? " !" : ""); - if (espinfo->spis[0] - != espinfo->spis[1]) - printf("%u:%u", -@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_esp *espinfo = (struct xt_esp *)params->match->data; -+ bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI; - -- if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) { -- xt_xlate_add(xl, "esp spi%s", -- (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : ""); -+ if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) { -+ xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : ""); - if (espinfo->spis[0] != espinfo->spis[1]) - xt_xlate_add(xl, " %u-%u", espinfo->spis[0], - espinfo->spis[1]); - else - xt_xlate_add(xl, " %u", espinfo->spis[0]); -+ } else if (afinfo->family == NFPROTO_IPV4) { -+ xt_xlate_add(xl, "meta l4proto esp"); -+ } else if (afinfo->family == NFPROTO_IPV6) { -+ xt_xlate_add(xl, "exthdr esp exists"); -+ } else { -+ return 0; - } - - return 1; -diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t -index 92c5779f860f1..37259d6b3a08f 100644 ---- a/extensions/libxt_esp.t -+++ b/extensions/libxt_esp.t -@@ -4,5 +4,6 @@ - -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK - -p esp -m esp ! --espspi 0:4294967294;=;OK - -p esp -m esp --espspi -1;;FAIL -+-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK - -p esp -m esp;=;OK - -m esp;;FAIL -diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate -index f6aba52f52235..5e8fb241beaf4 100644 ---- a/extensions/libxt_esp.txlate -+++ b/extensions/libxt_esp.txlate -@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop' - - iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP - nft 'add rule ip filter INPUT esp spi 500-600 counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT meta l4proto esp counter drop' -+ -+iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT exthdr esp exists counter drop' -+ -+ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP -+nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop' diff --git a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch b/0018-extensions-ipcomp-Save-inverted-full-ranges.patch deleted file mode 100644 index 316e5dd..0000000 --- a/0018-extensions-ipcomp-Save-inverted-full-ranges.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 15:57:46 +0100 -Subject: [PATCH] extensions: ipcomp: Save inverted full ranges - -Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support") -Signed-off-by: Phil Sutter -(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a) - -Conflicts: - extensions/libxt_ipcomp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_ipcomp.c | 7 ++++--- - extensions/libxt_ipcomp.t | 1 + - 2 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c -index 4171c4a1c4eb7..961c17e584933 100644 ---- a/extensions/libxt_ipcomp.c -+++ b/extensions/libxt_ipcomp.c -@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match, - static void comp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data; -+ bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI; - - if (!(compinfo->spis[0] == 0 -- && compinfo->spis[1] == 0xFFFFFFFF)) { -- printf("%s --ipcompspi ", -- (compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : ""); -+ && compinfo->spis[1] == UINT32_MAX -+ && !inv_spi)) { -+ printf("%s --ipcompspi ", inv_spi ? " !" : ""); - if (compinfo->spis[0] - != compinfo->spis[1]) - printf("%u:%u", -diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t -index 8546ba9ce416f..47c1fbc220c6a 100644 ---- a/extensions/libxt_ipcomp.t -+++ b/extensions/libxt_ipcomp.t -@@ -1,3 +1,4 @@ - :INPUT,OUTPUT - -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK - -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK -+-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK diff --git a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch b/0019-nft-Do-not-omit-full-ranges-if-inverted.patch deleted file mode 100644 index cfeacd5..0000000 --- a/0019-nft-Do-not-omit-full-ranges-if-inverted.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Fri, 2 Feb 2024 13:14:29 +0100 -Subject: [PATCH] nft: Do not omit full ranges if inverted - -Otherwise this turns a never matching rule into an always matching one. - -Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match") -Signed-off-by: Phil Sutter -(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_udp.t -- Missing commits adding test cases, add relevant ones manually instead - of adjusting the wrong ones as the original commit does. ---- - extensions/libxt_tcp.t | 2 ++ - extensions/libxt_udp.t | 2 ++ - iptables/nft.c | 4 ++-- - 3 files changed, 6 insertions(+), 2 deletions(-) - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 7a3bbd08952f0..3caa3e3f50271 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,6 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index f534770191a6e..aa2c91770e63f 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,6 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK -+-p udp -m udp ! --sport :;-p udp -m udp;OK -+-p udp -m udp ! --dport :;-p udp -m udp;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/iptables/nft.c b/iptables/nft.c -index 97fd4f49fdb4c..8e7a38ac93a3e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return 0; - } - -- if (src[0] || src[1] < 0xffff) { -+ if (src[0] || src[1] < UINT16_MAX || invert_src) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, ®); - if (!expr) - return -ENOMEM; -@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r, - return ret; - } - -- if (dst[0] || dst[1] < 0xffff) { -+ if (dst[0] || dst[1] < UINT16_MAX || invert_dst) { - expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, ®); - if (!expr) - return -ENOMEM; diff --git a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch b/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch deleted file mode 100644 index 326544f..0000000 --- a/0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Thu, 1 Feb 2024 17:42:12 +0100 -Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges - -Also translate a bare '-m tcp/udp' to 'meta l4proto' match. - -Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft") -Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft") -Signed-off-by: Phil Sutter -(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2) - -Conflicts: - extensions/libxt_tcp.t - extensions/libxt_tcp.txlate - extensions/libxt_udp.t - extensions/libxt_udp.txlate -- Context change due to Missing commits adding test cases. ---- - extensions/libxt_tcp.c | 48 +++++++++++++++++++++++-------------- - extensions/libxt_tcp.t | 4 ++-- - extensions/libxt_tcp.txlate | 6 +++++ - extensions/libxt_udp.c | 43 ++++++++++++++++++++------------- - extensions/libxt_udp.t | 4 ++-- - extensions/libxt_udp.txlate | 6 +++++ - 6 files changed, 72 insertions(+), 39 deletions(-) - -diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c -index f82572828649b..32bbd684fd5d7 100644 ---- a/extensions/libxt_tcp.c -+++ b/extensions/libxt_tcp.c -@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void tcp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; - -- if (tcpinfo->spts[0] != 0 -- || tcpinfo->spts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_SRCPT) -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (tcpinfo->spts[0] - != tcpinfo->spts[1]) -@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match) - tcpinfo->spts[0]); - } - -- if (tcpinfo->dpts[0] != 0 -- || tcpinfo->dpts[1] != 0xFFFF) { -- if (tcpinfo->invflags & XT_TCP_INV_DSTPT) -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (tcpinfo->dpts[0] - != tcpinfo->dpts[1]) -@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl, - { - const struct xt_tcp *tcpinfo = - (const struct xt_tcp *)params->match->data; -+ bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT; -+ bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT; -+ bool xlated = false; - -- if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) { - if (tcpinfo->spts[0] != tcpinfo->spts[1]) { - xt_xlate_add(xl, "tcp sport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0], tcpinfo->spts[1]); - } else { - xt_xlate_add(xl, "tcp sport %s%u", -- tcpinfo->invflags & XT_TCP_INV_SRCPT ? -- "!= " : "", -+ inv_srcpt ? "!= " : "", - tcpinfo->spts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) { -+ if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) { - if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) { - xt_xlate_add(xl, "tcp dport %s%u-%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0], tcpinfo->dpts[1]); - } else { - xt_xlate_add(xl, "tcp dport %s%u", -- tcpinfo->invflags & XT_TCP_INV_DSTPT ? -- "!= " : "", -+ inv_dstpt ? "!= " : "", - tcpinfo->dpts[0]); - } -+ xlated = true; - } - -- if (tcpinfo->option) -+ if (tcpinfo->option) { - xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option, - tcpinfo->invflags & XT_TCP_INV_OPTION ? - "missing" : "exists"); -+ xlated = true; -+ } - - if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) { - xt_xlate_add(xl, "tcp flags %s", -@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl, - print_tcp_xlate(xl, tcpinfo->flg_cmp); - xt_xlate_add(xl, " / "); - print_tcp_xlate(xl, tcpinfo->flg_mask); -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto tcp"); -+ - return 1; - } - -diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t -index 3caa3e3f50271..8baeeff2fc94b 100644 ---- a/extensions/libxt_tcp.t -+++ b/extensions/libxt_tcp.t -@@ -6,8 +6,8 @@ - -p tcp -m tcp --sport 1:1023;=;OK - -p tcp -m tcp --sport 1024:65535;=;OK - -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK ---p tcp -m tcp ! --sport :;-p tcp -m tcp;OK ---p tcp -m tcp ! --dport :;-p tcp -m tcp;OK -+-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK -+-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK - -p tcp -m tcp ! --sport 1;=;OK - -p tcp -m tcp ! --sport 65535;=;OK - -p tcp -m tcp ! --dport 1;=;OK -diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate -index 9802ddfe0039e..b3ddcc15833cf 100644 ---- a/extensions/libxt_tcp.txlate -+++ b/extensions/libxt_tcp.txlate -@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter' - - iptables-translate -A INPUT -p tcp ! --tcp-option 23 - nft 'add rule ip filter INPUT tcp option 23 missing counter' -+ -+iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept' -+ -+iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept' -diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c -index ba1c3eb768592..748d418039c3a 100644 ---- a/extensions/libxt_udp.c -+++ b/extensions/libxt_udp.c -@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric) - printf("%s", service); - } - -+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv) -+{ -+ return min == 0 && max == UINT16_MAX && !inv; -+} -+ - static void - print_ports(const char *name, uint16_t min, uint16_t max, - int invert, int numeric) - { - const char *inv = invert ? "!" : ""; - -- if (min != 0 || max != 0xFFFF || invert) { -+ if (!skip_ports_match(min, max, invert)) { - printf(" %s", name); - if (min == max) { - printf(":%s", inv); -@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric) - static void udp_save(const void *ip, const struct xt_entry_match *match) - { - const struct xt_udp *udpinfo = (struct xt_udp *)match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; - -- if (udpinfo->spts[0] != 0 -- || udpinfo->spts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_SRCPT) -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { -+ if (inv_srcpt) - printf(" !"); - if (udpinfo->spts[0] - != udpinfo->spts[1]) -@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match) - udpinfo->spts[0]); - } - -- if (udpinfo->dpts[0] != 0 -- || udpinfo->dpts[1] != 0xFFFF) { -- if (udpinfo->invflags & XT_UDP_INV_DSTPT) -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { -+ if (inv_dstpt) - printf(" !"); - if (udpinfo->dpts[0] - != udpinfo->dpts[1]) -@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl, - const struct xt_xlate_mt_params *params) - { - const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data; -+ bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT; -+ bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT; -+ bool xlated = false; - -- if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) { - if (udpinfo->spts[0] != udpinfo->spts[1]) { - xt_xlate_add(xl,"udp sport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0], udpinfo->spts[1]); - } else { - xt_xlate_add(xl, "udp sport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_srcpt ? "!= ": "", - udpinfo->spts[0]); - } -+ xlated = true; - } - -- if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) { -+ if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) { - if (udpinfo->dpts[0] != udpinfo->dpts[1]) { - xt_xlate_add(xl,"udp dport %s%u-%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0], udpinfo->dpts[1]); - } else { - xt_xlate_add(xl,"udp dport %s%u", -- udpinfo->invflags & XT_UDP_INV_SRCPT ? -- "!= ": "", -+ inv_dstpt ? "!= ": "", - udpinfo->dpts[0]); - } -+ xlated = true; - } - -+ if (!xlated) -+ xt_xlate_add(xl, "meta l4proto udp"); -+ - return 1; - } - -diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t -index aa2c91770e63f..0cde6ac30cc15 100644 ---- a/extensions/libxt_udp.t -+++ b/extensions/libxt_udp.t -@@ -6,8 +6,8 @@ - -p udp -m udp --sport 1:1023;=;OK - -p udp -m udp --sport 1024:65535;=;OK - -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK ---p udp -m udp ! --sport :;-p udp -m udp;OK ---p udp -m udp ! --dport :;-p udp -m udp;OK -+-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK -+-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK - -p udp -m udp ! --sport 1;=;OK - -p udp -m udp ! --sport 65535;=;OK - -p udp -m udp ! --dport 1;=;OK -diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate -index 28e7ca206b26b..d6bbb96f5d744 100644 ---- a/extensions/libxt_udp.txlate -+++ b/extensions/libxt_udp.txlate -@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep - - iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT - nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept' -+ -+iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept' -+ -+iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT -+nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept' diff --git a/0021-nft-Fix-for-broken-recover_rule_compat.patch b/0021-nft-Fix-for-broken-recover_rule_compat.patch deleted file mode 100644 index 46c636c..0000000 --- a/0021-nft-Fix-for-broken-recover_rule_compat.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 27 Feb 2024 18:47:39 +0100 -Subject: [PATCH] nft: Fix for broken recover_rule_compat() - -When IPv4 rule generator was changed to emit payload instead of -meta expressions for l4proto matches, the code reinserting -NFTNL_RULE_COMPAT_* attributes into rules being reused for counter -zeroing was broken by accident. - -Make rule compat recovery aware of the alternative match, basically -reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules -with NFTA_RULE_COMPAT") but add a test case this time to make sure -things stay intact. - -Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol") -Signed-off-by: Phil Sutter -(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305) ---- - iptables/nft.c | 27 ++++++++++++++++--- - .../nft-only/0011-zero-needs-compat_0 | 12 +++++++++ - 2 files changed, 35 insertions(+), 4 deletions(-) - create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 - -diff --git a/iptables/nft.c b/iptables/nft.c -index 8e7a38ac93a3e..42907a431a99e 100644 ---- a/iptables/nft.c -+++ b/iptables/nft.c -@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err) - return strerror(err); - } - -+static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp) -+{ -+ const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME); -+ uint32_t poff = offsetof(struct iphdr, protocol); -+ uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER; -+ -+ if (!strcmp(name, "payload") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG); -+ return 0; -+ } -+ if (!strcmp(name, "meta") && -+ nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) { -+ *dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -+ return 0; -+ } -+ return -1; -+} -+ - static int recover_rule_compat(struct nftnl_rule *r) - { - struct nftnl_expr_iter *iter; -@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r) - if (!e) - goto out; - -- if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) || -- nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO) -+ /* may be 'ip protocol' or 'meta l4proto' with identical RHS */ -+ if (l4proto_expr_get_dreg(e, ®) < 0) - goto next_expr; - -- reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG); -- - e = nftnl_expr_iter_next(iter); - if (!e) - goto out; -diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -new file mode 100755 -index 0000000000000..e276a953234cf ---- /dev/null -+++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 -@@ -0,0 +1,12 @@ -+#!/bin/bash -+ -+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } -+ -+set -e -+ -+rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080" -+for cmd in iptables ip6tables; do -+ $XT_MULTI $cmd -t mangle -A PREROUTING $rule -+ $XT_MULTI $cmd -t mangle -Z -+ $XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}" -+done diff --git a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch b/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch deleted file mode 100644 index 0be13ca..0000000 --- a/0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch +++ /dev/null @@ -1,48 +0,0 @@ -From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 5 Mar 2024 17:02:56 +0100 -Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match - -Since core xlate code now ignores '-p mh' if an mh extension is also -present in the rule, mh extension has to emit the l4proto match itself. -Therefore emit the exthdr match irrespective of '-p' argument value just -like other IPv6 extension header matches do. - -Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges") -Signed-off-by: Phil Sutter -(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4) ---- - extensions/libip6t_mh.c | 4 +--- - extensions/libip6t_mh.txlate | 2 +- - 2 files changed, 2 insertions(+), 4 deletions(-) - -diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c -index 3f80e28ec94c8..1a1cee832b584 100644 ---- a/extensions/libip6t_mh.c -+++ b/extensions/libip6t_mh.c -@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl, - { - const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data; - bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE; -- uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto; - - if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) { -- if (proto != IPPROTO_MH) -- xt_xlate_add(xl, "exthdr mh exists"); -+ xt_xlate_add(xl, "exthdr mh exists"); - return 1; - } - -diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate -index 3364ce574468f..7eeaeefab6116 100644 ---- a/extensions/libip6t_mh.txlate -+++ b/extensions/libip6t_mh.txlate -@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT - nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept' - - ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT --nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept' -+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' - - ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT - nft 'add rule ip6 filter INPUT exthdr mh exists counter accept' diff --git a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch b/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch deleted file mode 100644 index a5e7994..0000000 --- a/0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 9 Apr 2024 13:18:12 +0200 -Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option - -Calling iptables with '-c ""' resulted in a call to strchr() with an -invalid pointer as 'optarg + 1' points to past the buffer. The most -simple fix is to drop the offset: The global optstring part specifies a -single colon after 'c', so getopt() enforces a valid pointer in optarg. -If it contains a comma at first position, packet counter value parsing -will fail so all cases are covered. - -Reported-by: gorbanev.es@gmail.com -Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741 -Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters") -Signed-off-by: Phil Sutter -(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c) ---- - extensions/iptables.t | 5 +++++ - iptables/xshared.c | 2 +- - 2 files changed, 6 insertions(+), 1 deletion(-) - -diff --git a/extensions/iptables.t b/extensions/iptables.t -index b4b6d677abab1..5d6d3d15cc5fd 100644 ---- a/extensions/iptables.t -+++ b/extensions/iptables.t -@@ -4,3 +4,8 @@ - -i eth+ -o alongifacename+;=;OK - ! -i eth0;=;OK - ! -o eth+;=;OK -+-c "";;FAIL -+-c ,3;;FAIL -+-c 3,;;FAIL -+-c ,;;FAIL -+-c 2,3 -j ACCEPT;-j ACCEPT;OK -diff --git a/iptables/xshared.c b/iptables/xshared.c -index 690502c457dd0..f2e3bc03a2824 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[], - set_option(&cs->options, OPT_COUNTERS, &args->invflags, - invert); - args->pcnt = optarg; -- args->bcnt = strchr(args->pcnt + 1, ','); -+ args->bcnt = strchr(args->pcnt, ','); - if (args->bcnt) - args->bcnt++; - if (!args->bcnt && xs_has_arg(argc, argv)) diff --git a/coreteam-gpg-key-0xD55D978A8A1420E4.txt b/coreteam-gpg-key-0xD55D978A8A1420E4.txt deleted file mode 100644 index 2d3b902..0000000 --- a/coreteam-gpg-key-0xD55D978A8A1420E4.txt +++ /dev/null @@ -1,64 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded -660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi -V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2 -zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t -Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh -KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3 -dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi -WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg -9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj -+IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR -U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB -tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC -VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ -CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6 -+ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd -RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6 -4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN -IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w -bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf -Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj -QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3 -wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb -4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET -tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP -n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV -oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9 -o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S -ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU -tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp -HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM -FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/ -diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid -R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK -uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv -Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl -UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q -KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO -RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc -wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0 -0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+ -q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU -k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk -pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY -plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC -qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu -iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p -jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O -ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1 -CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag -8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB -bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM -jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR -rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg -3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ -7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1 -7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/ -yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8 -leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6 -U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+ -rlbu70nh2kSJrg== -=wukb ------END PGP PUBLIC KEY BLOCK----- diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt new file mode 100644 index 0000000..cd4a35b --- /dev/null +++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -0,0 +1,64 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E +o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+ +2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w +nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ +P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF +qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK +5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz +ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX +u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT +/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b +cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB +tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC +VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ +CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L +LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF +8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL +5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK +AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi +Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR +VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF +RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B +uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE +zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq +ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v +3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X +iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi +wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/ +UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj +M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm +97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E +FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW +IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb +0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF +GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu +bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8 +QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD +Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU +3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR +yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS +C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K +klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I +zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST +Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM +X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh +5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB +woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT +njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl +yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU +hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv +BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj +ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh +hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP +tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s +E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H +fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv +CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT +EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ +gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC +9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W +oD8ElPP+m/v6iA== +=70vD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/iptables.spec b/iptables.spec index 90ba23e..edea0ae 100644 --- a/iptables.spec +++ b/iptables.spec @@ -10,11 +10,11 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables -Version: 1.8.10 -Release: 15%{?dist} +Version: 1.8.11 +Release: 1%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig -Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt +Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt Source3: iptables.init Source4: iptables-config Source5: iptables.service @@ -22,30 +22,6 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-nft-helper -Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch -Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch -Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch -Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch -Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch -Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch -Patch007: 0007-man-Do-not-escape-exclamation-marks.patch -Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch -Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch -Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch -Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch -Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch -Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch -Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch -Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch -Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch -Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch -Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch -Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch -Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch -Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch -Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch -Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch - # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -440,6 +416,7 @@ fi %{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor %{_sbindir}/ebtables-translate +%{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* %{_libexecdir}/arptables-nft-helper @@ -448,6 +425,7 @@ fi %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* +%{_mandir}/man8/arptables-translate* %ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper @@ -456,6 +434,9 @@ fi %changelog +* Fri Nov 08 2024 Phil Sutter - 1.8.11-1 +- new version + * Thu Jul 18 2024 Fedora Release Engineering - 1.8.10-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 6015b94..1f7b750 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153 -SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748 +SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40 +SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2 From f8d67dc298024ae283e050e7af6b1afc23f26bed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 13 Jul 2024 18:27:10 +0200 Subject: [PATCH 24/43] Use %sbin_merge_compat macro for brevity --- iptables.spec | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/iptables.spec b/iptables.spec index edea0ae..c94f3d7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,12 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -161,12 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%if "%{_sbindir}" == "%{_bindir}" -# Compat symlinks for Requires in other packages. -# We rely on filesystem to create the symlinks for us. -Requires: filesystem(unmerged-sbin-symlinks) -Provides: /usr/sbin/iptables -%endif +%sbin_merge_compat /usr/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. From e18ea14e5e3c134b44d50e6456f249f6f3ee6860 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:31:44 +0100 Subject: [PATCH 25/43] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c94f3d7..cb9c4e6 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 1%{?dist} +Release: 2%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -424,6 +424,9 @@ fi %changelog +* Sun Jan 12 2025 Zbigniew JÄ™drzejewski-Szmek - 1.8.11-2 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Fri Nov 08 2024 Phil Sutter - 1.8.11-1 - new version From 43696a4be35ecb64b596d1db368cb736a91316e8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 14 Jan 2025 14:59:44 +0100 Subject: [PATCH 26/43] Keep alternatives symlinks under /usr/sbin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit update-alternatives becomes unhappy when called with paths under /usr/bin and /usr/sbin that are mixed: >>> Non-critical error in post-install scriptlet: iptables-legacy-0:1.8.11-3.fc42.x86_64 >>> Scriptlet output: >>> the primary link for iptables must be /usr/sbin/iptables >>> >>> [RPM] %post(iptables-legacy-1.8.11-3.fc42.x86_64) scriptlet failed, exit status 2 Things will mostly work if we keep using the old path: * On new installs, /usr/sbin will be a symlink, so the /usr/sbin paths will just point to /usr/bin and both sets of paths will work equivalently. * On upgrades, we'll maintain the /usr/sbin paths, which should be fine also, since everything must support using those paths for compatiblity. * The only thing that will not work is the merging of /usr/sbin to ./bin once /usr/sbin only contains symlinks. The scriptlets in filesystem.rpm would need to be adjusted to handle that case (i.e. allow symlinks /usr/sbin/foo → ../bin/foo and /usr/sbin/foo → /etc/alternatives/foo to be removed). This special case can be handled later. --- iptables.spec | 37 +++++++++++++++++++++++-------------- 1 file changed, 23 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index cb9c4e6..66f245a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 2%{?dist} +Release: 3%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -236,11 +236,17 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +%if "%{_sbindir}" == "%{_bindir}" +# We keep those symlinks in /usr/sbin for compatibility +mkdir -p %{buildroot}/usr/sbin +mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +%endif + %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -252,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables /usr/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -265,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -291,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -301,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=/usr/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -317,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=/usr/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -343,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd /usr/sbin/$cmd-nft done fi @@ -355,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -416,14 +422,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 +- Keep symlinks managed by alternatives under /usr/sbin + * Sun Jan 12 2025 Zbigniew JÄ™drzejewski-Szmek - 1.8.11-2 - Rebuilt for the bin-sbin merge (2nd attempt) From 2533c217e52cbe658e05afb25fc6bc2f912fca59 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 07:22:06 +0000 Subject: [PATCH 27/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index 66f245a..b170a43 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 3%{?dist} +Release: 4%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -430,6 +430,9 @@ fi %changelog +* Fri Jan 17 2025 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-3 - Keep symlinks managed by alternatives under /usr/sbin From c8015c16af9b2260f1fda5ccd6920774fc4d2efc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 26 Mar 2025 14:03:28 -0400 Subject: [PATCH 28/43] Flatpak fix for "Keep alternatives symlinks under /usr/sbin" Even if specific %_*dir macros cannot be used, %_prefix must be used at a minimum to refer to the installation path of files from the given package. This is a requirement for flatpak builds. --- iptables.spec | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/iptables.spec b/iptables.spec index b170a43..f211aa9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,7 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -156,7 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -238,15 +238,15 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %if "%{_sbindir}" == "%{_bindir}" # We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +mkdir -p %{buildroot}%{_prefix}/sbin +mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ %endif %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -258,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -271,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -307,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -323,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -349,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -361,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -422,8 +422,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From a1603c18de94a6d18aa110c640ea27941ca5927c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 2 Apr 2025 15:01:46 +0200 Subject: [PATCH 29/43] Assimilate arptables-services Provide the service as part of iptables-services. The arptables-nft-helper was already quite similar to arptables-legacy-helper, it should serve fine for legacy arptables, too. --- arptables-nft-helper => arptables-helper | 0 arptables.service | 12 +++++++++ iptables.spec | 32 ++++++++++++++---------- 3 files changed, 31 insertions(+), 13 deletions(-) rename arptables-nft-helper => arptables-helper (100%) create mode 100644 arptables.service diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index f211aa9..d195a2c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -20,7 +20,8 @@ Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-nft-helper +Source8: arptables-helper +Source9: arptables.service # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -125,6 +126,10 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} BuildArch: noarch %description services @@ -155,6 +160,9 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 %sbin_merge_compat %{_prefix}/sbin/iptables @@ -188,16 +196,18 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -224,9 +234,6 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 @@ -285,14 +292,14 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post iptables.service ip6tables.service +%systemd_post arptables.service iptables.service ip6tables.service %preun services -%systemd_preun iptables.service ip6tables.service +%systemd_preun arptables.service iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun iptables.service ip6tables.service +%systemd_postun arptables.service iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -343,8 +350,7 @@ update-alternatives --install \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} %postun nft if [ $1 -eq 0 ]; then @@ -390,9 +396,11 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%{_unitdir}/{arp,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/arptables-helper %files utils %license COPYING @@ -415,7 +423,6 @@ fi %{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* @@ -424,7 +431,6 @@ fi %{_mandir}/man8/arptables-translate* %ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From 347e497e7205a827bf52674e20c05d5595c100e0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 02:05:13 +0200 Subject: [PATCH 30/43] Assimilate ebtables-services Provide the service as part of iptables-services. --- ebtables-config | 11 +++++ ebtables-helper | 102 +++++++++++++++++++++++++++++++++++++++++++++++ ebtables.service | 11 +++++ iptables.spec | 28 +++++++++---- 4 files changed, 145 insertions(+), 7 deletions(-) create mode 100644 ebtables-config create mode 100644 ebtables-helper create mode 100644 ebtables.service diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index d195a2c..2144ee0 100644 --- a/iptables.spec +++ b/iptables.spec @@ -22,6 +22,9 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-helper Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -130,6 +133,10 @@ Obsoletes: %{name}-ipv6 < 1.4.11.1 Conflicts: %{name}-nft < 1.8.11-5 Obsoletes: arptables-services < 0.0.5-16 Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -196,7 +203,7 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init -install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config @@ -204,10 +211,12 @@ install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6table install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -292,14 +301,17 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post arptables.service iptables.service ip6tables.service +%systemd_post arptables.service ebtables.service +%systemd_post iptables.service ip6tables.service %preun services -%systemd_preun arptables.service iptables.service ip6tables.service +%systemd_preun arptables.service ebtables.service +%systemd_preun iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun arptables.service iptables.service ip6tables.service +%systemd_postun arptables.service ebtables.service +%systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -397,10 +409,12 @@ fi %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} %config(noreplace) %{_sysconfdir}/sysconfig/arptables -%{_unitdir}/{arp,ip,ip6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} -%{_libexecdir}/arptables-helper +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING From 45128b30b581863eee82c03977fd0d57cd301acc Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:50:18 +0200 Subject: [PATCH 31/43] rpmlint: Fix for E: description-line-too-long --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 2144ee0..ce9a1ee 100644 --- a/iptables.spec +++ b/iptables.spec @@ -93,9 +93,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 From e71883b551ebfba9eb6cd16095612d43ad878547 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:52:40 +0200 Subject: [PATCH 32/43] rpmlint: Fix for W: dangling-relative-symlink The %ghost directives in %files sections pick up the symlinks installed by the iptables build system, when in fact these are maintained in Fedora by alternatives. To avoid the confusion, remove them. To avoid causing 'W: zero-perms-ghost', add a %attr statement to the respective %ghost lines. --- iptables.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/iptables.spec b/iptables.spec index ce9a1ee..5efa959 100644 --- a/iptables.spec +++ b/iptables.spec @@ -247,16 +247,11 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}%{_prefix}/sbin -mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ -%endif - %ldconfig_scriptlets %post legacy @@ -378,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -442,8 +437,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From b2d1af398f3799020bc82f5f71a999ccd9dba432 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 11:43:34 +0200 Subject: [PATCH 33/43] spec: Merge common non-symlink removal loops --- iptables.spec | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5efa959..c8927c8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -310,6 +310,23 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_prefix}/sbin/iptables pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ @@ -322,14 +339,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ @@ -338,18 +347,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ From ac4331ac14f14b40c09d5009ca958697c7b8d1a0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 13:15:57 +0200 Subject: [PATCH 34/43] iptables-1.8.11-5 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c8927c8..93641a9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 4%{?dist} +Release: 5%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -441,6 +441,9 @@ fi %changelog +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From b56d83fa63cfe3b2db4f9d3f2e367b17cec36d23 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 20 Apr 2025 09:15:04 -0700 Subject: [PATCH 35/43] Add patch to fix -C handling ( fixes rhbz#2360423 ) --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ++++++++++++++++++ iptables.spec | 8 +- 2 files changed, 179 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 93641a9..177c6fd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 5%{?dist} +Release: 6%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -25,6 +25,9 @@ Source9: arptables.service Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch: iptables-1.8.11-fix-interface-comparisons.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -441,6 +444,9 @@ fi %changelog +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + * Thu Apr 03 2025 Phil Sutter - 1.8.11-5 - iptables-services to assimilate arptables- and ebtables-services From 046b2467b46a166204cecce9a6adc5ccfbd09031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 12 Mar 2025 16:06:49 +0100 Subject: [PATCH 36/43] Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit 43696a4be35ecb64b596d1db368cb736a91316e8 and also the follow-up work from c8015c16af9b2260f1fda5ccd6920774fc4d2efc. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected. Issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2361004. --- iptables.spec | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/iptables.spec b/iptables.spec index 177c6fd..bc9f667 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 6%{?dist} +Release: 7%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -271,7 +272,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -315,7 +316,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_prefix}/sbin/{eb,arp}tables; do +for pfx in %{_sbindir}/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -330,8 +331,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +341,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +349,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -361,7 +362,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +374,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +438,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + * Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 - Add patch to fix -C handling ( fixes rhbz#2360423 ) From 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Sat, 3 May 2025 23:22:49 +0200 Subject: [PATCH 37/43] Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit 046b2467b46a166204cecce9a6adc5ccfbd09031. These changes break systems, see bz#2362648 and bz#2362808 for details. --- iptables.spec | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/iptables.spec b/iptables.spec index bc9f667..fac1bbf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 7%{?dist} +Release: 8%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,7 +64,6 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -259,8 +258,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -272,7 +271,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -285,8 +284,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -316,7 +315,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_sbindir}/{eb,arp}tables; do +for pfx in %{_prefix}/sbin/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -331,8 +330,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -341,7 +340,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -349,7 +348,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -362,7 +361,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -374,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -438,13 +437,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + * Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 - Keep symlinks managed by alternatives under /usr/bin From 90a211ef7302c29a98a674de8afb3f6c7a0ab3ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 7 May 2025 16:30:51 +0200 Subject: [PATCH 38/43] Move iptables symlinks to /usr/bin again This partially reverts commit 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems. --- iptables.spec | 60 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index fac1bbf..edcea9a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 8%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -268,10 +269,19 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +294,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,6 +307,15 @@ alternatives --set iptables $(/dev/null || : +done +%endif + %post services %systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service @@ -330,8 +349,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +359,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +367,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -358,10 +377,19 @@ update-alternatives --install \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +401,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +465,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + * Sat May 03 2025 Phil Sutter - 1.8.11-8 - Revert last release, it breaks alternatives symlinks From 6f0696f58a45a6c3265c6d9837e06da2ffce5270 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 13 May 2025 10:55:45 +0200 Subject: [PATCH 39/43] Use modern option name for "follower" symlinks --- iptables.spec | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/iptables.spec b/iptables.spec index edcea9a..b5d83c1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -263,11 +263,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -298,11 +298,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $( Date: Tue, 20 May 2025 23:54:42 +0200 Subject: [PATCH 40/43] Fix for ghost files not present in iptables-nft RPM When fixing for rpmlint warnings, the standard symlinks installed by package's 'make install' were removed but they are in fact necessary for the globbing in %files section to happen. Replace them by empty files after removal to fix this. Fixes: e71883b551ebfba9eb6cd16095612d43ad878547 --- iptables.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index b5d83c1..c7216fb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -251,7 +251,8 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml From cc26decabc00149c006f76fc10450ce15d707077 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 20 May 2025 23:59:29 +0200 Subject: [PATCH 41/43] iptables-1.8.11-10 - Fix for ghost files not present in iptables-nft RPM Resolves: rhbz#2365424 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c7216fb..cdf4f66 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 9%{?dist} +Release: 10%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + * Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged. From 8ce4421d204c44131cbdc96465cafcb1f5f71288 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:46:02 +0000 Subject: [PATCH 42/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index cdf4f66..837bf0a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Phil Sutter - 1.8.11-10 - Fix for ghost files not present in iptables-nft RPM From 6a017827bbf2ff7454a8f3f45937124175c05e43 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Oct 2025 11:21:29 -0400 Subject: [PATCH 43/43] - Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. --- iptables-1.8.11-command-options-fix.patch | 27 +++++++++++++++++++++++ iptables.spec | 10 +++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 iptables-1.8.11-command-options-fix.patch diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables.spec b/iptables.spec index 837bf0a..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -27,7 +27,10 @@ Source11: ebtables-helper Source12: ebtables-config # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch: iptables-1.8.11-fix-interface-comparisons.patch +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -473,6 +476,9 @@ fi %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + * Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild