Compare commits
5 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
88cf200031 | ||
|
|
bf5cb46f73 | ||
|
|
2a5e6415c7 | ||
|
|
7ceca60847 | ||
|
|
d7a6e51ad5 |
29 changed files with 1906 additions and 10 deletions
|
|
@ -1,4 +1,4 @@
|
|||
From 1dba0d0a2c9c269dc5ed9e7d841b8ecb9dc060af Mon Sep 17 00:00:00 2001
|
||||
From ef37183c65bc1c69c8fdb198d9ee500cb7b394e5 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <psutter@redhat.com>
|
||||
Date: Fri, 12 Apr 2019 18:02:19 +0200
|
||||
Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
|
||||
|
|
@ -31,5 +31,5 @@ index 819ca4a459c42..a685b6bbcd7dc 100755
|
|||
FPE USR1 SEGV USR2 PIPE ALRM TERM
|
||||
|
||||
--
|
||||
2.21.0
|
||||
2.27.0
|
||||
|
||||
|
|
|
|||
33
0002-Fix-DEBUG-build.patch
Normal file
33
0002-Fix-DEBUG-build.patch
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
From 1c05f5907661207a61767db6b0d8e5e7bb60f5be Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 4 Dec 2019 09:36:59 +0100
|
||||
Subject: [PATCH] Fix DEBUG build
|
||||
|
||||
Fixed commit missed to update this conditional call to
|
||||
nft_rule_print_save().
|
||||
|
||||
Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-shared.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index 78e422781723f..426765641cff6 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
||||
|
||||
DEBUGP("comparing with... ");
|
||||
#ifdef DEBUG_DEL
|
||||
- nft_rule_print_save(r, NFT_RULE_APPEND, 0);
|
||||
+ nft_rule_print_save(h, r, NFT_RULE_APPEND, 0);
|
||||
#endif
|
||||
if (!h->ops->is_same(cs, &this))
|
||||
goto out;
|
||||
--
|
||||
2.27.0
|
||||
|
||||
59
0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch
Normal file
59
0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
From d46cba8bb28f3f57969ae36355801b1aade26983 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 4 Dec 2019 09:56:06 +0100
|
||||
Subject: [PATCH] xtables-restore: Fix parser feed from line buffer
|
||||
|
||||
When called with --noflush, xtables-restore would trip over chain lines:
|
||||
Parser uses strtok() to separate chain name, policy and counters which
|
||||
inserts nul-chars into the source string. Therefore strlen() can't be
|
||||
used anymore to find end of line. Fix this by caching line length before
|
||||
calling xtables_restore_parse_line().
|
||||
|
||||
Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
.../testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++
|
||||
iptables/xtables-restore.c | 4 +++-
|
||||
2 files changed, 13 insertions(+), 1 deletion(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
||||
new file mode 100755
|
||||
index 0000000000000..739e684a21183
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
||||
@@ -0,0 +1,10 @@
|
||||
+#!/bin/sh -e
|
||||
+
|
||||
+# assert input feed from buffer doesn't trip over
|
||||
+# added nul-chars from parsing chain line.
|
||||
+
|
||||
+$XT_MULTI iptables-restore --noflush <<EOF
|
||||
+*filter
|
||||
+:foobar - [0:0]
|
||||
+-A foobar -j ACCEPT
|
||||
+COMMIT
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index 2f0fe7d439d94..dd907e0b8ddd5 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -327,10 +327,12 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
line = 0;
|
||||
ptr = preload_buffer;
|
||||
while (*ptr) {
|
||||
+ size_t len = strlen(ptr);
|
||||
+
|
||||
h->error.lineno = ++line;
|
||||
DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr);
|
||||
xtables_restore_parse_line(h, p, &state, ptr);
|
||||
- ptr += strlen(ptr) + 1;
|
||||
+ ptr += len + 1;
|
||||
}
|
||||
if (*buffer) {
|
||||
h->error.lineno = ++line;
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
From 6ecf9d7f0ed60afdbd3637cc40e91a0b2d86d21c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 5 Dec 2019 11:40:26 +0100
|
||||
Subject: [PATCH] xtables-restore: Avoid access of uninitialized data
|
||||
|
||||
When flushing, 'buffer' is not written to prior to checking its first
|
||||
byte's value. Therefore it needs to be initialized upon declaration.
|
||||
|
||||
Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
|
||||
(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-restore.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index dd907e0b8ddd5..63cc15cee9621 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
const struct nft_xt_restore_parse *p)
|
||||
{
|
||||
struct nft_xt_restore_state state = {};
|
||||
- char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr;
|
||||
+ char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr;
|
||||
|
||||
if (!h->noflush) {
|
||||
nft_fake_cache(h);
|
||||
--
|
||||
2.27.0
|
||||
|
||||
31
0005-extensions-time-Avoid-undefined-shift.patch
Normal file
31
0005-extensions-time-Avoid-undefined-shift.patch
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
From 51ec6fb324ae61a1c4e6ee8514f8b13efb14b4fd Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 5 Dec 2019 13:15:01 +0100
|
||||
Subject: [PATCH] extensions: time: Avoid undefined shift
|
||||
|
||||
Value 1 is signed by default and left-shifting by 31 is undefined for
|
||||
those. Fix this by marking the value as unsigned.
|
||||
|
||||
Fixes: ad326ef9f734a ("Add the libxt_time iptables match")
|
||||
(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_time.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c
|
||||
index 5a8cc5de13031..d001f5b7f448f 100644
|
||||
--- a/extensions/libxt_time.c
|
||||
+++ b/extensions/libxt_time.c
|
||||
@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable)
|
||||
|
||||
printf(" ");
|
||||
for (i = 1; i <= 31; ++i)
|
||||
- if (mask & (1 << i)) {
|
||||
+ if (mask & (1u << i)) {
|
||||
if (nbdays++ > 0)
|
||||
printf(",");
|
||||
printf("%u", i);
|
||||
--
|
||||
2.27.0
|
||||
|
||||
31
0006-extensions-cluster-Avoid-undefined-shift.patch
Normal file
31
0006-extensions-cluster-Avoid-undefined-shift.patch
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
From b32190bee5a3b9fef63a32fa7f43edd1021e2ee9 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 5 Dec 2019 13:36:31 +0100
|
||||
Subject: [PATCH] extensions: cluster: Avoid undefined shift
|
||||
|
||||
Value 1 is signed by default and left-shifting by 31 is undefined for
|
||||
those. Fix this by marking the value as unsigned.
|
||||
|
||||
Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft")
|
||||
(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_cluster.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c
|
||||
index c9c35ee22e3df..d164bf6960166 100644
|
||||
--- a/extensions/libxt_cluster.c
|
||||
+++ b/extensions/libxt_cluster.c
|
||||
@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl,
|
||||
xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st,
|
||||
info->total_nodes, info->hash_seed);
|
||||
for (node = 0; node < 32; node++) {
|
||||
- if (info->node_mask & (1 << node)) {
|
||||
+ if (info->node_mask & (1u << node)) {
|
||||
if (needs_set == 0) {
|
||||
xt_xlate_add(xl, "{ ");
|
||||
needs_set = 1;
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
From 3d43932ba38f041c72902b894f9f90486a1a200f Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 5 Dec 2019 16:01:29 +0100
|
||||
Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname()
|
||||
|
||||
The function potentially fed overlong strings to strcpy(). Given that
|
||||
everything needed to avoid this is there, reorder code a bit to prevent
|
||||
those inputs, too.
|
||||
|
||||
Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft")
|
||||
(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-translate.c | 5 ++---
|
||||
1 file changed, 2 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index a42c60a3b64c6..77a186b905d73 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -32,14 +32,13 @@
|
||||
void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
|
||||
bool invert)
|
||||
{
|
||||
+ int ifaclen = strlen(ifname);
|
||||
char iface[IFNAMSIZ];
|
||||
- int ifaclen;
|
||||
|
||||
- if (ifname[0] == '\0')
|
||||
+ if (ifaclen < 1 || ifaclen >= IFNAMSIZ)
|
||||
return;
|
||||
|
||||
strcpy(iface, ifname);
|
||||
- ifaclen = strlen(iface);
|
||||
if (iface[ifaclen - 1] == '+')
|
||||
iface[ifaclen - 1] = '*';
|
||||
|
||||
--
|
||||
2.27.0
|
||||
|
||||
41
0008-extensions-among-Check-call-to-fstat.patch
Normal file
41
0008-extensions-among-Check-call-to-fstat.patch
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
From b1b60022ea6ece431f372e5c850c62ede97e61ad Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 5 Dec 2019 16:35:51 +0100
|
||||
Subject: [PATCH] extensions: among: Check call to fstat()
|
||||
|
||||
If this fails, a bogus length value may be passed to mmap().
|
||||
|
||||
Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
|
||||
(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libebt_among.c | 6 +++++-
|
||||
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
|
||||
index 2e87db3bc06fa..715d559f432c2 100644
|
||||
--- a/extensions/libebt_among.c
|
||||
+++ b/extensions/libebt_among.c
|
||||
@@ -6,6 +6,7 @@
|
||||
* August, 2003
|
||||
*/
|
||||
|
||||
+#include <errno.h>
|
||||
#include <ctype.h>
|
||||
#include <fcntl.h>
|
||||
#include <getopt.h>
|
||||
@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert,
|
||||
if ((fd = open(optarg, O_RDONLY)) == -1)
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"Couldn't open file '%s'", optarg);
|
||||
- fstat(fd, &stats);
|
||||
+ if (fstat(fd, &stats) < 0)
|
||||
+ xtables_error(PARAMETER_PROBLEM,
|
||||
+ "fstat(%s) failed: '%s'",
|
||||
+ optarg, strerror(errno));
|
||||
flen = stats.st_size;
|
||||
/* use mmap because the file will probably be big */
|
||||
optarg = mmap(0, flen, PROT_READ | PROT_WRITE,
|
||||
--
|
||||
2.27.0
|
||||
|
||||
78
0009-xtables-restore-fix-for-noflush-and-empty-lines.patch
Normal file
78
0009-xtables-restore-fix-for-noflush-and-empty-lines.patch
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
From 8c54e14a9d7e1fcfd30481cb50ec577edce5ce34 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 11 Feb 2020 16:52:59 +0100
|
||||
Subject: [PATCH] xtables-restore: fix for --noflush and empty lines
|
||||
|
||||
Lookahead buffer used for cache requirements estimate in restore
|
||||
--noflush separates individual lines with nul-chars. Two consecutive
|
||||
nul-chars are interpreted as end of buffer and remaining buffer content
|
||||
is skipped.
|
||||
|
||||
Sadly, reading an empty line (i.e., one containing a newline character
|
||||
only) caused double nul-chars to appear in buffer as well, leading to
|
||||
premature stop when reading cached lines from buffer.
|
||||
|
||||
To fix that, make use of xtables_restore_parse_line() skipping empty
|
||||
lines without calling strtok() and just leave the newline character in
|
||||
place. A more intuitive approach, namely skipping empty lines while
|
||||
buffering, is deliberately not chosen as that would cause wrong values
|
||||
in 'line' variable.
|
||||
|
||||
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400
|
||||
Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
|
||||
(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
.../ipt-restore/0011-noflush-empty-line_0 | 16 ++++++++++++++++
|
||||
iptables/xtables-restore.c | 8 +++++---
|
||||
2 files changed, 21 insertions(+), 3 deletions(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
|
||||
new file mode 100755
|
||||
index 0000000000000..bea1a690bb624
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
|
||||
@@ -0,0 +1,16 @@
|
||||
+#!/bin/bash -e
|
||||
+
|
||||
+# make sure empty lines won't break --noflush
|
||||
+
|
||||
+cat <<EOF | $XT_MULTI iptables-restore --noflush
|
||||
+# just a comment followed by innocent empty line
|
||||
+
|
||||
+*filter
|
||||
+-A FORWARD -j ACCEPT
|
||||
+COMMIT
|
||||
+EOF
|
||||
+
|
||||
+EXPECT='Chain FORWARD (policy ACCEPT)
|
||||
+target prot opt source destination
|
||||
+ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 '
|
||||
+diff -u <(echo "$EXPECT") <($XT_MULTI iptables -n -L FORWARD)
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index 63cc15cee9621..fb2ac8b5c12a3 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -293,11 +293,13 @@ void xtables_restore_parse(struct nft_handle *h,
|
||||
while (fgets(buffer, sizeof(buffer), p->in)) {
|
||||
size_t blen = strlen(buffer);
|
||||
|
||||
- /* drop trailing newline; xtables_restore_parse_line()
|
||||
+ /* Drop trailing newline; xtables_restore_parse_line()
|
||||
* uses strtok() which replaces them by nul-characters,
|
||||
* causing unpredictable string delimiting in
|
||||
- * preload_buffer */
|
||||
- if (buffer[blen - 1] == '\n')
|
||||
+ * preload_buffer.
|
||||
+ * Unless this is an empty line which would fold into a
|
||||
+ * spurious EoB indicator (double nul-char). */
|
||||
+ if (buffer[blen - 1] == '\n' && blen > 1)
|
||||
buffer[blen - 1] = '\0';
|
||||
else
|
||||
blen++;
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
From 604b7f0cf8dfeb25db7d739995e49f88fd9dbd45 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 5 Dec 2019 13:57:18 +0100
|
||||
Subject: [PATCH] libxtables: Avoid buffer overrun in
|
||||
xtables_compatible_revision()
|
||||
|
||||
The function is exported and accepts arbitrary strings as input. Calling
|
||||
strcpy() without length checks is not OK.
|
||||
|
||||
(cherry picked from commit f7d3dbb82e7ed94ccbf10cf70a3c7b3f3aaef1a1)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
libxtables/xtables.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index 895f6988eaf57..777c2b08e9896 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -856,7 +856,8 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt)
|
||||
|
||||
xtables_load_ko(xtables_modprobe_program, true);
|
||||
|
||||
- strcpy(rev.name, name);
|
||||
+ strncpy(rev.name, name, XT_EXTENSION_MAXNAMELEN - 1);
|
||||
+ rev.name[XT_EXTENSION_MAXNAMELEN - 1] = '\0';
|
||||
rev.revision = revision;
|
||||
|
||||
max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s);
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
From 347fdad75554acc0a356f976920946aec6ab52a5 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <psutter@redhat.com>
|
||||
Date: Tue, 10 Dec 2019 12:27:13 +0100
|
||||
Subject: [PATCH] uapi: netfilter: Avoid undefined left-shift in xt_sctp.h
|
||||
|
||||
This is a backport of kernel commit 164166558aace ("netfilter: uapi:
|
||||
Avoid undefined left-shift in xt_sctp.h").
|
||||
|
||||
(cherry picked from commit fe1ac5eaa8ae482c9112aed6b89f9f2e529f4516)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
include/linux/netfilter/xt_sctp.h | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/include/linux/netfilter/xt_sctp.h b/include/linux/netfilter/xt_sctp.h
|
||||
index a501e6196905d..5b28525a2482a 100644
|
||||
--- a/include/linux/netfilter/xt_sctp.h
|
||||
+++ b/include/linux/netfilter/xt_sctp.h
|
||||
@@ -40,19 +40,19 @@ struct xt_sctp_info {
|
||||
#define SCTP_CHUNKMAP_SET(chunkmap, type) \
|
||||
do { \
|
||||
(chunkmap)[type / bytes(__u32)] |= \
|
||||
- 1 << (type % bytes(__u32)); \
|
||||
+ 1u << (type % bytes(__u32)); \
|
||||
} while (0)
|
||||
|
||||
#define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
|
||||
do { \
|
||||
(chunkmap)[type / bytes(__u32)] &= \
|
||||
- ~(1 << (type % bytes(__u32))); \
|
||||
+ ~(1u << (type % bytes(__u32))); \
|
||||
} while (0)
|
||||
|
||||
#define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
|
||||
({ \
|
||||
((chunkmap)[type / bytes (__u32)] & \
|
||||
- (1 << (type % bytes (__u32)))) ? 1: 0; \
|
||||
+ (1u << (type % bytes (__u32)))) ? 1: 0; \
|
||||
})
|
||||
|
||||
#define SCTP_CHUNKMAP_RESET(chunkmap) \
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
From 1af5c5eacd8cbfe1d942ac5c59fce9ca007aa43a Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 6 Feb 2020 15:08:41 +0100
|
||||
Subject: [PATCH] xtables-translate: Fix for interface name corner-cases
|
||||
|
||||
There are two special situations xlate_ifname() didn't cover for:
|
||||
|
||||
* Interface name containing '*': This went unchanged, creating a command
|
||||
nft wouldn't accept. Instead translate into '\*' which doesn't change
|
||||
semantics.
|
||||
|
||||
* Interface name being '+': Can't translate into nft wildcard character
|
||||
as nft doesn't accept asterisk-only interface names. Instead decide
|
||||
what to do based on 'invert' value: Skip match creation if false,
|
||||
match against an invalid interface name if true.
|
||||
|
||||
Also add a test to make sure future changes to this behaviour are
|
||||
noticed.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit e179e87a1179e272a9bdabb0220b17d61d099ee3)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/generic.txlate | 12 ++++++++++++
|
||||
iptables/xtables-translate.c | 33 ++++++++++++++++++++++++++++-----
|
||||
2 files changed, 40 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/extensions/generic.txlate b/extensions/generic.txlate
|
||||
index b38fbd1fe113b..c92d082abea78 100644
|
||||
--- a/extensions/generic.txlate
|
||||
+++ b/extensions/generic.txlate
|
||||
@@ -18,3 +18,15 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi
|
||||
|
||||
ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
|
||||
nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
|
||||
+
|
||||
+# asterisk is not special in iptables and it is even a valid interface name
|
||||
+iptables-translate -A FORWARD -i '*' -o 'eth*foo'
|
||||
+nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
|
||||
+
|
||||
+# skip for always matching interface names
|
||||
+iptables-translate -A FORWARD -i '+'
|
||||
+nft add rule ip filter FORWARD counter
|
||||
+
|
||||
+# match against invalid interface name to simulate never matching rule
|
||||
+iptables-translate -A FORWARD ! -i '+'
|
||||
+nft add rule ip filter FORWARD iifname "INVAL/D" counter
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index 77a186b905d73..c4e177c0d63ba 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -32,15 +32,38 @@
|
||||
void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
|
||||
bool invert)
|
||||
{
|
||||
- int ifaclen = strlen(ifname);
|
||||
- char iface[IFNAMSIZ];
|
||||
+ int ifaclen = strlen(ifname), i, j;
|
||||
+ char iface[IFNAMSIZ * 2];
|
||||
|
||||
if (ifaclen < 1 || ifaclen >= IFNAMSIZ)
|
||||
return;
|
||||
|
||||
- strcpy(iface, ifname);
|
||||
- if (iface[ifaclen - 1] == '+')
|
||||
- iface[ifaclen - 1] = '*';
|
||||
+ for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
|
||||
+ switch (ifname[i]) {
|
||||
+ case '+':
|
||||
+ iface[j] = '*';
|
||||
+ break;
|
||||
+ case '*':
|
||||
+ iface[j++] = '\\';
|
||||
+ /* fall through */
|
||||
+ default:
|
||||
+ iface[j] = ifname[i];
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (ifaclen == 1 && ifname[0] == '+') {
|
||||
+ /* Nftables does not support wildcard only string. Workaround
|
||||
+ * is easy, given that this will match always or never
|
||||
+ * depending on 'invert' value. To match always, simply don't
|
||||
+ * generate an expression. To match never, use an invalid
|
||||
+ * interface name (kernel doesn't accept '/' in names) to match
|
||||
+ * against. */
|
||||
+ if (!invert)
|
||||
+ return;
|
||||
+ strcpy(iface, "INVAL/D");
|
||||
+ invert = false;
|
||||
+ }
|
||||
|
||||
xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface);
|
||||
}
|
||||
--
|
||||
2.27.0
|
||||
|
||||
60
0013-xtables-translate-Fix-for-iface.patch
Normal file
60
0013-xtables-translate-Fix-for-iface.patch
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
From 027cdbb0e64904aac90f878c2491059443f92b60 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 13 Feb 2020 14:01:50 +0100
|
||||
Subject: [PATCH] xtables-translate: Fix for iface++
|
||||
|
||||
In legacy iptables, only the last plus sign remains special, any
|
||||
previous ones are taken literally. Therefore xtables-translate must not
|
||||
replace all of them with asterisk but just the last one.
|
||||
|
||||
Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 94488d4eb912f5af4c88d148b39b38eb8a3c1f0b)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/generic.txlate | 4 ++++
|
||||
iptables/xtables-translate.c | 6 +++---
|
||||
2 files changed, 7 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/extensions/generic.txlate b/extensions/generic.txlate
|
||||
index c92d082abea78..0e256c3727559 100644
|
||||
--- a/extensions/generic.txlate
|
||||
+++ b/extensions/generic.txlate
|
||||
@@ -23,6 +23,10 @@ nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:
|
||||
iptables-translate -A FORWARD -i '*' -o 'eth*foo'
|
||||
nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
|
||||
|
||||
+# escape all asterisks but translate only the first plus character
|
||||
+iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
|
||||
+nft add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter
|
||||
+
|
||||
# skip for always matching interface names
|
||||
iptables-translate -A FORWARD -i '+'
|
||||
nft add rule ip filter FORWARD counter
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index c4e177c0d63ba..0f95855b41aa4 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -40,9 +40,6 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
|
||||
|
||||
for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
|
||||
switch (ifname[i]) {
|
||||
- case '+':
|
||||
- iface[j] = '*';
|
||||
- break;
|
||||
case '*':
|
||||
iface[j++] = '\\';
|
||||
/* fall through */
|
||||
@@ -65,6 +62,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
|
||||
invert = false;
|
||||
}
|
||||
|
||||
+ if (iface[j - 2] == '+')
|
||||
+ iface[j - 2] = '*';
|
||||
+
|
||||
xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface);
|
||||
}
|
||||
|
||||
--
|
||||
2.27.0
|
||||
|
||||
274
0014-xtables-Review-nft_init.patch
Normal file
274
0014-xtables-Review-nft_init.patch
Normal file
|
|
@ -0,0 +1,274 @@
|
|||
From 60206ee04840303b4b8e7edc8fa0359633aabcbe Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 21 Feb 2020 14:55:52 +0100
|
||||
Subject: [PATCH] xtables: Review nft_init()
|
||||
|
||||
Move common code into nft_init(), such as:
|
||||
|
||||
* initial zeroing nft_handle fields
|
||||
* family ops lookup and assignment to 'ops' field
|
||||
* setting of 'family' field
|
||||
|
||||
This requires minor adjustments in xtables_restore_main() so extra field
|
||||
initialization doesn't happen before nft_init() call.
|
||||
|
||||
As a side-effect, this fixes segfaulting xtables-monitor binary when
|
||||
printing rules for trace event as in that code-path 'ops' field wasn't
|
||||
initialized.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit d0446ab11182f6ca2adc486a124895f09a220c6e)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 9 ++++++++-
|
||||
iptables/nft.h | 2 +-
|
||||
iptables/xtables-arp.c | 9 +--------
|
||||
iptables/xtables-eb.c | 9 +--------
|
||||
iptables/xtables-monitor.c | 2 +-
|
||||
iptables/xtables-restore.c | 14 +++++++-------
|
||||
iptables/xtables-save.c | 9 ++-------
|
||||
iptables/xtables-standalone.c | 6 ++----
|
||||
iptables/xtables-translate.c | 2 +-
|
||||
iptables/xtables.c | 4 ----
|
||||
10 files changed, 24 insertions(+), 42 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 3f2a62ae12c07..0287add3fb21f 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -789,8 +789,10 @@ int nft_restart(struct nft_handle *h)
|
||||
return 0;
|
||||
}
|
||||
|
||||
-int nft_init(struct nft_handle *h, const struct builtin_table *t)
|
||||
+int nft_init(struct nft_handle *h, int family, const struct builtin_table *t)
|
||||
{
|
||||
+ memset(h, 0, sizeof(*h));
|
||||
+
|
||||
h->nl = mnl_socket_open(NETLINK_NETFILTER);
|
||||
if (h->nl == NULL)
|
||||
return -1;
|
||||
@@ -800,9 +802,14 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ h->ops = nft_family_ops_lookup(family);
|
||||
+ if (!h->ops)
|
||||
+ xtables_error(PARAMETER_PROBLEM, "Unknown family");
|
||||
+
|
||||
h->portid = mnl_socket_get_portid(h->nl);
|
||||
h->tables = t;
|
||||
h->cache = &h->__cache[0];
|
||||
+ h->family = family;
|
||||
|
||||
INIT_LIST_HEAD(&h->obj_list);
|
||||
INIT_LIST_HEAD(&h->err_list);
|
||||
diff --git a/iptables/nft.h b/iptables/nft.h
|
||||
index 51b5660314c0c..5cf260a6d2cd3 100644
|
||||
--- a/iptables/nft.h
|
||||
+++ b/iptables/nft.h
|
||||
@@ -80,7 +80,7 @@ extern const struct builtin_table xtables_bridge[NFT_TABLE_MAX];
|
||||
int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
|
||||
int (*cb)(const struct nlmsghdr *nlh, void *data),
|
||||
void *data);
|
||||
-int nft_init(struct nft_handle *h, const struct builtin_table *t);
|
||||
+int nft_init(struct nft_handle *h, int family, const struct builtin_table *t);
|
||||
void nft_fini(struct nft_handle *h);
|
||||
int nft_restart(struct nft_handle *h);
|
||||
|
||||
diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
|
||||
index 9cfad76263d32..c8196f08baa59 100644
|
||||
--- a/iptables/xtables-arp.c
|
||||
+++ b/iptables/xtables-arp.c
|
||||
@@ -500,17 +500,10 @@ int nft_init_arp(struct nft_handle *h, const char *pname)
|
||||
init_extensionsa();
|
||||
#endif
|
||||
|
||||
- memset(h, 0, sizeof(*h));
|
||||
- h->family = NFPROTO_ARP;
|
||||
-
|
||||
- if (nft_init(h, xtables_arp) < 0)
|
||||
+ if (nft_init(h, NFPROTO_ARP, xtables_arp) < 0)
|
||||
xtables_error(OTHER_PROBLEM,
|
||||
"Could not initialize nftables layer.");
|
||||
|
||||
- h->ops = nft_family_ops_lookup(h->family);
|
||||
- if (h->ops == NULL)
|
||||
- xtables_error(PARAMETER_PROBLEM, "Unknown family");
|
||||
-
|
||||
return 0;
|
||||
}
|
||||
|
||||
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
|
||||
index 15b971da3d425..c006bc95ac681 100644
|
||||
--- a/iptables/xtables-eb.c
|
||||
+++ b/iptables/xtables-eb.c
|
||||
@@ -739,16 +739,9 @@ int nft_init_eb(struct nft_handle *h, const char *pname)
|
||||
init_extensionsb();
|
||||
#endif
|
||||
|
||||
- memset(h, 0, sizeof(*h));
|
||||
-
|
||||
- h->family = NFPROTO_BRIDGE;
|
||||
-
|
||||
- if (nft_init(h, xtables_bridge) < 0)
|
||||
+ if (nft_init(h, NFPROTO_BRIDGE, xtables_bridge) < 0)
|
||||
xtables_error(OTHER_PROBLEM,
|
||||
"Could not initialize nftables layer.");
|
||||
- h->ops = nft_family_ops_lookup(h->family);
|
||||
- if (!h->ops)
|
||||
- xtables_error(PARAMETER_PROBLEM, "Unknown family");
|
||||
|
||||
/* manually registering ebt matches, given the original ebtables parser
|
||||
* don't use '-m matchname' and the match can't be loaded dynamically when
|
||||
diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
|
||||
index a5245d1422af9..c2b31dbaa0795 100644
|
||||
--- a/iptables/xtables-monitor.c
|
||||
+++ b/iptables/xtables-monitor.c
|
||||
@@ -615,7 +615,7 @@ int xtables_monitor_main(int argc, char *argv[])
|
||||
init_extensions4();
|
||||
#endif
|
||||
|
||||
- if (nft_init(&h, xtables_ipv4)) {
|
||||
+ if (nft_init(&h, AF_INET, xtables_ipv4)) {
|
||||
fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
|
||||
xtables_globals.program_name,
|
||||
xtables_globals.program_version,
|
||||
diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
|
||||
index fb2ac8b5c12a3..11834c0ea98c5 100644
|
||||
--- a/iptables/xtables-restore.c
|
||||
+++ b/iptables/xtables-restore.c
|
||||
@@ -360,15 +360,13 @@ static int
|
||||
xtables_restore_main(int family, const char *progname, int argc, char *argv[])
|
||||
{
|
||||
const struct builtin_table *tables;
|
||||
- struct nft_handle h = {
|
||||
- .family = family,
|
||||
- .restore = true,
|
||||
- };
|
||||
- int c;
|
||||
struct nft_xt_restore_parse p = {
|
||||
.commit = true,
|
||||
.cb = &restore_cb,
|
||||
};
|
||||
+ bool noflush = false;
|
||||
+ struct nft_handle h;
|
||||
+ int c;
|
||||
|
||||
line = 0;
|
||||
|
||||
@@ -402,7 +400,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
|
||||
print_usage(prog_name, PACKAGE_VERSION);
|
||||
exit(0);
|
||||
case 'n':
|
||||
- h.noflush = 1;
|
||||
+ noflush = true;
|
||||
break;
|
||||
case 'M':
|
||||
xtables_modprobe_program = optarg;
|
||||
@@ -464,13 +462,15 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
|
||||
return 1;
|
||||
}
|
||||
|
||||
- if (nft_init(&h, tables) < 0) {
|
||||
+ if (nft_init(&h, family, tables) < 0) {
|
||||
fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
|
||||
xtables_globals.program_name,
|
||||
xtables_globals.program_version,
|
||||
strerror(errno));
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
+ h.noflush = noflush;
|
||||
+ h.restore = true;
|
||||
|
||||
xtables_restore_parse(&h, &p);
|
||||
|
||||
diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
|
||||
index 3a52f8c3d8209..228282deaed07 100644
|
||||
--- a/iptables/xtables-save.c
|
||||
+++ b/iptables/xtables-save.c
|
||||
@@ -139,10 +139,8 @@ xtables_save_main(int family, int argc, char *argv[],
|
||||
struct do_output_data d = {
|
||||
.format = FMT_NOCOUNTS,
|
||||
};
|
||||
+ struct nft_handle h;
|
||||
bool dump = false;
|
||||
- struct nft_handle h = {
|
||||
- .family = family,
|
||||
- };
|
||||
FILE *file = NULL;
|
||||
int ret, c;
|
||||
|
||||
@@ -242,16 +240,13 @@ xtables_save_main(int family, int argc, char *argv[],
|
||||
return 1;
|
||||
}
|
||||
|
||||
- if (nft_init(&h, tables) < 0) {
|
||||
+ if (nft_init(&h, family, tables) < 0) {
|
||||
fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
|
||||
xtables_globals.program_name,
|
||||
xtables_globals.program_version,
|
||||
strerror(errno));
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
- h.ops = nft_family_ops_lookup(h.family);
|
||||
- if (!h.ops)
|
||||
- xtables_error(PARAMETER_PROBLEM, "Unknown family");
|
||||
|
||||
ret = do_output(&h, tablename, &d);
|
||||
nft_fini(&h);
|
||||
diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
|
||||
index 1a28c5480629f..022d5dd44abbf 100644
|
||||
--- a/iptables/xtables-standalone.c
|
||||
+++ b/iptables/xtables-standalone.c
|
||||
@@ -44,9 +44,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
|
||||
{
|
||||
int ret;
|
||||
char *table = "filter";
|
||||
- struct nft_handle h = {
|
||||
- .family = family,
|
||||
- };
|
||||
+ struct nft_handle h;
|
||||
|
||||
xtables_globals.program_name = progname;
|
||||
ret = xtables_init_all(&xtables_globals, family);
|
||||
@@ -61,7 +59,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
|
||||
init_extensions4();
|
||||
#endif
|
||||
|
||||
- if (nft_init(&h, xtables_ipv4) < 0) {
|
||||
+ if (nft_init(&h, family, xtables_ipv4) < 0) {
|
||||
fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
|
||||
xtables_globals.program_name,
|
||||
xtables_globals.program_version,
|
||||
diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
|
||||
index 0f95855b41aa4..76ad7eb69eca9 100644
|
||||
--- a/iptables/xtables-translate.c
|
||||
+++ b/iptables/xtables-translate.c
|
||||
@@ -480,7 +480,7 @@ static int xtables_xlate_main_common(struct nft_handle *h,
|
||||
return 1;
|
||||
}
|
||||
|
||||
- if (nft_init(h, tables) < 0) {
|
||||
+ if (nft_init(h, family, tables) < 0) {
|
||||
fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
|
||||
xtables_globals.program_name,
|
||||
xtables_globals.program_version,
|
||||
diff --git a/iptables/xtables.c b/iptables/xtables.c
|
||||
index 8f9dc628d0029..4b24d15c46295 100644
|
||||
--- a/iptables/xtables.c
|
||||
+++ b/iptables/xtables.c
|
||||
@@ -571,10 +571,6 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
|
||||
demand-load a protocol. */
|
||||
opterr = 0;
|
||||
|
||||
- h->ops = nft_family_ops_lookup(h->family);
|
||||
- if (h->ops == NULL)
|
||||
- xtables_error(PARAMETER_PROBLEM, "Unknown family");
|
||||
-
|
||||
opts = xt_params->orig_opts;
|
||||
while ((cs->c = getopt_long(argc, argv,
|
||||
"-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvw::W::nt:m:xc:g:46",
|
||||
--
|
||||
2.27.0
|
||||
|
||||
49
0015-nft-cache-Fix-nft_release_cache-under-stress.patch
Normal file
49
0015-nft-cache-Fix-nft_release_cache-under-stress.patch
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
From 381597830058c20cce350a705265fb2ab0150f2f Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 28 Feb 2020 20:32:13 +0100
|
||||
Subject: [PATCH] nft: cache: Fix nft_release_cache() under stress
|
||||
|
||||
iptables-nft-restore calls nft_action(h, NFT_COMPAT_COMMIT) for each
|
||||
COMMIT line in input. When restoring a dump containing multiple large
|
||||
tables, chances are nft_rebuild_cache() has to run multiple times.
|
||||
|
||||
If the above happens, consecutive table contents are added to __cache[1]
|
||||
which nft_rebuild_cache() then frees, so next commit attempt accesses
|
||||
invalid memory.
|
||||
|
||||
Fix this by making nft_release_cache() (called after each successful
|
||||
commit) return things into pre-rebuild state again, but keeping the
|
||||
fresh cache copy.
|
||||
|
||||
Fixes: f6ad231d698c7 ("nft: keep original cache in case of ERESTART")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit c550c81fd373e5753103d20f7902171f0fa79807)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-cache.c | 10 ++++++++--
|
||||
1 file changed, 8 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
||||
index 7345a27e2894b..6f21f2283e0fb 100644
|
||||
--- a/iptables/nft-cache.c
|
||||
+++ b/iptables/nft-cache.c
|
||||
@@ -647,8 +647,14 @@ void nft_rebuild_cache(struct nft_handle *h)
|
||||
|
||||
void nft_release_cache(struct nft_handle *h)
|
||||
{
|
||||
- if (h->cache_index)
|
||||
- flush_cache(h, &h->__cache[0], NULL);
|
||||
+ if (!h->cache_index)
|
||||
+ return;
|
||||
+
|
||||
+ flush_cache(h, &h->__cache[0], NULL);
|
||||
+ memcpy(&h->__cache[0], &h->__cache[1], sizeof(h->__cache[0]));
|
||||
+ memset(&h->__cache[1], 0, sizeof(h->__cache[1]));
|
||||
+ h->cache_index = 0;
|
||||
+ h->cache = &h->__cache[0];
|
||||
}
|
||||
|
||||
struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
|
||||
--
|
||||
2.27.0
|
||||
|
||||
84
0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch
Normal file
84
0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch
Normal file
|
|
@ -0,0 +1,84 @@
|
|||
From 02460350debd34be4342b87cac91d70240c7c431 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 13 Mar 2020 13:02:12 +0100
|
||||
Subject: [PATCH] nft: cache: Fix iptables-save segfault under stress
|
||||
|
||||
If kernel ruleset is constantly changing, code called by
|
||||
nft_is_table_compatible() may crash: For each item in table's chain
|
||||
list, nft_is_chain_compatible() is called. This in turn calls
|
||||
nft_build_cache() to fetch chain's rules. Though if kernel genid has changed
|
||||
meanwhile, cache is flushed and rebuilt from scratch, thereby freeing
|
||||
table's chain list - the foreach loop in nft_is_table_compatible() then
|
||||
operates on freed memory.
|
||||
|
||||
A simple reproducer (may need a few calls):
|
||||
|
||||
| RULESET='*filter
|
||||
| :INPUT ACCEPT [10517:1483527]
|
||||
| :FORWARD ACCEPT [0:0]
|
||||
| :OUTPUT ACCEPT [1714:105671]
|
||||
| COMMIT
|
||||
| '
|
||||
|
|
||||
| for ((i = 0; i < 100; i++)); do
|
||||
| iptables-nft-restore <<< "$RULESET" &
|
||||
| done &
|
||||
| iptables-nft-save
|
||||
|
||||
To fix the problem, basically revert commit ab1cd3b510fa5 ("nft: ensure
|
||||
cache consistency") so that __nft_build_cache() no longer flushes the
|
||||
cache. Instead just record kernel's genid when fetching for the first
|
||||
time. If kernel rule set changes until the changes are committed, the
|
||||
commit simply fails and local cache is being rebuilt.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 200bc399651499f502ac0de45f4d4aa4c9d37ab6)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-cache.c | 16 ++--------------
|
||||
1 file changed, 2 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
||||
index 6f21f2283e0fb..07265b7795e4f 100644
|
||||
--- a/iptables/nft-cache.c
|
||||
+++ b/iptables/nft-cache.c
|
||||
@@ -452,15 +452,11 @@ __nft_build_cache(struct nft_handle *h, enum nft_cache_level level,
|
||||
const struct builtin_table *t, const char *set,
|
||||
const char *chain)
|
||||
{
|
||||
- uint32_t genid_start, genid_stop;
|
||||
-
|
||||
if (level <= h->cache_level)
|
||||
return;
|
||||
-retry:
|
||||
- mnl_genid_get(h, &genid_start);
|
||||
|
||||
- if (h->cache_level && genid_start != h->nft_genid)
|
||||
- flush_chain_cache(h, NULL);
|
||||
+ if (!h->nft_genid)
|
||||
+ mnl_genid_get(h, &h->nft_genid);
|
||||
|
||||
switch (h->cache_level) {
|
||||
case NFT_CL_NONE:
|
||||
@@ -487,18 +483,10 @@ retry:
|
||||
break;
|
||||
}
|
||||
|
||||
- mnl_genid_get(h, &genid_stop);
|
||||
- if (genid_start != genid_stop) {
|
||||
- flush_chain_cache(h, NULL);
|
||||
- goto retry;
|
||||
- }
|
||||
-
|
||||
if (!t && !chain)
|
||||
h->cache_level = level;
|
||||
else if (h->cache_level < NFT_CL_TABLES)
|
||||
h->cache_level = NFT_CL_TABLES;
|
||||
-
|
||||
- h->nft_genid = genid_start;
|
||||
}
|
||||
|
||||
void nft_build_cache(struct nft_handle *h, struct nftnl_chain *c)
|
||||
--
|
||||
2.27.0
|
||||
|
||||
42
0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
Normal file
42
0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
Normal file
|
|
@ -0,0 +1,42 @@
|
|||
From 8a48c88b9cfa643e9c2783f41c6a79fd42514e6f Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Sat, 9 May 2020 13:36:49 +0200
|
||||
Subject: [PATCH] nfnl_osf: Fix broken conversion to nfnl_query()
|
||||
|
||||
Due to missing NLM_F_ACK flag in request, nfnetlink code in kernel
|
||||
didn't create an own ACK message but left it upon subsystem to ACK or
|
||||
not. Since nfnetlink_osf doesn't ACK by itself, nfnl_query() got stuck
|
||||
waiting for a reply.
|
||||
|
||||
Whoever did the conversion from deprecated nfnl_talk() obviously didn't
|
||||
even test basic functionality of the tool.
|
||||
|
||||
Fixes: 52aa15098ebd6 ("nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query()")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit c8332553caf48132403895bae750b3cd09a2efd8)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
utils/nfnl_osf.c | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c
|
||||
index 15d531975e11d..922d90ac135b7 100644
|
||||
--- a/utils/nfnl_osf.c
|
||||
+++ b/utils/nfnl_osf.c
|
||||
@@ -378,9 +378,11 @@ static int osf_load_line(char *buffer, int len, int del)
|
||||
memset(buf, 0, sizeof(buf));
|
||||
|
||||
if (del)
|
||||
- nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE, NLM_F_REQUEST);
|
||||
+ nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE,
|
||||
+ NLM_F_ACK | NLM_F_REQUEST);
|
||||
else
|
||||
- nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD, NLM_F_REQUEST | NLM_F_CREATE);
|
||||
+ nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD,
|
||||
+ NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE);
|
||||
|
||||
nfnl_addattr_l(nmh, sizeof(buf), OSF_ATTR_FINGER, &f, sizeof(struct xt_osf_user_finger));
|
||||
|
||||
--
|
||||
2.27.0
|
||||
|
||||
80
0018-nfnl_osf-Improve-error-handling.patch
Normal file
80
0018-nfnl_osf-Improve-error-handling.patch
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
From ef30ce26ceb48402f9c028802127151e962f51cd Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Sat, 9 May 2020 13:42:56 +0200
|
||||
Subject: [PATCH] nfnl_osf: Improve error handling
|
||||
|
||||
For some error cases, no log message was created - hence apart from the
|
||||
return code there was no indication of failing execution.
|
||||
|
||||
If a line load fails, don't abort but continue with the remaining
|
||||
file contents. The current pf.os file in this repository serves as
|
||||
proof-of-concept:
|
||||
|
||||
Lines 700 and 701: Duplicates of lines 698 and 699 because 'W*' and 'W0'
|
||||
parse into the same data.
|
||||
|
||||
Line 704: Duplicate of line 702 because apart from 'W*' and 'W0', only
|
||||
the first three fields on right-hand side are sent to the kernel.
|
||||
|
||||
When loading, these dups are ignored (they would bounce if NLM_F_EXCL
|
||||
was given). Upon deletion, they cause ENOENT response from kernel. In
|
||||
order to align duplicate-tolerance in both modes, just ignore that
|
||||
ENOENT.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 3e09bd1888575cfec136574d2b0e810ba33f1cfb)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
utils/nfnl_osf.c | 15 ++++++++++-----
|
||||
1 file changed, 10 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c
|
||||
index 922d90ac135b7..8008e83d8af4b 100644
|
||||
--- a/utils/nfnl_osf.c
|
||||
+++ b/utils/nfnl_osf.c
|
||||
@@ -392,7 +392,7 @@ static int osf_load_line(char *buffer, int len, int del)
|
||||
static int osf_load_entries(char *path, int del)
|
||||
{
|
||||
FILE *inf;
|
||||
- int err = 0;
|
||||
+ int err = 0, lineno = 0;
|
||||
char buf[1024];
|
||||
|
||||
inf = fopen(path, "r");
|
||||
@@ -402,7 +402,9 @@ static int osf_load_entries(char *path, int del)
|
||||
}
|
||||
|
||||
while(fgets(buf, sizeof(buf), inf)) {
|
||||
- int len;
|
||||
+ int len, rc;
|
||||
+
|
||||
+ lineno++;
|
||||
|
||||
if (buf[0] == '#' || buf[0] == '\n' || buf[0] == '\r')
|
||||
continue;
|
||||
@@ -414,9 +416,11 @@ static int osf_load_entries(char *path, int del)
|
||||
|
||||
buf[len] = '\0';
|
||||
|
||||
- err = osf_load_line(buf, len, del);
|
||||
- if (err)
|
||||
- break;
|
||||
+ rc = osf_load_line(buf, len, del);
|
||||
+ if (rc && (!del || errno != ENOENT)) {
|
||||
+ ulog_err("Failed to load line %d", lineno);
|
||||
+ err = rc;
|
||||
+ }
|
||||
|
||||
memset(buf, 0, sizeof(buf));
|
||||
}
|
||||
@@ -448,6 +452,7 @@ int main(int argc, char *argv[])
|
||||
|
||||
if (!fingerprints) {
|
||||
err = -ENOENT;
|
||||
+ ulog("Missing fingerprints file argument.\n");
|
||||
goto err_out_exit;
|
||||
}
|
||||
|
||||
--
|
||||
2.27.0
|
||||
|
||||
37
0019-nft-cache-Reset-genid-when-rebuilding-cache.patch
Normal file
37
0019-nft-cache-Reset-genid-when-rebuilding-cache.patch
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
From d7ac1f62d953ea2136df4bef247b635db93a537b Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <psutter@redhat.com>
|
||||
Date: Fri, 29 May 2020 19:33:22 +0200
|
||||
Subject: [PATCH] nft: cache: Reset genid when rebuilding cache
|
||||
|
||||
This is required in order to avoid a cache rebuild loop if
|
||||
iptables-nft-restore is called with '--test' parameter and a dump
|
||||
containing more than a single table.
|
||||
|
||||
If non-zero, __nft_build_cache() never updates genid and therefore the
|
||||
incorrect genid (caused by increment in nft_action()) is never
|
||||
corrected.
|
||||
|
||||
This is a Fedora-only fix, upstream rewrote the whole cache logic which
|
||||
implicitly resolved this problem.
|
||||
|
||||
Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress")
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft-cache.c | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
||||
index 07265b7795e4f..bc6e7f7eaebfb 100644
|
||||
--- a/iptables/nft-cache.c
|
||||
+++ b/iptables/nft-cache.c
|
||||
@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h)
|
||||
if (h->cache_level)
|
||||
__nft_flush_cache(h);
|
||||
|
||||
+ h->nft_genid = 0;
|
||||
h->cache_level = NFT_CL_NONE;
|
||||
__nft_build_cache(h, level, NULL, NULL, NULL);
|
||||
}
|
||||
--
|
||||
2.27.0
|
||||
|
||||
45
0020-nft-Fix-command-name-in-ip6tables-error-message.patch
Normal file
45
0020-nft-Fix-command-name-in-ip6tables-error-message.patch
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
From 6036d70408b1d4e8760e47cdf862cc73c1de727d Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 7 Aug 2020 13:48:28 +0200
|
||||
Subject: [PATCH] nft: Fix command name in ip6tables error message
|
||||
|
||||
Upon errors, ip6tables-nft would prefix its error messages with
|
||||
'iptables:' instead of 'ip6tables:'. Turns out the command name was
|
||||
hard-coded, use 'progname' variable instead.
|
||||
While being at it, merge the two mostly identical fprintf() calls into
|
||||
one.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
||||
(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-standalone.c | 12 ++++--------
|
||||
1 file changed, 4 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
|
||||
index 022d5dd44abbf..b5b7ccaf4e660 100644
|
||||
--- a/iptables/xtables-standalone.c
|
||||
+++ b/iptables/xtables-standalone.c
|
||||
@@ -74,14 +74,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
|
||||
nft_fini(&h);
|
||||
|
||||
if (!ret) {
|
||||
- if (errno == EINVAL) {
|
||||
- fprintf(stderr, "iptables: %s. "
|
||||
- "Run `dmesg' for more information.\n",
|
||||
- nft_strerror(errno));
|
||||
- } else {
|
||||
- fprintf(stderr, "iptables: %s.\n",
|
||||
- nft_strerror(errno));
|
||||
- }
|
||||
+ fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
|
||||
+ (errno == EINVAL ?
|
||||
+ " Run `dmesg' for more information." : ""));
|
||||
+
|
||||
if (errno == EAGAIN)
|
||||
exit(RESOURCE_PROBLEM);
|
||||
}
|
||||
--
|
||||
2.27.0
|
||||
|
||||
366
0021-tests-shell-Fix-skip-checks-with-host-mode.patch
Normal file
366
0021-tests-shell-Fix-skip-checks-with-host-mode.patch
Normal file
|
|
@ -0,0 +1,366 @@
|
|||
From 5d22e14bad69933519ddcc6bb39817bf7ae09db8 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 12 Feb 2020 21:26:06 +0100
|
||||
Subject: [PATCH] tests: shell: Fix skip checks with --host mode
|
||||
|
||||
When testing host binaries, XT_MULTI variable contains just the program
|
||||
name without path component which most skip checks didn't expect. Fix
|
||||
them, and while being at it also reduce indenting level in two scripts
|
||||
by moving the skip check up front with an early exit call.
|
||||
|
||||
Fixes: 416898e335322 ("tests/shell: Support testing host binaries")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 2b2b7948c1960ba4680677664ff58477be869de6)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
.../arptables/0001-arptables-save-restore_0 | 2 +-
|
||||
.../0002-arptables-restore-defaults_0 | 2 +-
|
||||
.../arptables/0003-arptables-verbose-output_0 | 2 +-
|
||||
.../testcases/ebtables/0001-ebtables-basic_0 | 135 +++++++++---------
|
||||
.../ebtables/0002-ebtables-save-restore_0 | 2 +-
|
||||
.../ebtables/0003-ebtables-restore-defaults_0 | 2 +-
|
||||
.../testcases/ebtables/0004-save-counters_0 | 2 +-
|
||||
.../testcases/ebtables/0005-ifnamechecks_0 | 2 +-
|
||||
.../firewalld-restore/0001-firewalld_0 | 2 +-
|
||||
.../testcases/ipt-restore/0004-restore-race_0 | 2 +-
|
||||
.../shell/testcases/nft-only/0001compat_0 | 15 +-
|
||||
.../shell/testcases/nft-only/0002invflags_0 | 2 +-
|
||||
.../nft-only/0003delete-with-comment_0 | 2 +-
|
||||
13 files changed, 88 insertions(+), 84 deletions(-)
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
index bf04dc0a3e15a..e64e9142ee98b 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
|
||||
@@ -4,7 +4,7 @@ set -e
|
||||
#set -x
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
# fill arptables manually
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
index 38d387f327ebb..afd0fcb460d85 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
|
||||
@@ -3,7 +3,7 @@
|
||||
set -e
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
# arptables-restore reuses preloaded targets and matches, make sure defaults
|
||||
# apply to consecutive rules using the same target/match as a previous one
|
||||
diff --git a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
|
||||
index 10c5ec33ada2c..952cfa7898371 100755
|
||||
--- a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
|
||||
+++ b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
|
||||
@@ -4,7 +4,7 @@ set -e
|
||||
set -x
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
$XT_MULTI arptables -N foo
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
|
||||
index c7f24a383f698..0c1eb4ca66f52 100755
|
||||
--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
|
||||
+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
|
||||
@@ -1,86 +1,89 @@
|
||||
#!/bin/sh
|
||||
|
||||
+case "$XT_MULTI" in
|
||||
+*xtables-nft-multi)
|
||||
+ ;;
|
||||
+*)
|
||||
+ echo "skip $XT_MULTI"
|
||||
+ exit 0
|
||||
+ ;;
|
||||
+esac
|
||||
+
|
||||
get_entries_count() { # (chain)
|
||||
$XT_MULTI ebtables -L $1 | sed -n 's/.*entries: \([0-9]*\).*/\1/p'
|
||||
}
|
||||
|
||||
set -x
|
||||
-case "$XT_MULTI" in
|
||||
-*/xtables-nft-multi)
|
||||
- for t in filter nat;do
|
||||
- $XT_MULTI ebtables -t $t -L || exit 1
|
||||
- $XT_MULTI ebtables -t $t -X || exit 1
|
||||
- $XT_MULTI ebtables -t $t -F || exit 1
|
||||
- done
|
||||
-
|
||||
- for t in broute foobar ;do
|
||||
- $XT_MULTI ebtables -t $t -L &&
|
||||
- $XT_MULTI ebtables -t $t -X &&
|
||||
- $XT_MULTI ebtables -t $t -F
|
||||
- if [ $? -eq 0 ]; then
|
||||
- echo "Expect nonzero return for unsupported table"
|
||||
- exit 1
|
||||
- fi
|
||||
- done
|
||||
|
||||
+for t in filter nat;do
|
||||
+ $XT_MULTI ebtables -t $t -L || exit 1
|
||||
+ $XT_MULTI ebtables -t $t -X || exit 1
|
||||
+ $XT_MULTI ebtables -t $t -F || exit 1
|
||||
+done
|
||||
|
||||
- $XT_MULTI ebtables -t filter -N FOO || exit 1
|
||||
- $XT_MULTI ebtables -t filter -N FOO
|
||||
+for t in broute foobar ;do
|
||||
+ $XT_MULTI ebtables -t $t -L &&
|
||||
+ $XT_MULTI ebtables -t $t -X &&
|
||||
+ $XT_MULTI ebtables -t $t -F
|
||||
if [ $? -eq 0 ]; then
|
||||
- echo "Duplicate chain FOO"
|
||||
- $XT_MULTI ebtables -t filter -L
|
||||
+ echo "Expect nonzero return for unsupported table"
|
||||
exit 1
|
||||
fi
|
||||
+done
|
||||
|
||||
- entries=$(get_entries_count FOO)
|
||||
- if [ $entries -ne 0 ]; then
|
||||
- echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
|
||||
- $XT_MULTI ebtables -L
|
||||
- exit 1
|
||||
- fi
|
||||
|
||||
- $XT_MULTI ebtables -A FORWARD -j FOO
|
||||
- entries=$(get_entries_count FORWARD)
|
||||
- if [ $entries -ne 1 ]; then
|
||||
- echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
|
||||
- $XT_MULTI ebtables -L
|
||||
- exit 1
|
||||
- fi
|
||||
+$XT_MULTI ebtables -t filter -N FOO || exit 1
|
||||
+$XT_MULTI ebtables -t filter -N FOO
|
||||
+if [ $? -eq 0 ]; then
|
||||
+ echo "Duplicate chain FOO"
|
||||
+ $XT_MULTI ebtables -t filter -L
|
||||
+ exit 1
|
||||
+fi
|
||||
|
||||
- entries=$(get_entries_count FOO)
|
||||
- if [ $entries -ne 0 ]; then
|
||||
- echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
|
||||
- $XT_MULTI ebtables -L
|
||||
- exit 1
|
||||
- fi
|
||||
+entries=$(get_entries_count FOO)
|
||||
+if [ $entries -ne 0 ]; then
|
||||
+ echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
|
||||
+ $XT_MULTI ebtables -L
|
||||
+ exit 1
|
||||
+fi
|
||||
|
||||
- $XT_MULTI ebtables -A FOO -j ACCEPT
|
||||
- entries=$(get_entries_count FOO)
|
||||
- if [ $entries -ne 1 ]; then
|
||||
- echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
|
||||
- $XT_MULTI ebtables -L
|
||||
- exit 1
|
||||
- fi
|
||||
+$XT_MULTI ebtables -A FORWARD -j FOO
|
||||
+entries=$(get_entries_count FORWARD)
|
||||
+if [ $entries -ne 1 ]; then
|
||||
+ echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
|
||||
+ $XT_MULTI ebtables -L
|
||||
+ exit 1
|
||||
+fi
|
||||
|
||||
- $XT_MULTI ebtables -t filter -N BAR || exit 1
|
||||
- $XT_MULTI ebtables -t filter -N BAZ || exit 1
|
||||
+entries=$(get_entries_count FOO)
|
||||
+if [ $entries -ne 0 ]; then
|
||||
+ echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
|
||||
+ $XT_MULTI ebtables -L
|
||||
+ exit 1
|
||||
+fi
|
||||
|
||||
- $XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
|
||||
- $XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
|
||||
- $XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
|
||||
+$XT_MULTI ebtables -A FOO -j ACCEPT
|
||||
+entries=$(get_entries_count FOO)
|
||||
+if [ $entries -ne 1 ]; then
|
||||
+ echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
|
||||
+ $XT_MULTI ebtables -L
|
||||
+ exit 1
|
||||
+fi
|
||||
|
||||
- $XT_MULTI ebtables -t filter -L BAZ || exit 1
|
||||
- $XT_MULTI ebtables -t filter -X BAZ || exit 1
|
||||
- $XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
|
||||
- if [ $? -eq 0 ]; then
|
||||
- echo "Deleted chain -L BAZ ok, expected failure"
|
||||
- $XT_MULTI ebtables -t filter -L
|
||||
- exit 1
|
||||
- fi
|
||||
+$XT_MULTI ebtables -t filter -N BAR || exit 1
|
||||
+$XT_MULTI ebtables -t filter -N BAZ || exit 1
|
||||
|
||||
- $XT_MULTI ebtables -t $t -F || exit 0
|
||||
- ;;
|
||||
-*)
|
||||
- echo "skip $XT_MULTI"
|
||||
- ;;
|
||||
-esac
|
||||
+$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
|
||||
+$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
|
||||
+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
|
||||
+
|
||||
+$XT_MULTI ebtables -t filter -L BAZ || exit 1
|
||||
+$XT_MULTI ebtables -t filter -X BAZ || exit 1
|
||||
+$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
|
||||
+if [ $? -eq 0 ]; then
|
||||
+ echo "Deleted chain -L BAZ ok, expected failure"
|
||||
+ $XT_MULTI ebtables -t filter -L
|
||||
+ exit 1
|
||||
+fi
|
||||
+
|
||||
+$XT_MULTI ebtables -t $t -F || exit 0
|
||||
diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
|
||||
index e18d46551509d..b84f63a7c3672 100755
|
||||
--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
|
||||
+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
|
||||
@@ -4,7 +4,7 @@ set -e
|
||||
#set -x
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
# fill ebtables manually
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
|
||||
index 62d224134456b..63891c1bb731a 100755
|
||||
--- a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
|
||||
+++ b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
|
||||
@@ -3,7 +3,7 @@
|
||||
set -e
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
# ebtables-restore reuses preloaded targets and matches, make sure defaults
|
||||
# apply to consecutive rules using the same target/match as a previous one
|
||||
diff --git a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
|
||||
index 46966f433139a..d52db900604ef 100755
|
||||
--- a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
|
||||
+++ b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
|
||||
@@ -3,7 +3,7 @@
|
||||
set -e
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
$XT_MULTI ebtables --init-table
|
||||
$XT_MULTI ebtables -A FORWARD -i nodev123 -o nodev432 -j ACCEPT
|
||||
diff --git a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
|
||||
index 2163d364b318b..0b3acfd7613db 100755
|
||||
--- a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
|
||||
+++ b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
|
||||
@@ -3,7 +3,7 @@
|
||||
set -e
|
||||
|
||||
# there is no legacy backend to test
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
EXPECT='*filter
|
||||
:INPUT ACCEPT
|
||||
diff --git a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
|
||||
index 8bf0c2c6c194e..0174b03f4ebc7 100755
|
||||
--- a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
|
||||
+++ b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
|
||||
@@ -231,7 +231,7 @@ for table in nat mangle raw filter;do
|
||||
done
|
||||
|
||||
case "$XT_MULTI" in
|
||||
-*/xtables-nft-multi)
|
||||
+*xtables-nft-multi)
|
||||
# nft-multi displays chain names in different order, work around this for now
|
||||
tmpfile2=$(mktemp)
|
||||
sort "$tmpfile" > "$tmpfile2"
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
|
||||
index 96a5e66d0ab81..9fc50615b8926 100755
|
||||
--- a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
|
||||
@@ -86,7 +86,7 @@ if [ $LINES1 -ne $LINES2 ]; then
|
||||
fi
|
||||
|
||||
case "$XT_MULTI" in
|
||||
-*/xtables-nft-multi)
|
||||
+*xtables-nft-multi)
|
||||
attempts=$((RANDOM%10))
|
||||
attempts=$((attempts+1))
|
||||
;;
|
||||
diff --git a/iptables/tests/shell/testcases/nft-only/0001compat_0 b/iptables/tests/shell/testcases/nft-only/0001compat_0
|
||||
index 4319ea5a6a797..a617c52f53695 100755
|
||||
--- a/iptables/tests/shell/testcases/nft-only/0001compat_0
|
||||
+++ b/iptables/tests/shell/testcases/nft-only/0001compat_0
|
||||
@@ -5,17 +5,18 @@
|
||||
# xtables: avoid bogus 'is incompatible' warning
|
||||
|
||||
case "$XT_MULTI" in
|
||||
-*/xtables-nft-multi)
|
||||
- nft -v >/dev/null || exit 0
|
||||
- nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42; }' || exit 1
|
||||
- nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42; }' || exit 1
|
||||
-
|
||||
- $XT_MULTI iptables -L -t filter || exit 1
|
||||
- $XT_MULTI ip6tables -L -t filter || exit 1
|
||||
+*xtables-nft-multi)
|
||||
;;
|
||||
*)
|
||||
echo skip $XT_MULTI
|
||||
+ exit 0
|
||||
;;
|
||||
esac
|
||||
|
||||
+nft -v >/dev/null || exit 0
|
||||
+nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42; }' || exit 1
|
||||
+nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42; }' || exit 1
|
||||
+
|
||||
+$XT_MULTI iptables -L -t filter || exit 1
|
||||
+$XT_MULTI ip6tables -L -t filter || exit 1
|
||||
exit 0
|
||||
diff --git a/iptables/tests/shell/testcases/nft-only/0002invflags_0 b/iptables/tests/shell/testcases/nft-only/0002invflags_0
|
||||
index 406b6081a98a4..fe33874dde7f2 100755
|
||||
--- a/iptables/tests/shell/testcases/nft-only/0002invflags_0
|
||||
+++ b/iptables/tests/shell/testcases/nft-only/0002invflags_0
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
set -e
|
||||
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
$XT_MULTI iptables -A INPUT -p tcp --dport 53 ! -s 192.168.0.1 -j ACCEPT
|
||||
$XT_MULTI ip6tables -A INPUT -p tcp --dport 53 ! -s feed:babe::1 -j ACCEPT
|
||||
diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
|
||||
index 67af9fd897410..ccb009e469076 100755
|
||||
--- a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
|
||||
+++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
set -e
|
||||
|
||||
-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
|
||||
comment1="foo bar"
|
||||
comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
|
||||
--
|
||||
2.27.0
|
||||
|
||||
31
0022-nft-Drop-pointless-assignment.patch
Normal file
31
0022-nft-Drop-pointless-assignment.patch
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
From 056fc7c35441f666952f4fd1d5cf09a6f83e7b89 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 17 Feb 2020 12:56:24 +0100
|
||||
Subject: [PATCH] nft: Drop pointless assignment
|
||||
|
||||
No need to set 'i' to zero here, it is not used before the next
|
||||
assignment.
|
||||
|
||||
Fixes: 77e6a93d5c9dc ("xtables: add and set "implict" flag on transaction objects")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit ef10c1b8fc1e1f4d4019b2df4fcfb93f71430c85)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index 0287add3fb21f..eb517e0264e5b 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2810,7 +2810,6 @@ retry:
|
||||
|
||||
nft_refresh_transaction(h);
|
||||
|
||||
- i=0;
|
||||
list_for_each_entry_safe(err, ne, &h->err_list, head)
|
||||
mnl_err_list_free(err);
|
||||
|
||||
--
|
||||
2.27.0
|
||||
|
||||
43
0023-iptables-test.py-Fix-host-mode.patch
Normal file
43
0023-iptables-test.py-Fix-host-mode.patch
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
From 109208e73d7448556e62a29f65b9fc0ef2837b32 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 18 Feb 2020 16:43:16 +0100
|
||||
Subject: [PATCH] iptables-test.py: Fix --host mode
|
||||
|
||||
In some cases, the script still called repo binaries. Avoid this when in
|
||||
--host mode to allow testing without the need to compile sources in
|
||||
beforehand.
|
||||
|
||||
Fixes: 1b5d762c1865e ("iptables-test: Support testing host binaries")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit ba2af278e8836977a8cfb35c54dac60ca9b40000)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables-test.py | 5 ++---
|
||||
1 file changed, 2 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/iptables-test.py b/iptables-test.py
|
||||
index fdb4e6a3644e4..e986d7a318218 100755
|
||||
--- a/iptables-test.py
|
||||
+++ b/iptables-test.py
|
||||
@@ -119,8 +119,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
|
||||
elif splitted[0] == EBTABLES:
|
||||
command = EBTABLES_SAVE
|
||||
|
||||
- path = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE
|
||||
- command = path + " " + command
|
||||
+ command = EXECUTEABLE + " " + command
|
||||
|
||||
if netns:
|
||||
command = "ip netns exec ____iptables-container-test " + command
|
||||
@@ -165,7 +164,7 @@ def execute_cmd(cmd, filename, lineno):
|
||||
'''
|
||||
global log_file
|
||||
if cmd.startswith('iptables ') or cmd.startswith('ip6tables ') or cmd.startswith('ebtables ') or cmd.startswith('arptables '):
|
||||
- cmd = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE + " " + cmd
|
||||
+ cmd = EXECUTEABLE + " " + cmd
|
||||
|
||||
print("command: {}".format(cmd), file=log_file)
|
||||
ret = subprocess.call(cmd, shell=True, universal_newlines=True,
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
From e0c60af65b142a3c954a9f489bfdfcb1e09125db Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 4 Mar 2020 02:43:27 +0100
|
||||
Subject: [PATCH] connlabel: Allow numeric labels even if connlabel.conf exists
|
||||
|
||||
Existing code is a bit quirky: If no connlabel.conf was found, the local
|
||||
function connlabel_value_parse() is called which tries to interpret
|
||||
given label as a number. If the config exists though,
|
||||
nfct_labelmap_get_bit() is called instead which doesn't care about
|
||||
"undefined" connlabel names. So unless installed connlabel.conf contains
|
||||
entries for all possible numeric labels, rules added by users may stop
|
||||
working if a connlabel.conf is created.
|
||||
|
||||
Related man page snippet states: "Using a number always overrides
|
||||
connlabel.conf", so try numeric parsing and fall back to nfct only if
|
||||
that failed.
|
||||
|
||||
Fixes: 51340f7b6a110 ("extensions: libxt_connlabel: use libnetfilter_conntrack")
|
||||
Fixes: 3a3bb480a738a ("extensions: connlabel: Fallback on missing connlabel.conf")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit f56d91bd80f0e86aaad56a32ddc84f373bb80745)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_connlabel.c | 7 ++-----
|
||||
1 file changed, 2 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
|
||||
index 5a01fe7237bd8..565b8c796b017 100644
|
||||
--- a/extensions/libxt_connlabel.c
|
||||
+++ b/extensions/libxt_connlabel.c
|
||||
@@ -70,18 +70,15 @@ static int connlabel_value_parse(const char *in)
|
||||
static void connlabel_mt_parse(struct xt_option_call *cb)
|
||||
{
|
||||
struct xt_connlabel_mtinfo *info = cb->data;
|
||||
- bool have_labelmap = !connlabel_open();
|
||||
int tmp;
|
||||
|
||||
xtables_option_parse(cb);
|
||||
|
||||
switch (cb->entry->id) {
|
||||
case O_LABEL:
|
||||
- if (have_labelmap)
|
||||
+ tmp = connlabel_value_parse(cb->arg);
|
||||
+ if (tmp < 0 && !connlabel_open())
|
||||
tmp = nfct_labelmap_get_bit(map, cb->arg);
|
||||
- else
|
||||
- tmp = connlabel_value_parse(cb->arg);
|
||||
-
|
||||
if (tmp < 0)
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"label '%s' not found or invalid value",
|
||||
--
|
||||
2.27.0
|
||||
|
||||
73
0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch
Normal file
73
0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
From ceeef92ea4d1ede8f6a2481fae977b9aba443e00 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Mon, 4 May 2020 19:30:29 +0200
|
||||
Subject: [PATCH] nft: Fix leaks in ebt_add_policy_rule()
|
||||
|
||||
The function leaked memory allocated in temporary struct
|
||||
iptables_command_state, clean it immediately after use.
|
||||
|
||||
In any of the udata-related error cases, allocated nftnl_rule would
|
||||
leak, fix this by introducing a common error path to goto.
|
||||
|
||||
In regular code path, the allocated nftnl_rule would still leak:
|
||||
batch_obj_del() does not free rules in NFT_COMPAT_RULE_APPEND jobs, as
|
||||
they typically sit in cache as well. Policy rules in turn weren't added
|
||||
to cache: They are created immediately before commit and never
|
||||
referenced from other rules. Add them now so they are freed just like
|
||||
regular rules.
|
||||
|
||||
Fixes: aff1162b3e4b7 ("ebtables-nft: Support user-defined chain policies")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 5fdb447fdfe877bd6236830b4a2507d4d61bc1a1)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 18 ++++++++++++------
|
||||
1 file changed, 12 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index eb517e0264e5b..a5816824f09d6 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -2884,27 +2884,33 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
|
||||
|
||||
r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
|
||||
nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs);
|
||||
+ ebt_cs_clean(&cs);
|
||||
+
|
||||
if (!r)
|
||||
return -1;
|
||||
|
||||
udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
|
||||
if (!udata)
|
||||
- return -1;
|
||||
+ goto err_free_rule;
|
||||
|
||||
if (!nftnl_udata_put_u32(udata, UDATA_TYPE_EBTABLES_POLICY, 1))
|
||||
- return -1;
|
||||
+ goto err_free_rule;
|
||||
|
||||
nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
|
||||
nftnl_udata_buf_data(udata),
|
||||
nftnl_udata_buf_len(udata));
|
||||
nftnl_udata_buf_free(udata);
|
||||
|
||||
- if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r)) {
|
||||
- nftnl_rule_free(r);
|
||||
- return -1;
|
||||
- }
|
||||
+ if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r))
|
||||
+ goto err_free_rule;
|
||||
+
|
||||
+ /* add the rule to chain so it is freed later */
|
||||
+ nftnl_chain_rule_add_tail(r, c);
|
||||
|
||||
return 0;
|
||||
+err_free_rule:
|
||||
+ nftnl_rule_free(r);
|
||||
+ return -1;
|
||||
}
|
||||
|
||||
int ebt_set_user_chain_policy(struct nft_handle *h, const char *table,
|
||||
--
|
||||
2.27.0
|
||||
|
||||
35
0026-nft-Fix-leak-when-replacing-a-rule.patch
Normal file
35
0026-nft-Fix-leak-when-replacing-a-rule.patch
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
From bb8d1b774e42d56a303f99723410608db3e25ff6 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 6 May 2020 13:33:20 +0200
|
||||
Subject: [PATCH] nft: Fix leak when replacing a rule
|
||||
|
||||
If nft_rule_append() is called with a reference rule, it is supposed to
|
||||
insert the new rule at the reference position and then remove the
|
||||
reference from cache. Instead, it removed the new rule from cache again
|
||||
right after inserting it. Also, it missed to free the removed rule.
|
||||
|
||||
Fixes: 5ca9acf51adf9 ("xtables: Fix position of replaced rules in cache")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit b199aca80da5741add50cce244492cc005230b66)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/nft.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/nft.c b/iptables/nft.c
|
||||
index a5816824f09d6..b5bfcf64e51a4 100644
|
||||
--- a/iptables/nft.c
|
||||
+++ b/iptables/nft.c
|
||||
@@ -1376,7 +1376,8 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
|
||||
|
||||
if (ref) {
|
||||
nftnl_chain_rule_insert_at(r, ref);
|
||||
- nftnl_chain_rule_del(r);
|
||||
+ nftnl_chain_rule_del(ref);
|
||||
+ nftnl_rule_free(ref);
|
||||
} else {
|
||||
c = nft_chain_find(h, table, chain);
|
||||
if (!c) {
|
||||
--
|
||||
2.27.0
|
||||
|
||||
34
0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch
Normal file
34
0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
From 9e2217200016ff23bf8646fbd6119eff5079434e Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed, 20 May 2020 01:00:57 +0200
|
||||
Subject: [PATCH] doc: libxt_MARK: OUTPUT chain is fine, too
|
||||
|
||||
In order to route packets originating from the host itself based on
|
||||
fwmark, mangle table's OUTPUT chain must be used. Mention this chain as
|
||||
alternative to PREROUTING.
|
||||
|
||||
Fixes: c9be7f153f7bf ("doc: libxt_MARK: no longer restricted to mangle table")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 7f0a69c8fe78da130cc52ea9fc35ffb9cbc2b8ef)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
extensions/libxt_MARK.man | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/extensions/libxt_MARK.man b/extensions/libxt_MARK.man
|
||||
index 712fb76f7340c..b2408597e98f1 100644
|
||||
--- a/extensions/libxt_MARK.man
|
||||
+++ b/extensions/libxt_MARK.man
|
||||
@@ -1,7 +1,7 @@
|
||||
This target is used to set the Netfilter mark value associated with the packet.
|
||||
It can, for example, be used in conjunction with routing based on fwmark (needs
|
||||
-iproute2). If you plan on doing so, note that the mark needs to be set in the
|
||||
-PREROUTING chain of the mangle table to affect routing.
|
||||
+iproute2). If you plan on doing so, note that the mark needs to be set in
|
||||
+either the PREROUTING or the OUTPUT chain of the mangle table to affect routing.
|
||||
The mark field is 32 bits wide.
|
||||
.TP
|
||||
\fB\-\-set\-xmark\fP \fIvalue\fP[\fB/\fP\fImask\fP]
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
From e6abc8bc94bcbb2de0784fe9cd3a8fd7560726e5 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 29 May 2020 16:39:31 +0200
|
||||
Subject: [PATCH] tests: shell: Fix syntax in
|
||||
ipt-restore/0010-noflush-new-chain_0
|
||||
|
||||
The here-doc statement missed the final delimiter. Worked anyways
|
||||
because end-of-file would do the trick.
|
||||
|
||||
Fixes: a103fbfadf4c1 ("xtables-restore: Fix parser feed from line buffer")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit fe1cfd89c239cb6ce54f0c7b99ec2eb517db5f12)
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
.../tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
||||
index 739e684a21183..2817376ed913e 100755
|
||||
--- a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
||||
+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
|
||||
@@ -8,3 +8,4 @@ $XT_MULTI iptables-restore --noflush <<EOF
|
||||
:foobar - [0:0]
|
||||
-A foobar -j ACCEPT
|
||||
COMMIT
|
||||
+EOF
|
||||
--
|
||||
2.27.0
|
||||
|
||||
|
|
@ -19,7 +19,7 @@ Name: iptables
|
|||
Summary: Tools for managing Linux kernel packet filtering capabilities
|
||||
URL: http://www.netfilter.org/projects/iptables
|
||||
Version: 1.8.4
|
||||
Release: 6%{?dist}
|
||||
Release: 9%{?dist}
|
||||
Source: %{url}/files/%{name}-%{version}.tar.bz2
|
||||
Source1: iptables.init
|
||||
Source2: iptables-config
|
||||
|
|
@ -33,6 +33,34 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
|
|||
%endif
|
||||
|
||||
Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
|
||||
Patch2: 0002-Fix-DEBUG-build.patch
|
||||
Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch
|
||||
Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch
|
||||
Patch5: 0005-extensions-time-Avoid-undefined-shift.patch
|
||||
Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch
|
||||
Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch
|
||||
Patch8: 0008-extensions-among-Check-call-to-fstat.patch
|
||||
Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch
|
||||
Patch10: 0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch
|
||||
Patch11: 0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch
|
||||
Patch12: 0012-xtables-translate-Fix-for-interface-name-corner-case.patch
|
||||
Patch13: 0013-xtables-translate-Fix-for-iface.patch
|
||||
Patch14: 0014-xtables-Review-nft_init.patch
|
||||
Patch15: 0015-nft-cache-Fix-nft_release_cache-under-stress.patch
|
||||
Patch16: 0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch
|
||||
Patch17: 0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
|
||||
Patch18: 0018-nfnl_osf-Improve-error-handling.patch
|
||||
Patch19: 0019-nft-cache-Reset-genid-when-rebuilding-cache.patch
|
||||
Patch20: 0020-nft-Fix-command-name-in-ip6tables-error-message.patch
|
||||
Patch21: 0021-tests-shell-Fix-skip-checks-with-host-mode.patch
|
||||
Patch22: 0022-nft-Drop-pointless-assignment.patch
|
||||
Patch23: 0023-iptables-test.py-Fix-host-mode.patch
|
||||
Patch24: 0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch
|
||||
Patch25: 0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch
|
||||
Patch26: 0026-nft-Fix-leak-when-replacing-a-rule.patch
|
||||
Patch27: 0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch
|
||||
Patch28: 0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch
|
||||
|
||||
# pf.os: ISC license
|
||||
# iptables-apply: Artistic Licence 2.0
|
||||
License: GPLv2 and Artistic Licence 2.0 and ISC
|
||||
|
|
@ -119,7 +147,7 @@ a bytecode generator for use with xt_bpf.
|
|||
|
||||
%package nft
|
||||
Summary: nftables compatibility for iptables, arptables and ebtables
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||
Obsoletes: iptables-compat < 1.6.2-4
|
||||
Provides: arptables-helper
|
||||
Provides: iptables
|
||||
|
|
@ -350,12 +378,6 @@ fi
|
|||
%{_mandir}/man8/iptables*
|
||||
%{_mandir}/man8/ip6tables*
|
||||
%{_mandir}/man8/xtables-legacy*
|
||||
%dir %{_libdir}/xtables
|
||||
%{_libdir}/xtables/libarpt*
|
||||
%{_libdir}/xtables/libebt*
|
||||
%{_libdir}/xtables/libipt*
|
||||
%{_libdir}/xtables/libip6t*
|
||||
%{_libdir}/xtables/libxt*
|
||||
%ghost %{_sbindir}/iptables
|
||||
%ghost %{_sbindir}/iptables-restore
|
||||
%ghost %{_sbindir}/iptables-save
|
||||
|
|
@ -370,6 +392,10 @@ fi
|
|||
%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}*
|
||||
%endif
|
||||
%{_libdir}/libxtables.so.12*
|
||||
%dir %{_libdir}/xtables
|
||||
%{_libdir}/xtables/libipt*
|
||||
%{_libdir}/xtables/libip6t*
|
||||
%{_libdir}/xtables/libxt*
|
||||
|
||||
%files devel
|
||||
%dir %{_includedir}/iptables
|
||||
|
|
@ -422,6 +448,9 @@ fi
|
|||
%{_sbindir}/arptables-nft*
|
||||
%{_sbindir}/xtables-nft-multi
|
||||
%{_sbindir}/xtables-monitor
|
||||
%dir %{_libdir}/xtables
|
||||
%{_libdir}/xtables/libarpt*
|
||||
%{_libdir}/xtables/libebt*
|
||||
%{_libexecdir}/arptables-nft-helper
|
||||
%{_mandir}/man8/xtables-monitor*
|
||||
%{_mandir}/man8/xtables-translate*
|
||||
|
|
@ -446,6 +475,19 @@ fi
|
|||
|
||||
|
||||
%changelog
|
||||
* Tue Aug 25 03:32:14 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-9
|
||||
- Fix for wrong prefix in ip6tables error messages
|
||||
- Add further fixes from upstream
|
||||
|
||||
* Tue Jun 23 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-8
|
||||
- Add further fixes from upstream
|
||||
|
||||
* Wed Feb 12 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-7
|
||||
- Move nft-specific extensions into iptables-nft package
|
||||
- Move remaining extensions into iptables-libs package
|
||||
- Make iptables-nft depend on iptables-libs instead of iptables
|
||||
- Add upstream-suggested fixes
|
||||
|
||||
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue