iptables-1.8.5-6

- iptables: accept lock file name at runtime

Resolves: RHBZ#1932157

0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch

@@ -0,0 +1,40 @@
+From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 29 Jul 2020 15:39:31 +0200
+Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
+
+Athough this cache level fetches table names only, it shouldn't skip the
+consistency check.
+
+Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-cache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 638b18bc7e382..434cc10b82ce7 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -511,14 +511,14 @@ retry:
+ 	if (req->level >= NFT_CL_TABLES)
+ 		fetch_table_cache(h);
+ 	if (req->level == NFT_CL_FAKE)
+-		return;
++		goto genid_check;
+ 	if (req->level >= NFT_CL_CHAINS)
+ 		fetch_chain_cache(h, t, chains);
+ 	if (req->level >= NFT_CL_SETS)
+ 		fetch_set_cache(h, t, NULL);
+ 	if (req->level >= NFT_CL_RULES)
+ 		fetch_rule_cache(h, t);
+-
++genid_check:
+ 	mnl_genid_get(h, &genid_check);
+ 	if (h->nft_genid != genid_check) {
+ 		flush_cache(h, h->cache, NULL);
+-- 
+2.27.0
+

0004-nft-Fix-command-name-in-ip6tables-error-message.patch

@@ -0,0 +1,45 @@
+From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 7 Aug 2020 13:48:28 +0200
+Subject: [PATCH] nft: Fix command name in ip6tables error message
+
+Upon errors, ip6tables-nft would prefix its error messages with
+'iptables:' instead of 'ip6tables:'. Turns out the command name was
+hard-coded, use 'progname' variable instead.
+While being at it, merge the two mostly identical fprintf() calls into
+one.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-standalone.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
+index dd6fb7919d2e1..7b71db62f1ea6 100644
+--- a/iptables/xtables-standalone.c
++++ b/iptables/xtables-standalone.c
+@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
+ 	xtables_fini();
+ 
+ 	if (!ret) {
+-		if (errno == EINVAL) {
+-			fprintf(stderr, "iptables: %s. "
+-					"Run `dmesg' for more information.\n",
+-				nft_strerror(errno));
+-		} else {
+-			fprintf(stderr, "iptables: %s.\n",
+-				nft_strerror(errno));
+-		}
++		fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
++			(errno == EINVAL ?
++			 " Run `dmesg' for more information." : ""));
++
+ 		if (errno == EAGAIN)
+ 			exit(RESOURCE_PROBLEM);
+ 	}
+-- 
+2.27.0
+

0005-ebtables-Fix-for-broken-chain-renaming.patch

@@ -0,0 +1,66 @@
+From 1b7ca0bdd7284d750f894f59e48f9a8b0da82076 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 17 Nov 2020 11:38:27 +0100
+Subject: [PATCH] ebtables: Fix for broken chain renaming
+
+Loading extensions pollutes 'errno' value, hence before using it to
+indicate failure it should be sanitized. This was done by the called
+function before the parsing/netlink split and not migrated by accident.
+Move it into calling code to clarify the connection.
+
+Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247)
+
+ Conflicts:
+	iptables/nft.c
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c                                                | 3 ---
+ iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++
+ iptables/xtables-eb.c                                         | 1 +
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 0c5a74fc232c6..2e4b91916b332 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1936,9 +1936,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
+ 
+ 	nft_xt_builtin_init(h, table);
+ 
+-	/* Config load changed errno. Ensure genuine info for our callers. */
+-	errno = 0;
+-
+ 	/* Find the old chain to be renamed */
+ 	c = nft_chain_find(h, table, chain);
+ 	if (c == NULL) {
+diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
+index 0c1eb4ca66f52..6f11bd12593dd 100755
+--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
+@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then
+ 	exit 1
+ fi
+ 
++$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1
++$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1
++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
++
+ $XT_MULTI ebtables -t $t -F || exit 0
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 375a95d1d5c75..6df5839f07436 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 				else if (strchr(argv[optind], ' ') != NULL)
+ 					xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
+ 
++				errno = 0;
+ 				ret = nft_cmd_chain_user_rename(h, chain, *table,
+ 							    argv[optind]);
+ 				if (ret != 0 && errno == ENOENT)
+-- 
+2.28.0
+

0006-ebtables-Exit-gracefully-on-invalid-table-names.patch

@@ -0,0 +1,51 @@
+From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 28 Jan 2021 01:09:56 +0100
+Subject: [PATCH] ebtables: Exit gracefully on invalid table names
+
+Users are able to cause program abort by passing a table name that
+doesn't exist:
+
+| # ebtables-nft -t dummy -P INPUT ACCEPT
+| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed.
+| Aborted
+
+Avoid this by checking table existence just like iptables-nft does upon
+parsing '-t' optarg. Since the list of tables is known and fixed,
+checking the given name's length is pointless. So just drop that check
+in return.
+
+With this patch in place, output looks much better:
+
+| # ebtables-nft -t dummy -P INPUT ACCEPT
+| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist
+| Perhaps iptables or your kernel needs to be upgraded.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-eb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index cfa9317c78e94..5bb34d6d292a9 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -914,10 +914,10 @@ print_zero:
+ 				xtables_error(PARAMETER_PROBLEM,
+ 					      "The -t option (seen in line %u) cannot be used in %s.\n",
+ 					      line, xt_params->program_name);
+-			if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1)
+-				xtables_error(PARAMETER_PROBLEM,
+-					      "Table name length cannot exceed %d characters",
+-					      EBT_TABLE_MAXNAMELEN - 1);
++			if (!nft_table_builtin_find(h, optarg))
++				xtables_error(VERSION_PROBLEM,
++					      "table '%s' does not exist",
++					      optarg);
+ 			*table = optarg;
+ 			table_set = true;
+ 			break;
+-- 
+2.28.0
+

0007-iptables-accept-lock-file-name-at-runtime.patch

@@ -0,0 +1,94 @@
+From 05b2a86662ad732ecfbec1c2ef597dbedf54cf9c Mon Sep 17 00:00:00 2001
+From: Giuseppe Scrivano <gscrivan@redhat.com>
+Date: Fri, 17 Jul 2020 10:39:40 +0200
+Subject: [PATCH] iptables: accept lock file name at runtime
+
+allow users to override at runtime the lock file to use through the
+XTABLES_LOCKFILE environment variable.
+
+It allows to use iptables when the user has granted enough
+capabilities (e.g. a user+network namespace) to configure the network
+but that lacks access to the XT_LOCK_NAME (by default placed under
+/run).
+
+$ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ...
+
+Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 5105e844c2ff6a3e320bf8cdadc5094d4eaef2b7)
+---
+ configure.ac           |  1 +
+ iptables/iptables.8.in |  8 ++++++++
+ iptables/xshared.c     | 11 ++++++++---
+ 3 files changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 31a8bb261c437..d37752a20afd2 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -219,6 +219,7 @@ AC_SUBST([libxtables_vmajor])
+ 
+ AC_DEFINE_UNQUOTED([XT_LOCK_NAME], "${xt_lock_name}",
+ 	[Location of the iptables lock file])
++AC_SUBST([XT_LOCK_NAME], "${xt_lock_name}")
+ 
+ AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile
+ 	iptables/Makefile iptables/xtables.pc
+diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
+index 054564b3df91e..999cf339845f9 100644
+--- a/iptables/iptables.8.in
++++ b/iptables/iptables.8.in
+@@ -397,6 +397,14 @@ corresponding to that rule's position in the chain.
+ \fB\-\-modprobe=\fP\fIcommand\fP
+ When adding or inserting rules into a chain, use \fIcommand\fP
+ to load any necessary modules (targets, match extensions, etc).
++
++.SH LOCK FILE
++iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at
++launch.
++
++The \fBXTABLES_LOCKFILE\fP environment variable can be used to override
++the default setting.
++
+ .SH MATCH AND TARGET EXTENSIONS
+ .PP
+ iptables can use extended packet matching and target modules.
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index c1d1371a6d54a..7d97637f7e129 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -249,15 +249,20 @@ void xs_init_match(struct xtables_match *match)
+ static int xtables_lock(int wait, struct timeval *wait_interval)
+ {
+ 	struct timeval time_left, wait_time;
++	const char *lock_file;
+ 	int fd, i = 0;
+ 
+ 	time_left.tv_sec = wait;
+ 	time_left.tv_usec = 0;
+ 
+-	fd = open(XT_LOCK_NAME, O_CREAT, 0600);
++	lock_file = getenv("XTABLES_LOCKFILE");
++	if (lock_file == NULL || lock_file[0] == '\0')
++		lock_file = XT_LOCK_NAME;
++
++	fd = open(lock_file, O_CREAT, 0600);
+ 	if (fd < 0) {
+ 		fprintf(stderr, "Fatal: can't open lock file %s: %s\n",
+-			XT_LOCK_NAME, strerror(errno));
++			lock_file, strerror(errno));
+ 		return XT_LOCK_FAILED;
+ 	}
+ 
+@@ -265,7 +270,7 @@ static int xtables_lock(int wait, struct timeval *wait_interval)
+ 		if (flock(fd, LOCK_EX) == 0)
+ 			return fd;
+ 
+-		fprintf(stderr, "Can't lock %s: %s\n", XT_LOCK_NAME,
++		fprintf(stderr, "Can't lock %s: %s\n", lock_file,
+ 			strerror(errno));
+ 		return XT_LOCK_BUSY;
+ 	}
+-- 
+2.31.0
+

iptables.spec

@@ -19,7 +19,7 @@ Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: http://www.netfilter.org/projects/iptables
 Version: 1.8.5
-Release: 2%{?dist}
+Release: 6%{?dist}
 Source: %{url}/files/%{name}-%{version}.tar.bz2
 Source1: iptables.init
 Source2: iptables-config
@@ -34,6 +34,11 @@ Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
 
 Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch
 Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch
+Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
+Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch
+Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch
+Patch6: 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch
+Patch7: 0007-iptables-accept-lock-file-name-at-runtime.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
@@ -446,6 +451,19 @@ fi
 
 
 %changelog
+* Wed Mar 24 2021 Phil Sutter <psutter@redhat.com> - 1.8.5-6
+- iptables: accept lock file name at runtime
+
+* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.5-5
+- ebtables: Exit gracefully on invalid table names
+
+* Tue Nov 17 14:37:49 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-4
+- ebtables: Fix for broken chain renaming
+
+* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-3
+- nft: cache: Check consistency with NFT_CL_FAKE, too
+- nft: Fix command name in ip6tables error message
+
 * Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.5-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild