rpms
/
iptables
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import iptables-1.8.4-10.el8_2.1

This commit is contained in:
CentOS Sources 2020-07-21 06:23:46 -04:00 committed by Andrew Lukoshko
parent 8807ad6906
commit 94389dbbc5
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
SOURCES/0018-nft-cache-Reset-genid-when-rebuilding-cache.patch Normal file
View File

@ -0,0 +1,37 @@
From f2f7731420d56e7164d352d62184408d9570bef1 Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Fri, 29 May 2020 19:33:22 +0200
Subject: [PATCH] nft: cache: Reset genid when rebuilding cache
This is required in order to avoid a cache rebuild loop if
iptables-nft-restore is called with '--test' parameter and a dump
containing more than a single table.
If non-zero, __nft_build_cache() never updates genid and therefore the
incorrect genid (caused by increment in nft_action()) is never
corrected.
This is a RHEL-only fix, upstream rewrote the whole cache logic which
implicitly resolved this problem.
Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress")
Signed-off-by: Phil Sutter <psutter@redhat.com>
---
iptables/nft-cache.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
index 07265b7795e4f..bc6e7f7eaebfb 100644
--- a/iptables/nft-cache.c
+++ b/iptables/nft-cache.c
@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h)
if (h->cache_level)
__nft_flush_cache(h);
+ h->nft_genid = 0;
h->cache_level = NFT_CL_NONE;
__nft_build_cache(h, level, NULL, NULL, NULL);
}
--
2.27.0

6
SPECS/iptables.spec
View File

@ -17,7 +17,7 @@ Name: iptables
Summary: Tools for managing Linux kernel packet filtering capabilities
URL: http://www.netfilter.org/projects/iptables
Version: 1.8.4
Release: 10%{?dist}
Release: 10%{?dist}.1
Source: %{url}/files/%{name}-%{version}.tar.bz2
Source1: iptables.init
Source2: iptables-config
@ -51,6 +51,7 @@ Patch14: 0014-iptables-test.py-Fix-host-mode.patch
Patch15: 0015-xtables-monitor-Fix-segfault-when-tracing.patch
Patch16: 0016-nft-cache-Fix-nft_release_cache-under-stress.patch
Patch17: 0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch
Patch18: 0018-nft-cache-Reset-genid-when-rebuilding-cache.patch
# pf.os: ISC license
# iptables-apply: Artistic Licence 2.0
@ -459,6 +460,9 @@ done
%doc %{_mandir}/man8/ebtables*.8*
%changelog
* Tue Jun 09 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-10.1
- Fix for hanging iptables-restore --test
* Tue Mar 17 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-10
- Fix for iptables-restore segfault under pressure
- Fix for iptables-save segfault under pressure