import iptables-1.8.4-10.el8_2.1

SOURCES/0018-nft-cache-Reset-genid-when-rebuilding-cache.patch

@@ -0,0 +1,37 @@
+From f2f7731420d56e7164d352d62184408d9570bef1 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 29 May 2020 19:33:22 +0200
+Subject: [PATCH] nft: cache: Reset genid when rebuilding cache
+
+This is required in order to avoid a cache rebuild loop if
+iptables-nft-restore is called with '--test' parameter and a dump
+containing more than a single table.
+
+If non-zero, __nft_build_cache() never updates genid and therefore the
+incorrect genid (caused by increment in nft_action()) is never
+corrected.
+
+This is a RHEL-only fix, upstream rewrote the whole cache logic which
+implicitly resolved this problem.
+
+Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress")
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-cache.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 07265b7795e4f..bc6e7f7eaebfb 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h)
+ 	if (h->cache_level)
+ 		__nft_flush_cache(h);
+ 
++	h->nft_genid = 0;
+ 	h->cache_level = NFT_CL_NONE;
+ 	__nft_build_cache(h, level, NULL, NULL, NULL);
+ }
+-- 
+2.27.0
+

SPECS/iptables.spec

@@ -17,7 +17,7 @@ Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: http://www.netfilter.org/projects/iptables
 Version: 1.8.4
-Release: 10%{?dist}
+Release: 10%{?dist}.1
 Source: %{url}/files/%{name}-%{version}.tar.bz2
 Source1: iptables.init
 Source2: iptables-config
@@ -51,6 +51,7 @@ Patch14: 0014-iptables-test.py-Fix-host-mode.patch
 Patch15: 0015-xtables-monitor-Fix-segfault-when-tracing.patch
 Patch16: 0016-nft-cache-Fix-nft_release_cache-under-stress.patch
 Patch17: 0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch
+Patch18: 0018-nft-cache-Reset-genid-when-rebuilding-cache.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
@@ -459,6 +460,9 @@ done
 %doc %{_mandir}/man8/ebtables*.8*
 
 %changelog
+* Tue Jun 09 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-10.1
+- Fix for hanging iptables-restore --test
+
 * Tue Mar 17 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-10
 - Fix for iptables-restore segfault under pressure
 - Fix for iptables-save segfault under pressure