From 9a94261e69abb48f5da6af5400896fd1b8313804 Mon Sep 17 00:00:00 2001 From: Thomas Woerner Date: Mon, 30 Mar 2009 12:59:19 +0000 Subject: [PATCH] forgot to add patch --- iptables-1.4.3.1-cloexec.patch | 109 +++++++++++++++++++++++++++++++++ 1 file changed, 109 insertions(+) create mode 100644 iptables-1.4.3.1-cloexec.patch diff --git a/iptables-1.4.3.1-cloexec.patch b/iptables-1.4.3.1-cloexec.patch new file mode 100644 index 0000000..47af3f7 --- /dev/null +++ b/iptables-1.4.3.1-cloexec.patch @@ -0,0 +1,109 @@ +diff -up iptables-1.4.3.1/extensions/libipt_realm.c.cloexec iptables-1.4.3.1/extensions/libipt_realm.c +--- iptables-1.4.3.1/extensions/libipt_realm.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/extensions/libipt_realm.c 2009-03-30 14:23:11.000000000 +0200 +@@ -49,7 +49,7 @@ static void load_realms(void) + int id; + struct realmname *oldnm = NULL, *newnm = NULL; + +- fil = fopen(rfnm, "r"); ++ fil = fopen(rfnm, "re"); + if (!fil) { + rdberr = 1; + return; +@@ -248,7 +248,7 @@ static struct xtables_match realm_mt_reg + .extra_opts = realm_opts, + }; + +-void _init(void) ++void __attribute((constructor)) nf_ext_init(void) + { + xtables_register_match(&realm_mt_reg); + } +diff -up iptables-1.4.3.1/ip6tables-restore.c.cloexec iptables-1.4.3.1/ip6tables-restore.c +--- iptables-1.4.3.1/ip6tables-restore.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/ip6tables-restore.c 2009-03-30 14:23:11.000000000 +0200 +@@ -169,7 +169,7 @@ int main(int argc, char *argv[]) + } + + if (optind == argc - 1) { +- in = fopen(argv[optind], "r"); ++ in = fopen(argv[optind], "re"); + if (!in) { + fprintf(stderr, "Can't open %s: %s\n", argv[optind], + strerror(errno)); +diff -up iptables-1.4.3.1/ip6tables-save.c.cloexec iptables-1.4.3.1/ip6tables-save.c +--- iptables-1.4.3.1/ip6tables-save.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/ip6tables-save.c 2009-03-30 14:24:11.000000000 +0200 +@@ -41,7 +41,7 @@ static int for_each_table(int (*func)(co + FILE *procfile = NULL; + char tablename[IP6T_TABLE_MAXNAMELEN+1]; + +- procfile = fopen("/proc/net/ip6_tables_names", "r"); ++ procfile = fopen("/proc/net/ip6_tables_names", "re"); + if (!procfile) + return ret; + +diff -up iptables-1.4.3.1/iptables-restore.c.cloexec iptables-1.4.3.1/iptables-restore.c +--- iptables-1.4.3.1/iptables-restore.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/iptables-restore.c 2009-03-30 14:23:11.000000000 +0200 +@@ -175,7 +175,7 @@ main(int argc, char *argv[]) + } + + if (optind == argc - 1) { +- in = fopen(argv[optind], "r"); ++ in = fopen(argv[optind], "re"); + if (!in) { + fprintf(stderr, "Can't open %s: %s\n", argv[optind], + strerror(errno)); +diff -up iptables-1.4.3.1/iptables-save.c.cloexec iptables-1.4.3.1/iptables-save.c +--- iptables-1.4.3.1/iptables-save.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/iptables-save.c 2009-03-30 14:24:33.000000000 +0200 +@@ -39,7 +39,7 @@ static int for_each_table(int (*func)(co + FILE *procfile = NULL; + char tablename[IPT_TABLE_MAXNAMELEN+1]; + +- procfile = fopen("/proc/net/ip_tables_names", "r"); ++ procfile = fopen("/proc/net/ip_tables_names", "re"); + if (!procfile) + return ret; + +diff -up iptables-1.4.3.1/iptables-xml.c.cloexec iptables-1.4.3.1/iptables-xml.c +--- iptables-1.4.3.1/iptables-xml.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/iptables-xml.c 2009-03-30 14:23:11.000000000 +0200 +@@ -653,7 +653,7 @@ main(int argc, char *argv[]) + } + + if (optind == argc - 1) { +- in = fopen(argv[optind], "r"); ++ in = fopen(argv[optind], "re"); + if (!in) { + fprintf(stderr, "Can't open %s: %s", argv[optind], + strerror(errno)); +diff -up iptables-1.4.3.1/xtables.c.cloexec iptables-1.4.3.1/xtables.c +--- iptables-1.4.3.1/xtables.c.cloexec 2009-03-24 13:08:24.000000000 +0100 ++++ iptables-1.4.3.1/xtables.c 2009-03-30 14:25:51.000000000 +0200 +@@ -280,6 +280,11 @@ static char *get_modprobe(void) + procfile = open(PROC_SYS_MODPROBE, O_RDONLY); + if (procfile < 0) + return NULL; ++ if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) { ++ fprintf(stderr, "Could not set close on exec: %s\n", ++ strerror(errno)); ++ exit(1); ++ } + + ret = (char *) malloc(PROCFILE_BUFSIZ); + if (ret) { +@@ -672,6 +677,12 @@ static int compatible_revision(const cha + exit(1); + } + ++ if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { ++ fprintf(stderr, "Could not set close on exec: %s\n", ++ strerror(errno)); ++ exit(1); ++ } ++ + xtables_load_ko(xtables_modprobe_program, true); + + strcpy(rev.name, name);