From f25b42a62f6f19e0404bf219e90f479a6ff40188 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 21 Feb 2023 08:47:01 +0000 Subject: [PATCH] import iptables-1.8.4-23.el8_7.1 --- ...-nft-shared-Introduce-__get_cmp_data.patch | 69 ++++++ SOURCES/0078-ebtables-Support-p-Length.patch | 227 ++++++++++++++++++ SPECS/iptables.spec | 9 +- 3 files changed, 304 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch create mode 100644 SOURCES/0078-ebtables-Support-p-Length.patch diff --git a/SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch b/SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch new file mode 100644 index 0000000..a66ba06 --- /dev/null +++ b/SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch @@ -0,0 +1,69 @@ +From f224f2763d3502b159286bcc90e769580b9f07b0 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 27 Sep 2022 23:15:37 +0200 +Subject: [PATCH] nft-shared: Introduce __get_cmp_data() + +This is an inner function to get_cmp_data() returning the op value as-is +for caller examination. + +Signed-off-by: Phil Sutter +(cherry picked from commit 8dc22798bf813ce92aaac58a6fe8749fe3fc18dc) + +Conflicts: + iptables/nft-shared.c + iptables/nft-shared.h +- Context changes due to missing commits + cf14b92bc1a3f ("nft-shared: Drop unused function print_proto()") and + aa92ec96078d0 ("nft: pass struct nft_xt_ctx to parse_meta()") +--- + iptables/nft-shared.c | 17 ++++++++++------- + iptables/nft-shared.h | 1 + + 2 files changed, 11 insertions(+), 7 deletions(-) + +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index e3ba4ac34146f..af6d33ce6120b 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -388,17 +388,20 @@ void print_proto(uint16_t proto, int invert) + printf("-p %u ", proto); + } + +-void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv) ++void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op) + { + uint32_t len; +- uint8_t op; + + memcpy(data, nftnl_expr_get(e, NFTNL_EXPR_CMP_DATA, &len), dlen); +- op = nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP); +- if (op == NFT_CMP_NEQ) +- *inv = true; +- else +- *inv = false; ++ *op = nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP); ++} ++ ++void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv) ++{ ++ uint8_t op; ++ ++ __get_cmp_data(e, data, dlen, &op); ++ *inv = (op == NFT_CMP_NEQ); + } + + static void nft_meta_set_to_target(struct nft_xt_ctx *ctx) +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 29f7056714235..e01381b83c47a 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -143,6 +143,7 @@ int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface, + unsigned char *iniface_mask, char *outiface, + unsigned char *outiface_mask, uint8_t *invflags); + void print_proto(uint16_t proto, int invert); ++void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); + void nft_rule_to_iptables_command_state(struct nft_handle *h, + const struct nftnl_rule *r, +-- +2.38.0 + diff --git a/SOURCES/0078-ebtables-Support-p-Length.patch b/SOURCES/0078-ebtables-Support-p-Length.patch new file mode 100644 index 0000000..845609d --- /dev/null +++ b/SOURCES/0078-ebtables-Support-p-Length.patch @@ -0,0 +1,227 @@ +From 76c798f2f0021aaf740fa6cb90833e56130f7064 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 27 Sep 2022 23:19:34 +0200 +Subject: [PATCH] ebtables: Support '-p Length' + +To match on Ethernet frames using the etherproto field as length value, +ebtables accepts the special protocol name "LENGTH". Implement this in +ebtables-nft using a native match for 'ether type < 0x0600'. + +Since extension 802_3 matches are valid only with such Ethernet frames, +add a local add_match() wrapper which complains if the extension is used +without '-p Length' parameter. Legacy ebtables does this within the +extension's final_check callback, but it's not possible here due for lack of +fw->bitmask field access. + +While being at it, add xlate support, adjust tests and make ebtables-nft +print the case-insensitive argument with capital 'L' like legacy +ebtables does. + +Signed-off-by: Phil Sutter +(cherry picked from commit aa0b8b03f7c7e741ccd96360bd64d90ea8c3c3aa) + +Conflicts: + iptables/nft-bridge.c +- Adjusted to missing commit 7e38890c6b4fb + ("nft: prepare for dynamic register allocation") +- Context change due to missing commit 0c0cd4340ed88 + ("nft: Don't pass command state opaque to family ops callbacks") +--- + extensions/generic.txlate | 6 +++ + extensions/libebt_802_3.t | 6 ++- + iptables/nft-bridge.c | 47 +++++++++++++++---- + .../ebtables/0002-ebtables-save-restore_0 | 12 ++--- + 4 files changed, 53 insertions(+), 18 deletions(-) + +diff --git a/extensions/generic.txlate b/extensions/generic.txlate +index 9ae9a5b54c1b9..6779d6f86dec8 100644 +--- a/extensions/generic.txlate ++++ b/extensions/generic.txlate +@@ -67,6 +67,12 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi + ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00 + nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter + ++ebtables-translate -I INPUT -p Length ++nft insert rule bridge filter INPUT ether type < 0x0600 counter ++ ++ebtables-translate -I INPUT -p ! Length ++nft insert rule bridge filter INPUT ether type >= 0x0600 counter ++ + # asterisk is not special in iptables and it is even a valid interface name + iptables-translate -A FORWARD -i '*' -o 'eth*foo' + nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter +diff --git a/extensions/libebt_802_3.t b/extensions/libebt_802_3.t +index ddfb2f0a72baf..a138f35d2c756 100644 +--- a/extensions/libebt_802_3.t ++++ b/extensions/libebt_802_3.t +@@ -1,3 +1,5 @@ + :INPUT,FORWARD,OUTPUT +---802_3-sap ! 0x0a -j CONTINUE;=;OK +---802_3-type 0x000a -j RETURN;=;OK ++--802_3-sap ! 0x0a -j CONTINUE;=;FAIL ++--802_3-type 0x000a -j RETURN;=;FAIL ++-p Length --802_3-sap ! 0x0a -j CONTINUE;=;OK ++-p Length --802_3-type 0x000a -j RETURN;=;OK +diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c +index 3fd03fb8de4ff..176304e9f2f23 100644 +--- a/iptables/nft-bridge.c ++++ b/iptables/nft-bridge.c +@@ -129,6 +129,18 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs) + return add_action(r, cs, false); + } + ++static int ++nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw, ++ struct nftnl_rule *r, struct xt_entry_match *m) ++{ ++ if (!strcmp(m->u.user.name, "802_3") && ++ !(fw->bitmask & EBT_802_3)) ++ xtables_error(PARAMETER_PROBLEM, ++ "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH"); ++ ++ return add_match(h, r, m); ++} ++ + static int nft_bridge_add(struct nft_handle *h, + struct nftnl_rule *r, void *data) + { +@@ -172,17 +184,25 @@ static int nft_bridge_add(struct nft_handle *h, + } + + if ((fw->bitmask & EBT_NOPROTO) == 0) { ++ uint16_t ethproto = fw->ethproto; ++ + op = nft_invflags2cmp(fw->invflags, EBT_IPROTO); + add_payload(r, offsetof(struct ethhdr, h_proto), 2, + NFT_PAYLOAD_LL_HEADER); +- add_cmp_u16(r, fw->ethproto, op); ++ ++ if (fw->bitmask & EBT_802_3) { ++ op = (op == NFT_CMP_EQ ? NFT_CMP_LT : NFT_CMP_GTE); ++ ethproto = htons(0x0600); ++ } ++ ++ add_cmp_u16(r, ethproto, op); + } + + add_compat(r, fw->ethproto, fw->invflags & EBT_IPROTO); + + for (iter = cs->match_list; iter; iter = iter->next) { + if (iter->ismatch) { +- if (add_match(h, r, iter->u.match->m)) ++ if (nft_bridge_add_match(h, fw, r, iter->u.match->m)) + break; + } else { + if (add_target(r, iter->u.watcher->t)) +@@ -239,6 +259,7 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx, + struct ebt_entry *fw = &cs->eb; + unsigned char addr[ETH_ALEN]; + unsigned short int ethproto; ++ uint8_t op; + bool inv; + int i; + +@@ -275,8 +296,14 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx, + fw->bitmask |= EBT_ISOURCE; + break; + case offsetof(struct ethhdr, h_proto): +- get_cmp_data(e, ðproto, sizeof(ethproto), &inv); +- fw->ethproto = ethproto; ++ __get_cmp_data(e, ðproto, sizeof(ethproto), &op); ++ if (ethproto == htons(0x0600)) { ++ fw->bitmask |= EBT_802_3; ++ inv = (op == NFT_CMP_GTE); ++ } else { ++ fw->ethproto = ethproto; ++ inv = (op == NFT_CMP_NEQ); ++ } + if (inv) + fw->invflags |= EBT_IPROTO; + fw->bitmask &= ~EBT_NOPROTO; +@@ -611,7 +638,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask) + printf("! "); + + if (bitmask & EBT_802_3) { +- printf("length "); ++ printf("Length "); + return; + } + +@@ -626,7 +653,7 @@ static void nft_bridge_save_rule(const void *data, unsigned int format) + { + const struct iptables_command_state *cs = data; + +- if (cs->eb.ethproto) ++ if (!(cs->eb.bitmask & EBT_NOPROTO)) + print_protocol(cs->eb.ethproto, cs->eb.invflags & EBT_IPROTO, + cs->eb.bitmask); + if (cs->eb.bitmask & EBT_ISOURCE) +@@ -892,7 +919,10 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl) + xlate_ifname(xl, "meta obrname", cs->eb.logical_out, + cs->eb.invflags & EBT_ILOGICALOUT); + +- if ((cs->eb.bitmask & EBT_NOPROTO) == 0) { ++ if (cs->eb.bitmask & EBT_802_3) { ++ xt_xlate_add(xl, "ether type %s 0x0600 ", ++ cs->eb.invflags & EBT_IPROTO ? ">=" : "<"); ++ } else if ((cs->eb.bitmask & EBT_NOPROTO) == 0) { + const char *implicit = NULL; + + switch (ntohs(cs->eb.ethproto)) { +@@ -915,9 +945,6 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl) + ntohs(cs->eb.ethproto)); + } + +- if (cs->eb.bitmask & EBT_802_3) +- return 0; +- + if (cs->eb.bitmask & EBT_ISOURCE) + nft_bridge_xlate_mac(xl, "saddr", cs->eb.invflags & EBT_ISOURCE, + cs->eb.sourcemac, cs->eb.sourcemsk); +diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +index b84f63a7c3672..a4fc31548e323 100755 +--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 ++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 +@@ -13,8 +13,8 @@ $XT_MULTI ebtables -A INPUT -p IPv4 -i lo -j ACCEPT + $XT_MULTI ebtables -P FORWARD DROP + $XT_MULTI ebtables -A OUTPUT -s ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff -j DROP + $XT_MULTI ebtables -N foo +-$XT_MULTI ebtables -A foo --802_3-sap 0x23 -j ACCEPT +-$XT_MULTI ebtables -A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT ++$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 -j ACCEPT ++$XT_MULTI ebtables -A foo -p length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT + #$XT_MULTI ebtables -A foo --among-dst fe:ed:ba:be:00:01,fe:ed:ba:be:00:02,fe:ed:ba:be:00:03 -j ACCEPT + $XT_MULTI ebtables -A foo -p ARP --arp-gratuitous -j ACCEPT + $XT_MULTI ebtables -A foo -p ARP --arp-opcode Request -j ACCEPT +@@ -44,7 +44,7 @@ $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT + $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT + #$XT_MULTI ebtables -A foo --vlan-id 42 -j ACCEPT + +-$XT_MULTI ebtables -A foo --802_3-sap 0x23 --limit 100 -j ACCEPT ++$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 --limit 100 -j ACCEPT + $XT_MULTI ebtables -A foo --pkttype-type multicast --log + $XT_MULTI ebtables -A foo --pkttype-type multicast --limit 100 -j ACCEPT + +@@ -75,8 +75,8 @@ DUMP='*filter + -A INPUT -p IPv4 -i lo -j ACCEPT + -A FORWARD -j foo + -A OUTPUT -s Broadcast -j DROP +--A foo --802_3-sap 0x23 -j ACCEPT +--A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT ++-A foo -p Length --802_3-sap 0x23 -j ACCEPT ++-A foo -p Length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT + -A foo -p ARP --arp-gratuitous -j ACCEPT + -A foo -p ARP --arp-op Request -j ACCEPT + -A foo -p ARP --arp-ip-src 10.0.0.1 -j ACCEPT +@@ -96,7 +96,7 @@ DUMP='*filter + -A foo --nflog-group 1 -j CONTINUE + -A foo --pkttype-type multicast -j ACCEPT + -A foo --stp-type config -j ACCEPT +--A foo --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT ++-A foo -p Length --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT + -A foo --pkttype-type multicast --log-level notice --log-prefix "" -j CONTINUE + -A foo --pkttype-type multicast --limit 100/sec --limit-burst 5 -j ACCEPT + *nat +-- +2.38.0 + diff --git a/SPECS/iptables.spec b/SPECS/iptables.spec index 975d753..a9552ab 100644 --- a/SPECS/iptables.spec +++ b/SPECS/iptables.spec @@ -17,7 +17,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: http://www.netfilter.org/projects/iptables Version: 1.8.4 -Release: 23%{?dist} +Release: 23%{?dist}.1 Source: %{url}/files/%{name}-%{version}.tar.bz2 Source1: iptables.init Source2: iptables-config @@ -110,6 +110,9 @@ Patch73: 0073-Improve-error-messages-for-unsupported-extensions.patch Patch74: 0074-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch Patch75: 0075-tests-shell-Check-overhead-in-iptables-save-and-rest.patch Patch76: 0076-libxtables-Fix-unsupported-extension-warning-corner-.patch +Patch77: 0077-nft-shared-Introduce-__get_cmp_data.patch +Patch78: 0078-ebtables-Support-p-Length.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -518,6 +521,10 @@ done %doc %{_mandir}/man8/ebtables*.8* %changelog +* Wed Nov 23 2022 Phil Sutter - 1.8.4-23.1 +- ebtables: Support '-p Length' +- nft-shared: Introduce __get_cmp_data() + * Fri Jul 01 2022 Phil Sutter - 1.8.4-23 - libxtables: Fix unsupported extension warning corner case - tests: shell: Check overhead in iptables-save and -restore