From 7a8231504928a4ad7a2229d0f8a27d9734159647 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 7 Nov 2023 23:44:55 +0100 Subject: [PATCH] ebtables: Fix corner-case noflush restore bug JIRA: https://issues.redhat.com/browse/RHEL-14147 Upstream Status: iptables commit c1083acea70787eea3f7929fd04718434bb05ba8 commit c1083acea70787eea3f7929fd04718434bb05ba8 Author: Phil Sutter Date: Tue Nov 7 19:12:14 2023 +0100 ebtables: Fix corner-case noflush restore bug Report came from firwalld, but this is actually rather hard to trigger. Since a regular chain line prevents it, typical dump/restore use-cases are unaffected. Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation") Cc: Eric Garver Signed-off-by: Phil Sutter Signed-off-by: Phil Sutter --- .../testcases/ebtables/0009-broute-bug_0 | 25 +++++++++++++++++++ iptables/xtables-eb.c | 2 ++ 2 files changed, 27 insertions(+) create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 new file mode 100755 index 0000000..0def0ac --- /dev/null +++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 @@ -0,0 +1,25 @@ +#!/bin/sh +# +# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring: +# - with --noflush +# - a second table after the broute one +# - A policy command but no chain line for BROUTING chain + +set -e + +case "$XT_MULTI" in +*xtables-nft-multi) + ;; +*) + echo "skip $XT_MULTI" + exit 0 + ;; +esac + +$XT_MULTI ebtables-restore --noflush <