libnetfilter_conntrack-1.0.9-1.el9

- expect/conntrack: Avoid spurious covscan overrun warning
- conntrack: fix build with kernel 5.15 and musl
- New version 1.0.9

Resolves: rhbz#2150043

.gitignore

@@ -9,3 +9,4 @@ libnetfilter_conntrack-0.0.101.tar.bz2
 /libnetfilter_conntrack-1.0.6.tar.bz2
 /libnetfilter_conntrack-1.0.7.tar.bz2
 /libnetfilter_conntrack-1.0.8.tar.bz2
+/libnetfilter_conntrack-1.0.9.tar.bz2

0001-conntrack-fix-build-with-kernel-5.15-and-musl.patch

@@ -0,0 +1,57 @@
+From 8ee1e27facf598a1362b29b794e51271b5be4db7 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Thu, 24 Feb 2022 15:01:11 +0100
+Subject: [PATCH] conntrack: fix build with kernel 5.15 and musl
+
+Currently, with kernel 5.15 headers and musl building is failing with
+redefinition errors due to a conflict between the kernel and musl headers.
+
+Musl is able to suppres the conflicting kernel header definitions if they
+are included after the standard libc ones, however since ICMP definitions
+were moved into a separate internal header to avoid duplication this has
+stopped working and is breaking the builds.
+
+It seems that the issue is that <netinet/in.h> which contains the UAPI
+suppression defines is included in the internal.h header and not in the
+proto.h which actually includes the kernel ICMP headers and thus UAPI
+supression defines are not present.
+
+Solve this by moving the <netinet/in.h> include before the ICMP kernel
+includes in the proto.h
+
+Fixes: bc1cb4b11403 ("conntrack: Move icmp request>reply type mapping to common file")
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit 21ee35dde73aec5eba35290587d479218c6dd824)
+---
+ include/internal/internal.h | 1 -
+ include/internal/proto.h    | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/internal/internal.h b/include/internal/internal.h
+index 2ef8a9057628b..7cd7c44bf8336 100644
+--- a/include/internal/internal.h
++++ b/include/internal/internal.h
+@@ -14,7 +14,6 @@
+ #include <arpa/inet.h>
+ #include <time.h>
+ #include <errno.h>
+-#include <netinet/in.h>
+ 
+ #include <libnfnetlink/libnfnetlink.h>
+ #include <libnetfilter_conntrack/libnetfilter_conntrack.h>
+diff --git a/include/internal/proto.h b/include/internal/proto.h
+index 40e7bfe63cc77..60a5f4e4ff8e0 100644
+--- a/include/internal/proto.h
++++ b/include/internal/proto.h
+@@ -2,6 +2,7 @@
+ #define _NFCT_PROTO_H_
+ 
+ #include <stdint.h>
++#include <netinet/in.h>
+ #include <linux/icmp.h>
+ #include <linux/icmpv6.h>
+ 
+-- 
+2.38.0
+

0002-expect-conntrack-Avoid-spurious-covscan-overrun-warn.patch

@@ -0,0 +1,92 @@
+From 883bc7739f467000f1ccb00b5d0e383c7289dcc0 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Mar 2022 14:55:53 +0100
+Subject: [PATCH] expect/conntrack: Avoid spurious covscan overrun warning
+
+It doesn't like how memset() is called for a struct nfnlhdr pointer with
+large size value. Pass void pointers instead. This also removes the call
+from __build_{expect,conntrack}() which is duplicate in
+__build_query_{exp,ct}() code-path.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 86f5bdc2a85b208053e7361ccd575e4eb3c853a3)
+---
+ src/conntrack/api.c   | 4 +++-
+ src/conntrack/build.c | 2 --
+ src/expect/api.c      | 4 +++-
+ src/expect/build.c    | 2 --
+ 4 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/conntrack/api.c b/src/conntrack/api.c
+index b7f64fb43ce83..7f72d07f2e7f6 100644
+--- a/src/conntrack/api.c
++++ b/src/conntrack/api.c
+@@ -779,6 +779,8 @@ int nfct_build_conntrack(struct nfnl_subsys_handle *ssh,
+ 	assert(req != NULL);
+ 	assert(ct != NULL);
+ 
++	memset(req, 0, size);
++
+ 	return __build_conntrack(ssh, req, size, type, flags, ct);
+ }
+ 
+@@ -812,7 +814,7 @@ __build_query_ct(struct nfnl_subsys_handle *ssh,
+ 	assert(data != NULL);
+ 	assert(req != NULL);
+ 
+-	memset(req, 0, size);
++	memset(buffer, 0, size);
+ 
+ 	switch(qt) {
+ 	case NFCT_Q_CREATE:
+diff --git a/src/conntrack/build.c b/src/conntrack/build.c
+index b5a7061d53698..f80cfc12d5e38 100644
+--- a/src/conntrack/build.c
++++ b/src/conntrack/build.c
+@@ -27,8 +27,6 @@ int __build_conntrack(struct nfnl_subsys_handle *ssh,
+ 		return -1;
+ 	}
+ 
+-	memset(req, 0, size);
+-
+ 	buf = (char *)&req->nlh;
+ 	nlh = mnl_nlmsg_put_header(buf);
+ 	nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK << 8) | type;
+diff --git a/src/expect/api.c b/src/expect/api.c
+index 39cd09249684c..b100c72ded50e 100644
+--- a/src/expect/api.c
++++ b/src/expect/api.c
+@@ -513,6 +513,8 @@ int nfexp_build_expect(struct nfnl_subsys_handle *ssh,
+ 	assert(req != NULL);
+ 	assert(exp != NULL);
+ 
++	memset(req, 0, size);
++
+ 	return __build_expect(ssh, req, size, type, flags, exp);
+ }
+ 
+@@ -546,7 +548,7 @@ __build_query_exp(struct nfnl_subsys_handle *ssh,
+ 	assert(data != NULL);
+ 	assert(req != NULL);
+ 
+-	memset(req, 0, size);
++	memset(buffer, 0, size);
+ 
+ 	switch(qt) {
+ 	case NFCT_Q_CREATE:
+diff --git a/src/expect/build.c b/src/expect/build.c
+index 2e0f968f36dad..1807adce26f62 100644
+--- a/src/expect/build.c
++++ b/src/expect/build.c
+@@ -29,8 +29,6 @@ int __build_expect(struct nfnl_subsys_handle *ssh,
+ 	else
+ 		return -1;
+ 
+-	memset(req, 0, size);
+-
+ 	buf = (char *)&req->nlh;
+ 	nlh = mnl_nlmsg_put_header(buf);
+ 	nlh->nlmsg_type = (NFNL_SUBSYS_CTNETLINK_EXP << 8) | type;
+-- 
+2.38.0
+

libnetfilter_conntrack.spec

@@ -1,12 +1,13 @@
 Name:           libnetfilter_conntrack
-Version:        1.0.8
-Release:        5%{?dist}
+Version:        1.0.9
+Release:        1%{?dist}
 Summary:        Netfilter conntrack userspace library
 License:        GPLv2+
 URL:            http://netfilter.org
 Source0:        http://netfilter.org/projects/libnetfilter_conntrack/files/%{name}-%{version}.tar.bz2
 
-Patch01:        0001-conntrack-don-t-cancel-nest-on-unknown-layer-4-proto.patch
+Patch01:        0001-conntrack-fix-build-with-kernel-5.15-and-musl.patch
+Patch02:        0002-expect-conntrack-Avoid-spurious-covscan-overrun-warn.patch
 
 BuildRequires:  gcc
 BuildRequires:  kernel-headers
@@ -53,6 +54,11 @@ find $RPM_BUILD_ROOT -type f -name "*.la" -delete
 %{_includedir}/libnetfilter_conntrack/*.h
 
 %changelog
+* Thu Dec 08 2022 Phil Sutter <psutter@redhat.com> - 1.0.9-1
+- expect/conntrack: Avoid spurious covscan overrun warning
+- conntrack: fix build with kernel 5.15 and musl
+- New version 1.0.9
+
 * Wed Dec 07 2022 Phil Sutter <psutter@redhat.com> - 1.0.8-5
 - conntrack: don't cancel nest on unknown layer 4 protocols
 

sources

@@ -1 +1 @@
-SHA512 (libnetfilter_conntrack-1.0.8.tar.bz2) = ddc70e7e3f2d764ed1e115e4a03fe8848b8c04bd69eea0952e63131dd4dae3c23f33b8be518673e1ec3b5dbf708f5f86eac97be46fe265d95386a5e902bd0b82
+SHA512 (libnetfilter_conntrack-1.0.9.tar.bz2) = e8b03425aaba3b72e6034c215656c34176d0550c08e0455aaeb1365d9141505d0c4feaa8978c8ccf2b7af9db6c9e874ceb866347e533b41cb03a189884f4004c