From f0685f22c0bd18ff07bd3178689ee8d80a2658bc Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 13 Aug 2021 11:07:36 +0200 Subject: [PATCH] libnetfilter_queue-1.0.5-1.el9 - Rebase onto upstream version 1.0.5 Resolves: rhbz#1993305 --- .gitignore | 1 + ...a-use-inet_ntop-instead-of-inet_ntoa.patch | 37 ------------ 0001-src-fix-IPv6-header-handling.patch | 58 +++++++++++++++++++ libnetfilter_queue.spec | 10 ++-- sources | 2 +- 5 files changed, 66 insertions(+), 42 deletions(-) delete mode 100644 0001-extra-use-inet_ntop-instead-of-inet_ntoa.patch create mode 100644 0001-src-fix-IPv6-header-handling.patch diff --git a/.gitignore b/.gitignore index b5732a1..4fdda18 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ libnetfilter_queue-0.0.17.tar.bz2 libnetfilter_queue-1.0.0.tar.bz2 /libnetfilter_queue-1.0.1.tar.bz2 /libnetfilter_queue-1.0.2.tar.bz2 +/libnetfilter_queue-1.0.5.tar.bz2 diff --git a/0001-extra-use-inet_ntop-instead-of-inet_ntoa.patch b/0001-extra-use-inet_ntop-instead-of-inet_ntoa.patch deleted file mode 100644 index d4dabe2..0000000 --- a/0001-extra-use-inet_ntop-instead-of-inet_ntoa.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 3065fb3642c8e554432059629808a62560e2184f Mon Sep 17 00:00:00 2001 -From: Ting-Wei Lan -Date: Fri, 20 Jun 2014 18:26:59 +0800 -Subject: [PATCH] extra: use inet_ntop instead of inet_ntoa - -The result of inet_ntoa() will be overwritten by the next call to -inet_ntoa(), so using it twice in the same snprintf() call causes -wrong result. - -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Phil Sutter ---- - src/extra/ipv4.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/src/extra/ipv4.c b/src/extra/ipv4.c -index 0fe716ba4697c..a93d113fb23cf 100644 ---- a/src/extra/ipv4.c -+++ b/src/extra/ipv4.c -@@ -134,9 +134,13 @@ int nfq_ip_snprintf(char *buf, size_t size, const struct iphdr *iph) - struct in_addr src = { iph->saddr }; - struct in_addr dst = { iph->daddr }; - -+ char src_str[INET_ADDRSTRLEN]; -+ char dst_str[INET_ADDRSTRLEN]; -+ - ret = snprintf(buf, size, "SRC=%s DST=%s LEN=%u TOS=0x%X " - "PREC=0x%X TTL=%u ID=%u PROTO=%u ", -- inet_ntoa(src), inet_ntoa(dst), -+ inet_ntop(AF_INET, &src, src_str, INET_ADDRSTRLEN), -+ inet_ntop(AF_INET, &dst, dst_str, INET_ADDRSTRLEN), - ntohs(iph->tot_len), IPTOS_TOS(iph->tos), - IPTOS_PREC(iph->tos), iph->ttl, ntohs(iph->id), - iph->protocol); --- -2.31.0 - diff --git a/0001-src-fix-IPv6-header-handling.patch b/0001-src-fix-IPv6-header-handling.patch new file mode 100644 index 0000000..9c5ab96 --- /dev/null +++ b/0001-src-fix-IPv6-header-handling.patch @@ -0,0 +1,58 @@ +From 89c17c1a301b3df0ae3b430a105f3208a0c6b53e Mon Sep 17 00:00:00 2001 +From: Etan Kissling +Date: Tue, 9 Feb 2021 23:51:33 +0100 +Subject: [PATCH] src: fix IPv6 header handling + +This corrects issues in IPv6 header handling that sometimes resulted +in an endless loop. + +Signed-off-by: Etan Kissling +Signed-off-by: Pablo Neira Ayuso +(cherry picked from commit 51f25df304aeaa6c1b02ef7456a61278ee70c102) +--- + src/extra/ipv6.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/src/extra/ipv6.c b/src/extra/ipv6.c +index 42c5e25054dff..23f64ba6706b8 100644 +--- a/src/extra/ipv6.c ++++ b/src/extra/ipv6.c +@@ -67,10 +67,19 @@ int nfq_ip6_set_transport_header(struct pkt_buff *pktb, struct ip6_hdr *ip6h, + uint8_t nexthdr = ip6h->ip6_nxt; + uint8_t *cur = (uint8_t *)ip6h + sizeof(struct ip6_hdr); + +- while (nexthdr != target) { ++ while (nexthdr == IPPROTO_HOPOPTS || ++ nexthdr == IPPROTO_ROUTING || ++ nexthdr == IPPROTO_FRAGMENT || ++ nexthdr == IPPROTO_AH || ++ nexthdr == IPPROTO_NONE || ++ nexthdr == IPPROTO_DSTOPTS) { + struct ip6_ext *ip6_ext; + uint32_t hdrlen; + ++ /* Extension header was requested, we're done. */ ++ if (nexthdr == target) ++ break; ++ + /* No more extensions, we're done. */ + if (nexthdr == IPPROTO_NONE) { + cur = NULL; +@@ -107,11 +116,13 @@ int nfq_ip6_set_transport_header(struct pkt_buff *pktb, struct ip6_hdr *ip6h, + } else if (nexthdr == IPPROTO_AH) + hdrlen = (ip6_ext->ip6e_len + 2) << 2; + else +- hdrlen = ip6_ext->ip6e_len; ++ hdrlen = (ip6_ext->ip6e_len + 1) << 3; + + nexthdr = ip6_ext->ip6e_nxt; + cur += hdrlen; + } ++ if (nexthdr != target) ++ cur = NULL; + pktb->transport_header = cur; + return cur ? 1 : 0; + } +-- +2.32.0 + diff --git a/libnetfilter_queue.spec b/libnetfilter_queue.spec index 0807e4a..a94d577 100644 --- a/libnetfilter_queue.spec +++ b/libnetfilter_queue.spec @@ -1,15 +1,15 @@ %define libnfnetlink 1.0.1 Name: libnetfilter_queue -Version: 1.0.2 -Release: 20%{?dist} +Version: 1.0.5 +Release: 1%{?dist} Summary: Netfilter queue userspace library # Most files say GPLv2+, one says v2 only. License: GPLv2 URL: http://netfilter.org Source0: http://netfilter.org/projects/%{name}/files/%{name}-%{version}.tar.bz2 -Patch1: 0001-extra-use-inet_ntop-instead-of-inet_ntoa.patch +Patch1: 0001-src-fix-IPv6-header-handling.patch BuildRequires: libnfnetlink-devel >= %{libnfnetlink}, pkgconfig, kernel-headers BuildRequires: autoconf, automake, libtool, libmnl-devel >= 1.0.3 @@ -45,7 +45,6 @@ make %{?_smp_mflags} rm -rf $RPM_BUILD_ROOT make DESTDIR=%{buildroot} install find $RPM_BUILD_ROOT -type f -name "*.la" -exec rm -f {} ';' -rm %{buildroot}/%{_includedir}/internal.h %ldconfig_scriptlets @@ -60,6 +59,9 @@ rm %{buildroot}/%{_includedir}/internal.h %{_libdir}/pkgconfig/%{name}.pc %changelog +* Fri Aug 13 2021 Phil Sutter - 1.0.5-1 +- Rebase onto upstream version 1.0.5 + * Mon Aug 09 2021 Mohan Boddu - 1.0.2-20 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 diff --git a/sources b/sources index 19ee049..d632d40 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -df09befac35cb215865b39a36c96a3fa libnetfilter_queue-1.0.2.tar.bz2 +SHA512 (libnetfilter_queue-1.0.5.tar.bz2) = 732a44b602e5efaa4f5582ea25ff8f5ec8f4dca5c0e725cd93fe2d441db80416b25c6018147be90acb262d7428eb5b21b3f7b5920e612d115061ec6a19d67f85