import libnftnl-1.1.5-5.el8

SOURCES/0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch

@@ -0,0 +1,56 @@
+From e04405f86a93185e4843b4e8c0644a4c66683fac Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 13 Jan 2022 20:10:27 +0100
+Subject: [PATCH] set_elem: missing set and build for NFTNL_SET_ELEM_EXPR
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2040478
+Upstream Status: libnftnl commit 92705574380f7
+
+commit 92705574380f7ffd9f244b4cb69422a85269ab41
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Wed Mar 11 14:23:33 2020 +0100
+
+    set_elem: missing set and build for NFTNL_SET_ELEM_EXPR
+
+    Extend nftnl_set_elem_set() and nftnl_set_elem_nlmsg_build_payload() to
+    support for the NFTNL_SET_ELEM_EXPR attribute.
+
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ src/set_elem.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/src/set_elem.c b/src/set_elem.c
+index 2203193..4421322 100644
+--- a/src/set_elem.c
++++ b/src/set_elem.c
+@@ -162,6 +162,12 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
+ 		if (!s->objref)
+ 			return -1;
+ 		break;
++	case NFTNL_SET_ELEM_EXPR:
++		if (s->flags & (1 << NFTNL_SET_ELEM_EXPR))
++			nftnl_expr_free(s->expr);
++
++		s->expr = (void *)data;
++		break;
+ 	}
+ 	s->flags |= (1 << attr);
+ 	return 0;
+@@ -326,6 +332,13 @@ void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh,
+ 		mnl_attr_put(nlh, NFTA_SET_ELEM_USERDATA, e->user.len, e->user.data);
+ 	if (e->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+ 		mnl_attr_put_strz(nlh, NFTA_SET_ELEM_OBJREF, e->objref);
++	if (e->flags & (1 << NFTNL_SET_ELEM_EXPR)) {
++		struct nlattr *nest1;
++
++		nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_EXPR);
++		nftnl_expr_build_payload(nlh, e->expr);
++		mnl_attr_nest_end(nlh, nest1);
++	}
+ }
+ 
+ static void nftnl_set_elem_nlmsg_build_def(struct nlmsghdr *nlh,
+-- 
+2.31.1
+

SOURCES/0011-expr-dynset-release-stateful-expression-from-.free-p.patch

@@ -0,0 +1,47 @@
+From 719810aeae4bf7a5c99bb6090070e769954d2e01 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 13 Jan 2022 20:10:27 +0100
+Subject: [PATCH] expr: dynset: release stateful expression from .free path
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2040478
+Upstream Status: libnftnl commit 0bd7d62c450c6
+
+commit 0bd7d62c450c6736af4141d37073c5b40f1f894d
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Wed May 6 20:45:35 2020 +0200
+
+    expr: dynset: release stateful expression from .free path
+
+    ==22778==ERROR: LeakSanitizer: detected memory leaks
+
+    Direct leak of 64 byte(s) in 1 object(s) allocated from:
+        #0 0x7f3212406518 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
+        #1 0x7f321041703e in nftnl_expr_alloc /home/pablo/devel/scm/git-netfilter/libnftnl/src/expr.c:37
+        #2 0x7f3211d51c16 in netlink_gen_limit_stmt /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_linearize.c:859
+        #3 0x7f3211d5220c in netlink_gen_stmt_stateful /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_linearize.c:891
+        #4 0x7f3211d58630 in netlink_gen_meter_stmt /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_linearize.c:1441
+    [...]
+
+    SUMMARY: AddressSanitizer: 64 byte(s) leaked in 1 allocation(s).
+
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ src/expr/dynset.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/expr/dynset.c b/src/expr/dynset.c
+index 4870923..466dfff 100644
+--- a/src/expr/dynset.c
++++ b/src/expr/dynset.c
+@@ -278,6 +278,8 @@ static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
+ 	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+ 
+ 	xfree(dynset->set_name);
++	if (dynset->expr)
++		nftnl_expr_free(dynset->expr);
+ }
+ 
+ struct expr_ops expr_ops_dynset = {
+-- 
+2.31.1
+

SOURCES/0012-set-expose-nftnl_set_elem_nlmsg_build.patch

@@ -0,0 +1,87 @@
+From 3fb9a2e1b66e931453b18b022b0a364a66699580 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 21 Jan 2022 13:48:20 +0100
+Subject: [PATCH] set: expose nftnl_set_elem_nlmsg_build()
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2040754
+Upstream Status: libnftnl commit 8d74a15d941c6
+Conflicts: Adjusted symbol version name to avoid confusion with upstream
+           versions.
+
+commit 8d74a15d941c69b7d0f5961be1e56b87ca3235d0
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Thu Nov 4 14:09:44 2021 +0100
+
+    set: expose nftnl_set_elem_nlmsg_build()
+
+    Expose a function to build one single set element netlink message.
+
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ include/libnftnl/set.h | 2 ++
+ src/libnftnl.map       | 4 ++++
+ src/set_elem.c         | 9 +++++----
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h
+index 6843adf..99d692e 100644
+--- a/include/libnftnl/set.h
++++ b/include/libnftnl/set.h
+@@ -135,6 +135,8 @@ bool nftnl_set_elem_is_set(const struct nftnl_set_elem *s, uint16_t attr);
+ #define nftnl_set_elem_nlmsg_build_hdr	nftnl_nlmsg_build_hdr
+ void nftnl_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s);
+ void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set_elem *e);
++struct nlattr *nftnl_set_elem_nlmsg_build(struct nlmsghdr *nlh,
++					  struct nftnl_set_elem *elem, int i);
+ 
+ int nftnl_set_elem_parse(struct nftnl_set_elem *e, enum nftnl_parse_type type,
+ 		       const char *data, struct nftnl_parse_err *err);
+diff --git a/src/libnftnl.map b/src/libnftnl.map
+index 8230d15..0799570 100644
+--- a/src/libnftnl.map
++++ b/src/libnftnl.map
+@@ -359,3 +359,7 @@ LIBNFTNL_13 {
+   nftnl_obj_set_data;
+   nftnl_flowtable_set_data;
+ } LIBNFTNL_12;
++
++LIBNFTNL_RHEL_14 {
++  nftnl_set_elem_nlmsg_build;
++} LIBNFTNL_13;
+diff --git a/src/set_elem.c b/src/set_elem.c
+index 4421322..ce1a976 100644
+--- a/src/set_elem.c
++++ b/src/set_elem.c
+@@ -352,8 +352,9 @@ static void nftnl_set_elem_nlmsg_build_def(struct nlmsghdr *nlh,
+ 		mnl_attr_put_strz(nlh, NFTA_SET_ELEM_LIST_TABLE, s->table);
+ }
+ 
+-static struct nlattr *nftnl_set_elem_build(struct nlmsghdr *nlh,
+-					      struct nftnl_set_elem *elem, int i)
++EXPORT_SYMBOL(nftnl_set_elem_nlmsg_build);
++struct nlattr *nftnl_set_elem_nlmsg_build(struct nlmsghdr *nlh,
++					  struct nftnl_set_elem *elem, int i)
+ {
+ 	struct nlattr *nest2;
+ 
+@@ -378,7 +379,7 @@ void nftnl_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set
+ 
+ 	nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_LIST_ELEMENTS);
+ 	list_for_each_entry(elem, &s->element_list, head)
+-		nftnl_set_elem_build(nlh, elem, ++i);
++		nftnl_set_elem_nlmsg_build(nlh, elem, ++i);
+ 
+ 	mnl_attr_nest_end(nlh, nest1);
+ }
+@@ -818,7 +819,7 @@ int nftnl_set_elems_nlmsg_build_payload_iter(struct nlmsghdr *nlh,
+ 	nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_LIST_ELEMENTS);
+ 	elem = nftnl_set_elems_iter_next(iter);
+ 	while (elem != NULL) {
+-		nest2 = nftnl_set_elem_build(nlh, elem, ++i);
++		nest2 = nftnl_set_elem_nlmsg_build(nlh, elem, ++i);
+ 		if (nftnl_attr_nest_overflow(nlh, nest1, nest2)) {
+ 			/* Go back to previous not to miss this element */
+ 			iter->cur = list_entry(iter->cur->head.prev,
+-- 
+2.31.1
+

SPECS/libnftnl.spec

@@ -1,9 +1,9 @@
 %define rpmversion 1.1.5
-%define specrelease 4%{?dist}
+%define specrelease 5
 
 Name:           libnftnl
 Version:        %{rpmversion}
-Release:        %{specrelease}%{?buildid}
+Release:        %{specrelease}%{?dist}
 Summary:        Library for low-level interaction with nftables Netlink's API over libmnl
 License:        GPLv2+
 URL:            http://netfilter.org/projects/libnftnl/
@@ -21,6 +21,9 @@ Patch5:             0006-include-resync-nf_tables.h-cache-copy.patch
 Patch6:             0007-set-Add-support-for-NFTA_SET_DESC_CONCAT-attributes.patch
 Patch7:             0008-set_elem-Introduce-support-for-NFTNL_SET_ELEM_KEY_EN.patch
 Patch8:             0009-src-Fix-for-reading-garbage-in-nftnl_chain-getters.patch
+Patch9:             0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch
+Patch10:            0011-expr-dynset-release-stateful-expression-from-.free-p.patch
+Patch11:            0012-set-expose-nftnl_set_elem_nlmsg_build.patch
 
 %description
 A library for low-level interaction with nftables Netlink's API over libmnl.
@@ -67,6 +70,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
 %{_includedir}/libnftnl
 
 %changelog
+* Fri Jan 21 2022 Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
+- set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
+- expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
+- set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]
+
 * Wed Feb 19 2020 Phil Sutter <psutter@redhat.com> [1.1.5-4.el8]
 - src: Fix for reading garbage in nftnl_chain getters (Phil Sutter) [1758673]