From 675ec80edd038f16005066794a4264525218909c Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 10 May 2022 03:20:23 -0400 Subject: [PATCH] import libnftnl-1.1.5-5.el8 --- ...-set-and-build-for-NFTNL_SET_ELEM_EX.patch | 56 ++++++++++++ ...ase-stateful-expression-from-.free-p.patch | 47 ++++++++++ ...et-expose-nftnl_set_elem_nlmsg_build.patch | 87 +++++++++++++++++++ SPECS/libnftnl.spec | 12 ++- 4 files changed, 200 insertions(+), 2 deletions(-) create mode 100644 SOURCES/0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch create mode 100644 SOURCES/0011-expr-dynset-release-stateful-expression-from-.free-p.patch create mode 100644 SOURCES/0012-set-expose-nftnl_set_elem_nlmsg_build.patch diff --git a/SOURCES/0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch b/SOURCES/0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch new file mode 100644 index 0000000..3d38755 --- /dev/null +++ b/SOURCES/0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch @@ -0,0 +1,56 @@ +From e04405f86a93185e4843b4e8c0644a4c66683fac Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 13 Jan 2022 20:10:27 +0100 +Subject: [PATCH] set_elem: missing set and build for NFTNL_SET_ELEM_EXPR + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2040478 +Upstream Status: libnftnl commit 92705574380f7 + +commit 92705574380f7ffd9f244b4cb69422a85269ab41 +Author: Pablo Neira Ayuso +Date: Wed Mar 11 14:23:33 2020 +0100 + + set_elem: missing set and build for NFTNL_SET_ELEM_EXPR + + Extend nftnl_set_elem_set() and nftnl_set_elem_nlmsg_build_payload() to + support for the NFTNL_SET_ELEM_EXPR attribute. + + Signed-off-by: Pablo Neira Ayuso +--- + src/set_elem.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/src/set_elem.c b/src/set_elem.c +index 2203193..4421322 100644 +--- a/src/set_elem.c ++++ b/src/set_elem.c +@@ -162,6 +162,12 @@ int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr, + if (!s->objref) + return -1; + break; ++ case NFTNL_SET_ELEM_EXPR: ++ if (s->flags & (1 << NFTNL_SET_ELEM_EXPR)) ++ nftnl_expr_free(s->expr); ++ ++ s->expr = (void *)data; ++ break; + } + s->flags |= (1 << attr); + return 0; +@@ -326,6 +332,13 @@ void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, + mnl_attr_put(nlh, NFTA_SET_ELEM_USERDATA, e->user.len, e->user.data); + if (e->flags & (1 << NFTNL_SET_ELEM_OBJREF)) + mnl_attr_put_strz(nlh, NFTA_SET_ELEM_OBJREF, e->objref); ++ if (e->flags & (1 << NFTNL_SET_ELEM_EXPR)) { ++ struct nlattr *nest1; ++ ++ nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_EXPR); ++ nftnl_expr_build_payload(nlh, e->expr); ++ mnl_attr_nest_end(nlh, nest1); ++ } + } + + static void nftnl_set_elem_nlmsg_build_def(struct nlmsghdr *nlh, +-- +2.31.1 + diff --git a/SOURCES/0011-expr-dynset-release-stateful-expression-from-.free-p.patch b/SOURCES/0011-expr-dynset-release-stateful-expression-from-.free-p.patch new file mode 100644 index 0000000..326458c --- /dev/null +++ b/SOURCES/0011-expr-dynset-release-stateful-expression-from-.free-p.patch @@ -0,0 +1,47 @@ +From 719810aeae4bf7a5c99bb6090070e769954d2e01 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 13 Jan 2022 20:10:27 +0100 +Subject: [PATCH] expr: dynset: release stateful expression from .free path + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2040478 +Upstream Status: libnftnl commit 0bd7d62c450c6 + +commit 0bd7d62c450c6736af4141d37073c5b40f1f894d +Author: Pablo Neira Ayuso +Date: Wed May 6 20:45:35 2020 +0200 + + expr: dynset: release stateful expression from .free path + + ==22778==ERROR: LeakSanitizer: detected memory leaks + + Direct leak of 64 byte(s) in 1 object(s) allocated from: + #0 0x7f3212406518 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9518) + #1 0x7f321041703e in nftnl_expr_alloc /home/pablo/devel/scm/git-netfilter/libnftnl/src/expr.c:37 + #2 0x7f3211d51c16 in netlink_gen_limit_stmt /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_linearize.c:859 + #3 0x7f3211d5220c in netlink_gen_stmt_stateful /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_linearize.c:891 + #4 0x7f3211d58630 in netlink_gen_meter_stmt /home/pablo/devel/scm/git-netfilter/nftables/src/netlink_linearize.c:1441 + [...] + + SUMMARY: AddressSanitizer: 64 byte(s) leaked in 1 allocation(s). + + Signed-off-by: Pablo Neira Ayuso +--- + src/expr/dynset.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/expr/dynset.c b/src/expr/dynset.c +index 4870923..466dfff 100644 +--- a/src/expr/dynset.c ++++ b/src/expr/dynset.c +@@ -278,6 +278,8 @@ static void nftnl_expr_dynset_free(const struct nftnl_expr *e) + struct nftnl_expr_dynset *dynset = nftnl_expr_data(e); + + xfree(dynset->set_name); ++ if (dynset->expr) ++ nftnl_expr_free(dynset->expr); + } + + struct expr_ops expr_ops_dynset = { +-- +2.31.1 + diff --git a/SOURCES/0012-set-expose-nftnl_set_elem_nlmsg_build.patch b/SOURCES/0012-set-expose-nftnl_set_elem_nlmsg_build.patch new file mode 100644 index 0000000..e2624c4 --- /dev/null +++ b/SOURCES/0012-set-expose-nftnl_set_elem_nlmsg_build.patch @@ -0,0 +1,87 @@ +From 3fb9a2e1b66e931453b18b022b0a364a66699580 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Fri, 21 Jan 2022 13:48:20 +0100 +Subject: [PATCH] set: expose nftnl_set_elem_nlmsg_build() + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2040754 +Upstream Status: libnftnl commit 8d74a15d941c6 +Conflicts: Adjusted symbol version name to avoid confusion with upstream + versions. + +commit 8d74a15d941c69b7d0f5961be1e56b87ca3235d0 +Author: Pablo Neira Ayuso +Date: Thu Nov 4 14:09:44 2021 +0100 + + set: expose nftnl_set_elem_nlmsg_build() + + Expose a function to build one single set element netlink message. + + Signed-off-by: Pablo Neira Ayuso +--- + include/libnftnl/set.h | 2 ++ + src/libnftnl.map | 4 ++++ + src/set_elem.c | 9 +++++---- + 3 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/include/libnftnl/set.h b/include/libnftnl/set.h +index 6843adf..99d692e 100644 +--- a/include/libnftnl/set.h ++++ b/include/libnftnl/set.h +@@ -135,6 +135,8 @@ bool nftnl_set_elem_is_set(const struct nftnl_set_elem *s, uint16_t attr); + #define nftnl_set_elem_nlmsg_build_hdr nftnl_nlmsg_build_hdr + void nftnl_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s); + void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set_elem *e); ++struct nlattr *nftnl_set_elem_nlmsg_build(struct nlmsghdr *nlh, ++ struct nftnl_set_elem *elem, int i); + + int nftnl_set_elem_parse(struct nftnl_set_elem *e, enum nftnl_parse_type type, + const char *data, struct nftnl_parse_err *err); +diff --git a/src/libnftnl.map b/src/libnftnl.map +index 8230d15..0799570 100644 +--- a/src/libnftnl.map ++++ b/src/libnftnl.map +@@ -359,3 +359,7 @@ LIBNFTNL_13 { + nftnl_obj_set_data; + nftnl_flowtable_set_data; + } LIBNFTNL_12; ++ ++LIBNFTNL_RHEL_14 { ++ nftnl_set_elem_nlmsg_build; ++} LIBNFTNL_13; +diff --git a/src/set_elem.c b/src/set_elem.c +index 4421322..ce1a976 100644 +--- a/src/set_elem.c ++++ b/src/set_elem.c +@@ -352,8 +352,9 @@ static void nftnl_set_elem_nlmsg_build_def(struct nlmsghdr *nlh, + mnl_attr_put_strz(nlh, NFTA_SET_ELEM_LIST_TABLE, s->table); + } + +-static struct nlattr *nftnl_set_elem_build(struct nlmsghdr *nlh, +- struct nftnl_set_elem *elem, int i) ++EXPORT_SYMBOL(nftnl_set_elem_nlmsg_build); ++struct nlattr *nftnl_set_elem_nlmsg_build(struct nlmsghdr *nlh, ++ struct nftnl_set_elem *elem, int i) + { + struct nlattr *nest2; + +@@ -378,7 +379,7 @@ void nftnl_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set + + nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_LIST_ELEMENTS); + list_for_each_entry(elem, &s->element_list, head) +- nftnl_set_elem_build(nlh, elem, ++i); ++ nftnl_set_elem_nlmsg_build(nlh, elem, ++i); + + mnl_attr_nest_end(nlh, nest1); + } +@@ -818,7 +819,7 @@ int nftnl_set_elems_nlmsg_build_payload_iter(struct nlmsghdr *nlh, + nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_LIST_ELEMENTS); + elem = nftnl_set_elems_iter_next(iter); + while (elem != NULL) { +- nest2 = nftnl_set_elem_build(nlh, elem, ++i); ++ nest2 = nftnl_set_elem_nlmsg_build(nlh, elem, ++i); + if (nftnl_attr_nest_overflow(nlh, nest1, nest2)) { + /* Go back to previous not to miss this element */ + iter->cur = list_entry(iter->cur->head.prev, +-- +2.31.1 + diff --git a/SPECS/libnftnl.spec b/SPECS/libnftnl.spec index 4769895..d249733 100644 --- a/SPECS/libnftnl.spec +++ b/SPECS/libnftnl.spec @@ -1,9 +1,9 @@ %define rpmversion 1.1.5 -%define specrelease 4%{?dist} +%define specrelease 5 Name: libnftnl Version: %{rpmversion} -Release: %{specrelease}%{?buildid} +Release: %{specrelease}%{?dist} Summary: Library for low-level interaction with nftables Netlink's API over libmnl License: GPLv2+ URL: http://netfilter.org/projects/libnftnl/ @@ -21,6 +21,9 @@ Patch5: 0006-include-resync-nf_tables.h-cache-copy.patch Patch6: 0007-set-Add-support-for-NFTA_SET_DESC_CONCAT-attributes.patch Patch7: 0008-set_elem-Introduce-support-for-NFTNL_SET_ELEM_KEY_EN.patch Patch8: 0009-src-Fix-for-reading-garbage-in-nftnl_chain-getters.patch +Patch9: 0010-set_elem-missing-set-and-build-for-NFTNL_SET_ELEM_EX.patch +Patch10: 0011-expr-dynset-release-stateful-expression-from-.free-p.patch +Patch11: 0012-set-expose-nftnl_set_elem_nlmsg_build.patch %description A library for low-level interaction with nftables Netlink's API over libmnl. @@ -67,6 +70,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' %{_includedir}/libnftnl %changelog +* Fri Jan 21 2022 Phil Sutter [1.1.5-5.el8] +- set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754] +- expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478] +- set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478] + * Wed Feb 19 2020 Phil Sutter [1.1.5-4.el8] - src: Fix for reading garbage in nftnl_chain getters (Phil Sutter) [1758673]