rpms/libnftnl
7
0
Fork 0
Code Issues Pull Requests Releases Activity

libnftnl-1.3.0-1.el10

Browse Source 
* Thu Nov 20 2025 Phil Sutter <psutter@redhat.com> [1.3.0-1.el10]
- Rebase onto version 1.3.0 (Phil Sutter) [RHEL-121193]
Resolves: RHEL-121193
This commit is contained in:
Phil Sutter 2025-11-20 19:22:29 +01:00
parent 1836acfa30
commit 7ac31e990d
6 changed files with 9 additions and 208 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -29,3 +29,4 @@
/libnftnl-1.2.6.tar.xz
/libnftnl-1.2.7.tar.xz
/libnftnl-1.2.8.tar.xz
/libnftnl-1.3.0.tar.xz

48
0001-set-Fix-for-array-overrun-when-setting-NFTNL_SET_DES.patch
View File

@ -1,48 +0,0 @@
From 73e56f12f39cf114532eb37119ac84865ffd71fd Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Wed, 4 Dec 2024 16:20:16 +0100
Subject: [PATCH] set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT
JIRA: https://issues.redhat.com/browse/RHEL-34697
Upstream Status: libnftnl commit 7cb2a63d67af14576988631e916404592f261fd4
commit 7cb2a63d67af14576988631e916404592f261fd4
Author: Phil Sutter <phil@nwl.cc>
Date: Wed Nov 27 16:30:08 2024 +0100
set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT
Assuming max data_len of 16 * 4B and no zero bytes in 'data':
The while loop will increment field_count, use it as index for the
field_len array and afterwards make sure it hasn't increased to
NFT_REG32_COUNT. Thus a value of NFT_REG32_COUNT - 1 (= 15) will pass
the check, get incremented to 16 and used as index to the 16 fields long
array.
Use a less fancy for-loop to avoid the increment vs. check problem.
Fixes: 407f616ea5318 ("set: buffer overflow in NFTNL_SET_DESC_CONCAT setter")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Phil Sutter <psutter@redhat.com>
---
src/set.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/set.c b/src/set.c
index 75ad64e..e9048e0 100644
--- a/src/set.c
+++ b/src/set.c
@@ -189,8 +189,10 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data,
return -1;
memcpy(&s->desc.field_len, data, data_len);
- while (s->desc.field_len[++s->desc.field_count]) {
- if (s->desc.field_count >= NFT_REG32_COUNT)
+ for (s->desc.field_count = 0;
+ s->desc.field_count < NFT_REG32_COUNT;
+ s->desc.field_count++) {
+ if (!s->desc.field_len[s->desc.field_count])
break;
}
break;

2
0003-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch → 0001-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch
View File

@ -1,4 +1,4 @@
From 775bf5eba066f61c7737d6995f276765f76328d9 Mon Sep 17 00:00:00 2001
From 143387be5e15b030381df3ab3970cbc66c35cd48 Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Wed, 10 Sep 2025 17:29:07 +0200
Subject: [PATCH] udata: Introduce NFTNL_UDATA_TABLE_NFT{VER,BLD}

153
0002-trace-add-support-for-TRACE_CT-information.patch
View File

@ -1,153 +0,0 @@
From 486a9c5ed53e3f1bea1bc4b8668eefa9453e1aa8 Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Tue, 15 Jul 2025 20:42:30 +0200
Subject: [PATCH] trace: add support for TRACE_CT information
JIRA: https://issues.redhat.com/browse/RHEL-103864
Upstream Status: libnftnl commit 56e37303ed30a4f9b73ec1f90b53da7dda645748
commit 56e37303ed30a4f9b73ec1f90b53da7dda645748
Author: Florian Westphal <fw@strlen.de>
Date: Thu May 22 15:51:15 2025 +0200
trace: add support for TRACE_CT information
Decode direction/id/state/status information.
This will be used by 'nftables monitor trace' to print a packets
conntrack state.
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Phil Sutter <psutter@redhat.com>
---
include/libnftnl/trace.h | 4 +++
include/linux/netfilter/nf_tables.h | 8 +++++
src/trace.c | 46 +++++++++++++++++++++++++++++
3 files changed, 58 insertions(+)
diff --git a/include/libnftnl/trace.h b/include/libnftnl/trace.h
index 18ab0c3..5d66b50 100644
--- a/include/libnftnl/trace.h
+++ b/include/libnftnl/trace.h
@@ -28,6 +28,10 @@ enum nftnl_trace_attr {
NFTNL_TRACE_VERDICT,
NFTNL_TRACE_NFPROTO,
NFTNL_TRACE_POLICY,
+ NFTNL_TRACE_CT_DIRECTION,
+ NFTNL_TRACE_CT_ID,
+ NFTNL_TRACE_CT_STATE,
+ NFTNL_TRACE_CT_STATUS,
__NFTNL_TRACE_MAX,
};
#define NFTNL_TRACE_MAX (__NFTNL_TRACE_MAX - 1)
diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
index c48b193..2c9f833 100644
--- a/include/linux/netfilter/nf_tables.h
+++ b/include/linux/netfilter/nf_tables.h
@@ -1797,6 +1797,10 @@ enum nft_xfrm_keys {
* @NFTA_TRACE_MARK: nfmark (NLA_U32)
* @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
* @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
+ * @NFTA_TRACE_CT_ID: conntrack id (NLA_U32)
+ * @NFTA_TRACE_CT_DIRECTION: packets direction (NLA_U8)
+ * @NFTA_TRACE_CT_STATUS: conntrack status (NLA_U32)
+ * @NFTA_TRACE_CT_STATE: packet state (new, established, ...) (NLA_U32)
*/
enum nft_trace_attributes {
NFTA_TRACE_UNSPEC,
@@ -1817,6 +1821,10 @@ enum nft_trace_attributes {
NFTA_TRACE_NFPROTO,
NFTA_TRACE_POLICY,
NFTA_TRACE_PAD,
+ NFTA_TRACE_CT_ID,
+ NFTA_TRACE_CT_DIRECTION,
+ NFTA_TRACE_CT_STATUS,
+ NFTA_TRACE_CT_STATE,
__NFTA_TRACE_MAX
};
#define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
diff --git a/src/trace.c b/src/trace.c
index f426437..26bf8d7 100644
--- a/src/trace.c
+++ b/src/trace.c
@@ -48,6 +48,12 @@ struct nftnl_trace {
uint32_t policy;
uint16_t iiftype;
uint16_t oiftype;
+ struct {
+ uint16_t dir;
+ uint32_t id;
+ uint32_t state;
+ uint32_t status;
+ } ct;
uint32_t flags;
};
@@ -92,6 +98,10 @@ static int nftnl_trace_parse_attr_cb(const struct nlattr *attr, void *data)
if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
abi_breakage();
break;
+ case NFTA_TRACE_CT_DIRECTION:
+ if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+ abi_breakage();
+ break;
case NFTA_TRACE_IIFTYPE:
case NFTA_TRACE_OIFTYPE:
if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
@@ -104,6 +114,9 @@ static int nftnl_trace_parse_attr_cb(const struct nlattr *attr, void *data)
case NFTA_TRACE_POLICY:
case NFTA_TRACE_NFPROTO:
case NFTA_TRACE_TYPE:
+ case NFTA_TRACE_CT_ID:
+ case NFTA_TRACE_CT_STATE:
+ case NFTA_TRACE_CT_STATUS:
if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
abi_breakage();
break;
@@ -194,6 +207,18 @@ const void *nftnl_trace_get_data(const struct nftnl_trace *trace,
case NFTNL_TRACE_POLICY:
*data_len = sizeof(uint32_t);
return &trace->policy;
+ case NFTNL_TRACE_CT_DIRECTION:
+ *data_len = sizeof(uint16_t);
+ return &trace->ct.dir;
+ case NFTNL_TRACE_CT_ID:
+ *data_len = sizeof(uint32_t);
+ return &trace->ct.id;
+ case NFTNL_TRACE_CT_STATE:
+ *data_len = sizeof(uint32_t);
+ return &trace->ct.state;
+ case NFTNL_TRACE_CT_STATUS:
+ *data_len = sizeof(uint32_t);
+ return &trace->ct.status;
case __NFTNL_TRACE_MAX:
break;
}
@@ -423,5 +448,26 @@ int nftnl_trace_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_trace *t)
t->flags |= (1 << NFTNL_TRACE_MARK);
}
+ if (tb[NFTA_TRACE_CT_DIRECTION]) {
+ t->ct.dir = mnl_attr_get_u8(tb[NFTA_TRACE_CT_DIRECTION]);
+ t->flags |= (1 << NFTNL_TRACE_CT_DIRECTION);
+ }
+
+ if (tb[NFTA_TRACE_CT_ID]) {
+ /* NFT_CT_ID is expected to be in big endian */
+ t->ct.id = mnl_attr_get_u32(tb[NFTA_TRACE_CT_ID]);
+ t->flags |= (1 << NFTNL_TRACE_CT_ID);
+ }
+
+ if (tb[NFTA_TRACE_CT_STATE]) {
+ t->ct.state = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_CT_STATE]));
+ t->flags |= (1 << NFTNL_TRACE_CT_STATE);
+ }
+
+ if (tb[NFTA_TRACE_CT_STATUS]) {
+ t->ct.status = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_CT_STATUS]));
+ t->flags |= (1 << NFTNL_TRACE_CT_STATUS);
+ }
+
return 0;
}

11
libnftnl.spec
View File

@ -1,14 +1,12 @@
Name: libnftnl
Version: 1.2.8
Release: 5%{?dist}
Version: 1.3.0
Release: 1%{?dist}
Summary: Library for low-level interaction with nftables Netlink's API over libmnl
License: GPL-2.0-or-later
URL: https://netfilter.org/projects/libnftnl/
Source0: %{url}/files/%{name}-%{version}.tar.xz
Patch1: 0001-set-Fix-for-array-overrun-when-setting-NFTNL_SET_DES.patch
Patch2: 0002-trace-add-support-for-TRACE_CT-information.patch
Patch3: 0003-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch
Patch1: 0001-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch
BuildRequires: libmnl-devel
BuildRequires: gcc
@ -57,6 +55,9 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
%{_includedir}/libnftnl
%changelog
* Thu Nov 20 2025 Phil Sutter <psutter@redhat.com> [1.3.0-1.el10]
- Rebase onto version 1.3.0 (Phil Sutter) [RHEL-121193]
* Thu Oct 30 2025 Phil Sutter <psutter@redhat.com> [1.2.8-5.el10]
- Bump release for a side-tag build (Phil Sutter) [RHEL-125122]

2
sources
View File

@ -1 +1 @@
SHA512 (libnftnl-1.2.8.tar.xz) = c57030f34c50b09ae2fbf8dac5d9cf431eaaa5a5a08098e3e4c146a8bd4ae9b7753f5d2de5f2d0a6c15e5ba0c39f51275c9d8b03bdedeaadbafa6c96f9a972b6
SHA512 (libnftnl-1.3.0.tar.xz) = a2220dba97cc9a1bbd0d093a0bd0afd491120a814be6343aef35cbeba0e4781289fa84ced36510b6b9d76e99b3ba35f3964a9a40a21f38e2e0fad90c34fd3916