diff --git a/.gitignore b/.gitignore index 7832f53..8d73f64 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ /libnftnl-1.2.6.tar.xz /libnftnl-1.2.7.tar.xz /libnftnl-1.2.8.tar.xz +/libnftnl-1.3.0.tar.xz diff --git a/0001-set-Fix-for-array-overrun-when-setting-NFTNL_SET_DES.patch b/0001-set-Fix-for-array-overrun-when-setting-NFTNL_SET_DES.patch deleted file mode 100644 index 58facdb..0000000 --- a/0001-set-Fix-for-array-overrun-when-setting-NFTNL_SET_DES.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 73e56f12f39cf114532eb37119ac84865ffd71fd Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Wed, 4 Dec 2024 16:20:16 +0100 -Subject: [PATCH] set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT - -JIRA: https://issues.redhat.com/browse/RHEL-34697 -Upstream Status: libnftnl commit 7cb2a63d67af14576988631e916404592f261fd4 - -commit 7cb2a63d67af14576988631e916404592f261fd4 -Author: Phil Sutter -Date: Wed Nov 27 16:30:08 2024 +0100 - - set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT - - Assuming max data_len of 16 * 4B and no zero bytes in 'data': - The while loop will increment field_count, use it as index for the - field_len array and afterwards make sure it hasn't increased to - NFT_REG32_COUNT. Thus a value of NFT_REG32_COUNT - 1 (= 15) will pass - the check, get incremented to 16 and used as index to the 16 fields long - array. - Use a less fancy for-loop to avoid the increment vs. check problem. - - Fixes: 407f616ea5318 ("set: buffer overflow in NFTNL_SET_DESC_CONCAT setter") - Signed-off-by: Phil Sutter - Reviewed-by: Pablo Neira Ayuso - -Signed-off-by: Phil Sutter ---- - src/set.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/src/set.c b/src/set.c -index 75ad64e..e9048e0 100644 ---- a/src/set.c -+++ b/src/set.c -@@ -189,8 +189,10 @@ int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data, - return -1; - - memcpy(&s->desc.field_len, data, data_len); -- while (s->desc.field_len[++s->desc.field_count]) { -- if (s->desc.field_count >= NFT_REG32_COUNT) -+ for (s->desc.field_count = 0; -+ s->desc.field_count < NFT_REG32_COUNT; -+ s->desc.field_count++) { -+ if (!s->desc.field_len[s->desc.field_count]) - break; - } - break; diff --git a/0003-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch b/0001-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch similarity index 94% rename from 0003-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch rename to 0001-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch index 61e3591..49c19ef 100644 --- a/0003-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch +++ b/0001-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch @@ -1,4 +1,4 @@ -From 775bf5eba066f61c7737d6995f276765f76328d9 Mon Sep 17 00:00:00 2001 +From 143387be5e15b030381df3ab3970cbc66c35cd48 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 10 Sep 2025 17:29:07 +0200 Subject: [PATCH] udata: Introduce NFTNL_UDATA_TABLE_NFT{VER,BLD} diff --git a/0002-trace-add-support-for-TRACE_CT-information.patch b/0002-trace-add-support-for-TRACE_CT-information.patch deleted file mode 100644 index f6e2db2..0000000 --- a/0002-trace-add-support-for-TRACE_CT-information.patch +++ /dev/null @@ -1,153 +0,0 @@ -From 486a9c5ed53e3f1bea1bc4b8668eefa9453e1aa8 Mon Sep 17 00:00:00 2001 -From: Phil Sutter -Date: Tue, 15 Jul 2025 20:42:30 +0200 -Subject: [PATCH] trace: add support for TRACE_CT information - -JIRA: https://issues.redhat.com/browse/RHEL-103864 -Upstream Status: libnftnl commit 56e37303ed30a4f9b73ec1f90b53da7dda645748 - -commit 56e37303ed30a4f9b73ec1f90b53da7dda645748 -Author: Florian Westphal -Date: Thu May 22 15:51:15 2025 +0200 - - trace: add support for TRACE_CT information - - Decode direction/id/state/status information. - This will be used by 'nftables monitor trace' to print a packets - conntrack state. - - Signed-off-by: Florian Westphal - Reviewed-by: Pablo Neira Ayuso - -Signed-off-by: Phil Sutter ---- - include/libnftnl/trace.h | 4 +++ - include/linux/netfilter/nf_tables.h | 8 +++++ - src/trace.c | 46 +++++++++++++++++++++++++++++ - 3 files changed, 58 insertions(+) - -diff --git a/include/libnftnl/trace.h b/include/libnftnl/trace.h -index 18ab0c3..5d66b50 100644 ---- a/include/libnftnl/trace.h -+++ b/include/libnftnl/trace.h -@@ -28,6 +28,10 @@ enum nftnl_trace_attr { - NFTNL_TRACE_VERDICT, - NFTNL_TRACE_NFPROTO, - NFTNL_TRACE_POLICY, -+ NFTNL_TRACE_CT_DIRECTION, -+ NFTNL_TRACE_CT_ID, -+ NFTNL_TRACE_CT_STATE, -+ NFTNL_TRACE_CT_STATUS, - __NFTNL_TRACE_MAX, - }; - #define NFTNL_TRACE_MAX (__NFTNL_TRACE_MAX - 1) -diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h -index c48b193..2c9f833 100644 ---- a/include/linux/netfilter/nf_tables.h -+++ b/include/linux/netfilter/nf_tables.h -@@ -1797,6 +1797,10 @@ enum nft_xfrm_keys { - * @NFTA_TRACE_MARK: nfmark (NLA_U32) - * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32) - * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32) -+ * @NFTA_TRACE_CT_ID: conntrack id (NLA_U32) -+ * @NFTA_TRACE_CT_DIRECTION: packets direction (NLA_U8) -+ * @NFTA_TRACE_CT_STATUS: conntrack status (NLA_U32) -+ * @NFTA_TRACE_CT_STATE: packet state (new, established, ...) (NLA_U32) - */ - enum nft_trace_attributes { - NFTA_TRACE_UNSPEC, -@@ -1817,6 +1821,10 @@ enum nft_trace_attributes { - NFTA_TRACE_NFPROTO, - NFTA_TRACE_POLICY, - NFTA_TRACE_PAD, -+ NFTA_TRACE_CT_ID, -+ NFTA_TRACE_CT_DIRECTION, -+ NFTA_TRACE_CT_STATUS, -+ NFTA_TRACE_CT_STATE, - __NFTA_TRACE_MAX - }; - #define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1) -diff --git a/src/trace.c b/src/trace.c -index f426437..26bf8d7 100644 ---- a/src/trace.c -+++ b/src/trace.c -@@ -48,6 +48,12 @@ struct nftnl_trace { - uint32_t policy; - uint16_t iiftype; - uint16_t oiftype; -+ struct { -+ uint16_t dir; -+ uint32_t id; -+ uint32_t state; -+ uint32_t status; -+ } ct; - - uint32_t flags; - }; -@@ -92,6 +98,10 @@ static int nftnl_trace_parse_attr_cb(const struct nlattr *attr, void *data) - if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0) - abi_breakage(); - break; -+ case NFTA_TRACE_CT_DIRECTION: -+ if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0) -+ abi_breakage(); -+ break; - case NFTA_TRACE_IIFTYPE: - case NFTA_TRACE_OIFTYPE: - if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0) -@@ -104,6 +114,9 @@ static int nftnl_trace_parse_attr_cb(const struct nlattr *attr, void *data) - case NFTA_TRACE_POLICY: - case NFTA_TRACE_NFPROTO: - case NFTA_TRACE_TYPE: -+ case NFTA_TRACE_CT_ID: -+ case NFTA_TRACE_CT_STATE: -+ case NFTA_TRACE_CT_STATUS: - if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) - abi_breakage(); - break; -@@ -194,6 +207,18 @@ const void *nftnl_trace_get_data(const struct nftnl_trace *trace, - case NFTNL_TRACE_POLICY: - *data_len = sizeof(uint32_t); - return &trace->policy; -+ case NFTNL_TRACE_CT_DIRECTION: -+ *data_len = sizeof(uint16_t); -+ return &trace->ct.dir; -+ case NFTNL_TRACE_CT_ID: -+ *data_len = sizeof(uint32_t); -+ return &trace->ct.id; -+ case NFTNL_TRACE_CT_STATE: -+ *data_len = sizeof(uint32_t); -+ return &trace->ct.state; -+ case NFTNL_TRACE_CT_STATUS: -+ *data_len = sizeof(uint32_t); -+ return &trace->ct.status; - case __NFTNL_TRACE_MAX: - break; - } -@@ -423,5 +448,26 @@ int nftnl_trace_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_trace *t) - t->flags |= (1 << NFTNL_TRACE_MARK); - } - -+ if (tb[NFTA_TRACE_CT_DIRECTION]) { -+ t->ct.dir = mnl_attr_get_u8(tb[NFTA_TRACE_CT_DIRECTION]); -+ t->flags |= (1 << NFTNL_TRACE_CT_DIRECTION); -+ } -+ -+ if (tb[NFTA_TRACE_CT_ID]) { -+ /* NFT_CT_ID is expected to be in big endian */ -+ t->ct.id = mnl_attr_get_u32(tb[NFTA_TRACE_CT_ID]); -+ t->flags |= (1 << NFTNL_TRACE_CT_ID); -+ } -+ -+ if (tb[NFTA_TRACE_CT_STATE]) { -+ t->ct.state = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_CT_STATE])); -+ t->flags |= (1 << NFTNL_TRACE_CT_STATE); -+ } -+ -+ if (tb[NFTA_TRACE_CT_STATUS]) { -+ t->ct.status = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_CT_STATUS])); -+ t->flags |= (1 << NFTNL_TRACE_CT_STATUS); -+ } -+ - return 0; - } diff --git a/libnftnl.spec b/libnftnl.spec index 7834368..d436e5d 100644 --- a/libnftnl.spec +++ b/libnftnl.spec @@ -1,14 +1,12 @@ Name: libnftnl -Version: 1.2.8 -Release: 5%{?dist} +Version: 1.3.0 +Release: 1%{?dist} Summary: Library for low-level interaction with nftables Netlink's API over libmnl License: GPL-2.0-or-later URL: https://netfilter.org/projects/libnftnl/ Source0: %{url}/files/%{name}-%{version}.tar.xz -Patch1: 0001-set-Fix-for-array-overrun-when-setting-NFTNL_SET_DES.patch -Patch2: 0002-trace-add-support-for-TRACE_CT-information.patch -Patch3: 0003-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch +Patch1: 0001-udata-Introduce-NFTNL_UDATA_TABLE_NFT-VER-BLD.patch BuildRequires: libmnl-devel BuildRequires: gcc @@ -57,6 +55,9 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';' %{_includedir}/libnftnl %changelog +* Thu Nov 20 2025 Phil Sutter [1.3.0-1.el10] +- Rebase onto version 1.3.0 (Phil Sutter) [RHEL-121193] + * Thu Oct 30 2025 Phil Sutter [1.2.8-5.el10] - Bump release for a side-tag build (Phil Sutter) [RHEL-125122] diff --git a/sources b/sources index 7dffdf8..db07b00 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libnftnl-1.2.8.tar.xz) = c57030f34c50b09ae2fbf8dac5d9cf431eaaa5a5a08098e3e4c146a8bd4ae9b7753f5d2de5f2d0a6c15e5ba0c39f51275c9d8b03bdedeaadbafa6c96f9a972b6 +SHA512 (libnftnl-1.3.0.tar.xz) = a2220dba97cc9a1bbd0d093a0bd0afd491120a814be6343aef35cbeba0e4781289fa84ced36510b6b9d76e99b3ba35f3964a9a40a21f38e2e0fad90c34fd3916