From 3f281622c63911cbf555115a635e33cc1cfd68fe Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 7 Nov 2023 11:30:15 +0000 Subject: [PATCH] import UBI nftables-1.0.4-11.el9_3 --- ...check-address-family-in-set-collapse.patch | 114 ++++++++++++++++++ SPECS/nftables.spec | 13 +- 2 files changed, 123 insertions(+), 4 deletions(-) create mode 100644 SOURCES/0032-rule-check-address-family-in-set-collapse.patch diff --git a/SOURCES/0032-rule-check-address-family-in-set-collapse.patch b/SOURCES/0032-rule-check-address-family-in-set-collapse.patch new file mode 100644 index 0000000..f42a7f8 --- /dev/null +++ b/SOURCES/0032-rule-check-address-family-in-set-collapse.patch @@ -0,0 +1,114 @@ +From cd38d8b8d34685d6bcbce4ac259a42c47ff67580 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 21 Sep 2023 17:27:22 +0200 +Subject: [PATCH] rule: check address family in set collapse + +JIRA: https://issues.redhat.com/browse/RHEL-5908 +Upstream Status: nftables commit a817ea9655dee + +commit a817ea9655dee1915423a802c0133e3611e02b3a +Author: Derek Hageman +Date: Thu Sep 1 10:10:41 2022 -0600 + + rule: check address family in set collapse + + 498a5f0c219d added collapsing of set operations in different commands. + However, the logic is currently too relaxed. It is valid to have a + table and set with identical names on different address families. + For example: + + table ip a { + set x { + type inet_service; + } + } + table ip6 a { + set x { + type inet_service; + } + } + add element ip a x { 1 } + add element ip a x { 2 } + add element ip6 a x { 2 } + + The above currently results in nothing being added to the ip6 family + table due to being collapsed into the ip table add. Prior to + 498a5f0c219d the set add would work. The fix is simply to check the + family in addition to the table and set names before allowing a + collapse. + + [ Add testcase to tests/shell --pablo ] + + Fixes: 498a5f0c219d ("rule: collapse set element commands") + Signed-off-by: Derek Hageman + Signed-off-by: Pablo Neira Ayuso + +Signed-off-by: Phil Sutter +--- + src/rule.c | 3 ++- + tests/shell/testcases/sets/collapse_elem_0 | 19 +++++++++++++++++++ + .../testcases/sets/dumps/collapse_elem_0.nft | 12 ++++++++++++ + 3 files changed, 33 insertions(+), 1 deletion(-) + create mode 100755 tests/shell/testcases/sets/collapse_elem_0 + create mode 100644 tests/shell/testcases/sets/dumps/collapse_elem_0.nft + +diff --git a/src/rule.c b/src/rule.c +index 0526a14..3b60cca 100644 +--- a/src/rule.c ++++ b/src/rule.c +@@ -1409,7 +1409,8 @@ bool nft_cmd_collapse(struct list_head *cmds) + continue; + } + +- if (strcmp(elems->handle.table.name, cmd->handle.table.name) || ++ if (elems->handle.family != cmd->handle.family || ++ strcmp(elems->handle.table.name, cmd->handle.table.name) || + strcmp(elems->handle.set.name, cmd->handle.set.name)) { + elems = cmd; + continue; +diff --git a/tests/shell/testcases/sets/collapse_elem_0 b/tests/shell/testcases/sets/collapse_elem_0 +new file mode 100755 +index 0000000..7699e9d +--- /dev/null ++++ b/tests/shell/testcases/sets/collapse_elem_0 +@@ -0,0 +1,19 @@ ++#!/bin/bash ++ ++set -e ++ ++RULESET="table ip a { ++ set x { ++ type inet_service; ++ } ++} ++table ip6 a { ++ set x { ++ type inet_service; ++ } ++} ++add element ip a x { 1 } ++add element ip a x { 2 } ++add element ip6 a x { 2 }" ++ ++$NFT -f - <<< $RULESET +diff --git a/tests/shell/testcases/sets/dumps/collapse_elem_0.nft b/tests/shell/testcases/sets/dumps/collapse_elem_0.nft +new file mode 100644 +index 0000000..a3244fc +--- /dev/null ++++ b/tests/shell/testcases/sets/dumps/collapse_elem_0.nft +@@ -0,0 +1,12 @@ ++table ip a { ++ set x { ++ type inet_service ++ elements = { 1, 2 } ++ } ++} ++table ip6 a { ++ set x { ++ type inet_service ++ elements = { 2 } ++ } ++} +-- +2.41.0 + diff --git a/SPECS/nftables.spec b/SPECS/nftables.spec index e68faf3..26fd11c 100644 --- a/SPECS/nftables.spec +++ b/SPECS/nftables.spec @@ -1,9 +1,9 @@ -%define rpmversion 1.0.4 -%define specrelease 10 +%define nft_rpmversion 1.0.4 +%define nft_specrelease 11 Name: nftables -Version: %{rpmversion} -Release: %{specrelease}%{?dist}%{?buildid} +Version: %{nft_rpmversion} +Release: %{nft_specrelease}%{?dist}%{?buildid} # Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track. Epoch: 1 Summary: Netfilter Tables userspace utillites @@ -50,6 +50,7 @@ Patch28: 0028-netlink-Fix-for-potential-NULL-pointer-deref.patch Patch29: 0029-optimize-Do-not-return-garbage-from-stack.patch Patch30: 0030-optimize-Clarify-chain_optimize-array-allocations.patch Patch31: 0031-netlink_delinearize-Sanitize-concat-data-element-dec.patch +Patch32: 0032-rule-check-address-family-in-set-collapse.patch BuildRequires: autoconf BuildRequires: automake @@ -161,6 +162,10 @@ sed -i -e 's/\(sofile=\)".*"/\1"'$sofile'"/' \ %{python3_sitelib}/nftables/ %changelog +* Thu Sep 21 2023 Phil Sutter [1.0.4-11.el9] +- rule: check address family in set collapse (Phil Sutter) [RHEL-5908] +- spec: Rename variables to avoid a clash (Phil Sutter) [INTERNAL] + * Tue Feb 21 2023 Phil Sutter [1.0.4-10.el9] - netlink_delinearize: Sanitize concat data element decoding (Phil Sutter) [2160049] - optimize: Clarify chain_optimize() array allocations (Phil Sutter) [2160049]