nftables-1.1.5-6.el10

* Wed Jul 29 2026 Phil Sutter <psutter@redhat.com> [1.1.5-6.el10]
- tests: Prepare exit codes for automake (Phil Sutter) [RHEL-179035]
- parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-179035]
- intervals: Fix for inconsistent union field use (Phil Sutter) [RHEL-179035]
Resolves: RHEL-179035

0040-intervals-Fix-for-inconsistent-union-field-use.patch

@@ -0,0 +1,46 @@
+From 800a941f90e85ec7b3e0974c1fc575edde59f558 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Tue, 28 Jul 2026 13:31:01 +0200
+Subject: [PATCH] intervals: Fix for inconsistent union field use
+
+JIRA: https://issues.redhat.com/browse/RHEL-179035
+Upstream Status: nftables commit ba90672b190737d72723d0ec6ccfaaa46b4e7cd0
+Conflicts: Adjusted to missing commit 775383afb9298
+           ("src: move flags from EXPR_SET_ELEM to key")
+
+commit ba90672b190737d72723d0ec6ccfaaa46b4e7cd0
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Tue May 26 15:49:58 2026 +0200
+
+    intervals: Fix for inconsistent union field use
+
+    Reported by a static code analyzer: key->value belongs to a different
+    struct in the embedded anonymous union than key->range.* which is
+    accessed elsewhere in that function.
+
+    It is correct in that the function asserts key->etype to be
+    EXPR_RANGE_VALUE, so key->value is not necessarily valid (it just
+    happens to match key->range.low's offset.
+
+    Fixes: 91dc281a82ea6 ("src: rework singleton interval transformation to reduce memory consumption")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ src/intervals.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/intervals.c b/src/intervals.c
+index d8c61ef..9246068 100644
+--- a/src/intervals.c
++++ b/src/intervals.c
+@@ -812,7 +812,8 @@ int setelem_to_interval(const struct set *set, struct expr *elem,
+ 
+ 	if (adjacent)
+ 		return 0;
+-	else if (!mpz_cmp_ui(key->value, 0) && elem->flags & EXPR_F_INTERVAL_END) {
++	else if (!mpz_cmp_ui(key->range.low, 0) &&
++		 elem->flags & EXPR_F_INTERVAL_END) {
+ 		low->flags |= EXPR_F_INTERVAL_END;
+ 		return 0;
+ 	} else if (mpz_scan0(key->range.high, 0) == set->key->len) {

0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch

@@ -0,0 +1,50 @@
+From 1bfcf1e3dbd322525bb227733e0e04c9f0389d01 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Tue, 28 Jul 2026 13:31:25 +0200
+Subject: [PATCH] parser_json: fix map/set type confusion crash in map
+ statement parser
+
+JIRA: https://issues.redhat.com/browse/RHEL-179035
+Upstream Status: nftables commit 628701e796ab9a4da5541cf77fa809c2ce8e7720
+
+commit 628701e796ab9a4da5541cf77fa809c2ce8e7720
+Author: Florian Westphal <fw@strlen.de>
+Date:   Thu May 21 16:18:55 2026 +0200
+
+    parser_json: fix map/set type confusion crash in map statement parser
+
+    Quoting Alessandro Gario:
+      Anthropic is conducting research into the use of large language models
+      for automated vulnerability discovery in open source software. As part
+      of that work, Anthropic used Claude to scan a set of widely used open
+      source projects for security issues. Anthropic then engaged Trail of
+      Bits to independently triage, manually validate, and develop patches
+      for the findings. [..]
+
+      json_parse_map_stmt() in src/parser_json.c:2584 passes
+      &stmt->set.stmt_list to json_parse_set_stmt_list(), but the
+      statement object is a map_stmt. The function reads as a copy/edit of
+      json_parse_set_stmt() that forgot to retarget the list-head pointer.
+
+    Reported-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+    Fixes: 27a2da23d508 ("netlink_linearize: skip set element expression in map statement key")
+    Signed-off-by: Florian Westphal <fw@strlen.de>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ src/parser_json.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/parser_json.c b/src/parser_json.c
+index 3a50c86..3521885 100644
+--- a/src/parser_json.c
++++ b/src/parser_json.c
+@@ -2532,7 +2532,7 @@ static struct stmt *json_parse_map_stmt(struct json_ctx *ctx,
+ 	stmt->map.set = expr2;
+ 
+ 	if (!json_unpack(value, "{s:o}", "stmt", &stmt_json) &&
+-	    json_parse_set_stmt_list(ctx, &stmt->set.stmt_list, stmt_json) < 0) {
++	    json_parse_set_stmt_list(ctx, &stmt->map.stmt_list, stmt_json) < 0) {
+ 		stmt_free(stmt);
+ 		return NULL;
+ 	}

0042-tests-Prepare-exit-codes-for-automake.patch

@@ -0,0 +1,112 @@
+From 3706376e6c6eab768155ef6dcc17c35c3c0f8e5d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 29 Jul 2026 14:48:05 +0200
+Subject: [PATCH] tests: Prepare exit codes for automake
+
+JIRA: https://issues.redhat.com/browse/RHEL-179035
+Upstream Status: nftables commit 15c01d744a6b8f428e785a36687e7ecdbc3e7a15
+
+commit 15c01d744a6b8f428e785a36687e7ecdbc3e7a15
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Thu Aug 31 12:44:55 2023 +0200
+
+    tests: Prepare exit codes for automake
+
+    Make the test suite runners exit 77 when requiring root and running as
+    regular user, exit 99 for internal errors (unrelated to test cases) and
+    exit 1 (or any free non-zero value) to indicate test failures.
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ tests/monitor/run-tests.sh | 11 ++++-------
+ tests/py/nft-test.py       | 12 +++++++-----
+ tests/shell/run-tests.sh   |  2 +-
+ 3 files changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/tests/monitor/run-tests.sh b/tests/monitor/run-tests.sh
+index bf10c16..3aeb5e2 100755
+--- a/tests/monitor/run-tests.sh
++++ b/tests/monitor/run-tests.sh
+@@ -12,18 +12,15 @@ err() {
+ 	echo "$*" >&2
+ }
+ 
+-die() {
+-	err "$*"
+-	exit 1
+-}
+-
+ if [ "$(id -u)" != "0" ] ; then
+-	die "this requires root!"
++	err "this requires root!"
++	exit 77
+ fi
+ 
+ testdir=$(mktemp -d)
+ if [ ! -d $testdir ]; then
+-	die "Failed to create test directory"
++	err "Failed to create test directory"
++	exit 99
+ fi
+ trap 'rm -rf $testdir; $nft flush ruleset' EXIT
+ 
+diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py
+index 984f2b9..78f3fa9 100755
+--- a/tests/py/nft-test.py
++++ b/tests/py/nft-test.py
+@@ -1519,7 +1519,7 @@ def main():
+ 
+     if os.getuid() != 0:
+         print("You need to be root to run this, sorry")
+-        return
++        return 77
+ 
+     if not args.no_netns and not spawn_netns():
+         print_warning("cannot run in own namespace, connectivity might break")
+@@ -1538,11 +1538,11 @@ def main():
+     if check_lib_path and not os.path.exists(args.library):
+         print("The nftables library at '%s' does not exist. "
+               "You need to build the project." % args.library)
+-        return
++        return 99
+ 
+     if args.enable_schema and not args.enable_json:
+         print_error("Option --schema requires option --json")
+-        return
++        return 99
+ 
+     global nftables
+     nftables = Nftables(sofile = args.library)
+@@ -1555,7 +1555,7 @@ def main():
+         print_info("Log will be available at %s" % LOGFILE)
+     except IOError:
+         print_error("Cannot open log file %s" % LOGFILE)
+-        return
++        return 99
+ 
+     file_list = []
+     if args.filenames:
+@@ -1601,5 +1601,7 @@ def main():
+                 print("%d test files, %d files passed, %d unit tests, " % (test_files, files_ok, tests))
+                 print("%d error, %d warning" % (errors, warnings))
+ 
++    return errors != 0
++
+ if __name__ == '__main__':
+-    main()
++    sys.exit(main())
+diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh
+index 2d2e0ad..46f523b 100755
+--- a/tests/shell/run-tests.sh
++++ b/tests/shell/run-tests.sh
+@@ -96,7 +96,7 @@ _msg() {
+ 		printf '%s\n' "$level: $*"
+ 	fi
+ 	if [ "$level" = E ] ; then
+-		exit 1
++		exit 99
+ 	fi
+ }
+ 

nftables.spec

@@ -1,6 +1,6 @@
 Name:           nftables
 Version:        1.1.5
-Release:        5%{?dist}
+Release:        6%{?dist}
 # Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track.
 Epoch:          1
 Summary:        Netfilter Tables userspace utilities
@@ -56,6 +56,9 @@ Patch36:            0036-tests-py-tools-Add-regen_payloads.sh.patch
 Patch37:            0037-tests-py-objects.t-must-use-input-not-output.patch
 Patch38:            0038-tests-py-Update-payload-records.patch
 Patch39:            0039-tests-py-Adjust-payloads-to-changed-userdata-printin.patch
+Patch40:            0040-intervals-Fix-for-inconsistent-union-field-use.patch
+Patch41:            0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch
+Patch42:            0042-tests-Prepare-exit-codes-for-automake.patch
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -173,6 +176,11 @@ cd py/
 %files -n python3-nftables -f %{pyproject_files}
 
 %changelog
+* Wed Jul 29 2026 Phil Sutter <psutter@redhat.com> [1.1.5-6.el10]
+- tests: Prepare exit codes for automake (Phil Sutter) [RHEL-179035]
+- parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-179035]
+- intervals: Fix for inconsistent union field use (Phil Sutter) [RHEL-179035]
+
 * Thu May 21 2026 Phil Sutter <psutter@redhat.com> [1.1.5-5.el10]
 - Bump revision to overcome pipeline issues (Phil Sutter) [RHEL-128553]