From 4d51d5b25e0da76437f93f74852648d790c83bcd Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 29 Jul 2026 14:48:51 +0200 Subject: [PATCH] nftables-1.1.5-6.el10 * Wed Jul 29 2026 Phil Sutter [1.1.5-6.el10] - tests: Prepare exit codes for automake (Phil Sutter) [RHEL-179035] - parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-179035] - intervals: Fix for inconsistent union field use (Phil Sutter) [RHEL-179035] Resolves: RHEL-179035 --- ...Fix-for-inconsistent-union-field-use.patch | 46 +++++++ ...map-set-type-confusion-crash-in-map-.patch | 50 ++++++++ ...ests-Prepare-exit-codes-for-automake.patch | 112 ++++++++++++++++++ nftables.spec | 10 +- 4 files changed, 217 insertions(+), 1 deletion(-) create mode 100644 0040-intervals-Fix-for-inconsistent-union-field-use.patch create mode 100644 0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch create mode 100644 0042-tests-Prepare-exit-codes-for-automake.patch diff --git a/0040-intervals-Fix-for-inconsistent-union-field-use.patch b/0040-intervals-Fix-for-inconsistent-union-field-use.patch new file mode 100644 index 0000000..e7edcda --- /dev/null +++ b/0040-intervals-Fix-for-inconsistent-union-field-use.patch @@ -0,0 +1,46 @@ +From 800a941f90e85ec7b3e0974c1fc575edde59f558 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Jul 2026 13:31:01 +0200 +Subject: [PATCH] intervals: Fix for inconsistent union field use + +JIRA: https://issues.redhat.com/browse/RHEL-179035 +Upstream Status: nftables commit ba90672b190737d72723d0ec6ccfaaa46b4e7cd0 +Conflicts: Adjusted to missing commit 775383afb9298 + ("src: move flags from EXPR_SET_ELEM to key") + +commit ba90672b190737d72723d0ec6ccfaaa46b4e7cd0 +Author: Phil Sutter +Date: Tue May 26 15:49:58 2026 +0200 + + intervals: Fix for inconsistent union field use + + Reported by a static code analyzer: key->value belongs to a different + struct in the embedded anonymous union than key->range.* which is + accessed elsewhere in that function. + + It is correct in that the function asserts key->etype to be + EXPR_RANGE_VALUE, so key->value is not necessarily valid (it just + happens to match key->range.low's offset. + + Fixes: 91dc281a82ea6 ("src: rework singleton interval transformation to reduce memory consumption") + Signed-off-by: Phil Sutter + +Signed-off-by: Phil Sutter +--- + src/intervals.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/intervals.c b/src/intervals.c +index d8c61ef..9246068 100644 +--- a/src/intervals.c ++++ b/src/intervals.c +@@ -812,7 +812,8 @@ int setelem_to_interval(const struct set *set, struct expr *elem, + + if (adjacent) + return 0; +- else if (!mpz_cmp_ui(key->value, 0) && elem->flags & EXPR_F_INTERVAL_END) { ++ else if (!mpz_cmp_ui(key->range.low, 0) && ++ elem->flags & EXPR_F_INTERVAL_END) { + low->flags |= EXPR_F_INTERVAL_END; + return 0; + } else if (mpz_scan0(key->range.high, 0) == set->key->len) { diff --git a/0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch b/0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch new file mode 100644 index 0000000..71c644a --- /dev/null +++ b/0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch @@ -0,0 +1,50 @@ +From 1bfcf1e3dbd322525bb227733e0e04c9f0389d01 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 28 Jul 2026 13:31:25 +0200 +Subject: [PATCH] parser_json: fix map/set type confusion crash in map + statement parser + +JIRA: https://issues.redhat.com/browse/RHEL-179035 +Upstream Status: nftables commit 628701e796ab9a4da5541cf77fa809c2ce8e7720 + +commit 628701e796ab9a4da5541cf77fa809c2ce8e7720 +Author: Florian Westphal +Date: Thu May 21 16:18:55 2026 +0200 + + parser_json: fix map/set type confusion crash in map statement parser + + Quoting Alessandro Gario: + Anthropic is conducting research into the use of large language models + for automated vulnerability discovery in open source software. As part + of that work, Anthropic used Claude to scan a set of widely used open + source projects for security issues. Anthropic then engaged Trail of + Bits to independently triage, manually validate, and develop patches + for the findings. [..] + + json_parse_map_stmt() in src/parser_json.c:2584 passes + &stmt->set.stmt_list to json_parse_set_stmt_list(), but the + statement object is a map_stmt. The function reads as a copy/edit of + json_parse_set_stmt() that forgot to retarget the list-head pointer. + + Reported-by: Alessandro Gario + Fixes: 27a2da23d508 ("netlink_linearize: skip set element expression in map statement key") + Signed-off-by: Florian Westphal + +Signed-off-by: Phil Sutter +--- + src/parser_json.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/parser_json.c b/src/parser_json.c +index 3a50c86..3521885 100644 +--- a/src/parser_json.c ++++ b/src/parser_json.c +@@ -2532,7 +2532,7 @@ static struct stmt *json_parse_map_stmt(struct json_ctx *ctx, + stmt->map.set = expr2; + + if (!json_unpack(value, "{s:o}", "stmt", &stmt_json) && +- json_parse_set_stmt_list(ctx, &stmt->set.stmt_list, stmt_json) < 0) { ++ json_parse_set_stmt_list(ctx, &stmt->map.stmt_list, stmt_json) < 0) { + stmt_free(stmt); + return NULL; + } diff --git a/0042-tests-Prepare-exit-codes-for-automake.patch b/0042-tests-Prepare-exit-codes-for-automake.patch new file mode 100644 index 0000000..2f2b5c7 --- /dev/null +++ b/0042-tests-Prepare-exit-codes-for-automake.patch @@ -0,0 +1,112 @@ +From 3706376e6c6eab768155ef6dcc17c35c3c0f8e5d Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Wed, 29 Jul 2026 14:48:05 +0200 +Subject: [PATCH] tests: Prepare exit codes for automake + +JIRA: https://issues.redhat.com/browse/RHEL-179035 +Upstream Status: nftables commit 15c01d744a6b8f428e785a36687e7ecdbc3e7a15 + +commit 15c01d744a6b8f428e785a36687e7ecdbc3e7a15 +Author: Phil Sutter +Date: Thu Aug 31 12:44:55 2023 +0200 + + tests: Prepare exit codes for automake + + Make the test suite runners exit 77 when requiring root and running as + regular user, exit 99 for internal errors (unrelated to test cases) and + exit 1 (or any free non-zero value) to indicate test failures. + + Signed-off-by: Phil Sutter + +Signed-off-by: Phil Sutter +--- + tests/monitor/run-tests.sh | 11 ++++------- + tests/py/nft-test.py | 12 +++++++----- + tests/shell/run-tests.sh | 2 +- + 3 files changed, 12 insertions(+), 13 deletions(-) + +diff --git a/tests/monitor/run-tests.sh b/tests/monitor/run-tests.sh +index bf10c16..3aeb5e2 100755 +--- a/tests/monitor/run-tests.sh ++++ b/tests/monitor/run-tests.sh +@@ -12,18 +12,15 @@ err() { + echo "$*" >&2 + } + +-die() { +- err "$*" +- exit 1 +-} +- + if [ "$(id -u)" != "0" ] ; then +- die "this requires root!" ++ err "this requires root!" ++ exit 77 + fi + + testdir=$(mktemp -d) + if [ ! -d $testdir ]; then +- die "Failed to create test directory" ++ err "Failed to create test directory" ++ exit 99 + fi + trap 'rm -rf $testdir; $nft flush ruleset' EXIT + +diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py +index 984f2b9..78f3fa9 100755 +--- a/tests/py/nft-test.py ++++ b/tests/py/nft-test.py +@@ -1519,7 +1519,7 @@ def main(): + + if os.getuid() != 0: + print("You need to be root to run this, sorry") +- return ++ return 77 + + if not args.no_netns and not spawn_netns(): + print_warning("cannot run in own namespace, connectivity might break") +@@ -1538,11 +1538,11 @@ def main(): + if check_lib_path and not os.path.exists(args.library): + print("The nftables library at '%s' does not exist. " + "You need to build the project." % args.library) +- return ++ return 99 + + if args.enable_schema and not args.enable_json: + print_error("Option --schema requires option --json") +- return ++ return 99 + + global nftables + nftables = Nftables(sofile = args.library) +@@ -1555,7 +1555,7 @@ def main(): + print_info("Log will be available at %s" % LOGFILE) + except IOError: + print_error("Cannot open log file %s" % LOGFILE) +- return ++ return 99 + + file_list = [] + if args.filenames: +@@ -1601,5 +1601,7 @@ def main(): + print("%d test files, %d files passed, %d unit tests, " % (test_files, files_ok, tests)) + print("%d error, %d warning" % (errors, warnings)) + ++ return errors != 0 ++ + if __name__ == '__main__': +- main() ++ sys.exit(main()) +diff --git a/tests/shell/run-tests.sh b/tests/shell/run-tests.sh +index 2d2e0ad..46f523b 100755 +--- a/tests/shell/run-tests.sh ++++ b/tests/shell/run-tests.sh +@@ -96,7 +96,7 @@ _msg() { + printf '%s\n' "$level: $*" + fi + if [ "$level" = E ] ; then +- exit 1 ++ exit 99 + fi + } + diff --git a/nftables.spec b/nftables.spec index 5529ecb..369e183 100644 --- a/nftables.spec +++ b/nftables.spec @@ -1,6 +1,6 @@ Name: nftables Version: 1.1.5 -Release: 5%{?dist} +Release: 6%{?dist} # Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track. Epoch: 1 Summary: Netfilter Tables userspace utilities @@ -56,6 +56,9 @@ Patch36: 0036-tests-py-tools-Add-regen_payloads.sh.patch Patch37: 0037-tests-py-objects.t-must-use-input-not-output.patch Patch38: 0038-tests-py-Update-payload-records.patch Patch39: 0039-tests-py-Adjust-payloads-to-changed-userdata-printin.patch +Patch40: 0040-intervals-Fix-for-inconsistent-union-field-use.patch +Patch41: 0041-parser_json-fix-map-set-type-confusion-crash-in-map-.patch +Patch42: 0042-tests-Prepare-exit-codes-for-automake.patch BuildRequires: autoconf BuildRequires: automake @@ -173,6 +176,11 @@ cd py/ %files -n python3-nftables -f %{pyproject_files} %changelog +* Wed Jul 29 2026 Phil Sutter [1.1.5-6.el10] +- tests: Prepare exit codes for automake (Phil Sutter) [RHEL-179035] +- parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-179035] +- intervals: Fix for inconsistent union field use (Phil Sutter) [RHEL-179035] + * Thu May 21 2026 Phil Sutter [1.1.5-5.el10] - Bump revision to overcome pipeline issues (Phil Sutter) [RHEL-128553]