rpms/nftables
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add patch to fix nft -f dep gen.

Browse Source
This commit is contained in:
Kevin Fenzi 2015-01-10 11:11:51 -07:00
parent 86e8aa2973
commit 6b22efbed5
2 changed files with 71 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
nftables-0.4-fix-dep-gen.patch Normal file
View File

@ -0,0 +1,62 @@
From 545c93d54d900e8e20071891b7e2bf3bb0e5fed2 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue, 6 Jan 2015 21:28:53 +0100
Subject: evaluate: reject: fix dependency generation from nft -f
When nft -f is used, ctx->cmd points to the table object, which
contains the corresponding chain, set and rule lists. The reject
statement evaluator relies on ctx->cmd->rule to add the payload
dependencies, which is doesn't point to the rule in that case.
This patch adds the rule context to the eval_ctx structure to update
the rule list of statements when generating dependencies, as the reject
statement needs.
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=993
Reported-by: Ting-Wei Lan <lantw44@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
diff --git a/include/rule.h b/include/rule.h
index 936177b..0c52315 100644
--- a/include/rule.h
+++ b/include/rule.h
@@ -344,6 +344,7 @@ extern void cmd_free(struct cmd *cmd);
* @msgs: message queue
* @cmd: current command
* @table: current table
+ * @rule: current rule
* @set: current set
* @stmt: current statement
* @ectx: expression context
@@ -353,6 +354,7 @@ struct eval_ctx {
struct list_head *msgs;
struct cmd *cmd;
struct table *table;
+ struct rule *rule;
struct set *set;
struct stmt *stmt;
struct expr_ctx ectx;
diff --git a/src/evaluate.c b/src/evaluate.c
index 8f0acf7..2c4e811 100644
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -1203,7 +1203,7 @@ static int stmt_reject_gen_dependency(struct eval_ctx *ctx, struct stmt *stmt,
if (payload_gen_dependency(ctx, payload, &nstmt) < 0)
return -1;
- list_add(&nstmt->list, &ctx->cmd->rule->stmts);
+ list_add(&nstmt->list, &ctx->rule->stmts);
return 0;
}
@@ -1722,6 +1722,7 @@ static int rule_evaluate(struct eval_ctx *ctx, struct rule *rule)
proto_ctx_init(&ctx->pctx, rule->handle.family);
memset(&ctx->ectx, 0, sizeof(ctx->ectx));
+ ctx->rule = rule;
list_for_each_entry(stmt, &rule->stmts, list) {
if (tstmt != NULL)
return stmt_binary_error(ctx, stmt, tstmt,
--
cgit v0.10.2

10
nftables.spec
View File

@ -3,7 +3,7 @@
Name: nftables
Version: 0.4
#Release: 0.1.%{snapdate}git%{?dist}
Release: 1%{?dist}
Release: 2%{?dist}
# Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track.
Epoch: 1
Summary: Netfilter Tables userspace utillites
@ -12,6 +12,9 @@ License: GPLv2
URL: http://netfilter.org/projects/nftables/
#Source0: http://ftp.netfilter.org/pub/nftables/snapshot/nftables-%{snapdate}.tar.bz2
Source0: http://ftp.netfilter.org/pub/nftables/nftables-%{version}.tar.bz2
# Already applied upstream
# http://git.netfilter.org/nftables/patch/?id=545c93d54d900e8e20071891b7e2bf3bb0e5fed2
Patch0: nftables-0.4-fix-dep-gen.patch
#BuildRequires: autogen
#BuildRequires: autoconf
@ -32,6 +35,8 @@ Netfilter Tables userspace utilities.
#setup -q -n nftables-%{snapdate}
%setup -q
%patch0 -p1
%build
#./autogen.sh
%configure --disable-silent-rules
@ -49,6 +54,9 @@ chmod 644 $RPM_BUILD_ROOT/%{_mandir}/man8/nft*
%{_mandir}/man8/nft*
%changelog
* Sat Jan 10 2015 Kevin Fenzi <kevin@scrye.com> 0.4-2
- Add patch to fix nft -f dep gen.
* Fri Dec 26 2014 Kevin Fenzi <kevin@scrye.com> 0.4-1
- Update to 0.4
- Add Epoch to fix versioning.