nftables-1.0.4-8.el8

* Fri May 29 2026 Phil Sutter <psutter@redhat.com> [1.0.4-8.el8]
- Tree-wide use of python3 (Phil Sutter) [RHEL-179874]
- tests: shell: connect chains to hook point (Phil Sutter) [RHEL-179874]
- src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-179599]
- expression: cleanup expr_ops_by_type() and handle u32 input (Phil Sutter) [RHEL-179599]
- netlink: handle invalid etype in set_make_key() (Phil Sutter) [RHEL-179599]
Resolves: RHEL-179599, RHEL-179874

.fmf/version

@@ -0,0 +1 @@
+1

0043-netlink-handle-invalid-etype-in-set_make_key.patch

@@ -0,0 +1,42 @@
+From c0bdfb75c5f264b4f56179b1ce54ad335695ae8f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 28 May 2026 00:48:45 +0200
+Subject: [PATCH] netlink: handle invalid etype in set_make_key()
+
+JIRA: https://issues.redhat.com/browse/RHEL-179599
+Upstream Status: nftables commit c4186c5376ee73efff005dbd23dd73a8e06e6ad8
+
+commit c4186c5376ee73efff005dbd23dd73a8e06e6ad8
+Author: Thomas Haller <thaller@redhat.com>
+Date:   Wed Sep 20 16:26:07 2023 +0200
+
+    netlink: handle invalid etype in set_make_key()
+
+    It's not clear to me, what ensures that the etype is always valid.
+    Handle a NULL.
+
+    Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support')
+    Signed-off-by: Thomas Haller <thaller@redhat.com>
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ src/netlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/netlink.c b/src/netlink.c
+index dee1732..c323854 100644
+--- a/src/netlink.c
++++ b/src/netlink.c
+@@ -801,6 +801,8 @@ static struct expr *set_make_key(const struct nftnl_udata *attr)
+ 
+ 	etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]);
+ 	ops = expr_ops_by_type(etype);
++	if (!ops)
++		return NULL;
+ 
+ 	expr = ops->parse_udata(ud[NFTNL_UDATA_SET_TYPEOF_DATA]);
+ 	if (!expr)
+-- 
+2.53.0
+

0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch

@@ -0,0 +1,135 @@
+From 12799007329de427d4d0515b3be3307ccd1c8c09 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 28 May 2026 00:48:45 +0200
+Subject: [PATCH] expression: cleanup expr_ops_by_type() and handle u32 input
+
+JIRA: https://issues.redhat.com/browse/RHEL-179599
+Upstream Status: nftables commit 3d0ce3c19d319a5aae806b617905cfa1ee7f87f4
+Conflicts: Changes in old code due to missing commit 0d614a853bf49
+           ("src: fix enum/integer mismatches").
+
+commit 3d0ce3c19d319a5aae806b617905cfa1ee7f87f4
+Author: Thomas Haller <thaller@redhat.com>
+Date:   Wed Sep 20 16:26:08 2023 +0200
+
+    expression: cleanup expr_ops_by_type() and handle u32 input
+
+    Make fewer assumptions about the underlying integer type of the enum.
+    Instead, be clear about where we have an untrusted uint32_t from netlink
+    and an enum. Rename expr_ops_by_type() to expr_ops_by_type_u32() to make
+    this clearer. Later we might make the enum as packed, when this starts
+    to matter more.
+
+    Also, only the code path expr_ops() wants strict validation and assert
+    against valid enum values. Move the assertion out of
+    __expr_ops_by_type(). Then expr_ops_by_type_u32() does not need to
+    duplicate the handling of EXPR_INVALID. We still need to duplicate the
+    check against EXPR_MAX, to ensure that the uint32_t value can be cast to
+    an enum value.
+
+    [ Remove cast on EXPR_MAX. --pablo ]
+
+    Signed-off-by: Thomas Haller <thaller@redhat.com>
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ include/expression.h |  2 +-
+ src/expression.c     | 23 ++++++++++++-----------
+ src/netlink.c        |  4 ++--
+ 3 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/include/expression.h b/include/expression.h
+index cf7319b..57fb377 100644
+--- a/include/expression.h
++++ b/include/expression.h
+@@ -181,7 +181,7 @@ struct expr_ops {
+ };
+ 
+ const struct expr_ops *expr_ops(const struct expr *e);
+-const struct expr_ops *expr_ops_by_type(enum expr_types etype);
++const struct expr_ops *expr_ops_by_type_u32(uint32_t value);
+ 
+ /**
+  * enum expr_flags
+diff --git a/src/expression.c b/src/expression.c
+index 7390089..ebb8079 100644
+--- a/src/expression.c
++++ b/src/expression.c
+@@ -994,7 +994,7 @@ static struct expr *concat_expr_parse_udata(const struct nftnl_udata *attr)
+ 			goto err_free;
+ 
+ 		etype = nftnl_udata_get_u32(nest_ud[NFTNL_UDATA_SET_KEY_CONCAT_SUB_TYPE]);
+-		ops = expr_ops_by_type(etype);
++		ops = expr_ops_by_type_u32(etype);
+ 		if (!ops || !ops->parse_udata)
+ 			goto err_free;
+ 
+@@ -1497,9 +1497,7 @@ void range_expr_value_high(mpz_t rop, const struct expr *expr)
+ static const struct expr_ops *__expr_ops_by_type(enum expr_types etype)
+ {
+ 	switch (etype) {
+-	case EXPR_INVALID:
+-		BUG("Invalid expression ops requested");
+-		break;
++	case EXPR_INVALID: break;
+ 	case EXPR_VERDICT: return &verdict_expr_ops;
+ 	case EXPR_SYMBOL: return &symbol_expr_ops;
+ 	case EXPR_VARIABLE: return &variable_expr_ops;
+@@ -1531,20 +1529,23 @@ static const struct expr_ops *__expr_ops_by_type(enum expr_types etype)
+ 	case EXPR_FLAGCMP: return &flagcmp_expr_ops;
+ 	}
+ 
+-	BUG("Unknown expression type %d\n", etype);
++	return NULL;
+ }
+ 
+ const struct expr_ops *expr_ops(const struct expr *e)
+ {
+-	return __expr_ops_by_type(e->etype);
++	const struct expr_ops *ops;
++
++	ops = __expr_ops_by_type(e->etype);
++	if (!ops)
++		BUG("Unknown expression type %d\n", e->etype);
++
++	return ops;
+ }
+ 
+-const struct expr_ops *expr_ops_by_type(uint32_t value)
++const struct expr_ops *expr_ops_by_type_u32(uint32_t value)
+ {
+-	/* value might come from unreliable source, such as "udata"
+-	 * annotation of set keys.  Avoid BUG() assertion.
+-	 */
+-	if (value == EXPR_INVALID || value > EXPR_MAX)
++	if (value > EXPR_MAX)
+ 		return NULL;
+ 
+ 	return __expr_ops_by_type(value);
+diff --git a/src/netlink.c b/src/netlink.c
+index c323854..7dc166f 100644
+--- a/src/netlink.c
++++ b/src/netlink.c
+@@ -783,8 +783,8 @@ static struct expr *set_make_key(const struct nftnl_udata *attr)
+ {
+ 	const struct nftnl_udata *ud[NFTNL_UDATA_SET_TYPEOF_MAX + 1] = {};
+ 	const struct expr_ops *ops;
+-	enum expr_types etype;
+ 	struct expr *expr;
++	uint32_t etype;
+ 	int err;
+ 
+ 	if (!attr)
+@@ -800,7 +800,7 @@ static struct expr *set_make_key(const struct nftnl_udata *attr)
+ 		return NULL;
+ 
+ 	etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]);
+-	ops = expr_ops_by_type(etype);
++	ops = expr_ops_by_type_u32(etype);
+ 	if (!ops)
+ 		return NULL;
+ 
+-- 
+2.53.0
+

0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch

@@ -0,0 +1,45 @@
+From 2e909b6557572a481dbaa84f3aa81a71e96ac5f9 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 28 May 2026 00:49:16 +0200
+Subject: [PATCH] src: netlink: fix crash when ops doesn't support udata
+
+JIRA: https://issues.redhat.com/browse/RHEL-179599
+Upstream Status: nftables commit be737a1986bfee0ddea4bee7863dca0123a2bcbc
+
+commit be737a1986bfee0ddea4bee7863dca0123a2bcbc
+Author: Florian Westphal <fw@strlen.de>
+Date:   Thu May 8 16:29:04 2025 +0200
+
+    src: netlink: fix crash when ops doesn't support udata
+
+    Whenever a new version adds udata support to an expression, then old
+    versions of nft will crash when trying to list such a ruleset generated
+    by a more recent version of nftables.
+
+    Fix this by falling back to 'type' format.
+
+    Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support')
+    Signed-off-by: Florian Westphal <fw@strlen.de>
+    Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ src/netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/netlink.c b/src/netlink.c
+index 7dc166f..4946634 100644
+--- a/src/netlink.c
++++ b/src/netlink.c
+@@ -801,7 +801,7 @@ static struct expr *set_make_key(const struct nftnl_udata *attr)
+ 
+ 	etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]);
+ 	ops = expr_ops_by_type_u32(etype);
+-	if (!ops)
++	if (!ops || !ops->parse_udata)
+ 		return NULL;
+ 
+ 	expr = ops->parse_udata(ud[NFTNL_UDATA_SET_TYPEOF_DATA]);
+-- 
+2.53.0
+

0046-tests-shell-connect-chains-to-hook-point.patch

@@ -0,0 +1,106 @@
+From a47b862ee07e029f6aa324cb628d4b2ec0d9d6e2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 28 May 2026 14:52:27 +0200
+Subject: [PATCH] tests: shell: connect chains to hook point
+
+JIRA: https://issues.redhat.com/browse/RHEL-179874
+Upstream Status: nftables commit 1fc78397e9a1fb5e41841b8b4e92a9eb9536c6f1
+Conflicts: Removed changes to non-existent dumps and test cases.
+
+commit 1fc78397e9a1fb5e41841b8b4e92a9eb9536c6f1
+Author: Florian Westphal <fw@strlen.de>
+Date:   Wed Jul 10 02:33:37 2024 +0200
+
+    tests: shell: connect chains to hook point
+
+    These tests should fail because they contain a loop or exceed the jump stack.
+
+    But this depends on the kernel validating chains that are not bound to any
+    basechain/hook point.
+
+    Wire up the initial chain to filter type.
+
+    Without this tests will start to fail when kernel stops validating
+    chains that are not reachable by any base chain.
+
+    Signed-off-by: Florian Westphal <fw@strlen.de>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ tests/shell/testcases/chains/0003jump_loop_1         | 3 ++-
+ tests/shell/testcases/chains/0010endless_jump_loop_1 | 2 +-
+ tests/shell/testcases/chains/0011endless_jump_loop_1 | 2 +-
+ tests/shell/testcases/chains/0018check_jump_loop_1   | 2 +-
+ tests/shell/testcases/transactions/0023rule_1        | 2 +-
+ 5 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/tests/shell/testcases/chains/0003jump_loop_1 b/tests/shell/testcases/chains/0003jump_loop_1
+index 80e243f..1a8eaf6 100755
+--- a/tests/shell/testcases/chains/0003jump_loop_1
++++ b/tests/shell/testcases/chains/0003jump_loop_1
+@@ -5,8 +5,9 @@ set -e
+ MAX_JUMPS=16
+ 
+ $NFT add table t
++$NFT "add chain t c1 { type filter hook prerouting priority 0; }"
+ 
+-for i in $(seq 1 $MAX_JUMPS)
++for i in $(seq 2 $MAX_JUMPS)
+ do
+ 	$NFT add chain t c${i}
+ done
+diff --git a/tests/shell/testcases/chains/0010endless_jump_loop_1 b/tests/shell/testcases/chains/0010endless_jump_loop_1
+index 5d3ef23..6000e5d 100755
+--- a/tests/shell/testcases/chains/0010endless_jump_loop_1
++++ b/tests/shell/testcases/chains/0010endless_jump_loop_1
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $NFT add table t
+-$NFT add chain t c
++$NFT add chain "t c { type filter hook input priority 0; }"
+ 
+ # kernel should return ELOOP
+ $NFT add rule t c tcp dport vmap {1 : jump c} 2>/dev/null || exit 0
+diff --git a/tests/shell/testcases/chains/0011endless_jump_loop_1 b/tests/shell/testcases/chains/0011endless_jump_loop_1
+index d75932d..66abf8d 100755
+--- a/tests/shell/testcases/chains/0011endless_jump_loop_1
++++ b/tests/shell/testcases/chains/0011endless_jump_loop_1
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $NFT add table t
+-$NFT add chain t c1
++$NFT add chain "t c1 { type filter hook forward priority 0; }"
+ $NFT add chain t c2
+ $NFT add map t m {type inet_service : verdict \;}
+ $NFT add element t m {2 : jump c2}
+diff --git a/tests/shell/testcases/chains/0018check_jump_loop_1 b/tests/shell/testcases/chains/0018check_jump_loop_1
+index b87520f..1e674d3 100755
+--- a/tests/shell/testcases/chains/0018check_jump_loop_1
++++ b/tests/shell/testcases/chains/0018check_jump_loop_1
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $NFT add table ip filter
+-$NFT add chain ip filter ap1
++$NFT add chain ip filter ap1 "{ type filter hook input priority 0; }"
+ $NFT add chain ip filter ap2
+ $NFT add rule ip filter ap1 jump ap2
+ 
+diff --git a/tests/shell/testcases/transactions/0023rule_1 b/tests/shell/testcases/transactions/0023rule_1
+index e58c088..863bcde 100755
+--- a/tests/shell/testcases/transactions/0023rule_1
++++ b/tests/shell/testcases/transactions/0023rule_1
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ 
+ RULESET="add table x
+-add chain x y
++add chain x y { type filter hook input priority 0; }
+ add rule x y jump y"
+ 
+ # kernel must return ELOOP
+-- 
+2.53.0
+

0047-Tree-wide-use-of-python3.patch

@@ -0,0 +1,83 @@
+From 1b77c42989bca6d5a03f6b7bdb3d5cd729b792e3 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 28 May 2026 16:58:10 +0200
+Subject: [PATCH] Tree-wide use of python3
+
+JIRA: https://issues.redhat.com/browse/RHEL-179874
+Upstream Status: nftables commit 9c0ddde6c830d4718cea88160693fdad6cb15137
+Conflicts:
+- Dropped changes to INSTALL document, they don't apply due to missing
+  other changes
+- Context change in py/setup.py due to missing commit 8ae4dc1f40aa0
+  ("py: use setup.cfg to configure setuptools")
+- Dropped changes to non-existent json-pretty.sh helper
+
+commit 9c0ddde6c830d4718cea88160693fdad6cb15137
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Mon Feb 16 18:23:35 2026 +0100
+
+    Tree-wide use of python3
+
+    It seems that unversioned Python shebangs are discouraged these days:
+
+    - See the lintian web on Debian:
+      https://lintian.debian.org/tags/script-uses-unversioned-python-in-shebang.html
+
+    - Also, see "Finalizing Fedora's Switch to Python3":
+      https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
+
+    Replace them all tree-wide.
+
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ py/nftables.py              | 2 +-
+ py/setup.py                 | 2 +-
+ tests/json_echo/run-test.py | 2 +-
+ tests/py/nft-test.py        | 2 +-
+ 4 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/py/nftables.py b/py/nftables.py
+index 2a0a1e8..f9966d7 100644
+--- a/py/nftables.py
++++ b/py/nftables.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ # Copyright(C) 2018 Phil Sutter <phil@nwl.cc>
+ 
+ # This program is free software; you can redistribute it and/or modify
+diff --git a/py/setup.py b/py/setup.py
+index 72fc8fd..c3850f5 100755
+--- a/py/setup.py
++++ b/py/setup.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/env python3
+ from distutils.core import setup
+ from nftables import NFTABLES_VERSION
+ 
+diff --git a/tests/json_echo/run-test.py b/tests/json_echo/run-test.py
+index a6bdfc6..a990901 100755
+--- a/tests/json_echo/run-test.py
++++ b/tests/json_echo/run-test.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ 
+ from __future__ import print_function
+ import sys
+diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py
+index b66a33c..2b3f28e 100755
+--- a/tests/py/nft-test.py
++++ b/tests/py/nft-test.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/env python3
+ #
+ # (C) 2014 by Ana Rey Botello <anarey@gmail.com>
+ #
+-- 
+2.53.0
+

ci.fmf

@@ -0,0 +1 @@
+resultsdb-testcase: separate

gating.yaml

@@ -1,7 +1,7 @@
+# Gating rhel
 --- !Policy
 product_versions:
-  - rhel-8
+  - rhel-*
 decision_context: osci_compose_gate
 rules:
-#  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1-gating.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-gating.functional}

nftables.spec

@@ -1,5 +1,5 @@
 %define nft_rpmversion 1.0.4
-%define nft_specrelease 7
+%define nft_specrelease 8
 %define libnftnl_ver 1.2.2-1
 
 Name:           nftables
@@ -63,6 +63,11 @@ Patch39:            0039-xt-Fall-back-to-generic-printing-from-translation.patch
 Patch40:            0040-xt-Fix-fallback-printing-for-extensions-matching-key.patch
 Patch41:            0041-evaluate-un-break-rule-insert-with-intervals.patch
 Patch42:            0042-xt-Fix-translation-error-path.patch
+Patch43:            0043-netlink-handle-invalid-etype-in-set_make_key.patch
+Patch44:            0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch
+Patch45:            0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch
+Patch46:            0046-tests-shell-connect-chains-to-hook-point.patch
+Patch47:            0047-Tree-wide-use-of-python3.patch
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -182,6 +187,13 @@ touch -r %{SOURCE2} $RPM_BUILD_ROOT/%{python3_sitelib}/nftables/nftables.py
 %{python3_sitelib}/nftables/
 
 %changelog
+* Fri May 29 2026 Phil Sutter <psutter@redhat.com> [1.0.4-8.el8]
+- Tree-wide use of python3 (Phil Sutter) [RHEL-179874]
+- tests: shell: connect chains to hook point (Phil Sutter) [RHEL-179874]
+- src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-179599]
+- expression: cleanup expr_ops_by_type() and handle u32 input (Phil Sutter) [RHEL-179599]
+- netlink: handle invalid etype in set_make_key() (Phil Sutter) [RHEL-179599]
+
 * Fri Nov 29 2024 Phil Sutter <psutter@redhat.com> [1.0.4-7.el8]
 - xt: Fix translation error path (Phil Sutter) [RHEL-5806]
 

plans/tier1-gating.fmf

@@ -0,0 +1,10 @@
+summary: Internal Tier1-gating beakerlib tests
+discover:
+    how: fmf
+    url: git://pkgs.devel.redhat.com/tests/nftables
+    filter: 'tag: CI-gating & tag: -destructive'
+execute:
+    how: tmt
+adjust:
+    enabled: false
+    when: distro == centos-stream or distro == fedora