From aff0aa217e67af9e7366df04252de66d1a9d58c6 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 29 May 2026 01:57:25 +0200 Subject: [PATCH] nftables-1.0.4-8.el8 * Fri May 29 2026 Phil Sutter [1.0.4-8.el8] - Tree-wide use of python3 (Phil Sutter) [RHEL-179874] - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-179874] - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-179599] - expression: cleanup expr_ops_by_type() and handle u32 input (Phil Sutter) [RHEL-179599] - netlink: handle invalid etype in set_make_key() (Phil Sutter) [RHEL-179599] Resolves: RHEL-179599, RHEL-179874 --- .fmf/version | 1 + ...handle-invalid-etype-in-set_make_key.patch | 42 ++++++ ...up-expr_ops_by_type-and-handle-u32-i.patch | 135 ++++++++++++++++++ ...crash-when-ops-doesn-t-support-udata.patch | 45 ++++++ ...s-shell-connect-chains-to-hook-point.patch | 106 ++++++++++++++ 0047-Tree-wide-use-of-python3.patch | 83 +++++++++++ ci.fmf | 1 + gating.yaml | 6 +- nftables.spec | 14 +- plans/tier1-gating.fmf | 10 ++ 10 files changed, 439 insertions(+), 4 deletions(-) create mode 100644 .fmf/version create mode 100644 0043-netlink-handle-invalid-etype-in-set_make_key.patch create mode 100644 0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch create mode 100644 0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch create mode 100644 0046-tests-shell-connect-chains-to-hook-point.patch create mode 100644 0047-Tree-wide-use-of-python3.patch create mode 100644 ci.fmf create mode 100644 plans/tier1-gating.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/0043-netlink-handle-invalid-etype-in-set_make_key.patch b/0043-netlink-handle-invalid-etype-in-set_make_key.patch new file mode 100644 index 0000000..f67bc1a --- /dev/null +++ b/0043-netlink-handle-invalid-etype-in-set_make_key.patch @@ -0,0 +1,42 @@ +From c0bdfb75c5f264b4f56179b1ce54ad335695ae8f Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 May 2026 00:48:45 +0200 +Subject: [PATCH] netlink: handle invalid etype in set_make_key() + +JIRA: https://issues.redhat.com/browse/RHEL-179599 +Upstream Status: nftables commit c4186c5376ee73efff005dbd23dd73a8e06e6ad8 + +commit c4186c5376ee73efff005dbd23dd73a8e06e6ad8 +Author: Thomas Haller +Date: Wed Sep 20 16:26:07 2023 +0200 + + netlink: handle invalid etype in set_make_key() + + It's not clear to me, what ensures that the etype is always valid. + Handle a NULL. + + Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support') + Signed-off-by: Thomas Haller + Signed-off-by: Pablo Neira Ayuso + +Signed-off-by: Phil Sutter +--- + src/netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/netlink.c b/src/netlink.c +index dee1732..c323854 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -801,6 +801,8 @@ static struct expr *set_make_key(const struct nftnl_udata *attr) + + etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]); + ops = expr_ops_by_type(etype); ++ if (!ops) ++ return NULL; + + expr = ops->parse_udata(ud[NFTNL_UDATA_SET_TYPEOF_DATA]); + if (!expr) +-- +2.53.0 + diff --git a/0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch b/0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch new file mode 100644 index 0000000..d24d98c --- /dev/null +++ b/0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch @@ -0,0 +1,135 @@ +From 12799007329de427d4d0515b3be3307ccd1c8c09 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 May 2026 00:48:45 +0200 +Subject: [PATCH] expression: cleanup expr_ops_by_type() and handle u32 input + +JIRA: https://issues.redhat.com/browse/RHEL-179599 +Upstream Status: nftables commit 3d0ce3c19d319a5aae806b617905cfa1ee7f87f4 +Conflicts: Changes in old code due to missing commit 0d614a853bf49 + ("src: fix enum/integer mismatches"). + +commit 3d0ce3c19d319a5aae806b617905cfa1ee7f87f4 +Author: Thomas Haller +Date: Wed Sep 20 16:26:08 2023 +0200 + + expression: cleanup expr_ops_by_type() and handle u32 input + + Make fewer assumptions about the underlying integer type of the enum. + Instead, be clear about where we have an untrusted uint32_t from netlink + and an enum. Rename expr_ops_by_type() to expr_ops_by_type_u32() to make + this clearer. Later we might make the enum as packed, when this starts + to matter more. + + Also, only the code path expr_ops() wants strict validation and assert + against valid enum values. Move the assertion out of + __expr_ops_by_type(). Then expr_ops_by_type_u32() does not need to + duplicate the handling of EXPR_INVALID. We still need to duplicate the + check against EXPR_MAX, to ensure that the uint32_t value can be cast to + an enum value. + + [ Remove cast on EXPR_MAX. --pablo ] + + Signed-off-by: Thomas Haller + Signed-off-by: Pablo Neira Ayuso + +Signed-off-by: Phil Sutter +--- + include/expression.h | 2 +- + src/expression.c | 23 ++++++++++++----------- + src/netlink.c | 4 ++-- + 3 files changed, 15 insertions(+), 14 deletions(-) + +diff --git a/include/expression.h b/include/expression.h +index cf7319b..57fb377 100644 +--- a/include/expression.h ++++ b/include/expression.h +@@ -181,7 +181,7 @@ struct expr_ops { + }; + + const struct expr_ops *expr_ops(const struct expr *e); +-const struct expr_ops *expr_ops_by_type(enum expr_types etype); ++const struct expr_ops *expr_ops_by_type_u32(uint32_t value); + + /** + * enum expr_flags +diff --git a/src/expression.c b/src/expression.c +index 7390089..ebb8079 100644 +--- a/src/expression.c ++++ b/src/expression.c +@@ -994,7 +994,7 @@ static struct expr *concat_expr_parse_udata(const struct nftnl_udata *attr) + goto err_free; + + etype = nftnl_udata_get_u32(nest_ud[NFTNL_UDATA_SET_KEY_CONCAT_SUB_TYPE]); +- ops = expr_ops_by_type(etype); ++ ops = expr_ops_by_type_u32(etype); + if (!ops || !ops->parse_udata) + goto err_free; + +@@ -1497,9 +1497,7 @@ void range_expr_value_high(mpz_t rop, const struct expr *expr) + static const struct expr_ops *__expr_ops_by_type(enum expr_types etype) + { + switch (etype) { +- case EXPR_INVALID: +- BUG("Invalid expression ops requested"); +- break; ++ case EXPR_INVALID: break; + case EXPR_VERDICT: return &verdict_expr_ops; + case EXPR_SYMBOL: return &symbol_expr_ops; + case EXPR_VARIABLE: return &variable_expr_ops; +@@ -1531,20 +1529,23 @@ static const struct expr_ops *__expr_ops_by_type(enum expr_types etype) + case EXPR_FLAGCMP: return &flagcmp_expr_ops; + } + +- BUG("Unknown expression type %d\n", etype); ++ return NULL; + } + + const struct expr_ops *expr_ops(const struct expr *e) + { +- return __expr_ops_by_type(e->etype); ++ const struct expr_ops *ops; ++ ++ ops = __expr_ops_by_type(e->etype); ++ if (!ops) ++ BUG("Unknown expression type %d\n", e->etype); ++ ++ return ops; + } + +-const struct expr_ops *expr_ops_by_type(uint32_t value) ++const struct expr_ops *expr_ops_by_type_u32(uint32_t value) + { +- /* value might come from unreliable source, such as "udata" +- * annotation of set keys. Avoid BUG() assertion. +- */ +- if (value == EXPR_INVALID || value > EXPR_MAX) ++ if (value > EXPR_MAX) + return NULL; + + return __expr_ops_by_type(value); +diff --git a/src/netlink.c b/src/netlink.c +index c323854..7dc166f 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -783,8 +783,8 @@ static struct expr *set_make_key(const struct nftnl_udata *attr) + { + const struct nftnl_udata *ud[NFTNL_UDATA_SET_TYPEOF_MAX + 1] = {}; + const struct expr_ops *ops; +- enum expr_types etype; + struct expr *expr; ++ uint32_t etype; + int err; + + if (!attr) +@@ -800,7 +800,7 @@ static struct expr *set_make_key(const struct nftnl_udata *attr) + return NULL; + + etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]); +- ops = expr_ops_by_type(etype); ++ ops = expr_ops_by_type_u32(etype); + if (!ops) + return NULL; + +-- +2.53.0 + diff --git a/0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch b/0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch new file mode 100644 index 0000000..d6be99c --- /dev/null +++ b/0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch @@ -0,0 +1,45 @@ +From 2e909b6557572a481dbaa84f3aa81a71e96ac5f9 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 May 2026 00:49:16 +0200 +Subject: [PATCH] src: netlink: fix crash when ops doesn't support udata + +JIRA: https://issues.redhat.com/browse/RHEL-179599 +Upstream Status: nftables commit be737a1986bfee0ddea4bee7863dca0123a2bcbc + +commit be737a1986bfee0ddea4bee7863dca0123a2bcbc +Author: Florian Westphal +Date: Thu May 8 16:29:04 2025 +0200 + + src: netlink: fix crash when ops doesn't support udata + + Whenever a new version adds udata support to an expression, then old + versions of nft will crash when trying to list such a ruleset generated + by a more recent version of nftables. + + Fix this by falling back to 'type' format. + + Fixes: 6e48df5329ea ('src: add "typeof" build/parse/print support') + Signed-off-by: Florian Westphal + Reviewed-by: Pablo Neira Ayuso + +Signed-off-by: Phil Sutter +--- + src/netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/netlink.c b/src/netlink.c +index 7dc166f..4946634 100644 +--- a/src/netlink.c ++++ b/src/netlink.c +@@ -801,7 +801,7 @@ static struct expr *set_make_key(const struct nftnl_udata *attr) + + etype = nftnl_udata_get_u32(ud[NFTNL_UDATA_SET_TYPEOF_EXPR]); + ops = expr_ops_by_type_u32(etype); +- if (!ops) ++ if (!ops || !ops->parse_udata) + return NULL; + + expr = ops->parse_udata(ud[NFTNL_UDATA_SET_TYPEOF_DATA]); +-- +2.53.0 + diff --git a/0046-tests-shell-connect-chains-to-hook-point.patch b/0046-tests-shell-connect-chains-to-hook-point.patch new file mode 100644 index 0000000..642b6c3 --- /dev/null +++ b/0046-tests-shell-connect-chains-to-hook-point.patch @@ -0,0 +1,106 @@ +From a47b862ee07e029f6aa324cb628d4b2ec0d9d6e2 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 May 2026 14:52:27 +0200 +Subject: [PATCH] tests: shell: connect chains to hook point + +JIRA: https://issues.redhat.com/browse/RHEL-179874 +Upstream Status: nftables commit 1fc78397e9a1fb5e41841b8b4e92a9eb9536c6f1 +Conflicts: Removed changes to non-existent dumps and test cases. + +commit 1fc78397e9a1fb5e41841b8b4e92a9eb9536c6f1 +Author: Florian Westphal +Date: Wed Jul 10 02:33:37 2024 +0200 + + tests: shell: connect chains to hook point + + These tests should fail because they contain a loop or exceed the jump stack. + + But this depends on the kernel validating chains that are not bound to any + basechain/hook point. + + Wire up the initial chain to filter type. + + Without this tests will start to fail when kernel stops validating + chains that are not reachable by any base chain. + + Signed-off-by: Florian Westphal + +Signed-off-by: Phil Sutter +--- + tests/shell/testcases/chains/0003jump_loop_1 | 3 ++- + tests/shell/testcases/chains/0010endless_jump_loop_1 | 2 +- + tests/shell/testcases/chains/0011endless_jump_loop_1 | 2 +- + tests/shell/testcases/chains/0018check_jump_loop_1 | 2 +- + tests/shell/testcases/transactions/0023rule_1 | 2 +- + 5 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/tests/shell/testcases/chains/0003jump_loop_1 b/tests/shell/testcases/chains/0003jump_loop_1 +index 80e243f..1a8eaf6 100755 +--- a/tests/shell/testcases/chains/0003jump_loop_1 ++++ b/tests/shell/testcases/chains/0003jump_loop_1 +@@ -5,8 +5,9 @@ set -e + MAX_JUMPS=16 + + $NFT add table t ++$NFT "add chain t c1 { type filter hook prerouting priority 0; }" + +-for i in $(seq 1 $MAX_JUMPS) ++for i in $(seq 2 $MAX_JUMPS) + do + $NFT add chain t c${i} + done +diff --git a/tests/shell/testcases/chains/0010endless_jump_loop_1 b/tests/shell/testcases/chains/0010endless_jump_loop_1 +index 5d3ef23..6000e5d 100755 +--- a/tests/shell/testcases/chains/0010endless_jump_loop_1 ++++ b/tests/shell/testcases/chains/0010endless_jump_loop_1 +@@ -3,7 +3,7 @@ + set -e + + $NFT add table t +-$NFT add chain t c ++$NFT add chain "t c { type filter hook input priority 0; }" + + # kernel should return ELOOP + $NFT add rule t c tcp dport vmap {1 : jump c} 2>/dev/null || exit 0 +diff --git a/tests/shell/testcases/chains/0011endless_jump_loop_1 b/tests/shell/testcases/chains/0011endless_jump_loop_1 +index d75932d..66abf8d 100755 +--- a/tests/shell/testcases/chains/0011endless_jump_loop_1 ++++ b/tests/shell/testcases/chains/0011endless_jump_loop_1 +@@ -3,7 +3,7 @@ + set -e + + $NFT add table t +-$NFT add chain t c1 ++$NFT add chain "t c1 { type filter hook forward priority 0; }" + $NFT add chain t c2 + $NFT add map t m {type inet_service : verdict \;} + $NFT add element t m {2 : jump c2} +diff --git a/tests/shell/testcases/chains/0018check_jump_loop_1 b/tests/shell/testcases/chains/0018check_jump_loop_1 +index b87520f..1e674d3 100755 +--- a/tests/shell/testcases/chains/0018check_jump_loop_1 ++++ b/tests/shell/testcases/chains/0018check_jump_loop_1 +@@ -3,7 +3,7 @@ + set -e + + $NFT add table ip filter +-$NFT add chain ip filter ap1 ++$NFT add chain ip filter ap1 "{ type filter hook input priority 0; }" + $NFT add chain ip filter ap2 + $NFT add rule ip filter ap1 jump ap2 + +diff --git a/tests/shell/testcases/transactions/0023rule_1 b/tests/shell/testcases/transactions/0023rule_1 +index e58c088..863bcde 100755 +--- a/tests/shell/testcases/transactions/0023rule_1 ++++ b/tests/shell/testcases/transactions/0023rule_1 +@@ -1,7 +1,7 @@ + #!/bin/bash + + RULESET="add table x +-add chain x y ++add chain x y { type filter hook input priority 0; } + add rule x y jump y" + + # kernel must return ELOOP +-- +2.53.0 + diff --git a/0047-Tree-wide-use-of-python3.patch b/0047-Tree-wide-use-of-python3.patch new file mode 100644 index 0000000..54b86a8 --- /dev/null +++ b/0047-Tree-wide-use-of-python3.patch @@ -0,0 +1,83 @@ +From 1b77c42989bca6d5a03f6b7bdb3d5cd729b792e3 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 28 May 2026 16:58:10 +0200 +Subject: [PATCH] Tree-wide use of python3 + +JIRA: https://issues.redhat.com/browse/RHEL-179874 +Upstream Status: nftables commit 9c0ddde6c830d4718cea88160693fdad6cb15137 +Conflicts: +- Dropped changes to INSTALL document, they don't apply due to missing + other changes +- Context change in py/setup.py due to missing commit 8ae4dc1f40aa0 + ("py: use setup.cfg to configure setuptools") +- Dropped changes to non-existent json-pretty.sh helper + +commit 9c0ddde6c830d4718cea88160693fdad6cb15137 +Author: Pablo Neira Ayuso +Date: Mon Feb 16 18:23:35 2026 +0100 + + Tree-wide use of python3 + + It seems that unversioned Python shebangs are discouraged these days: + + - See the lintian web on Debian: + https://lintian.debian.org/tags/script-uses-unversioned-python-in-shebang.html + + - Also, see "Finalizing Fedora's Switch to Python3": + https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 + + Replace them all tree-wide. + + Signed-off-by: Pablo Neira Ayuso + +Signed-off-by: Phil Sutter +--- + py/nftables.py | 2 +- + py/setup.py | 2 +- + tests/json_echo/run-test.py | 2 +- + tests/py/nft-test.py | 2 +- + 4 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/py/nftables.py b/py/nftables.py +index 2a0a1e8..f9966d7 100644 +--- a/py/nftables.py ++++ b/py/nftables.py +@@ -1,4 +1,4 @@ +-#!/usr/bin/python ++#!/usr/bin/python3 + # Copyright(C) 2018 Phil Sutter + + # This program is free software; you can redistribute it and/or modify +diff --git a/py/setup.py b/py/setup.py +index 72fc8fd..c3850f5 100755 +--- a/py/setup.py ++++ b/py/setup.py +@@ -1,4 +1,4 @@ +-#!/usr/bin/env python ++#!/usr/bin/env python3 + from distutils.core import setup + from nftables import NFTABLES_VERSION + +diff --git a/tests/json_echo/run-test.py b/tests/json_echo/run-test.py +index a6bdfc6..a990901 100755 +--- a/tests/json_echo/run-test.py ++++ b/tests/json_echo/run-test.py +@@ -1,4 +1,4 @@ +-#!/usr/bin/python ++#!/usr/bin/python3 + + from __future__ import print_function + import sys +diff --git a/tests/py/nft-test.py b/tests/py/nft-test.py +index b66a33c..2b3f28e 100755 +--- a/tests/py/nft-test.py ++++ b/tests/py/nft-test.py +@@ -1,4 +1,4 @@ +-#!/usr/bin/env python ++#!/usr/bin/env python3 + # + # (C) 2014 by Ana Rey Botello + # +-- +2.53.0 + diff --git a/ci.fmf b/ci.fmf new file mode 100644 index 0000000..c5aa0e0 --- /dev/null +++ b/ci.fmf @@ -0,0 +1 @@ +resultsdb-testcase: separate diff --git a/gating.yaml b/gating.yaml index 3d46eeb..9773aea 100644 --- a/gating.yaml +++ b/gating.yaml @@ -1,7 +1,7 @@ +# Gating rhel --- !Policy product_versions: - - rhel-8 + - rhel-* decision_context: osci_compose_gate rules: -# - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional} - - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1-gating.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-gating.functional} diff --git a/nftables.spec b/nftables.spec index c4fcde2..77f6479 100644 --- a/nftables.spec +++ b/nftables.spec @@ -1,5 +1,5 @@ %define nft_rpmversion 1.0.4 -%define nft_specrelease 7 +%define nft_specrelease 8 %define libnftnl_ver 1.2.2-1 Name: nftables @@ -63,6 +63,11 @@ Patch39: 0039-xt-Fall-back-to-generic-printing-from-translation.patch Patch40: 0040-xt-Fix-fallback-printing-for-extensions-matching-key.patch Patch41: 0041-evaluate-un-break-rule-insert-with-intervals.patch Patch42: 0042-xt-Fix-translation-error-path.patch +Patch43: 0043-netlink-handle-invalid-etype-in-set_make_key.patch +Patch44: 0044-expression-cleanup-expr_ops_by_type-and-handle-u32-i.patch +Patch45: 0045-src-netlink-fix-crash-when-ops-doesn-t-support-udata.patch +Patch46: 0046-tests-shell-connect-chains-to-hook-point.patch +Patch47: 0047-Tree-wide-use-of-python3.patch BuildRequires: autoconf BuildRequires: automake @@ -182,6 +187,13 @@ touch -r %{SOURCE2} $RPM_BUILD_ROOT/%{python3_sitelib}/nftables/nftables.py %{python3_sitelib}/nftables/ %changelog +* Fri May 29 2026 Phil Sutter [1.0.4-8.el8] +- Tree-wide use of python3 (Phil Sutter) [RHEL-179874] +- tests: shell: connect chains to hook point (Phil Sutter) [RHEL-179874] +- src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-179599] +- expression: cleanup expr_ops_by_type() and handle u32 input (Phil Sutter) [RHEL-179599] +- netlink: handle invalid etype in set_make_key() (Phil Sutter) [RHEL-179599] + * Fri Nov 29 2024 Phil Sutter [1.0.4-7.el8] - xt: Fix translation error path (Phil Sutter) [RHEL-5806] diff --git a/plans/tier1-gating.fmf b/plans/tier1-gating.fmf new file mode 100644 index 0000000..664a8f7 --- /dev/null +++ b/plans/tier1-gating.fmf @@ -0,0 +1,10 @@ +summary: Internal Tier1-gating beakerlib tests +discover: + how: fmf + url: git://pkgs.devel.redhat.com/tests/nftables + filter: 'tag: CI-gating & tag: -destructive' +execute: + how: tmt +adjust: + enabled: false + when: distro == centos-stream or distro == fedora