[arch-commits] Commit in nftables/repos (12 files)

Bartłomiej Piotrowski bpiotrowski at archlinux.org
Mon Nov 7 17:40:04 UTC 2016


    Date: Monday, November 7, 2016 @ 17:40:03
  Author: bpiotrowski
Revision: 280058

archrelease: copy trunk to staging-i686, staging-x86_64

Added:
  nftables/repos/staging-i686/
  nftables/repos/staging-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch
    (from rev 280057, nftables/trunk/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch)
  nftables/repos/staging-i686/PKGBUILD
    (from rev 280057, nftables/trunk/PKGBUILD)
  nftables/repos/staging-i686/nftables-reload
    (from rev 280057, nftables/trunk/nftables-reload)
  nftables/repos/staging-i686/nftables.conf
    (from rev 280057, nftables/trunk/nftables.conf)
  nftables/repos/staging-i686/nftables.service
    (from rev 280057, nftables/trunk/nftables.service)
  nftables/repos/staging-x86_64/
  nftables/repos/staging-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch
    (from rev 280057, nftables/trunk/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch)
  nftables/repos/staging-x86_64/PKGBUILD
    (from rev 280057, nftables/trunk/PKGBUILD)
  nftables/repos/staging-x86_64/nftables-reload
    (from rev 280057, nftables/trunk/nftables-reload)
  nftables/repos/staging-x86_64/nftables.conf
    (from rev 280057, nftables/trunk/nftables.conf)
  nftables/repos/staging-x86_64/nftables.service
    (from rev 280057, nftables/trunk/nftables.service)

------------------------------------------------------------------------------+
 staging-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch   |  108 ++++++++++
 staging-i686/PKGBUILD                                                        |   63 +++++
 staging-i686/nftables-reload                                                 |    3 
 staging-i686/nftables.conf                                                   |   38 +++
 staging-i686/nftables.service                                                |   15 +
 staging-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch |  108 ++++++++++
 staging-x86_64/PKGBUILD                                                      |   63 +++++
 staging-x86_64/nftables-reload                                               |    3 
 staging-x86_64/nftables.conf                                                 |   38 +++
 staging-x86_64/nftables.service                                              |   15 +
 10 files changed, 454 insertions(+)

Copied: nftables/repos/staging-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch (from rev 280057, nftables/trunk/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch)
===================================================================
--- staging-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch	                        (rev 0)
+++ staging-i686/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,108 @@
+From 3503738f77cdbe521da1054a37f59ac2e442b4cf Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw at strlen.de>
+Date: Mon, 6 Jun 2016 21:52:28 +0200
+Subject: [PATCH 2/7] payload: don't update protocol context if we can't find a
+ description
+
+Since commit
+20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
+we deref null pointer if we can't find a description for the desired
+protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
+(tcp, udp) works.
+
+Also add a test case for this.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
+Signed-off-by: Florian Westphal <fw at strlen.de>
+Acked-by: Pablo Neira Ayuso <pablo at netfilter.org>
+---
+ src/payload.c                   | 3 +++
+ tests/py/ip/ip.t                | 3 +++
+ tests/py/ip/ip.t.payload        | 5 +++++
+ tests/py/ip/ip.t.payload.inet   | 7 +++++++
+ tests/py/ip/ip.t.payload.netdev | 7 +++++++
+ 5 files changed, 25 insertions(+)
+
+diff --git a/src/payload.c b/src/payload.c
+index ac0e917..9ba980a 100644
+--- a/src/payload.c
++++ b/src/payload.c
+@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
+ 	base = ctx->protocol[left->payload.base].desc;
+ 	desc = proto_find_upper(base, proto);
+ 
++	if (!desc)
++		return;
++
+ 	assert(desc->base <= PROTO_BASE_MAX);
+ 	if (desc->base == base->base) {
+ 		assert(base->length > 0);
+diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
+index 594136c..a265b75 100644
+--- a/tests/py/ip/ip.t
++++ b/tests/py/ip/ip.t
+@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
+ ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
+ - ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
+ 
++ip protocol 255;ok
++ip protocol 256;fail
++
+ ip checksum 13172 drop;ok
+ ip checksum 22;ok
+ ip checksum != 233;ok
+diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
+index 3bd3358..15cc590 100644
+--- a/tests/py/ip/ip.t.payload
++++ b/tests/py/ip/ip.t.payload
+@@ -204,6 +204,11 @@ ip test-ip4 input
+   [ lookup reg 1 set __set%d ]
+   [ immediate reg 0 accept ]
+ 
++# ip protocol 255
++ip test-ip4 input
++  [ payload load 1b @ network header + 9 => reg 1 ]
++  [ cmp eq reg 1 0x000000ff ]
++
+ # ip checksum 13172 drop
+ ip test-ip4 input
+   [ payload load 2b @ network header + 10 => reg 1 ]
+diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
+index ef4692e..e495246 100644
+--- a/tests/py/ip/ip.t.payload.inet
++++ b/tests/py/ip/ip.t.payload.inet
+@@ -268,6 +268,13 @@ inet test-inet input
+   [ lookup reg 1 set __set%d ]
+   [ immediate reg 0 accept ]
+ 
++# ip protocol 255
++ip test-ip4 input
++  [ meta load nfproto => reg 1 ]
++  [ cmp eq reg 1 0x00000002 ]
++  [ payload load 1b @ network header + 9 => reg 1 ]
++  [ cmp eq reg 1 0x000000ff ]
++
+ # ip checksum 13172 drop
+ inet test-inet input
+   [ meta load nfproto => reg 1 ]
+diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
+index 4feaa27..8eaee4c 100644
+--- a/tests/py/ip/ip.t.payload.netdev
++++ b/tests/py/ip/ip.t.payload.netdev
+@@ -204,6 +204,13 @@ netdev test-netdev ingress
+   [ lookup reg 1 set __set%d ]
+   [ immediate reg 0 accept ]
+ 
++# ip protocol 255
++ip test-ip4 input
++  [ meta load protocol => reg 1 ]
++  [ cmp eq reg 1 0x00000008 ]
++  [ payload load 1b @ network header + 9 => reg 1 ]
++  [ cmp eq reg 1 0x000000ff ]
++
+ # ip checksum 13172 drop
+ netdev test-netdev ingress 
+   [ meta load protocol => reg 1 ]
+-- 
+2.8.3
+

Copied: nftables/repos/staging-i686/PKGBUILD (from rev 280057, nftables/trunk/PKGBUILD)
===================================================================
--- staging-i686/PKGBUILD	                        (rev 0)
+++ staging-i686/PKGBUILD	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,63 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.6
+pkgrel=3
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+        '01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch'
+        'nftables.conf'
+        'nftables.service'
+        'nftables-reload')
+sha1sums=('c0f90a208e0ab5d43d3e638350a4fe58e6f4366f'
+          'SKIP'
+          'c2f79f151a57ba6888d325f2573a6a0269830e9b'
+          'a7146fad414f9e827e2e83b630308890c876b80d'
+          '65833b9c5b777cfb3a0776060c569a727ce6f460'
+          'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+  cd $pkgname-$pkgver
+  # apply patch from the source array (should be a pacman feature)
+  local filename
+  for filename in "${source[@]}"; do
+    if [[ "$filename" =~ \.patch$ ]]; then
+      msg2 "Applying patch ${filename##*/}"
+      patch -p1 -N -i "$srcdir/${filename##*/}"
+    fi
+  done
+  :
+}
+
+build() {
+  cd $pkgname-$pkgver
+  ./configure \
+    --prefix=/usr \
+    --sbindir=/usr/bin \
+    --sysconfdir=/usr/share \
+    CONFIG_MAN=y DB2MAN=docbook2man
+  make
+}
+
+package() {
+  pushd $pkgname-$pkgver
+  make DESTDIR="$pkgdir" install
+  popd
+  # basic safe firewall config
+  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+  # systemd
+  install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+  install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:

Copied: nftables/repos/staging-i686/nftables-reload (from rev 280057, nftables/trunk/nftables-reload)
===================================================================
--- staging-i686/nftables-reload	                        (rev 0)
+++ staging-i686/nftables-reload	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"

Copied: nftables/repos/staging-i686/nftables.conf (from rev 280057, nftables/trunk/nftables.conf)
===================================================================
--- staging-i686/nftables.conf	                        (rev 0)
+++ staging-i686/nftables.conf	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0;
+
+    # allow established/related connections
+    ct state {established, related} accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # everything else
+    reject with icmp type port-unreachable
+  }
+  chain forward {
+    type filter hook forward priority 0;
+    drop
+  }
+  chain output {
+    type filter hook output priority 0;
+  }
+
+}
+
+# vim:set ts=2 sw=2 et:

Copied: nftables/repos/staging-i686/nftables.service (from rev 280057, nftables/trunk/nftables.service)
===================================================================
--- staging-i686/nftables.service	                        (rev 0)
+++ staging-i686/nftables.service	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

Copied: nftables/repos/staging-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch (from rev 280057, nftables/trunk/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch)
===================================================================
--- staging-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch	                        (rev 0)
+++ staging-x86_64/01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,108 @@
+From 3503738f77cdbe521da1054a37f59ac2e442b4cf Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw at strlen.de>
+Date: Mon, 6 Jun 2016 21:52:28 +0200
+Subject: [PATCH 2/7] payload: don't update protocol context if we can't find a
+ description
+
+Since commit
+20b1131c07acd2fc ("payload: fix stacked headers protocol context tracking")
+we deref null pointer if we can't find a description for the desired
+protocol, so "ip protocol 254" crashes while testing protocols 6 or 17
+(tcp, udp) works.
+
+Also add a test case for this.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1072
+Signed-off-by: Florian Westphal <fw at strlen.de>
+Acked-by: Pablo Neira Ayuso <pablo at netfilter.org>
+---
+ src/payload.c                   | 3 +++
+ tests/py/ip/ip.t                | 3 +++
+ tests/py/ip/ip.t.payload        | 5 +++++
+ tests/py/ip/ip.t.payload.inet   | 7 +++++++
+ tests/py/ip/ip.t.payload.netdev | 7 +++++++
+ 5 files changed, 25 insertions(+)
+
+diff --git a/src/payload.c b/src/payload.c
+index ac0e917..9ba980a 100644
+--- a/src/payload.c
++++ b/src/payload.c
+@@ -85,6 +85,9 @@ static void payload_expr_pctx_update(struct proto_ctx *ctx,
+ 	base = ctx->protocol[left->payload.base].desc;
+ 	desc = proto_find_upper(base, proto);
+ 
++	if (!desc)
++		return;
++
+ 	assert(desc->base <= PROTO_BASE_MAX);
+ 	if (desc->base == base->base) {
+ 		assert(base->length > 0);
+diff --git a/tests/py/ip/ip.t b/tests/py/ip/ip.t
+index 594136c..a265b75 100644
+--- a/tests/py/ip/ip.t
++++ b/tests/py/ip/ip.t
+@@ -75,6 +75,9 @@ ip protocol != tcp;ok;ip protocol != 6
+ ip protocol { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok;ip protocol { 33, 136, 17, 51, 50, 6, 132, 1, 108} accept
+ - ip protocol != { icmp, esp, ah, comp, udp, udplite, tcp, dccp, sctp} accept;ok
+ 
++ip protocol 255;ok
++ip protocol 256;fail
++
+ ip checksum 13172 drop;ok
+ ip checksum 22;ok
+ ip checksum != 233;ok
+diff --git a/tests/py/ip/ip.t.payload b/tests/py/ip/ip.t.payload
+index 3bd3358..15cc590 100644
+--- a/tests/py/ip/ip.t.payload
++++ b/tests/py/ip/ip.t.payload
+@@ -204,6 +204,11 @@ ip test-ip4 input
+   [ lookup reg 1 set __set%d ]
+   [ immediate reg 0 accept ]
+ 
++# ip protocol 255
++ip test-ip4 input
++  [ payload load 1b @ network header + 9 => reg 1 ]
++  [ cmp eq reg 1 0x000000ff ]
++
+ # ip checksum 13172 drop
+ ip test-ip4 input
+   [ payload load 2b @ network header + 10 => reg 1 ]
+diff --git a/tests/py/ip/ip.t.payload.inet b/tests/py/ip/ip.t.payload.inet
+index ef4692e..e495246 100644
+--- a/tests/py/ip/ip.t.payload.inet
++++ b/tests/py/ip/ip.t.payload.inet
+@@ -268,6 +268,13 @@ inet test-inet input
+   [ lookup reg 1 set __set%d ]
+   [ immediate reg 0 accept ]
+ 
++# ip protocol 255
++ip test-ip4 input
++  [ meta load nfproto => reg 1 ]
++  [ cmp eq reg 1 0x00000002 ]
++  [ payload load 1b @ network header + 9 => reg 1 ]
++  [ cmp eq reg 1 0x000000ff ]
++
+ # ip checksum 13172 drop
+ inet test-inet input
+   [ meta load nfproto => reg 1 ]
+diff --git a/tests/py/ip/ip.t.payload.netdev b/tests/py/ip/ip.t.payload.netdev
+index 4feaa27..8eaee4c 100644
+--- a/tests/py/ip/ip.t.payload.netdev
++++ b/tests/py/ip/ip.t.payload.netdev
+@@ -204,6 +204,13 @@ netdev test-netdev ingress
+   [ lookup reg 1 set __set%d ]
+   [ immediate reg 0 accept ]
+ 
++# ip protocol 255
++ip test-ip4 input
++  [ meta load protocol => reg 1 ]
++  [ cmp eq reg 1 0x00000008 ]
++  [ payload load 1b @ network header + 9 => reg 1 ]
++  [ cmp eq reg 1 0x000000ff ]
++
+ # ip checksum 13172 drop
+ netdev test-netdev ingress 
+   [ meta load protocol => reg 1 ]
+-- 
+2.8.3
+

Copied: nftables/repos/staging-x86_64/PKGBUILD (from rev 280057, nftables/trunk/PKGBUILD)
===================================================================
--- staging-x86_64/PKGBUILD	                        (rev 0)
+++ staging-x86_64/PKGBUILD	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,63 @@
+# $Id$
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=0.6
+pkgrel=3
+pkgdesc='Netfilter tables userspace tools'
+arch=('i686' 'x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses')
+makedepends=('docbook2x')
+backup=('etc/nftables.conf')
+validpgpkeys=('C09DB2063F1D7034BA6152ADAB4655A126D292E4') # Netfilter Core Team
+# 2016-11-03: https sources download is broken with curl
+source=("http://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+        '01-payload-don-t-update-protocol-context-if-we-can-t-fi.patch'
+        'nftables.conf'
+        'nftables.service'
+        'nftables-reload')
+sha1sums=('c0f90a208e0ab5d43d3e638350a4fe58e6f4366f'
+          'SKIP'
+          'c2f79f151a57ba6888d325f2573a6a0269830e9b'
+          'a7146fad414f9e827e2e83b630308890c876b80d'
+          '65833b9c5b777cfb3a0776060c569a727ce6f460'
+          'd9f40e751b44dd9dc9fdb3b7eba3cc0a9b7e1b01')
+
+prepare() {
+  cd $pkgname-$pkgver
+  # apply patch from the source array (should be a pacman feature)
+  local filename
+  for filename in "${source[@]}"; do
+    if [[ "$filename" =~ \.patch$ ]]; then
+      msg2 "Applying patch ${filename##*/}"
+      patch -p1 -N -i "$srcdir/${filename##*/}"
+    fi
+  done
+  :
+}
+
+build() {
+  cd $pkgname-$pkgver
+  ./configure \
+    --prefix=/usr \
+    --sbindir=/usr/bin \
+    --sysconfdir=/usr/share \
+    CONFIG_MAN=y DB2MAN=docbook2man
+  make
+}
+
+package() {
+  pushd $pkgname-$pkgver
+  make DESTDIR="$pkgdir" install
+  popd
+  # basic safe firewall config
+  install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+  # systemd
+  install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+  install -Dm755 nftables-reload "$pkgdir/usr/lib/systemd/scripts/nftables-reload"
+}
+
+# vim:set ts=2 sw=2 et:

Copied: nftables/repos/staging-x86_64/nftables-reload (from rev 280057, nftables/trunk/nftables-reload)
===================================================================
--- staging-x86_64/nftables-reload	                        (rev 0)
+++ staging-x86_64/nftables-reload	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,3 @@
+#!/usr/bin/nft -f
+flush ruleset
+include "/etc/nftables.conf"

Copied: nftables/repos/staging-x86_64/nftables.conf (from rev 280057, nftables/trunk/nftables.conf)
===================================================================
--- staging-x86_64/nftables.conf	                        (rev 0)
+++ staging-x86_64/nftables.conf	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,38 @@
+#!/usr/bin/nft -f
+# ipv4/ipv6 Simple & Safe Firewall
+# you can find examples in /usr/share/nftables/
+
+table inet filter {
+  chain input {
+    type filter hook input priority 0;
+
+    # allow established/related connections
+    ct state {established, related} accept
+
+    # early drop of invalid connections
+    ct state invalid drop
+
+    # allow from loopback
+    iifname lo accept
+
+    # allow icmp
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+
+    # allow ssh
+    tcp dport ssh accept
+
+    # everything else
+    reject with icmp type port-unreachable
+  }
+  chain forward {
+    type filter hook forward priority 0;
+    drop
+  }
+  chain output {
+    type filter hook output priority 0;
+  }
+
+}
+
+# vim:set ts=2 sw=2 et:

Copied: nftables/repos/staging-x86_64/nftables.service (from rev 280057, nftables/trunk/nftables.service)
===================================================================
--- staging-x86_64/nftables.service	                        (rev 0)
+++ staging-x86_64/nftables.service	2016-11-07 17:40:03 UTC (rev 280058)
@@ -0,0 +1,15 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+ExecReload=/usr/bin/nft -f /usr/lib/systemd/scripts/nftables-reload
+ExecStop=/usr/bin/nft flush ruleset
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target



More information about the arch-commits mailing list