[arch-commits] Commit in nftables/repos (6 files)
Christian Hesse
eworm at gemini.archlinux.org
Tue Jun 7 09:28:18 UTC 2022
Date: Tuesday, June 7, 2022 @ 09:28:18
Author: eworm
Revision: 447702
archrelease: copy trunk to testing-x86_64
Added:
nftables/repos/testing-x86_64/
nftables/repos/testing-x86_64/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch
(from rev 447701, nftables/trunk/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch)
nftables/repos/testing-x86_64/PKGBUILD
(from rev 447701, nftables/trunk/PKGBUILD)
nftables/repos/testing-x86_64/nftables.conf
(from rev 447701, nftables/trunk/nftables.conf)
nftables/repos/testing-x86_64/nftables.install
(from rev 447701, nftables/trunk/nftables.install)
nftables/repos/testing-x86_64/nftables.service
(from rev 447701, nftables/trunk/nftables.service)
-----------------------------------------------------------------+
0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch | 106 ++++++++++
PKGBUILD | 64 ++++++
nftables.conf | 27 ++
nftables.install | 10
nftables.service | 12 +
5 files changed, 219 insertions(+)
Copied: nftables/repos/testing-x86_64/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch (from rev 447701, nftables/trunk/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch)
===================================================================
--- testing-x86_64/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch (rev 0)
+++ testing-x86_64/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch 2022-06-07 09:28:18 UTC (rev 447702)
@@ -0,0 +1,106 @@
+From 818f7dded9c9e8a89a2de98801425536180ae307 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo at netfilter.org>
+Date: Wed, 1 Jun 2022 19:09:31 +0200
+Subject: evaluate: reset ctx->set after set interval evaluation
+
+Otherwise bogus error reports on set datatype mismatch might occur, such as:
+
+Error: datatype mismatch, expected Internet protocol, expression has type IPv4 address
+ meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
+ ~~~~~~~~~~~~ ^^^^^^^^^^^^
+
+with an unrelated set declaration.
+
+table ip test {
+ set set_with_interval {
+ type ipv4_addr
+ flags interval
+ }
+
+ chain prerouting {
+ type nat hook prerouting priority dstnat; policy accept;
+ meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
+ }
+}
+
+This bug has been introduced in the evaluation step.
+
+Reported-by: Roman Petrov <nwhisper at gmail.com>
+Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge)"
+Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
+---
+ src/evaluate.c | 10 ++++++----
+ tests/shell/testcases/sets/dumps/set_eval_0.nft | 11 +++++++++++
+ tests/shell/testcases/sets/set_eval_0 | 17 +++++++++++++++++
+ 3 files changed, 34 insertions(+), 4 deletions(-)
+ create mode 100644 tests/shell/testcases/sets/dumps/set_eval_0.nft
+ create mode 100755 tests/shell/testcases/sets/set_eval_0
+
+diff --git a/src/evaluate.c b/src/evaluate.c
+index 1447a4c2..82bf1311 100644
+--- a/src/evaluate.c
++++ b/src/evaluate.c
+@@ -4005,8 +4005,9 @@ static int setelem_evaluate(struct eval_ctx *ctx, struct cmd *cmd)
+ cmd->elem.set = set_get(set);
+
+ if (set_is_interval(ctx->set->flags) &&
+- !(set->flags & NFT_SET_CONCAT))
+- return interval_set_eval(ctx, ctx->set, cmd->expr);
++ !(set->flags & NFT_SET_CONCAT) &&
++ interval_set_eval(ctx, ctx->set, cmd->expr) < 0)
++ return -1;
+
+ ctx->set = NULL;
+
+@@ -4184,8 +4185,9 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
+ }
+
+ if (set_is_interval(ctx->set->flags) &&
+- !(ctx->set->flags & NFT_SET_CONCAT))
+- return interval_set_eval(ctx, ctx->set, set->init);
++ !(ctx->set->flags & NFT_SET_CONCAT) &&
++ interval_set_eval(ctx, ctx->set, set->init) < 0)
++ return -1;
+
+ ctx->set = NULL;
+
+diff --git a/tests/shell/testcases/sets/dumps/set_eval_0.nft b/tests/shell/testcases/sets/dumps/set_eval_0.nft
+new file mode 100644
+index 00000000..a45462b8
+--- /dev/null
++++ b/tests/shell/testcases/sets/dumps/set_eval_0.nft
+@@ -0,0 +1,11 @@
++table ip nat {
++ set set_with_interval {
++ type ipv4_addr
++ flags interval
++ }
++
++ chain prerouting {
++ type nat hook prerouting priority dstnat; policy accept;
++ meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
++ }
++}
+diff --git a/tests/shell/testcases/sets/set_eval_0 b/tests/shell/testcases/sets/set_eval_0
+new file mode 100755
+index 00000000..82b6d3bc
+--- /dev/null
++++ b/tests/shell/testcases/sets/set_eval_0
+@@ -0,0 +1,17 @@
++#!/bin/bash
++
++set -e
++
++RULESET="table ip nat {
++ set set_with_interval {
++ type ipv4_addr
++ flags interval
++ }
++
++ chain prerouting {
++ type nat hook prerouting priority dstnat; policy accept;
++ meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
++ }
++}"
++
++$NFT -f - <<< $RULESET
Copied: nftables/repos/testing-x86_64/PKGBUILD (from rev 447701, nftables/trunk/PKGBUILD)
===================================================================
--- testing-x86_64/PKGBUILD (rev 0)
+++ testing-x86_64/PKGBUILD 2022-06-07 09:28:18 UTC (rev 447702)
@@ -0,0 +1,64 @@
+# Maintainer: Sébastien "Seblu" Luttringer <seblu at archlinux.org>
+
+pkgname=nftables
+epoch=1
+pkgver=1.0.3
+pkgrel=2
+pkgdesc='Netfilter tables userspace tools'
+arch=('x86_64')
+url='https://netfilter.org/projects/nftables/'
+license=('GPL2')
+depends=('libmnl' 'libnftnl' 'gmp' 'readline' 'ncurses' 'jansson')
+optdepends=('python: Python bindings')
+makedepends=('asciidoc' 'python')
+backup=('etc/nftables.conf')
+validpgpkeys=('37D964ACC04981C75500FB9BD55D978A8A1420E4') # Netfilter Core Team
+source=("https://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
+ '0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch'
+ 'nftables.conf'
+ 'nftables.service')
+install=nftables.install
+sha256sums=('47c4eba0105ebd3ffa89553e0702ccb34d8906a91f72ced58ab0d992b29c7748'
+ 'SKIP'
+ '4f02929d20a0cad1e988cef05b29539725142bf0a69cc3ab42cf4010de0a4f54'
+ '2aff88019097d21dbfa4713f5b54c184751c86376e458b683f8d90f3abd232a8'
+ 'deffeef36fe658867dd9203ec13dec85047a6d224ea63334dcf60db97e1809ea')
+
+prepare() {
+ cd $pkgname-$pkgver
+ # apply patch from the source array (should be a pacman feature)
+ local src
+ for src in "${source[@]}"; do
+ src="${src%%::*}"
+ src="${src##*/}"
+ [[ $src = *.patch ]] || continue
+ msg2 "Applying patch $src..."
+ patch -Np1 < "../$src"
+ done
+ :
+}
+
+build() {
+ cd $pkgname-$pkgver
+ autoreconf -fi #FIXME: To remove with 01.patch
+ ./configure \
+ --prefix=/usr \
+ --sbindir=/usr/bin \
+ --sysconfdir=/usr/share \
+ --with-json \
+ --with-cli=readline \
+ --disable-debug
+ make
+}
+
+package() {
+ pushd $pkgname-$pkgver
+ make DESTDIR="$pkgdir" install
+ popd
+ # basic safe firewall config
+ install -Dm644 nftables.conf "$pkgdir/etc/nftables.conf"
+ # systemd
+ install -Dm644 nftables.service "$pkgdir/usr/lib/systemd/system/nftables.service"
+}
+
+# vim:set ts=2 sw=2 et:
Copied: nftables/repos/testing-x86_64/nftables.conf (from rev 447701, nftables/trunk/nftables.conf)
===================================================================
--- testing-x86_64/nftables.conf (rev 0)
+++ testing-x86_64/nftables.conf 2022-06-07 09:28:18 UTC (rev 447702)
@@ -0,0 +1,27 @@
+#!/usr/bin/nft -f
+# vim:set ts=2 sw=2 et:
+
+# IPv4/IPv6 Simple & Safe firewall ruleset.
+# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.
+
+table inet filter
+delete table inet filter
+table inet filter {
+ chain input {
+ type filter hook input priority filter
+ policy drop
+
+ ct state invalid drop comment "early drop of invalid connections"
+ ct state {established, related} accept comment "allow tracked connections"
+ iifname lo accept comment "allow from loopback"
+ ip protocol icmp accept comment "allow icmp"
+ meta l4proto ipv6-icmp accept comment "allow icmp v6"
+ tcp dport ssh accept comment "allow sshd"
+ pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
+ counter
+ }
+ chain forward {
+ type filter hook forward priority filter
+ policy drop
+ }
+}
Copied: nftables/repos/testing-x86_64/nftables.install (from rev 447701, nftables/trunk/nftables.install)
===================================================================
--- testing-x86_64/nftables.install (rev 0)
+++ testing-x86_64/nftables.install 2022-06-07 09:28:18 UTC (rev 447702)
@@ -0,0 +1,10 @@
+## arg 1: the new package version
+## arg 2: the old package version
+post_upgrade() {
+ (( $(vercmp "$2" '1:0.9.9-1') > 0 )) || cat <<EOF
+==> Stopping/restarting the nftables service does NOT flush the ruleset anymore.
+==> The nftables.conf file requires a delete/flush directive to be restarted.
+==> See examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples.
+==> The nftables service reload has been removed as it is now equivalent to a restart.
+EOF
+}
Copied: nftables/repos/testing-x86_64/nftables.service (from rev 447701, nftables/trunk/nftables.service)
===================================================================
--- testing-x86_64/nftables.service (rev 0)
+++ testing-x86_64/nftables.service 2022-06-07 09:28:18 UTC (rev 447702)
@@ -0,0 +1,12 @@
+[Unit]
+Description=Netfilter Tables
+Documentation=man:nft(8)
+Wants=network-pre.target
+Before=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/nft -f /etc/nftables.conf
+
+[Install]
+WantedBy=multi-user.target
More information about the arch-commits
mailing list