[arch-commits] Commit in nftables/trunk (2 files)

[Christian Hesse]

    Date: Tuesday, June 7, 2022 @ 20:52:25
  Author: eworm
Revision: 447737

upgpkg: nftables 1:1.0.4-1: new upstream release

Modified:
  nftables/trunk/PKGBUILD
Deleted:
  nftables/trunk/0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch

-----------------------------------------------------------------+
 0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch |  106 ----------
 PKGBUILD                                                        |    8 
 2 files changed, 3 insertions(+), 111 deletions(-)

Deleted: 0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch
===================================================================
--- 0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch	2022-06-07 20:50:56 UTC (rev 447736)
+++ 0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch	2022-06-07 20:52:25 UTC (rev 447737)
@@ -1,106 +0,0 @@
-From 818f7dded9c9e8a89a2de98801425536180ae307 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo at netfilter.org>
-Date: Wed, 1 Jun 2022 19:09:31 +0200
-Subject: evaluate: reset ctx->set after set interval evaluation
-
-Otherwise bogus error reports on set datatype mismatch might occur, such as:
-
-Error: datatype mismatch, expected Internet protocol, expression has type IPv4 address
-    meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
-    ~~~~~~~~~~~~ ^^^^^^^^^^^^
-
-with an unrelated set declaration.
-
-table ip test {
-       set set_with_interval {
-               type ipv4_addr
-               flags interval
-       }
-
-       chain prerouting {
-               type nat hook prerouting priority dstnat; policy accept;
-               meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
-       }
-}
-
-This bug has been introduced in the evaluation step.
-
-Reported-by: Roman Petrov <nwhisper at gmail.com>
-Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge)"
-Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
----
- src/evaluate.c                                  | 10 ++++++----
- tests/shell/testcases/sets/dumps/set_eval_0.nft | 11 +++++++++++
- tests/shell/testcases/sets/set_eval_0           | 17 +++++++++++++++++
- 3 files changed, 34 insertions(+), 4 deletions(-)
- create mode 100644 tests/shell/testcases/sets/dumps/set_eval_0.nft
- create mode 100755 tests/shell/testcases/sets/set_eval_0
-
-diff --git a/src/evaluate.c b/src/evaluate.c
-index 1447a4c2..82bf1311 100644
---- a/src/evaluate.c
-+++ b/src/evaluate.c
-@@ -4005,8 +4005,9 @@ static int setelem_evaluate(struct eval_ctx *ctx, struct cmd *cmd)
- 	cmd->elem.set = set_get(set);
- 
- 	if (set_is_interval(ctx->set->flags) &&
--	    !(set->flags & NFT_SET_CONCAT))
--		return interval_set_eval(ctx, ctx->set, cmd->expr);
-+	    !(set->flags & NFT_SET_CONCAT) &&
-+	    interval_set_eval(ctx, ctx->set, cmd->expr) < 0)
-+		return -1;
- 
- 	ctx->set = NULL;
- 
-@@ -4184,8 +4185,9 @@ static int set_evaluate(struct eval_ctx *ctx, struct set *set)
- 	}
- 
- 	if (set_is_interval(ctx->set->flags) &&
--	    !(ctx->set->flags & NFT_SET_CONCAT))
--		return interval_set_eval(ctx, ctx->set, set->init);
-+	    !(ctx->set->flags & NFT_SET_CONCAT) &&
-+	    interval_set_eval(ctx, ctx->set, set->init) < 0)
-+		return -1;
- 
- 	ctx->set = NULL;
- 
-diff --git a/tests/shell/testcases/sets/dumps/set_eval_0.nft b/tests/shell/testcases/sets/dumps/set_eval_0.nft
-new file mode 100644
-index 00000000..a45462b8
---- /dev/null
-+++ b/tests/shell/testcases/sets/dumps/set_eval_0.nft
-@@ -0,0 +1,11 @@
-+table ip nat {
-+	set set_with_interval {
-+		type ipv4_addr
-+		flags interval
-+	}
-+
-+	chain prerouting {
-+		type nat hook prerouting priority dstnat; policy accept;
-+		meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
-+	}
-+}
-diff --git a/tests/shell/testcases/sets/set_eval_0 b/tests/shell/testcases/sets/set_eval_0
-new file mode 100755
-index 00000000..82b6d3bc
---- /dev/null
-+++ b/tests/shell/testcases/sets/set_eval_0
-@@ -0,0 +1,17 @@
-+#!/bin/bash
-+
-+set -e
-+
-+RULESET="table ip nat {
-+        set set_with_interval {
-+                type ipv4_addr
-+                flags interval
-+        }
-+
-+        chain prerouting {
-+                type nat hook prerouting priority dstnat; policy accept;
-+                meta l4proto { tcp, udp } th dport 443 dnat to 10.0.0.1
-+        }
-+}"
-+
-+$NFT -f - <<< $RULESET

Modified: PKGBUILD
===================================================================
--- PKGBUILD	2022-06-07 20:50:56 UTC (rev 447736)
+++ PKGBUILD	2022-06-07 20:52:25 UTC (rev 447737)
@@ -2,8 +2,8 @@
 
 pkgname=nftables
 epoch=1
-pkgver=1.0.3
-pkgrel=2
+pkgver=1.0.4
+pkgrel=1
 pkgdesc='Netfilter tables userspace tools'
 arch=('x86_64')
 url='https://netfilter.org/projects/nftables/'
@@ -14,13 +14,11 @@
 backup=('etc/nftables.conf')
 validpgpkeys=('37D964ACC04981C75500FB9BD55D978A8A1420E4') # Netfilter Core Team
 source=("https://netfilter.org/projects/nftables/files/nftables-$pkgver.tar.bz2"{,.sig}
-        '0001-evaluate-reset-ctx-set-after-set-interval-evaluation.patch'
         'nftables.conf'
         'nftables.service')
 install=nftables.install
-sha256sums=('47c4eba0105ebd3ffa89553e0702ccb34d8906a91f72ced58ab0d992b29c7748'
+sha256sums=('927fb1fea1f685a328c10cf791eb655d7e1ed49d310eea5cb3101dfd8d6cba35'
             'SKIP'
-            '4f02929d20a0cad1e988cef05b29539725142bf0a69cc3ab42cf4010de0a4f54'
             '2aff88019097d21dbfa4713f5b54c184751c86376e458b683f8d90f3abd232a8'
             'deffeef36fe658867dd9203ec13dec85047a6d224ea63334dcf60db97e1809ea')