diff --git a/CVE-2019-11360.patch b/CVE-2019-11360.patch deleted file mode 100644 index 782cde8d37a6341ba55c746336486dee0de38dd9..0000000000000000000000000000000000000000 --- a/CVE-2019-11360.patch +++ /dev/null @@ -1,113 +0,0 @@ -From da800103668f256f11d88851fa9ea9faf298b760 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Mon, 22 Apr 2019 23:17:27 +0200 -Subject: [PATCH] xshared: check for maximum buffer length in - add_param_to_argv() - -Bail out if we go over the boundary, based on patch from Sebastian. - -Reported-by: Sebastian Neef -Signed-off-by: Pablo Neira Ayuso ---- - iptables/xshared.c | 46 ++++++++++++++++++++++++++++------------------ - 1 file changed, 28 insertions(+), 18 deletions(-) - -diff --git a/iptables/xshared.c b/iptables/xshared.c -index b16f5fa..b0ca8e6 100644 ---- a/iptables/xshared.c -+++ b/iptables/xshared.c -@@ -433,10 +433,24 @@ void save_argv(void) - } - } - -+struct xt_param_buf { -+ char buffer[1024]; -+ int len; -+}; -+ -+static void add_param(struct xt_param_buf *param, const char *curchar) -+{ -+ param->buffer[param->len++] = *curchar; -+ if (param->len >= sizeof(param->buffer)) -+ xtables_error(PARAMETER_PROBLEM, -+ "Parameter too long!"); -+} -+ - void add_param_to_argv(char *parsestart, int line) - { -- int quote_open = 0, escaped = 0, param_len = 0; -- char param_buffer[1024], *curchar; -+ int quote_open = 0, escaped = 0; -+ struct xt_param_buf param = {}; -+ char *curchar; - - /* After fighting with strtok enough, here's now - * a 'real' parser. According to Rusty I'm now no -@@ -445,7 +459,7 @@ void add_param_to_argv(char *parsestart, int line) - for (curchar = parsestart; *curchar; curchar++) { - if (quote_open) { - if (escaped) { -- param_buffer[param_len++] = *curchar; -+ add_param(¶m, curchar); - escaped = 0; - continue; - } else if (*curchar == '\\') { -@@ -455,7 +469,7 @@ void add_param_to_argv(char *parsestart, int line) - quote_open = 0; - *curchar = '"'; - } else { -- param_buffer[param_len++] = *curchar; -+ add_param(¶m, curchar); - continue; - } - } else { -@@ -471,36 +485,32 @@ void add_param_to_argv(char *parsestart, int line) - case ' ': - case '\t': - case '\n': -- if (!param_len) { -+ if (!param.len) { - /* two spaces? */ - continue; - } - break; - default: - /* regular character, copy to buffer */ -- param_buffer[param_len++] = *curchar; -- -- if (param_len >= sizeof(param_buffer)) -- xtables_error(PARAMETER_PROBLEM, -- "Parameter too long!"); -+ add_param(¶m, curchar); - continue; - } - -- param_buffer[param_len] = '\0'; -+ param.buffer[param.len] = '\0'; - - /* check if table name specified */ -- if ((param_buffer[0] == '-' && -- param_buffer[1] != '-' && -- strchr(param_buffer, 't')) || -- (!strncmp(param_buffer, "--t", 3) && -- !strncmp(param_buffer, "--table", strlen(param_buffer)))) { -+ if ((param.buffer[0] == '-' && -+ param.buffer[1] != '-' && -+ strchr(param.buffer, 't')) || -+ (!strncmp(param.buffer, "--t", 3) && -+ !strncmp(param.buffer, "--table", strlen(param.buffer)))) { - xtables_error(PARAMETER_PROBLEM, - "The -t option (seen in line %u) cannot be used in %s.\n", - line, xt_params->program_name); - } - -- add_argv(param_buffer, 0); -- param_len = 0; -+ add_argv(param.buffer, 0); -+ param.len = 0; - } - } - --- -1.8.3.1 - diff --git a/iptables-1.8.1.tar.bz2 b/iptables-1.8.1.tar.bz2 deleted file mode 100644 index c93c714a9086c0001863ea755f4fbea725624d5c..0000000000000000000000000000000000000000 Binary files a/iptables-1.8.1.tar.bz2 and /dev/null differ diff --git a/iptables-1.8.4.tar.bz2 b/iptables-1.8.4.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..e95fb7a24cada577d192cf565eefb51d273a99f1 Binary files /dev/null and b/iptables-1.8.4.tar.bz2 differ diff --git a/iptables.init b/iptables.init index 8f74bb3f082d54c402ec045a80b6ccaf5936594c..ceb6bbe64590ece1fd2471950da34b75d0170a31 100644 --- a/iptables.init +++ b/iptables.init @@ -18,8 +18,21 @@ # Description: Start, stop and save iptables firewall ### END INIT INFO -# Source function library. -. /etc/init.d/functions +# compat for removed initscripts dependency +success() { + echo -n "[ OK ]" + return 0 +} + +warning() { + echo -n "[WARNING]" + return 1 +} + +failure() { + echo -n "[FAILED]" + return 1 +} IPTABLES=iptables IPTABLES_DATA=/etc/sysconfig/$IPTABLES diff --git a/iptables.spec b/iptables.spec index 795e8e1bbe2c3b76ee762be3c830302b887ab607..ef1d803c8b657858afdc836517da3e63db0854fe 100644 --- a/iptables.spec +++ b/iptables.spec @@ -1,8 +1,8 @@ %global script_path %{_libexecdir}/iptables %global legacy_actions %{_libexecdir}/initscripts/legacy-actions Name: iptables -Version: 1.8.1 -Release: 5 +Version: 1.8.4 +Release: 4 Summary: IP packet filter administration utilities License: GPLv2 and Artistic Licence 2.0 and ISC URL: https://www.netfilter.org/ @@ -13,11 +13,11 @@ Source3: iptables.service Source4: sysconfig_iptables Source5: sysconfig_ip6tables -Patch1: iptables-apply-Use-mktemp-instead-of-tempfile.patch -Patch2: CVE-2019-11360.patch +Patch1: iptables-apply-Use-mktemp-instead-of-tempfile.patch BuildRequires: bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd git BuildRequires: libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel +BuildRequires: autogen autoconf automake libtool iptables Requires: %{name}-libs = %{version}-%{release} @@ -68,6 +68,7 @@ Nft package for iproute. %autosetup -n %{name}-%{version} -p1 -S git %build +./autogen.sh %configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr %disable_rpath @@ -130,16 +131,14 @@ install -m 0755 -c ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6table install -m 0755 iptables/iptables-apply %{buildroot}%{_sbindir} install -m 0755 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8 -pushd %{buildroot}%{_sbindir} -mv ebtables ebtables-nft -mv arptables arptables-nft +touch %{buildroot}%{_libexecdir}/arptables-helper -touch ebtables \ - arptables \ - iptables \ - ip6tables -popd +touch %{buildroot}%{_mandir}/man8/arptables.8 +touch %{buildroot}%{_mandir}/man8/arptables-save.8 +touch %{buildroot}%{_mandir}/man8/arptables-restore.8 +touch %{buildroot}%{_mandir}/man8/ebtables.8 +cp -a %{_libdir}/libip*tc.so.0.* %{buildroot}%{_libdir} %ldconfig_scriptlets %post @@ -170,20 +169,51 @@ fi pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables %{_sbindir}/update-alternatives --install \ - $pfx iptables $pfx-nft 5 \ + $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ --slave $pfx-restore iptables-restore $pfx-nft-restore \ --slave $pfx-save iptables-save $pfx-nft-save \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -for cmd in ebtables arptables; do - if [ "$(readlink -e %{_sbindir}/$cmd)" == %{_sbindir}/$cmd ]; then - rm -f %{_sbindir}/$cmd +pfx=%{_sbindir}/ebtables +manpfx=%{_mandir}/man8/ebtables +for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx fi - %{_sbindir}/update-alternatives --install \ - %{_sbindir}/$cmd $cmd %{_sbindir}/$cmd-nft 5 done +if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then + rm -f $manpfx.8.gz +fi +%{_sbindir}/update-alternatives --install \ + $pfx ebtables $pfx-nft 10 \ + --slave $pfx-save ebtables-save $pfx-nft-save \ + --slave $pfx-restore ebtables-restore $pfx-nft-restore \ + --slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz + +pfx=%{_sbindir}/arptables +manpfx=%{_mandir}/man8/arptables +lepfx=%{_libexecdir}/arptables +for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then + rm -f $manpfx$sfx.8.gz + fi +done +if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then + rm -f $lepfx-helper +fi +%{_sbindir}/update-alternatives --install \ + $pfx arptables $pfx-nft 10 \ + --slave $pfx-save arptables-save $pfx-nft-save \ + --slave $pfx-restore arptables-restore $pfx-nft-restore \ + --slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \ + --slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \ + --slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \ + --slave $lepfx-helper arptables-helper $lepfx-nft-helper %postun nft if [ $1 -eq 0 ]; then @@ -208,7 +238,6 @@ fi %exclude %{_sbindir}/*-translate %exclude %{_sbindir}/xtables-monitor %{_bindir}/iptables-xml -%{_libdir}/xtables/* %{_unitdir}/*.service %dir %{legacy_actions} %{legacy_actions}/ip* @@ -221,6 +250,11 @@ fi %defattr(-,root,root) %{_libdir}/libip*tc.so.* %{_libdir}/libxtables.so.* +%{_libdir}/libxtables.so.12* +%dir %{_libdir}/xtables +%{_libdir}/xtables/libipt* +%{_libdir}/xtables/libip6t* +%{_libdir}/xtables/libxt* %files devel %defattr(-,root,root) @@ -230,29 +264,76 @@ fi %files nft %defattr(-,root,root) -%{_sbindir}/*-nft* -%{_sbindir}/*-translate +%{_sbindir}/iptables-nft* +%{_sbindir}/iptables-restore-translate +%{_sbindir}/iptables-translate +%{_sbindir}/ip6tables-nft* +%{_sbindir}/ip6tables-restore-translate +%{_sbindir}/ip6tables-translate +%{_sbindir}/ebtables-nft* +%{_sbindir}/arptables-nft* +%{_sbindir}/xtables-nft-multi %{_sbindir}/xtables-monitor -%ghost %{_sbindir}/ip*tables -%ghost %{_sbindir}/ip*tables-restore -%ghost %{_sbindir}/ip*tables-save +%dir %{_libdir}/xtables +%{_libdir}/xtables/libarpt* +%{_libdir}/xtables/libebt* +%ghost %{_sbindir}/iptables +%ghost %{_sbindir}/iptables-restore +%ghost %{_sbindir}/iptables-save +%ghost %{_sbindir}/ip6tables +%ghost %{_sbindir}/ip6tables-restore +%ghost %{_sbindir}/ip6tables-save %ghost %{_sbindir}/ebtables %ghost %{_sbindir}/ebtables-save %ghost %{_sbindir}/ebtables-restore %ghost %{_sbindir}/arptables %ghost %{_sbindir}/arptables-save %ghost %{_sbindir}/arptables-restore +%ghost %{_libexecdir}/arptables-helper %files help %defattr(-,root,root) %doc INCOMPATIBILITIES -%{_mandir}/* +%ghost %{_mandir}/man8/arptables.8.gz +%ghost %{_mandir}/man8/arptables-save.8.gz +%ghost %{_mandir}/man8/arptables-restore.8.gz +%ghost %{_mandir}/man8/ebtables.8.gz +%{_mandir}/man8/xtables-monitor* +%{_mandir}/man8/xtables-translate* +%{_mandir}/man8/*-nft* +%{_mandir}/man8/nfnl_osf* +%{_mandir}/man8/nfbpf_compile* +%{_mandir}/man1/iptables-xml* +%{_mandir}/man8/iptables* +%{_mandir}/man8/ip6tables* +%{_mandir}/man8/xtables-legacy* %changelog -* Thu Apr 16 2020 chenzhen - 1.8.1-5 +* Wed May 6 2020 zhouxudong - 1.8.4-4 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: solve conflicts with arptables-help ebtables-help + +* Mon Apr 20 2020 zhouxudong - 1.8.4-3 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: add libip*tc.so.0.* to libs + +* Mon Apr 20 2020 zhouxudong - 1.8.4-2 +- Type: bugfix +- ID: NA +- SUG: NA +- DESC: fix build for iprout + +* Thu Apr 16 2020 zhouxudong - 1.8.4-1 +- Pakcage update t0 1.8.4 + +* Fri Mar 27 2020 zengweifeng - 1.8.1-5 - Type:cves - ID:CVE-2019-11360 -- SUG:restart +- SUG:NA - DESC:fix CVE-2019-11360 * Sat Jan 18 2020 openEuler Buildteam - 1.8.1-4 @@ -275,3 +356,4 @@ fi * Fri Sep 20 2019 openEuler Buildteam - 1.8.0-5 - Package init +