diff --git a/backport-extensions-recent-Fix-format-string-for-unsigned-values.patch b/backport-extensions-recent-Fix-format-string-for-unsigned-values.patch new file mode 100644 index 0000000000000000000000000000000000000000..4102aae0f3bd097c331782a4638588d4a364366f --- /dev/null +++ b/backport-extensions-recent-Fix-format-string-for-unsigned-values.patch @@ -0,0 +1,56 @@ +From 8696f659eadd58505469841a3af16ad2c830e8e5 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Thu, 20 Jun 2024 18:17:16 +0200 +Subject: extensions: recent: Fix format string for unsigned values + +Both fields 'seconds' and 'hit_count' are unsigned, use '%u' +accordingly. While being at it, also fix coding-style in those lines. + +Basically a day-1 bug, have Fixes: point at a reasonably old commit. + +Fixes: af1660fe0e88c ("Move libipt_recent to libxt_recent") +Signed-off-by: Phil Sutter + +Conflict:NA +Reference:https://git.netfilter.org/iptables/commit/?id=8696f659eadd58505469841a3af16ad2c830e8e5 +--- + extensions/libxt_recent.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/extensions/libxt_recent.c b/extensions/libxt_recent.c +index 055ae350..0221d446 100644 +--- a/extensions/libxt_recent.c ++++ b/extensions/libxt_recent.c +@@ -193,10 +193,12 @@ static void recent_print(const void *ip, const struct xt_entry_match *match, + printf(" UPDATE"); + if (info->check_set & XT_RECENT_REMOVE) + printf(" REMOVE"); +- if(info->seconds) printf(" seconds: %d", info->seconds); ++ if (info->seconds) ++ printf(" seconds: %u", info->seconds); + if (info->check_set & XT_RECENT_REAP) + printf(" reap"); +- if(info->hit_count) printf(" hit_count: %d", info->hit_count); ++ if (info->hit_count) ++ printf(" hit_count: %u", info->hit_count); + if (info->check_set & XT_RECENT_TTL) + printf(" TTL-Match"); + printf(" name: %s", info->name); +@@ -233,10 +235,12 @@ static void recent_save(const void *ip, const struct xt_entry_match *match, + printf(" --update"); + if (info->check_set & XT_RECENT_REMOVE) + printf(" --remove"); +- if(info->seconds) printf(" --seconds %d", info->seconds); ++ if (info->seconds) ++ printf(" --seconds %u", info->seconds); + if (info->check_set & XT_RECENT_REAP) + printf(" --reap"); +- if(info->hit_count) printf(" --hitcount %d", info->hit_count); ++ if (info->hit_count) ++ printf(" --hitcount %u", info->hit_count); + if (info->check_set & XT_RECENT_TTL) + printf(" --rttl"); + printf(" --name %s",info->name); +-- +cgit v1.2.3 + diff --git a/backport-nft-cmd-Init-struct-nft_cmd-head-early.patch b/backport-nft-cmd-Init-struct-nft_cmd-head-early.patch new file mode 100644 index 0000000000000000000000000000000000000000..a148f5202495e87ca1666dae6c58a7371c47c084 --- /dev/null +++ b/backport-nft-cmd-Init-struct-nft_cmd-head-early.patch @@ -0,0 +1,36 @@ +From db7fc1862b8bd5e2eea83ed4089fcf35fc01c032 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Tue, 23 Jul 2024 21:31:34 +0200 +Subject: nft: cmd: Init struct nft_cmd::head early + +Calling nft_cmd_free() in error case segfaults otherwise if the to be +freed object is not part of a list yet. + +Exposed by commit eab75ed36a4f2 ("nft: Avoid memleak in error path of +nft_cmd_new()"), but belongs to commit a7f1e208cdf9c (and may go well +along with it). + +Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands") +Signed-off-by: Phil Sutter + +Conflict:NA +Reference:https://git.netfilter.org/iptables/commit/?id=db7fc1862b8bd5e2eea83ed4089fcf35fc01c032 +--- + iptables/nft-cmd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c +index b38da9bd..58d5aa11 100644 +--- a/iptables/nft-cmd.c ++++ b/iptables/nft-cmd.c +@@ -28,6 +28,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command, + struct nft_cmd *cmd; + + cmd = xtables_calloc(1, sizeof(struct nft_cmd)); ++ INIT_LIST_HEAD(&cmd->head); + cmd->error.lineno = h->error.lineno; + cmd->command = command; + cmd->table = xtables_strdup(table); +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 9252b00f05b76f47a0d97799f175bb33c39221a3..588fd6e48b5c25f24d87bfa36be9ead159456262 100644 --- a/iptables.spec +++ b/iptables.spec @@ -2,7 +2,7 @@ %global legacy_actions %{_libexecdir}/initscripts/legacy-actions Name: iptables Version: 1.8.9 -Release: 7 +Release: 8 Summary: IP packet filter administration utilities License: GPL-2.0-only and Artistic-2.0 URL: https://www.netfilter.org/ @@ -29,6 +29,8 @@ Patch12: backport-libiptc-Fix-for-another-segfault-due-to-chain-index-N Patch13: backport-libxtables-Fix-memleak-of-matches-udata.patch Patch14: backport-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch Patch15: tests-extensions-add-some-testcases.patch +Patch16: backport-extensions-recent-Fix-format-string-for-unsigned-values.patch +Patch17: backport-nft-cmd-Init-struct-nft_cmd-head-early.patch BuildRequires: bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd @@ -340,6 +342,13 @@ fi %{_datadir}/xtables/iptables.xslt %changelog +* Thu Nov 21 2024 yanglu - 1.8.9-8 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:extensions:recent:Fix format string for unsigned values + nft:cmd:Init struct nft_cmd::head early + * Mon Sep 30 2024 zhouyihang - 1.8.9-7 - Type: bugfix - ID: NA