From a5b33b83abe0264e75a3b27ff682ac9040c62ff9 Mon Sep 17 00:00:00 2001 From: zhanghao Date: Mon, 14 Aug 2023 20:26:45 +0800 Subject: [PATCH] iptables: Fix handling of non-existent chains (cherry picked from commit e0a92ac5c52ee84db31e6478d6621b5dae1468de) --- ...-Fix-handling-of-non-existent-chains.patch | 56 +++++++++++++++++++ iptables.spec | 10 +++- 2 files changed, 64 insertions(+), 2 deletions(-) create mode 100644 backport-iptables-Fix-handling-of-non-existent-chains.patch diff --git a/backport-iptables-Fix-handling-of-non-existent-chains.patch b/backport-iptables-Fix-handling-of-non-existent-chains.patch new file mode 100644 index 0000000..e952b6a --- /dev/null +++ b/backport-iptables-Fix-handling-of-non-existent-chains.patch @@ -0,0 +1,56 @@ +From 82ccfb488eeac5507471099b9b4e6d136cc06e3b Mon Sep 17 00:00:00 2001 +From: Jacek Tomasiak +Date: Mon, 19 Jun 2023 13:46:36 +0200 +Subject: iptables: Fix handling of non-existent chains + +Since 694612adf87 the "compatibility" check considers non-existent +chains as "incompatible". This broke some scripts which used calls +like `iptables -L CHAIN404` to test for chain existence and expect +"No chain/target/match by that name." in the output. + +This patch changes the logic of `nft_is_table_compatible()` to +report non-existent chains as "compatible" which restores the old +behavior. + +Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks") +Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648 +Signed-off-by: Jacek Tomasiak +Signed-off-by: Jacek Tomasiak +Signed-off-by: Phil Sutter + +Conflict: NA +Reference: https://git.netfilter.org/iptables/commit?id=82ccfb488eeac5507471099b9b4e6d136cc06e3b + +--- + iptables/nft.c | 2 +- + iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/iptables/nft.c b/iptables/nft.c +index 1cb104e7..020553a4 100644 +--- a/iptables/nft.c ++++ b/iptables/nft.c +@@ -3860,7 +3860,7 @@ bool nft_is_table_compatible(struct nft_handle *h, + if (chain) { + struct nft_chain *c = nft_chain_find(h, table, chain); + +- return c && !nft_is_chain_compatible(c, h); ++ return !c || !nft_is_chain_compatible(c, h); + } + + return !nft_chain_foreach(h, table, nft_is_chain_compatible, h); +diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 +index 33c5f1f3..234f3040 100755 +--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 ++++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0 +@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar + cmd 0 -E foo bar + cmd 1 "$EEXIST_F" -E foo bar + cmd 1 "$ENOENT" -E foo bar2 ++cmd 1 "$ENOENT" -L foo + cmd 0 -N foo2 + cmd 1 "$EEXIST_F" -E foo2 bar + +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index bc6301b..fd917e1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -2,7 +2,7 @@ %global legacy_actions %{_libexecdir}/initscripts/legacy-actions Name: iptables Version: 1.8.7 -Release: 13 +Release: 14 Summary: IP packet filter administration utilities License: GPLv2 and Artistic Licence 2.0 and ISC URL: https://www.netfilter.org/ @@ -30,8 +30,8 @@ Patch12: backport-iptables-restore-Free-handle-with-test-also.patch Patch13: backport-nft-Plug-memleak-in-nft_rule_zero_counters.patch Patch14: backport-iptables-Plug-memleaks-in-print_firewall.patch Patch15: backport-ebtables-translate-Print-flush-command-after-parsing-is-finished.patch - Patch16: backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch +Patch17: backport-iptables-Fix-handling-of-non-existent-chains.patch BuildRequires: bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd BuildRequires: libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel @@ -340,6 +340,12 @@ fi %{_mandir}/man8/xtables-legacy* %changelog +* Mon Aug 14 2023 zhanghao - 1.8.7-14 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:iptables: Fix handling of non-existent chains + * Wed Apr 12 2023 zhanghao - 1.8.7-13 - Type:bugfix - CVE:NA -- Gitee