packages/iptables
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iptables: Fix handling of non-existent chains

Browse Source 
(cherry picked from commit e0a92ac5c52ee84db31e6478d6621b5dae1468de)
This commit is contained in:
zhanghao 2023-08-14 20:26:45 +08:00 committed by openeuler-sync-bot
parent 4f90d323fe
commit c15cd920c6
2 changed files with 64 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
backport-iptables-Fix-handling-of-non-existent-chains.patch Normal file
View File

@ -0,0 +1,56 @@
From 82ccfb488eeac5507471099b9b4e6d136cc06e3b Mon Sep 17 00:00:00 2001
From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
Date: Mon, 19 Jun 2023 13:46:36 +0200
Subject: iptables: Fix handling of non-existent chains
Since 694612adf87 the "compatibility" check considers non-existent
chains as "incompatible". This broke some scripts which used calls
like `iptables -L CHAIN404` to test for chain existence and expect
"No chain/target/match by that name." in the output.
This patch changes the logic of `nft_is_table_compatible()` to
report non-existent chains as "compatible" which restores the old
behavior.
Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
Signed-off-by: Phil Sutter <phil@nwl.cc>
Conflict: NA
Reference: https://git.netfilter.org/iptables/commit?id=82ccfb488eeac5507471099b9b4e6d136cc06e3b
---
iptables/nft.c | 2 +-
iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 +
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index 1cb104e7..020553a4 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -3860,7 +3860,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
if (chain) {
struct nft_chain *c = nft_chain_find(h, table, chain);
- return c && !nft_is_chain_compatible(c, h);
+ return !c || !nft_is_chain_compatible(c, h);
}
return !nft_chain_foreach(h, table, nft_is_chain_compatible, h);
diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
index 33c5f1f3..234f3040 100755
--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar
cmd 0 -E foo bar
cmd 1 "$EEXIST_F" -E foo bar
cmd 1 "$ENOENT" -E foo bar2
+cmd 1 "$ENOENT" -L foo
cmd 0 -N foo2
cmd 1 "$EEXIST_F" -E foo2 bar
--
cgit v1.2.3

10
iptables.spec
View File

@ -2,7 +2,7 @@
%global legacy_actions %{_libexecdir}/initscripts/legacy-actions
Name: iptables
Version: 1.8.7
Release: 13
Release: 14
Summary: IP packet filter administration utilities
License: GPLv2 and Artistic Licence 2.0 and ISC
URL: https://www.netfilter.org/
@ -30,8 +30,8 @@ Patch12: backport-iptables-restore-Free-handle-with-test-also.patch
Patch13: backport-nft-Plug-memleak-in-nft_rule_zero_counters.patch
Patch14: backport-iptables-Plug-memleaks-in-print_firewall.patch
Patch15: backport-ebtables-translate-Print-flush-command-after-parsing-is-finished.patch
Patch16: backport-xtables-eb-fix-crash-when-opts-isn-t-reallocated.patch
Patch17: backport-iptables-Fix-handling-of-non-existent-chains.patch
BuildRequires: bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd
BuildRequires: libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel
@ -340,6 +340,12 @@ fi
%{_mandir}/man8/xtables-legacy*
%changelog
* Mon Aug 14 2023 zhanghao <zhanghao383@huawei.com> - 1.8.7-14
- Type:bugfix
- CVE:NA
- SUG:NA
- DESC:iptables: Fix handling of non-existent chains
* Wed Apr 12 2023 zhanghao <zhanghao383@huawei.com> - 1.8.7-13
- Type:bugfix
- CVE:NA