packages/iptables
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update to 1.8.5

Browse Source
This commit is contained in:
hanzj0122_admin 2020-07-25 10:50:57 +08:00
parent c88d7df741
commit c83c1768c5
6 changed files with 110 additions and 174 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

113
CVE-2019-11360.patch
View File

@ -1,113 +0,0 @@
From da800103668f256f11d88851fa9ea9faf298b760 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 22 Apr 2019 23:17:27 +0200
Subject: [PATCH] xshared: check for maximum buffer length in
add_param_to_argv()
Bail out if we go over the boundary, based on patch from Sebastian.
Reported-by: Sebastian Neef <contact@0day.work>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
iptables/xshared.c | 46 ++++++++++++++++++++++++++++------------------
1 file changed, 28 insertions(+), 18 deletions(-)
diff --git a/iptables/xshared.c b/iptables/xshared.c
index b16f5fa..b0ca8e6 100644
--- a/iptables/xshared.c
+++ b/iptables/xshared.c
@@ -433,10 +433,24 @@ void save_argv(void)
}
}
+struct xt_param_buf {
+ char buffer[1024];
+ int len;
+};
+
+static void add_param(struct xt_param_buf *param, const char *curchar)
+{
+ param->buffer[param->len++] = *curchar;
+ if (param->len >= sizeof(param->buffer))
+ xtables_error(PARAMETER_PROBLEM,
+ "Parameter too long!");
+}
+
void add_param_to_argv(char *parsestart, int line)
{
- int quote_open = 0, escaped = 0, param_len = 0;
- char param_buffer[1024], *curchar;
+ int quote_open = 0, escaped = 0;
+ struct xt_param_buf param = {};
+ char *curchar;
/* After fighting with strtok enough, here's now
* a 'real' parser. According to Rusty I'm now no
@@ -445,7 +459,7 @@ void add_param_to_argv(char *parsestart, int line)
for (curchar = parsestart; *curchar; curchar++) {
if (quote_open) {
if (escaped) {
- param_buffer[param_len++] = *curchar;
+ add_param(&param, curchar);
escaped = 0;
continue;
} else if (*curchar == '\\') {
@@ -455,7 +469,7 @@ void add_param_to_argv(char *parsestart, int line)
quote_open = 0;
*curchar = '"';
} else {
- param_buffer[param_len++] = *curchar;
+ add_param(&param, curchar);
continue;
}
} else {
@@ -471,36 +485,32 @@ void add_param_to_argv(char *parsestart, int line)
case ' ':
case '\t':
case '\n':
- if (!param_len) {
+ if (!param.len) {
/* two spaces? */
continue;
}
break;
default:
/* regular character, copy to buffer */
- param_buffer[param_len++] = *curchar;
-
- if (param_len >= sizeof(param_buffer))
- xtables_error(PARAMETER_PROBLEM,
- "Parameter too long!");
+ add_param(&param, curchar);
continue;
}
- param_buffer[param_len] = '\0';
+ param.buffer[param.len] = '\0';
/* check if table name specified */
- if ((param_buffer[0] == '-' &&
- param_buffer[1] != '-' &&
- strchr(param_buffer, 't')) ||
- (!strncmp(param_buffer, "--t", 3) &&
- !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
+ if ((param.buffer[0] == '-' &&
+ param.buffer[1] != '-' &&
+ strchr(param.buffer, 't')) ||
+ (!strncmp(param.buffer, "--t", 3) &&
+ !strncmp(param.buffer, "--table", strlen(param.buffer)))) {
xtables_error(PARAMETER_PROBLEM,
"The -t option (seen in line %u) cannot be used in %s.\n",
line, xt_params->program_name);
}
- add_argv(param_buffer, 0);
- param_len = 0;
+ add_argv(param.buffer, 0);
+ param.len = 0;
}
}
--
1.8.3.1

BIN
iptables-1.8.1.tar.bz2
View File

Binary file not shown.

BIN
iptables-1.8.5.tar.bz2 Normal file
View File

Binary file not shown.

33
iptables-apply-Use-mktemp-instead-of-tempfile.patch
View File

@ -1,33 +0,0 @@
From 6c3a1a5c29a7c41af9da1a3bbf137df994479518 Mon Sep 17 00:00:00 2001
From: Phil Sutter <psutter@redhat.com>
Date: Fri, 12 Apr 2019 18:02:19 +0200
Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
---
iptables-apply | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/iptables-apply b/iptables-apply
index 819ca4a..a685b6b 100755
--- a/iptables/iptables-apply
+++ b/iptables/iptables-apply
@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
exit 2
fi
-COMMANDS=(tempfile "$SAVE" "$RESTORE")
+COMMANDS=(mktemp "$SAVE" "$RESTORE")
for cmd in "${COMMANDS[@]}"; do
if ! command -v $cmd >/dev/null; then
@@ -122,7 +122,7 @@ done
umask 0700
-TMPFILE=$(tempfile -p iptap)
+TMPFILE=$(mktemp)
trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
FPE USR1 SEGV USR2 PIPE ALRM TERM
--
1.8.3.1

17
iptables.init
View File

@ -18,8 +18,21 @@
# Description: Start, stop and save iptables firewall
### END INIT INFO
# Source function library.
. /etc/init.d/functions
# compat for removed initscripts dependency
success() {
echo -n "[ OK ]"
return 0
}
warning() {
echo -n "[WARNING]"
return 1
}
failure() {
echo -n "[FAILED]"
return 1
}
IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES

121
iptables.spec
View File

@ -1,8 +1,8 @@
%global script_path %{_libexecdir}/iptables
%global legacy_actions %{_libexecdir}/initscripts/legacy-actions
Name: iptables
Version: 1.8.1
Release: 5
Version: 1.8.5
Release: 1
Summary: IP packet filter administration utilities
License: GPLv2 and Artistic Licence 2.0 and ISC
URL: https://www.netfilter.org/
@ -13,11 +13,9 @@ Source3: iptables.service
Source4: sysconfig_iptables
Source5: sysconfig_ip6tables
Patch1: iptables-apply-Use-mktemp-instead-of-tempfile.patch
Patch2: CVE-2019-11360.patch
BuildRequires: bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd git
BuildRequires: libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel
BuildRequires: autogen autoconf automake libtool iptables
Requires: %{name}-libs = %{version}-%{release}
@ -68,6 +66,7 @@ Nft package for iproute.
%autosetup -n %{name}-%{version} -p1 -S git
%build
./autogen.sh
%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
%disable_rpath
@ -130,16 +129,14 @@ install -m 0755 -c ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6table
install -m 0755 iptables/iptables-apply %{buildroot}%{_sbindir}
install -m 0755 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8
pushd %{buildroot}%{_sbindir}
mv ebtables ebtables-nft
mv arptables arptables-nft
touch %{buildroot}%{_libexecdir}/arptables-helper
touch ebtables \
arptables \
iptables \
ip6tables
popd
touch %{buildroot}%{_mandir}/man8/arptables.8
touch %{buildroot}%{_mandir}/man8/arptables-save.8
touch %{buildroot}%{_mandir}/man8/arptables-restore.8
touch %{buildroot}%{_mandir}/man8/ebtables.8
cp -a %{_libdir}/libip*tc.so.0.* %{buildroot}%{_libdir}
%ldconfig_scriptlets
%post
@ -170,20 +167,58 @@ fi
pfx=%{_sbindir}/iptables
pfx6=%{_sbindir}/ip6tables
%{_sbindir}/update-alternatives --install \
$pfx iptables $pfx-nft 5 \
$pfx iptables $pfx-nft 10 \
--slave $pfx6 ip6tables $pfx6-nft \
--slave $pfx-restore iptables-restore $pfx-nft-restore \
--slave $pfx-save iptables-save $pfx-nft-save \
--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
--slave $pfx6-save ip6tables-save $pfx6-nft-save
for cmd in ebtables arptables; do
if [ "$(readlink -e %{_sbindir}/$cmd)" == %{_sbindir}/$cmd ]; then
rm -f %{_sbindir}/$cmd
pfx=%{_sbindir}/ebtables
manpfx=%{_mandir}/man8/ebtables
for sfx in "" "-restore" "-save"; do
if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
rm -f $pfx$sfx
fi
%{_sbindir}/update-alternatives --install \
%{_sbindir}/$cmd $cmd %{_sbindir}/$cmd-nft 5
done
if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
rm -f $manpfx.8.gz
fi
%{_sbindir}/update-alternatives --install \
$pfx ebtables $pfx-nft 10 \
--slave $pfx-save ebtables-save $pfx-nft-save \
--slave $pfx-restore ebtables-restore $pfx-nft-restore \
--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz
pfx=%{_sbindir}/arptables
manpfx=%{_mandir}/man8/arptables
lepfx=%{_libexecdir}/arptables
for sfx in "" "-restore" "-save"; do
if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
rm -f $pfx$sfx
fi
if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
rm -f $manpfx$sfx.8.gz
fi
done
if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
rm -f $lepfx-helper
fi
%{_sbindir}/update-alternatives --install \
$pfx arptables $pfx-nft 10 \
--slave $pfx-save arptables-save $pfx-nft-save \
--slave $pfx-restore arptables-restore $pfx-nft-restore \
--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \
--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \
--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \
--slave $lepfx-helper arptables-helper $lepfx-nft-helper
if [ x`rpm -qa firewalld` != x ]; then
firews=`systemctl status firewalld | grep Active | awk '{print $3}'`
if [ "$firews" == "(running)" ]; then
%systemd_postun_with_restart firewalld.service
fi
fi
%postun nft
if [ $1 -eq 0 ]; then
@ -202,13 +237,13 @@ fi
%{_sbindir}/nfnl_osf
%{_sbindir}/nfbpf_*
%{_sbindir}/iptables-apply
%{_sbindir}/ip6tables-apply
%{_sbindir}/ip*tables-legacy*
%{_sbindir}/xtables-legacy-multi
%exclude %{_sbindir}/*-nft*
%exclude %{_sbindir}/*-translate
%exclude %{_sbindir}/xtables-monitor
%{_bindir}/iptables-xml
%{_libdir}/xtables/*
%{_unitdir}/*.service
%dir %{legacy_actions}
%{legacy_actions}/ip*
@ -221,6 +256,11 @@ fi
%defattr(-,root,root)
%{_libdir}/libip*tc.so.*
%{_libdir}/libxtables.so.*
%{_libdir}/libxtables.so.12*
%dir %{_libdir}/xtables
%{_libdir}/xtables/libipt*
%{_libdir}/xtables/libip6t*
%{_libdir}/xtables/libxt*
%files devel
%defattr(-,root,root)
@ -230,25 +270,54 @@ fi
%files nft
%defattr(-,root,root)
%{_sbindir}/*-nft*
%{_sbindir}/*-translate
%{_sbindir}/iptables-nft*
%{_sbindir}/iptables-restore-translate
%{_sbindir}/iptables-translate
%{_sbindir}/ip6tables-nft*
%{_sbindir}/ip6tables-restore-translate
%{_sbindir}/ip6tables-translate
%{_sbindir}/ebtables-nft*
%{_sbindir}/arptables-nft*
%{_sbindir}/xtables-nft-multi
%{_sbindir}/xtables-monitor
%ghost %{_sbindir}/ip*tables
%ghost %{_sbindir}/ip*tables-restore
%ghost %{_sbindir}/ip*tables-save
%dir %{_libdir}/xtables
%{_libdir}/xtables/libarpt*
%{_libdir}/xtables/libebt*
%ghost %{_sbindir}/iptables
%ghost %{_sbindir}/iptables-restore
%ghost %{_sbindir}/iptables-save
%ghost %{_sbindir}/ip6tables
%ghost %{_sbindir}/ip6tables-restore
%ghost %{_sbindir}/ip6tables-save
%ghost %{_sbindir}/ebtables
%ghost %{_sbindir}/ebtables-save
%ghost %{_sbindir}/ebtables-restore
%ghost %{_sbindir}/arptables
%ghost %{_sbindir}/arptables-save
%ghost %{_sbindir}/arptables-restore
%ghost %{_libexecdir}/arptables-helper
%files help
%defattr(-,root,root)
%doc INCOMPATIBILITIES
%{_mandir}/*
%ghost %{_mandir}/man8/arptables.8.gz
%ghost %{_mandir}/man8/arptables-save.8.gz
%ghost %{_mandir}/man8/arptables-restore.8.gz
%ghost %{_mandir}/man8/ebtables.8.gz
%{_mandir}/man8/xtables-monitor*
%{_mandir}/man8/xtables-translate*
%{_mandir}/man8/*-nft*
%{_mandir}/man8/nfnl_osf*
%{_mandir}/man8/nfbpf_compile*
%{_mandir}/man1/iptables-xml*
%{_mandir}/man8/iptables*
%{_mandir}/man8/ip6tables*
%{_mandir}/man8/xtables-legacy*
%changelog
* Sat Jul 25 hanzhijun <hanzhijun1@huawei.com> - 1.8.5-1
- update to 1.8.5
* Thu Apr 16 2020 chenzhen <chenzhen44@huawei.com> - 1.8.1-5
- Type:cves
- ID:CVE-2019-11360