update to 1.8.5

CVE-2019-11360.patch

@@ -1,113 +0,0 @@
-From da800103668f256f11d88851fa9ea9faf298b760 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Mon, 22 Apr 2019 23:17:27 +0200
-Subject: [PATCH] xshared: check for maximum buffer length in
- add_param_to_argv()
-
-Bail out if we go over the boundary, based on patch from Sebastian.
-
-Reported-by: Sebastian Neef <contact@0day.work>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- iptables/xshared.c | 46 ++++++++++++++++++++++++++++------------------
- 1 file changed, 28 insertions(+), 18 deletions(-)
-
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index b16f5fa..b0ca8e6 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -433,10 +433,24 @@ void save_argv(void)
- 	}
- }
- 
-+struct xt_param_buf {
-+	char	buffer[1024];
-+	int 	len;
-+};
-+
-+static void add_param(struct xt_param_buf *param, const char *curchar)
-+{
-+	param->buffer[param->len++] = *curchar;
-+	if (param->len >= sizeof(param->buffer))
-+		xtables_error(PARAMETER_PROBLEM,
-+			      "Parameter too long!");
-+}
-+
- void add_param_to_argv(char *parsestart, int line)
- {
--	int quote_open = 0, escaped = 0, param_len = 0;
--	char param_buffer[1024], *curchar;
-+	int quote_open = 0, escaped = 0;
-+	struct xt_param_buf param = {};
-+	char *curchar;
- 
- 	/* After fighting with strtok enough, here's now
- 	 * a 'real' parser. According to Rusty I'm now no
-@@ -445,7 +459,7 @@ void add_param_to_argv(char *parsestart, int line)
- 	for (curchar = parsestart; *curchar; curchar++) {
- 		if (quote_open) {
- 			if (escaped) {
--				param_buffer[param_len++] = *curchar;
-+				add_param(&param, curchar);
- 				escaped = 0;
- 				continue;
- 			} else if (*curchar == '\\') {
-@@ -455,7 +469,7 @@ void add_param_to_argv(char *parsestart, int line)
- 				quote_open = 0;
- 				*curchar = '"';
- 			} else {
--				param_buffer[param_len++] = *curchar;
-+				add_param(&param, curchar);
- 				continue;
- 			}
- 		} else {
-@@ -471,36 +485,32 @@ void add_param_to_argv(char *parsestart, int line)
- 		case ' ':
- 		case '\t':
- 		case '\n':
--			if (!param_len) {
-+			if (!param.len) {
- 				/* two spaces? */
- 				continue;
- 			}
- 			break;
- 		default:
- 			/* regular character, copy to buffer */
--			param_buffer[param_len++] = *curchar;
--
--			if (param_len >= sizeof(param_buffer))
--				xtables_error(PARAMETER_PROBLEM,
--					      "Parameter too long!");
-+			add_param(&param, curchar);
- 			continue;
- 		}
- 
--		param_buffer[param_len] = '\0';
-+		param.buffer[param.len] = '\0';
- 
- 		/* check if table name specified */
--		if ((param_buffer[0] == '-' &&
--		     param_buffer[1] != '-' &&
--		     strchr(param_buffer, 't')) ||
--		    (!strncmp(param_buffer, "--t", 3) &&
--		     !strncmp(param_buffer, "--table", strlen(param_buffer)))) {
-+		if ((param.buffer[0] == '-' &&
-+		     param.buffer[1] != '-' &&
-+		     strchr(param.buffer, 't')) ||
-+		    (!strncmp(param.buffer, "--t", 3) &&
-+		     !strncmp(param.buffer, "--table", strlen(param.buffer)))) {
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "The -t option (seen in line %u) cannot be used in %s.\n",
- 				      line, xt_params->program_name);
- 		}
- 
--		add_argv(param_buffer, 0);
--		param_len = 0;
-+		add_argv(param.buffer, 0);
-+		param.len = 0;
- 	}
- }
- 
--- 
-1.8.3.1
-

iptables-apply-Use-mktemp-instead-of-tempfile.patch

@@ -1,33 +0,0 @@
-From 6c3a1a5c29a7c41af9da1a3bbf137df994479518 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <psutter@redhat.com>
-Date: Fri, 12 Apr 2019 18:02:19 +0200
-Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
-
----
- iptables-apply | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables-apply b/iptables-apply
-index 819ca4a..a685b6b 100755
---- a/iptables/iptables-apply
-+++ b/iptables/iptables-apply
-@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
- 	exit 2
- fi
- 
--COMMANDS=(tempfile "$SAVE" "$RESTORE")
-+COMMANDS=(mktemp "$SAVE" "$RESTORE")
- 
- for cmd in "${COMMANDS[@]}"; do
- 	if ! command -v $cmd >/dev/null; then
-@@ -122,7 +122,7 @@ done
- 
- umask 0700
- 
--TMPFILE=$(tempfile -p iptap)
-+TMPFILE=$(mktemp)
- trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
- 		      FPE USR1 SEGV USR2 PIPE ALRM TERM
- 
--- 
-1.8.3.1

iptables.init

@@ -18,8 +18,21 @@
 # Description: Start, stop and save iptables firewall
 ### END INIT INFO
 
-# Source function library.
+# compat for removed initscripts dependency
-. /etc/init.d/functions
+success() {
+	echo -n "[  OK  ]"
+	return 0
+}
+
+warning() {
+	echo -n "[WARNING]"
+	return 1
+}
+
+failure() {
+	echo -n "[FAILED]"
+	return 1
+}
 
 IPTABLES=iptables
 IPTABLES_DATA=/etc/sysconfig/$IPTABLES

iptables.spec

@@ -1,8 +1,8 @@
 %global script_path %{_libexecdir}/iptables
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 Name:		  iptables
-Version:	  1.8.1
+Version:	  1.8.5
-Release:	  5
+Release:	  1
 Summary:	  IP packet filter administration utilities
 License:	  GPLv2 and Artistic Licence 2.0 and ISC
 URL:		  https://www.netfilter.org/
@@ -13,11 +13,9 @@ Source3:          iptables.service
 Source4:          sysconfig_iptables
 Source5:          sysconfig_ip6tables
 
-Patch1:           iptables-apply-Use-mktemp-instead-of-tempfile.patch 
-Patch2:           CVE-2019-11360.patch
-
 BuildRequires:    bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd git
 BuildRequires:    libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel
+BuildRequires:    autogen autoconf automake libtool iptables
 
 Requires:         %{name}-libs = %{version}-%{release}
 
@@ -68,6 +66,7 @@ Nft package for iproute.
 %autosetup -n %{name}-%{version} -p1 -S git
 
 %build
+./autogen.sh
 %configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
 
 %disable_rpath
@@ -130,16 +129,14 @@ install -m 0755 -c ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6table
 install -m 0755 iptables/iptables-apply %{buildroot}%{_sbindir}
 install -m 0755 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8
 
-pushd %{buildroot}%{_sbindir}
+touch %{buildroot}%{_libexecdir}/arptables-helper
-mv ebtables ebtables-nft
-mv arptables arptables-nft
 
-touch ebtables  \
+touch %{buildroot}%{_mandir}/man8/arptables.8
-      arptables \
+touch %{buildroot}%{_mandir}/man8/arptables-save.8
-      iptables  \
+touch %{buildroot}%{_mandir}/man8/arptables-restore.8
-      ip6tables
+touch %{buildroot}%{_mandir}/man8/ebtables.8
-popd
 
+cp -a %{_libdir}/libip*tc.so.0.* %{buildroot}%{_libdir}
 %ldconfig_scriptlets
 
 %post
@@ -170,20 +167,58 @@ fi
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
 %{_sbindir}/update-alternatives --install \
-	$pfx iptables $pfx-nft 5 \
+	$pfx iptables $pfx-nft 10 \
 	--slave $pfx6 ip6tables $pfx6-nft \
 	--slave $pfx-restore iptables-restore $pfx-nft-restore \
 	--slave $pfx-save iptables-save $pfx-nft-save \
 	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
 	--slave $pfx6-save ip6tables-save $pfx6-nft-save
 
-for cmd in ebtables arptables; do
+pfx=%{_sbindir}/ebtables
-	if [ "$(readlink -e %{_sbindir}/$cmd)" == %{_sbindir}/$cmd ]; then
+manpfx=%{_mandir}/man8/ebtables
-		rm -f %{_sbindir}/$cmd
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
 	fi
-	%{_sbindir}/update-alternatives --install \
-	%{_sbindir}/$cmd $cmd %{_sbindir}/$cmd-nft 5
 done
+if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
+	rm -f $manpfx.8.gz
+fi
+%{_sbindir}/update-alternatives --install \
+	$pfx ebtables $pfx-nft 10 \
+	--slave $pfx-save ebtables-save $pfx-nft-save \
+	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
+	--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz
+
+pfx=%{_sbindir}/arptables
+manpfx=%{_mandir}/man8/arptables
+lepfx=%{_libexecdir}/arptables
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
+		rm -f $manpfx$sfx.8.gz
+	fi
+done
+if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
+	rm -f $lepfx-helper
+fi
+%{_sbindir}/update-alternatives --install \
+	$pfx arptables $pfx-nft 10 \
+	--slave $pfx-save arptables-save $pfx-nft-save \
+	--slave $pfx-restore arptables-restore $pfx-nft-restore \
+	--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \
+	--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \
+	--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \
+	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
+
+if [ x`rpm -qa firewalld` != x ]; then
+	firews=`systemctl status firewalld | grep Active | awk '{print $3}'`
+	if [ "$firews" == "(running)" ]; then
+		%systemd_postun_with_restart firewalld.service
+	fi
+fi
 
 %postun           nft
 if [ $1 -eq 0 ]; then
@@ -202,13 +237,13 @@ fi
 %{_sbindir}/nfnl_osf
 %{_sbindir}/nfbpf_*
 %{_sbindir}/iptables-apply
+%{_sbindir}/ip6tables-apply
 %{_sbindir}/ip*tables-legacy*
 %{_sbindir}/xtables-legacy-multi
 %exclude %{_sbindir}/*-nft*
 %exclude %{_sbindir}/*-translate
 %exclude %{_sbindir}/xtables-monitor
 %{_bindir}/iptables-xml
-%{_libdir}/xtables/*
 %{_unitdir}/*.service
 %dir %{legacy_actions}
 %{legacy_actions}/ip*
@@ -221,6 +256,11 @@ fi
 %defattr(-,root,root)
 %{_libdir}/libip*tc.so.*
 %{_libdir}/libxtables.so.*
+%{_libdir}/libxtables.so.12*
+%dir %{_libdir}/xtables
+%{_libdir}/xtables/libipt*
+%{_libdir}/xtables/libip6t*
+%{_libdir}/xtables/libxt*
 
 %files            devel
 %defattr(-,root,root)
@@ -230,25 +270,54 @@ fi
 
 %files            nft
 %defattr(-,root,root)
-%{_sbindir}/*-nft*
+%{_sbindir}/iptables-nft*
-%{_sbindir}/*-translate
+%{_sbindir}/iptables-restore-translate
+%{_sbindir}/iptables-translate
+%{_sbindir}/ip6tables-nft*
+%{_sbindir}/ip6tables-restore-translate
+%{_sbindir}/ip6tables-translate
+%{_sbindir}/ebtables-nft*
+%{_sbindir}/arptables-nft*
+%{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
-%ghost %{_sbindir}/ip*tables
+%dir %{_libdir}/xtables
-%ghost %{_sbindir}/ip*tables-restore
+%{_libdir}/xtables/libarpt*
-%ghost %{_sbindir}/ip*tables-save
+%{_libdir}/xtables/libebt*
+%ghost %{_sbindir}/iptables
+%ghost %{_sbindir}/iptables-restore
+%ghost %{_sbindir}/iptables-save
+%ghost %{_sbindir}/ip6tables
+%ghost %{_sbindir}/ip6tables-restore
+%ghost %{_sbindir}/ip6tables-save
 %ghost %{_sbindir}/ebtables
 %ghost %{_sbindir}/ebtables-save
 %ghost %{_sbindir}/ebtables-restore
 %ghost %{_sbindir}/arptables
 %ghost %{_sbindir}/arptables-save
 %ghost %{_sbindir}/arptables-restore
+%ghost %{_libexecdir}/arptables-helper
 
 %files            help
 %defattr(-,root,root)
 %doc INCOMPATIBILITIES
-%{_mandir}/*
+%ghost %{_mandir}/man8/arptables.8.gz
+%ghost %{_mandir}/man8/arptables-save.8.gz
+%ghost %{_mandir}/man8/arptables-restore.8.gz
+%ghost %{_mandir}/man8/ebtables.8.gz
+%{_mandir}/man8/xtables-monitor*
+%{_mandir}/man8/xtables-translate*
+%{_mandir}/man8/*-nft*
+%{_mandir}/man8/nfnl_osf*
+%{_mandir}/man8/nfbpf_compile*
+%{_mandir}/man1/iptables-xml*
+%{_mandir}/man8/iptables*
+%{_mandir}/man8/ip6tables*
+%{_mandir}/man8/xtables-legacy*
 
 %changelog
+* Sat Jul 25 hanzhijun <hanzhijun1@huawei.com> - 1.8.5-1
+- update to 1.8.5
+
 * Thu Apr 16 2020 chenzhen <chenzhen44@huawei.com> - 1.8.1-5
 - Type:cves
 - ID:CVE-2019-11360