!74 fix some patches from 1.8.7 and enabled DT testcases

From: @zhang-hao-jon 
Reviewed-by: @seuzw 
Signed-off-by: @seuzw

bugfix-add-check-fw-in-entry.patch

@@ -12,10 +12,10 @@ If the fw pointer is empty, a core dump occurs.
  2 files changed, 41 insertions(+)
 
 diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index 576c2cf..db79906 100644
+index 345af45..5885d41 100644
 --- a/iptables/ip6tables.c
 +++ b/iptables/ip6tables.c
-@@ -557,6 +557,10 @@ append_entry(const xt_chainlabel chain,
+@@ -218,6 +218,10 @@ append_entry(const xt_chainlabel chain,
  	unsigned int i, j;
  	int ret = 1;
  
@@ -26,7 +26,7 @@ index 576c2cf..db79906 100644
  	for (i = 0; i < nsaddrs; i++) {
  		fw->ipv6.src = saddrs[i];
  		fw->ipv6.smsk = smasks[i];
-@@ -581,6 +585,11 @@ replace_entry(const xt_chainlabel chain,
+@@ -242,6 +246,11 @@ replace_entry(const xt_chainlabel chain,
  	      int verbose,
  	      struct xtc_handle *handle)
  {
@@ -38,66 +38,66 @@ index 576c2cf..db79906 100644
  	fw->ipv6.src = *saddr;
  	fw->ipv6.dst = *daddr;
  	fw->ipv6.smsk = *smask;
-@@ -607,6 +616,10 @@ insert_entry(const xt_chainlabel chain,
+@@ -268,6 +277,10 @@ insert_entry(const xt_chainlabel chain,
  	unsigned int i, j;
  	int ret = 1;
  
-+        if (!fw) {
++	 if (!fw) {
 +                return 0;
 +        }
 +
  	for (i = 0; i < nsaddrs; i++) {
  		fw->ipv6.src = saddrs[i];
  		fw->ipv6.smsk = smasks[i];
-@@ -674,6 +687,10 @@ delete_entry(const xt_chainlabel chain,
+@@ -301,6 +314,10 @@ delete_entry(const xt_chainlabel chain,
  	int ret = 1;
  	unsigned char *mask;
  
++	 if (!fw) {
++                return 0;
++        }
++
+ 	mask = make_delete_mask(matches, target, sizeof(*fw));
+ 	for (i = 0; i < nsaddrs; i++) {
+ 		fw->ipv6.src = saddrs[i];
+@@ -331,6 +348,10 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
+ 	int ret = 1;
+ 	unsigned char *mask;
+ 
++	 if (!fw) {
++                return 0;
++        }
++
+ 	mask = make_delete_mask(matches, target, sizeof(fw));
+ 	for (i = 0; i < nsaddrs; i++) {
+ 		fw->ipv6.src = saddrs[i];
+diff --git a/iptables/iptables.c b/iptables/iptables.c
+index 6f7b347..0d302e5 100644
+--- a/iptables/iptables.c
++++ b/iptables/iptables.c
+@@ -217,6 +217,10 @@ append_entry(const xt_chainlabel chain,
+ 	unsigned int i, j;
+ 	int ret = 1;
+ 
 +        if (!fw) {
 +                return 0;
 +        }
-+
- 	mask = make_delete_mask(matches, target);
- 	for (i = 0; i < nsaddrs; i++) {
- 		fw->ipv6.src = saddrs[i];
-@@ -704,6 +721,10 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
- 	int ret = 1;
- 	unsigned char *mask;
- 
-+	if (!fw) {
-+                return 0;
-+        }
-+
- 	mask = make_delete_mask(matches, target);
- 	for (i = 0; i < nsaddrs; i++) {
- 		fw->ipv6.src = saddrs[i];
-diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 88ef6cf..6507603 100644
---- a/iptables/iptables.c
-+++ b/iptables/iptables.c
-@@ -549,6 +549,10 @@ append_entry(const xt_chainlabel chain,
- 	unsigned int i, j;
- 	int ret = 1;
- 
-+	if (!fw) {
-+		return 0;
-+	}
 +
  	for (i = 0; i < nsaddrs; i++) {
  		fw->ip.src.s_addr = saddrs[i].s_addr;
  		fw->ip.smsk.s_addr = smasks[i].s_addr;
-@@ -573,6 +577,10 @@ replace_entry(const xt_chainlabel chain,
+@@ -241,6 +245,10 @@ replace_entry(const xt_chainlabel chain,
  	      int verbose,
  	      struct xtc_handle *handle)
  {
-+	if (!fw) {
++        if (!fw) {
 +                return 0;
 +        }
 +
  	fw->ip.src.s_addr = saddr->s_addr;
  	fw->ip.dst.s_addr = daddr->s_addr;
  	fw->ip.smsk.s_addr = smask->s_addr;
-@@ -599,6 +607,10 @@ insert_entry(const xt_chainlabel chain,
+@@ -267,6 +275,10 @@ insert_entry(const xt_chainlabel chain,
  	unsigned int i, j;
  	int ret = 1;
  
@@ -108,28 +108,28 @@ index 88ef6cf..6507603 100644
  	for (i = 0; i < nsaddrs; i++) {
  		fw->ip.src.s_addr = saddrs[i].s_addr;
  		fw->ip.smsk.s_addr = smasks[i].s_addr;
-@@ -666,6 +678,10 @@ delete_entry(const xt_chainlabel chain,
+@@ -300,6 +312,10 @@ delete_entry(const xt_chainlabel chain,
  	int ret = 1;
  	unsigned char *mask;
  
-+        if (!fw) {
++       if (!fw) {
 +                return 0;
 +        }
 +
- 	mask = make_delete_mask(matches, target);
+ 	mask = make_delete_mask(matches, target, sizeof(*fw));
  	for (i = 0; i < nsaddrs; i++) {
  		fw->ip.src.s_addr = saddrs[i].s_addr;
-@@ -696,6 +712,10 @@ check_entry(const xt_chainlabel chain, struct ipt_entry *fw,
+@@ -330,6 +346,10 @@ check_entry(const xt_chainlabel chain, struct ipt_entry *fw,
  	int ret = 1;
  	unsigned char *mask;
  
-+        if (!fw) {
++    if (!fw) {
 +                return 0;
 +        }
 +
- 	mask = make_delete_mask(matches, target);
+ 	mask = make_delete_mask(matches, target, sizeof(*fw));
  	for (i = 0; i < nsaddrs; i++) {
  		fw->ip.src.s_addr = saddrs[i].s_addr;
 -- 
-2.27.0
+2.23.0
 

enabled-makecheck-in-extensions.patch

@@ -4,20 +4,31 @@ Date: Sat, 26 Nov 2022 18:08:31 +0800
 Subject: [PATCH] enable
 
 Signed-off-by: huangyu <huangyu106@huawei.com>
----
- extensions/GNUmakefile.in | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
 
+---
+ Makefile.am               | 1 -
+ extensions/GNUmakefile.in | 4 +++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 451c3cb..098e967 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -34,4 +34,3 @@ tarball:
+ config.status: extensions/GNUmakefile.in \
+ 	include/xtables-version.h.in
+ 
+-TESTS = xlate-test.py iptables-test.py iptables/tests/shell/run-tests.sh
 diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in
-index 956ccb3..70515c4 100644
+index e289adf..7052ecc 100644
 --- a/extensions/GNUmakefile.in
 +++ b/extensions/GNUmakefile.in
 @@ -79,7 +79,7 @@ targets_install :=
  
  .SECONDARY:
  
--.PHONY: all install uninstall clean distclean FORCE
-+.PHONY: all install uninstall check clean distclean FORCE
+-.PHONY: all install uninstall clean distclean FORCE dvi check installcheck
++.PHONY: all install uninstall check clean distclean FORCE dvi check installcheck
  
  all: ${targets}
  
@@ -28,8 +39,8 @@ index 956ccb3..70515c4 100644
 +check:
 +
  clean:
- 	rm -f *.o *.oo *.so *.a {matches,targets}.man initext.c initext4.c initext6.c initextb.c initexta.c;
- 	rm -f .*.d .*.dd;
+ 	rm -f *.o *.oo *.so *.a matches.man targets.man
+ 	rm -f initext.c initext4.c initext6.c initextb.c initexta.c
 -- 
 2.23.0
 

iptables.spec

@@ -2,7 +2,7 @@
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 Name:		  iptables
 Version:	  1.8.9
-Release:	  1
+Release:	  2
 Summary:	  IP packet filter administration utilities
 License:	  GPLv2 and Artistic Licence 2.0 and ISC
 URL:		  https://www.netfilter.org/
@@ -13,7 +13,9 @@ Source3:          iptables.service
 Source4:          sysconfig_iptables
 Source5:          sysconfig_ip6tables
 
-Patch01:          0001-extensions-NAT-Fix-for-Werror-format-security.patch
+Patch0:           0001-extensions-NAT-Fix-for-Werror-format-security.patch
+Patch1:           enabled-makecheck-in-extensions.patch
+Patch2:           bugfix-add-check-fw-in-entry.patch
 
 BuildRequires:    bison flex gcc kernel-headers libpcap-devel libselinux-devel systemd
 BuildRequires:    libmnl-devel libnetfilter_conntrack-devel libnfnetlink-devel libnftnl-devel
@@ -78,6 +80,9 @@ rm -f include/linux/types.h
 
 %make_build
 
+%check
+make check
+
 %install
 %make_install 
 
@@ -327,6 +332,12 @@ fi
 %{_datadir}/xtables/iptables.xslt
 
 %changelog
+* Wed Feb 15 2023 zhanghao <zhanghao383@huawei.com> - 1.8.9-2
+- Type:requirement
+- ID:NA
+- SUG:NA
+- DESC:fix one patch from 1.8.7 and delete useless Patches
+
 * Wed Feb 08 2023 zhanghao <zhanghao383@huawei.com> - 1.8.9-1
 - Type:requirement
 - ID:NA