Attachment 1459271 Details for Bug 1601609 – Patch fixing the bug

Patch fixing the bug

iptables-restore-double-lock.patch (text/plain), 4.97 KB, created by contact+rhelbugzilla on 2018-07-16 21:56:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: contact+rhelbugzilla

Created: 2018-07-16 21:56:27 UTC

Size: 4.97 KB

patch

obsolete

> iptables/ip6tables-restore.c                       |  7 +++-
> iptables/iptables-restore.c                        |  9 +++--
> .../ipt-restore/0001load-specific-table_0          | 42 ++++++++++++++++++++++
> .../testcases/ipt-restore/dumps/ip6tables.dump     | 30 ++++++++++++++++
> .../testcases/ipt-restore/dumps/iptables.dump      | 30 ++++++++++++++++
> 5 files changed, 115 insertions(+), 3 deletions(-)
>
>diff --git a/iptables/ip6tables-restore.c b/iptables/ip6tables-restore.c
>index ceffa616..a880fae5 100644
>--- a/iptables/ip6tables-restore.c
>+++ b/iptables/ip6tables-restore.c
>@@ -325,8 +325,13 @@ int ip6tables_restore_main(int argc, char *argv[])
> 			strncpy(curtable, table, XT_TABLE_MAXNAMELEN);
> 			curtable[XT_TABLE_MAXNAMELEN] = '\0';
> 
>-			if (tablename != NULL && strcmp(tablename, table) != 0)
>+			if (tablename != NULL && strcmp(tablename, table) != 0) {
>+				if (lock >= 0) {
>+					xtables_unlock(lock);
>+					lock = XT_LOCK_NOT_ACQUIRED;
>+				}
> 				continue;
>+			}
> 			if (handle)
> 				ops->free(handle);
> 
>diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
>index 39198752..190a990f 100644
>--- a/iptables/iptables-restore.c
>+++ b/iptables/iptables-restore.c
>@@ -97,7 +97,7 @@ static int parse_counters(char *string, struct xt_counters *ctr)
> static char *newargv[255];
> static int newargc;
> 
>-/* function adding one argument to newargv, updating newargc 
>+/* function adding one argument to newargv, updating newargc
>  * returns true if argument added, false otherwise */
> static int add_argv(char *what) {
> 	DEBUGP("add_argv: %s\n", what);
>@@ -323,8 +323,13 @@ iptables_restore_main(int argc, char *argv[])
> 			strncpy(curtable, table, XT_TABLE_MAXNAMELEN);
> 			curtable[XT_TABLE_MAXNAMELEN] = '\0';
> 
>-			if (tablename && (strcmp(tablename, table) != 0))
>+			if (tablename && (strcmp(tablename, table) != 0)) {
>+				if (lock >= 0) {
>+					xtables_unlock(lock);
>+					lock = XT_LOCK_NOT_ACQUIRED;
>+				}
> 				continue;
>+			}
> 			if (handle)
> 				ops->free(handle);
> 
>diff --git a/iptables/tests/shell/testcases/ipt-restore/0001load-specific-table_0 b/iptables/tests/shell/testcases/ipt-restore/0001load-specific-table_0
>new file mode 100755
>index 00000000..56d2d966
>--- /dev/null
>+++ b/iptables/tests/shell/testcases/ipt-restore/0001load-specific-table_0
>@@ -0,0 +1,42 @@
>+#!/bin/bash
>+# vim: syntax=sh:noexpandtab:sw=4:ts=4:sts=4
>+
>+RET=0
>+tmpfile=""
>+
>+set -x
>+
>+clean_tempfile()
>+{
>+	if [ -n "${tmpfile}" ]; then
>+		rm -f "${tmpfile}"
>+	fi
>+}
>+
>+trap clean_tempfile EXIT
>+
>+tmpfile=$(mktemp) || exit 1
>+
>+do_simple()
>+{
>+	iptables="${1}"
>+	table="${2}"
>+	dumpfile="$(dirname "${0}")/dumps/${iptables}.dump"
>+
>+	"$XT_MULTI" "${iptables}-restore" --table="${table}" <"${dumpfile}"; rv=$?
>+
>+	if [ "${rv}" -ne 0 ]; then
>+		RET=1
>+	fi
>+}
>+
>+do_simple "iptables" "filter"
>+do_simple "iptables" "mangle"
>+do_simple "iptables" "raw"
>+do_simple "iptables" "nat"
>+do_simple "ip6tables" "filter"
>+do_simple "ip6tables" "mangle"
>+do_simple "ip6tables" "raw"
>+do_simple "ip6tables" "nat"
>+
>+exit "${RET}"
>diff --git a/iptables/tests/shell/testcases/ipt-restore/dumps/ip6tables.dump b/iptables/tests/shell/testcases/ipt-restore/dumps/ip6tables.dump
>new file mode 100644
>index 00000000..4ac4f882
>--- /dev/null
>+++ b/iptables/tests/shell/testcases/ipt-restore/dumps/ip6tables.dump
>@@ -0,0 +1,30 @@
>+*nat
>+:PREROUTING ACCEPT [0:0]
>+:INPUT ACCEPT [0:0]
>+:OUTPUT ACCEPT [8:656]
>+:POSTROUTING ACCEPT [8:656]
>+COMMIT
>+
>+*mangle
>+:PREROUTING ACCEPT [794:190738]
>+:INPUT ACCEPT [794:190738]
>+:FORWARD ACCEPT [0:0]
>+:OUTPUT ACCEPT [991:170303]
>+:POSTROUTING ACCEPT [991:170303]
>+COMMIT
>+
>+*raw
>+:PREROUTING ACCEPT [794:190738]
>+:OUTPUT ACCEPT [991:170303]
>+COMMIT
>+
>+*filter
>+:INPUT DROP [0:0]
>+:FORWARD DROP [0:0]
>+:OUTPUT ACCEPT [991:170303]
>+-A INPUT -i lo -j ACCEPT
>+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>+-A INPUT -p ipv6-icmp -j ACCEPT
>+-A OUTPUT -p tcp -m tcp --dport 137 -j REJECT --reject-with icmp6-port-unreachable
>+-A OUTPUT -p udp -m udp --dport 137 -j REJECT --reject-with icmp6-port-unreachable
>+COMMIT
>diff --git a/iptables/tests/shell/testcases/ipt-restore/dumps/iptables.dump b/iptables/tests/shell/testcases/ipt-restore/dumps/iptables.dump
>new file mode 100644
>index 00000000..6e4e42d3
>--- /dev/null
>+++ b/iptables/tests/shell/testcases/ipt-restore/dumps/iptables.dump
>@@ -0,0 +1,30 @@
>+*nat
>+:PREROUTING ACCEPT [1:89]
>+:INPUT ACCEPT [0:0]
>+:OUTPUT ACCEPT [351:24945]
>+:POSTROUTING ACCEPT [351:24945]
>+COMMIT
>+
>+*mangle
>+:PREROUTING ACCEPT [3270:1513114]
>+:INPUT ACCEPT [3270:1513114]
>+:FORWARD ACCEPT [0:0]
>+:OUTPUT ACCEPT [3528:1087907]
>+:POSTROUTING ACCEPT [3546:1090751]
>+COMMIT
>+
>+*raw
>+:PREROUTING ACCEPT [3270:1513114]
>+:OUTPUT ACCEPT [3528:1087907]
>+COMMIT
>+
>+*filter
>+:INPUT DROP [37:4057]
>+:FORWARD DROP [0:0]
>+:OUTPUT ACCEPT [3528:1087907]
>+-A INPUT -i lo -j ACCEPT
>+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
>+-A INPUT -p icmp -j ACCEPT
>+-A OUTPUT -p tcp -m tcp --dport 137 -j REJECT --reject-with icmp-port-unreachable
>+-A OUTPUT -p udp -m udp --dport 137 -j REJECT --reject-with icmp-port-unreachable
>+COMMIT

Actions: View

Attachments on bug 1601609: 1459271 | 1459272 | 1459273