Re: [PATCH 2/2] libnetfilter_conntrack: Update to version 1.0.9

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 4462 bytes --]

Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 18 Nov 2022, at 22:50, Adolf Belka <adolf.belka(a)ipfire.org> wrote:
> 
> - Update from version 1.0.8 to 1.0.9
> - Update of rootfile
> - Changelog
>    1.0.9
> This release comes with the new nfct_nlmsg_build_filter() function that
> allows to add metadata for kernel-side filtering of conntrack entries
> during conntrack table dump.
> The nfct_query() API supports the new NFCT_Q_FLUSH_FILTER argument,
> it allows to flush only ipv4 or ipv6 entries from the connection
> tracking table.
> nfct_snprint family of functions have been updated.
> SCTP conntrack entries now support 'heartbeat sent/acked' state.
> Entries offloaded to hardware include '[HW_OFFLOAD]' in the formatted
> output string.
> Notable bugs fixed with this release include:
> Fix buffer overflows and out-of-bounds accesses in the
> nfct_snprintf() functions.
> nfct_nlmsg_build() did not work for ICMP flows unless all ICMP attributes
> were set in the reply tuple too, this affected the 'conntrack' tool
> where updates (e.g. setting the conntrack mark to a different value)
> of ICMP flows would not work.
> - Detailed Changes
>      src: Handle negative snprintf return values properly
>      src: Fix nfexp_snprintf return value docs
>      conntrack: Replace strncpy with snprintf to improve null byte handling
>      conntrack: Fix incorrect snprintf size calculation
>      include: Add ARRAY_SIZE() macro
>      conntrack: Fix buffer overflow on invalid icmp type in setters
>      conntrack: Move icmp request>reply type mapping to common file
>      conntrack: Fix buffer overflow in protocol related snprintf functions
>      conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fns
>      examples: check return value of nfct_nlmsg_build()
>      libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private
>      conntrack: dccp print function should use dccp state
>      conntrack: sctp: update states
>      include: add CTA_STATS_CLASH_RESOLVE
>      include: sync uapi header with nf-next
>      src: add support for status dump filter
>      include: add CTA_STATS_CHAIN_TOOLONG from linux 5.15 uapi
>      libnetfilter_conntrack: bump version to 1.0.9
>      build: use the right automake variables
>      Update .gitignore
>      build: update obsolete autoconf macros
>      conntrack: fix invmap_icmpv6 entries
>      conntrack: Don't use ICMP attrs in decision to build repl tuple
>      src: add IPS_HW_OFFLOAD flag
>      conntrack: add flush filter command
>      build: missing internal/proto.h in Makefile.am
>      conntrack: add nfct_nlmsg_build_filter() helper
>      conntrack: don't cancel nest on unknown layer 4 protocols
>      tests: Fix for missing qa-connlabel.conf in tarball
>      tests: Add simple tests to TESTS variable
> 
> Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
> ---
> config/rootfiles/common/libnetfilter_conntrack | 2 +-
> lfs/libnetfilter_conntrack                     | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/config/rootfiles/common/libnetfilter_conntrack b/config/rootfiles/common/libnetfilter_conntrack
> index f5c776359..755ca8f2f 100644
> --- a/config/rootfiles/common/libnetfilter_conntrack
> +++ b/config/rootfiles/common/libnetfilter_conntrack
> @@ -12,5 +12,5 @@
> #usr/lib/libnetfilter_conntrack.la
> #usr/lib/libnetfilter_conntrack.so
> usr/lib/libnetfilter_conntrack.so.3
> -usr/lib/libnetfilter_conntrack.so.3.7.0
> +usr/lib/libnetfilter_conntrack.so.3.8.0
> #usr/lib/pkgconfig/libnetfilter_conntrack.pc
> diff --git a/lfs/libnetfilter_conntrack b/lfs/libnetfilter_conntrack
> index 2eb00fb6f..3141606fe 100644
> --- a/lfs/libnetfilter_conntrack
> +++ b/lfs/libnetfilter_conntrack
> @@ -24,7 +24,7 @@
> 
> include Config
> 
> -VER        = 1.0.8
> +VER        = 1.0.9
> 
> THISAPP    = libnetfilter_conntrack-$(VER)
> DL_FILE    = $(THISAPP).tar.bz2
> @@ -40,7 +40,7 @@ objects = $(DL_FILE)
> 
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> 
> -$(DL_FILE)_BLAKE2 = 614f8d80863d6f7d8110b5faf68debe3a9ba0c6737f02fa0de9d0e53d30771581becb052e7cd990b0632e9264cb9cdeb2af26a41e2b1ab9421218ec616e1f8d8
> +$(DL_FILE)_BLAKE2 = 701393338a0bf852b97d80a1e4ab078dea741f7181246b3dafcbe8cff287b5b9fae72c1c50867ea71baab83fa842471b2c7054fb4702bf35900a352078de8f3a
> 
> install : $(TARGET)
> 
> -- 
> 2.38.1
>