Reviewed-by: Michael Tremer michael.tremer@ipfire.org
On 18 Nov 2022, at 22:50, Adolf Belka adolf.belka@ipfire.org wrote:
- Update from version 1.0.8 to 1.0.9
- Update of rootfile
- Changelog 1.0.9
This release comes with the new nfct_nlmsg_build_filter() function that allows to add metadata for kernel-side filtering of conntrack entries during conntrack table dump. The nfct_query() API supports the new NFCT_Q_FLUSH_FILTER argument, it allows to flush only ipv4 or ipv6 entries from the connection tracking table. nfct_snprint family of functions have been updated. SCTP conntrack entries now support 'heartbeat sent/acked' state. Entries offloaded to hardware include '[HW_OFFLOAD]' in the formatted output string. Notable bugs fixed with this release include: Fix buffer overflows and out-of-bounds accesses in the nfct_snprintf() functions. nfct_nlmsg_build() did not work for ICMP flows unless all ICMP attributes were set in the reply tuple too, this affected the 'conntrack' tool where updates (e.g. setting the conntrack mark to a different value) of ICMP flows would not work.
- Detailed Changes src: Handle negative snprintf return values properly src: Fix nfexp_snprintf return value docs conntrack: Replace strncpy with snprintf to improve null byte handling conntrack: Fix incorrect snprintf size calculation include: Add ARRAY_SIZE() macro conntrack: Fix buffer overflow on invalid icmp type in setters conntrack: Move icmp request>reply type mapping to common file conntrack: Fix buffer overflow in protocol related snprintf functions conntrack: Fix buffer overflows in __snprintf_protoinfo* like in *2str fns examples: check return value of nfct_nlmsg_build() libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private conntrack: dccp print function should use dccp state conntrack: sctp: update states include: add CTA_STATS_CLASH_RESOLVE include: sync uapi header with nf-next src: add support for status dump filter include: add CTA_STATS_CHAIN_TOOLONG from linux 5.15 uapi libnetfilter_conntrack: bump version to 1.0.9 build: use the right automake variables Update .gitignore build: update obsolete autoconf macros conntrack: fix invmap_icmpv6 entries conntrack: Don't use ICMP attrs in decision to build repl tuple src: add IPS_HW_OFFLOAD flag conntrack: add flush filter command build: missing internal/proto.h in Makefile.am conntrack: add nfct_nlmsg_build_filter() helper conntrack: don't cancel nest on unknown layer 4 protocols tests: Fix for missing qa-connlabel.conf in tarball tests: Add simple tests to TESTS variable
Signed-off-by: Adolf Belka adolf.belka@ipfire.org
config/rootfiles/common/libnetfilter_conntrack | 2 +- lfs/libnetfilter_conntrack | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/config/rootfiles/common/libnetfilter_conntrack b/config/rootfiles/common/libnetfilter_conntrack index f5c776359..755ca8f2f 100644 --- a/config/rootfiles/common/libnetfilter_conntrack +++ b/config/rootfiles/common/libnetfilter_conntrack @@ -12,5 +12,5 @@ #usr/lib/libnetfilter_conntrack.la #usr/lib/libnetfilter_conntrack.so usr/lib/libnetfilter_conntrack.so.3 -usr/lib/libnetfilter_conntrack.so.3.7.0 +usr/lib/libnetfilter_conntrack.so.3.8.0 #usr/lib/pkgconfig/libnetfilter_conntrack.pc diff --git a/lfs/libnetfilter_conntrack b/lfs/libnetfilter_conntrack index 2eb00fb6f..3141606fe 100644 --- a/lfs/libnetfilter_conntrack +++ b/lfs/libnetfilter_conntrack @@ -24,7 +24,7 @@
include Config
-VER = 1.0.8 +VER = 1.0.9
THISAPP = libnetfilter_conntrack-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 614f8d80863d6f7d8110b5faf68debe3a9ba0c6737f02fa0de9d0e53d30771581becb052e7cd990b0632e9264cb9cdeb2af26a41e2b1ab9421218ec616e1f8d8 +$(DL_FILE)_BLAKE2 = 701393338a0bf852b97d80a1e4ab078dea741f7181246b3dafcbe8cff287b5b9fae72c1c50867ea71baab83fa842471b2c7054fb4702bf35900a352078de8f3a
install : $(TARGET)
-- 2.38.1