netdev - [ANNOUNCE] iptables 1.8.11 release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Zy4nCFxZvkkUrjj6@orbyte.nwl.cc>
Date: Fri, 8 Nov 2024 15:58:16 +0100
From: Phil Sutter <phil@...filter.org>
To: netfilter <netfilter@...r.kernel.org>,
	netfilter-devel <netfilter-devel@...r.kernel.org>
Cc: netdev@...r.kernel.org, netfilter-announce@...ts.netfilter.org,
	lwn@....net
Subject: [ANNOUNCE] iptables 1.8.11 release

Hi!

The Netfilter project proudly presents:

        iptables 1.8.11

This release contains new features:

- New arptables-translate tool
- ebtables-nft:
  - Support for --change-counters command, albeit not atomic
  - Specify rule counters using iptables' '-c N,M' syntax
  - Support --replace and --list-rules commands
  - Support zeroing individual rules
  - Print negations (exclamation marks) extrapositioned (i.e., before
    the match they invert) for consistency with iptables
- iptables-translate:
  - Align protocol name lookups with iptables
  - iptables-translate: Support socket match and TPROXY target
  - iptables-translate: Slightly improved avoidance of redundant 'ip
    protocol'/'meta l4proto' matches
- iptables:
  - Undo numeric protocol printing of v1.8.9 for well-known protocols
    for consistency with iptables-save
  - Enable implicit extension lookup for dccp and ipcomp protocols (so
    no extra '-m <proto>' is needed after '-p <proto>')
- iptables-save: Avoid calls to getprotobynumber() for consistency and
  improved performance with huge rule sets
- libxtables: Support use of both xtables_ipaddr_to_numeric() and
  xtables_ipmask_to_numeric() as parameters to the same function call
- configure: Support disabling use of libnfnetlink
- Prefix xtables-monitor rule events by a typical command (iptables,
  ip6tables) instead of -4/-6 flags for consistency with ebtables and
  arptables events

... and fixes:

- arptables-nft:
  - Ineffective masks when specified in --h-type, --opcode and
    --proto-type matches
  - Wrong formatting of --h-type values and --proto-type masks causing
    misinterpretation by  arptables-restore
- iptables-nft:
  - Wrong error messages in corner-case error conditions
  - Zeroing single rule counters broken (again!)
  - Incorrect combination of inverted payload matches
  - Spurious error when zeroing a specific builtin chain which doesn't
    exist - Calling -Z command with bogus rule number must fail
- libiptc: Corner-case segfault upon renaming a chain
- ebtables-restore:
  - Corner-case bug with --noflush
  - Spurious failures when deleting multiple rules with among matches
- ebtables-nft:
  - Different line number (--Ln) formatting than ebtables-legacy
  - Off-by-one rule number when using -S command with rule number
- iptables-legacy: Broken --wait without timeout
- libxtables: Leak of matches' udata buffer
- Some matches stripped full value ranges from output even if inverted
- Illegal memory access when parsing '-c ""' (i.e., empty string
  argument)
- Inverted full interface wildcards (e.g. '! -i +') stripped from
  iptables-save output
- xtables-monitor:
  - Incorrect output when not called with -4 or -6 options
  - Flush stdout after each line to prevent buffers and help with
    scripting
  - Align output for builtin chains with that of tables
  - Capture arptables chain events, too
  - Empty 'EVENT:' lines printed for ebtables rule changes
- Fix for compiling against musl libc
- xtables-translate: Fix translation of TPROXY target

... and documentation updates:

- Extensions: string: Starting with linux-6.7, pattern matching no
  longer extends past 'to' offset - update the man page accordingly
- Extensions: recent: Clarify ip_list_hash_size default value and
  obsoleted state of ip_pkt_list_tot
- ebtables-nft.8: Note that --concurrent is a NOP
- Misc. typesetting, spelling and grammar fixes in man pages

You can download the new release from:

https://netfilter.org/projects/iptables/downloads.html#iptables-1.8.11

To build the code, libnftnl 1.2.6 is required:

* http://netfilter.org/projects/libnftnl/downloads.html#libnftnl-1.2.6

In case of bugs, file them via:

* https://bugzilla.netfilter.org

Happy firewalling!

View attachment "changes-iptables-1.8.11.txt" of type "text/plain" (10278 bytes)