d/patches: add 0000-upstream-fix-restore-noflush.patch

Include patch from upstream:

https://git.netfilter.org/iptables/commit/?id=a103fbfadf4c17b8b12caa57eef72deaaa71a18c



Closes: #946289
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

debian/patches/0000-upstream-fix-restore-noflush.patch

+From a103fbfadf4c17b8b12caa57eef72deaaa71a18c Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 4 Dec 2019 09:56:06 +0100
+Subject: xtables-restore: Fix parser feed from line buffer
+
+When called with --noflush, xtables-restore would trip over chain lines:
+Parser uses strtok() to separate chain name, policy and counters which
+inserts nul-chars into the source string. Therefore strlen() can't be
+used anymore to find end of line. Fix this by caching line length before
+calling xtables_restore_parse_line().
+
+Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ .../tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 | 10 ++++++++++
+ iptables/xtables-restore.c                                     |  4 +++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+ create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+new file mode 100755
+index 00000000..739e684a
+--- /dev/null
++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+@@ -0,0 +1,10 @@
++#!/bin/sh -e
++
++# assert input feed from buffer doesn't trip over
++# added nul-chars from parsing chain line.
++
++$XT_MULTI iptables-restore --noflush <<EOF
++*filter
++:foobar - [0:0]
++-A foobar -j ACCEPT
++COMMIT
+diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
+index 2f0fe7d4..dd907e0b 100644
+--- a/iptables/xtables-restore.c
++++ b/iptables/xtables-restore.c
+@@ -327,10 +327,12 @@ void xtables_restore_parse(struct nft_handle *h,
+ 	line = 0;
+ 	ptr = preload_buffer;
+ 	while (*ptr) {
++		size_t len = strlen(ptr);
++
+ 		h->error.lineno = ++line;
+ 		DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr);
+ 		xtables_restore_parse_line(h, p, &state, ptr);
+-		ptr += strlen(ptr) + 1;
++		ptr += len + 1;
+ 	}
+ 	if (*buffer) {
+ 		h->error.lineno = ++line;
+-- 
+cgit v1.2.1
+

debian/patches/series

 0000-upstream-bump-build-dep-libnftnl.patch
+0000-upstream-fix-restore-noflush.patch
 0101-changelog.patch
 0103-lintian_allows_to.patch
 0104-lintian_hyphens.patch