diff --git a/SOURCES/arptables-0.0.4-covscan_fix01_simple.patch b/SOURCES/arptables-0.0.4-covscan_fix01_simple.patch
new file mode 100644
index 0000000..9c12c97
--- /dev/null
+++ b/SOURCES/arptables-0.0.4-covscan_fix01_simple.patch
@@ -0,0 +1,24 @@
+commit 461c0674967504fafe7feb7631c51e7fceb67753
+Author: Jaromír Končický <jkoncick@redhat.com>
+Date: Tue Oct 15 21:40:20 2013 +0200
+
+ make static analysis tool happy (false positive)
+
+diff --git a/userspace/arptables/arptables.c b/userspace/arptables/arptables.c
+index 5535ab2..8ef445a 100644
+--- a/userspace/arptables/arptables.c
++++ b/userspace/arptables/arptables.c
+@@ -1668,10 +1668,12 @@ static char *get_modprobe(void)
+
+ ret = malloc(1024);
+ if (ret) {
+- switch (read(procfile, ret, 1024)) {
++ int read_bytes = read(procfile, ret, 1024);
++ switch (read_bytes) {
+ case -1: goto fail;
+ case 1024: goto fail; /* Partial read. Wierd */
+ }
++ ret[read_bytes] = '\0';
+ if (ret[strlen(ret)-1]=='\n')
+ ret[strlen(ret)-1]=0;
+ close(procfile);
diff --git a/SOURCES/arptables-0.0.4-covscan_fix02_buf_overflow.patch b/SOURCES/arptables-0.0.4-covscan_fix02_buf_overflow.patch
new file mode 100644
index 0000000..b6d2cc3
--- /dev/null
+++ b/SOURCES/arptables-0.0.4-covscan_fix02_buf_overflow.patch
@@ -0,0 +1,88 @@
+commit fea55b0930d7cb67a3359185e53ef6b856b7721d
+Author: Jaromír Končický <jkoncick@redhat.com>
+Date: Tue Oct 15 21:55:52 2013 +0200
+
+ fix potential buffer overflows reported by static analysis
+
+diff --git a/userspace/arptables/arptables.c b/userspace/arptables/arptables.c
+index 8ef445a..4da6fea 100644
+--- a/userspace/arptables/arptables.c
++++ b/userspace/arptables/arptables.c
+@@ -1270,7 +1270,7 @@ print_firewall(const struct arpt_entry *fw,
+ sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
+ else
+ sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
+- strcat(buf, mask_to_dotted(&(fw->arp.smsk)));
++ strncat(buf, mask_to_dotted(&(fw->arp.smsk)), sizeof(buf) - strlen(buf) -1);
+ printf("-s %s ", buf);
+ }
+
+@@ -1294,7 +1294,7 @@ after_devsrc:
+ sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
+ else
+ sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
+- strcat(buf, mask_to_dotted(&(fw->arp.tmsk)));
++ strncat(buf, mask_to_dotted(&(fw->arp.tmsk)), sizeof(buf) - strlen(buf) -1);
+ printf("-d %s ", buf);
+ }
+
+@@ -1796,7 +1796,7 @@ int do_command(int argc, char *argv[], char **table, arptc_handle_t *handle)
+ *table, arptc_strerror(errno));
+ }
+ }
+- }
++ }
+
+ memset(&fw, 0, sizeof(fw));
+ opts = original_opts;
+@@ -2064,7 +2064,8 @@ int do_command(int argc, char *argv[], char **table, arptc_handle_t *handle)
+
+ target->t = fw_calloc(1, size);
+ target->t->u.target_size = size;
+- strcpy(target->t->u.user.name, jumpto);
++ strncpy(target->t->u.user.name, jumpto, sizeof(target->t->u.user.name));
++ target->t->u.user.name[sizeof(target->t->u.user.name)-1] = '\0';
+ /*
+ target->init(target->t, &fw.nfcache);
+ */
+diff --git a/userspace/arptables/libarptc/libarptc_incl.c b/userspace/arptables/libarptc/libarptc_incl.c
+index 2fa3d43..9c1aeac 100644
+--- a/userspace/arptables/libarptc/libarptc_incl.c
++++ b/userspace/arptables/libarptc/libarptc_incl.c
+@@ -209,8 +209,10 @@ alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules)
+ h->counter_map = (void *)h
+ + sizeof(STRUCT_TC_HANDLE)
+ + size;
+- strcpy(h->info.name, tablename);
+- strcpy(h->entries.name, tablename);
++ strncpy(h->info.name, tablename, sizeof(h->info.name));
++ h->info.name[sizeof(h->info.name)-1] = '\0';
++ strncpy(h->entries.name, tablename, sizeof(h->entries.name));
++ h->entries.name[sizeof(h->entries.name)-1] = '\0';
+
+ return h;
+ }
+@@ -357,8 +359,9 @@ add_chain(STRUCT_ENTRY *e, TC_HANDLE_T h, STRUCT_ENTRY **prev)
+ h->cache_chain_heads[h->cache_num_chains-1].end
+ = *prev;
+
+- strcpy(h->cache_chain_heads[h->cache_num_chains].name,
+- (const char *)GET_TARGET(e)->data);
++ strncpy(h->cache_chain_heads[h->cache_num_chains].name,
++ (const char *)GET_TARGET(e)->data, TABLE_MAXNAMELEN-1);
++ h->cache_chain_heads[h->cache_num_chains].name[TABLE_MAXNAMELEN-1] = '\0';
+ h->cache_chain_heads[h->cache_num_chains].start
+ = (void *)e + e->next_offset;
+ h->cache_num_chains++;
+@@ -368,8 +371,9 @@ add_chain(STRUCT_ENTRY *e, TC_HANDLE_T h, STRUCT_ENTRY **prev)
+ h->cache_chain_heads[h->cache_num_chains-1].end
+ = *prev;
+
+- strcpy(h->cache_chain_heads[h->cache_num_chains].name,
+- h->hooknames[builtin-1]);
++ strncpy(h->cache_chain_heads[h->cache_num_chains].name,
++ h->hooknames[builtin-1], TABLE_MAXNAMELEN-1);
++ h->cache_chain_heads[h->cache_num_chains].name[TABLE_MAXNAMELEN-1] = '\0';
+ h->cache_chain_heads[h->cache_num_chains].start
+ = (void *)e;
+ h->cache_num_chains++;
diff --git a/SOURCES/arptables-0.0.4-man-install.patch b/SOURCES/arptables-0.0.4-man-install.patch
new file mode 100644
index 0000000..cd55148
--- /dev/null
+++ b/SOURCES/arptables-0.0.4-man-install.patch
@@ -0,0 +1,55 @@
+commit 42notupstreamyet
+Author: Jesper Dangaard Brouer <brouer@redhat.com>
+Date: Thu Nov 14 13:37:39 2013 +0100
+
+ arptables: Add man pages for arptables-{save,restore}
+
+ Also fixed up the Makefile to install these man pages.
+
+ Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+
+
+diff --git a/userspace/arptables/Makefile b/userspace/arptables/Makefile
+index 38158d9..7bead0d 100644
+--- a/userspace/arptables/Makefile
++++ b/userspace/arptables/Makefile
+@@ -6,10 +6,13 @@ PREFIX:=/usr/local
+ LIBDIR:=$(PREFIX)/lib
+ BINDIR:=$(PREFIX)/sbin
+ MANDIR:=$(PREFIX)/man
++man8dir=$(MANDIR)/man8
+ INITDIR:=/etc/rc.d/init.d
+ SYSCONFIGDIR:=/etc/sysconfig
+ DESTDIR:=
+
++MANS = arptables.8 arptables-save.8 arptables-restore.8
++
+ COPT_FLAGS:=-O2
+ CFLAGS:=$(COPT_FLAGS) -Wall -Wunused -I$(KERNEL_DIR)/include/ -Iinclude/ -DARPTABLES_VERSION=\"$(ARPTABLES_VERSION)\" #-g -DDEBUG #-pg # -DARPTC_DEBUG
+
+@@ -36,10 +39,6 @@ libarptc/libarptc.a: libarptc/libarptc.o
+ arptables: arptables-standalone.o arptables.o libarptc/libarptc.o $(EXT_OBJS)
+ $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
+
+-$(DESTDIR)$(MANDIR)/man8/arptables.8: arptables.8
+- mkdir -p $(@D)
+- install -m 0644 $< $@
+-
+ $(DESTDIR)$(BINDIR)/arptables: arptables
+ mkdir -p $(DESTDIR)$(BINDIR)
+ install -m 0755 $< $@
+@@ -57,8 +56,13 @@ scripts: arptables-save arptables-restore arptables.sysv
+ if test -d $(DESTDIR)$(INITDIR); then install -m 0755 arptables.sysv_ $(DESTDIR)$(INITDIR)/arptables; fi
+ rm -f arptables-save_ arptables-restore_ arptables.sysv_
+
++.PHONY: install-man
++install-man: $(MANS)
++ [ -d "$(DESTDIR)$(man8dir)" ] || mkdir -p "$(DESTDIR)$(man8dir)"
++ install -m 0644 $^ $(DESTDIR)$(man8dir)/
++
+ .PHONY: install
+-install: $(DESTDIR)$(MANDIR)/man8/arptables.8 $(DESTDIR)$(BINDIR)/arptables scripts
++install: install-man $(DESTDIR)$(BINDIR)/arptables scripts
+
+ .PHONY: clean
+ clean:
diff --git a/SOURCES/arptables-restore.8 b/SOURCES/arptables-restore.8
new file mode 100644
index 0000000..4f2f623
--- /dev/null
+++ b/SOURCES/arptables-restore.8
@@ -0,0 +1,41 @@
+.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" ""
+.\"
+.\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
+.\" Man page written by Harald Welte <laforge@gnumonks.org>
+.\" It is based on the iptables-restore man page.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation; either version 2 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful,
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+.\" GNU General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program; if not, write to the Free Software
+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+.\"
+.\"
+.SH NAME
+arptables-restore \(em Restore ARP Tables
+.SH SYNOPSIS
+\fBarptables\-restore
+.SH DESCRIPTION
+.PP
+.B arptables-restore
+is used to restore ARP Tables from data specified on STDIN or
+via a file as first argument.
+Use I/O redirection provided by your shell to read from a file
+.TP
+.B arptables-restore
+flushes (deletes) all previous contents of the respective ARP Table.
+.SH BUGS
+None known as of arptables-0.0.4 release
+.SH AUTHOR
+Jesper Dangaard Brouer <brouer@redhat.com>
+.SH SEE ALSO
+\fBarptables\-save\fP(8), \fBarptables\fP(8)
+.PP
diff --git a/SOURCES/arptables-save.8 b/SOURCES/arptables-save.8
new file mode 100644
index 0000000..34791a9
--- /dev/null
+++ b/SOURCES/arptables-save.8
@@ -0,0 +1,37 @@
+.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" ""
+.\"
+.\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
+.\" Man page written by Harald Welte <laforge@gnumonks.org>
+.\" It is based on the iptables-save man page.
+.\"
+.\" This program is free software; you can redistribute it and/or modify
+.\" it under the terms of the GNU General Public License as published by
+.\" the Free Software Foundation; either version 2 of the License, or
+.\" (at your option) any later version.
+.\"
+.\" This program is distributed in the hope that it will be useful,
+.\" but WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+.\" GNU General Public License for more details.
+.\"
+.\" You should have received a copy of the GNU General Public License
+.\" along with this program; if not, write to the Free Software
+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+.\"
+.\"
+.SH NAME
+arptables-save \(em dump arptables rules to stdout
+.SH SYNOPSIS
+\fBarptables\-save
+.SH DESCRIPTION
+.PP
+.B arptables-save
+is used to dump the contents of an ARP Table in easily parseable format
+to STDOUT. Use I/O-redirection provided by your shell to write to a file.
+.SH BUGS
+None known as of arptables-0.0.4 release
+.SH AUTHOR
+Jesper Dangaard Brouer <brouer@redhat.com>
+.SH SEE ALSO
+\fBarptables\-restore\fP(8), \fBarptables\fP(8)
+.PP
diff --git a/SPECS/arptables.spec b/SPECS/arptables.spec
index f4db657..2689112 100644
--- a/SPECS/arptables.spec
+++ b/SPECS/arptables.spec
@@ -1,7 +1,7 @@
Summary: User space tool to set up tables of ARP rules in kernel
Name: arptables
Version: 0.0.4
-Release: 4%{?dist}
+Release: 7%{?dist}
License: GPLv2+
Group: System Environment/Base
@@ -12,6 +12,12 @@ Source2: arptables-helper
# http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
# http://marc.info/?l=netfilter-devel&m=137908241011194&w=2
Source3: COPYING
+Source4: arptables-save.8
+Source5: arptables-restore.8
+
+Patch1: arptables-0.0.4-covscan_fix01_simple.patch
+Patch2: arptables-0.0.4-covscan_fix02_buf_overflow.patch
+Patch3: arptables-0.0.4-man-install.patch
BuildRequires: systemd
Requires(post): systemd
@@ -29,8 +35,13 @@ user space tool, but is less complicated.
%prep
%setup -q -n arptables-v%{version}
+%patch1 -p3 -b .covscan_fix01_simple
+%patch2 -p3 -b .covscan_fix02_buf_overflow
+%patch3 -p3 -b .man-install
cp %{SOURCE3} COPYING
+cp %{SOURCE4} .
+cp %{SOURCE5} .
%build
# Makefile uses $(KERNEL_DIR) to redefine where to look for header files.
@@ -68,6 +79,18 @@ echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
%config(noreplace) %{_sysconfdir}/sysconfig/arptables
%changelog
+* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 0.0.4-7
+- Mass rebuild 2014-01-24
+
+* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 0.0.4-6
+- Mass rebuild 2013-12-27
+
+* Thu Nov 14 2013 Jesper Dangaard Brouer <brouer@redhat.com> - 0.0.4-5
+- fix issues reported by static analysis tools
+ Resolves: rhbz#1027762
+- add man-pages for arptables-{save,restore}
+ Resolves: rhbz#1025726
+
* Mon Sep 16 2013 Jiri Popelka <jpopelka@redhat.com> - 0.0.4-4
- revert previous change, the code is not ready for this