From c8015c16af9b2260f1fda5ccd6920774fc4d2efc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 26 Mar 2025 14:03:28 -0400 Subject: [PATCH 01/23] Flatpak fix for "Keep alternatives symlinks under /usr/sbin" Even if specific %_*dir macros cannot be used, %_prefix must be used at a minimum to refer to the installation path of files from the given package. This is a requirement for flatpak builds. --- iptables.spec | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/iptables.spec b/iptables.spec index b170a43..f211aa9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -65,7 +65,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -156,7 +156,7 @@ Provides: iptables Provides: arptables Provides: ebtables -%sbin_merge_compat /usr/sbin/iptables +%sbin_merge_compat %{_prefix}/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -238,15 +238,15 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %if "%{_sbindir}" == "%{_bindir}" # We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +mkdir -p %{buildroot}%{_prefix}/sbin +mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ %endif %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -258,7 +258,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -271,8 +271,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,8 +297,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -307,7 +307,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -323,7 +323,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -349,7 +349,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -361,7 +361,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -422,8 +422,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From a1603c18de94a6d18aa110c640ea27941ca5927c Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 2 Apr 2025 15:01:46 +0200 Subject: [PATCH 02/23] Assimilate arptables-services Provide the service as part of iptables-services. The arptables-nft-helper was already quite similar to arptables-legacy-helper, it should serve fine for legacy arptables, too. --- arptables-nft-helper => arptables-helper | 0 arptables.service | 12 +++++++++ iptables.spec | 32 ++++++++++++++---------- 3 files changed, 31 insertions(+), 13 deletions(-) rename arptables-nft-helper => arptables-helper (100%) create mode 100644 arptables.service diff --git a/arptables-nft-helper b/arptables-helper similarity index 100% rename from arptables-nft-helper rename to arptables-helper diff --git a/arptables.service b/arptables.service new file mode 100644 index 0000000..df6c7d6 --- /dev/null +++ b/arptables.service @@ -0,0 +1,12 @@ +[Unit] +Description=Automates a packet filtering firewall with arptables +After=network.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/arptables-helper start +ExecStop=/usr/libexec/arptables-helper stop +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index f211aa9..d195a2c 100644 --- a/iptables.spec +++ b/iptables.spec @@ -20,7 +20,8 @@ Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-nft-helper +Source8: arptables-helper +Source9: arptables.service # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -125,6 +126,10 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 +# Look at me, I'm the new arptables-services now! +Conflicts: %{name}-nft < 1.8.11-5 +Obsoletes: arptables-services < 0.0.5-16 +Provides: arptables-services = %{version}-%{release} BuildArch: noarch %description services @@ -155,6 +160,9 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables +# allowing old arptables-legacy will break when switching alternatives +# due to the dropped arptables-helper symlink +Conflicts: arptables-legacy < 0.0.5-16 %sbin_merge_compat %{_prefix}/sbin/iptables @@ -188,16 +196,18 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init +install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables +echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -224,9 +234,6 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes -install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ -touch %{buildroot}%{_libexecdir}/arptables-helper - # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 @@ -285,14 +292,14 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post iptables.service ip6tables.service +%systemd_post arptables.service iptables.service ip6tables.service %preun services -%systemd_preun iptables.service ip6tables.service +%systemd_preun arptables.service iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun iptables.service ip6tables.service +%systemd_postun arptables.service iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -343,8 +350,7 @@ update-alternatives --install \ --slave $pfx-restore arptables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ - --slave $lepfx-helper arptables-helper $lepfx-nft-helper + ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} %postun nft if [ $1 -eq 0 ]; then @@ -390,9 +396,11 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%{_unitdir}/ip{,6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/arptables +%{_unitdir}/{arp,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} +%{_libexecdir}/arptables-helper %files utils %license COPYING @@ -415,7 +423,6 @@ fi %{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* -%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* @@ -424,7 +431,6 @@ fi %{_mandir}/man8/arptables-translate* %ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} -%ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From 347e497e7205a827bf52674e20c05d5595c100e0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 02:05:13 +0200 Subject: [PATCH 03/23] Assimilate ebtables-services Provide the service as part of iptables-services. --- ebtables-config | 11 +++++ ebtables-helper | 102 +++++++++++++++++++++++++++++++++++++++++++++++ ebtables.service | 11 +++++ iptables.spec | 28 +++++++++---- 4 files changed, 145 insertions(+), 7 deletions(-) create mode 100644 ebtables-config create mode 100644 ebtables-helper create mode 100644 ebtables.service diff --git a/ebtables-config b/ebtables-config new file mode 100644 index 0000000..69d9289 --- /dev/null +++ b/ebtables-config @@ -0,0 +1,11 @@ +# Save current firewall rules on stop. +# Value: yes|no, default: no +# Saves all firewall rules if firewall gets stopped +# (e.g. on system shutdown). +EBTABLES_SAVE_ON_STOP="no" + +# Save (and restore) rule counters. +# Value: yes|no, default: no +# Save rule counters when saving a kernel table to a file. If the +# rule counters were saved, they will be restored when restoring the table. +EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper new file mode 100644 index 0000000..e63bd2b --- /dev/null +++ b/ebtables-helper @@ -0,0 +1,102 @@ +#!/bin/bash + +# compat for removed initscripts dependency + +success() { + echo "[ OK ]" + return 0 +} + +failure() { + echo "[FAILED]" + return 1 +} + +# internal variables +EBTABLES_CONFIG=/etc/sysconfig/ebtables-config +EBTABLES_DATA=/etc/sysconfig/ebtables +EBTABLES_TABLES="broute filter nat" +VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables + +# ebtables-config defaults +EBTABLES_SAVE_ON_STOP="no" +EBTABLES_SAVE_ON_RESTART="no" +EBTABLES_SAVE_COUNTER="no" + +# load config if existing +[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" + +initialize() { + local ret=0 + for table in $EBTABLES_TABLES; do + ebtables -t $table --init-table || ret=1 + done + return $ret +} + +sanitize_dump() { + local drop=false + + export EBTABLES_TABLES + + cat $1 | while read line; do + case $line in + \**) + drop=false + local table="${line#\*}" + local found=false + for t in $EBTABLES_TABLES; do + if [[ $t == $table ]]; then + found=true + break + fi + done + $found || drop=true + ;; + esac + $drop || echo "$line" + done +} + +start() { + if [ -f $EBTABLES_DATA ]; then + echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " + sanitize_dump $EBTABLES_DATA | ebtables-restore + else + echo -n $"ebtables: no stored ruleset, initializing empty tables: " + initialize + fi + local ret=$? + touch $VAR_SUBSYS_EBTABLES + return $ret +} + +save() { + echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " + export EBTABLES_SAVE_COUNTER + ebtables-save >$EBTABLES_DATA && success || failure +} + +case $1 in + start) + [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 + start && success || failure + RETVAL=$? + ;; + stop) + [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save + echo -n $"ebtables: stopping firewall: " + initialize && success || failure + RETVAL=$? + rm -f $VAR_SUBSYS_EBTABLES + ;; + save) + save + ;; + *) + echo "usage: ${0##*/} {start|stop|save}" >&2 + RETVAL=2 + ;; +esac + +exit $RETVAL diff --git a/ebtables.service b/ebtables.service new file mode 100644 index 0000000..b096f1d --- /dev/null +++ b/ebtables.service @@ -0,0 +1,11 @@ +[Unit] +Description=Ethernet Bridge Filtering tables + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/libexec/ebtables-helper start +ExecStop=/usr/libexec/ebtables-helper stop + +[Install] +WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index d195a2c..2144ee0 100644 --- a/iptables.spec +++ b/iptables.spec @@ -22,6 +22,9 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-helper Source9: arptables.service +Source10: ebtables.service +Source11: ebtables-helper +Source12: ebtables-config # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -130,6 +133,10 @@ Obsoletes: %{name}-ipv6 < 1.4.11.1 Conflicts: %{name}-nft < 1.8.11-5 Obsoletes: arptables-services < 0.0.5-16 Provides: arptables-services = %{version}-%{release} +# Look at me, I'm the new ebtables-services now! +# (With epoch to turn our version number higher value) +Obsoletes: ebtables-services < 2.0.11-20 +Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -196,7 +203,7 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init -install -p -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ +install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config @@ -204,10 +211,12 @@ install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6table install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables +install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ +touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{SOURCE9} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -292,14 +301,17 @@ rm /var/tmp/alternatives.iptables.current mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post services -%systemd_post arptables.service iptables.service ip6tables.service +%systemd_post arptables.service ebtables.service +%systemd_post iptables.service ip6tables.service %preun services -%systemd_preun arptables.service iptables.service ip6tables.service +%systemd_preun arptables.service ebtables.service +%systemd_preun iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun arptables.service iptables.service ip6tables.service +%systemd_postun arptables.service ebtables.service +%systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true @@ -397,10 +409,12 @@ fi %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} %config(noreplace) %{_sysconfdir}/sysconfig/arptables -%{_unitdir}/{arp,ip,ip6}tables.service +%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config +%ghost %{_sysconfdir}/sysconfig/ebtables +%{_unitdir}/{arp,eb,ip,ip6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} -%{_libexecdir}/arptables-helper +%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING From 45128b30b581863eee82c03977fd0d57cd301acc Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:50:18 +0200 Subject: [PATCH 04/23] rpmlint: Fix for E: description-line-too-long --- iptables.spec | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/iptables.spec b/iptables.spec index 2144ee0..ce9a1ee 100644 --- a/iptables.spec +++ b/iptables.spec @@ -93,9 +93,8 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real so version. - -For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real +so version. For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 From e71883b551ebfba9eb6cd16095612d43ad878547 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 3 Apr 2025 13:52:40 +0200 Subject: [PATCH 05/23] rpmlint: Fix for W: dangling-relative-symlink The %ghost directives in %files sections pick up the symlinks installed by the iptables build system, when in fact these are maintained in Fedora by alternatives. To avoid the confusion, remove them. To avoid causing 'W: zero-perms-ghost', add a %attr statement to the respective %ghost lines. --- iptables.spec | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/iptables.spec b/iptables.spec index ce9a1ee..5efa959 100644 --- a/iptables.spec +++ b/iptables.spec @@ -247,16 +247,11 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 +rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}%{_prefix}/sbin -mv %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}%{_prefix}/sbin/ -%endif - %ldconfig_scriptlets %post legacy @@ -378,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -442,8 +437,8 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz From b2d1af398f3799020bc82f5f71a999ccd9dba432 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 11:43:34 +0200 Subject: [PATCH 06/23] spec: Merge common non-symlink removal loops --- iptables.spec | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/iptables.spec b/iptables.spec index 5efa959..c8927c8 100644 --- a/iptables.spec +++ b/iptables.spec @@ -310,6 +310,23 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true +# remove non-symlinks in spots managed by alternatives +# to cover for updates from not-yet-alternatived versions +for pfx in %{_prefix}/sbin/{eb,arp}tables; do + for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + done +done +for manpfx in %{_mandir}/man8/{eb,arp}tables; do + for sfx in {,-restore,-save}.8.gz; do + if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then + rm -f $manpfx$sfx + fi + done +done + pfx=%{_prefix}/sbin/iptables pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ @@ -322,14 +339,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi -done -if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then - rm -f $manpfx.8.gz -fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --slave $pfx-save ebtables-save $pfx-nft-save \ @@ -338,18 +347,6 @@ update-alternatives --install \ pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables -lepfx=%{_libexecdir}/arptables -for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then - rm -f $manpfx$sfx.8.gz - fi -done -if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then - rm -f $lepfx-helper -fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --slave $pfx-save arptables-save $pfx-nft-save \ From ac4331ac14f14b40c09d5009ca958697c7b8d1a0 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Fri, 4 Apr 2025 13:15:57 +0200 Subject: [PATCH 07/23] iptables-1.8.11-5 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c8927c8..93641a9 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 4%{?dist} +Release: 5%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -441,6 +441,9 @@ fi %changelog +* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 +- iptables-services to assimilate arptables- and ebtables-services + * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From b56d83fa63cfe3b2db4f9d3f2e367b17cec36d23 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 20 Apr 2025 09:15:04 -0700 Subject: [PATCH 08/23] Add patch to fix -C handling ( fixes rhbz#2360423 ) --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ++++++++++++++++++ iptables.spec | 8 +- 2 files changed, 179 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index 93641a9..177c6fd 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 5%{?dist} +Release: 6%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -25,6 +25,9 @@ Source9: arptables.service Source10: ebtables.service Source11: ebtables-helper Source12: ebtables-config +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch: iptables-1.8.11-fix-interface-comparisons.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -441,6 +444,9 @@ fi %changelog +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + * Thu Apr 03 2025 Phil Sutter - 1.8.11-5 - iptables-services to assimilate arptables- and ebtables-services From 4ff93fe91442b368c136fb38ee8d1658f2da6e71 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 20 Apr 2025 09:23:41 -0700 Subject: [PATCH 09/23] Add patch to fix -C handling ( fixes rhbz#2360423 ) --- ...les-1.8.11-fix-interface-comparisons.patch | 172 ++++++++++++++++++ iptables.spec | 9 +- 2 files changed, 180 insertions(+), 1 deletion(-) create mode 100644 iptables-1.8.11-fix-interface-comparisons.patch diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch new file mode 100644 index 0000000..b038616 --- /dev/null +++ b/iptables-1.8.11-fix-interface-comparisons.patch @@ -0,0 +1,172 @@ +From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001 +From: Jeremy Sowden +Date: Mon, 18 Nov 2024 13:56:50 +0000 +Subject: nft: fix interface comparisons in `-C` commands + +Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from +kernel") removed code which explicitly set interface masks to all ones. The +result of this is that they are zero. However, they are used to mask interfaces +in `is_same_interfaces`. Consequently, the masked values are alway zero, the +comparisons are always true, and check commands which ought to fail succeed: + + # iptables -N test + # iptables -A test -i lo \! -o lo -j REJECT + # iptables -v -L test + Chain test (0 references) + pkts bytes target prot opt in out source destination + 0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable + # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT + REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable + +Remove the mask parameters from `is_same_interfaces`. Add a test-case. + +Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel") +Signed-off-by: Jeremy Sowden +Signed-off-by: Phil Sutter +--- + iptables/nft-arp.c | 10 ++---- + iptables/nft-ipv4.c | 4 +-- + iptables/nft-ipv6.c | 6 +--- + iptables/nft-shared.c | 36 +++++----------------- + iptables/nft-shared.h | 6 +--- + .../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++ + 6 files changed, 22 insertions(+), 49 deletions(-) + create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 + +diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c +index 264864c3..c11d64c3 100644 +--- a/iptables/nft-arp.c ++++ b/iptables/nft-arp.c +@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a, + return false; + } + +- return is_same_interfaces(a->arp.iniface, +- a->arp.outiface, +- (unsigned char *)a->arp.iniface_mask, +- (unsigned char *)a->arp.outiface_mask, +- b->arp.iniface, +- b->arp.outiface, +- (unsigned char *)b->arp.iniface_mask, +- (unsigned char *)b->arp.outiface_mask); ++ return is_same_interfaces(a->arp.iniface, a->arp.outiface, ++ b->arp.iniface, b->arp.outiface); + } + + static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy) +diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c +index 74092875..0c8bd291 100644 +--- a/iptables/nft-ipv4.c ++++ b/iptables/nft-ipv4.c +@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface, +- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask, +- b->fw.ip.iniface, b->fw.ip.outiface, +- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask); ++ b->fw.ip.iniface, b->fw.ip.outiface); + } + + static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c +index b184f8af..4dbb2af2 100644 +--- a/iptables/nft-ipv6.c ++++ b/iptables/nft-ipv6.c +@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a, + } + + return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface, +- a->fw6.ipv6.iniface_mask, +- a->fw6.ipv6.outiface_mask, +- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface, +- b->fw6.ipv6.iniface_mask, +- b->fw6.ipv6.outiface_mask); ++ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface); + } + + static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs) +diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c +index 6775578b..2c29e68f 100644 +--- a/iptables/nft-shared.c ++++ b/iptables/nft-shared.c +@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, + } + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask) ++ const char *b_iniface, const char *b_outiface) + { +- int i; +- +- for (i = 0; i < IFNAMSIZ; i++) { +- if (a_iniface_mask[i] != b_iniface_mask[i]) { +- DEBUGP("different iniface mask %x, %x (%d)\n", +- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i); +- return false; +- } +- if ((a_iniface[i] & a_iniface_mask[i]) +- != (b_iniface[i] & b_iniface_mask[i])) { +- DEBUGP("different iniface\n"); +- return false; +- } +- if (a_outiface_mask[i] != b_outiface_mask[i]) { +- DEBUGP("different outiface mask\n"); +- return false; +- } +- if ((a_outiface[i] & a_outiface_mask[i]) +- != (b_outiface[i] & b_outiface_mask[i])) { +- DEBUGP("different outiface\n"); +- return false; +- } ++ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) { ++ DEBUGP("different iniface\n"); ++ return false; ++ } ++ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) { ++ DEBUGP("different outiface\n"); ++ return false; + } +- + return true; + } + +diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h +index 51d1e460..b57aee1f 100644 +--- a/iptables/nft-shared.h ++++ b/iptables/nft-shared.h +@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint + void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv); + + bool is_same_interfaces(const char *a_iniface, const char *a_outiface, +- unsigned const char *a_iniface_mask, +- unsigned const char *a_outiface_mask, +- const char *b_iniface, const char *b_outiface, +- unsigned const char *b_iniface_mask, +- unsigned const char *b_outiface_mask); ++ const char *b_iniface, const char *b_outiface); + + void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op); + void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv); +diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +new file mode 100755 +index 00000000..278cd648 +--- /dev/null ++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 +@@ -0,0 +1,9 @@ ++#!/bin/bash ++ ++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; } ++ ++$XT_MULTI iptables -N test ++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT ++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1 ++ ++exit 0 +-- +cgit v1.2.3 + diff --git a/iptables.spec b/iptables.spec index b170a43..57090a7 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 4%{?dist} +Release: 5%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -22,6 +22,10 @@ Source6: sysconfig_iptables Source7: sysconfig_ip6tables Source8: arptables-nft-helper +# Patch to fix -C handling, already upstream +# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 +Patch: iptables-1.8.11-fix-interface-comparisons.patch + # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 License: GPL-2.0-only AND Artistic-2.0 AND ISC @@ -430,6 +434,9 @@ fi %changelog +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-5 +- Add patch to fix -C handling ( fixes rhbz#2360423 ) + * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 046b2467b46a166204cecce9a6adc5ccfbd09031 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 12 Mar 2025 16:06:49 +0100 Subject: [PATCH 10/23] Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit 43696a4be35ecb64b596d1db368cb736a91316e8 and also the follow-up work from c8015c16af9b2260f1fda5ccd6920774fc4d2efc. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected. Issue mentioned in https://bugzilla.redhat.com/show_bug.cgi?id=2361004. --- iptables.spec | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/iptables.spec b/iptables.spec index 177c6fd..bc9f667 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 6%{?dist} +Release: 7%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -271,7 +272,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -315,7 +316,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_prefix}/sbin/{eb,arp}tables; do +for pfx in %{_sbindir}/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -330,8 +331,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +341,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +349,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -361,7 +362,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +374,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +438,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +- Keep symlinks managed by alternatives under /usr/bin + * Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 - Add patch to fix -C handling ( fixes rhbz#2360423 ) From 9b74fed687d0ca9cbaa47e04527c7fb251c89b38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 12 Mar 2025 16:06:49 +0100 Subject: [PATCH 11/23] Revert "Keep alternatives symlinks under /usr/sbin" This reverts commit 43696a4be35ecb64b596d1db368cb736a91316e8. Now that chkconfig has been updated to treat /usr/sbin and /usr/bin as equivalent, we can drop the workaround here. I used this package as test case for the new chkconfig/alternatives code. With the changes in both packages, we get proper behaviour without warnings, and on upgrades, the conversion to merged sbin, i.e. symlinking of /usr/sbin to ./bin, happens as expected. --- iptables.spec | 38 ++++++++++++++++++-------------------- 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/iptables.spec b/iptables.spec index 57090a7..9246932 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 5%{?dist} +Release: 6%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -61,6 +61,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -240,17 +241,11 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ -%endif - %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -262,7 +257,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -275,8 +270,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -301,8 +296,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -311,7 +306,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -327,7 +322,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -353,7 +348,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -365,7 +360,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -426,14 +421,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-6 +- Keep symlinks managed by alternatives under /usr/bin + * Sun Apr 20 2025 Kevin Fenzi - 1.8.11-5 - Add patch to fix -C handling ( fixes rhbz#2360423 ) From cdf3f93581aa474bd2295bb079311c2abcecb598 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 29 Apr 2025 13:16:03 +0200 Subject: [PATCH 12/23] Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit 9b74fed687d0ca9cbaa47e04527c7fb251c89b38. These changes break systems, see bz#2362648 and bz#2362808 for details. --- iptables.spec | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/iptables.spec b/iptables.spec index 9246932..2fa1077 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 6%{?dist} +Release: 7%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -61,7 +61,6 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -241,11 +240,17 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml +%if "%{_sbindir}" == "%{_bindir}" +# We keep those symlinks in /usr/sbin for compatibility +mkdir -p %{buildroot}/usr/sbin +mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ +%endif + %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -257,7 +262,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables /usr/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -270,8 +275,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -296,8 +301,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=/usr/sbin/iptables +pfx6=/usr/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -306,7 +311,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=/usr/sbin/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -322,7 +327,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=/usr/sbin/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -348,7 +353,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd /usr/sbin/$cmd-nft done fi @@ -360,7 +365,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -421,14 +426,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Tue Apr 29 2025 Phil Sutter - 1.8.11-7 +- Revert last release, it breaks alternatives symlinks + * Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-6 - Keep symlinks managed by alternatives under /usr/bin From 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Sat, 3 May 2025 23:22:49 +0200 Subject: [PATCH 13/23] Reapply "Keep alternatives symlinks under /usr/sbin" This reverts commit 046b2467b46a166204cecce9a6adc5ccfbd09031. These changes break systems, see bz#2362648 and bz#2362808 for details. --- iptables.spec | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/iptables.spec b/iptables.spec index bc9f667..fac1bbf 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 7%{?dist} +Release: 8%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,7 +64,6 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 -Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -259,8 +258,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -272,7 +271,7 @@ update-alternatives --install \ %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_sbindir}/iptables-legacy + iptables %{_prefix}/sbin/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -285,8 +284,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -316,7 +315,7 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables # remove non-symlinks in spots managed by alternatives # to cover for updates from not-yet-alternatived versions -for pfx in %{_sbindir}/{eb,arp}tables; do +for pfx in %{_prefix}/sbin/{eb,arp}tables; do for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then rm -f $pfx$sfx @@ -331,8 +330,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_sbindir}/iptables -pfx6=%{_sbindir}/ip6tables +pfx=%{_prefix}/sbin/iptables +pfx6=%{_prefix}/sbin/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -341,7 +340,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_sbindir}/ebtables +pfx=%{_prefix}/sbin/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -349,7 +348,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_sbindir}/arptables +pfx=%{_prefix}/sbin/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -362,7 +361,7 @@ update-alternatives --install \ %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_sbindir}/$cmd-nft + update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft done fi @@ -374,7 +373,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -438,13 +437,16 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Sat May 03 2025 Phil Sutter - 1.8.11-8 +- Revert last release, it breaks alternatives symlinks + * Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 - Keep symlinks managed by alternatives under /usr/bin From 90a211ef7302c29a98a674de8afb3f6c7a0ab3ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Wed, 7 May 2025 16:30:51 +0200 Subject: [PATCH 14/23] Move iptables symlinks to /usr/bin again This partially reverts commit 2f0c9f89a9226a1ecb38675510932bea9f3e1e3b. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems. --- iptables.spec | 60 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index fac1bbf..edcea9a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 8%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -64,6 +64,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -258,8 +259,8 @@ ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bi %ldconfig_scriptlets %post legacy -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -268,10 +269,19 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables %{_prefix}/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -284,8 +294,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -297,6 +307,15 @@ alternatives --set iptables $(/dev/null || : +done +%endif + %post services %systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service @@ -330,8 +349,8 @@ for manpfx in %{_mandir}/man8/{eb,arp}tables; do done done -pfx=%{_prefix}/sbin/iptables -pfx6=%{_prefix}/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -340,7 +359,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=%{_prefix}/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ @@ -348,7 +367,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=%{_prefix}/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables update-alternatives --install \ $pfx arptables $pfx-nft 10 \ @@ -358,10 +377,19 @@ update-alternatives --install \ ${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd %{_prefix}/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -373,7 +401,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -437,13 +465,17 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_prefix}/sbin/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_prefix}/sbin/{eb,arp}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + * Sat May 03 2025 Phil Sutter - 1.8.11-8 - Revert last release, it breaks alternatives symlinks From 6f0696f58a45a6c3265c6d9837e06da2ffce5270 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 13 May 2025 10:55:45 +0200 Subject: [PATCH 15/23] Use modern option name for "follower" symlinks --- iptables.spec | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/iptables.spec b/iptables.spec index edcea9a..b5d83c1 100644 --- a/iptables.spec +++ b/iptables.spec @@ -263,11 +263,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -298,11 +298,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $( Date: Wed, 7 May 2025 16:30:51 +0200 Subject: [PATCH 16/23] Move iptables symlinks to /usr/bin again This partially reverts commit cdf3f93581aa474bd2295bb079311c2abcecb598. This time around, we also manually create symlinks in /usr/sbin to handle systems with unmerged /usr/sbin. This should fix the problems reported in https://bodhi.fedoraproject.org/updates/FEDORA-2025-a17e3e5938. For files that are %ghost, filesystem filetriggers are not triggered, so the symlinks may not be created automatically (depending on the specific upgrade path). In the meantime, alternatives has been updated to treat /usr/sbin and /usr/bin as equivalent, and filesystem has been updated to merge alternatives symlinks in /usr/sbin. We also need to move the files in this package to allow the merge to be finalized on upgraded systems. --- iptables.spec | 60 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 14 deletions(-) diff --git a/iptables.spec b/iptables.spec index 2fa1077..a87d9ee 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 7%{?dist} +Release: 8%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -61,6 +61,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Conflicts: setup < 2.10.4-1 +Conflicts: alternatives < 1.32-1 Requires(post): /usr/sbin/update-alternatives Requires(postun): /usr/sbin/update-alternatives %if 0%{?rhel} < 9 @@ -249,8 +250,8 @@ mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/ %ldconfig_scriptlets %post legacy -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -259,10 +260,19 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ --slave $pfx6-save ip6tables-save $pfx6-legacy-save +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun legacy if [ $1 -eq 0 ]; then update-alternatives --remove \ - iptables /usr/sbin/iptables-legacy + iptables %{_sbindir}/iptables-legacy fi # iptables-1.8.0-1 introduced the use of alternatives @@ -275,8 +285,8 @@ alternatives --list | awk '/^iptables/{print $3; exit}' \ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup %triggerpostun legacy -- iptables > 1.8.0 -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ --slave $pfx6 ip6tables $pfx6-legacy \ @@ -288,6 +298,15 @@ alternatives --set iptables $(/dev/null || : +done +%endif + %post services %systemd_post iptables.service ip6tables.service @@ -301,8 +320,8 @@ mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -pfx=/usr/sbin/iptables -pfx6=/usr/sbin/ip6tables +pfx=%{_sbindir}/iptables +pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-nft 10 \ --slave $pfx6 ip6tables $pfx6-nft \ @@ -311,7 +330,7 @@ update-alternatives --install \ --slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \ --slave $pfx6-save ip6tables-save $pfx6-nft-save -pfx=/usr/sbin/ebtables +pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables for sfx in "" "-restore" "-save"; do if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then @@ -327,7 +346,7 @@ update-alternatives --install \ --slave $pfx-restore ebtables-restore $pfx-nft-restore \ ${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz} -pfx=/usr/sbin/arptables +pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables lepfx=%{_libexecdir}/arptables for sfx in "" "-restore" "-save"; do @@ -350,10 +369,19 @@ update-alternatives --install \ ${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ --slave $lepfx-helper arptables-helper $lepfx-nft-helper +%if "%{_sbindir}" == "%{_bindir}" +# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a +# directory. Those symlinks will only be created if there is no symlink +# or file already. +for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do + test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || : +done +%endif + %postun nft if [ $1 -eq 0 ]; then for cmd in iptables ebtables arptables; do - update-alternatives --remove $cmd /usr/sbin/$cmd-nft + update-alternatives --remove $cmd %{_sbindir}/$cmd-nft done fi @@ -365,7 +393,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -426,14 +454,18 @@ fi %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost /usr/sbin/ip{,6}tables{,-save,-restore} -%ghost /usr/sbin/{eb,arp}tables{,-save,-restore} +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} %ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog +* Wed May 07 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-8 +- Reapply the change to keep symlinks managed by alternatives under /usr/bin, + this time with a scriptlet create symlinks if /usr/sbin is unmerged. + * Tue Apr 29 2025 Phil Sutter - 1.8.11-7 - Revert last release, it breaks alternatives symlinks From 8c8f81088a649ac1b446d01d6f474e4b698b0a0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 13 May 2025 10:56:23 +0200 Subject: [PATCH 17/23] Use modern option name for "follower" symlinks --- iptables.spec | 48 ++++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/iptables.spec b/iptables.spec index a87d9ee..17e5d5a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -254,11 +254,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -289,11 +289,11 @@ pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ $pfx iptables $pfx-legacy 10 \ - --slave $pfx6 ip6tables $pfx6-legacy \ - --slave $pfx-restore iptables-restore $pfx-legacy-restore \ - --slave $pfx-save iptables-save $pfx-legacy-save \ - --slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ - --slave $pfx6-save ip6tables-save $pfx6-legacy-save + --follower $pfx6 ip6tables $pfx6-legacy \ + --follower $pfx-restore iptables-restore $pfx-legacy-restore \ + --follower $pfx-save iptables-save $pfx-legacy-save \ + --follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \ + --follower $pfx6-save ip6tables-save $pfx6-legacy-save alternatives --set iptables $( Date: Tue, 20 May 2025 23:54:42 +0200 Subject: [PATCH 18/23] Fix for ghost files not present in iptables-nft RPM When fixing for rpmlint warnings, the standard symlinks installed by package's 'make install' were removed but they are in fact necessary for the globbing in %files section to happen. Replace them by empty files after removal to fix this. Fixes: e71883b551ebfba9eb6cd16095612d43ad878547 --- iptables.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index b5d83c1..c7216fb 100644 --- a/iptables.spec +++ b/iptables.spec @@ -251,7 +251,8 @@ touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -rm %{buildroot}%{_prefix}/bin/{ip,ip6,arp,eb}tables{,-save,-restore} +rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} +touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml From cc26decabc00149c006f76fc10450ce15d707077 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Tue, 20 May 2025 23:59:29 +0200 Subject: [PATCH 19/23] iptables-1.8.11-10 - Fix for ghost files not present in iptables-nft RPM Resolves: rhbz#2365424 --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index c7216fb..cdf4f66 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 9%{?dist} +Release: 10%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Tue May 20 2025 Phil Sutter - 1.8.11-10 +- Fix for ghost files not present in iptables-nft RPM + * Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged. From 50d38a64efdc9838ee22f75176ca00d6fe62e114 Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 21 May 2025 00:11:41 +0200 Subject: [PATCH 20/23] Fix build This is a leftover from pre-bin/sbin merge, drop it. Fixes: f0bc5dc9b6072 ("Move iptables symlinks to /usr/bin again") --- iptables.spec | 6 ------ 1 file changed, 6 deletions(-) diff --git a/iptables.spec b/iptables.spec index 17e5d5a..72ef2be 100644 --- a/iptables.spec +++ b/iptables.spec @@ -241,12 +241,6 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8 # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml -%if "%{_sbindir}" == "%{_bindir}" -# We keep those symlinks in /usr/sbin for compatibility -mkdir -p %{buildroot}/usr/sbin -mv %{buildroot}/usr/bin/{ip,ip6,arp,eb}tables{,-save,-restore} %{buildroot}/usr/sbin/ -%endif - %ldconfig_scriptlets %post legacy From 8ce4421d204c44131cbdc96465cafcb1f5f71288 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:46:02 +0000 Subject: [PATCH 21/23] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- iptables.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iptables.spec b/iptables.spec index cdf4f66..837bf0a 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 10%{?dist} +Release: 11%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -473,6 +473,9 @@ fi %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Phil Sutter - 1.8.11-10 - Fix for ghost files not present in iptables-nft RPM From 6a017827bbf2ff7454a8f3f45937124175c05e43 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Oct 2025 11:21:29 -0400 Subject: [PATCH 22/23] - Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. --- iptables-1.8.11-command-options-fix.patch | 27 +++++++++++++++++++++++ iptables.spec | 10 +++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 iptables-1.8.11-command-options-fix.patch diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables.spec b/iptables.spec index 837bf0a..c999d94 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 11%{?dist} +Release: 12%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -27,7 +27,10 @@ Source11: ebtables-helper Source12: ebtables-config # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch: iptables-1.8.11-fix-interface-comparisons.patch +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -473,6 +476,9 @@ fi %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +- Pull in upstream fix for too strict command option parsing + * Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 6710c03251af2204a49d474d670bbbc20f5bce17 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Tue, 28 Oct 2025 11:21:29 -0400 Subject: [PATCH 23/23] - Pull in upstream fix for too strict command option parsing upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281 xshared: Accept an option if any given command allows it Fixed commit made option checking overly strict: Some commands may be commbined (foremost --list and --zero), reject a given option only if it is not allowed by any of the given commands. --- iptables-1.8.11-command-options-fix.patch | 27 +++++++++++++++++++++++ iptables.spec | 10 +++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 iptables-1.8.11-command-options-fix.patch diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch new file mode 100644 index 0000000..f6eecb1 --- /dev/null +++ b/iptables-1.8.11-command-options-fix.patch @@ -0,0 +1,27 @@ +commit 192c3a6bc18f206895ec5e38812d648ccfe7e281 +Author: Phil Sutter +Date: Wed Apr 23 12:36:13 2025 +0200 + + xshared: Accept an option if any given command allows it + + Fixed commit made option checking overly strict: Some commands may be + commbined (foremost --list and --zero), reject a given option only if it + is not allowed by any of the given commands. + + Reported-by: Adam Nielsen + Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()") + Signed-off-by: Phil Sutter + +diff --git a/iptables/xshared.c b/iptables/xshared.c +index cdfd11ab..fc61e0fd 100644 +--- a/iptables/xshared.c ++++ b/iptables/xshared.c +@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops, + */ + for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) { + if ((options & optval) && +- (options_v_commands[i] & command) != command) ++ !(options_v_commands[i] & command)) + xtables_error(PARAMETER_PROBLEM, + "Illegal option `%s' with this command", + ops->option_name(optval)); diff --git a/iptables.spec b/iptables.spec index 72ef2be..df52c17 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 8%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -24,7 +24,10 @@ Source8: arptables-nft-helper # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 -Patch: iptables-1.8.11-fix-interface-comparisons.patch +Patch1: iptables-1.8.11-fix-interface-comparisons.patch +# Patch to fix overly strict command option checking +# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281 +Patch2: iptables-1.8.11-command-options-fix.patch # pf.os: ISC license # iptables-apply: Artistic Licence 2.0 @@ -456,6 +459,9 @@ fi %changelog +* Tue Oct 28 2025 Paul Wouters - 1.8.11-9 +- Pull in upstream fix for too strict command option parsing + * Wed May 07 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-8 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged.