diff --git a/arptables-helper b/arptables-nft-helper similarity index 100% rename from arptables-helper rename to arptables-nft-helper diff --git a/arptables.service b/arptables.service deleted file mode 100644 index df6c7d6..0000000 --- a/arptables.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Automates a packet filtering firewall with arptables -After=network.target - -[Service] -Type=oneshot -ExecStart=/usr/libexec/arptables-helper start -ExecStop=/usr/libexec/arptables-helper stop -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target diff --git a/ebtables-config b/ebtables-config deleted file mode 100644 index 69d9289..0000000 --- a/ebtables-config +++ /dev/null @@ -1,11 +0,0 @@ -# Save current firewall rules on stop. -# Value: yes|no, default: no -# Saves all firewall rules if firewall gets stopped -# (e.g. on system shutdown). -EBTABLES_SAVE_ON_STOP="no" - -# Save (and restore) rule counters. -# Value: yes|no, default: no -# Save rule counters when saving a kernel table to a file. If the -# rule counters were saved, they will be restored when restoring the table. -EBTABLES_SAVE_COUNTER="no" diff --git a/ebtables-helper b/ebtables-helper deleted file mode 100644 index e63bd2b..0000000 --- a/ebtables-helper +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/bash - -# compat for removed initscripts dependency - -success() { - echo "[ OK ]" - return 0 -} - -failure() { - echo "[FAILED]" - return 1 -} - -# internal variables -EBTABLES_CONFIG=/etc/sysconfig/ebtables-config -EBTABLES_DATA=/etc/sysconfig/ebtables -EBTABLES_TABLES="broute filter nat" -VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables - -# ebtables-config defaults -EBTABLES_SAVE_ON_STOP="no" -EBTABLES_SAVE_ON_RESTART="no" -EBTABLES_SAVE_COUNTER="no" - -# load config if existing -[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG" - -initialize() { - local ret=0 - for table in $EBTABLES_TABLES; do - ebtables -t $table --init-table || ret=1 - done - return $ret -} - -sanitize_dump() { - local drop=false - - export EBTABLES_TABLES - - cat $1 | while read line; do - case $line in - \**) - drop=false - local table="${line#\*}" - local found=false - for t in $EBTABLES_TABLES; do - if [[ $t == $table ]]; then - found=true - break - fi - done - $found || drop=true - ;; - esac - $drop || echo "$line" - done -} - -start() { - if [ -f $EBTABLES_DATA ]; then - echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: " - sanitize_dump $EBTABLES_DATA | ebtables-restore - else - echo -n $"ebtables: no stored ruleset, initializing empty tables: " - initialize - fi - local ret=$? - touch $VAR_SUBSYS_EBTABLES - return $ret -} - -save() { - echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: " - export EBTABLES_SAVE_COUNTER - ebtables-save >$EBTABLES_DATA && success || failure -} - -case $1 in - start) - [ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0 - start && success || failure - RETVAL=$? - ;; - stop) - [ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save - echo -n $"ebtables: stopping firewall: " - initialize && success || failure - RETVAL=$? - rm -f $VAR_SUBSYS_EBTABLES - ;; - save) - save - ;; - *) - echo "usage: ${0##*/} {start|stop|save}" >&2 - RETVAL=2 - ;; -esac - -exit $RETVAL diff --git a/ebtables.service b/ebtables.service deleted file mode 100644 index b096f1d..0000000 --- a/ebtables.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=Ethernet Bridge Filtering tables - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/libexec/ebtables-helper start -ExecStop=/usr/libexec/ebtables-helper stop - -[Install] -WantedBy=multi-user.target diff --git a/iptables.spec b/iptables.spec index c999d94..df52c17 100644 --- a/iptables.spec +++ b/iptables.spec @@ -11,7 +11,7 @@ Name: iptables Summary: Tools for managing Linux kernel packet filtering capabilities URL: https://www.netfilter.org/projects/iptables Version: 1.8.11 -Release: 12%{?dist} +Release: 9%{?dist} Source0: %{url}/files/%{name}-%{version}.tar.xz source1: %{url}/files/%{name}-%{version}.tar.xz.sig Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt @@ -20,11 +20,8 @@ Source4: iptables-config Source5: iptables.service Source6: sysconfig_iptables Source7: sysconfig_ip6tables -Source8: arptables-helper -Source9: arptables.service -Source10: ebtables.service -Source11: ebtables-helper -Source12: ebtables-config +Source8: arptables-nft-helper + # Patch to fix -C handling, already upstream # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848 Patch1: iptables-1.8.11-fix-interface-comparisons.patch @@ -76,7 +73,7 @@ Provides: iptables Provides: %{name}-compat = %{version}-%{release} Obsoletes: %{name}-compat < 1.8.9-7 -%sbin_merge_compat %{_prefix}/sbin/iptables +%sbin_merge_compat /usr/sbin/iptables %description legacy The iptables utility controls the network packet filtering code in the @@ -100,8 +97,9 @@ Summary: iptables legacy libraries %description legacy-libs iptables libraries. -Please remember that libip*tc libraries do neither have a stable API nor a real -so version. For more information about this, please have a look at +Please remember that libip*tc libraries do neither have a stable API nor a real so version. + +For more information about this, please have a look at http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5 @@ -135,14 +133,6 @@ Requires: %{name}-utils = %{version}-%{release} Obsoletes: %{name} < 1.4.16.1 # obsolete ipv6 sub package Obsoletes: %{name}-ipv6 < 1.4.11.1 -# Look at me, I'm the new arptables-services now! -Conflicts: %{name}-nft < 1.8.11-5 -Obsoletes: arptables-services < 0.0.5-16 -Provides: arptables-services = %{version}-%{release} -# Look at me, I'm the new ebtables-services now! -# (With epoch to turn our version number higher value) -Obsoletes: ebtables-services < 2.0.11-20 -Provides: ebtables-services = 1:%{version}-%{release} BuildArch: noarch %description services @@ -173,11 +163,8 @@ Provides: arptables-helper Provides: iptables Provides: arptables Provides: ebtables -# allowing old arptables-legacy will break when switching alternatives -# due to the dropped arptables-helper symlink -Conflicts: arptables-legacy < 0.0.5-16 -%sbin_merge_compat %{_prefix}/sbin/iptables +%sbin_merge_compat /usr/sbin/iptables %description nft nftables compatibility for iptables, arptables and ebtables. @@ -209,20 +196,16 @@ install -d -m 755 %{buildroot}%{script_path} install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init -install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/ install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables -echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables -install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/ -touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables # install systemd service files install -d -m 755 %{buildroot}/%{_unitdir} -install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir} +install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir} sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir} @@ -249,13 +232,14 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables # Remove /etc/ethertypes (now part of setup) rm -f %{buildroot}%{_sysconfdir}/ethertypes +install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/ +touch %{buildroot}%{_libexecdir}/arptables-helper + # prepare for alternatives touch %{buildroot}%{_mandir}/man8/arptables.8 touch %{buildroot}%{_mandir}/man8/arptables-save.8 touch %{buildroot}%{_mandir}/man8/arptables-restore.8 touch %{buildroot}%{_mandir}/man8/ebtables.8 -rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} -touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore} # fix absolute symlink ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml @@ -321,38 +305,18 @@ done %endif %post services -%systemd_post arptables.service ebtables.service %systemd_post iptables.service ip6tables.service %preun services -%systemd_preun arptables.service ebtables.service %systemd_preun iptables.service ip6tables.service %postun services %?ldconfig -%systemd_postun arptables.service ebtables.service %systemd_postun iptables.service ip6tables.service %post -e nft [[ %%{_excludedocs} == 1 ]] || do_man=true -# remove non-symlinks in spots managed by alternatives -# to cover for updates from not-yet-alternatived versions -for pfx in %{_prefix}/sbin/{eb,arp}tables; do - for sfx in "" "-restore" "-save"; do - if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then - rm -f $pfx$sfx - fi - done -done -for manpfx in %{_mandir}/man8/{eb,arp}tables; do - for sfx in {,-restore,-save}.8.gz; do - if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then - rm -f $manpfx$sfx - fi - done -done - pfx=%{_sbindir}/iptables pfx6=%{_sbindir}/ip6tables update-alternatives --install \ @@ -365,6 +329,14 @@ update-alternatives --install \ pfx=%{_sbindir}/ebtables manpfx=%{_mandir}/man8/ebtables +for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi +done +if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then + rm -f $manpfx.8.gz +fi update-alternatives --install \ $pfx ebtables $pfx-nft 10 \ --follower $pfx-save ebtables-save $pfx-nft-save \ @@ -373,13 +345,26 @@ update-alternatives --install \ pfx=%{_sbindir}/arptables manpfx=%{_mandir}/man8/arptables +lepfx=%{_libexecdir}/arptables +for sfx in "" "-restore" "-save"; do + if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then + rm -f $pfx$sfx + fi + if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then + rm -f $manpfx$sfx.8.gz + fi +done +if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then + rm -f $lepfx-helper +fi update-alternatives --install \ $pfx arptables $pfx-nft 10 \ --follower $pfx-save arptables-save $pfx-nft-save \ --follower $pfx-restore arptables-restore $pfx-nft-restore \ ${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \ ${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \ - ${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} + ${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \ + --follower $lepfx-helper arptables-helper $lepfx-nft-helper %if "%{_sbindir}" == "%{_bindir}" # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a @@ -405,7 +390,7 @@ fi %{_mandir}/man8/xtables-legacy* %dir %{_datadir}/xtables %{_datadir}/xtables/iptables.xslt -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} %files libs %license COPYING @@ -434,13 +419,9 @@ fi %dir %{script_path} %{script_path}/ip{,6}tables.init %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config} -%config(noreplace) %{_sysconfdir}/sysconfig/arptables -%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config -%ghost %{_sysconfdir}/sysconfig/ebtables -%{_unitdir}/{arp,eb,ip,ip6}tables.service +%{_unitdir}/ip{,6}tables.service %dir %{legacy_actions}/ip{,6}tables %{legacy_actions}/ip{,6}tables/{save,panic} -%{_libexecdir}/{arp,eb}tables-helper %files utils %license COPYING @@ -463,44 +444,37 @@ fi %{_sbindir}/arptables-translate %dir %{_libdir}/xtables %{_libdir}/xtables/lib{arp,eb}t* +%{_libexecdir}/arptables-nft-helper %{_mandir}/man8/xtables-monitor* %{_mandir}/man8/xtables-translate* %{_mandir}/man8/*-nft* %{_mandir}/man8/ip{,6}tables{,-restore}-translate* %{_mandir}/man8/ebtables-translate* %{_mandir}/man8/arptables-translate* -%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore} -%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %{_sbindir}/ip{,6}tables{,-save,-restore} +%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore} +%ghost %{_libexecdir}/arptables-helper %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz %ghost %{_mandir}/man8/ebtables.8.gz %changelog -* Tue Oct 28 2025 Paul Wouters - 1.8.11-12 +* Tue Oct 28 2025 Paul Wouters - 1.8.11-9 - Pull in upstream fix for too strict command option parsing -* Thu Jul 24 2025 Fedora Release Engineering - 1.8.11-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue May 20 2025 Phil Sutter - 1.8.11-10 -- Fix for ghost files not present in iptables-nft RPM - -* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-9 +* Wed May 07 2025 Zbigniew Jędrzejewski-Szmek - 1.8.11-8 - Reapply the change to keep symlinks managed by alternatives under /usr/bin, this time with a scriptlet create symlinks if /usr/sbin is unmerged. -* Sat May 03 2025 Phil Sutter - 1.8.11-8 +* Tue Apr 29 2025 Phil Sutter - 1.8.11-7 - Revert last release, it breaks alternatives symlinks -* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-7 +* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek - 1.8.11-6 - Keep symlinks managed by alternatives under /usr/bin -* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-6 +* Sun Apr 20 2025 Kevin Fenzi - 1.8.11-5 - Add patch to fix -C handling ( fixes rhbz#2360423 ) -* Thu Apr 03 2025 Phil Sutter - 1.8.11-5 -- iptables-services to assimilate arptables- and ebtables-services - * Fri Jan 17 2025 Fedora Release Engineering - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild