iptables-1.8.7-8

- iptables.init: Fix functionality for iptables-nft
- iptables.init: Ignore sysctl files not suffixed '.conf'
- iptables.init: Drop unused NEW_MODUTILS check
- iptables.init: Drop some trailing whitespace

iptables.init

@@ -55,11 +55,6 @@ if [ ! -x /sbin/$IPTABLES ]; then
     exit 5
 fi
 
-# Old or new modutils
-/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
-    && NEW_MODUTILS=1 \
-    || NEW_MODUTILS=0
-
 # Default firewall configuration:
 IPTABLES_MODULES=""
 IPTABLES_SAVE_ON_STOP="no"
@@ -75,13 +70,33 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000
 # Load firewall configuration.
 [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
 
+is_iptables_nft() {
+	iptables --version | grep -q '(nf_tables)'
+}
+
+netfilter_active() {
+	is_iptables_nft && return 0
+	[ -e "$PROC_IPTABLES_NAMES" ]
+}
+
+netfilter_tables() {
+	netfilter_active || return 1
+	is_iptables_nft && {
+		# explicitly omit security table from this list as
+		# it should be reserved for SELinux use
+		echo "raw mangle filter nat"
+		return 0
+	}
+	cat "$PROC_IPTABLES_NAMES" 2>/dev/null
+}
+
 # Get active tables
-NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+NF_TABLES=$(netfilter_tables)
 
 
 flush_n_delete() {
     # Flush firewall rules and delete chains.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
     [ -z "$NF_TABLES" ] && return 1
@@ -113,10 +128,10 @@ set_policy() {
     policy=$1
 
     # Check if iptable module is loaded
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
-    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+    tables=$(netfilter_tables)
     [ -z "$tables" ] && return 1
 
     echo -n $"${IPTABLES}: Setting chains to policy $policy: "
@@ -166,7 +181,7 @@ load_sysctl() {
         echo -n $"Loading sysctl settings: "
         ret=0
         for item in $IPTABLES_SYSCTL_LOAD_LIST; do
-            fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
+            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
             let ret+=$?;
         done
         [ $ret -eq 0 ] && success || failure
@@ -217,7 +232,7 @@ start() {
 	    return 1
 	fi
     fi
-    
+ 
     # Load additional modules (helpers)
     if [ -n "$IPTABLES_MODULES" ]; then
 	echo -n $"${IPTABLES}: Loading additional modules: "
@@ -230,7 +245,7 @@ start() {
 	[ $ret -eq 0 ] && success || failure
 	echo
     fi
-    
+ 
     # Load sysctl settings
     load_sysctl
 
@@ -240,7 +255,7 @@ start() {
 
 stop() {
     # Do not stop if iptables module is not loaded.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Set default chain policy to ACCEPT, in order to not break shutdown
     # on systems where the default policy is DROP and root device is
@@ -248,14 +263,14 @@ stop() {
     set_policy ACCEPT
     # And then, flush the rules and delete chains
     flush_n_delete
-    
+
     rm -f $VAR_SUBSYS_IPTABLES
     return $ret
 }
 
 save() {
     # Check if iptable module is loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
 	return 0
     fi
@@ -298,7 +313,7 @@ save() {
 }
 
 status() {
-    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
 	echo $"${IPTABLES}: Firewall is not running."
 	return 3
     fi
@@ -306,7 +321,7 @@ status() {
     # Do not print status if lockfile is missing and iptables modules are not 
     # loaded.
     # Check if iptable modules are loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo $"${IPTABLES}: Firewall modules are not loaded."
 	return 3
     fi
@@ -319,7 +334,7 @@ status() {
 
     NUM=
     [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
-    VERBOSE= 
+    VERBOSE=
     [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
     COUNT=
     [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

iptables.spec

@@ -4,14 +4,6 @@
 # service legacy actions (RHBZ#748134)
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 
-# Bootstrap mode providing old and new versions of libip{4,6}tc in parallel
-%global bootstrap 0
-
-%if 0%{?bootstrap}
-%global version_old      1.8.2
-%global iptc_so_ver_old  0
-%global ipXtc_so_ver_old 0
-%endif
 %global iptc_so_ver  0
 %global ipXtc_so_ver 2
 
@@ -19,7 +11,7 @@ Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: https://www.netfilter.org/projects/iptables
 Version: 1.8.7
-Release: 3%{?dist}
+Release: 8%{?dist}
 Source: %{url}/files/%{name}-%{version}.tar.bz2
 Source1: iptables.init
 Source2: iptables-config
@@ -27,10 +19,6 @@ Source3: iptables.service
 Source4: sysconfig_iptables
 Source5: sysconfig_ip6tables
 Source6: arptables-nft-helper
-%if 0%{?bootstrap}
-Source7: %{url}/files/%{name}-%{version_old}.tar.bz2
-Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
-%endif
 
 Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch
 
@@ -57,22 +45,55 @@ BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
 BuildRequires: make
-Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-%if 0%{?fedora} > 24
-Conflicts: setup < 2.10.4-1
-%endif
-Requires(post): %{_sbindir}/update-alternatives
-Requires(postun): %{_sbindir}/update-alternatives
 
 %description
 The iptables utility controls the network packet filtering code in the
 Linux kernel. If you need to set up firewalls and/or IP masquerading,
 you should install this package.
 
+%package compat
+Summary: Temporary transitioning package
+Obsoletes: %{name} < 1.8.7-4
+Requires: %{name}-legacy = %{version}-%{release}
+Requires: %{name}-utils = %{version}-%{release}
+Provides: iptables
+
+%description compat
+This package only exists to help transition iptables users to the new
+package split. It will be removed after one distribution release cycle, please
+do not reference it or depend on it in any way.
+
+%package legacy
+Summary: Legacy tools for managing Linux kernel packet filtering capabilities
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Conflicts: setup < 2.10.4-1
+Requires(post): %{_sbindir}/update-alternatives
+Requires(postun): %{_sbindir}/update-alternatives
+%if 0%{?rhel} < 9
+Provides:	iptables
+%endif
+
+%description legacy
+The iptables utility controls the network packet filtering code in the
+Linux kernel. This package contains the legacy tools which are obsoleted by
+nft-variants in iptables-nft package for backwards compatibility reasons.
+If you need to set up firewalls and/or IP masquerading, you should not install
+this package but either nftables or iptables-nft instead.
+
 %package libs
-Summary: iptables libraries
+Summary: libxtables and iptables extensions userspace support
 
 %description libs
+libxtables and associated shared object files
+
+Libxtables provides unified access to iptables extensions in userspace. Data
+and logic for those is kept in per-extension shared object files.
+
+%package legacy-libs
+Summary: iptables legacy libraries
+
+%description legacy-libs
 iptables libraries.
 
 Please remember that libip*tc libraries do neither have a stable API nor a real so version.
@@ -81,14 +102,23 @@ For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
-
 %package devel
 Summary: Development package for iptables
-Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+# XXX: Drop this after two releases or so
+Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %description devel
-iptables development headers and libraries.
+libxtables development headers and pkgconfig files
+
+%package legacy-devel
+Summary: Development package for legacy iptables
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: pkgconfig
+
+%description legacy-devel
+Legacy iptables development headers and pkgconfig files
 
 The iptc libraries are marked as not public by upstream. The interface is not
 stable and may change with every new version. It is therefore unsupported.
@@ -109,18 +139,21 @@ This package provides the services iptables and ip6tables that have been split
 out of the base package since they are not active by default anymore.
 
 %package utils
-Summary: iptables and ip6tables services for iptables
+Summary: iptables and ip6tables misc utilities
 Requires: %{name} = %{version}-%{release}
 
 %description utils
 Utils for iptables
 
 This package provides nfnl_osf with the pf.os database and nfbpf_compile,
-a bytecode generator for use with xt_bpf.
+a bytecode generator for use with xt_bpf. Also included is iptables-apply,
+a safer way to update iptables remotely.
 
 %package nft
 Summary: nftables compatibility for iptables, arptables and ebtables
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires(post): %{_sbindir}/update-alternatives
+Requires(postun): %{_sbindir}/update-alternatives
 Obsoletes: iptables-compat < 1.6.2-4
 Provides: arptables-helper
 Provides: iptables
@@ -133,14 +166,6 @@ nftables compatibility for iptables, arptables and ebtables.
 %prep
 %autosetup -p1
 
-%if 0%{?bootstrap}
-%{__mkdir} -p bootstrap_ver
-pushd bootstrap_ver
-%{__tar} --strip-components=1 -xf %{SOURCE7}
-%{__patch} -p1 <%{SOURCE8}
-popd
-%endif
-
 %build
 ./autogen.sh
 CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
@@ -154,44 +179,11 @@ rm -f include/linux/types.h
 
 %make_build
 
-%if 0%{?bootstrap}
-pushd bootstrap_ver
-./autogen.sh
-CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
-%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
-
-# do not use rpath
-sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
-sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
-
-rm -f include/linux/types.h
-
-%make_build
-popd
-%endif
-
 %install
-%if 0%{?bootstrap}
-%make_install -C bootstrap_ver
-%{_bindir}/find %{buildroot} -xtype f -not \
-	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
-%{_bindir}/find %{buildroot} -type l -not \
-	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
-%endif
-
 %make_install
 # remove la file(s)
 rm -f %{buildroot}%{_libdir}/*.la
 
-# install ip*tables.h header files
-install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/
-install -d -m 755 %{buildroot}%{_includedir}/iptables
-install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/
-
-# install ipulog header file
-install -d -m 755 %{buildroot}%{_includedir}/libipulog/
-install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/
-
 # install init scripts and configuration files
 install -d -m 755 %{buildroot}%{script_path}
 install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
@@ -230,10 +222,8 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic
 sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy
 install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic
 
-%if 0%{?fedora} > 24
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
-%endif
 
 install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/
 touch %{buildroot}%{_libexecdir}/arptables-helper
@@ -246,7 +236,7 @@ touch %{buildroot}%{_mandir}/man8/ebtables.8
 
 %ldconfig_scriptlets
 
-%post
+%post legacy
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
 %{_sbindir}/update-alternatives --install \
@@ -257,12 +247,35 @@ pfx6=%{_sbindir}/ip6tables
 	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
 	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
 
-%postun
+%postun legacy
 if [ $1 -eq 0 ]; then
 	%{_sbindir}/update-alternatives --remove \
 		iptables %{_sbindir}/iptables-legacy
 fi
 
+# iptables-1.8.0-1 introduced the use of alternatives
+# when upgrading, its %postun script runs due to the package renaming
+# fix this by repeating the install into alternatives
+# also keep the old alternatives configuration to not change the system
+%triggerun legacy -- iptables > 1.8.0
+alternatives --list | awk '/^iptables/{print $3; exit}' \
+		>/var/tmp/alternatives.iptables.current
+cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
+
+%triggerpostun legacy -- iptables > 1.8.0
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
+%{_sbindir}/update-alternatives --install \
+	$pfx iptables $pfx-legacy 10 \
+	--slave $pfx6 ip6tables $pfx6-legacy \
+	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
+	--slave $pfx-save iptables-save $pfx-legacy-save \
+	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
+rm /var/tmp/alternatives.iptables.current
+mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
+
 %post services
 %systemd_post iptables.service ip6tables.service
 
@@ -331,119 +344,110 @@ if [ $1 -eq 0 ]; then
 	done
 fi
 
-%files
-%license COPYING
+%files compat
+
+%files legacy
 %doc INCOMPATIBILITIES
-%if 0%{?fedora} <= 24
-%{_sysconfdir}/ethertypes
-%endif
-%{_sbindir}/iptables-apply
-%{_sbindir}/ip6tables-apply
-%{_sbindir}/iptables-legacy*
-%{_sbindir}/ip6tables-legacy*
+%{_sbindir}/ip{,6}tables-legacy*
 %{_sbindir}/xtables-legacy-multi
 %{_bindir}/iptables-xml
 %{_mandir}/man1/iptables-xml*
-%{_mandir}/man8/iptables*
-%{_mandir}/man8/ip6tables*
 %{_mandir}/man8/xtables-legacy*
-%ghost %{_sbindir}/iptables
-%ghost %{_sbindir}/iptables-restore
-%ghost %{_sbindir}/iptables-save
-%ghost %{_sbindir}/ip6tables
-%ghost %{_sbindir}/ip6tables-restore
-%ghost %{_sbindir}/ip6tables-save
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
-%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
-%if 0%{?bootstrap}
-%{_libdir}/libiptc.so.%{iptc_so_ver_old}*
-%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}*
-%endif
+%license COPYING
 %{_libdir}/libxtables.so.12*
 %dir %{_libdir}/xtables
-%{_libdir}/xtables/libipt*
-%{_libdir}/xtables/libip6t*
-%{_libdir}/xtables/libxt*
+%{_libdir}/xtables/lib{ip,ip6,x}t*
+%{_mandir}/man8/ip{,6}tables.8.gz
+%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz
+
+%files legacy-libs
+%license COPYING
+%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
 
 %files devel
-%dir %{_includedir}/iptables
-%{_includedir}/iptables/*.h
-%{_includedir}/*.h
+%{_includedir}/xtables{,-version}.h
+%{_libdir}/libxtables.so
+%{_libdir}/pkgconfig/xtables.pc
+
+%files legacy-devel
 %dir %{_includedir}/libiptc
 %{_includedir}/libiptc/*.h
-%dir %{_includedir}/libipulog
-%{_includedir}/libipulog/*.h
 %{_libdir}/libip*tc.so
-%{_libdir}/libxtables.so
-%{_libdir}/pkgconfig/libiptc.pc
-%{_libdir}/pkgconfig/libip4tc.pc
-%{_libdir}/pkgconfig/libip6tc.pc
-%{_libdir}/pkgconfig/xtables.pc
+%{_libdir}/pkgconfig/libip{,4,6}tc.pc
 
 %files services
 %dir %{script_path}
-%{script_path}/iptables.init
-%{script_path}/ip6tables.init
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config
-%{_unitdir}/iptables.service
-%{_unitdir}/ip6tables.service
-%dir %{legacy_actions}/iptables
-%{legacy_actions}/iptables/save
-%{legacy_actions}/iptables/panic
-%dir %{legacy_actions}/ip6tables
-%{legacy_actions}/ip6tables/save
-%{legacy_actions}/ip6tables/panic
+%{script_path}/ip{,6}tables.init
+%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
+%{_unitdir}/ip{,6}tables.service
+%dir %{legacy_actions}/ip{,6}tables
+%{legacy_actions}/ip{,6}tables/{save,panic}
 
 %files utils
+%license COPYING
 %{_sbindir}/nfnl_osf
 %{_sbindir}/nfbpf_compile
+%{_sbindir}/ip{,6}tables-apply
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/pf.os
 %{_mandir}/man8/nfnl_osf*
 %{_mandir}/man8/nfbpf_compile*
+%{_mandir}/man8/ip{,6}tables-apply*
 
 %files nft
-%{_sbindir}/iptables-nft*
-%{_sbindir}/iptables-restore-translate
-%{_sbindir}/iptables-translate
-%{_sbindir}/ip6tables-nft*
-%{_sbindir}/ip6tables-restore-translate
-%{_sbindir}/ip6tables-translate
-%{_sbindir}/ebtables-nft*
-%{_sbindir}/arptables-nft*
+%{_sbindir}/ip{,6}tables-nft*
+%{_sbindir}/ip{,6}tables{,-restore}-translate
+%{_sbindir}/{eb,arp}tables-nft*
 %{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
 %dir %{_libdir}/xtables
-%{_libdir}/xtables/libarpt*
-%{_libdir}/xtables/libebt*
+%{_libdir}/xtables/lib{arp,eb}t*
 %{_libexecdir}/arptables-nft-helper
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
-%ghost %{_sbindir}/iptables
-%ghost %{_sbindir}/iptables-restore
-%ghost %{_sbindir}/iptables-save
-%ghost %{_sbindir}/ip6tables
-%ghost %{_sbindir}/ip6tables-restore
-%ghost %{_sbindir}/ip6tables-save
-%ghost %{_sbindir}/ebtables
-%ghost %{_sbindir}/ebtables-save
-%ghost %{_sbindir}/ebtables-restore
-%ghost %{_sbindir}/arptables
-%ghost %{_sbindir}/arptables-save
-%ghost %{_sbindir}/arptables-restore
+%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
 %ghost %{_libexecdir}/arptables-helper
-%ghost %{_mandir}/man8/arptables.8.gz
-%ghost %{_mandir}/man8/arptables-save.8.gz
-%ghost %{_mandir}/man8/arptables-restore.8.gz
+%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
+* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8
+- iptables.init: Fix functionality for iptables-nft
+- iptables.init: Ignore sysctl files not suffixed '.conf'
+- iptables.init: Drop unused NEW_MODUTILS check
+- iptables.init: Drop some trailing whitespace
+
+* Wed Apr 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-7
+- Make iptables-compat provide iptables
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6
+- Restore alternatives configuration after upgrade
+- Fix license location
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-5
+- Fix upgrade path with package rename
+- Add missing dependencies to iptables-nft package
+
+* Tue Feb 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-4
+- Drop bootstrap code again
+- Drop workarounds for F24 and lower
+- Fix iptables-utils summary
+- Ship iptables-apply with iptables-utils
+- Reduce files sections by use of globbing
+- Ship common man pages with iptables-libs
+- Ship *-translate man pages with iptables-nft
+- Move legacy iptables binaries, libraries and headers into sub-packages
+- Introduce compat sub-package to help with above transitions
+- Drop libipulog header from devel package, this belongs to libnetfilter_log
+- Do not ship internal headers in devel package
+
 * Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-3
 - ebtables: Exit gracefully on invalid table names