Compare commits
5 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
67fb45c6e1 | ||
|
|
1a0467a585 | ||
|
|
1aa65c29aa | ||
|
|
d43cf112d2 | ||
|
|
94169cfe5b |
27 changed files with 210 additions and 744 deletions
11
.gitignore
vendored
11
.gitignore
vendored
|
|
@ -1,8 +1,3 @@
|
|||
/.build-*.log
|
||||
/iptables-*.src.rpm
|
||||
/noarch/
|
||||
/x86_64/
|
||||
/iptables.spec.orig
|
||||
/iptables-1.6.2.tar.bz2
|
||||
/iptables-1.8.0.tar.bz2
|
||||
/iptables-1.8.2.tar.bz2
|
||||
|
|
@ -11,9 +6,3 @@
|
|||
/iptables-1.8.5.tar.bz2
|
||||
/iptables-1.8.6.tar.bz2
|
||||
/iptables-1.8.7.tar.bz2
|
||||
/iptables-1.8.8.tar.bz2
|
||||
/iptables-1.8.9.tar.xz
|
||||
/iptables-1.8.10.tar.xz
|
||||
/iptables-1.8.10.tar.xz.sig
|
||||
/iptables-1.8.11.tar.xz
|
||||
/iptables-1.8.11.tar.xz.sig
|
||||
|
|
|
|||
51
0001-ebtables-Exit-gracefully-on-invalid-table-names.patch
Normal file
51
0001-ebtables-Exit-gracefully-on-invalid-table-names.patch
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 28 Jan 2021 01:09:56 +0100
|
||||
Subject: [PATCH] ebtables: Exit gracefully on invalid table names
|
||||
|
||||
Users are able to cause program abort by passing a table name that
|
||||
doesn't exist:
|
||||
|
||||
| # ebtables-nft -t dummy -P INPUT ACCEPT
|
||||
| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed.
|
||||
| Aborted
|
||||
|
||||
Avoid this by checking table existence just like iptables-nft does upon
|
||||
parsing '-t' optarg. Since the list of tables is known and fixed,
|
||||
checking the given name's length is pointless. So just drop that check
|
||||
in return.
|
||||
|
||||
With this patch in place, output looks much better:
|
||||
|
||||
| # ebtables-nft -t dummy -P INPUT ACCEPT
|
||||
| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist
|
||||
| Perhaps iptables or your kernel needs to be upgraded.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
||||
---
|
||||
iptables/xtables-eb.c | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
|
||||
index cfa9317c78e94..5bb34d6d292a9 100644
|
||||
--- a/iptables/xtables-eb.c
|
||||
+++ b/iptables/xtables-eb.c
|
||||
@@ -914,10 +914,10 @@ print_zero:
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"The -t option (seen in line %u) cannot be used in %s.\n",
|
||||
line, xt_params->program_name);
|
||||
- if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1)
|
||||
- xtables_error(PARAMETER_PROBLEM,
|
||||
- "Table name length cannot exceed %d characters",
|
||||
- EBT_TABLE_MAXNAMELEN - 1);
|
||||
+ if (!nft_table_builtin_find(h, optarg))
|
||||
+ xtables_error(VERSION_PROBLEM,
|
||||
+ "table '%s' does not exist",
|
||||
+ optarg);
|
||||
*table = optarg;
|
||||
table_set = true;
|
||||
break;
|
||||
--
|
||||
2.28.0
|
||||
|
||||
|
|
@ -5,12 +5,12 @@ ARPTABLES_CONFIG=/etc/sysconfig/arptables
|
|||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo "[ OK ]"
|
||||
echo -n "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo "[FAILED]"
|
||||
echo -n "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
|
|
@ -21,28 +21,31 @@ start() {
|
|||
|
||||
# don't do squat if we don't have the config file
|
||||
if [ -f $ARPTABLES_CONFIG ]; then
|
||||
printf "Applying arptables firewall rules: "
|
||||
echo -n $"Applying arptables firewall rules: "
|
||||
/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
|
||||
success || \
|
||||
failure
|
||||
echo
|
||||
touch /var/lock/subsys/arptables
|
||||
else
|
||||
failure
|
||||
echo "Configuration file /etc/sysconfig/arptables missing"
|
||||
echo
|
||||
echo $"Configuration file /etc/sysconfig/arptables missing"
|
||||
exit 6
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
printf "Removing user defined chains: "
|
||||
echo -n $"Removing user defined chains:"
|
||||
arptables -X && success || failure
|
||||
printf "Flushing all chains: "
|
||||
echo -n $"Flushing all chains:"
|
||||
arptables -F && success || failure
|
||||
printf "Resetting built-in chains to the default ACCEPT policy: "
|
||||
echo -n $"Resetting built-in chains to the default ACCEPT policy:"
|
||||
arptables -P INPUT ACCEPT && \
|
||||
arptables -P OUTPUT ACCEPT && \
|
||||
success || \
|
||||
failure
|
||||
echo
|
||||
rm -f /var/lock/subsys/arptables
|
||||
}
|
||||
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
[Unit]
|
||||
Description=Automates a packet filtering firewall with arptables
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/libexec/arptables-helper start
|
||||
ExecStop=/usr/libexec/arptables-helper stop
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
|
||||
o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
|
||||
2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
|
||||
nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
|
||||
P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
|
||||
qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
|
||||
5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
|
||||
ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
|
||||
u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
|
||||
/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
|
||||
cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
|
||||
tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
|
||||
VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
|
||||
CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
|
||||
LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
|
||||
8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
|
||||
5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
|
||||
AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
|
||||
Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
|
||||
VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
|
||||
RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
|
||||
uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
|
||||
zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
|
||||
ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
|
||||
3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
|
||||
iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
|
||||
wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
|
||||
UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
|
||||
M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
|
||||
97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
|
||||
FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
|
||||
IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
|
||||
0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
|
||||
GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
|
||||
bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
|
||||
QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
|
||||
Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
|
||||
3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
|
||||
yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
|
||||
C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
|
||||
klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
|
||||
zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
|
||||
Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
|
||||
X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
|
||||
5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
|
||||
woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
|
||||
njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
|
||||
yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
|
||||
hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
|
||||
BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
|
||||
ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
|
||||
hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
|
||||
tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
|
||||
E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
|
||||
fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
|
||||
CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
|
||||
EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
|
||||
gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
|
||||
9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
|
||||
oD8ElPP+m/v6iA==
|
||||
=70vD
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
# Save current firewall rules on stop.
|
||||
# Value: yes|no, default: no
|
||||
# Saves all firewall rules if firewall gets stopped
|
||||
# (e.g. on system shutdown).
|
||||
EBTABLES_SAVE_ON_STOP="no"
|
||||
|
||||
# Save (and restore) rule counters.
|
||||
# Value: yes|no, default: no
|
||||
# Save rule counters when saving a kernel table to a file. If the
|
||||
# rule counters were saved, they will be restored when restoring the table.
|
||||
EBTABLES_SAVE_COUNTER="no"
|
||||
102
ebtables-helper
102
ebtables-helper
|
|
@ -1,102 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
# internal variables
|
||||
EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
|
||||
EBTABLES_DATA=/etc/sysconfig/ebtables
|
||||
EBTABLES_TABLES="broute filter nat"
|
||||
VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
|
||||
|
||||
# ebtables-config defaults
|
||||
EBTABLES_SAVE_ON_STOP="no"
|
||||
EBTABLES_SAVE_ON_RESTART="no"
|
||||
EBTABLES_SAVE_COUNTER="no"
|
||||
|
||||
# load config if existing
|
||||
[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
|
||||
|
||||
initialize() {
|
||||
local ret=0
|
||||
for table in $EBTABLES_TABLES; do
|
||||
ebtables -t $table --init-table || ret=1
|
||||
done
|
||||
return $ret
|
||||
}
|
||||
|
||||
sanitize_dump() {
|
||||
local drop=false
|
||||
|
||||
export EBTABLES_TABLES
|
||||
|
||||
cat $1 | while read line; do
|
||||
case $line in
|
||||
\**)
|
||||
drop=false
|
||||
local table="${line#\*}"
|
||||
local found=false
|
||||
for t in $EBTABLES_TABLES; do
|
||||
if [[ $t == $table ]]; then
|
||||
found=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
$found || drop=true
|
||||
;;
|
||||
esac
|
||||
$drop || echo "$line"
|
||||
done
|
||||
}
|
||||
|
||||
start() {
|
||||
if [ -f $EBTABLES_DATA ]; then
|
||||
echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
|
||||
sanitize_dump $EBTABLES_DATA | ebtables-restore
|
||||
else
|
||||
echo -n $"ebtables: no stored ruleset, initializing empty tables: "
|
||||
initialize
|
||||
fi
|
||||
local ret=$?
|
||||
touch $VAR_SUBSYS_EBTABLES
|
||||
return $ret
|
||||
}
|
||||
|
||||
save() {
|
||||
echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
|
||||
export EBTABLES_SAVE_COUNTER
|
||||
ebtables-save >$EBTABLES_DATA && success || failure
|
||||
}
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
|
||||
start && success || failure
|
||||
RETVAL=$?
|
||||
;;
|
||||
stop)
|
||||
[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
|
||||
echo -n $"ebtables: stopping firewall: "
|
||||
initialize && success || failure
|
||||
RETVAL=$?
|
||||
rm -f $VAR_SUBSYS_EBTABLES
|
||||
;;
|
||||
save)
|
||||
save
|
||||
;;
|
||||
*)
|
||||
echo "usage: ${0##*/} {start|stop|save}" >&2
|
||||
RETVAL=2
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
[Unit]
|
||||
Description=Ethernet Bridge Filtering tables
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/libexec/ebtables-helper start
|
||||
ExecStop=/usr/libexec/ebtables-helper stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
|
||||
Author: Phil Sutter <phil@nwl.cc>
|
||||
Date: Wed Apr 23 12:36:13 2025 +0200
|
||||
|
||||
xshared: Accept an option if any given command allows it
|
||||
|
||||
Fixed commit made option checking overly strict: Some commands may be
|
||||
commbined (foremost --list and --zero), reject a given option only if it
|
||||
is not allowed by any of the given commands.
|
||||
|
||||
Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
|
||||
Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
|
||||
diff --git a/iptables/xshared.c b/iptables/xshared.c
|
||||
index cdfd11ab..fc61e0fd 100644
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
|
||||
*/
|
||||
for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
|
||||
if ((options & optval) &&
|
||||
- (options_v_commands[i] & command) != command)
|
||||
+ !(options_v_commands[i] & command))
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
"Illegal option `%s' with this command",
|
||||
ops->option_name(optval));
|
||||
|
|
@ -1,172 +0,0 @@
|
|||
From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Sowden <jeremy@azazel.net>
|
||||
Date: Mon, 18 Nov 2024 13:56:50 +0000
|
||||
Subject: nft: fix interface comparisons in `-C` commands
|
||||
|
||||
Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
|
||||
kernel") removed code which explicitly set interface masks to all ones. The
|
||||
result of this is that they are zero. However, they are used to mask interfaces
|
||||
in `is_same_interfaces`. Consequently, the masked values are alway zero, the
|
||||
comparisons are always true, and check commands which ought to fail succeed:
|
||||
|
||||
# iptables -N test
|
||||
# iptables -A test -i lo \! -o lo -j REJECT
|
||||
# iptables -v -L test
|
||||
Chain test (0 references)
|
||||
pkts bytes target prot opt in out source destination
|
||||
0 0 REJECT all -- lo !lo anywhere anywhere reject-with icmp-port-unreachable
|
||||
# iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
|
||||
REJECT all opt -- in lo out !lo 0.0.0.0/0 -> 0.0.0.0/0 reject-with icmp-port-unreachable
|
||||
|
||||
Remove the mask parameters from `is_same_interfaces`. Add a test-case.
|
||||
|
||||
Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
|
||||
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
---
|
||||
iptables/nft-arp.c | 10 ++----
|
||||
iptables/nft-ipv4.c | 4 +--
|
||||
iptables/nft-ipv6.c | 6 +---
|
||||
iptables/nft-shared.c | 36 +++++-----------------
|
||||
iptables/nft-shared.h | 6 +---
|
||||
.../testcases/nft-only/0020-compare-interfaces_0 | 9 ++++++
|
||||
6 files changed, 22 insertions(+), 49 deletions(-)
|
||||
create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
|
||||
|
||||
diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
|
||||
index 264864c3..c11d64c3 100644
|
||||
--- a/iptables/nft-arp.c
|
||||
+++ b/iptables/nft-arp.c
|
||||
@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
|
||||
return false;
|
||||
}
|
||||
|
||||
- return is_same_interfaces(a->arp.iniface,
|
||||
- a->arp.outiface,
|
||||
- (unsigned char *)a->arp.iniface_mask,
|
||||
- (unsigned char *)a->arp.outiface_mask,
|
||||
- b->arp.iniface,
|
||||
- b->arp.outiface,
|
||||
- (unsigned char *)b->arp.iniface_mask,
|
||||
- (unsigned char *)b->arp.outiface_mask);
|
||||
+ return is_same_interfaces(a->arp.iniface, a->arp.outiface,
|
||||
+ b->arp.iniface, b->arp.outiface);
|
||||
}
|
||||
|
||||
static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
|
||||
diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
|
||||
index 74092875..0c8bd291 100644
|
||||
--- a/iptables/nft-ipv4.c
|
||||
+++ b/iptables/nft-ipv4.c
|
||||
@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
|
||||
}
|
||||
|
||||
return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
|
||||
- a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
|
||||
- b->fw.ip.iniface, b->fw.ip.outiface,
|
||||
- b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
|
||||
+ b->fw.ip.iniface, b->fw.ip.outiface);
|
||||
}
|
||||
|
||||
static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
|
||||
diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
|
||||
index b184f8af..4dbb2af2 100644
|
||||
--- a/iptables/nft-ipv6.c
|
||||
+++ b/iptables/nft-ipv6.c
|
||||
@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
|
||||
}
|
||||
|
||||
return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
|
||||
- a->fw6.ipv6.iniface_mask,
|
||||
- a->fw6.ipv6.outiface_mask,
|
||||
- b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
|
||||
- b->fw6.ipv6.iniface_mask,
|
||||
- b->fw6.ipv6.outiface_mask);
|
||||
+ b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
|
||||
}
|
||||
|
||||
static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
|
||||
diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
|
||||
index 6775578b..2c29e68f 100644
|
||||
--- a/iptables/nft-shared.c
|
||||
+++ b/iptables/nft-shared.c
|
||||
@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
|
||||
}
|
||||
|
||||
bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
|
||||
- unsigned const char *a_iniface_mask,
|
||||
- unsigned const char *a_outiface_mask,
|
||||
- const char *b_iniface, const char *b_outiface,
|
||||
- unsigned const char *b_iniface_mask,
|
||||
- unsigned const char *b_outiface_mask)
|
||||
+ const char *b_iniface, const char *b_outiface)
|
||||
{
|
||||
- int i;
|
||||
-
|
||||
- for (i = 0; i < IFNAMSIZ; i++) {
|
||||
- if (a_iniface_mask[i] != b_iniface_mask[i]) {
|
||||
- DEBUGP("different iniface mask %x, %x (%d)\n",
|
||||
- a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
|
||||
- return false;
|
||||
- }
|
||||
- if ((a_iniface[i] & a_iniface_mask[i])
|
||||
- != (b_iniface[i] & b_iniface_mask[i])) {
|
||||
- DEBUGP("different iniface\n");
|
||||
- return false;
|
||||
- }
|
||||
- if (a_outiface_mask[i] != b_outiface_mask[i]) {
|
||||
- DEBUGP("different outiface mask\n");
|
||||
- return false;
|
||||
- }
|
||||
- if ((a_outiface[i] & a_outiface_mask[i])
|
||||
- != (b_outiface[i] & b_outiface_mask[i])) {
|
||||
- DEBUGP("different outiface\n");
|
||||
- return false;
|
||||
- }
|
||||
+ if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
|
||||
+ DEBUGP("different iniface\n");
|
||||
+ return false;
|
||||
+ }
|
||||
+ if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
|
||||
+ DEBUGP("different outiface\n");
|
||||
+ return false;
|
||||
}
|
||||
-
|
||||
return true;
|
||||
}
|
||||
|
||||
diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
|
||||
index 51d1e460..b57aee1f 100644
|
||||
--- a/iptables/nft-shared.h
|
||||
+++ b/iptables/nft-shared.h
|
||||
@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
|
||||
void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
|
||||
|
||||
bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
|
||||
- unsigned const char *a_iniface_mask,
|
||||
- unsigned const char *a_outiface_mask,
|
||||
- const char *b_iniface, const char *b_outiface,
|
||||
- unsigned const char *b_iniface_mask,
|
||||
- unsigned const char *b_outiface_mask);
|
||||
+ const char *b_iniface, const char *b_outiface);
|
||||
|
||||
void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
|
||||
void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
|
||||
diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
|
||||
new file mode 100755
|
||||
index 00000000..278cd648
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
|
||||
@@ -0,0 +1,9 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
|
||||
+
|
||||
+$XT_MULTI iptables -N test
|
||||
+$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
|
||||
+$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
|
||||
+
|
||||
+exit 0
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
|
|
@ -1,8 +1,7 @@
|
|||
[Unit]
|
||||
Description=IPv4 firewall with iptables
|
||||
After=syslog.target
|
||||
AssertPathExists=/etc/sysconfig/iptables
|
||||
Before=network-pre.target
|
||||
Wants=network-pre.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
|
|
@ -14,4 +13,4 @@ Environment=BOOTUP=serial
|
|||
Environment=CONSOLETYPE=serial
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
WantedBy=basic.target
|
||||
|
|
|
|||
419
iptables.spec
419
iptables.spec
|
|
@ -10,35 +10,25 @@
|
|||
Name: iptables
|
||||
Summary: Tools for managing Linux kernel packet filtering capabilities
|
||||
URL: https://www.netfilter.org/projects/iptables
|
||||
Version: 1.8.11
|
||||
Release: 12%{?dist}
|
||||
Source0: %{url}/files/%{name}-%{version}.tar.xz
|
||||
source1: %{url}/files/%{name}-%{version}.tar.xz.sig
|
||||
Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
|
||||
Source3: iptables.init
|
||||
Source4: iptables-config
|
||||
Source5: iptables.service
|
||||
Source6: sysconfig_iptables
|
||||
Source7: sysconfig_ip6tables
|
||||
Source8: arptables-helper
|
||||
Source9: arptables.service
|
||||
Source10: ebtables.service
|
||||
Source11: ebtables-helper
|
||||
Source12: ebtables-config
|
||||
# Patch to fix -C handling, already upstream
|
||||
# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
|
||||
Patch1: iptables-1.8.11-fix-interface-comparisons.patch
|
||||
# Patch to fix overly strict command option checking
|
||||
# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
|
||||
Patch2: iptables-1.8.11-command-options-fix.patch
|
||||
Version: 1.8.7
|
||||
Release: 8%{?dist}
|
||||
Source: %{url}/files/%{name}-%{version}.tar.bz2
|
||||
Source1: iptables.init
|
||||
Source2: iptables-config
|
||||
Source3: iptables.service
|
||||
Source4: sysconfig_iptables
|
||||
Source5: sysconfig_ip6tables
|
||||
Source6: arptables-nft-helper
|
||||
|
||||
Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch
|
||||
|
||||
# pf.os: ISC license
|
||||
# iptables-apply: Artistic Licence 2.0
|
||||
License: GPL-2.0-only AND Artistic-2.0 AND ISC
|
||||
License: GPLv2 and Artistic Licence 2.0 and ISC
|
||||
|
||||
# libnetfilter_conntrack is needed for xt_connlabel
|
||||
BuildRequires: pkgconfig(libnetfilter_conntrack)
|
||||
# libnfnetlink-devel is required for nfnl_osf
|
||||
# libnfnetlink-devel is requires for nfnl_osf
|
||||
BuildRequires: pkgconfig(libnfnetlink)
|
||||
BuildRequires: libselinux-devel
|
||||
BuildRequires: kernel-headers
|
||||
|
|
@ -48,35 +38,41 @@ BuildRequires: bison
|
|||
BuildRequires: flex
|
||||
BuildRequires: gcc
|
||||
BuildRequires: pkgconfig(libmnl) >= 1.0
|
||||
BuildRequires: pkgconfig(libnftnl) >= 1.2.6
|
||||
BuildRequires: pkgconfig(libnftnl) >= 1.1.5
|
||||
# libpcap-devel for nfbpf_compile
|
||||
BuildRequires: libpcap-devel
|
||||
BuildRequires: autoconf
|
||||
BuildRequires: automake
|
||||
BuildRequires: libtool
|
||||
BuildRequires: make
|
||||
BuildRequires: gnupg2
|
||||
|
||||
%description
|
||||
The iptables utility controls the network packet filtering code in the
|
||||
Linux kernel. If you need to set up firewalls and/or IP masquerading,
|
||||
you should install this package.
|
||||
|
||||
%package compat
|
||||
Summary: Temporary transitioning package
|
||||
Obsoletes: %{name} < 1.8.7-4
|
||||
Requires: %{name}-legacy = %{version}-%{release}
|
||||
Requires: %{name}-utils = %{version}-%{release}
|
||||
Provides: iptables
|
||||
|
||||
%description compat
|
||||
This package only exists to help transition iptables users to the new
|
||||
package split. It will be removed after one distribution release cycle, please
|
||||
do not reference it or depend on it in any way.
|
||||
|
||||
%package legacy
|
||||
Summary: Legacy tools for managing Linux kernel packet filtering capabilities
|
||||
Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
|
||||
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||
Conflicts: setup < 2.10.4-1
|
||||
Conflicts: alternatives < 1.32-1
|
||||
Requires(post): /usr/sbin/update-alternatives
|
||||
Requires(postun): /usr/sbin/update-alternatives
|
||||
Requires(post): %{_sbindir}/update-alternatives
|
||||
Requires(postun): %{_sbindir}/update-alternatives
|
||||
%if 0%{?rhel} < 9
|
||||
Provides: iptables
|
||||
%endif
|
||||
Provides: %{name}-compat = %{version}-%{release}
|
||||
Obsoletes: %{name}-compat < 1.8.9-7
|
||||
|
||||
%sbin_merge_compat %{_prefix}/sbin/iptables
|
||||
|
||||
%description legacy
|
||||
The iptables utility controls the network packet filtering code in the
|
||||
|
|
@ -100,8 +96,9 @@ Summary: iptables legacy libraries
|
|||
%description legacy-libs
|
||||
iptables libraries.
|
||||
|
||||
Please remember that libip*tc libraries do neither have a stable API nor a real
|
||||
so version. For more information about this, please have a look at
|
||||
Please remember that libip*tc libraries do neither have a stable API nor a real so version.
|
||||
|
||||
For more information about this, please have a look at
|
||||
|
||||
http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
|
||||
|
||||
|
|
@ -129,21 +126,11 @@ stable and may change with every new version. It is therefore unsupported.
|
|||
%package services
|
||||
Summary: iptables and ip6tables services for iptables
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires: %{name}-utils = %{version}-%{release}
|
||||
%{?systemd_ordering}
|
||||
# obsolete old main package
|
||||
Obsoletes: %{name} < 1.4.16.1
|
||||
# obsolete ipv6 sub package
|
||||
Obsoletes: %{name}-ipv6 < 1.4.11.1
|
||||
# Look at me, I'm the new arptables-services now!
|
||||
Conflicts: %{name}-nft < 1.8.11-5
|
||||
Obsoletes: arptables-services < 0.0.5-16
|
||||
Provides: arptables-services = %{version}-%{release}
|
||||
# Look at me, I'm the new ebtables-services now!
|
||||
# (With epoch to turn our version number higher value)
|
||||
Obsoletes: ebtables-services < 2.0.11-20
|
||||
Provides: ebtables-services = 1:%{version}-%{release}
|
||||
BuildArch: noarch
|
||||
|
||||
%description services
|
||||
iptables services for IPv4 and IPv6
|
||||
|
|
@ -165,25 +152,18 @@ a safer way to update iptables remotely.
|
|||
%package nft
|
||||
Summary: nftables compatibility for iptables, arptables and ebtables
|
||||
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
|
||||
Requires(post): /usr/sbin/update-alternatives
|
||||
Requires(post): /usr/bin/readlink
|
||||
Requires(postun): /usr/sbin/update-alternatives
|
||||
Requires(post): %{_sbindir}/update-alternatives
|
||||
Requires(postun): %{_sbindir}/update-alternatives
|
||||
Obsoletes: iptables-compat < 1.6.2-4
|
||||
Provides: arptables-helper
|
||||
Provides: iptables
|
||||
Provides: arptables
|
||||
Provides: ebtables
|
||||
# allowing old arptables-legacy will break when switching alternatives
|
||||
# due to the dropped arptables-helper symlink
|
||||
Conflicts: arptables-legacy < 0.0.5-16
|
||||
|
||||
%sbin_merge_compat %{_prefix}/sbin/iptables
|
||||
|
||||
%description nft
|
||||
nftables compatibility for iptables, arptables and ebtables.
|
||||
|
||||
%prep
|
||||
%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
|
||||
%autosetup -p1
|
||||
|
||||
%build
|
||||
|
|
@ -206,24 +186,20 @@ rm -f %{buildroot}%{_libdir}/*.la
|
|||
|
||||
# install init scripts and configuration files
|
||||
install -d -m 755 %{buildroot}%{script_path}
|
||||
install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
|
||||
sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
|
||||
install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
|
||||
sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
|
||||
install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
|
||||
install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
|
||||
install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
|
||||
install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
|
||||
sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
|
||||
install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
|
||||
sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
|
||||
install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
|
||||
install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
|
||||
install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
|
||||
echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
|
||||
install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
|
||||
touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
|
||||
install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables
|
||||
install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
|
||||
|
||||
# install systemd service files
|
||||
install -d -m 755 %{buildroot}/%{_unitdir}
|
||||
install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
|
||||
sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
|
||||
install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}
|
||||
sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service
|
||||
install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
|
||||
|
||||
# install legacy actions for service command
|
||||
|
|
@ -249,42 +225,31 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables
|
|||
# Remove /etc/ethertypes (now part of setup)
|
||||
rm -f %{buildroot}%{_sysconfdir}/ethertypes
|
||||
|
||||
install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/
|
||||
touch %{buildroot}%{_libexecdir}/arptables-helper
|
||||
|
||||
# prepare for alternatives
|
||||
touch %{buildroot}%{_mandir}/man8/arptables.8
|
||||
touch %{buildroot}%{_mandir}/man8/arptables-save.8
|
||||
touch %{buildroot}%{_mandir}/man8/arptables-restore.8
|
||||
touch %{buildroot}%{_mandir}/man8/ebtables.8
|
||||
rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
|
||||
touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
|
||||
|
||||
# fix absolute symlink
|
||||
ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
|
||||
|
||||
%ldconfig_scriptlets
|
||||
|
||||
%post legacy
|
||||
pfx=%{_sbindir}/iptables
|
||||
pfx6=%{_sbindir}/ip6tables
|
||||
update-alternatives --install \
|
||||
%{_sbindir}/update-alternatives --install \
|
||||
$pfx iptables $pfx-legacy 10 \
|
||||
--follower $pfx6 ip6tables $pfx6-legacy \
|
||||
--follower $pfx-restore iptables-restore $pfx-legacy-restore \
|
||||
--follower $pfx-save iptables-save $pfx-legacy-save \
|
||||
--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
|
||||
--follower $pfx6-save ip6tables-save $pfx6-legacy-save
|
||||
|
||||
%if "%{_sbindir}" == "%{_bindir}"
|
||||
# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
|
||||
# directory. Those symlinks will only be created if there is no symlink
|
||||
# or file already.
|
||||
for name in ip{,6}tables{,-save,-restore}; do
|
||||
test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
|
||||
done
|
||||
%endif
|
||||
--slave $pfx6 ip6tables $pfx6-legacy \
|
||||
--slave $pfx-restore iptables-restore $pfx-legacy-restore \
|
||||
--slave $pfx-save iptables-save $pfx-legacy-save \
|
||||
--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
|
||||
--slave $pfx6-save ip6tables-save $pfx6-legacy-save
|
||||
|
||||
%postun legacy
|
||||
if [ $1 -eq 0 ]; then
|
||||
update-alternatives --remove \
|
||||
%{_sbindir}/update-alternatives --remove \
|
||||
iptables %{_sbindir}/iptables-legacy
|
||||
fi
|
||||
|
||||
|
|
@ -300,112 +265,95 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
|
|||
%triggerpostun legacy -- iptables > 1.8.0
|
||||
pfx=%{_sbindir}/iptables
|
||||
pfx6=%{_sbindir}/ip6tables
|
||||
update-alternatives --install \
|
||||
%{_sbindir}/update-alternatives --install \
|
||||
$pfx iptables $pfx-legacy 10 \
|
||||
--follower $pfx6 ip6tables $pfx6-legacy \
|
||||
--follower $pfx-restore iptables-restore $pfx-legacy-restore \
|
||||
--follower $pfx-save iptables-save $pfx-legacy-save \
|
||||
--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
|
||||
--follower $pfx6-save ip6tables-save $pfx6-legacy-save
|
||||
--slave $pfx6 ip6tables $pfx6-legacy \
|
||||
--slave $pfx-restore iptables-restore $pfx-legacy-restore \
|
||||
--slave $pfx-save iptables-save $pfx-legacy-save \
|
||||
--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
|
||||
--slave $pfx6-save ip6tables-save $pfx6-legacy-save
|
||||
alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
|
||||
rm /var/tmp/alternatives.iptables.current
|
||||
mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
|
||||
|
||||
%if "%{_sbindir}" == "%{_bindir}"
|
||||
# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
|
||||
# directory. Those symlinks will only be created if there is no symlink
|
||||
# or file already.
|
||||
for name in ip{,6}tables{,-save,-restore}; do
|
||||
test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
|
||||
done
|
||||
%endif
|
||||
|
||||
%post services
|
||||
%systemd_post arptables.service ebtables.service
|
||||
%systemd_post iptables.service ip6tables.service
|
||||
|
||||
%preun services
|
||||
%systemd_preun arptables.service ebtables.service
|
||||
%systemd_preun iptables.service ip6tables.service
|
||||
|
||||
%postun services
|
||||
%?ldconfig
|
||||
%systemd_postun arptables.service ebtables.service
|
||||
%systemd_postun iptables.service ip6tables.service
|
||||
|
||||
%post -e nft
|
||||
[[ %%{_excludedocs} == 1 ]] || do_man=true
|
||||
|
||||
# remove non-symlinks in spots managed by alternatives
|
||||
# to cover for updates from not-yet-alternatived versions
|
||||
for pfx in %{_prefix}/sbin/{eb,arp}tables; do
|
||||
for sfx in "" "-restore" "-save"; do
|
||||
if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
|
||||
rm -f $pfx$sfx
|
||||
fi
|
||||
done
|
||||
done
|
||||
for manpfx in %{_mandir}/man8/{eb,arp}tables; do
|
||||
for sfx in {,-restore,-save}.8.gz; do
|
||||
if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
|
||||
rm -f $manpfx$sfx
|
||||
fi
|
||||
done
|
||||
done
|
||||
|
||||
%post nft
|
||||
pfx=%{_sbindir}/iptables
|
||||
pfx6=%{_sbindir}/ip6tables
|
||||
update-alternatives --install \
|
||||
%{_sbindir}/update-alternatives --install \
|
||||
$pfx iptables $pfx-nft 10 \
|
||||
--follower $pfx6 ip6tables $pfx6-nft \
|
||||
--follower $pfx-restore iptables-restore $pfx-nft-restore \
|
||||
--follower $pfx-save iptables-save $pfx-nft-save \
|
||||
--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
|
||||
--follower $pfx6-save ip6tables-save $pfx6-nft-save
|
||||
--slave $pfx6 ip6tables $pfx6-nft \
|
||||
--slave $pfx-restore iptables-restore $pfx-nft-restore \
|
||||
--slave $pfx-save iptables-save $pfx-nft-save \
|
||||
--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
|
||||
--slave $pfx6-save ip6tables-save $pfx6-nft-save
|
||||
|
||||
pfx=%{_sbindir}/ebtables
|
||||
manpfx=%{_mandir}/man8/ebtables
|
||||
update-alternatives --install \
|
||||
for sfx in "" "-restore" "-save"; do
|
||||
if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
|
||||
rm -f $pfx$sfx
|
||||
fi
|
||||
done
|
||||
if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
|
||||
rm -f $manpfx.8.gz
|
||||
fi
|
||||
%{_sbindir}/update-alternatives --install \
|
||||
$pfx ebtables $pfx-nft 10 \
|
||||
--follower $pfx-save ebtables-save $pfx-nft-save \
|
||||
--follower $pfx-restore ebtables-restore $pfx-nft-restore \
|
||||
${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
|
||||
--slave $pfx-save ebtables-save $pfx-nft-save \
|
||||
--slave $pfx-restore ebtables-restore $pfx-nft-restore \
|
||||
--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz
|
||||
|
||||
pfx=%{_sbindir}/arptables
|
||||
manpfx=%{_mandir}/man8/arptables
|
||||
update-alternatives --install \
|
||||
$pfx arptables $pfx-nft 10 \
|
||||
--follower $pfx-save arptables-save $pfx-nft-save \
|
||||
--follower $pfx-restore arptables-restore $pfx-nft-restore \
|
||||
${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
|
||||
${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
|
||||
${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
|
||||
|
||||
%if "%{_sbindir}" == "%{_bindir}"
|
||||
# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
|
||||
# directory. Those symlinks will only be created if there is no symlink
|
||||
# or file already.
|
||||
for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
|
||||
test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
|
||||
lepfx=%{_libexecdir}/arptables
|
||||
for sfx in "" "-restore" "-save"; do
|
||||
if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
|
||||
rm -f $pfx$sfx
|
||||
fi
|
||||
if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
|
||||
rm -f $manpfx$sfx.8.gz
|
||||
fi
|
||||
done
|
||||
%endif
|
||||
if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
|
||||
rm -f $lepfx-helper
|
||||
fi
|
||||
%{_sbindir}/update-alternatives --install \
|
||||
$pfx arptables $pfx-nft 10 \
|
||||
--slave $pfx-save arptables-save $pfx-nft-save \
|
||||
--slave $pfx-restore arptables-restore $pfx-nft-restore \
|
||||
--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \
|
||||
--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \
|
||||
--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \
|
||||
--slave $lepfx-helper arptables-helper $lepfx-nft-helper
|
||||
|
||||
%postun nft
|
||||
if [ $1 -eq 0 ]; then
|
||||
for cmd in iptables ebtables arptables; do
|
||||
update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
|
||||
%{_sbindir}/update-alternatives --remove \
|
||||
$cmd %{_sbindir}/$cmd-nft
|
||||
done
|
||||
fi
|
||||
|
||||
%files compat
|
||||
|
||||
%files legacy
|
||||
%doc INCOMPATIBILITIES
|
||||
%{_sbindir}/ip{,6}tables-legacy*
|
||||
%{_sbindir}/xtables-legacy-multi
|
||||
%{_bindir}/iptables-xml
|
||||
%{_mandir}/man1/iptables-xml*
|
||||
%{_mandir}/man8/xtables-legacy*
|
||||
%dir %{_datadir}/xtables
|
||||
%{_datadir}/xtables/iptables.xslt
|
||||
%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
|
||||
%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
|
||||
|
||||
%files libs
|
||||
%license COPYING
|
||||
|
|
@ -434,13 +382,9 @@ fi
|
|||
%dir %{script_path}
|
||||
%{script_path}/ip{,6}tables.init
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/arptables
|
||||
%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
|
||||
%ghost %{_sysconfdir}/sysconfig/ebtables
|
||||
%{_unitdir}/{arp,eb,ip,ip6}tables.service
|
||||
%{_unitdir}/ip{,6}tables.service
|
||||
%dir %{legacy_actions}/ip{,6}tables
|
||||
%{legacy_actions}/ip{,6}tables/{save,panic}
|
||||
%{_libexecdir}/{arp,eb}tables-helper
|
||||
|
||||
%files utils
|
||||
%license COPYING
|
||||
|
|
@ -459,176 +403,29 @@ fi
|
|||
%{_sbindir}/{eb,arp}tables-nft*
|
||||
%{_sbindir}/xtables-nft-multi
|
||||
%{_sbindir}/xtables-monitor
|
||||
%{_sbindir}/ebtables-translate
|
||||
%{_sbindir}/arptables-translate
|
||||
%dir %{_libdir}/xtables
|
||||
%{_libdir}/xtables/lib{arp,eb}t*
|
||||
%{_libexecdir}/arptables-nft-helper
|
||||
%{_mandir}/man8/xtables-monitor*
|
||||
%{_mandir}/man8/xtables-translate*
|
||||
%{_mandir}/man8/*-nft*
|
||||
%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
|
||||
%{_mandir}/man8/ebtables-translate*
|
||||
%{_mandir}/man8/arptables-translate*
|
||||
%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
|
||||
%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
|
||||
%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
|
||||
%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
|
||||
%ghost %{_libexecdir}/arptables-helper
|
||||
%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
|
||||
%ghost %{_mandir}/man8/ebtables.8.gz
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
|
||||
- Pull in upstream fix for too strict command option parsing
|
||||
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
|
||||
- Fix for ghost files not present in iptables-nft RPM
|
||||
|
||||
* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-9
|
||||
- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
|
||||
this time with a scriptlet create symlinks if /usr/sbin is unmerged.
|
||||
|
||||
* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
|
||||
- Revert last release, it breaks alternatives symlinks
|
||||
|
||||
* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-7
|
||||
- Keep symlinks managed by alternatives under /usr/bin
|
||||
|
||||
* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
|
||||
- Add patch to fix -C handling ( fixes rhbz#2360423 )
|
||||
|
||||
* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
|
||||
- iptables-services to assimilate arptables- and ebtables-services
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
|
||||
- Keep symlinks managed by alternatives under /usr/sbin
|
||||
|
||||
* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
|
||||
- Rebuilt for the bin-sbin merge (2nd attempt)
|
||||
|
||||
* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
|
||||
- new version
|
||||
|
||||
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-14
|
||||
- Add unmerged-sbin compat also for -legacy subpackage
|
||||
|
||||
* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-13
|
||||
- Bump release and add changelog entry
|
||||
|
||||
* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-12
|
||||
- Rebuilt for the bin-sbin merge
|
||||
|
||||
* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-11
|
||||
- Add missing build dependency
|
||||
|
||||
* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-10
|
||||
- Verify tarball GPG signature
|
||||
|
||||
* Wed Jul 03 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-9
|
||||
- Backport fixes from upstream
|
||||
|
||||
* Tue May 21 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-8
|
||||
- Make iptables-legacy own %%{_datadir}/xtables
|
||||
|
||||
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Thu Jan 11 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-5
|
||||
- Backport fixes from upstream
|
||||
- Fix flatpak build
|
||||
|
||||
* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-4
|
||||
- The actual obsoletes fix
|
||||
|
||||
* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-3
|
||||
- Fix compat sub-package obsoletion
|
||||
|
||||
* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-2
|
||||
- Obsolete dropped compat package
|
||||
|
||||
* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-1
|
||||
- New version 1.8.10
|
||||
- Drop compat sub-package
|
||||
|
||||
* Tue Aug 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-6
|
||||
- Convert license to SPDX format
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
|
||||
- Backport fixes from upstream
|
||||
|
||||
* Thu Apr 20 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-3
|
||||
- Support %%_excludedocs macro in alternatives installation
|
||||
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Thu Jan 12 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-1
|
||||
- Make iptables-xml a relative symlink
|
||||
- Drop not needed xtables.conf
|
||||
- Ship iptables.xslt with iptables-legacy package
|
||||
- Ship ebtables-translate tool with iptables-nft package
|
||||
- Update to 1.8.9.
|
||||
|
||||
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.8-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Fri Jul 08 2022 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.8-2
|
||||
- iptables-services requires iptables-apply in utils to apply rules
|
||||
|
||||
* Fri May 13 2022 Phil Sutter <psutter@redhat.com> - 1.8.8-1
|
||||
- Update to 1.8.8. Fixes rhbz#2085503
|
||||
|
||||
* Thu Mar 03 2022 Phil Sutter <psutter@redhat.com> - 1.8.7-16
|
||||
- Improve error messages for unsupported extensions
|
||||
- xshared: Fix response to unprivileged users
|
||||
- libxtables: Register only the highest revision extension
|
||||
- Ignore typical 'fedpkg local' results in .gitignore
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-15
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Sat Nov 27 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-14
|
||||
- Rebuild for new libnftnl.
|
||||
|
||||
* Thu Aug 05 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-13
|
||||
- doc: ebtables-nft.8: Adjust for missing atomic-options
|
||||
- nft: Fix for non-verbose check command
|
||||
- Build services sub-package as noarch
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-12
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Thu Jul 01 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-11
|
||||
- Fix performance restoring large rulesets
|
||||
- Review unit file
|
||||
|
||||
* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-10
|
||||
- Backport fixes from upstream
|
||||
|
||||
* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-9
|
||||
- Remove bashisms from arptables-nft-helper
|
||||
|
||||
* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8
|
||||
- iptables.init: Fix functionality for iptables-nft
|
||||
- iptables.init: Ignore sysctl files not suffixed '.conf'
|
||||
- iptables.init: Drop unused NEW_MODUTILS check
|
||||
- iptables.init: Drop some trailing whitespace
|
||||
|
||||
* Mon Mar 29 2021 Damian Wrobel <dwrobel@ertelnet.rybnik.pl> - 1.8.7-7
|
||||
- Add missing readlink required for iptables-nft(post)
|
||||
* Wed Apr 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-7
|
||||
- Make iptables-compat provide iptables
|
||||
|
||||
* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6
|
||||
- Restore alternatives configuration after upgrade
|
||||
|
|
|
|||
3
sources
3
sources
|
|
@ -1,2 +1 @@
|
|||
SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
|
||||
SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2
|
||||
SHA512 (iptables-1.8.7.tar.bz2) = c0a33fafbf1139157a9f52860938ebedc282a1394a68dcbd58981159379eb525919f999b25925f2cb4d6b18089bd99a94b00b3e73cff5cb0a0e47bdff174ed75
|
||||
|
|
|
|||
|
|
@ -29,10 +29,12 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
IPSET=testset6
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
# rlAssertRpm kernel
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
|
|
|
|||
|
|
@ -29,10 +29,12 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
TESTD=$PWD
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "source $TESTD/rules.in" 0 "read ruleset"
|
||||
|
|
|
|||
|
|
@ -29,6 +29,7 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
SERVICES="iptables ip6tables firewalld"
|
||||
|
||||
prepare_page() {
|
||||
|
|
@ -41,6 +42,7 @@ prepare_page() {
|
|||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
# rlAssertRpm kernel
|
||||
rlLogInfo $(uname -r)
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
|
|
@ -119,14 +121,10 @@ rlJournalStart
|
|||
rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
|
||||
rlRun "iptables -t raw -F"
|
||||
rlRun "ip6tables -t raw -F"
|
||||
if rlTestVersion "$(uname -r)" "<" "4.6"; then
|
||||
rlRun "rmmod nf_log_ipv4"
|
||||
rlRun "rmmod nf_log_ipv6"
|
||||
rlRun "rmmod nf_log_common"
|
||||
rlRun "rmmod nfnetlink_log" 0,1
|
||||
else
|
||||
rlLogInfo "new kernel detected: skipping unloading modules"
|
||||
fi
|
||||
rlRun "rmmod nf_log_ipv4"
|
||||
rlRun "rmmod nf_log_ipv6"
|
||||
rlRun "rmmod nf_log_common"
|
||||
rlRun "rmmod nfnetlink_log" 0,1
|
||||
rlLogInfo "restoring services"
|
||||
for svc in $SERVICES; do
|
||||
rlServiceRestore $svc
|
||||
|
|
|
|||
|
|
@ -29,6 +29,7 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
CGNUM="15"
|
||||
CGNAME="15"
|
||||
CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
|
||||
|
|
@ -40,6 +41,7 @@ SKIP6=false
|
|||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
# rlAssertRpm kernel-$(uname -r)
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
|
|
|
|||
|
|
@ -29,8 +29,11 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
|
|
|||
|
|
@ -53,7 +53,7 @@ $(METADATA): Makefile
|
|||
@echo "Type: Regression" >> $(METADATA)
|
||||
@echo "TestTime: 5m" >> $(METADATA)
|
||||
@echo "RunFor: iptables" >> $(METADATA)
|
||||
@echo "Requires: iptables iproute ipset" >> $(METADATA)
|
||||
@echo "Requires: iptables bridge-utils ipset" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
|
|
|
|||
|
|
@ -29,13 +29,16 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "ip6tables-save > ip6tables.backup"
|
||||
rlRun "iptables-save > iptables.backup"
|
||||
rlRun "ip link add dev testbr type bridge" 0 "create bridge iface"
|
||||
rlRun "brctl addbr testbr" 0 "create bridge iface"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
|
|
@ -72,7 +75,7 @@ rlJournalStart
|
|||
rlRun "ip6tables-restore < ip6tables.backup"
|
||||
rlRun "iptables-restore < iptables.backup"
|
||||
rlRun "ip link set down dev testbr"
|
||||
rlRun "ip link del testbr" 0 "remove bridge iface"
|
||||
rlRun "brctl delbr testbr" 0 "remove bridge iface"
|
||||
rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
|
||||
rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
|
||||
rlRun "popd"
|
||||
|
|
|
|||
|
|
@ -29,8 +29,11 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "cp /etc/sysconfig/ip6tables ."
|
||||
|
|
|
|||
|
|
@ -29,10 +29,12 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
SERVICES="iptables ip6tables firewalld"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
for svc in $SERVICES; do
|
||||
|
|
|
|||
|
|
@ -29,11 +29,13 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
IPSET4="ipsetv4"
|
||||
IPSET6="ipsetv6"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "ipset create $IPSET4 hash:ip"
|
||||
|
|
|
|||
|
|
@ -29,8 +29,11 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlServiceStart iptables
|
||||
|
|
|
|||
|
|
@ -30,8 +30,11 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartTest
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
|
||||
rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
|
||||
rlPhaseEnd
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@
|
|||
- iptables-services # multiple tests need iptables/ip6tables config files
|
||||
- initscripts # multiple tests need system command
|
||||
- libcgroup-tools # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
|
||||
- bridge-utils # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
|
||||
- ipset # multiple tests need ipset command
|
||||
- strace # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
|
||||
- policycoreutils # initscript-sanity needs restorecon command
|
||||
|
|
|
|||
|
|
@ -29,8 +29,11 @@
|
|||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="iptables"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue