CentOS Sources
2 years ago
committed by
MSVSphere Packaging Team
commit
0cf87b82cc
@ -0,0 +1 @@
|
||||
SOURCES/iptables-1.8.8.tar.bz2
|
||||
@ -0,0 +1 @@
|
||||
98783621a5e58ff55f83b1350523f3de41af621d SOURCES/iptables-1.8.8.tar.bz2
|
||||
@ -0,0 +1,334 @@
|
||||
From 7ef75f20c338d0f09b50633aa0d5d83c868015ab Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <psutter@redhat.com>
|
||||
Date: Thu, 17 Jun 2021 18:44:28 +0200
|
||||
Subject: [PATCH] doc: Add deprecation notices to all relevant man pages
|
||||
|
||||
This is RHEL9 trying to friendly kick people towards nftables.
|
||||
---
|
||||
iptables/arptables-nft-restore.8 | 13 ++++++++++++-
|
||||
iptables/arptables-nft-save.8 | 14 +++++++++++++-
|
||||
iptables/arptables-nft.8 | 19 ++++++++++++++++++-
|
||||
iptables/ebtables-nft.8 | 15 ++++++++++++++-
|
||||
iptables/iptables-apply.8.in | 14 +++++++++++++-
|
||||
iptables/iptables-extensions.8.tmpl.in | 14 ++++++++++++++
|
||||
iptables/iptables-restore.8.in | 17 ++++++++++++++++-
|
||||
iptables/iptables-save.8.in | 15 ++++++++++++++-
|
||||
iptables/iptables.8.in | 17 +++++++++++++++++
|
||||
iptables/xtables-monitor.8.in | 11 +++++++++++
|
||||
10 files changed, 142 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8
|
||||
index 09d9082cf9fd3..b1bf02998f9cc 100644
|
||||
--- a/iptables/arptables-nft-restore.8
|
||||
+++ b/iptables/arptables-nft-restore.8
|
||||
@@ -24,6 +24,17 @@ arptables-restore \- Restore ARP Tables (nft-based)
|
||||
.SH SYNOPSIS
|
||||
\fBarptables\-restore
|
||||
.SH DESCRIPTION
|
||||
+This tool is
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. It is maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
.PP
|
||||
.B arptables-restore
|
||||
is used to restore ARP Tables from data specified on STDIN or
|
||||
@@ -35,5 +46,5 @@ flushes (deletes) all previous contents of the respective ARP Table.
|
||||
.SH AUTHOR
|
||||
Jesper Dangaard Brouer <brouer@redhat.com>
|
||||
.SH SEE ALSO
|
||||
-\fBarptables\-save\fP(8), \fBarptables\fP(8)
|
||||
+\fBarptables\-save\fP(8), \fBarptables\fP(8), \fBnft\fP(8)
|
||||
.PP
|
||||
diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8
|
||||
index 905e59854cc28..49bb0f6260f2f 100644
|
||||
--- a/iptables/arptables-nft-save.8
|
||||
+++ b/iptables/arptables-nft-save.8
|
||||
@@ -27,6 +27,18 @@ arptables-save \- dump arptables rules to stdout (nft-based)
|
||||
\fBarptables\-save\fP [\fB\-V\fP]
|
||||
.SH DESCRIPTION
|
||||
.PP
|
||||
+This tool is
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. It is maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
+.PP
|
||||
.B arptables-save
|
||||
is used to dump the contents of an ARP Table in easily parseable format
|
||||
to STDOUT. Use I/O-redirection provided by your shell to write to a file.
|
||||
@@ -43,5 +55,5 @@ Print version information and exit.
|
||||
.SH AUTHOR
|
||||
Jesper Dangaard Brouer <brouer@redhat.com>
|
||||
.SH SEE ALSO
|
||||
-\fBarptables\-restore\fP(8), \fBarptables\fP(8)
|
||||
+\fBarptables\-restore\fP(8), \fBarptables\fP(8), \fBnft\fP(8)
|
||||
.PP
|
||||
diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8
|
||||
index ea31e0842acd4..ec5b993a41e8b 100644
|
||||
--- a/iptables/arptables-nft.8
|
||||
+++ b/iptables/arptables-nft.8
|
||||
@@ -39,6 +39,19 @@ arptables \- ARP table administration (nft-based)
|
||||
.BR "arptables " [ "-t table" ] " -P chain target " [ options ]
|
||||
|
||||
.SH DESCRIPTION
|
||||
+.PP
|
||||
+This tool is
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. It is maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
+.PP
|
||||
.B arptables
|
||||
is a user space tool, it is used to set up and maintain the
|
||||
tables of ARP rules in the Linux kernel. These rules inspect
|
||||
@@ -340,9 +353,13 @@ bridges, the same may be achieved using
|
||||
chain in
|
||||
.BR ebtables .
|
||||
|
||||
+This tool is deprecated in Red Hat Enterprise Linux. It is maintenance only and
|
||||
+will not receive new features. New setups should use \fBnft\fP(8). Existing
|
||||
+setups should migrate to \fBnft\fP(8) when possible.
|
||||
+
|
||||
.SH MAILINGLISTS
|
||||
.BR "" "See " http://netfilter.org/mailinglists.html
|
||||
.SH SEE ALSO
|
||||
-.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip (8)
|
||||
+.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip "(8), " nft (8)
|
||||
.PP
|
||||
.BR "" "See " https://wiki.nftables.org
|
||||
diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
|
||||
index d75aae240bc05..ed1bf8f2db55b 100644
|
||||
--- a/iptables/ebtables-nft.8
|
||||
+++ b/iptables/ebtables-nft.8
|
||||
@@ -46,6 +46,19 @@ ebtables \- Ethernet bridge frame table administration (nft-based)
|
||||
.br
|
||||
|
||||
.SH DESCRIPTION
|
||||
+.PP
|
||||
+This tool is
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. It is maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
+.PP
|
||||
.B ebtables
|
||||
is an application program used to set up and maintain the
|
||||
tables of rules (inside the Linux kernel) that inspect
|
||||
@@ -1069,6 +1082,6 @@ has not been implemented, although
|
||||
might replace them entirely given the inherent atomicity of nftables.
|
||||
Finally, this list is probably not complete.
|
||||
.SH SEE ALSO
|
||||
-.BR xtables-nft "(8), " iptables "(8), " ip (8)
|
||||
+.BR xtables-nft "(8), " iptables "(8), " ip "(8), " nft (8)
|
||||
.PP
|
||||
.BR "" "See " https://wiki.nftables.org
|
||||
diff --git a/iptables/iptables-apply.8.in b/iptables/iptables-apply.8.in
|
||||
index f0ed4e5f8d450..7f99a21ed2b61 100644
|
||||
--- a/iptables/iptables-apply.8.in
|
||||
+++ b/iptables/iptables-apply.8.in
|
||||
@@ -11,6 +11,18 @@ iptables-apply \- a safer way to update iptables remotely
|
||||
\fBiptables\-apply\fP [\-\fBhV\fP] [\fB-t\fP \fItimeout\fP] [\fB-w\fP \fIsavefile\fP] {[\fIrulesfile]|-c [runcmd]}\fP
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
+This tool is
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. It is maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
+.PP
|
||||
iptables\-apply will try to apply a new rulesfile (as output by
|
||||
iptables-save, read by iptables-restore) or run a command to configure
|
||||
iptables and then prompt the user whether the changes are okay. If the
|
||||
@@ -47,7 +59,7 @@ Display usage information.
|
||||
Display version information.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
-\fBiptables-restore\fP(8), \fBiptables-save\fP(8), \fBiptables\fR(8).
|
||||
+\fBiptables-restore\fP(8), \fBiptables-save\fP(8), \fBiptables\fR(8), \fBnft\fP(8).
|
||||
.SH LEGALESE
|
||||
.PP
|
||||
Original iptables-apply - Copyright 2006 Martin F. Krafft <madduck@madduck.net>.
|
||||
diff --git a/iptables/iptables-extensions.8.tmpl.in b/iptables/iptables-extensions.8.tmpl.in
|
||||
index 99d89a1fe44ad..73d40bbfe9c52 100644
|
||||
--- a/iptables/iptables-extensions.8.tmpl.in
|
||||
+++ b/iptables/iptables-extensions.8.tmpl.in
|
||||
@@ -7,6 +7,20 @@ iptables-extensions \(em list of extensions in the standard iptables distributio
|
||||
.PP
|
||||
\fBiptables\fP [\fB\-m\fP \fIname\fP [\fImodule-options\fP...]]
|
||||
[\fB\-j\fP \fItarget-name\fP [\fItarget-options\fP...]
|
||||
+.SH DESCRIPTION
|
||||
+These tools are
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. They are maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details. There is also
|
||||
+.BR iptables\-translate (8)/ ip6tables\-translate (8)
|
||||
+to help with the migration.
|
||||
.SH MATCH EXTENSIONS
|
||||
iptables can use extended packet matching modules
|
||||
with the \fB\-m\fP or \fB\-\-match\fP
|
||||
diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
|
||||
index 20216842d8358..8f4811c72f2ec 100644
|
||||
--- a/iptables/iptables-restore.8.in
|
||||
+++ b/iptables/iptables-restore.8.in
|
||||
@@ -31,6 +31,19 @@ ip6tables-restore \(em Restore IPv6 Tables
|
||||
[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
|
||||
[\fBfile\fP]
|
||||
.SH DESCRIPTION
|
||||
+These tools are
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. They are maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details. There is also
|
||||
+.BR iptables\-restore\-translate (8)/ ip6tables\-restore\-translate (8)
|
||||
+to help with the migration.
|
||||
.PP
|
||||
.B iptables-restore
|
||||
and
|
||||
@@ -81,7 +94,9 @@ from Rusty Russell.
|
||||
.br
|
||||
Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-restore.
|
||||
.SH SEE ALSO
|
||||
-\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8)
|
||||
+\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8),
|
||||
+\fBnft\fP(8), \fBiptables\-restore\-translate\fP(8),
|
||||
+\fBip6tables\-restore\-translate\fP(8)
|
||||
.PP
|
||||
The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
|
||||
which details NAT, and the netfilter-hacking-HOWTO which details the
|
||||
diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
|
||||
index 7683fd3780f72..6fe50b2d446e5 100644
|
||||
--- a/iptables/iptables-save.8.in
|
||||
+++ b/iptables/iptables-save.8.in
|
||||
@@ -30,6 +30,18 @@ ip6tables-save \(em dump iptables rules
|
||||
[\fB\-t\fP \fItable\fP] [\fB\-f\fP \fIfilename\fP]
|
||||
.SH DESCRIPTION
|
||||
.PP
|
||||
+These tools are
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. They are maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
+.PP
|
||||
.B iptables-save
|
||||
and
|
||||
.B ip6tables-save
|
||||
@@ -62,7 +74,8 @@ Rusty Russell <rusty@rustcorp.com.au>
|
||||
.br
|
||||
Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
|
||||
.SH SEE ALSO
|
||||
-\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8)
|
||||
+\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8),
|
||||
+\fBnft\fP(8)
|
||||
.PP
|
||||
The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
|
||||
which details NAT, and the netfilter-hacking-HOWTO which details the
|
||||
diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
|
||||
index 627ff0e4da7a4..a8b31206d45b2 100644
|
||||
--- a/iptables/iptables.8.in
|
||||
+++ b/iptables/iptables.8.in
|
||||
@@ -55,6 +55,20 @@ match = \fB\-m\fP \fImatchname\fP [\fIper-match-options\fP]
|
||||
.PP
|
||||
target = \fB\-j\fP \fItargetname\fP [\fIper\-target\-options\fP]
|
||||
.SH DESCRIPTION
|
||||
+These tools are
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. They are maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details. There is also
|
||||
+.BR iptables\-translate (8)/ ip6tables\-translate (8)
|
||||
+to help with the migration.
|
||||
+.PP
|
||||
\fBIptables\fP and \fBip6tables\fP are used to set up, maintain, and inspect the
|
||||
tables of IPv4 and IPv6 packet
|
||||
filter rules in the Linux kernel. Several different tables
|
||||
@@ -447,6 +461,9 @@ There are several other changes in iptables.
|
||||
\fBiptables\-save\fP(8),
|
||||
\fBiptables\-restore\fP(8),
|
||||
\fBiptables\-extensions\fP(8),
|
||||
+\fBnft\fP(8),
|
||||
+\fBiptables\-translate\fP(8),
|
||||
+\fBip6tables\-translate\fP(8)
|
||||
.PP
|
||||
The packet-filtering-HOWTO details iptables usage for
|
||||
packet filtering, the NAT-HOWTO details NAT,
|
||||
diff --git a/iptables/xtables-monitor.8.in b/iptables/xtables-monitor.8.in
|
||||
index a7f22c0d8c08e..e21d7ff23035f 100644
|
||||
--- a/iptables/xtables-monitor.8.in
|
||||
+++ b/iptables/xtables-monitor.8.in
|
||||
@@ -6,6 +6,17 @@ xtables-monitor \(em show changes to rule set and trace-events
|
||||
.PP
|
||||
\
|
||||
.SH DESCRIPTION
|
||||
+This tool is
|
||||
+.B deprecated
|
||||
+in Red Hat Enterprise Linux. It is maintenance only and will not receive new
|
||||
+features. New setups should use
|
||||
+.BR nft (8).
|
||||
+Existing setups should migrate to
|
||||
+.BR nft (8)
|
||||
+when possible. See
|
||||
+.UR https://red.ht/nft_your_tables
|
||||
+.UE
|
||||
+for details.
|
||||
.PP
|
||||
.B xtables-monitor
|
||||
is used to monitor changes to the ruleset or to show rule evaluation events
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,26 @@
|
||||
From 231626933e5fd54b8d9e66dfc9a8a374a9192121 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <psutter@redhat.com>
|
||||
Date: Fri, 16 Jul 2021 21:51:49 +0200
|
||||
Subject: [PATCH] extensions: SECMARK: Use a better context in test case
|
||||
|
||||
RHEL SELinux policies don't allow setting
|
||||
system_u:object_r:firewalld_exec_t:s0 context. Use one instead which has
|
||||
'packet_type' attribute (identified via
|
||||
'seinfo -xt | grep packet_type').
|
||||
---
|
||||
extensions/libxt_SECMARK.t | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/extensions/libxt_SECMARK.t b/extensions/libxt_SECMARK.t
|
||||
index 39d4c09348bf4..295e7a7244902 100644
|
||||
--- a/extensions/libxt_SECMARK.t
|
||||
+++ b/extensions/libxt_SECMARK.t
|
||||
@@ -1,4 +1,4 @@
|
||||
:INPUT,FORWARD,OUTPUT
|
||||
*security
|
||||
--j SECMARK --selctx system_u:object_r:firewalld_exec_t:s0;=;OK
|
||||
+-j SECMARK --selctx system_u:object_r:ssh_server_packet_t:s0;=;OK
|
||||
-j SECMARK;;FAIL
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,29 @@
|
||||
From 4350a1e4daabc4ec1f9b692425d9bd0d48d27488 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Fri, 13 May 2022 16:51:58 +0200
|
||||
Subject: [PATCH] xshared: Fix build for -Werror=format-security
|
||||
|
||||
Gcc complains about the omitted format string.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit b72eb12ea5a61df0655ad99d5048994e916be83a)
|
||||
---
|
||||
iptables/xshared.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xshared.c b/iptables/xshared.c
|
||||
index fae5ddd5df93e..a8512d3808154 100644
|
||||
--- a/iptables/xshared.c
|
||||
+++ b/iptables/xshared.c
|
||||
@@ -1307,7 +1307,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg)
|
||||
return;
|
||||
|
||||
if (args->family != NFPROTO_ARP)
|
||||
- xtables_error(PARAMETER_PROBLEM, msg);
|
||||
+ xtables_error(PARAMETER_PROBLEM, "%s", msg);
|
||||
|
||||
fprintf(stderr, "%s", msg);
|
||||
}
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,61 @@
|
||||
From e7a2e0f70ed69c7b1ed1b4e6474ccf0924f81b23 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 2 Jun 2022 13:44:45 +0200
|
||||
Subject: [PATCH] tests: shell: Check overhead in iptables-save and -restore
|
||||
|
||||
Some repeated calls have been reduced recently, assert this in a test
|
||||
evaluating strace output.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 0416ae5dea134b33e22c97e68b64010d679debe1)
|
||||
---
|
||||
.../shell/testcases/ipt-save/0007-overhead_0 | 37 +++++++++++++++++++
|
||||
1 file changed, 37 insertions(+)
|
||||
create mode 100755 iptables/tests/shell/testcases/ipt-save/0007-overhead_0
|
||||
|
||||
diff --git a/iptables/tests/shell/testcases/ipt-save/0007-overhead_0 b/iptables/tests/shell/testcases/ipt-save/0007-overhead_0
|
||||
new file mode 100755
|
||||
index 0000000000000..b86d71f209471
|
||||
--- /dev/null
|
||||
+++ b/iptables/tests/shell/testcases/ipt-save/0007-overhead_0
|
||||
@@ -0,0 +1,37 @@
|
||||
+#!/bin/bash
|
||||
+
|
||||
+# Test recent performance improvements in iptables-save due to reduced
|
||||
+# overhead.
|
||||
+
|
||||
+strace --version >/dev/null || { echo "skip for missing strace"; exit 0; }
|
||||
+
|
||||
+RULESET=$(
|
||||
+ echo "*filter"
|
||||
+ for ((i = 0; i < 100; i++)); do
|
||||
+ echo ":mychain$i -"
|
||||
+ echo "-A FORWARD -p tcp --dport 22 -j mychain$i"
|
||||
+ done
|
||||
+ echo "COMMIT"
|
||||
+)
|
||||
+
|
||||
+RESTORE_STRACE=$(strace $XT_MULTI iptables-restore <<< "$RULESET" 2>&1 >/dev/null)
|
||||
+SAVE_STRACE=$(strace $XT_MULTI iptables-save 2>&1 >/dev/null)
|
||||
+
|
||||
+do_grep() { # (name, threshold, pattern)
|
||||
+ local cnt=$(grep -c "$3")
|
||||
+ [[ $cnt -le $2 ]] && return 0
|
||||
+ echo "ERROR: Too many $3 lookups for $1: $cnt > $2"
|
||||
+ exit 1
|
||||
+}
|
||||
+
|
||||
+# iptables prefers hard-coded protocol names instead of looking them up first
|
||||
+
|
||||
+do_grep "$XT_MULTI iptables-restore" 0 /etc/protocols <<< "$RESTORE_STRACE"
|
||||
+do_grep "$XT_MULTI iptables-save" 0 /etc/protocols <<< "$SAVE_STRACE"
|
||||
+
|
||||
+# iptables-nft-save pointlessly checked whether chain jumps are targets
|
||||
+
|
||||
+do_grep "$XT_MULTI iptables-restore" 10 libxt_ <<< "$RESTORE_STRACE"
|
||||
+do_grep "$XT_MULTI iptables-save" 10 libxt_ <<< "$SAVE_STRACE"
|
||||
+
|
||||
+exit 0
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,33 @@
|
||||
From 5d197a9a4c0f456243894aea4b5fd059ecf6c402 Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Tue, 7 Jun 2022 18:07:00 +0200
|
||||
Subject: [PATCH] arptables: Support -x/--exact flag
|
||||
|
||||
Legacy arptables accepts but ignores the flag. Yet there are remains of
|
||||
the functionality in sources, like OPT_EXPANDED define and a print_num()
|
||||
function which acts on FMT_KILOMEGAGIGA flag being set or not. So
|
||||
instead of mimicking legacy behaviour by explicitly ignoring -x flag for
|
||||
arptables, just enable the feature for it.
|
||||
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 24c5b593156de29a49146bcc3497ebb7d8d40ef0)
|
||||
---
|
||||
iptables/xshared.h | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/iptables/xshared.h b/iptables/xshared.h
|
||||
index 14568bb00fb65..a50c8b7298072 100644
|
||||
--- a/iptables/xshared.h
|
||||
+++ b/iptables/xshared.h
|
||||
@@ -69,7 +69,7 @@ struct xtables_target;
|
||||
|
||||
#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:"
|
||||
#define IPT_OPTSTRING OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x"
|
||||
-#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nv" /* "m:" */
|
||||
+#define ARPT_OPTSTRING OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */
|
||||
#define EBT_OPTSTRING OPTSTRING_COMMON "hv"
|
||||
|
||||
/* define invflags which won't collide with IPT ones */
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,91 @@
|
||||
From 18fda96510a8e518e22523843050b824fa97cf2c Mon Sep 17 00:00:00 2001
|
||||
From: Phil Sutter <phil@nwl.cc>
|
||||
Date: Thu, 30 Jun 2022 18:04:39 +0200
|
||||
Subject: [PATCH] libxtables: Fix unsupported extension warning corner case
|
||||
|
||||
Some extensions are not supported in revision 0 by user space anymore,
|
||||
for those the warning in xtables_compatible_revision() does not print as
|
||||
no revision 0 is tried.
|
||||
|
||||
To fix this, one has to track if none of the user space supported
|
||||
revisions were accepted by the kernel. Therefore add respective logic to
|
||||
xtables_find_{target,match}().
|
||||
|
||||
Note that this does not lead to duplicated warnings for unsupported
|
||||
extensions that have a revision 0 because xtables_compatible_revision()
|
||||
returns true for them to allow for extension's help output.
|
||||
|
||||
For the record, these ip6tables extensions are affected: set/SET,
|
||||
socket, tos/TOS, TPROXY and SNAT. In addition to that, TEE is affected
|
||||
for both families.
|
||||
|
||||
Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions")
|
||||
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
||||
(cherry picked from commit 552c4a2f9e5706fef5f7abb27d1492a78bbb2a37)
|
||||
---
|
||||
libxtables/xtables.c | 14 ++++++++++++++
|
||||
1 file changed, 14 insertions(+)
|
||||
|
||||
diff --git a/libxtables/xtables.c b/libxtables/xtables.c
|
||||
index 96fd783a066cf..7abc63bcfd83e 100644
|
||||
--- a/libxtables/xtables.c
|
||||
+++ b/libxtables/xtables.c
|
||||
@@ -773,6 +773,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
||||
struct xtables_match *ptr;
|
||||
const char *icmp6 = "icmp6";
|
||||
bool found = false;
|
||||
+ bool seen = false;
|
||||
|
||||
if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)
|
||||
xtables_error(PARAMETER_PROBLEM,
|
||||
@@ -791,6 +792,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
||||
if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
|
||||
ptr = *dptr;
|
||||
*dptr = (*dptr)->next;
|
||||
+ seen = true;
|
||||
if (!found &&
|
||||
xtables_fully_register_pending_match(ptr, prev)) {
|
||||
found = true;
|
||||
@@ -804,6 +806,11 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
|
||||
dptr = &((*dptr)->next);
|
||||
}
|
||||
|
||||
+ if (seen && !found)
|
||||
+ fprintf(stderr,
|
||||
+ "Warning: Extension %s is not supported, missing kernel module?\n",
|
||||
+ name);
|
||||
+
|
||||
for (ptr = xtables_matches; ptr; ptr = ptr->next) {
|
||||
if (extension_cmp(name, ptr->name, ptr->family)) {
|
||||
struct xtables_match *clone;
|
||||
@@ -896,6 +903,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
||||
struct xtables_target **dptr;
|
||||
struct xtables_target *ptr;
|
||||
bool found = false;
|
||||
+ bool seen = false;
|
||||
|
||||
/* Standard target? */
|
||||
if (strcmp(name, "") == 0
|
||||
@@ -914,6 +922,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
||||
if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
|
||||
ptr = *dptr;
|
||||
*dptr = (*dptr)->next;
|
||||
+ seen = true;
|
||||
if (!found &&
|
||||
xtables_fully_register_pending_target(ptr, prev)) {
|
||||
found = true;
|
||||
@@ -927,6 +936,11 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
|
||||
dptr = &((*dptr)->next);
|
||||
}
|
||||
|
||||
+ if (seen && !found)
|
||||
+ fprintf(stderr,
|
||||
+ "Warning: Extension %s is not supported, missing kernel module?\n",
|
||||
+ name);
|
||||
+
|
||||
for (ptr = xtables_targets; ptr; ptr = ptr->next) {
|
||||
if (extension_cmp(name, ptr->name, ptr->family)) {
|
||||
struct xtables_target *clone;
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
#!/bin/sh
|
||||
|
||||
ARPTABLES_CONFIG=/etc/sysconfig/arptables
|
||||
|
||||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
start() {
|
||||
if [ ! -x /usr/sbin/arptables ]; then
|
||||
exit 4
|
||||
fi
|
||||
|
||||
# don't do squat if we don't have the config file
|
||||
if [ -f $ARPTABLES_CONFIG ]; then
|
||||
printf "Applying arptables firewall rules: "
|
||||
/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
|
||||
success || \
|
||||
failure
|
||||
touch /var/lock/subsys/arptables
|
||||
else
|
||||
failure
|
||||
echo "Configuration file /etc/sysconfig/arptables missing"
|
||||
exit 6
|
||||
fi
|
||||
}
|
||||
|
||||
stop() {
|
||||
printf "Removing user defined chains: "
|
||||
arptables -X && success || failure
|
||||
printf "Flushing all chains: "
|
||||
arptables -F && success || failure
|
||||
printf "Resetting built-in chains to the default ACCEPT policy: "
|
||||
arptables -P INPUT ACCEPT && \
|
||||
arptables -P OUTPUT ACCEPT && \
|
||||
success || \
|
||||
failure
|
||||
rm -f /var/lock/subsys/arptables
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
;;
|
||||
|
||||
stop)
|
||||
stop
|
||||
;;
|
||||
|
||||
restart|reload)
|
||||
# "restart" is really just "start" as this isn't a daemon,
|
||||
# and "start" clears any pre-defined rules anyway.
|
||||
# This is really only here to make those who expect it happy
|
||||
start
|
||||
;;
|
||||
|
||||
condrestart|try-restart|force-reload)
|
||||
[ -e /var/lock/subsys/arptables ] && start
|
||||
;;
|
||||
|
||||
*)
|
||||
exit 2
|
||||
esac
|
||||
|
||||
exit 0
|
||||
@ -0,0 +1,12 @@
|
||||
[Unit]
|
||||
Description=Automates a packet filtering firewall with arptables
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/libexec/arptables-helper start
|
||||
ExecStop=/usr/libexec/arptables-helper stop
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -0,0 +1,11 @@
|
||||
# Save current firewall rules on stop.
|
||||
# Value: yes|no, default: no
|
||||
# Saves all firewall rules if firewall gets stopped
|
||||
# (e.g. on system shutdown).
|
||||
EBTABLES_SAVE_ON_STOP="no"
|
||||
|
||||
# Save (and restore) rule counters.
|
||||
# Value: yes|no, default: no
|
||||
# Save rule counters when saving a kernel table to a file. If the
|
||||
# rule counters were saved, they will be restored when restoring the table.
|
||||
EBTABLES_SAVE_COUNTER="no"
|
||||
@ -0,0 +1,104 @@
|
||||
#!/bin/bash
|
||||
|
||||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
# internal variables
|
||||
EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
|
||||
EBTABLES_DATA=/etc/sysconfig/ebtables
|
||||
EBTABLES_TABLES="filter nat"
|
||||
if ebtables --version | grep -q '(legacy)'; then
|
||||
EBTABLES_TABLES+=" broute"
|
||||
fi
|
||||
VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
|
||||
|
||||
# ebtables-config defaults
|
||||
EBTABLES_SAVE_ON_STOP="no"
|
||||
EBTABLES_SAVE_COUNTER="no"
|
||||
|
||||
# load config if existing
|
||||
[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
|
||||
|
||||
initialize() {
|
||||
local ret=0
|
||||
for table in $EBTABLES_TABLES; do
|
||||
ebtables -t $table --init-table || ret=1
|
||||
done
|
||||
return $ret
|
||||
}
|
||||
|
||||
sanitize_dump() {
|
||||
local drop=false
|
||||
|
||||
export EBTABLES_TABLES
|
||||
|
||||
cat $1 | while read line; do
|
||||
case $line in
|
||||
\**)
|
||||
drop=false
|
||||
local table="${line#\*}"
|
||||
local found=false
|
||||
for t in $EBTABLES_TABLES; do
|
||||
if [[ $t == "$table" ]]; then
|
||||
found=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
$found || drop=true
|
||||
;;
|
||||
esac
|
||||
$drop || echo "$line"
|
||||
done
|
||||
}
|
||||
|
||||
start() {
|
||||
if [ -f $EBTABLES_DATA ]; then
|
||||
echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
|
||||
sanitize_dump $EBTABLES_DATA | ebtables-restore
|
||||
else
|
||||
echo -n $"ebtables: no stored ruleset, initializing empty tables: "
|
||||
initialize
|
||||
fi
|
||||
local ret=$?
|
||||
touch $VAR_SUBSYS_EBTABLES
|
||||
return $ret
|
||||
}
|
||||
|
||||
save() {
|
||||
echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
|
||||
export EBTABLES_SAVE_COUNTER
|
||||
ebtables-save >$EBTABLES_DATA && success || failure
|
||||
}
|
||||
|
||||
case $1 in
|
||||
start)
|
||||
[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
|
||||
start && success || failure
|
||||
RETVAL=$?
|
||||
;;
|
||||
stop)
|
||||
[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
|
||||
echo -n $"ebtables: stopping firewall: "
|
||||
initialize && success || failure
|
||||
RETVAL=$?
|
||||
rm -f $VAR_SUBSYS_EBTABLES
|
||||
;;
|
||||
save)
|
||||
save
|
||||
;;
|
||||
*)
|
||||
echo "usage: ${0##*/} {start|stop|save}" >&2
|
||||
RETVAL=2
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
@ -0,0 +1,11 @@
|
||||
[Unit]
|
||||
Description=Ethernet Bridge Filtering tables
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/libexec/ebtables-helper start
|
||||
ExecStop=/usr/libexec/ebtables-helper stop
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -0,0 +1,59 @@
|
||||
# Load additional iptables modules (nat helpers)
|
||||
# Default: -none-
|
||||
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
|
||||
# are loaded after the firewall rules are applied. Options for the helpers are
|
||||
# stored in /etc/modprobe.conf.
|
||||
IPTABLES_MODULES=""
|
||||
|
||||
# Save current firewall rules on stop.
|
||||
# Value: yes|no, default: no
|
||||
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
|
||||
# (e.g. on system shutdown).
|
||||
IPTABLES_SAVE_ON_STOP="no"
|
||||
|
||||
# Save current firewall rules on restart.
|
||||
# Value: yes|no, default: no
|
||||
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
|
||||
# restarted.
|
||||
IPTABLES_SAVE_ON_RESTART="no"
|
||||
|
||||
# Save (and restore) rule and chain counter.
|
||||
# Value: yes|no, default: no
|
||||
# Save counters for rules and chains to /etc/sysconfig/iptables if
|
||||
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
|
||||
# SAVE_ON_RESTART is enabled.
|
||||
IPTABLES_SAVE_COUNTER="no"
|
||||
|
||||
# Numeric status output
|
||||
# Value: yes|no, default: yes
|
||||
# Print IP addresses and port numbers in numeric format in the status output.
|
||||
IPTABLES_STATUS_NUMERIC="yes"
|
||||
|
||||
# Verbose status output
|
||||
# Value: yes|no, default: yes
|
||||
# Print info about the number of packets and bytes plus the "input-" and
|
||||
# "outputdevice" in the status output.
|
||||
IPTABLES_STATUS_VERBOSE="no"
|
||||
|
||||
# Status output with numbered lines
|
||||
# Value: yes|no, default: yes
|
||||
# Print a counter/number for every rule in the status output.
|
||||
IPTABLES_STATUS_LINENUMBERS="yes"
|
||||
|
||||
# Reload sysctl settings on start and restart
|
||||
# Default: -none-
|
||||
# Space separated list of sysctl items which are to be reloaded on start.
|
||||
# List items will be matched by fgrep.
|
||||
#IPTABLES_SYSCTL_LOAD_LIST=".nf_conntrack .bridge-nf"
|
||||
|
||||
# Set wait option for iptables-restore calls in seconds
|
||||
# Default: 600
|
||||
# Set to 0 to deactivate the wait.
|
||||
#IPTABLES_RESTORE_WAIT=600
|
||||
|
||||
# Set wait interval option for iptables-restore calls in microseconds
|
||||
# Default: 1000000
|
||||
# Set to 100000 to try to get the lock every 100000 microseconds, 10 times a
|
||||
# second.
|
||||
# Only usable with IPTABLES_RESTORE_WAIT > 0
|
||||
#IPTABLES_RESTORE_WAIT_INTERVAL=1000000
|
||||
@ -0,0 +1,450 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# iptables Start iptables firewall
|
||||
#
|
||||
# chkconfig: 2345 08 92
|
||||
# description: Starts, stops and saves iptables firewall
|
||||
#
|
||||
# config: /etc/sysconfig/iptables
|
||||
# config: /etc/sysconfig/iptables-config
|
||||
#
|
||||
### BEGIN INIT INFO
|
||||
# Provides: iptables
|
||||
# Required-Start:
|
||||
# Required-Stop:
|
||||
# Default-Start: 2 3 4 5
|
||||
# Default-Stop: 0 1 6
|
||||
# Short-Description: start and stop iptables firewall
|
||||
# Description: Start, stop and save iptables firewall
|
||||
### END INIT INFO
|
||||
|
||||
# compat for removed initscripts dependency
|
||||
|
||||
success() {
|
||||
echo -n "[ OK ]"
|
||||
return 0
|
||||
}
|
||||
|
||||
warning() {
|
||||
echo -n "[WARNING]"
|
||||
return 1
|
||||
}
|
||||
|
||||
failure() {
|
||||
echo -n "[FAILED]"
|
||||
return 1
|
||||
}
|
||||
|
||||
IPTABLES=iptables
|
||||
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
|
||||
IPTABLES_FALLBACK_DATA=${IPTABLES_DATA}.fallback
|
||||
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
|
||||
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
|
||||
[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
|
||||
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
|
||||
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
|
||||
|
||||
# only usable for root
|
||||
if [ $EUID != 0 ]; then
|
||||
echo -n $"${IPTABLES}: Only usable by root."; warning; echo
|
||||
exit 4
|
||||
fi
|
||||
|
||||
if [ ! -x /sbin/$IPTABLES ]; then
|
||||
echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
|
||||
exit 5
|
||||
fi
|
||||
|
||||
# Default firewall configuration:
|
||||
IPTABLES_MODULES=""
|
||||
IPTABLES_SAVE_ON_STOP="no"
|
||||
IPTABLES_SAVE_ON_RESTART="no"
|
||||
IPTABLES_SAVE_COUNTER="no"
|
||||
IPTABLES_STATUS_NUMERIC="yes"
|
||||
IPTABLES_STATUS_VERBOSE="no"
|
||||
IPTABLES_STATUS_LINENUMBERS="yes"
|
||||
IPTABLES_SYSCTL_LOAD_LIST=""
|
||||
IPTABLES_RESTORE_WAIT=600
|
||||
IPTABLES_RESTORE_WAIT_INTERVAL=1000000
|
||||
|
||||
# Load firewall configuration.
|
||||
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
|
||||
|
||||
is_iptables_nft() {
|
||||
iptables --version | grep -q '(nf_tables)'
|
||||
}
|
||||
|
||||
netfilter_active() {
|
||||
is_iptables_nft && return 0
|
||||
[ -e "$PROC_IPTABLES_NAMES" ]
|
||||
}
|
||||
|
||||
netfilter_tables() {
|
||||
netfilter_active || return 1
|
||||
is_iptables_nft && {
|
||||
# explicitly omit security table from this list as
|
||||
# it should be reserved for SELinux use
|
||||
echo "raw mangle filter nat"
|
||||
return 0
|
||||
}
|
||||
cat "$PROC_IPTABLES_NAMES" 2>/dev/null
|
||||
}
|
||||
|
||||
# Get active tables
|
||||
NF_TABLES=$(netfilter_tables)
|
||||
|
||||
|
||||
flush_n_delete() {
|
||||
# Flush firewall rules and delete chains.
|
||||
netfilter_active || return 0
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
[ -z "$NF_TABLES" ] && return 1
|
||||
|
||||
echo -n $"${IPTABLES}: Flushing firewall rules: "
|
||||
ret=0
|
||||
# For all tables
|
||||
for i in $NF_TABLES; do
|
||||
# Flush firewall rules.
|
||||
$IPTABLES -t $i -F;
|
||||
let ret+=$?;
|
||||
|
||||
# Delete firewall chains.
|
||||
$IPTABLES -t $i -X;
|
||||
let ret+=$?;
|
||||
|
||||
# Set counter to zero.
|
||||
$IPTABLES -t $i -Z;
|
||||
let ret+=$?;
|
||||
done
|
||||
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
return $ret
|
||||
}
|
||||
|
||||
set_policy() {
|
||||
# Set policy for configured tables.
|
||||
policy=$1
|
||||
|
||||
# Check if iptable module is loaded
|
||||
netfilter_active || return 0
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
tables=$(netfilter_tables)
|
||||
[ -z "$tables" ] && return 1
|
||||
|
||||
echo -n $"${IPTABLES}: Setting chains to policy $policy: "
|
||||
ret=0
|
||||
for i in $tables; do
|
||||
echo -n "$i "
|
||||
case "$i" in
|
||||
raw)
|
||||
$IPTABLES -t raw -P PREROUTING $policy \
|
||||
&& $IPTABLES -t raw -P OUTPUT $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
filter)
|
||||
$IPTABLES -t filter -P INPUT $policy \
|
||||
&& $IPTABLES -t filter -P OUTPUT $policy \
|
||||
&& $IPTABLES -t filter -P FORWARD $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
nat)
|
||||
$IPTABLES -t nat -P PREROUTING $policy \
|
||||
&& $IPTABLES -t nat -P POSTROUTING $policy \
|
||||
&& $IPTABLES -t nat -P OUTPUT $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
mangle)
|
||||
$IPTABLES -t mangle -P PREROUTING $policy \
|
||||
&& $IPTABLES -t mangle -P POSTROUTING $policy \
|
||||
&& $IPTABLES -t mangle -P INPUT $policy \
|
||||
&& $IPTABLES -t mangle -P OUTPUT $policy \
|
||||
&& $IPTABLES -t mangle -P FORWARD $policy \
|
||||
|| let ret+=1
|
||||
;;
|
||||
*)
|
||||
let ret+=1
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
return $ret
|
||||
}
|
||||
|
||||
load_sysctl() {
|
||||
# load matched sysctl values
|
||||
if [ -n "$IPTABLES_SYSCTL_LOAD_LIST" ]; then
|
||||
echo -n $"Loading sysctl settings: "
|
||||
ret=0
|
||||
for item in $IPTABLES_SYSCTL_LOAD_LIST; do
|
||||
fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
|
||||
let ret+=$?;
|
||||
done
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
fi
|
||||
return $ret
|
||||
}
|
||||
|
||||
start() {
|
||||
# Do not start if there is no config file.
|
||||
if [ ! -f "$IPTABLES_DATA" ]; then
|
||||
echo -n $"${IPTABLES}: No config file."; warning; echo
|
||||
return 6
|
||||
fi
|
||||
|
||||
# check if ipv6 module load is deactivated
|
||||
if [ "${_IPV}" = "ipv6" ] \
|
||||
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
||||
echo $"${IPTABLES}: ${_IPV} is disabled."
|
||||
return 150
|
||||
fi
|
||||
|
||||
echo -n $"${IPTABLES}: Applying firewall rules: "
|
||||
|
||||
OPT=
|
||||
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||
if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
|
||||
OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
|
||||
if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
|
||||
OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
|
||||
fi
|
||||
fi
|
||||
|
||||
$IPTABLES-restore $OPT $IPTABLES_DATA
|
||||
if [ $? -eq 0 ]; then
|
||||
success; echo
|
||||
else
|
||||
failure; echo;
|
||||
if [ -f "$IPTABLES_FALLBACK_DATA" ]; then
|
||||
echo -n $"${IPTABLES}: Applying firewall fallback rules: "
|
||||
$IPTABLES-restore $OPT $IPTABLES_FALLBACK_DATA
|
||||
if [ $? -eq 0 ]; then
|
||||
success; echo
|
||||
else
|
||||
failure; echo; return 1
|
||||
fi
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Load additional modules (helpers)
|
||||
if [ -n "$IPTABLES_MODULES" ]; then
|
||||
echo -n $"${IPTABLES}: Loading additional modules: "
|
||||
ret=0
|
||||
for mod in $IPTABLES_MODULES; do
|
||||
echo -n "$mod "
|
||||
modprobe $mod > /dev/null 2>&1
|
||||
let ret+=$?;
|
||||
done
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
fi
|
||||
|
||||
# Load sysctl settings
|
||||
load_sysctl
|
||||
|
||||
touch $VAR_SUBSYS_IPTABLES
|
||||
return $ret
|
||||
}
|
||||
|
||||
stop() {
|
||||
# Do not stop if iptables module is not loaded.
|
||||
netfilter_active || return 0
|
||||
|
||||
# Set default chain policy to ACCEPT, in order to not break shutdown
|
||||
# on systems where the default policy is DROP and root device is
|
||||
# network-based (i.e.: iSCSI, NFS)
|
||||
set_policy ACCEPT
|
||||
# And then, flush the rules and delete chains
|
||||
flush_n_delete
|
||||
|
||||
rm -f $VAR_SUBSYS_IPTABLES
|
||||
return $ret
|
||||
}
|
||||
|
||||
save() {
|
||||
# Check if iptable module is loaded
|
||||
if ! netfilter_active; then
|
||||
echo -n $"${IPTABLES}: Nothing to save."; warning; echo
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
if [ -z "$NF_TABLES" ]; then
|
||||
echo -n $"${IPTABLES}: Nothing to save."; warning; echo
|
||||
return 6
|
||||
fi
|
||||
|
||||
echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
|
||||
|
||||
OPT=
|
||||
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||
|
||||
ret=0
|
||||
TMP_FILE=$(/bin/mktemp -q $IPTABLES_DATA.XXXXXX) \
|
||||
&& chmod 600 "$TMP_FILE" \
|
||||
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
|
||||
&& size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|
||||
|| ret=1
|
||||
if [ $ret -eq 0 ]; then
|
||||
if [ -e $IPTABLES_DATA ]; then
|
||||
cp -f $IPTABLES_DATA $IPTABLES_DATA.save \
|
||||
&& chmod 600 $IPTABLES_DATA.save \
|
||||
&& restorecon $IPTABLES_DATA.save \
|
||||
|| ret=1
|
||||
fi
|
||||
if [ $ret -eq 0 ]; then
|
||||
mv -f $TMP_FILE $IPTABLES_DATA \
|
||||
&& chmod 600 $IPTABLES_DATA \
|
||||
&& restorecon $IPTABLES_DATA \
|
||||
|| ret=1
|
||||
fi
|
||||
fi
|
||||
rm -f $TMP_FILE
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
return $ret
|
||||
}
|
||||
|
||||
status() {
|
||||
if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
|
||||
echo $"${IPTABLES}: Firewall is not running."
|
||||
return 3
|
||||
fi
|
||||
|
||||
# Do not print status if lockfile is missing and iptables modules are not
|
||||
# loaded.
|
||||
# Check if iptable modules are loaded
|
||||
if ! netfilter_active; then
|
||||
echo $"${IPTABLES}: Firewall modules are not loaded."
|
||||
return 3
|
||||
fi
|
||||
|
||||
# Check if firewall is configured (has tables)
|
||||
if [ -z "$NF_TABLES" ]; then
|
||||
echo $"${IPTABLES}: Firewall is not configured. "
|
||||
return 3
|
||||
fi
|
||||
|
||||
NUM=
|
||||
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
|
||||
VERBOSE=
|
||||
[ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
|
||||
COUNT=
|
||||
[ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
|
||||
|
||||
for table in $NF_TABLES; do
|
||||
echo $"Table: $table"
|
||||
$IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
|
||||
done
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
reload() {
|
||||
# Do not reload if there is no config file.
|
||||
if [ ! -f "$IPTABLES_DATA" ]; then
|
||||
echo -n $"${IPTABLES}: No config file."; warning; echo
|
||||
return 6
|
||||
fi
|
||||
|
||||
# check if ipv6 module load is deactivated
|
||||
if [ "${_IPV}" = "ipv6" ] \
|
||||
&& grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
|
||||
echo $"${IPTABLES}: ${_IPV} is disabled."
|
||||
return 150
|
||||
fi
|
||||
|
||||
echo -n $"${IPTABLES}: Trying to reload firewall rules: "
|
||||
|
||||
OPT=
|
||||
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
|
||||
if [ $IPTABLES_RESTORE_WAIT -ne 0 ]; then
|
||||
OPT="${OPT} --wait ${IPTABLES_RESTORE_WAIT}"
|
||||
if [ $IPTABLES_RESTORE_WAIT_INTERVAL -lt 1000000 ]; then
|
||||
OPT="${OPT} --wait-interval ${IPTABLES_RESTORE_WAIT_INTERVAL}"
|
||||
fi
|
||||
fi
|
||||
|
||||
$IPTABLES-restore $OPT $IPTABLES_DATA
|
||||
if [ $? -eq 0 ]; then
|
||||
success; echo
|
||||
else
|
||||
failure; echo; echo "Firewall rules are not changed."; return 1
|
||||
fi
|
||||
|
||||
# Load additional modules (helpers)
|
||||
if [ -n "$IPTABLES_MODULES" ]; then
|
||||
echo -n $"${IPTABLES}: Loading additional modules: "
|
||||
ret=0
|
||||
for mod in $IPTABLES_MODULES; do
|
||||
echo -n "$mod "
|
||||
modprobe $mod > /dev/null 2>&1
|
||||
let ret+=$?;
|
||||
done
|
||||
[ $ret -eq 0 ] && success || failure
|
||||
echo
|
||||
fi
|
||||
|
||||
# Load sysctl settings
|
||||
load_sysctl
|
||||
|
||||
return $ret
|
||||
}
|
||||
|
||||
restart() {
|
||||
[ "x$IPTABLES_SAVE_ON_RESTART" = "xyes" ] && save
|
||||
stop
|
||||
start
|
||||
}
|
||||
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
[ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
||||
start
|
||||
RETVAL=$?
|
||||
;;
|
||||
stop)
|
||||
[ "x$IPTABLES_SAVE_ON_STOP" = "xyes" ] && save
|
||||
stop
|
||||
RETVAL=$?
|
||||
;;
|
||||
restart|force-reload)
|
||||
restart
|
||||
RETVAL=$?
|
||||
;;
|
||||
reload)
|
||||
[ -e "$VAR_SUBSYS_IPTABLES" ] && reload
|
||||
RETVAL=$?
|
||||
;;
|
||||
condrestart|try-restart)
|
||||
[ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
|
||||
restart
|
||||
RETVAL=$?
|
||||
;;
|
||||
status)
|
||||
status
|
||||
RETVAL=$?
|
||||
;;
|
||||
panic)
|
||||
set_policy DROP
|
||||
RETVAL=$?
|
||||
;;
|
||||
save)
|
||||
save
|
||||
RETVAL=$?
|
||||
;;
|
||||
*)
|
||||
echo $"Usage: ${IPTABLES} {start|stop|reload|restart|condrestart|status|panic|save}"
|
||||
RETVAL=2
|
||||
;;
|
||||
esac
|
||||
|
||||
exit $RETVAL
|
||||
@ -0,0 +1,17 @@
|
||||
[Unit]
|
||||
Description=IPv4 firewall with iptables
|
||||
AssertPathExists=/etc/sysconfig/iptables
|
||||
Before=network-pre.target
|
||||
Wants=network-pre.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
ExecStart=/usr/libexec/iptables/iptables.init start
|
||||
ExecReload=/usr/libexec/iptables/iptables.init reload
|
||||
ExecStop=/usr/libexec/iptables/iptables.init stop
|
||||
Environment=BOOTUP=serial
|
||||
Environment=CONSOLETYPE=serial
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@ -0,0 +1,15 @@
|
||||
# sample configuration for ip6tables service
|
||||
# you can edit this manually or use system-config-firewall
|
||||
# please do not ask us to add additional ports/services to this default configuration
|
||||
*filter
|
||||
:INPUT ACCEPT [0:0]
|
||||
:FORWARD ACCEPT [0:0]
|
||||
:OUTPUT ACCEPT [0:0]
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
-A INPUT -p ipv6-icmp -j ACCEPT
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
||||
-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT
|
||||
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
|
||||
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
|
||||
COMMIT
|
||||
@ -0,0 +1,14 @@
|
||||
# sample configuration for iptables service
|
||||
# you can edit this manually or use system-config-firewall
|
||||
# please do not ask us to add additional ports/services to this default configuration
|
||||
*filter
|
||||
:INPUT ACCEPT [0:0]
|
||||
:FORWARD ACCEPT [0:0]
|
||||
:OUTPUT ACCEPT [0:0]
|
||||
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
-A INPUT -p icmp -j ACCEPT
|
||||
-A INPUT -i lo -j ACCEPT
|
||||
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
|
||||
-A INPUT -j REJECT --reject-with icmp-host-prohibited
|
||||
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
|
||||
COMMIT
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue