RHBA-2013:0332 - Bug Fix Advisory

Topic

Updated iptables packages that fix several bugs and add two enhancements are now
available for Red Hat Enterprise Linux 6.

Description

The iptables utility controls the network packet filtering code in the Linux
kernel.

This update fixes the following bugs:

• The sysctl values for certain netfilter kernel modules, such as nf_conntrack

and xt_conntrack, were not restored after a firewall restart. Consequently, the
firewall did not always perform as expected after a restart. This update allows
iptables to load sysctl settings on start if specified by the user in the
/etc/sysctl.conf file. Users can now define sysctl settings to load on start and
restart. (BZ#800208)

• The iptables(8) and ip6tables(8) man pages were previously missing information

about the AUDIT target module, which allows creating audit records of the packet
flow. This update adds the missing description of the audit support to these man
pages. (BZ#809108)

• The iptables and ip6tables commands did not correctly handle calculation of

the maximum length of iptables chains. Consequently, when assigning a firewall
rule to an iptables chain with a name longer than 28 characters, the iptables or
ip6tables command terminated with a buffer overflow and the rule was not
assigned. This update corrects the related code so that iptables and ip6tables
now handle names of iptable chains correctly and a firewall rule is assigned in
the described scenario as expected. (BZ#821441)

• The iptables init script calls the /sbin/restorecon binary when saving

firewall rules so that the iptables packages depend on the policycoreutils
packages. However, the iptables packages previously did not require the
policycoreutils as a dependency. Consequently, the "/etc/init.d/iptables save"
command failed if the policycoreutils packages were not installed on the system.
This update modifies the iptables spec file to require the policycoreutils
packages as its prerequisite and thus prevents this problem from occurring.
(BZ#836286)

In addition, this update adds the following enhancements:

• The iptables packages has been modified to support the update-alternatives

mechanism to allow easier delivery of new iptables versions for the MRG Realtime
kernel. (BZ#747068)

• Fallback mode has been added for the iptables and ip6tables services. A

fallback firewall configuration can be stored in the
/etc/sysconfig/iptables.fallback and /etc/sysconfig/ip6tables.fallback files in
the iptables-save file format. The firewall rules from the fallback file are
used if the service fails to apply the firewall rules from the
/etc/sysconfig/iptables file (or the /etc/sysconfig/ip6tables file in case of
ip6tables). (BZ#808272)

All users of iptables are advised to upgrade to these updated packages, which
fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 809108 - man page, missing auditing support
• BZ - 836286 - iptables init script calls /sbin/restorecon, but iptables rpm doesn't require the corresponding policycoreutils package

CVEs

(none)

References

(none)