RHBA-2013:1710 - Bug Fix Advisory

Topic

Updated iptables packages that fix several bugs and add two enhancements are now
available for Red Hat Enterprise Linux 6.

Description

The iptables utility controls the network packet filtering code in the Linux
kernel. The utility allows users to perform certain operations such as setting
up firewalls or IP masquerading.

This update fixes the following bugs:

• A previous version of iptables added the "alternatives" functionality support

for the /lib/xtables/ or /lib64/xtables/ directory. However, iptables failed to
replace the directory with the alternatives slave symbolic link when upgrading
iptables with the "yum upgrade" command and the directory contained custom
plug-in files. Consequently, some iptables modules became unavailable. This
problem has been fixed by modifying the iptables spec file so that the
/lib/xtables/ or /lib64/xtables/ directory is no longer managed by
"alternatives". (BZ#924362)

• The iptables-save command previously supported only the "--modprobe=" option

to specify the path to the modprobe executable. However, the iptables-save(8)
man page incorrectly stated that this action could have been performed using an
unsupported option, "-M", which could lead to confusion. The iptables-save
command has been modified to support the "-M" option for specifying the path to
modprobe, and corrects the iptables-save(8) man page, which now correctly
mentions both the "-M" and "--modprobe=" option. (BZ#983198)

• Due to a bug in the iptables init script, the system could become unresponsive

during shutdown when using the network-based root device and the default filter
for INPUT or OUTPUT policy was DROP. This problem has been fixed by setting the
default chain policy to ACCEPT before flushing the iptables rules and deleting
the iptables chains. (BZ#1007632)

In addition, this update adds the following enhancements:

• The iptables utility has been modified to support a new option,

"--queue-bypass", which allows bypassing an NFQUEUE rule if the specified queue
is not used. (BZ#845435)

• A new iptables service option,"reload", has been added to enable a refresh of

the firewall rules without unloading netfilter kernel modules and a possible
drop of connections. (BZ#928812)

Users of iptables are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 845435 - "--queue-bypass" backport
• BZ - 924362 - New alternatives doesn't verify if /lib*/xtables is symlinked correctly
• BZ - 983198 - iptables-save man page completely wrong - which conflicting arguments should work?

CVEs

(none)

References

(none)