RHBA-2015:1404 - Bug Fix Advisory

Topic

Updated iptables packages that fix several bugs and add two enhancements are now
available for Red Hat Enterprise Linux 6.

Description

The iptables utility controls the network packet filtering code in the Linux
kernel.

This update fixes the following bugs:

• Previously, no iptables revision was used for rules that match an ipset. As a

consequence, iptables rules with the match-set option could be added, but not
removed again, as the rules could not be located again for their removal. This
update adds revision 0 and 1 code patches for libipt_SET. As a result, new ipset
match rules can now be removed. Please note that adding and removing rules using
the match-set option now works with the patch applied, but removing a rule that
was added with an earlier version of iptables does not work and cannot be fixed.
Use the rule number to remove such rules. (BZ#1081422)

• In iptables version 1.4.7-9, the use of alternatives was introduced. Because

of the use of versioned (/lib*/xtables-%{version}) custom plug-ins, the plug-ins
had to be placed in the appropriate versioned plug-in directory. Starting with
iptables version 1.4.7-10, the plug-in directory was reverted back to
/lib*/xtables/, but custom plug-ins from iptables version 1.4.7-9 were not
copied over. Consequently, upgrading iptables 1.4.7-9 to a newer version led to
a loss of custom plug-ins. A plug-in update trigger which detects updates to
iptables from version 1.4.7-15 and lower has been added. As a result, custom
plug-ins from the /%{_lib}/xtables-1.4.7/ directory are copied to the
/%{_lib}/xtables/ directory if the plug-in in /%{_lib}/xtables-1.4.7/ has a
newer file date or if it does not exist in the destination directory while
updating from iptables version earlier than 1.4.7-15 to a newer version.
(BZ#1088400)

• Previously, a space after Datagram Congestion Control Protocol (DCCP) packet

types for print and save was missing, which led to malformed output. With this
update, a space has been added at the end of the print_types() function output.
As a result, the output of the "iptables -L", "iptables -S", and iptables-save
commands is now correct. (BZ#1084974)

• Previously, some init script warning messages for a failed euid 0 check (no

configuration file and nothing to save) were missing. Consequently, only exit
status codes were provided in these cases, but no messages. This update adds the
warning messages that are now provided in the described situation. (BZ#1081191)

In addition, this update adds the following enhancements:

• This update adds support for IPv6 ipset, as ipsets were not previously usable

in IPv6 firewall rules. (BZ#1161330)

• This update adds support for the "-C" check option for the ip*tables commands.

Previously, there was no simple way to check if a certain rule exists. Now, the
"-C" option can be used in a rule to check if a rule exists. (BZ#1088361)

Users of iptables are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 1084974 - iptables-save cuts space before -j

CVEs

(none)

References

(none)