Issued:

2013-02-20

Updated:

2013-02-20

RHBA-2013:0332 - iptables bug fix and enhancement update

Synopsis

iptables bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated iptables packages that fix several bugs and add two enhancements are now available for Red Hat Enterprise Linux 6.

Description

The iptables utility controls the network packet filtering code in the Linux kernel.

This update fixes the following bugs:

• The sysctl values for certain netfilter kernel modules, such as nf_conntrack and xt_conntrack, were not restored after a firewall restart. Consequently, the firewall did not always perform as expected after a restart. This update allows iptables to load sysctl settings on start if specified by the user in the /etc/sysctl.conf file. Users can now define sysctl settings to load on start and restart. (BZ#800208)

• The iptables(8) and ip6tables(8) man pages were previously missing information about the AUDIT target module, which allows creating audit records of the packet flow. This update adds the missing description of the audit support to these man pages. (BZ#809108)

• The iptables and ip6tables commands did not correctly handle calculation of the maximum length of iptables chains. Consequently, when assigning a firewall rule to an iptables chain with a name longer than 28 characters, the iptables or ip6tables command terminated with a buffer overflow and the rule was not assigned. This update corrects the related code so that iptables and ip6tables now handle names of iptable chains correctly and a firewall rule is assigned in the described scenario as expected. (BZ#821441)

• The iptables init script calls the /sbin/restorecon binary when saving firewall rules so that the iptables packages depend on the policycoreutils packages. However, the iptables packages previously did not require the policycoreutils as a dependency. Consequently, the "/etc/init.d/iptables save" command failed if the policycoreutils packages were not installed on the system. This update modifies the iptables spec file to require the policycoreutils packages as its prerequisite and thus prevents this problem from occurring. (BZ#836286)

In addition, this update adds the following enhancements:

• The iptables packages has been modified to support the update-alternatives mechanism to allow easier delivery of new iptables versions for the MRG Realtime kernel. (BZ#747068)

• Fallback mode has been added for the iptables and ip6tables services. A fallback firewall configuration can be stored in the /etc/sysconfig/iptables.fallback and /etc/sysconfig/ip6tables.fallback files in the iptables-save file format. The firewall rules from the fallback file are used if the service fails to apply the firewall rules from the /etc/sysconfig/iptables file (or the /etc/sysconfig/ip6tables file in case of ip6tables). (BZ#808272)

All users of iptables are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• iptables-devel-1.4.7-9.el6.ppc64.rpm
• iptables-debuginfo-1.4.7-9.el6.x86_64.rpm
• iptables-1.4.7-9.el6.s390.rpm
• iptables-ipv6-1.4.7-9.el6.s390x.rpm
• iptables-devel-1.4.7-9.el6.i686.rpm
• iptables-1.4.7-9.el6.i686.rpm
• iptables-debuginfo-1.4.7-9.el6.ppc64.rpm
• iptables-debuginfo-1.4.7-9.el6.s390x.rpm
• iptables-devel-1.4.7-9.el6.s390x.rpm
• iptables-1.4.7-9.el6.s390x.rpm
• iptables-1.4.7-9.el6.ppc64.rpm
• iptables-debuginfo-1.4.7-9.el6.i686.rpm
• iptables-1.4.7-9.el6.x86_64.rpm
• iptables-devel-1.4.7-9.el6.ppc.rpm
• iptables-devel-1.4.7-9.el6.x86_64.rpm
• iptables-debuginfo-1.4.7-9.el6.s390.rpm
• iptables-ipv6-1.4.7-9.el6.i686.rpm
• iptables-1.4.7-9.el6.ppc.rpm
• iptables-1.4.7-9.el6.src.rpm
• iptables-ipv6-1.4.7-9.el6.x86_64.rpm
• iptables-devel-1.4.7-9.el6.s390.rpm
• iptables-debuginfo-1.4.7-9.el6.ppc.rpm
• iptables-ipv6-1.4.7-9.el6.ppc64.rpm

Fixes

• This content is not included.BZ - 809108
• This content is not included.BZ - 836286

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.