# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
-#IPTABLES_MODULES_UNLOAD="yes"
+IPTABLES_MODULES_UNLOAD="yes"
# Save current firewall rules on stop.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
-#IPTABLES_SAVE_ON_STOP="no"
+IPTABLES_SAVE_ON_STOP="no"
# Save current firewall rules on restart.
# Value: yes|no, default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
-#IPTABLES_SAVE_ON_RESTART="no"
+IPTABLES_SAVE_ON_RESTART="no"
# Save (and restore) rule and chain counter.
# Value: yes|no, default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
-#IPTABLES_SAVE_COUNTER="no"
+IPTABLES_SAVE_COUNTER="no"
# Numeric status output
-# Value: yes|no, default: no
+# Value: yes|no, default: yes
# Print IP addresses and port numbers in numeric format in the status output.
-#IPTABLES_STATUS_NUMERIC="no"
+IPTABLES_STATUS_NUMERIC="no"
+
+# Verbose status output
+# Value: yes|no, default: yes
+# Print info about the number of packets and bytes plus the "input-" and
+# "outputdevice" in the status output.
+IPTABLES_STATUS_VERBOSE="yes"
+
+# Status output with numbered lines
+# Value: yes|no, default: yes
+# Print a counter/number for every rule in the status output.
+IPTABLES_STATUS_LINENUMBERS="yes"
#
# config: /etc/sysconfig/iptables
# config: /etc/sysconfig/iptables-config
+#
+### BEGIN INIT INFO
+# Provides: iptables
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: start and stop iptables firewall
+# Description: Start, stop and save iptables firewall
+### END INIT INFO
+
+# from http://fr2.rpmfind.net/linux/fedora/releases/10/Everything/source/SRPMS/iptables-1.4.1.1-2.fc10.src.rpm
# Source function library.
. /etc/init.d/functions
IPTABLES_DATA=/etc/sysconfig/$IPTABLES
IPTABLES_CONFIG=/etc/sysconfig/${IPTABLES}-config
IPV=${IPTABLES%tables} # ip for ipv4 | ip6 for ipv6
+[ "$IPV" = "ip" ] && _IPV="ipv4" || _IPV="ipv6"
PROC_IPTABLES_NAMES=/proc/net/${IPV}_tables_names
VAR_SUBSYS_IPTABLES=/var/lock/subsys/$IPTABLES
if [ ! -x /sbin/$IPTABLES ]; then
- echo -n $"/sbin/$IPTABLES does not exist."; warning; echo
- exit 0
-fi
-
-if lsmod 2>/dev/null | grep -q ipchains ; then
- echo -n $"ipchains and $IPTABLES can not be used together."; warning; echo
- exit 0
+ echo -n $"${IPTABLES}: /sbin/$IPTABLES does not exist."; warning; echo
+ exit 5
fi
# Old or new modutils
IPTABLES_SAVE_ON_STOP="no"
IPTABLES_SAVE_ON_RESTART="no"
IPTABLES_SAVE_COUNTER="no"
-IPTABLES_STATUS_NUMERIC="no"
+IPTABLES_STATUS_NUMERIC="yes"
# Load firewall configuration.
[ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
+# Netfilter modules
+NF_MODULES=($(lsmod | awk "/^${IPV}table_/ {print \$1}") ${IPV}_tables)
+NF_MODULES_COMMON=(x_tables nf_nat nf_conntrack) # Used by netfilter v4 and v6
+
+# Get active tables
+NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+
+
rmmod_r() {
# Unload module with all referring modules.
# At first all referring modules will be unloaded, then the module itself.
# Get referring modules.
# New modutils have another output format.
[ $NEW_MODUTILS = 1 ] \
- && ref=`lsmod | awk "/^${mod}/ { print \\\$4; }" | tr ',' ' '` \
- || ref=`lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1`
+ && ref=$(lsmod | awk "/^${mod}/ { print \$4; }" | tr ',' ' ') \
+ || ref=$(lsmod | grep ^${mod} | cut -d "[" -s -f 2 | cut -d "]" -s -f 1)
# recursive call for all referring modules
for i in $ref; do
# after all referring modules are unloaded.
if grep -q "^${mod}" /proc/modules ; then
modprobe -r $mod > /dev/null 2>&1
- let ret+=$?;
+ res=$?
+ [ $res -eq 0 ] || echo -n " $mod"
+ let ret+=$res;
fi
return $ret
flush_n_delete() {
# Flush firewall rules and delete chains.
- [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- [ -z "$tables" ] && return 1
+ [ -z "$NF_TABLES" ] && return 1
- echo -n $"Flushing firewall rules: "
+ echo -n $"${IPTABLES}: Flushing firewall rules: "
ret=0
# For all tables
- for i in $tables; do
+ for i in $NF_TABLES; do
# Flush firewall rules.
$IPTABLES -t $i -F;
let ret+=$?;
policy=$1
# Check if iptable module is loaded
- [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
+ tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
[ -z "$tables" ] && return 1
- echo -n $"Setting chains to policy $policy: "
+ echo -n $"${IPTABLES}: Setting chains to policy $policy: "
ret=0
for i in $tables; do
echo -n "$i "
case "$i" in
+ raw)
+ $IPTABLES -t raw -P PREROUTING $policy \
+ && $IPTABLES -t raw -P OUTPUT $policy \
+ || let ret+=1
+ ;;
filter)
$IPTABLES -t filter -P INPUT $policy \
&& $IPTABLES -t filter -P OUTPUT $policy \
start() {
# Do not start if there is no config file.
- [ -f "$IPTABLES_DATA" ] || return 1
+ [ ! -f "$IPTABLES_DATA" ] && return 6
- echo -n $"Applying $IPTABLES firewall rules: "
+ # check if ipv6 module load is deactivated
+ if [ "${_IPV}" = "ipv6" ] \
+ && grep -qIsE "^install[[:space:]]+${_IPV}[[:space:]]+/bin/(true|false)" /etc/modprobe.conf /etc/modprobe.d/* ; then
+ echo $"${IPTABLES}: ${_IPV} is disabled."
+ return 150
+ fi
+
+ echo -n $"${IPTABLES}: Applying firewall rules: "
OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
# Load additional modules (helpers)
if [ -n "$IPTABLES_MODULES" ]; then
- echo -n $"Loading additional $IPTABLES modules: "
+ echo -n $"${IPTABLES}: Loading additional modules: "
ret=0
for mod in $IPTABLES_MODULES; do
echo -n "$mod "
}
stop() {
-
- # Do not stop if iptables module is not loaded.
- [ -e "$PROC_IPTABLES_NAMES" ] || return 1
+ # Do not stop if iptables module is not loaded.
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
flush_n_delete
set_policy ACCEPT
if [ "x$IPTABLES_MODULES_UNLOAD" = "xyes" ]; then
- echo -n $"Unloading $IPTABLES modules: "
+ echo -n $"${IPTABLES}: Unloading modules: "
ret=0
- rmmod_r ${IPV}_tables
- let ret+=$?;
- rmmod_r ${IPV}_conntrack
- let ret+=$?;
+ for mod in ${NF_MODULES[*]}; do
+ rmmod_r $mod
+ let ret+=$?;
+ done
+ # try to unload remaining netfilter modules used by ipv4 and ipv6
+ # netfilter
+ for mod in ${NF_MODULES_COMMON[*]}; do
+ rmmod_r $mod >/dev/null
+ done
[ $ret -eq 0 ] && success || failure
echo
fi
save() {
# Check if iptable module is loaded
- [ ! -e "$PROC_IPTABLES_NAMES" ] && return 1
+ [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
# Check if firewall is configured (has tables)
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- [ -z "$tables" ] && return 1
+ [ -z "$NF_TABLES" ] && return 6
- echo -n $"Saving firewall rules to $IPTABLES_DATA: "
+ echo -n $"${IPTABLES}: Saving firewall rules to $IPTABLES_DATA: "
OPT=
[ "x$IPTABLES_SAVE_COUNTER" = "xyes" ] && OPT="-c"
ret=0
- TMP_FILE=`/bin/mktemp -q /tmp/$IPTABLES.XXXXXX` \
+ TMP_FILE=$(/bin/mktemp -q /tmp/$IPTABLES.XXXXXX) \
&& chmod 600 "$TMP_FILE" \
&& $IPTABLES-save $OPT > $TMP_FILE 2>/dev/null \
- && size=`stat -c '%s' $TMP_FILE` && [ $size -gt 0 ] \
+ && size=$(stat -c '%s' $TMP_FILE) && [ $size -gt 0 ] \
|| ret=1
if [ $ret -eq 0 ]; then
if [ -e $IPTABLES_DATA ]; then
}
status() {
+ if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+ echo $"${IPTABLES}: Firewall is not running."
+ return 3
+ fi
+
# Do not print status if lockfile is missing and iptables modules are not
# loaded.
- # Check if iptable module is loaded
- if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
- echo $"Firewall is stopped."
- return 1
+ # Check if iptable modules are loaded
+ if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+ echo $"${IPTABLES}: Firewall modules are not loaded."
+ return 3
fi
# Check if firewall is configured (has tables)
- if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
- echo $"Firewall is not configured. "
- return 1
- fi
- tables=`cat $PROC_IPTABLES_NAMES 2>/dev/null`
- if [ -z "$tables" ]; then
- echo $"Firewall is not configured. "
- return 1
+ if [ -z "$NF_TABLES" ]; then
+ echo $"${IPTABLES}: Firewall is not configured. "
+ return 3
fi
NUM=
[ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
+ VERBOSE=
+ [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
+ COUNT=
+ [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
- for table in $tables; do
+ for table in $NF_TABLES; do
echo $"Table: $table"
- $IPTABLES -t $table --list $NUM && echo
+ $IPTABLES -t $table --list $NUM $VERBOSE $COUNT && echo
done
return 0
start
}
+
case "$1" in
start)
- stop
+ [ -f "$VAR_SUBSYS_IPTABLES" ] && exit 0
start
RETVAL=$?
;;
stop
RETVAL=$?
;;
- restart)
+ restart|force-reload)
restart
RETVAL=$?
;;
- condrestart)
- [ -e "$VAR_SUBSYS_IPTABLES" ] && restart
+ condrestart|try-restart)
+ [ ! -e "$VAR_SUBSYS_IPTABLES" ] && exit 0
+ restart
+ RETVAL=$?
;;
status)
status
RETVAL=$?
;;
*)
- echo $"Usage: $0 {start|stop|restart|condrestart|status|panic|save}"
- exit 1
+ echo $"Usage: ${IPTABLES} {start|stop|restart|condrestart|status|panic|save}"
+ RETVAL=2
;;
esac
BuildRoot: %{_tmppath}/%{name}-buildroot
License: GPL
BuildPrereq: /usr/bin/perl
-Requires: kernel >= 2.4.20
+Requires: kernel >= 2.6.27
Requires(post,postun): chkconfig
Prefix: %{_prefix}
BuildRequires: kernel-devel
%define KERNEL_DIR "/usr/src/kernels/%{KERNEL}"
-./configure --disable-devel --prefix=%{buildroot}/usr/local
+%if %{build_devel}
+%define configure_option --enable-devel
+%else
+%define configure_option
+%endif
+
+./configure --prefix=/usr %{configure_option} --enable-libipq --bindir=/bin --sbindir=/sbin --sysconfdir=/etc --libdir=/%{_libdir} --libexecdir=/%{_lib} --mandir=%{_mandir} --includedir=%{_includedir}
make COPT_FLAGS="$OPT" KERNEL_DIR=%{KERNEL_DIR} LIBDIR=/%{_lib}
-make COPT_FLAGS="$OPT" KERNEL_DIR=%{KERNEL_DIR} LIBDIR=/%{_lib} iptables-save iptables-restore
-make COPT_FLAGS="$OPT" KERNEL_DIR=%{KERNEL_DIR} LIBDIR=/%{_lib} ip6tables-save ip6tables-restore
%install
-mkdir -p %{buildroot}/sbin
-make install DESTDIR=%{buildroot} KERNEL_DIR=%{KERNEL_DIR} BINDIR=/sbin LIBDIR=/%{_lib} MANDIR=%{_mandir}
-cp ip{6,}tables-{save,restore} $RPM_BUILD_ROOT/sbin
-mkdir -p $RPM_BUILD_ROOT%{_mandir}/man8
-cp iptables-*.8 $RPM_BUILD_ROOT%{_mandir}/man8
-mkdir -p $RPM_BUILD_ROOT/etc/rc.d/init.d
-install -c -m755 %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/iptables
+# Thierry : for 1.4.1.1
+# from http://fr2.rpmfind.net/linux/fedora/releases/10/Everything/source/SRPMS/iptables-1.4.1.1-2.fc10.src.rpm
+make install DESTDIR=%{buildroot}
+
+# install iptc devel library
+%if %{build_devel}
+install -m 644 libiptc/libiptc.a %{buildroot}/%{_libdir}
+%endif
+
+# install init scripts and configuration files
+install -d -m 755 $RPM_BUILD_ROOT/etc/rc.d/init.d
+install -c -m 755 %{SOURCE1} $RPM_BUILD_ROOT/etc/rc.d/init.d/iptables
sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
-install -c -m755 ip6tables.init $RPM_BUILD_ROOT/etc/rc.d/init.d/ip6tables
-mkdir -p $RPM_BUILD_ROOT/etc/sysconfig
-install -c -m755 %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/iptables-config
-install -c -m755 %{SOURCE3} $RPM_BUILD_ROOT/etc/sysconfig/iptables
+install -c -m 755 ip6tables.init $RPM_BUILD_ROOT/etc/rc.d/init.d/ip6tables
+install -d -m 755 $RPM_BUILD_ROOT/etc/sysconfig
+install -c -m 755 %{SOURCE2} $RPM_BUILD_ROOT/etc/sysconfig/iptables-config
sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
-install -c -m755 ip6tables-config $RPM_BUILD_ROOT/etc/sysconfig/ip6tables-config
+install -c -m 755 ip6tables-config $RPM_BUILD_ROOT/etc/sysconfig/ip6tables-config
+install -c -m755 %{SOURCE3} $RPM_BUILD_ROOT/etc/sysconfig/iptables
%clean
rm -rf $RPM_BUILD_ROOT
%config %attr(0755,root,root) /etc/rc.d/init.d/iptables
%config(noreplace) %attr(0600,root,root) /etc/sysconfig/iptables-config
%config(noreplace) %attr(0600,root,root) /etc/sysconfig/iptables
-/usr/local/sbin/iptables*
/sbin/iptables*
-/usr/local/bin/iptables*
-/usr/local/libexec/xtables/*
%{_mandir}/man8/iptables*
+# Thierry - WARNING : location changed
+%dir /%{_lib}/xtables
+# WARNING : location changed
+/%{_lib}/xtables/libipt*
+# WARNING : new stuff
+/%{_lib}/xtables/libxt*
+# WARNING : not found at all
+#/sbin/ipset*
+#%{_mandir}/man8/ipset*
+#%dir /%{_lib}/ipset
+#/%{_lib}/ipset/libipset*
+
%files ipv6
%defattr(-,root,root,0755)
%config %attr(0755,root,root) /etc/rc.d/init.d/ip6tables
%config(noreplace) %attr(0600,root,root) /etc/sysconfig/ip6tables-config
/sbin/ip6tables*
+# Thierry - WARNING : new stuff
+/bin/iptables-xml
%{_mandir}/man8/ip6tables*
-/%{_lib}/iptables/libip6t*
+# WARNING : location changed
+/%{_lib}/xtables/libip6t*
%if %{build_devel}
%files devel
%defattr(-,root,root,0755)
-%{_includedir}/libipq.h
+%{_includedir}/*.h
+%dir %{_includedir}/libiptc
+%{_includedir}/libiptc/*.h
%{_libdir}/libipq.a
-#%{_libdir}/libiptc.a
+%{_libdir}/libiptc.a
%{_mandir}/man3/*
%endif