Hi,
On 5 Mar 2019, at 12:37, ummeegge ummeegge@ipfire.org wrote:
Hi Michael,
On Di, 2019-03-05 at 09:47 +0000, Michael Tremer wrote:
Hi,
I will just merge this and then we will see during testing of the Core Update.
Have deleted all the *legacy* binaries and as before, no problems at all. Should i send another patch without them ?
If those are all symlinks, I guess it makes sense to remove them, because they are more confusing than anything else.
Please submit another patch. Remember that I have already merged this one.
What could possibly go wrong?
Have currently no problems in focus. Have build also nftables (with libnftnl with an extended iptables-1.8.2 version which incl. also ebtables, arptables, the translation stuff and a lot more) to check there for some possible usage of the *legacy* stuff. It is currently possible to use both (iptables beneath nftables) which offers some funky new possiblities :D but in there the same, did NOT needed the *legacy* binaries since all known iptables binaries are still presant but possibly i have missed/overseen something.
I do not think that there is any sense to build notables for IPFire 2. It is disabled in the kernel, we are using some extensions that only work for iptables (l7 filter, geoid, ipp2p) and therefore we can never use it.
-Michael
At least all is working.
Best,
Erik
Best, -Michael
On 4 Mar 2019, at 06:54, ummeegge ummeegge@ipfire.org wrote:
Hi Michael,
On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote:
Hi,
This release of iptables has some interesting changes:
We now have multiple binaries with -legacy in name.
Yes i was also a little in wonder about that although it looked a little like a helper tool if nftables and iptables running at the same time. Looking at linuxfromscratch --> http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html if '--disable-nftables' has been set, there are no *-legacy* binaries listed under "Installed Programs:". There is also the xtables-legacy-multi binary and looking into the nftables-wiki -->
https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools
(please check the 'link to a summary') it appears that all setsockopt based tools are all now considered as 'legacy'.
Did you test this? Is there anything we need to think about?
Am running iptables-1.8.2 currently with a backup of my production machine with ~ 50 rules and a vast IPset configuration (firewall.local) and i haven´t recognized problems.
Some other tests i made: Made also a diff between 'iptables-legacy-save' and 'iptables-save' whereby the output seems to be pretty much the same. Moved then also all iptables-legacy* binaries away, restarted the machine and all seems to work as it should.
Since it is a little a sensible update, it is great to go for some more overviews/testings/thinking_abouts.
Best,
Erik
-Michael
On 3 Mar 2019, at 08:09, Erik Kapfer ummeegge@ipfire.org wrote:
netfilter-layer7 has also been updated to v2.23 .
Signed-off-by: Erik Kapfer ummeegge@ipfire.org
config/rootfiles/common/iptables | 19 ++++++++++++------- lfs/iptables | 17 +++++++++-------- 2 files changed, 21 insertions(+), 15 deletions(-)
diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables index d7584c0ad..9aa9e51cb 100644 --- a/config/rootfiles/common/iptables +++ b/config/rootfiles/common/iptables @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0 #lib/libxtables.la lib/libxtables.so lib/libxtables.so.12 -lib/libxtables.so.12.0.0 +lib/libxtables.so.12.2.0 #lib/xtables -lib/xtables/libebt_802_3.so -lib/xtables/libebt_ip.so -lib/xtables/libebt_log.so -lib/xtables/libebt_mark_m.so lib/xtables/libip6t_DNAT.so lib/xtables/libip6t_DNPT.so lib/xtables/libip6t_HL.so @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so lib/xtables/libxt_length.so lib/xtables/libxt_limit.so lib/xtables/libxt_mac.so -lib/xtables/libxt_mangle.so lib/xtables/libxt_mark.so lib/xtables/libxt_multiport.so lib/xtables/libxt_nfacct.so @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so lib/xtables/libxt_u32.so lib/xtables/libxt_udp.so sbin/ip6tables +sbin/ip6tables-legacy +sbin/ip6tables-legacy-restore +sbin/ip6tables-legacy-save sbin/ip6tables-restore sbin/ip6tables-save sbin/iptables +sbin/iptables-legacy +sbin/iptables-legacy-restore +sbin/iptables-legacy-save sbin/iptables-restore sbin/iptables-save sbin/iptables-xml #sbin/nfnl_osf -sbin/xtables-multi +sbin/xtables-legacy-multi #usr/include/libipq.h #usr/include/libiptc #usr/include/libiptc/ipt_kernel_headers.h @@ -178,5 +179,9 @@ sbin/xtables-multi #usr/share/man/man8/iptables-save.8 #usr/share/man/man8/iptables.8 #usr/share/man/man8/nfnl_osf.8 +#usr/share/man/man8/xtables-legacy.8 +#usr/share/man/man8/xtables-monitor.8 +#usr/share/man/man8/xtables-nft.8 +#usr/share/man/man8/xtables-translate.8 #usr/share/xtables usr/share/xtables/pf.os diff --git a/lfs/iptables b/lfs/iptables index b4a2834b8..17817a9ef 100644 --- a/lfs/iptables +++ b/lfs/iptables @@ -1,7 +1,7 @@ ############################################################### #### ############ #
## IPFire.org - A linux based firewall # -# Copyright (C) 2007-2018 IPFire Team info@ipfire.org
#+# Copyright (C) 2007-2019 IPFire Team info@ipfire.org
##
## This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@
include Config
-VER = 1.6.2 +VER = 1.8.2
THISAPP = iptables-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -36,13 +36,13 @@ TARGET = $(DIR_INFO)/$(THISAPP) # Top-level Rules ############################################################### #### ############ objects = $(DL_FILE) \
- netfilter-layer7-v2.22.tar.gz
- netfilter-layer7-v2.23.tar.gz
$(DL_FILE) = $(DL_FROM)/$(DL_FILE) -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter- layer7- v2.22.tar.gz +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter- layer7- v2.23.tar.gz
-$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d -netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599 +netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb
install : $(TARGET)
@@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
# Layer7
- cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
v2.22.tar.gz
- cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
- cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
v2.23.tar.gz
- cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \ ./extensions/
# imq @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --libdir=/lib \ --includedir=/usr/include \ --enable-libipq \
--with-xtlibdir=/lib/xtables \-- 2.12.2