Bug 431961

Description of problem:
The iptables and ip6tables configurations are not always synchronized by
system-config-firewall.

While attempting to figure out what is going on with bug# 431803 (selinux
denials on access to /etc/sysconfig/iptables) I noticed this problem with
system-config-firewall.

The iptables and ip6tables configurations are not both being set by
system-config-firewall writing the configuration (clicking Apply).  This happens
if iptables has a custom configuration, or if ip6tables has a custom
configuration (this can be anything other than what system-config-firewall tried
to load).

If there is an iptables change made, then only ip6tables is getting a
configuration loaded, leaving all the chains in iptables as they were.  If there
is an ip6tables change, then only iptables is getting loaded by
system-config-firewall.

What this means is all ipv4 traffic is coming in irregardless of settings in
system-config-firewall because it only effected ipv6 traffic, not ipv4.

Version-Release number of selected component (if applicable):
system-config-firewall-1.2.2-1.fc9.noarch
iptables-1.3.8-6.fc9.i386


Steps to Reproduce:
- cd /etc/sysconfig
- service iptables stop; service ip6tables stop; rm iptables ip6tables
iptables.save ip6tables.save

Now.. no configurations.

1. clear all configurations in iptables and ip6tables (iptables -F; ip6tables -F)
2. set FORWARD iptables chain to default DROP manually (iptables -P FORWARD DROP)
2. open system-config-firewall and set configuration
3. check iptables -L and ip6tables -L

Actual results:
All ipv4 traffic is permitted through iptables chains

Expected results:
Firewall configuration should apply to both iptables and ip6tables, removing
prior changes

Additional info:

Here is what happens after system-config-firewall applies settings (load default
configuration 'server') when ip6tables has no configuration but iptables DOES
have a custom configuration.

 - iptables -P FORWARD DROP
18:59:32  |root:2| |58 files:468K@sysconfig| |1 jobs|
 - iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
18:59:35  |root:2| |58 files:468K@sysconfig| |1 jobs|
 - system-config-firewall
[1]+  Done                    system-config-firewall
19:00:10  |root:2| |61 files:492K@sysconfig| |0 jobs|
 - iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
19:00:13  |root:2| |61 files:492K@sysconfig| |0 jobs|
 - ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all      anywhere             anywhere           state
RELATED,ESTABLISHED 
ACCEPT     ipv6-icmp    anywhere             anywhere           
ACCEPT     all      anywhere             anywhere           
ACCEPT     tcp      anywhere             anywhere           state NEW tcp dpt:ssh 
REJECT     all      anywhere             anywhere           reject-with
icmp6-adm-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all      anywhere             anywhere           reject-with
icmp6-adm-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination