Bug 2211063
| Summary: | Rebase package to upstream version 1.8.5 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Phil Sutter <psutter> |
| Component: | iptables | Assignee: | Phil Sutter <psutter> |
| Status: | CLOSED ERRATA | QA Contact: | qe-baseos-daemons |
| Severity: | unspecified | Docs Contact: | Marc Muehlfeld <mmuehlfe> |
| Priority: | unspecified | ||
| Version: | 8.9 | CC: | bpanchal, egarver, jbainbri, jpeska, todoleza |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 8.9 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | iptables-1.8.5-8.el8 | Doc Type: | Rebase: Bug Fixes and Enhancements |
| Doc Text: |
.`iptables` rebased to version 1.8.5
The `iptables` packages have been upgraded to upstream version 1.8.5, which provides a number of enhancements and bug fixes over the previous version:
* The code of the `iptables-apply` script was cleaned up.
* Missing translations were added, and existing translations were fixed in the `iptables-translate` utility. Additionally, translations were reviewed for strictness. As a result, API users can now notice if a translation fails.
* The `connlabel` match operation now supports numeric labels.
* The cache handling was improved:
** The kernel rule set caching code was rewritten.
** The `iptables` utility gathers the initial requirements before fetching the needed data.
** If possible, `iptables` now caches only specific chains and tables.
* In `bpf` match operations, `iptables` opens Extended Berkeley Packet Filter (eBPF) programs in read-only mode.
* The `--alarm` option was added to the `IDLETIMER` target.
* Multiple memory leaks were fixed.
* Code was merged to reduce the size and optimize the code flow.
* The string match extension no longer prints the `--to` option if its value is the default one.
* The `among` match extension was fixed to work correctly when used in multiple rules loaded by the `ebtables-restore` utility.
* Various man pages were updated.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-14 15:51:50 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2174395, 2190094 | ||
| Deadline: | 2023-08-14 | ||
|
Description
Phil Sutter
2023-05-30 12:21:12 UTC
Use the opportunity for a bit of spec file cleanup: * Drop the bootstrap code needed when libiptc SONAME bumped in RHEL8.2 * Eliminate a duplicate file warning caused by overlapping globbing in %files section Changes proposed here: https://gitlab.com/redhat/centos-stream/rpms/iptables/-/merge_requests/36 This rebase causes a regression, reported in bug 2236501. The fix is a commit which lacks a Fixes: tag and therefore wasn't identified by my script. I went through the list of upstream commits since v1.8.5, manually searching for the word "fix". I identified two regression fixes which affect us: 0bd7a8eaf3582 ("iptables-nft: fix basechain policy configuration") - The reported fix in bug 2236501 - Test case included 30c1d44389631 ("ebtables: Exit gracefully on invalid table names") - Fix abort when specifying invalid table name - Affects error path only It looks like we need exception+ now to push a new build. Should we try or do an early z-stream after GA? > It looks like we need exception+ now to push a new build. Should we try or do
an early z-stream after GA?
It could be 0day zstreamed.
Dropped a left-over from your corrections, please review. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (iptables bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:7184 |