deleted file mode 100644

Binary files a/SPECS/iptables/blfs-systemd-units-20140907.tar.bz2 and /dev/null differ

deleted file mode 100644

@@ -1,71 +0,0 @@

-#!/bin/sh

-

-# Begin /etc/systemd/scripts/iptables

-

-# Insert connection-tracking modules

-# (not needed if built into the kernel)

-modprobe nf_conntrack

-modprobe xt_LOG

-

-# Enable broadcast echo Protection

-echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

-

-# Disable Source Routed Packets

-echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

-echo 0 > /proc/sys/net/ipv4/conf/default/accept_source_route

-

-# Enable TCP SYN Cookie Protection

-echo 1 > /proc/sys/net/ipv4/tcp_syncookies

-

-# Disable ICMP Redirect Acceptance

-echo 0 > /proc/sys/net/ipv4/conf/default/accept_redirects

-

-# Do not send Redirect Messages

-echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

-echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects

-

-# Drop Spoofed Packets coming in on an interface, where responses

-# would result in the reply going out a different interface.

-echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

-echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter

-

-# Log packets with impossible addresses.

-echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

-echo 1 > /proc/sys/net/ipv4/conf/default/log_martians

-

-# be verbose on dynamic ip-addresses  (not needed in case of static IP)

-echo 2 > /proc/sys/net/ipv4/ip_dynaddr

-

-# disable Explicit Congestion Notification

-# too many routers are still ignorant

-echo 0 > /proc/sys/net/ipv4/tcp_ecn

-

-# Set a known state

-iptables -P INPUT   DROP

-iptables -P FORWARD DROP

-iptables -P OUTPUT  DROP

-

-# These lines are here in case rules are already in place and the

-# script is ever rerun on the fly. We want to remove all rules and

-# pre-existing user defined chains before we implement new rules.

-iptables -F

-iptables -X

-iptables -Z

-

-iptables -t nat -F

-

-# Allow local-only connections

-iptables -A INPUT  -i lo -j ACCEPT

-

-# Free output on any interface to any ip for any service

-# (equal to -P ACCEPT)

-iptables -A OUTPUT -j ACCEPT

-

-# Permit answers on already established connections

-# and permit new connections related to established ones

-# (e.g. port mode ftp)

-iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

-

-#Enable ssh connections

-iptables -A INPUT -p tcp --dport 22 -j ACCEPT

-# End /etc/systemd/scripts/iptables

new file mode 100644

@@ -0,0 +1,74 @@

+#!/bin/sh

+

+# Begin /etc/systemd/scripts/iptables

+

+# Insert connection-tracking modules

+# (not needed if built into the kernel)

+modprobe nf_conntrack

+modprobe xt_LOG

+

+# Enable broadcast echo Protection

+echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

+

+# Disable Source Routed Packets

+echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route

+echo 0 > /proc/sys/net/ipv4/conf/default/accept_source_route

+

+# Enable TCP SYN Cookie Protection

+echo 1 > /proc/sys/net/ipv4/tcp_syncookies

+

+# Disable ICMP Redirect Acceptance

+echo 0 > /proc/sys/net/ipv4/conf/default/accept_redirects

+

+# Do not send Redirect Messages

+echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects

+echo 0 > /proc/sys/net/ipv4/conf/default/send_redirects

+

+# Drop Spoofed Packets coming in on an interface, where responses

+# would result in the reply going out a different interface.

+echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

+echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter

+

+# Log packets with impossible addresses.

+echo 1 > /proc/sys/net/ipv4/conf/all/log_martians

+echo 1 > /proc/sys/net/ipv4/conf/default/log_martians

+

+# be verbose on dynamic ip-addresses  (not needed in case of static IP)

+echo 2 > /proc/sys/net/ipv4/ip_dynaddr

+

+# disable Explicit Congestion Notification

+# too many routers are still ignorant

+echo 0 > /proc/sys/net/ipv4/tcp_ecn

+

+# Set a known state

+iptables -P INPUT   DROP

+iptables -P FORWARD DROP

+iptables -P OUTPUT  DROP

+

+# These lines are here in case rules are already in place and the

+# script is ever rerun on the fly. We want to remove all rules and

+# pre-existing user defined chains before we implement new rules.

+iptables -F

+iptables -X

+iptables -Z

+

+iptables -t nat -F

+iptables -t nat -X

+iptables -t mangle -F

+iptables -t mangle -X

+

+# Allow local-only connections

+iptables -A INPUT  -i lo -j ACCEPT

+

+# Free output on any interface to any ip for any service

+# (equal to -P ACCEPT)

+iptables -A OUTPUT -j ACCEPT

+

+# Permit answers on already established connections

+# and permit new connections related to established ones

+# (e.g. port mode ftp)

+iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

+

+#Enable ssh connections

+iptables -A INPUT -p tcp --dport 22 -j ACCEPT

+# End /etc/systemd/scripts/iptables

new file mode 100644

@@ -0,0 +1,14 @@

+[Unit]

+Description=Load Iptables Rules

+ConditionFileIsExecutable=/etc/systemd/scripts/iptables

+After=network.target

+

+[Service]

+Type=forking

+ExecStart=/etc/systemd/scripts/iptables

+ExecStop=/etc/systemd/scripts/iptables.stop

+TimeoutSec=0

+RemainAfterExit=yes

+

+[Install]

+WantedBy=multi-user.target

@@ -1,18 +1,17 @@

 Summary:	Linux kernel packet control tool

 Name:		iptables

 Version:	1.6.0

-Release:	5%{?dist}

+Release:	6%{?dist}

 License:	GPLv2+

 URL:		http://www.netfilter.org/projects/iptables

 Group:		System Environment/Security

 Vendor:		VMware, Inc.

 Distribution: Photon

 Source0:	http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2

-%define sha1 iptables=21a694e75b0d6863cc001f85fb15915d12b8cc22

-Source1:	http://www.linuxfromscratch.org/blfs/downloads/systemd/blfs-systemd-units-20140907.tar.bz2

-%define sha1 blfs-systemd-units=713afb3bbe681314650146e5ec412ef77aa1fe33

-Source2:	iptable_rules

-Patch1:		blfs_systemd_fixes.patch

+%define sha1 iptables-=21a694e75b0d6863cc001f85fb15915d12b8cc22

+Source1:	iptables.service

+Source2:	iptables

+Source3:	iptables.stop

 BuildRequires:  systemd

 Requires:       systemd

 %description

@@ -21,9 +20,6 @@ firewall tool for Linux is Iptables. You will need to install

 Iptables if you intend on using any form of a firewall.

 %prep

 %setup -q

-tar xf %{SOURCE1} --no-same-owner

-cp %{SOURCE2} .

-%patch1 -p0

 %build

 ./configure \

 	CFLAGS="%{optflags}" \

@@ -44,13 +40,13 @@ make V=0

 [ %{buildroot} != "/"] && rm -rf %{buildroot}/*

 make DESTDIR=%{buildroot} install

 ln -sfv ../../sbin/xtables-multi %{buildroot}%{_libdir}/iptables-xml

-#	Install daemon script

-pushd blfs-systemd-units-20140907

-make DESTDIR=%{buildroot} install-iptables

-popd

+#	Install daemon scripts

+install -vdm755 %{buildroot}%{_unitdir}

+install -m 644 %{SOURCE1} %{buildroot}%{_unitdir}

 install -vdm755 %{buildroot}/etc/systemd/scripts

-cp iptable_rules %{buildroot}/etc/systemd/scripts/iptables

-chmod 755 %{buildroot}/etc/systemd/scripts/iptables

+install -m 755 %{SOURCE2} %{buildroot}/etc/systemd/scripts

+install -m 755 %{SOURCE3} %{buildroot}/etc/systemd/scripts

+

 find %{buildroot} -name '*.a'  -delete

 find %{buildroot} -name '*.la' -delete

 %{_fixperms} %{buildroot}/*

@@ -71,6 +67,7 @@ rm -rf %{buildroot}/*

 %files

 %defattr(-,root,root)

 %config(noreplace) /etc/systemd/scripts/iptables

+%config(noreplace) /etc/systemd/scripts/iptables.stop

 /lib/systemd/system/iptables.service

 /sbin/*

 %{_bindir}/*

@@ -83,6 +80,8 @@ rm -rf %{buildroot}/*

 %{_mandir}/man3/*

 %{_mandir}/man8/*

 %changelog

+*   Wed Jan 18 2017 Alexey Makhalov <amakhalov@vmware.com> 1.6.0-6

+-   Flush iptables on service stop

 *   Tue Aug 30 2016 Anish Swaminathan <anishs@vmware.com> 1.6.0-5

 -   Change config file properties for iptables script

 *   Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.6.0-4

new file mode 100644

@@ -0,0 +1,16 @@

+#! /bin/sh

+

+# Begin /etc/systemd/scripts/iptables.stop

+

+iptables -Z

+iptables -F

+iptables -t nat -F

+iptables -t nat -X

+iptables -t mangle -F

+iptables -t mangle -X

+iptables -X

+iptables -P INPUT       ACCEPT

+iptables -P FORWARD     ACCEPT

+iptables -P OUTPUT      ACCEPT

+

+# End /etc/systemd/scripts/iptables.stop

@@ -6,7 +6,7 @@ class CommandUtils(object):

         self.findBinary = "find"

     def findFile (self, filename, sourcePath):

-        process = subprocess.Popen([self.findBinary,  "-L", sourcePath,  "-name", filename],  stdout=subprocess.PIPE)

+        process = subprocess.Popen([self.findBinary,  "-L", sourcePath,  "-name", filename, "-not", "-type", "d"],  stdout=subprocess.PIPE)

         returnVal = process.wait()

         if returnVal != 0:

             return None