Re: system-config-firewall conntrack patch

Howdy folks, saw that you hadn't patched system-config-firewall to support conntrack so I thought I'd send our patch your way. Not a large contribution by any means, but I hope it helps. diff -rupN system-config-firewall-1.2.29.orig/src/fw_iptables.py system-config-firewall-1.2.29/src/fw_iptables.py --- system-config-firewall-1.2.29.orig/src/fw_iptables.py 2012-12-24 14:44:23.094496819 -0500 +++ system-config-firewall-1.2.29/src/fw_iptables.py 2012-12-24 14:46:06.040498696 -0500 @@ -362,7 +362,7 @@ class iptablesClass: # accept established and related connections as early as possible # RELATED is extremely important as it matches ICMP error messages - fd.write("-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n") + fd.write("-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\n") # icmp self._icmp(conf, fd, "INPUT", reject_type) @@ -377,7 +377,7 @@ class iptablesClass: for fwd in conf.forward_port: if fwd.has_key("toaddr"): continue - line = "-A INPUT -i %s -m state --state NEW -m %s -p %s" % \ + line = "-A INPUT -i %s -m conntrack --ctstate NEW -m %s -p %s" % \ (fwd["if"], fwd["proto"], fwd["proto"]) if fwd.has_key("toport"): line += " --dport %s" % self._portStr(fwd["toport"]) @@ -394,7 +394,7 @@ class iptablesClass: _dest = "" _port = "" if proto in [ "tcp", "udp" ]: - _state = "-m state --state NEW " + _state = "-m conntrack --ctstate NEW " _proto = "-m %s -p %s " % (proto, proto) else: if self.type == "ipv4": @@ -411,7 +411,7 @@ class iptablesClass: # open ports if conf.ports and len(conf.ports) > 0: for (ports, proto) in conf.ports: - fd.write("-A INPUT -m state --state NEW -m %s -p %s --dport %s " + fd.write("-A INPUT -m conntrack --ctstate NEW -m %s -p %s --dport %s " "-j ACCEPT\n" % (proto, proto, self._portStr(ports))) # FORWARD @@ -419,7 +419,7 @@ class iptablesClass: (self.type == "ipv4" and conf.masq and len(conf.masq) > 0) or \ (self.type == "ipv4" and remote_forward): # accept established and related connections - fd.write("-A FORWARD -m state --state ESTABLISHED,RELATED " + fd.write("-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED " "-j ACCEPT\n") # icmp self._icmp(conf, fd, "FORWARD", reject_type) @@ -442,7 +442,7 @@ class iptablesClass: port = self._portStr(fwd["toport"]) else: port = self._portStr(fwd["port"]) - fd.write("-A FORWARD -i %s -m state --state NEW " + fd.write("-A FORWARD -i %s -m conntrack --ctstate NEW " "-m %s -p %s -d %s --dport %s " "-j ACCEPT\n" % (fwd["if"], fwd["proto"], fwd["proto"], fwd["toaddr"],