diff --git a/.gitignore b/.gitignore
index ae4c970..3814395 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,19 @@
+/.build-*.log
+/iptables-*.src.rpm
+/noarch/
+/x86_64/
+/iptables.spec.orig
 /iptables-1.6.2.tar.bz2
 /iptables-1.8.0.tar.bz2
 /iptables-1.8.2.tar.bz2
 /iptables-1.8.3.tar.bz2
 /iptables-1.8.4.tar.bz2
 /iptables-1.8.5.tar.bz2
+/iptables-1.8.6.tar.bz2
+/iptables-1.8.7.tar.bz2
+/iptables-1.8.8.tar.bz2
+/iptables-1.8.9.tar.xz
+/iptables-1.8.10.tar.xz
+/iptables-1.8.10.tar.xz.sig
+/iptables-1.8.11.tar.xz
+/iptables-1.8.11.tar.xz.sig
diff --git a/0001-build-resolve-iptables-apply-not-getting-installed.patch b/0001-build-resolve-iptables-apply-not-getting-installed.patch
deleted file mode 100644
index 26e08db..0000000
--- a/0001-build-resolve-iptables-apply-not-getting-installed.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 55bb60d8ae717d3bc1cfdd6203604a18f30eb3c3 Mon Sep 17 00:00:00 2001
-From: Jan Engelhardt <jengelh@inai.de>
-Date: Wed, 3 Jun 2020 15:38:48 +0200
-Subject: [PATCH] build: resolve iptables-apply not getting installed
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-ip6tables-apply gets installed but iptables-apply does not.
-That is wrong.
-
-» make install DESTDIR=$PWD/r
-» find r -name "*app*"
-r/usr/local/sbin/ip6tables-apply
-r/usr/local/share/man/man8/iptables-apply.8
-r/usr/local/share/man/man8/ip6tables-apply.8
-
-Fixes: v1.8.5~87
-Signed-off-by: Jan Engelhardt <jengelh@inai.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/Makefile.am | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/Makefile.am b/iptables/Makefile.am
-index dc66b3cc09c08..2024dbf5cb88c 100644
---- a/iptables/Makefile.am
-+++ b/iptables/Makefile.am
-@@ -56,7 +56,7 @@ man_MANS         = iptables.8 iptables-restore.8 iptables-save.8 \
-                    ip6tables-save.8 iptables-extensions.8 \
-                    iptables-apply.8 ip6tables-apply.8
- 
--sbin_SCRIPT      = iptables-apply
-+sbin_SCRIPTS     = iptables-apply
- 
- if ENABLE_NFTABLES
- man_MANS	+= xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
--- 
-2.27.0
-
diff --git a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch b/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
deleted file mode 100644
index 1bdbbd1..0000000
--- a/0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
-Date: Wed, 14 Nov 2018 07:35:28 +0100
-Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-introduced support for gcc feature to check format string against passed
-argument.  This commit adds missing bits to extenstions's libipt_icmp.c
-and libip6t_icmp6.c that were causing build to fail.
-
-Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libip6t_icmp6.c | 4 ++--
- extensions/libipt_icmp.c   | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
-index 45a71875722c4..cc7bfaeb72fd7 100644
---- a/extensions/libip6t_icmp6.c
-+++ b/extensions/libip6t_icmp6.c
-@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 	type_name = icmp6_type_xlate(icmptype);
- 
- 	if (type_name) {
--		xt_xlate_add(xl, type_name);
-+		xt_xlate_add(xl, "%s", type_name);
- 	} else {
- 		for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
- 			if (icmpv6_codes[i].type == icmptype &&
-@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 				break;
- 
- 		if (i != ARRAY_SIZE(icmpv6_codes))
--			xt_xlate_add(xl, icmpv6_codes[i].name);
-+			xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
- 		else
- 			return 0;
- 	}
-diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
-index 5418997668d4c..e76257c54708c 100644
---- a/extensions/libipt_icmp.c
-+++ b/extensions/libipt_icmp.c
-@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 			if (icmp_codes[i].type == icmptype &&
- 			    icmp_codes[i].code_min == code_min &&
- 			    icmp_codes[i].code_max == code_max) {
--				xt_xlate_add(xl, icmp_codes[i].name);
-+				xt_xlate_add(xl, "%s", icmp_codes[i].name);
- 				return 1;
- 			}
- 	}
--- 
-2.21.0
-
diff --git a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/0002-xtables-translate-don-t-fail-if-help-was-requested.patch
deleted file mode 100644
index 4fcb549..0000000
--- a/0002-xtables-translate-don-t-fail-if-help-was-requested.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 51730adbe90a17e0d86d5adcab30040fa7e751ed Mon Sep 17 00:00:00 2001
-From: Arturo Borrero Gonzalez <arturo@netfilter.org>
-Date: Tue, 16 Jun 2020 11:20:42 +0200
-Subject: [PATCH] xtables-translate: don't fail if help was requested
-
-If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle
-this case in do_command_xlate().
-
-Before this patch, you would see:
-
- user@debian:~$ sudo iptables-translate -h
- [..]
- nft Unsupported command?
- user@debian:~$ echo $?
- 1
-
-After this patch:
-
- user@debian:~$ sudo iptables-translate -h
- [..]
- user@debian:~$ echo $?
- 0
-
-Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts")
-Acked-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
-(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/xtables-translate.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index 5aa42496b5a48..363c8be15b3fa 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
- 
- 	cs.restore = restore;
- 
--	if (!restore)
-+	if (!restore && p.command != CMD_NONE)
- 		printf("nft ");
- 
- 	switch (p.command) {
-@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
- 		break;
- 	case CMD_SET_POLICY:
- 		break;
-+	case CMD_NONE:
-+		ret = 1;
-+		break;
- 	default:
- 		/* We should never reach this... */
- 		printf("Unsupported command?\n");
--- 
-2.27.0
-
diff --git a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
deleted file mode 100644
index abe95fe..0000000
--- a/0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From eacefb728885b5dc51036181de83b2df309d4e6b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 29 Jul 2020 15:39:31 +0200
-Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
-
-Athough this cache level fetches table names only, it shouldn't skip the
-consistency check.
-
-Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft-cache.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index 638b18bc7e382..434cc10b82ce7 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -511,14 +511,14 @@ retry:
- 	if (req->level >= NFT_CL_TABLES)
- 		fetch_table_cache(h);
- 	if (req->level == NFT_CL_FAKE)
--		return;
-+		goto genid_check;
- 	if (req->level >= NFT_CL_CHAINS)
- 		fetch_chain_cache(h, t, chains);
- 	if (req->level >= NFT_CL_SETS)
- 		fetch_set_cache(h, t, NULL);
- 	if (req->level >= NFT_CL_RULES)
- 		fetch_rule_cache(h, t);
--
-+genid_check:
- 	mnl_genid_get(h, &genid_check);
- 	if (h->nft_genid != genid_check) {
- 		flush_cache(h, h->cache, NULL);
--- 
-2.27.0
-
diff --git a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch b/0004-nft-Fix-command-name-in-ip6tables-error-message.patch
deleted file mode 100644
index b9a83f6..0000000
--- a/0004-nft-Fix-command-name-in-ip6tables-error-message.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From dac3434e2e7ea297a3886c662d558305b460670b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 7 Aug 2020 13:48:28 +0200
-Subject: [PATCH] nft: Fix command name in ip6tables error message
-
-Upon errors, ip6tables-nft would prefix its error messages with
-'iptables:' instead of 'ip6tables:'. Turns out the command name was
-hard-coded, use 'progname' variable instead.
-While being at it, merge the two mostly identical fprintf() calls into
-one.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/xtables-standalone.c | 12 ++++--------
- 1 file changed, 4 insertions(+), 8 deletions(-)
-
-diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
-index dd6fb7919d2e1..7b71db62f1ea6 100644
---- a/iptables/xtables-standalone.c
-+++ b/iptables/xtables-standalone.c
-@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
- 	xtables_fini();
- 
- 	if (!ret) {
--		if (errno == EINVAL) {
--			fprintf(stderr, "iptables: %s. "
--					"Run `dmesg' for more information.\n",
--				nft_strerror(errno));
--		} else {
--			fprintf(stderr, "iptables: %s.\n",
--				nft_strerror(errno));
--		}
-+		fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
-+			(errno == EINVAL ?
-+			 " Run `dmesg' for more information." : ""));
-+
- 		if (errno == EAGAIN)
- 			exit(RESOURCE_PROBLEM);
- 	}
--- 
-2.27.0
-
diff --git a/0005-ebtables-Fix-for-broken-chain-renaming.patch b/0005-ebtables-Fix-for-broken-chain-renaming.patch
deleted file mode 100644
index 2ad2518..0000000
--- a/0005-ebtables-Fix-for-broken-chain-renaming.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 1b7ca0bdd7284d750f894f59e48f9a8b0da82076 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 17 Nov 2020 11:38:27 +0100
-Subject: [PATCH] ebtables: Fix for broken chain renaming
-
-Loading extensions pollutes 'errno' value, hence before using it to
-indicate failure it should be sanitized. This was done by the called
-function before the parsing/netlink split and not migrated by accident.
-Move it into calling code to clarify the connection.
-
-Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247)
-
- Conflicts:
-	iptables/nft.c
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft.c                                                | 3 ---
- iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++
- iptables/xtables-eb.c                                         | 1 +
- 3 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 0c5a74fc232c6..2e4b91916b332 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -1936,9 +1936,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
- 
- 	nft_xt_builtin_init(h, table);
- 
--	/* Config load changed errno. Ensure genuine info for our callers. */
--	errno = 0;
--
- 	/* Find the old chain to be renamed */
- 	c = nft_chain_find(h, table, chain);
- 	if (c == NULL) {
-diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-index 0c1eb4ca66f52..6f11bd12593dd 100755
---- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then
- 	exit 1
- fi
- 
-+$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1
-+$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1
-+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
-+
- $XT_MULTI ebtables -t $t -F || exit 0
-diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index 375a95d1d5c75..6df5839f07436 100644
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
- 				else if (strchr(argv[optind], ' ') != NULL)
- 					xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
- 
-+				errno = 0;
- 				ret = nft_cmd_chain_user_rename(h, chain, *table,
- 							    argv[optind]);
- 				if (ret != 0 && errno == ENOENT)
--- 
-2.28.0
-
diff --git a/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch b/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch
deleted file mode 100644
index ba625a2..0000000
--- a/0006-ebtables-Exit-gracefully-on-invalid-table-names.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 30c1d443896311e69762d6b51b63908ec602574f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 28 Jan 2021 01:09:56 +0100
-Subject: [PATCH] ebtables: Exit gracefully on invalid table names
-
-Users are able to cause program abort by passing a table name that
-doesn't exist:
-
-| # ebtables-nft -t dummy -P INPUT ACCEPT
-| ebtables: nft-cache.c:455: fetch_chain_cache: Assertion `t' failed.
-| Aborted
-
-Avoid this by checking table existence just like iptables-nft does upon
-parsing '-t' optarg. Since the list of tables is known and fixed,
-checking the given name's length is pointless. So just drop that check
-in return.
-
-With this patch in place, output looks much better:
-
-| # ebtables-nft -t dummy -P INPUT ACCEPT
-| ebtables v1.8.7 (nf_tables): table 'dummy' does not exist
-| Perhaps iptables or your kernel needs to be upgraded.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/xtables-eb.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index cfa9317c78e94..5bb34d6d292a9 100644
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -914,10 +914,10 @@ print_zero:
- 				xtables_error(PARAMETER_PROBLEM,
- 					      "The -t option (seen in line %u) cannot be used in %s.\n",
- 					      line, xt_params->program_name);
--			if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1)
--				xtables_error(PARAMETER_PROBLEM,
--					      "Table name length cannot exceed %d characters",
--					      EBT_TABLE_MAXNAMELEN - 1);
-+			if (!nft_table_builtin_find(h, optarg))
-+				xtables_error(VERSION_PROBLEM,
-+					      "table '%s' does not exist",
-+					      optarg);
- 			*table = optarg;
- 			table_set = true;
- 			break;
--- 
-2.28.0
-
diff --git a/0007-iptables-accept-lock-file-name-at-runtime.patch b/0007-iptables-accept-lock-file-name-at-runtime.patch
deleted file mode 100644
index 2aced55..0000000
--- a/0007-iptables-accept-lock-file-name-at-runtime.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 05b2a86662ad732ecfbec1c2ef597dbedf54cf9c Mon Sep 17 00:00:00 2001
-From: Giuseppe Scrivano <gscrivan@redhat.com>
-Date: Fri, 17 Jul 2020 10:39:40 +0200
-Subject: [PATCH] iptables: accept lock file name at runtime
-
-allow users to override at runtime the lock file to use through the
-XTABLES_LOCKFILE environment variable.
-
-It allows to use iptables when the user has granted enough
-capabilities (e.g. a user+network namespace) to configure the network
-but that lacks access to the XT_LOCK_NAME (by default placed under
-/run).
-
-$ XTABLES_LOCKFILE=/tmp/xtables unshare -rn iptables ...
-
-Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 5105e844c2ff6a3e320bf8cdadc5094d4eaef2b7)
----
- configure.ac           |  1 +
- iptables/iptables.8.in |  8 ++++++++
- iptables/xshared.c     | 11 ++++++++---
- 3 files changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 31a8bb261c437..d37752a20afd2 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -219,6 +219,7 @@ AC_SUBST([libxtables_vmajor])
- 
- AC_DEFINE_UNQUOTED([XT_LOCK_NAME], "${xt_lock_name}",
- 	[Location of the iptables lock file])
-+AC_SUBST([XT_LOCK_NAME], "${xt_lock_name}")
- 
- AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile
- 	iptables/Makefile iptables/xtables.pc
-diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
-index 054564b3df91e..999cf339845f9 100644
---- a/iptables/iptables.8.in
-+++ b/iptables/iptables.8.in
-@@ -397,6 +397,14 @@ corresponding to that rule's position in the chain.
- \fB\-\-modprobe=\fP\fIcommand\fP
- When adding or inserting rules into a chain, use \fIcommand\fP
- to load any necessary modules (targets, match extensions, etc).
-+
-+.SH LOCK FILE
-+iptables uses the \fI@XT_LOCK_NAME@\fP file to take an exclusive lock at
-+launch.
-+
-+The \fBXTABLES_LOCKFILE\fP environment variable can be used to override
-+the default setting.
-+
- .SH MATCH AND TARGET EXTENSIONS
- .PP
- iptables can use extended packet matching and target modules.
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index c1d1371a6d54a..7d97637f7e129 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -249,15 +249,20 @@ void xs_init_match(struct xtables_match *match)
- static int xtables_lock(int wait, struct timeval *wait_interval)
- {
- 	struct timeval time_left, wait_time;
-+	const char *lock_file;
- 	int fd, i = 0;
- 
- 	time_left.tv_sec = wait;
- 	time_left.tv_usec = 0;
- 
--	fd = open(XT_LOCK_NAME, O_CREAT, 0600);
-+	lock_file = getenv("XTABLES_LOCKFILE");
-+	if (lock_file == NULL || lock_file[0] == '\0')
-+		lock_file = XT_LOCK_NAME;
-+
-+	fd = open(lock_file, O_CREAT, 0600);
- 	if (fd < 0) {
- 		fprintf(stderr, "Fatal: can't open lock file %s: %s\n",
--			XT_LOCK_NAME, strerror(errno));
-+			lock_file, strerror(errno));
- 		return XT_LOCK_FAILED;
- 	}
- 
-@@ -265,7 +270,7 @@ static int xtables_lock(int wait, struct timeval *wait_interval)
- 		if (flock(fd, LOCK_EX) == 0)
- 			return fd;
- 
--		fprintf(stderr, "Can't lock %s: %s\n", XT_LOCK_NAME,
-+		fprintf(stderr, "Can't lock %s: %s\n", lock_file,
- 			strerror(errno));
- 		return XT_LOCK_BUSY;
- 	}
--- 
-2.31.0
-
diff --git a/arptables-nft-helper b/arptables-helper
similarity index 76%
rename from arptables-nft-helper
rename to arptables-helper
index 7380abf..913298d 100644
--- a/arptables-nft-helper
+++ b/arptables-helper
@@ -5,12 +5,12 @@ ARPTABLES_CONFIG=/etc/sysconfig/arptables
 # compat for removed initscripts dependency
 
 success() {
-	echo -n "[  OK  ]"
+	echo "[  OK  ]"
 	return 0
 }
 
 failure() {
-	echo -n "[FAILED]"
+	echo "[FAILED]"
 	return 1
 }
 
@@ -21,31 +21,28 @@ start() {
 
 	# don't do squat if we don't have the config file
 	if [ -f $ARPTABLES_CONFIG ]; then
-		echo -n $"Applying arptables firewall rules: "
+		printf "Applying arptables firewall rules: "
 		/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
 			success || \
 			failure
-		echo
 		touch /var/lock/subsys/arptables
 	else
 		failure
-		echo
-		echo $"Configuration file /etc/sysconfig/arptables missing"
+		echo "Configuration file /etc/sysconfig/arptables missing"
 		exit 6
 	fi
 }
 
 stop() {
-	echo -n $"Removing user defined chains:"
+	printf "Removing user defined chains: "
 	arptables -X && success || failure
-	echo -n $"Flushing all chains:"
+	printf "Flushing all chains: "
 	arptables -F && success || failure
-	echo -n $"Resetting built-in chains to the default ACCEPT policy:"
+	printf "Resetting built-in chains to the default ACCEPT policy: "
 	arptables -P INPUT ACCEPT && \
 		arptables -P OUTPUT ACCEPT && \
 		success || \
 		failure
-	echo
 	rm -f /var/lock/subsys/arptables
 }
 
diff --git a/arptables.service b/arptables.service
new file mode 100644
index 0000000..df6c7d6
--- /dev/null
+++ b/arptables.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Automates a packet filtering firewall with arptables
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/arptables-helper start
+ExecStop=/usr/libexec/arptables-helper stop
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/coreteam-gpg-key-0xD70D1A666ACF2B21.txt b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt
new file mode 100644
index 0000000..cd4a35b
--- /dev/null
+++ b/coreteam-gpg-key-0xD70D1A666ACF2B21.txt
@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
+o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
+2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
+nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
+P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
+qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
+5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
+ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
+u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
+/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
+cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
+tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
+VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
+CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
+LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
+8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
+5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
+AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
+Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
+VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
+RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
+uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
+zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
+ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
+3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
+iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
+wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
+UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
+M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
+97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
+FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
+IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
+0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
+GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
+bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
+QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
+Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
+3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
+yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
+C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
+klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
+zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
+Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
+X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
+5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
+woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
+njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
+yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
+hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
+BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
+ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
+hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
+tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
+E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
+fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
+CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
+EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
+gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
+9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
+oD8ElPP+m/v6iA==
+=70vD
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/ebtables-config b/ebtables-config
new file mode 100644
index 0000000..69d9289
--- /dev/null
+++ b/ebtables-config
@@ -0,0 +1,11 @@
+# Save current firewall rules on stop.
+#   Value: yes|no,  default: no
+# Saves all firewall rules if firewall gets stopped
+# (e.g. on system shutdown).
+EBTABLES_SAVE_ON_STOP="no"
+
+# Save (and restore) rule counters.
+#   Value: yes|no,  default: no
+# Save rule counters when saving a kernel table to a file. If the
+# rule counters were saved, they will be restored when restoring the table.
+EBTABLES_SAVE_COUNTER="no"
diff --git a/ebtables-helper b/ebtables-helper
new file mode 100644
index 0000000..e63bd2b
--- /dev/null
+++ b/ebtables-helper
@@ -0,0 +1,102 @@
+#!/bin/bash
+
+# compat for removed initscripts dependency
+
+success() {
+       echo "[  OK  ]"
+       return 0
+}
+
+failure() {
+       echo "[FAILED]"
+       return 1
+}
+
+# internal variables
+EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
+EBTABLES_DATA=/etc/sysconfig/ebtables
+EBTABLES_TABLES="broute filter nat"
+VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
+
+# ebtables-config defaults
+EBTABLES_SAVE_ON_STOP="no"
+EBTABLES_SAVE_ON_RESTART="no"
+EBTABLES_SAVE_COUNTER="no"
+
+# load config if existing
+[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
+
+initialize() {
+	local ret=0
+	for table in $EBTABLES_TABLES; do
+		ebtables -t $table --init-table || ret=1
+	done
+	return $ret
+}
+
+sanitize_dump() {
+	local drop=false
+
+	export EBTABLES_TABLES
+
+	cat $1 | while read line; do
+		case $line in
+		\**)
+			drop=false
+			local table="${line#\*}"
+			local found=false
+			for t in $EBTABLES_TABLES; do
+				if [[ $t == $table ]]; then
+					found=true
+					break
+				fi
+			done
+			$found || drop=true
+			;;
+		esac
+		$drop || echo "$line"
+	done
+}
+
+start() {
+	if [ -f $EBTABLES_DATA ]; then
+		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
+		sanitize_dump $EBTABLES_DATA | ebtables-restore
+	else
+		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
+		initialize
+	fi
+	local ret=$?
+	touch $VAR_SUBSYS_EBTABLES
+	return $ret
+}
+
+save() {
+	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
+	export EBTABLES_SAVE_COUNTER
+	ebtables-save >$EBTABLES_DATA && success || failure
+}
+
+case $1 in
+	start)
+		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
+		start && success || failure
+		RETVAL=$?
+		;;
+	stop)
+		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
+		echo -n $"ebtables: stopping firewall: "
+		initialize && success || failure
+		RETVAL=$?
+		rm -f $VAR_SUBSYS_EBTABLES
+		;;
+	save)
+		save
+		;;
+	*)
+		echo "usage: ${0##*/} {start|stop|save}" >&2
+		RETVAL=2
+		;;
+esac
+
+exit $RETVAL
diff --git a/ebtables.service b/ebtables.service
new file mode 100644
index 0000000..b096f1d
--- /dev/null
+++ b/ebtables.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Ethernet Bridge Filtering tables
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/ebtables-helper start
+ExecStop=/usr/libexec/ebtables-helper stop
+
+[Install]
+WantedBy=multi-user.target
diff --git a/iptables-1.8.11-command-options-fix.patch b/iptables-1.8.11-command-options-fix.patch
new file mode 100644
index 0000000..f6eecb1
--- /dev/null
+++ b/iptables-1.8.11-command-options-fix.patch
@@ -0,0 +1,27 @@
+commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Wed Apr 23 12:36:13 2025 +0200
+
+    xshared: Accept an option if any given command allows it
+    
+    Fixed commit made option checking overly strict: Some commands may be
+    commbined (foremost --list and --zero), reject a given option only if it
+    is not allowed by any of the given commands.
+    
+    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
+    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index cdfd11ab..fc61e0fd 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
+ 	 */
+ 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
+ 		if ((options & optval) &&
+-		    (options_v_commands[i] & command) != command)
++		    !(options_v_commands[i] & command))
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Illegal option `%s' with this command",
+ 				      ops->option_name(optval));
diff --git a/iptables-1.8.11-fix-interface-comparisons.patch b/iptables-1.8.11-fix-interface-comparisons.patch
new file mode 100644
index 0000000..b038616
--- /dev/null
+++ b/iptables-1.8.11-fix-interface-comparisons.patch
@@ -0,0 +1,172 @@
+From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Mon, 18 Nov 2024 13:56:50 +0000
+Subject: nft: fix interface comparisons in `-C` commands
+
+Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
+kernel") removed code which explicitly set interface masks to all ones.  The
+result of this is that they are zero.  However, they are used to mask interfaces
+in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
+comparisons are always true, and check commands which ought to fail succeed:
+
+  # iptables -N test
+  # iptables -A test -i lo \! -o lo -j REJECT
+  # iptables -v -L test
+  Chain test (0 references)
+   pkts bytes target     prot opt in     out     source               destination
+      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
+  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
+  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
+
+Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
+
+Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ iptables/nft-arp.c                                 | 10 ++----
+ iptables/nft-ipv4.c                                |  4 +--
+ iptables/nft-ipv6.c                                |  6 +---
+ iptables/nft-shared.c                              | 36 +++++-----------------
+ iptables/nft-shared.h                              |  6 +---
+ .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
+ 6 files changed, 22 insertions(+), 49 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 264864c3..c11d64c3 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
+ 		return false;
+ 	}
+ 
+-	return is_same_interfaces(a->arp.iniface,
+-				  a->arp.outiface,
+-				  (unsigned char *)a->arp.iniface_mask,
+-				  (unsigned char *)a->arp.outiface_mask,
+-				  b->arp.iniface,
+-				  b->arp.outiface,
+-				  (unsigned char *)b->arp.iniface_mask,
+-				  (unsigned char *)b->arp.outiface_mask);
++	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
++				  b->arp.iniface, b->arp.outiface);
+ }
+ 
+ static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index 74092875..0c8bd291 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
+-				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
+-				  b->fw.ip.iniface, b->fw.ip.outiface,
+-				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
++				  b->fw.ip.iniface, b->fw.ip.outiface);
+ }
+ 
+ static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index b184f8af..4dbb2af2 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
+-				  a->fw6.ipv6.iniface_mask,
+-				  a->fw6.ipv6.outiface_mask,
+-				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
+-				  b->fw6.ipv6.iniface_mask,
+-				  b->fw6.ipv6.outiface_mask);
++				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
+ }
+ 
+ static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 6775578b..2c29e68f 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
+ }
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask)
++			const char *b_iniface, const char *b_outiface)
+ {
+-	int i;
+-
+-	for (i = 0; i < IFNAMSIZ; i++) {
+-		if (a_iniface_mask[i] != b_iniface_mask[i]) {
+-			DEBUGP("different iniface mask %x, %x (%d)\n",
+-			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
+-			return false;
+-		}
+-		if ((a_iniface[i] & a_iniface_mask[i])
+-		    != (b_iniface[i] & b_iniface_mask[i])) {
+-			DEBUGP("different iniface\n");
+-			return false;
+-		}
+-		if (a_outiface_mask[i] != b_outiface_mask[i]) {
+-			DEBUGP("different outiface mask\n");
+-			return false;
+-		}
+-		if ((a_outiface[i] & a_outiface_mask[i])
+-		    != (b_outiface[i] & b_outiface_mask[i])) {
+-			DEBUGP("different outiface\n");
+-			return false;
+-		}
++	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
++		DEBUGP("different iniface\n");
++		return false;
++	}
++	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
++		DEBUGP("different outiface\n");
++		return false;
+ 	}
+-
+ 	return true;
+ }
+ 
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 51d1e460..b57aee1f 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
+ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask);
++			const char *b_iniface, const char *b_outiface);
+ 
+ void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+new file mode 100755
+index 00000000..278cd648
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+@@ -0,0 +1,9 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++
++$XT_MULTI iptables -N test
++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
++
++exit 0
+-- 
+cgit v1.2.3
+
diff --git a/iptables.init b/iptables.init
index 51155b0..ffbd742 100755
--- a/iptables.init
+++ b/iptables.init
@@ -55,11 +55,6 @@ if [ ! -x /sbin/$IPTABLES ]; then
     exit 5
 fi
 
-# Old or new modutils
-/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
-    && NEW_MODUTILS=1 \
-    || NEW_MODUTILS=0
-
 # Default firewall configuration:
 IPTABLES_MODULES=""
 IPTABLES_SAVE_ON_STOP="no"
@@ -75,13 +70,33 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000
 # Load firewall configuration.
 [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
 
+is_iptables_nft() {
+	iptables --version | grep -q '(nf_tables)'
+}
+
+netfilter_active() {
+	is_iptables_nft && return 0
+	[ -e "$PROC_IPTABLES_NAMES" ]
+}
+
+netfilter_tables() {
+	netfilter_active || return 1
+	is_iptables_nft && {
+		# explicitly omit security table from this list as
+		# it should be reserved for SELinux use
+		echo "raw mangle filter nat"
+		return 0
+	}
+	cat "$PROC_IPTABLES_NAMES" 2>/dev/null
+}
+
 # Get active tables
-NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+NF_TABLES=$(netfilter_tables)
 
 
 flush_n_delete() {
     # Flush firewall rules and delete chains.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
     [ -z "$NF_TABLES" ] && return 1
@@ -113,10 +128,10 @@ set_policy() {
     policy=$1
 
     # Check if iptable module is loaded
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
-    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+    tables=$(netfilter_tables)
     [ -z "$tables" ] && return 1
 
     echo -n $"${IPTABLES}: Setting chains to policy $policy: "
@@ -166,7 +181,7 @@ load_sysctl() {
         echo -n $"Loading sysctl settings: "
         ret=0
         for item in $IPTABLES_SYSCTL_LOAD_LIST; do
-            fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
+            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
             let ret+=$?;
         done
         [ $ret -eq 0 ] && success || failure
@@ -217,7 +232,7 @@ start() {
 	    return 1
 	fi
     fi
-    
+ 
     # Load additional modules (helpers)
     if [ -n "$IPTABLES_MODULES" ]; then
 	echo -n $"${IPTABLES}: Loading additional modules: "
@@ -230,7 +245,7 @@ start() {
 	[ $ret -eq 0 ] && success || failure
 	echo
     fi
-    
+ 
     # Load sysctl settings
     load_sysctl
 
@@ -240,7 +255,7 @@ start() {
 
 stop() {
     # Do not stop if iptables module is not loaded.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Set default chain policy to ACCEPT, in order to not break shutdown
     # on systems where the default policy is DROP and root device is
@@ -248,14 +263,14 @@ stop() {
     set_policy ACCEPT
     # And then, flush the rules and delete chains
     flush_n_delete
-    
+
     rm -f $VAR_SUBSYS_IPTABLES
     return $ret
 }
 
 save() {
     # Check if iptable module is loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
 	return 0
     fi
@@ -298,7 +313,7 @@ save() {
 }
 
 status() {
-    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
 	echo $"${IPTABLES}: Firewall is not running."
 	return 3
     fi
@@ -306,7 +321,7 @@ status() {
     # Do not print status if lockfile is missing and iptables modules are not 
     # loaded.
     # Check if iptable modules are loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo $"${IPTABLES}: Firewall modules are not loaded."
 	return 3
     fi
@@ -319,7 +334,7 @@ status() {
 
     NUM=
     [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
-    VERBOSE= 
+    VERBOSE=
     [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
     COUNT=
     [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"
diff --git a/iptables.service b/iptables.service
index 6722c7a..6b996d1 100644
--- a/iptables.service
+++ b/iptables.service
@@ -1,7 +1,8 @@
 [Unit]
 Description=IPv4 firewall with iptables
-After=syslog.target
 AssertPathExists=/etc/sysconfig/iptables
+Before=network-pre.target
+Wants=network-pre.target
 
 [Service]
 Type=oneshot
@@ -11,8 +12,6 @@ ExecReload=/usr/libexec/iptables/iptables.init reload
 ExecStop=/usr/libexec/iptables/iptables.init stop
 Environment=BOOTUP=serial
 Environment=CONSOLETYPE=serial
-StandardOutput=syslog
-StandardError=syslog
 
 [Install]
-WantedBy=basic.target
+WantedBy=multi-user.target
diff --git a/iptables.spec b/iptables.spec
index 19941e6..c999d94 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -4,49 +4,41 @@
 # service legacy actions (RHBZ#748134)
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 
-# Bootstrap mode providing old and new versions of libip{4,6}tc in parallel
-%global bootstrap 0
-
-%if 0%{?bootstrap}
-%global version_old      1.8.2
-%global iptc_so_ver_old  0
-%global ipXtc_so_ver_old 0
-%endif
 %global iptc_so_ver  0
 %global ipXtc_so_ver 2
 
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
-URL: http://www.netfilter.org/projects/iptables
-Version: 1.8.5
-Release: 6%{?dist}
-Source: %{url}/files/%{name}-%{version}.tar.bz2
-Source1: iptables.init
-Source2: iptables-config
-Source3: iptables.service
-Source4: sysconfig_iptables
-Source5: sysconfig_ip6tables
-Source6: arptables-nft-helper
-%if 0%{?bootstrap}
-Source7: %{url}/files/%{name}-%{version_old}.tar.bz2
-Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
-%endif
-
-Patch1: 0001-build-resolve-iptables-apply-not-getting-installed.patch
-Patch2: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch
-Patch3: 0003-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
-Patch4: 0004-nft-Fix-command-name-in-ip6tables-error-message.patch
-Patch5: 0005-ebtables-Fix-for-broken-chain-renaming.patch
-Patch6: 0006-ebtables-Exit-gracefully-on-invalid-table-names.patch
-Patch7: 0007-iptables-accept-lock-file-name-at-runtime.patch
+URL: https://www.netfilter.org/projects/iptables
+Version: 1.8.11
+Release: 12%{?dist}
+Source0: %{url}/files/%{name}-%{version}.tar.xz
+source1: %{url}/files/%{name}-%{version}.tar.xz.sig
+Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
+Source3: iptables.init
+Source4: iptables-config
+Source5: iptables.service
+Source6: sysconfig_iptables
+Source7: sysconfig_ip6tables
+Source8: arptables-helper
+Source9: arptables.service
+Source10: ebtables.service
+Source11: ebtables-helper
+Source12: ebtables-config
+# Patch to fix -C handling, already upstream
+# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
+Patch1: iptables-1.8.11-fix-interface-comparisons.patch
+# Patch to fix overly strict command option checking
+# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
+Patch2: iptables-1.8.11-command-options-fix.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
-License: GPLv2 and Artistic Licence 2.0 and ISC
+License: GPL-2.0-only AND Artistic-2.0 AND ISC
 
 # libnetfilter_conntrack is needed for xt_connlabel
 BuildRequires: pkgconfig(libnetfilter_conntrack)
-# libnfnetlink-devel is requires for nfnl_osf
+# libnfnetlink-devel is required for nfnl_osf
 BuildRequires: pkgconfig(libnfnetlink)
 BuildRequires: libselinux-devel
 BuildRequires: kernel-headers
@@ -56,45 +48,80 @@ BuildRequires: bison
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: pkgconfig(libmnl) >= 1.0
-BuildRequires: pkgconfig(libnftnl) >= 1.1.5
+BuildRequires: pkgconfig(libnftnl) >= 1.2.6
 # libpcap-devel for nfbpf_compile
 BuildRequires: libpcap-devel
-BuildRequires: autogen
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
-Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-%if 0%{?fedora} > 24
-Conflicts: setup < 2.10.4-1
-%endif
-Requires(post): %{_sbindir}/update-alternatives
-Requires(postun): %{_sbindir}/update-alternatives
+BuildRequires: make
+BuildRequires: gnupg2
 
 %description
 The iptables utility controls the network packet filtering code in the
 Linux kernel. If you need to set up firewalls and/or IP masquerading,
 you should install this package.
 
+%package legacy
+Summary: Legacy tools for managing Linux kernel packet filtering capabilities
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Conflicts: setup < 2.10.4-1
+Conflicts: alternatives < 1.32-1
+Requires(post): /usr/sbin/update-alternatives
+Requires(postun): /usr/sbin/update-alternatives
+%if 0%{?rhel} < 9
+Provides:	iptables
+%endif
+Provides:  %{name}-compat = %{version}-%{release}
+Obsoletes: %{name}-compat < 1.8.9-7
+
+%sbin_merge_compat %{_prefix}/sbin/iptables
+
+%description legacy
+The iptables utility controls the network packet filtering code in the
+Linux kernel. This package contains the legacy tools which are obsoleted by
+nft-variants in iptables-nft package for backwards compatibility reasons.
+If you need to set up firewalls and/or IP masquerading, you should not install
+this package but either nftables or iptables-nft instead.
+
 %package libs
-Summary: iptables libraries
+Summary: libxtables and iptables extensions userspace support
 
 %description libs
+libxtables and associated shared object files
+
+Libxtables provides unified access to iptables extensions in userspace. Data
+and logic for those is kept in per-extension shared object files.
+
+%package legacy-libs
+Summary: iptables legacy libraries
+
+%description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real so version.
-
-For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real
+so version. For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
-
 %package devel
 Summary: Development package for iptables
-Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+# XXX: Drop this after two releases or so
+Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %description devel
-iptables development headers and libraries.
+libxtables development headers and pkgconfig files
+
+%package legacy-devel
+Summary: Development package for legacy iptables
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: pkgconfig
+
+%description legacy-devel
+Legacy iptables development headers and pkgconfig files
 
 The iptc libraries are marked as not public by upstream. The interface is not
 stable and may change with every new version. It is therefore unsupported.
@@ -102,11 +129,21 @@ stable and may change with every new version. It is therefore unsupported.
 %package services
 Summary: iptables and ip6tables services for iptables
 Requires: %{name} = %{version}-%{release}
+Requires: %{name}-utils = %{version}-%{release}
 %{?systemd_ordering}
 # obsolete old main package
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
+# Look at me, I'm the new arptables-services now!
+Conflicts: %{name}-nft < 1.8.11-5
+Obsoletes: arptables-services < 0.0.5-16
+Provides: arptables-services = %{version}-%{release}
+# Look at me, I'm the new ebtables-services now!
+# (With epoch to turn our version number higher value)
+Obsoletes: ebtables-services < 2.0.11-20
+Provides: ebtables-services = 1:%{version}-%{release}
+BuildArch: noarch
 
 %description services
 iptables services for IPv4 and IPv6
@@ -115,38 +152,40 @@ This package provides the services iptables and ip6tables that have been split
 out of the base package since they are not active by default anymore.
 
 %package utils
-Summary: iptables and ip6tables services for iptables
+Summary: iptables and ip6tables misc utilities
 Requires: %{name} = %{version}-%{release}
 
 %description utils
 Utils for iptables
 
 This package provides nfnl_osf with the pf.os database and nfbpf_compile,
-a bytecode generator for use with xt_bpf.
+a bytecode generator for use with xt_bpf. Also included is iptables-apply,
+a safer way to update iptables remotely.
 
 %package nft
 Summary: nftables compatibility for iptables, arptables and ebtables
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires(post): /usr/sbin/update-alternatives
+Requires(post): /usr/bin/readlink
+Requires(postun): /usr/sbin/update-alternatives
 Obsoletes: iptables-compat < 1.6.2-4
 Provides: arptables-helper
 Provides: iptables
 Provides: arptables
 Provides: ebtables
+# allowing old arptables-legacy will break when switching alternatives
+# due to the dropped arptables-helper symlink
+Conflicts: arptables-legacy < 0.0.5-16
+
+%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description nft
 nftables compatibility for iptables, arptables and ebtables.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
 
-%if 0%{?bootstrap}
-%{__mkdir} -p bootstrap_ver
-pushd bootstrap_ver
-%{__tar} --strip-components=1 -xf %{SOURCE7}
-%{__patch} -p1 <%{SOURCE8}
-popd
-%endif
-
 %build
 ./autogen.sh
 CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
@@ -158,62 +197,33 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
 rm -f include/linux/types.h
 
-make %{?_smp_mflags}
-
-%if 0%{?bootstrap}
-pushd bootstrap_ver
-./autogen.sh
-CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
-%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
-
-# do not use rpath
-sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
-sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
-
-rm -f include/linux/types.h
-
-make %{?_smp_mflags}
-popd
-%endif
+%make_build
 
 %install
-%if 0%{?bootstrap}
-%make_install -C bootstrap_ver
-%{_bindir}/find %{buildroot} -xtype f -not \
-	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
-%{_bindir}/find %{buildroot} -type l -not \
-	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
-%endif
-
-make install DESTDIR=%{buildroot}
+%make_install
 # remove la file(s)
-rm -f %{buildroot}/%{_libdir}/*.la
-
-# install ip*tables.h header files
-install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/
-install -d -m 755 %{buildroot}%{_includedir}/iptables
-install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/
-
-# install ipulog header file
-install -d -m 755 %{buildroot}%{_includedir}/libipulog/
-install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/
+rm -f %{buildroot}%{_libdir}/*.la
 
 # install init scripts and configuration files
 install -d -m 755 %{buildroot}%{script_path}
-install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
+install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
+install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
-install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
+install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
-install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables
-install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
+install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
+install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
+touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}
-sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service
+install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
+sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
 # install legacy actions for service command
@@ -236,230 +246,436 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic
 sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy
 install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic
 
-%if 0%{?fedora} > 24
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
-%endif
-
-install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/
-touch %{buildroot}%{_libexecdir}/arptables-helper
 
 # prepare for alternatives
 touch %{buildroot}%{_mandir}/man8/arptables.8
 touch %{buildroot}%{_mandir}/man8/arptables-save.8
 touch %{buildroot}%{_mandir}/man8/arptables-restore.8
 touch %{buildroot}%{_mandir}/man8/ebtables.8
+rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+
+# fix absolute symlink
+ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
 
 %ldconfig_scriptlets
 
-%post
+%post legacy
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-%{_sbindir}/update-alternatives --install \
+update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--slave $pfx6 ip6tables $pfx6-legacy \
-	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
-	--slave $pfx-save iptables-save $pfx-legacy-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
 
-%postun
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
+
+%postun legacy
 if [ $1 -eq 0 ]; then
-	%{_sbindir}/update-alternatives --remove \
+	update-alternatives --remove \
 		iptables %{_sbindir}/iptables-legacy
 fi
 
+# iptables-1.8.0-1 introduced the use of alternatives
+# when upgrading, its %postun script runs due to the package renaming
+# fix this by repeating the install into alternatives
+# also keep the old alternatives configuration to not change the system
+%triggerun legacy -- iptables > 1.8.0
+alternatives --list | awk '/^iptables/{print $3; exit}' \
+		>/var/tmp/alternatives.iptables.current
+cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
+
+%triggerpostun legacy -- iptables > 1.8.0
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
+update-alternatives --install \
+	$pfx iptables $pfx-legacy 10 \
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
+rm /var/tmp/alternatives.iptables.current
+mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
+
 %post services
+%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
+%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
 %?ldconfig
+%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
-%post nft
+%post -e nft
+[[ %%{_excludedocs} == 1 ]] || do_man=true
+
+# remove non-symlinks in spots managed by alternatives
+# to cover for updates from not-yet-alternatived versions
+for pfx in %{_prefix}/sbin/{eb,arp}tables; do
+	for sfx in "" "-restore" "-save"; do
+		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+			rm -f $pfx$sfx
+		fi
+	done
+done
+for manpfx in %{_mandir}/man8/{eb,arp}tables; do
+	for sfx in {,-restore,-save}.8.gz; do
+		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
+			rm -f $manpfx$sfx
+		fi
+	done
+done
+
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-%{_sbindir}/update-alternatives --install \
+update-alternatives --install \
 	$pfx iptables $pfx-nft 10 \
-	--slave $pfx6 ip6tables $pfx6-nft \
-	--slave $pfx-restore iptables-restore $pfx-nft-restore \
-	--slave $pfx-save iptables-save $pfx-nft-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-nft-save
+	--follower $pfx6 ip6tables $pfx6-nft \
+	--follower $pfx-restore iptables-restore $pfx-nft-restore \
+	--follower $pfx-save iptables-save $pfx-nft-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-nft-save
 
 pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
-for sfx in "" "-restore" "-save"; do
-	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-		rm -f $pfx$sfx
-	fi
-done
-if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
-	rm -f $manpfx.8.gz
-fi
-%{_sbindir}/update-alternatives --install \
+update-alternatives --install \
 	$pfx ebtables $pfx-nft 10 \
-	--slave $pfx-save ebtables-save $pfx-nft-save \
-	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
-	--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz
+	--follower $pfx-save ebtables-save $pfx-nft-save \
+	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
 
 pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
-lepfx=%{_libexecdir}/arptables
-for sfx in "" "-restore" "-save"; do
-	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-		rm -f $pfx$sfx
-	fi
-	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
-		rm -f $manpfx$sfx.8.gz
-	fi
-done
-if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
-	rm -f $lepfx-helper
-fi
-%{_sbindir}/update-alternatives --install \
+update-alternatives --install \
 	$pfx arptables $pfx-nft 10 \
-	--slave $pfx-save arptables-save $pfx-nft-save \
-	--slave $pfx-restore arptables-restore $pfx-nft-restore \
-	--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \
-	--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \
-	--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \
-	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
+	--follower $pfx-save arptables-save $pfx-nft-save \
+	--follower $pfx-restore arptables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
+	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
+	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
 
 %postun nft
 if [ $1 -eq 0 ]; then
 	for cmd in iptables ebtables arptables; do
-		%{_sbindir}/update-alternatives --remove \
-			$cmd %{_sbindir}/$cmd-nft
+		update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
 	done
 fi
 
-%files
-%{!?_licensedir:%global license %%doc}
-%license COPYING
-%doc INCOMPATIBILITIES
-%if 0%{?fedora} <= 24
-%{_sysconfdir}/ethertypes
-%endif
-%{_sbindir}/iptables-apply
-%{_sbindir}/ip6tables-apply
-%{_sbindir}/iptables-legacy*
-%{_sbindir}/ip6tables-legacy*
+%files legacy
+%{_sbindir}/ip{,6}tables-legacy*
 %{_sbindir}/xtables-legacy-multi
 %{_bindir}/iptables-xml
 %{_mandir}/man1/iptables-xml*
-%{_mandir}/man8/iptables*
-%{_mandir}/man8/ip6tables*
 %{_mandir}/man8/xtables-legacy*
-%ghost %{_sbindir}/iptables
-%ghost %{_sbindir}/iptables-restore
-%ghost %{_sbindir}/iptables-save
-%ghost %{_sbindir}/ip6tables
-%ghost %{_sbindir}/ip6tables-restore
-%ghost %{_sbindir}/ip6tables-save
+%dir %{_datadir}/xtables
+%{_datadir}/xtables/iptables.xslt
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
-%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
-%if 0%{?bootstrap}
-%{_libdir}/libiptc.so.%{iptc_so_ver_old}*
-%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}*
-%endif
+%license COPYING
 %{_libdir}/libxtables.so.12*
 %dir %{_libdir}/xtables
-%{_libdir}/xtables/libipt*
-%{_libdir}/xtables/libip6t*
-%{_libdir}/xtables/libxt*
+%{_libdir}/xtables/lib{ip,ip6,x}t*
+%{_mandir}/man8/ip{,6}tables.8.gz
+%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz
+
+%files legacy-libs
+%license COPYING
+%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
 
 %files devel
-%dir %{_includedir}/iptables
-%{_includedir}/iptables/*.h
-%{_includedir}/*.h
+%{_includedir}/xtables{,-version}.h
+%{_libdir}/libxtables.so
+%{_libdir}/pkgconfig/xtables.pc
+
+%files legacy-devel
 %dir %{_includedir}/libiptc
 %{_includedir}/libiptc/*.h
-%dir %{_includedir}/libipulog
-%{_includedir}/libipulog/*.h
 %{_libdir}/libip*tc.so
-%{_libdir}/libxtables.so
-%{_libdir}/pkgconfig/libiptc.pc
-%{_libdir}/pkgconfig/libip4tc.pc
-%{_libdir}/pkgconfig/libip6tc.pc
-%{_libdir}/pkgconfig/xtables.pc
+%{_libdir}/pkgconfig/libip{,4,6}tc.pc
 
 %files services
 %dir %{script_path}
-%{script_path}/iptables.init
-%{script_path}/ip6tables.init
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config
-%{_unitdir}/iptables.service
-%{_unitdir}/ip6tables.service
-%dir %{legacy_actions}/iptables
-%{legacy_actions}/iptables/save
-%{legacy_actions}/iptables/panic
-%dir %{legacy_actions}/ip6tables
-%{legacy_actions}/ip6tables/save
-%{legacy_actions}/ip6tables/panic
+%{script_path}/ip{,6}tables.init
+%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
+%config(noreplace) %{_sysconfdir}/sysconfig/arptables
+%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
+%ghost %{_sysconfdir}/sysconfig/ebtables
+%{_unitdir}/{arp,eb,ip,ip6}tables.service
+%dir %{legacy_actions}/ip{,6}tables
+%{legacy_actions}/ip{,6}tables/{save,panic}
+%{_libexecdir}/{arp,eb}tables-helper
 
 %files utils
+%license COPYING
 %{_sbindir}/nfnl_osf
 %{_sbindir}/nfbpf_compile
+%{_sbindir}/ip{,6}tables-apply
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/pf.os
 %{_mandir}/man8/nfnl_osf*
 %{_mandir}/man8/nfbpf_compile*
+%{_mandir}/man8/ip{,6}tables-apply*
 
 %files nft
-%{_sbindir}/iptables-nft*
-%{_sbindir}/iptables-restore-translate
-%{_sbindir}/iptables-translate
-%{_sbindir}/ip6tables-nft*
-%{_sbindir}/ip6tables-restore-translate
-%{_sbindir}/ip6tables-translate
-%{_sbindir}/ebtables-nft*
-%{_sbindir}/arptables-nft*
+%{_sbindir}/ip{,6}tables-nft*
+%{_sbindir}/ip{,6}tables{,-restore}-translate
+%{_sbindir}/{eb,arp}tables-nft*
 %{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
+%{_sbindir}/ebtables-translate
+%{_sbindir}/arptables-translate
 %dir %{_libdir}/xtables
-%{_libdir}/xtables/libarpt*
-%{_libdir}/xtables/libebt*
-%{_libexecdir}/arptables-nft-helper
+%{_libdir}/xtables/lib{arp,eb}t*
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
-%ghost %{_sbindir}/iptables
-%ghost %{_sbindir}/iptables-restore
-%ghost %{_sbindir}/iptables-save
-%ghost %{_sbindir}/ip6tables
-%ghost %{_sbindir}/ip6tables-restore
-%ghost %{_sbindir}/ip6tables-save
-%ghost %{_sbindir}/ebtables
-%ghost %{_sbindir}/ebtables-save
-%ghost %{_sbindir}/ebtables-restore
-%ghost %{_sbindir}/arptables
-%ghost %{_sbindir}/arptables-save
-%ghost %{_sbindir}/arptables-restore
-%ghost %{_libexecdir}/arptables-helper
-%ghost %{_mandir}/man8/arptables.8.gz
-%ghost %{_mandir}/man8/arptables-save.8.gz
-%ghost %{_mandir}/man8/arptables-restore.8.gz
+%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
+%{_mandir}/man8/ebtables-translate*
+%{_mandir}/man8/arptables-translate*
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
-* Wed Mar 24 2021 Phil Sutter <psutter@redhat.com> - 1.8.5-6
-- iptables: accept lock file name at runtime
+* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
+- Pull in upstream fix for too strict command option parsing
 
-* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.5-5
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
+- Fix for ghost files not present in iptables-nft RPM
+
+* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
+- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
+  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
+
+* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
+- Revert last release, it breaks alternatives symlinks
+
+* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
+- Keep symlinks managed by alternatives under /usr/bin
+
+* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
+- Add patch to fix -C handling ( fixes rhbz#2360423 )
+
+* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
+- iptables-services to assimilate arptables- and ebtables-services
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
+- Keep symlinks managed by alternatives under /usr/sbin
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
+- new version
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-14
+- Add unmerged-sbin compat also for -legacy subpackage
+
+* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-13
+- Bump release and add changelog entry
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-12
+- Rebuilt for the bin-sbin merge
+
+* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-11
+- Add missing build dependency
+
+* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-10
+- Verify tarball GPG signature
+
+* Wed Jul 03 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-9
+- Backport fixes from upstream
+
+* Tue May 21 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-8
+- Make iptables-legacy own %%{_datadir}/xtables
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jan 11 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-5
+- Backport fixes from upstream
+- Fix flatpak build
+
+* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-4
+- The actual obsoletes fix
+
+* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-3
+- Fix compat sub-package obsoletion
+
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-2
+- Obsolete dropped compat package
+
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-1
+- New version 1.8.10
+- Drop compat sub-package
+
+* Tue Aug 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-6
+- Convert license to SPDX format
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
+- Backport fixes from upstream
+
+* Thu Apr 20 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-3
+- Support %%_excludedocs macro in alternatives installation
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Jan 12 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-1
+- Make iptables-xml a relative symlink
+- Drop not needed xtables.conf
+- Ship iptables.xslt with iptables-legacy package
+- Ship ebtables-translate tool with iptables-nft package
+- Update to 1.8.9.
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jul 08 2022 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.8-2
+- iptables-services requires iptables-apply in utils to apply rules
+
+* Fri May 13 2022 Phil Sutter <psutter@redhat.com> - 1.8.8-1
+- Update to 1.8.8. Fixes rhbz#2085503
+
+* Thu Mar 03 2022 Phil Sutter <psutter@redhat.com> - 1.8.7-16
+- Improve error messages for unsupported extensions
+- xshared: Fix response to unprivileged users
+- libxtables: Register only the highest revision extension
+- Ignore typical 'fedpkg local' results in .gitignore
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sat Nov 27 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-14
+- Rebuild for new libnftnl.
+
+* Thu Aug 05 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-13
+- doc: ebtables-nft.8: Adjust for missing atomic-options
+- nft: Fix for non-verbose check command
+- Build services sub-package as noarch
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jul 01 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-11
+- Fix performance restoring large rulesets
+- Review unit file
+
+* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-10
+- Backport fixes from upstream
+
+* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-9
+- Remove bashisms from arptables-nft-helper
+
+* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8
+- iptables.init: Fix functionality for iptables-nft
+- iptables.init: Ignore sysctl files not suffixed '.conf'
+- iptables.init: Drop unused NEW_MODUTILS check
+- iptables.init: Drop some trailing whitespace
+
+* Mon Mar 29 2021 Damian Wrobel <dwrobel@ertelnet.rybnik.pl> - 1.8.7-7
+- Add missing readlink required for iptables-nft(post)
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6
+- Restore alternatives configuration after upgrade
+- Fix license location
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-5
+- Fix upgrade path with package rename
+- Add missing dependencies to iptables-nft package
+
+* Tue Feb 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-4
+- Drop bootstrap code again
+- Drop workarounds for F24 and lower
+- Fix iptables-utils summary
+- Ship iptables-apply with iptables-utils
+- Reduce files sections by use of globbing
+- Ship common man pages with iptables-libs
+- Ship *-translate man pages with iptables-nft
+- Move legacy iptables binaries, libraries and headers into sub-packages
+- Introduce compat sub-package to help with above transitions
+- Drop libipulog header from devel package, this belongs to libnetfilter_log
+- Do not ship internal headers in devel package
+
+* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-3
 - ebtables: Exit gracefully on invalid table names
 
-* Tue Nov 17 14:37:49 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-4
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-1
+- Update to 1.8.7. Fixes rhbz#1916948
+
+* Thu Nov 19 17:32:24 CET 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-5
+- Use make macros
+
+* Tue Nov 17 14:05:30 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-4
 - ebtables: Fix for broken chain renaming
 
+* Mon Nov 16 13:39:22 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-3
+- Drop obsolete StandardOutput setting from unit file
+- Remove StandardError setting from unit file, its value is default
+
+* Thu Nov  5 2020 Florian Weimer <fweimer@redhat.com> - 1.8.6-2
+- Remove build dependency on autogen
+
+* Sat Oct 31 2020 Kevin Fenzi <kevin@scrye.com> - 1.8.6-1
+- Update to 1.8.6. Fixes bug #1893453
+
 * Tue Aug 25 15:56:10 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-3
 - nft: cache: Check consistency with NFT_CL_FAKE, too
 - nft: Fix command name in ip6tables error message
diff --git a/sources b/sources
index a7e9f94..1f7b750 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (iptables-1.8.5.tar.bz2) = 6a6baa541bb7aa331b176e0a91894e0766859814b59e77c71351ac34d6ebd337487981db48c70e476a48c67bcf891cfc663221a7582feb1496ad1df56eb28da8
+SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
+SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2
diff --git a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh
index 32eab99..952cd4c 100755
--- a/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh
+++ b/tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh
@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 IPSET=testset6
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
diff --git a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh
index 438468d..26a667e 100755
--- a/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh
+++ b/tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh
@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 TESTD=$PWD
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "source $TESTD/rules.in" 0 "read ruleset"
diff --git a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh
index 889c1b6..86652af 100755
--- a/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh
+++ b/tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh
@@ -29,7 +29,6 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 prepare_page() {
@@ -42,7 +41,6 @@ prepare_page() {
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlLogInfo $(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
@@ -121,10 +119,14 @@ rlJournalStart
         rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
         rlRun "iptables -t raw -F"
         rlRun "ip6tables -t raw -F"
-        rlRun "rmmod nf_log_ipv4"
-        rlRun "rmmod nf_log_ipv6"
-        rlRun "rmmod nf_log_common"
-        rlRun "rmmod nfnetlink_log" 0,1
+        if rlTestVersion "$(uname -r)" "<" "4.6"; then
+            rlRun "rmmod nf_log_ipv4"
+            rlRun "rmmod nf_log_ipv6"
+            rlRun "rmmod nf_log_common"
+            rlRun "rmmod nfnetlink_log" 0,1
+	else
+            rlLogInfo "new kernel detected: skipping unloading modules"
+	fi
         rlLogInfo "restoring services"
         for svc in $SERVICES; do
             rlServiceRestore $svc
diff --git a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh
index 888dfbd..0b4032e 100755
--- a/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh
+++ b/tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh
@@ -29,7 +29,6 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 CGNUM="15"
 CGNAME="15"
 CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
@@ -41,7 +40,6 @@ SKIP6=false
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel-$(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
diff --git a/tests/initscript-sanity/runtest.sh b/tests/initscript-sanity/runtest.sh
index e270b78..b132033 100755
--- a/tests/initscript-sanity/runtest.sh
+++ b/tests/initscript-sanity/runtest.sh
@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd
diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile
index 5b7f979..3d9ade1 100644
--- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile
+++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile
@@ -53,7 +53,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          iptables" >> $(METADATA)
-	@echo "Requires:        iptables bridge-utils ipset" >> $(METADATA)
+	@echo "Requires:        iptables iproute ipset" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2+" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
diff --git a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh
index 75f7413..f68925c 100755
--- a/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh
+++ b/tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh
@@ -29,16 +29,13 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ip6tables-save > ip6tables.backup"
         rlRun "iptables-save > iptables.backup"
-        rlRun "brctl addbr testbr" 0 "create bridge iface"
+        rlRun "ip link add dev testbr type bridge" 0 "create bridge iface"
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -75,7 +72,7 @@ rlJournalStart
         rlRun "ip6tables-restore < ip6tables.backup"
         rlRun "iptables-restore < iptables.backup"
         rlRun "ip link set down dev testbr"
-        rlRun "brctl delbr testbr" 0 "remove bridge iface"
+        rlRun "ip link del testbr" 0 "remove bridge iface"
         rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
         rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
         rlRun "popd"
diff --git a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh
index f59a908..d06fc4a 100755
--- a/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh
+++ b/tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh
@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "cp /etc/sysconfig/ip6tables ."
diff --git a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh
index 79b2696..2daddb3 100755
--- a/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh
+++ b/tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh
@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         for svc in $SERVICES; do
diff --git a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh
index d17e693..f409501 100755
--- a/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh
+++ b/tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh
@@ -29,13 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 IPSET4="ipsetv4"
 IPSET6="ipsetv6"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ipset create $IPSET4 hash:ip"
diff --git a/tests/iptables-save-cuts-space-before-j/runtest.sh b/tests/iptables-save-cuts-space-before-j/runtest.sh
index a6a5099..bba6bf2 100755
--- a/tests/iptables-save-cuts-space-before-j/runtest.sh
+++ b/tests/iptables-save-cuts-space-before-j/runtest.sh
@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlServiceStart iptables
diff --git a/tests/iptables-save-modprobe-option/runtest.sh b/tests/iptables-save-modprobe-option/runtest.sh
index 22951c4..240c76e 100755
--- a/tests/iptables-save-modprobe-option/runtest.sh
+++ b/tests/iptables-save-modprobe-option/runtest.sh
@@ -30,11 +30,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartTest
-        rlAssertRpm $PACKAGE
         rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
         rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
     rlPhaseEnd
diff --git a/tests/tests.yml b/tests/tests.yml
index dead758..8bac1f4 100644
--- a/tests/tests.yml
+++ b/tests/tests.yml
@@ -10,7 +10,6 @@
         - iptables-services # multiple tests need iptables/ip6tables config files
         - initscripts       # multiple tests need system command
         - libcgroup-tools   # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
-        - bridge-utils      # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
         - ipset             # multiple tests need ipset command
         - strace            # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
         - policycoreutils   # initscript-sanity needs restorecon command
@@ -21,7 +20,7 @@
   roles:
   - role: standard-test-rhts
     tests:
-    - backport-iptables-add-libxt-cgroup-frontend
+#    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by
@@ -43,7 +42,7 @@
   roles:
   - role: standard-test-beakerlib
     tests:
-    - backport-iptables-add-libxt-cgroup-frontend
+#    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by
diff --git a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh
index c3223b5..abfb03a 100755
--- a/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh
+++ b/tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh
@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd