- Pull in upstream fix for too strict command option parsing

upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281

	xshared: Accept an option if any given command allows it

	Fixed commit made option checking overly strict: Some commands may be
	commbined (foremost --list and --zero), reject a given option only if it
	is not allowed by any of the given commands.

.gitignore

@@ -1 +1,19 @@
+/.build-*.log
+/iptables-*.src.rpm
+/noarch/
+/x86_64/
+/iptables.spec.orig
 /iptables-1.6.2.tar.bz2
+/iptables-1.8.0.tar.bz2
+/iptables-1.8.2.tar.bz2
+/iptables-1.8.3.tar.bz2
+/iptables-1.8.4.tar.bz2
+/iptables-1.8.5.tar.bz2
+/iptables-1.8.6.tar.bz2
+/iptables-1.8.7.tar.bz2
+/iptables-1.8.8.tar.bz2
+/iptables-1.8.9.tar.xz
+/iptables-1.8.10.tar.xz
+/iptables-1.8.10.tar.xz.sig
+/iptables-1.8.11.tar.xz
+/iptables-1.8.11.tar.xz.sig

arptables-helper

@@ -0,0 +1,73 @@
+#!/bin/sh
+
+ARPTABLES_CONFIG=/etc/sysconfig/arptables
+
+# compat for removed initscripts dependency
+
+success() {
+	echo "[  OK  ]"
+	return 0
+}
+
+failure() {
+	echo "[FAILED]"
+	return 1
+}
+
+start() {
+	if [ ! -x /usr/sbin/arptables ]; then
+		exit 4
+	fi
+
+	# don't do squat if we don't have the config file
+	if [ -f $ARPTABLES_CONFIG ]; then
+		printf "Applying arptables firewall rules: "
+		/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
+			success || \
+			failure
+		touch /var/lock/subsys/arptables
+	else
+		failure
+		echo "Configuration file /etc/sysconfig/arptables missing"
+		exit 6
+	fi
+}
+
+stop() {
+	printf "Removing user defined chains: "
+	arptables -X && success || failure
+	printf "Flushing all chains: "
+	arptables -F && success || failure
+	printf "Resetting built-in chains to the default ACCEPT policy: "
+	arptables -P INPUT ACCEPT && \
+		arptables -P OUTPUT ACCEPT && \
+		success || \
+		failure
+	rm -f /var/lock/subsys/arptables
+}
+
+case "$1" in
+start)
+	start
+	;;
+
+stop)
+	stop
+	;;
+
+restart|reload)
+	# "restart" is really just "start" as this isn't a daemon,
+	# and "start" clears any pre-defined rules anyway.
+	# This is really only here to make those who expect it happy
+	start
+	;;
+
+condrestart|try-restart|force-reload)
+	[ -e /var/lock/subsys/arptables ] && start
+	;;
+
+*)
+	exit 2
+esac
+
+exit 0

arptables.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Automates a packet filtering firewall with arptables
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/arptables-helper start
+ExecStop=/usr/libexec/arptables-helper stop
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

coreteam-gpg-key-0xD70D1A666ACF2B21.txt

@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
+o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
+2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
+nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
+P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
+qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
+5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
+ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
+u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
+/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
+cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
+tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
+VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
+CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
+LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
+8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
+5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
+AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
+Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
+VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
+RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
+uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
+zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
+ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
+3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
+iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
+wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
+UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
+M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
+97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
+FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
+IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
+0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
+GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
+bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
+QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
+Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
+3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
+yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
+C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
+klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
+zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
+Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
+X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
+5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
+woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
+njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
+yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
+hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
+BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
+ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
+hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
+tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
+E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
+fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
+CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
+EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
+gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
+9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
+oD8ElPP+m/v6iA==
+=70vD
+-----END PGP PUBLIC KEY BLOCK-----

ebtables-config

@@ -0,0 +1,11 @@
+# Save current firewall rules on stop.
+#   Value: yes|no,  default: no
+# Saves all firewall rules if firewall gets stopped
+# (e.g. on system shutdown).
+EBTABLES_SAVE_ON_STOP="no"
+
+# Save (and restore) rule counters.
+#   Value: yes|no,  default: no
+# Save rule counters when saving a kernel table to a file. If the
+# rule counters were saved, they will be restored when restoring the table.
+EBTABLES_SAVE_COUNTER="no"

ebtables-helper

@@ -0,0 +1,102 @@
+#!/bin/bash
+
+# compat for removed initscripts dependency
+
+success() {
+       echo "[  OK  ]"
+       return 0
+}
+
+failure() {
+       echo "[FAILED]"
+       return 1
+}
+
+# internal variables
+EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
+EBTABLES_DATA=/etc/sysconfig/ebtables
+EBTABLES_TABLES="broute filter nat"
+VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
+
+# ebtables-config defaults
+EBTABLES_SAVE_ON_STOP="no"
+EBTABLES_SAVE_ON_RESTART="no"
+EBTABLES_SAVE_COUNTER="no"
+
+# load config if existing
+[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
+
+initialize() {
+	local ret=0
+	for table in $EBTABLES_TABLES; do
+		ebtables -t $table --init-table || ret=1
+	done
+	return $ret
+}
+
+sanitize_dump() {
+	local drop=false
+
+	export EBTABLES_TABLES
+
+	cat $1 | while read line; do
+		case $line in
+		\**)
+			drop=false
+			local table="${line#\*}"
+			local found=false
+			for t in $EBTABLES_TABLES; do
+				if [[ $t == $table ]]; then
+					found=true
+					break
+				fi
+			done
+			$found || drop=true
+			;;
+		esac
+		$drop || echo "$line"
+	done
+}
+
+start() {
+	if [ -f $EBTABLES_DATA ]; then
+		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
+		sanitize_dump $EBTABLES_DATA | ebtables-restore
+	else
+		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
+		initialize
+	fi
+	local ret=$?
+	touch $VAR_SUBSYS_EBTABLES
+	return $ret
+}
+
+save() {
+	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
+	export EBTABLES_SAVE_COUNTER
+	ebtables-save >$EBTABLES_DATA && success || failure
+}
+
+case $1 in
+	start)
+		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
+		start && success || failure
+		RETVAL=$?
+		;;
+	stop)
+		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
+		echo -n $"ebtables: stopping firewall: "
+		initialize && success || failure
+		RETVAL=$?
+		rm -f $VAR_SUBSYS_EBTABLES
+		;;
+	save)
+		save
+		;;
+	*)
+		echo "usage: ${0##*/} {start|stop|save}" >&2
+		RETVAL=2
+		;;
+esac
+
+exit $RETVAL

ebtables.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Ethernet Bridge Filtering tables
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/ebtables-helper start
+ExecStop=/usr/libexec/ebtables-helper stop
+
+[Install]
+WantedBy=multi-user.target

iptables-1.6.0-iptables-apply_mktemp.patch

@@ -1,21 +0,0 @@
-diff -up iptables-1.6.0/iptables/iptables-apply.iptables-apply_mktemp iptables-1.6.0/iptables/iptables-apply
---- iptables-1.6.0/iptables/iptables-apply.iptables-apply_mktemp	2015-12-09 13:55:06.000000000 +0100
-+++ iptables-1.6.0/iptables/iptables-apply	2016-04-13 17:44:07.130453958 +0200
-@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
- 	exit 2
- fi
- 
--COMMANDS=(tempfile "$SAVE" "$RESTORE")
-+COMMANDS=(mktemp "$SAVE" "$RESTORE")
- 
- for cmd in "${COMMANDS[@]}"; do
- 	if ! command -v $cmd >/dev/null; then
-@@ -122,7 +122,7 @@ done
- 
- umask 0700
- 
--TMPFILE=$(tempfile -p iptap)
-+TMPFILE=$(mktemp)
- trap "rm -f $TMPFILE" EXIT 1 2 3 4 5 6 7 8 10 11 12 13 14 15
- 
- if ! "$SAVE" >"$TMPFILE"; then

iptables-1.8.11-command-options-fix.patch

@@ -0,0 +1,27 @@
+commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Wed Apr 23 12:36:13 2025 +0200
+
+    xshared: Accept an option if any given command allows it
+    
+    Fixed commit made option checking overly strict: Some commands may be
+    commbined (foremost --list and --zero), reject a given option only if it
+    is not allowed by any of the given commands.
+    
+    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
+    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index cdfd11ab..fc61e0fd 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
+ 	 */
+ 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
+ 		if ((options & optval) &&
+-		    (options_v_commands[i] & command) != command)
++		    !(options_v_commands[i] & command))
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Illegal option `%s' with this command",
+ 				      ops->option_name(optval));

iptables-1.8.11-fix-interface-comparisons.patch

@@ -0,0 +1,172 @@
+From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Mon, 18 Nov 2024 13:56:50 +0000
+Subject: nft: fix interface comparisons in `-C` commands
+
+Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
+kernel") removed code which explicitly set interface masks to all ones.  The
+result of this is that they are zero.  However, they are used to mask interfaces
+in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
+comparisons are always true, and check commands which ought to fail succeed:
+
+  # iptables -N test
+  # iptables -A test -i lo \! -o lo -j REJECT
+  # iptables -v -L test
+  Chain test (0 references)
+   pkts bytes target     prot opt in     out     source               destination
+      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
+  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
+  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
+
+Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
+
+Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ iptables/nft-arp.c                                 | 10 ++----
+ iptables/nft-ipv4.c                                |  4 +--
+ iptables/nft-ipv6.c                                |  6 +---
+ iptables/nft-shared.c                              | 36 +++++-----------------
+ iptables/nft-shared.h                              |  6 +---
+ .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
+ 6 files changed, 22 insertions(+), 49 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 264864c3..c11d64c3 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
+ 		return false;
+ 	}
+ 
+-	return is_same_interfaces(a->arp.iniface,
+-				  a->arp.outiface,
+-				  (unsigned char *)a->arp.iniface_mask,
+-				  (unsigned char *)a->arp.outiface_mask,
+-				  b->arp.iniface,
+-				  b->arp.outiface,
+-				  (unsigned char *)b->arp.iniface_mask,
+-				  (unsigned char *)b->arp.outiface_mask);
++	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
++				  b->arp.iniface, b->arp.outiface);
+ }
+ 
+ static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index 74092875..0c8bd291 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
+-				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
+-				  b->fw.ip.iniface, b->fw.ip.outiface,
+-				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
++				  b->fw.ip.iniface, b->fw.ip.outiface);
+ }
+ 
+ static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index b184f8af..4dbb2af2 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
+-				  a->fw6.ipv6.iniface_mask,
+-				  a->fw6.ipv6.outiface_mask,
+-				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
+-				  b->fw6.ipv6.iniface_mask,
+-				  b->fw6.ipv6.outiface_mask);
++				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
+ }
+ 
+ static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 6775578b..2c29e68f 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
+ }
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask)
++			const char *b_iniface, const char *b_outiface)
+ {
+-	int i;
+-
+-	for (i = 0; i < IFNAMSIZ; i++) {
+-		if (a_iniface_mask[i] != b_iniface_mask[i]) {
+-			DEBUGP("different iniface mask %x, %x (%d)\n",
+-			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
+-			return false;
+-		}
+-		if ((a_iniface[i] & a_iniface_mask[i])
+-		    != (b_iniface[i] & b_iniface_mask[i])) {
+-			DEBUGP("different iniface\n");
+-			return false;
+-		}
+-		if (a_outiface_mask[i] != b_outiface_mask[i]) {
+-			DEBUGP("different outiface mask\n");
+-			return false;
+-		}
+-		if ((a_outiface[i] & a_outiface_mask[i])
+-		    != (b_outiface[i] & b_outiface_mask[i])) {
+-			DEBUGP("different outiface\n");
+-			return false;
+-		}
++	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
++		DEBUGP("different iniface\n");
++		return false;
++	}
++	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
++		DEBUGP("different outiface\n");
++		return false;
+ 	}
+-
+ 	return true;
+ }
+ 
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 51d1e460..b57aee1f 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
+ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask);
++			const char *b_iniface, const char *b_outiface);
+ 
+ void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+new file mode 100755
+index 00000000..278cd648
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+@@ -0,0 +1,9 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++
++$XT_MULTI iptables -N test
++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
++
++exit 0
+-- 
+cgit v1.2.3
+

iptables.init

@@ -18,8 +18,22 @@
 # Description: Start, stop and save iptables firewall
 ### END INIT INFO
 
-# Source function library.
-. /etc/init.d/functions
+# compat for removed initscripts dependency
+
+success() {
+	echo -n "[  OK  ]"
+	return 0
+}
+
+warning() {
+	echo -n "[WARNING]"
+	return 1
+}
+
+failure() {
+	echo -n "[FAILED]"
+	return 1
+}
 
 IPTABLES=iptables
 IPTABLES_DATA=/etc/sysconfig/$IPTABLES
@@ -41,11 +55,6 @@ if [ ! -x /sbin/$IPTABLES ]; then
     exit 5
 fi
 
-# Old or new modutils
-/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
-    && NEW_MODUTILS=1 \
-    || NEW_MODUTILS=0
-
 # Default firewall configuration:
 IPTABLES_MODULES=""
 IPTABLES_SAVE_ON_STOP="no"
@@ -61,13 +70,33 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000
 # Load firewall configuration.
 [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
 
+is_iptables_nft() {
+	iptables --version | grep -q '(nf_tables)'
+}
+
+netfilter_active() {
+	is_iptables_nft && return 0
+	[ -e "$PROC_IPTABLES_NAMES" ]
+}
+
+netfilter_tables() {
+	netfilter_active || return 1
+	is_iptables_nft && {
+		# explicitly omit security table from this list as
+		# it should be reserved for SELinux use
+		echo "raw mangle filter nat"
+		return 0
+	}
+	cat "$PROC_IPTABLES_NAMES" 2>/dev/null
+}
+
 # Get active tables
-NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+NF_TABLES=$(netfilter_tables)
 
 
 flush_n_delete() {
     # Flush firewall rules and delete chains.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
     [ -z "$NF_TABLES" ] && return 1
@@ -99,10 +128,10 @@ set_policy() {
     policy=$1
 
     # Check if iptable module is loaded
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
-    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+    tables=$(netfilter_tables)
     [ -z "$tables" ] && return 1
 
     echo -n $"${IPTABLES}: Setting chains to policy $policy: "
@@ -152,7 +181,7 @@ load_sysctl() {
         echo -n $"Loading sysctl settings: "
         ret=0
         for item in $IPTABLES_SYSCTL_LOAD_LIST; do
-            fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
+            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
             let ret+=$?;
         done
         [ $ret -eq 0 ] && success || failure
@@ -203,7 +232,7 @@ start() {
 	    return 1
 	fi
     fi
-    
+ 
     # Load additional modules (helpers)
     if [ -n "$IPTABLES_MODULES" ]; then
 	echo -n $"${IPTABLES}: Loading additional modules: "
@@ -216,7 +245,7 @@ start() {
 	[ $ret -eq 0 ] && success || failure
 	echo
     fi
-    
+ 
     # Load sysctl settings
     load_sysctl
 
@@ -226,7 +255,7 @@ start() {
 
 stop() {
     # Do not stop if iptables module is not loaded.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Set default chain policy to ACCEPT, in order to not break shutdown
     # on systems where the default policy is DROP and root device is
@@ -234,14 +263,14 @@ stop() {
     set_policy ACCEPT
     # And then, flush the rules and delete chains
     flush_n_delete
-    
+
     rm -f $VAR_SUBSYS_IPTABLES
     return $ret
 }
 
 save() {
     # Check if iptable module is loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
 	return 0
     fi
@@ -284,7 +313,7 @@ save() {
 }
 
 status() {
-    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
 	echo $"${IPTABLES}: Firewall is not running."
 	return 3
     fi
@@ -292,7 +321,7 @@ status() {
     # Do not print status if lockfile is missing and iptables modules are not 
     # loaded.
     # Check if iptable modules are loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo $"${IPTABLES}: Firewall modules are not loaded."
 	return 3
     fi
@@ -305,7 +334,7 @@ status() {
 
     NUM=
     [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
-    VERBOSE= 
+    VERBOSE=
     [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
     COUNT=
     [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

iptables.service

@@ -1,7 +1,8 @@
 [Unit]
 Description=IPv4 firewall with iptables
-After=syslog.target
 AssertPathExists=/etc/sysconfig/iptables
+Before=network-pre.target
+Wants=network-pre.target
 
 [Service]
 Type=oneshot
@@ -11,8 +12,6 @@ ExecReload=/usr/libexec/iptables/iptables.init reload
 ExecStop=/usr/libexec/iptables/iptables.init stop
 Environment=BOOTUP=serial
 Environment=CONSOLETYPE=serial
-StandardOutput=syslog
-StandardError=syslog
 
 [Install]
-WantedBy=basic.target
+WantedBy=multi-user.target

iptables.spec

@@ -4,86 +4,146 @@
 # service legacy actions (RHBZ#748134)
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 
+%global iptc_so_ver  0
+%global ipXtc_so_ver 2
+
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
-Version: 1.6.2
-Release: 3%{?dist}
-Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2
-Source1: iptables.init
-Source2: iptables-config
-Source3: iptables.service
-Source4: sysconfig_iptables
-Source5: sysconfig_ip6tables
-Patch1: iptables-1.6.0-iptables-apply_mktemp.patch
-URL: http://www.netfilter.org/
+URL: https://www.netfilter.org/projects/iptables
+Version: 1.8.11
+Release: 12%{?dist}
+Source0: %{url}/files/%{name}-%{version}.tar.xz
+source1: %{url}/files/%{name}-%{version}.tar.xz.sig
+Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
+Source3: iptables.init
+Source4: iptables-config
+Source5: iptables.service
+Source6: sysconfig_iptables
+Source7: sysconfig_ip6tables
+Source8: arptables-helper
+Source9: arptables.service
+Source10: ebtables.service
+Source11: ebtables-helper
+Source12: ebtables-config
+# Patch to fix -C handling, already upstream
+# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
+Patch1: iptables-1.8.11-fix-interface-comparisons.patch
+# Patch to fix overly strict command option checking
+# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
+Patch2: iptables-1.8.11-command-options-fix.patch
+
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
-License: GPLv2 and Artistic Licence 2.0 and ISC
+License: GPL-2.0-only AND Artistic-2.0 AND ISC
 
 # libnetfilter_conntrack is needed for xt_connlabel
 BuildRequires: pkgconfig(libnetfilter_conntrack)
-# libnfnetlink-devel is requires for nfnl_osf
+# libnfnetlink-devel is required for nfnl_osf
 BuildRequires: pkgconfig(libnfnetlink)
 BuildRequires: libselinux-devel
 BuildRequires: kernel-headers
 BuildRequires: systemd
-BuildRequires: pkgconfig(libnftnl)
-BuildRequires: pkgconfig(libmnl) >= 1.0
 # libmnl, libnftnl, bison, flex for nftables
 BuildRequires: bison
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: pkgconfig(libmnl) >= 1.0
-BuildRequires: pkgconfig(libnftnl) >= 1.0.5
+BuildRequires: pkgconfig(libnftnl) >= 1.2.6
 # libpcap-devel for nfbpf_compile
 BuildRequires: libpcap-devel
-Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-%if 0%{?fedora} > 24
-Conflicts: setup < 2.10.4-1
-%endif
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: libtool
+BuildRequires: make
+BuildRequires: gnupg2
 
 %description
 The iptables utility controls the network packet filtering code in the
 Linux kernel. If you need to set up firewalls and/or IP masquerading,
 you should install this package.
 
+%package legacy
+Summary: Legacy tools for managing Linux kernel packet filtering capabilities
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Conflicts: setup < 2.10.4-1
+Conflicts: alternatives < 1.32-1
+Requires(post): /usr/sbin/update-alternatives
+Requires(postun): /usr/sbin/update-alternatives
+%if 0%{?rhel} < 9
+Provides:	iptables
+%endif
+Provides:  %{name}-compat = %{version}-%{release}
+Obsoletes: %{name}-compat < 1.8.9-7
+
+%sbin_merge_compat %{_prefix}/sbin/iptables
+
+%description legacy
+The iptables utility controls the network packet filtering code in the
+Linux kernel. This package contains the legacy tools which are obsoleted by
+nft-variants in iptables-nft package for backwards compatibility reasons.
+If you need to set up firewalls and/or IP masquerading, you should not install
+this package but either nftables or iptables-nft instead.
+
 %package libs
-Summary: iptables libraries
-Group: System Environment/Base
+Summary: libxtables and iptables extensions userspace support
 
 %description libs
+libxtables and associated shared object files
+
+Libxtables provides unified access to iptables extensions in userspace. Data
+and logic for those is kept in per-extension shared object files.
+
+%package legacy-libs
+Summary: iptables legacy libraries
+
+%description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real so version.
-
-For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real
+so version. For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
-
 %package devel
 Summary: Development package for iptables
-Group: System Environment/Base
-Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+# XXX: Drop this after two releases or so
+Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %description devel
-iptables development headers and libraries.
+libxtables development headers and pkgconfig files
+
+%package legacy-devel
+Summary: Development package for legacy iptables
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: pkgconfig
+
+%description legacy-devel
+Legacy iptables development headers and pkgconfig files
 
 The iptc libraries are marked as not public by upstream. The interface is not
 stable and may change with every new version. It is therefore unsupported.
 
 %package services
 Summary: iptables and ip6tables services for iptables
-Group: System Environment/Base
 Requires: %{name} = %{version}-%{release}
-Requires(post): systemd
-Requires(preun): systemd
-Requires(postun): systemd
+Requires: %{name}-utils = %{version}-%{release}
+%{?systemd_ordering}
 # obsolete old main package
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
+# Look at me, I'm the new arptables-services now!
+Conflicts: %{name}-nft < 1.8.11-5
+Obsoletes: arptables-services < 0.0.5-16
+Provides: arptables-services = %{version}-%{release}
+# Look at me, I'm the new ebtables-services now!
+# (With epoch to turn our version number higher value)
+Obsoletes: ebtables-services < 2.0.11-20
+Provides: ebtables-services = 1:%{version}-%{release}
+BuildArch: noarch
 
 %description services
 iptables services for IPv4 and IPv6
@@ -92,28 +152,42 @@ This package provides the services iptables and ip6tables that have been split
 out of the base package since they are not active by default anymore.
 
 %package utils
-Summary: iptables and ip6tables services for iptables
-Group: System Environment/Base
+Summary: iptables and ip6tables misc utilities
 Requires: %{name} = %{version}-%{release}
 
 %description utils
-Utils for iptables.
+Utils for iptables
 
-Currently only provides nfnl_osf with the pf.os database.
+This package provides nfnl_osf with the pf.os database and nfbpf_compile,
+a bytecode generator for use with xt_bpf. Also included is iptables-apply,
+a safer way to update iptables remotely.
 
-%package compat
+%package nft
 Summary: nftables compatibility for iptables, arptables and ebtables
-Group: System Environment/Base
-Requires: %{name} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires(post): /usr/sbin/update-alternatives
+Requires(post): /usr/bin/readlink
+Requires(postun): /usr/sbin/update-alternatives
+Obsoletes: iptables-compat < 1.6.2-4
+Provides: arptables-helper
+Provides: iptables
+Provides: arptables
+Provides: ebtables
+# allowing old arptables-legacy will break when switching alternatives
+# due to the dropped arptables-helper symlink
+Conflicts: arptables-legacy < 0.0.5-16
 
-%description compat
+%sbin_merge_compat %{_prefix}/sbin/iptables
+
+%description nft
 nftables compatibility for iptables, arptables and ebtables.
 
 %prep
-%setup -q
-%patch1 -p1 -b .iptables-apply_mktemp
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+%autosetup -p1
 
 %build
+./autogen.sh
 CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
 %configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
 
@@ -123,38 +197,33 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
 rm -f include/linux/types.h
 
-make %{?_smp_mflags}
+%make_build
 
 %install
-make install DESTDIR=%{buildroot} 
+%make_install
 # remove la file(s)
-rm -f %{buildroot}/%{_libdir}/*.la
-
-# install ip*tables.h header files
-install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/
-install -d -m 755 %{buildroot}%{_includedir}/iptables
-install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/
-
-# install ipulog header file
-install -d -m 755 %{buildroot}%{_includedir}/libipulog/
-install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/
+rm -f %{buildroot}%{_libdir}/*.la
 
 # install init scripts and configuration files
 install -d -m 755 %{buildroot}%{script_path}
-install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
+install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
+install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
-install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
+install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
-install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables
-install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
+install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
+install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
+touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}
-sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service
+install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
+sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
 # install legacy actions for service command
@@ -177,121 +246,516 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic
 sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy
 install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic
 
-# install iptables-apply with man page
-install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/
-install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/
-
-%if 0%{?fedora} > 24
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
-%endif
 
-%if 0%{?rhel}
-%pre
-for p in %{_sysconfdir}/alternatives/{iptables,ip6tables}.*; do
-    if [ -h "$p" ]; then
-        ipt=$(readlink "$p")
-        echo "Removing alternatives for ${p##*/} with path $ipt"
-        %{_sbindir}/alternatives --remove "${p##*/}" "$ipt"
-    fi
+# prepare for alternatives
+touch %{buildroot}%{_mandir}/man8/arptables.8
+touch %{buildroot}%{_mandir}/man8/arptables-save.8
+touch %{buildroot}%{_mandir}/man8/arptables-restore.8
+touch %{buildroot}%{_mandir}/man8/ebtables.8
+rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+
+# fix absolute symlink
+ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
+
+%ldconfig_scriptlets
+
+%post legacy
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
+update-alternatives --install \
+	$pfx iptables $pfx-legacy 10 \
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
 done
 %endif
 
-%post -p /sbin/ldconfig
+%postun legacy
+if [ $1 -eq 0 ]; then
+	update-alternatives --remove \
+		iptables %{_sbindir}/iptables-legacy
+fi
 
-%postun -p /sbin/ldconfig
+# iptables-1.8.0-1 introduced the use of alternatives
+# when upgrading, its %postun script runs due to the package renaming
+# fix this by repeating the install into alternatives
+# also keep the old alternatives configuration to not change the system
+%triggerun legacy -- iptables > 1.8.0
+alternatives --list | awk '/^iptables/{print $3; exit}' \
+		>/var/tmp/alternatives.iptables.current
+cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
+
+%triggerpostun legacy -- iptables > 1.8.0
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
+update-alternatives --install \
+	$pfx iptables $pfx-legacy 10 \
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
+rm /var/tmp/alternatives.iptables.current
+mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
 
 %post services
+%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
+%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
-/sbin/ldconfig
+%?ldconfig
+%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
-%files
-%{!?_licensedir:%global license %%doc}
-%license COPYING
-%doc INCOMPATIBILITIES
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config
-%if 0%{?fedora} <= 24
-%{_sysconfdir}/ethertypes
+%post -e nft
+[[ %%{_excludedocs} == 1 ]] || do_man=true
+
+# remove non-symlinks in spots managed by alternatives
+# to cover for updates from not-yet-alternatived versions
+for pfx in %{_prefix}/sbin/{eb,arp}tables; do
+	for sfx in "" "-restore" "-save"; do
+		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+			rm -f $pfx$sfx
+		fi
+	done
+done
+for manpfx in %{_mandir}/man8/{eb,arp}tables; do
+	for sfx in {,-restore,-save}.8.gz; do
+		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
+			rm -f $manpfx$sfx
+		fi
+	done
+done
+
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
+update-alternatives --install \
+	$pfx iptables $pfx-nft 10 \
+	--follower $pfx6 ip6tables $pfx6-nft \
+	--follower $pfx-restore iptables-restore $pfx-nft-restore \
+	--follower $pfx-save iptables-save $pfx-nft-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-nft-save
+
+pfx=%{_sbindir}/ebtables
+manpfx=%{_mandir}/man8/ebtables
+update-alternatives --install \
+	$pfx ebtables $pfx-nft 10 \
+	--follower $pfx-save ebtables-save $pfx-nft-save \
+	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
+
+pfx=%{_sbindir}/arptables
+manpfx=%{_mandir}/man8/arptables
+update-alternatives --install \
+	$pfx arptables $pfx-nft 10 \
+	--follower $pfx-save arptables-save $pfx-nft-save \
+	--follower $pfx-restore arptables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
+	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
+	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
 %endif
-%{_sbindir}/iptables
-%{_sbindir}/iptables-apply
-%{_sbindir}/iptables-restore
-%{_sbindir}/iptables-save
-%{_sbindir}/ip6tables
-%{_sbindir}/ip6tables-restore
-%{_sbindir}/ip6tables-save
-%{_sbindir}/xtables-multi
-%{_sbindir}/nfbpf_compile
+
+%postun nft
+if [ $1 -eq 0 ]; then
+	for cmd in iptables ebtables arptables; do
+		update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
+	done
+fi
+
+%files legacy
+%{_sbindir}/ip{,6}tables-legacy*
+%{_sbindir}/xtables-legacy-multi
 %{_bindir}/iptables-xml
 %{_mandir}/man1/iptables-xml*
-%{_mandir}/man8/iptables*
-%{_mandir}/man8/ip6tables*
-%{_mandir}/man8/nfnl_osf*
-%dir %{_libdir}/xtables
-%{_libdir}/xtables/libarpt*
-%{_libdir}/xtables/libebt*
-%{_libdir}/xtables/libipt*
-%{_libdir}/xtables/libip6t*
-%{_libdir}/xtables/libxt*
+%{_mandir}/man8/xtables-legacy*
+%dir %{_datadir}/xtables
+%{_datadir}/xtables/iptables.xslt
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
-%{_libdir}/libip*tc.so.*
-%{_libdir}/libxtables.so.*
+%license COPYING
+%{_libdir}/libxtables.so.12*
+%dir %{_libdir}/xtables
+%{_libdir}/xtables/lib{ip,ip6,x}t*
+%{_mandir}/man8/ip{,6}tables.8.gz
+%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz
+
+%files legacy-libs
+%license COPYING
+%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
 
 %files devel
-%dir %{_includedir}/iptables
-%{_includedir}/iptables/*.h
-%{_includedir}/*.h
+%{_includedir}/xtables{,-version}.h
+%{_libdir}/libxtables.so
+%{_libdir}/pkgconfig/xtables.pc
+
+%files legacy-devel
 %dir %{_includedir}/libiptc
 %{_includedir}/libiptc/*.h
-%dir %{_includedir}/libipulog
-%{_includedir}/libipulog/*.h
 %{_libdir}/libip*tc.so
-%{_libdir}/libxtables.so
-%{_libdir}/pkgconfig/libiptc.pc
-%{_libdir}/pkgconfig/libip4tc.pc
-%{_libdir}/pkgconfig/libip6tc.pc
-%{_libdir}/pkgconfig/xtables.pc
+%{_libdir}/pkgconfig/libip{,4,6}tc.pc
 
 %files services
 %dir %{script_path}
-%{script_path}/iptables.init
-%{script_path}/ip6tables.init
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables
-%{_unitdir}/iptables.service
-%{_unitdir}/ip6tables.service
-%dir %{legacy_actions}/iptables
-%{legacy_actions}/iptables/save
-%{legacy_actions}/iptables/panic
-%dir %{legacy_actions}/ip6tables
-%{legacy_actions}/ip6tables/save
-%{legacy_actions}/ip6tables/panic
+%{script_path}/ip{,6}tables.init
+%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
+%config(noreplace) %{_sysconfdir}/sysconfig/arptables
+%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
+%ghost %{_sysconfdir}/sysconfig/ebtables
+%{_unitdir}/{arp,eb,ip,ip6}tables.service
+%dir %{legacy_actions}/ip{,6}tables
+%{legacy_actions}/ip{,6}tables/{save,panic}
+%{_libexecdir}/{arp,eb}tables-helper
 
 %files utils
+%license COPYING
 %{_sbindir}/nfnl_osf
+%{_sbindir}/nfbpf_compile
+%{_sbindir}/ip{,6}tables-apply
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/pf.os
+%{_mandir}/man8/nfnl_osf*
+%{_mandir}/man8/nfbpf_compile*
+%{_mandir}/man8/ip{,6}tables-apply*
+
+%files nft
+%{_sbindir}/ip{,6}tables-nft*
+%{_sbindir}/ip{,6}tables{,-restore}-translate
+%{_sbindir}/{eb,arp}tables-nft*
+%{_sbindir}/xtables-nft-multi
+%{_sbindir}/xtables-monitor
+%{_sbindir}/ebtables-translate
+%{_sbindir}/arptables-translate
+%dir %{_libdir}/xtables
+%{_libdir}/xtables/lib{arp,eb}t*
+%{_mandir}/man8/xtables-monitor*
+%{_mandir}/man8/xtables-translate*
+%{_mandir}/man8/*-nft*
+%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
+%{_mandir}/man8/ebtables-translate*
+%{_mandir}/man8/arptables-translate*
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
+%ghost %{_mandir}/man8/ebtables.8.gz
 
-%files compat
-%{_sbindir}/iptables-compat*
-%{_sbindir}/iptables-restore-translate
-%{_sbindir}/iptables-translate
-%{_sbindir}/ip6tables-compat*
-%{_sbindir}/ip6tables-restore-translate
-%{_sbindir}/ip6tables-translate
-%{_sbindir}/ebtables-compat*
-%{_sbindir}/arptables-compat
-%{_sbindir}/xtables-compat-multi
 
 %changelog
+* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
+- Pull in upstream fix for too strict command option parsing
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
+- Fix for ghost files not present in iptables-nft RPM
+
+* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
+- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
+  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
+
+* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
+- Revert last release, it breaks alternatives symlinks
+
+* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
+- Keep symlinks managed by alternatives under /usr/bin
+
+* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
+- Add patch to fix -C handling ( fixes rhbz#2360423 )
+
+* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
+- iptables-services to assimilate arptables- and ebtables-services
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
+- Keep symlinks managed by alternatives under /usr/sbin
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
+- new version
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-14
+- Add unmerged-sbin compat also for -legacy subpackage
+
+* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-13
+- Bump release and add changelog entry
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-12
+- Rebuilt for the bin-sbin merge
+
+* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-11
+- Add missing build dependency
+
+* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-10
+- Verify tarball GPG signature
+
+* Wed Jul 03 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-9
+- Backport fixes from upstream
+
+* Tue May 21 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-8
+- Make iptables-legacy own %%{_datadir}/xtables
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jan 11 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-5
+- Backport fixes from upstream
+- Fix flatpak build
+
+* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-4
+- The actual obsoletes fix
+
+* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-3
+- Fix compat sub-package obsoletion
+
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-2
+- Obsolete dropped compat package
+
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-1
+- New version 1.8.10
+- Drop compat sub-package
+
+* Tue Aug 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-6
+- Convert license to SPDX format
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
+- Backport fixes from upstream
+
+* Thu Apr 20 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-3
+- Support %%_excludedocs macro in alternatives installation
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Jan 12 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-1
+- Make iptables-xml a relative symlink
+- Drop not needed xtables.conf
+- Ship iptables.xslt with iptables-legacy package
+- Ship ebtables-translate tool with iptables-nft package
+- Update to 1.8.9.
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jul 08 2022 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.8-2
+- iptables-services requires iptables-apply in utils to apply rules
+
+* Fri May 13 2022 Phil Sutter <psutter@redhat.com> - 1.8.8-1
+- Update to 1.8.8. Fixes rhbz#2085503
+
+* Thu Mar 03 2022 Phil Sutter <psutter@redhat.com> - 1.8.7-16
+- Improve error messages for unsupported extensions
+- xshared: Fix response to unprivileged users
+- libxtables: Register only the highest revision extension
+- Ignore typical 'fedpkg local' results in .gitignore
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sat Nov 27 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-14
+- Rebuild for new libnftnl.
+
+* Thu Aug 05 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-13
+- doc: ebtables-nft.8: Adjust for missing atomic-options
+- nft: Fix for non-verbose check command
+- Build services sub-package as noarch
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jul 01 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-11
+- Fix performance restoring large rulesets
+- Review unit file
+
+* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-10
+- Backport fixes from upstream
+
+* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-9
+- Remove bashisms from arptables-nft-helper
+
+* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8
+- iptables.init: Fix functionality for iptables-nft
+- iptables.init: Ignore sysctl files not suffixed '.conf'
+- iptables.init: Drop unused NEW_MODUTILS check
+- iptables.init: Drop some trailing whitespace
+
+* Mon Mar 29 2021 Damian Wrobel <dwrobel@ertelnet.rybnik.pl> - 1.8.7-7
+- Add missing readlink required for iptables-nft(post)
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6
+- Restore alternatives configuration after upgrade
+- Fix license location
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-5
+- Fix upgrade path with package rename
+- Add missing dependencies to iptables-nft package
+
+* Tue Feb 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-4
+- Drop bootstrap code again
+- Drop workarounds for F24 and lower
+- Fix iptables-utils summary
+- Ship iptables-apply with iptables-utils
+- Reduce files sections by use of globbing
+- Ship common man pages with iptables-libs
+- Ship *-translate man pages with iptables-nft
+- Move legacy iptables binaries, libraries and headers into sub-packages
+- Introduce compat sub-package to help with above transitions
+- Drop libipulog header from devel package, this belongs to libnetfilter_log
+- Do not ship internal headers in devel package
+
+* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-3
+- ebtables: Exit gracefully on invalid table names
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-1
+- Update to 1.8.7. Fixes rhbz#1916948
+
+* Thu Nov 19 17:32:24 CET 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-5
+- Use make macros
+
+* Tue Nov 17 14:05:30 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-4
+- ebtables: Fix for broken chain renaming
+
+* Mon Nov 16 13:39:22 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-3
+- Drop obsolete StandardOutput setting from unit file
+- Remove StandardError setting from unit file, its value is default
+
+* Thu Nov  5 2020 Florian Weimer <fweimer@redhat.com> - 1.8.6-2
+- Remove build dependency on autogen
+
+* Sat Oct 31 2020 Kevin Fenzi <kevin@scrye.com> - 1.8.6-1
+- Update to 1.8.6. Fixes bug #1893453
+
+* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-3
+- nft: cache: Check consistency with NFT_CL_FAKE, too
+- nft: Fix command name in ip6tables error message
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 23 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-1
+- Rebase onto upstream version 1.8.5 plus two late fixes
+- Drop explicit iptables-apply installation, upstream fixed that
+- Ship ip6tables-apply along with iptables package
+
+* Wed Feb 12 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-7
+- Move nft-specific extensions into iptables-nft package
+- Move remaining extensions into iptables-libs package
+- Make iptables-nft depend on iptables-libs instead of iptables
+- Add upstream-suggested fixes
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jan 15 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-5
+- Raise Alternatives priority of nft variants to match legacy ones
+- Add Provides lines to allow for iptables-nft as full legacy alternative
+
+* Thu Dec 19 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-4
+- Drop leftover include in arptables-nft-helper
+
+* Fri Dec 13 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-3
+- Remove dependencies on initscripts package
+
+* Tue Dec 10 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-2
+- iptables-services requires /etc/init.d/functions
+
+* Wed Dec 04 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-1
+- New upstream version 1.8.4
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Tue Jun 25 2019 Björn Esser <besser82@fedoraproject.org> - 1.8.3-4
+- Disable bootstrapping
+
+* Tue Jun 25 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-3
+- Change URL to point at iptables project, not netfilter overview page
+- Reuse URL value in tarball source
+- Reduce globbing of library file names to expose future SONAME changes
+- Add bootstrapping for libip*tc SONAME bump
+
+* Tue Jun 25 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-2
+- Install new man page for nfbpf_compile utility
+- Move nfnl_osf man page to utils subpackage
+
+* Wed May 29 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-1
+- New upstream version 1.8.3
+
+* Mon Apr 15 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-1
+- New upstream version 1.8.2
+- Integrate ebtables and arptables save/restore scripts with alternatives
+- Add nft-specific ebtables and arptables man pages
+- Move /etc/sysconfig/ip*tables-config files into services sub-package
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Jan 23 2019 Bogdan Dobrelya <bdobreli@redhat.com> - 1.8.0-4
+- Use systemd_ordering macro
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Tue Jul 10 2018 Phil Sutter <psutter@redhat.com> - 1.8.0-2
+- Fix calling ebtables-nft and arptables-nft via their new names.
+
+* Mon Jul 09 2018 Phil Sutter <psutter@redhat.com> - 1.8.0-1
+- New upstream version 1.8.0.
+- Replace ldconfig calls with newly introduced macros.
+- Rename compat subpackage to iptables-nft to clarify its purpose.
+- Make use of Alternatives system.
+
 * Fri May 04 2018 Phil Sutter <psutter@redhat.com> - 1.6.2-3
 - Fix License: tag in spec-file
 - Fix separation into compat subpackage

sources

@@ -1 +1,2 @@
-SHA512 (iptables-1.6.2.tar.bz2) = 04f22e969c794246b9aa28055b202638081cfb0bb4a5625c049a30c48ac84cdd41db12a53c5831398cfe47c8f5691aa02b30b0ae3b5afe0f20ec48cf86a799c0
+SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
+SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2

tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh

@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 IPSET=testset6
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh

@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 TESTD=$PWD
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "source $TESTD/rules.in" 0 "read ruleset"

tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh

@@ -29,7 +29,6 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 prepare_page() {
@@ -42,7 +41,6 @@ prepare_page() {
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlLogInfo $(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
@@ -121,10 +119,14 @@ rlJournalStart
         rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
         rlRun "iptables -t raw -F"
         rlRun "ip6tables -t raw -F"
-        rlRun "rmmod nf_log_ipv4"
-        rlRun "rmmod nf_log_ipv6"
-        rlRun "rmmod nf_log_common"
-        rlRun "rmmod nfnetlink_log" 0,1
+        if rlTestVersion "$(uname -r)" "<" "4.6"; then
+            rlRun "rmmod nf_log_ipv4"
+            rlRun "rmmod nf_log_ipv6"
+            rlRun "rmmod nf_log_common"
+            rlRun "rmmod nfnetlink_log" 0,1
+	else
+            rlLogInfo "new kernel detected: skipping unloading modules"
+	fi
         rlLogInfo "restoring services"
         for svc in $SERVICES; do
             rlServiceRestore $svc

tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh

@@ -29,7 +29,6 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 CGNUM="15"
 CGNAME="15"
 CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
@@ -41,7 +40,6 @@ SKIP6=false
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel-$(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/initscript-sanity/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile

@@ -53,7 +53,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          iptables" >> $(METADATA)
-	@echo "Requires:        iptables bridge-utils ipset" >> $(METADATA)
+	@echo "Requires:        iptables iproute ipset" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2+" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh

@@ -29,16 +29,13 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ip6tables-save > ip6tables.backup"
         rlRun "iptables-save > iptables.backup"
-        rlRun "brctl addbr testbr" 0 "create bridge iface"
+        rlRun "ip link add dev testbr type bridge" 0 "create bridge iface"
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -75,7 +72,7 @@ rlJournalStart
         rlRun "ip6tables-restore < ip6tables.backup"
         rlRun "iptables-restore < iptables.backup"
         rlRun "ip link set down dev testbr"
-        rlRun "brctl delbr testbr" 0 "remove bridge iface"
+        rlRun "ip link del testbr" 0 "remove bridge iface"
         rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
         rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
         rlRun "popd"

tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "cp /etc/sysconfig/ip6tables ."

tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh

@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         for svc in $SERVICES; do

tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh

@@ -29,13 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 IPSET4="ipsetv4"
 IPSET6="ipsetv6"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ipset create $IPSET4 hash:ip"

tests/iptables-save-cuts-space-before-j/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlServiceStart iptables

tests/iptables-save-modprobe-option/runtest.sh

@@ -30,11 +30,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartTest
-        rlAssertRpm $PACKAGE
         rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
         rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
     rlPhaseEnd

tests/tests.yml

@@ -10,7 +10,6 @@
         - iptables-services # multiple tests need iptables/ip6tables config files
         - initscripts       # multiple tests need system command
         - libcgroup-tools   # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
-        - bridge-utils      # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
         - ipset             # multiple tests need ipset command
         - strace            # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
         - policycoreutils   # initscript-sanity needs restorecon command
@@ -21,7 +20,7 @@
   roles:
   - role: standard-test-rhts
     tests:
-    - backport-iptables-add-libxt-cgroup-frontend
+#    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by
@@ -43,7 +42,7 @@
   roles:
   - role: standard-test-beakerlib
     tests:
-    - backport-iptables-add-libxt-cgroup-frontend
+#    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by

tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd