- Pull in upstream fix for too strict command option parsing

upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281

	xshared: Accept an option if any given command allows it

	Fixed commit made option checking overly strict: Some commands may be
	commbined (foremost --list and --zero), reject a given option only if it
	is not allowed by any of the given commands.

.gitignore

@@ -1,3 +1,19 @@
+/.build-*.log
+/iptables-*.src.rpm
+/noarch/
+/x86_64/
+/iptables.spec.orig
 /iptables-1.6.2.tar.bz2
 /iptables-1.8.0.tar.bz2
 /iptables-1.8.2.tar.bz2
+/iptables-1.8.3.tar.bz2
+/iptables-1.8.4.tar.bz2
+/iptables-1.8.5.tar.bz2
+/iptables-1.8.6.tar.bz2
+/iptables-1.8.7.tar.bz2
+/iptables-1.8.8.tar.bz2
+/iptables-1.8.9.tar.xz
+/iptables-1.8.10.tar.xz
+/iptables-1.8.10.tar.xz.sig
+/iptables-1.8.11.tar.xz
+/iptables-1.8.11.tar.xz.sig

0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch

@@ -1,35 +0,0 @@
-From 1dba0d0a2c9c269dc5ed9e7d841b8ecb9dc060af Mon Sep 17 00:00:00 2001
-From: Phil Sutter <psutter@redhat.com>
-Date: Fri, 12 Apr 2019 18:02:19 +0200
-Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/iptables-apply | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/iptables-apply b/iptables/iptables-apply
-index 819ca4a459c42..a685b6bbcd7dc 100755
---- a/iptables/iptables-apply
-+++ b/iptables/iptables-apply
-@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
- 	exit 2
- fi
- 
--COMMANDS=(tempfile "$SAVE" "$RESTORE")
-+COMMANDS=(mktemp "$SAVE" "$RESTORE")
- 
- for cmd in "${COMMANDS[@]}"; do
- 	if ! command -v $cmd >/dev/null; then
-@@ -122,7 +122,7 @@ done
- 
- umask 0700
- 
--TMPFILE=$(tempfile -p iptap)
-+TMPFILE=$(mktemp)
- trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
- 		      FPE USR1 SEGV USR2 PIPE ALRM TERM
- 
--- 
-2.21.0
-

0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch

@@ -1,60 +0,0 @@
-From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
-Date: Wed, 14 Nov 2018 07:35:28 +0100
-Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-introduced support for gcc feature to check format string against passed
-argument.  This commit adds missing bits to extenstions's libipt_icmp.c
-and libip6t_icmp6.c that were causing build to fail.
-
-Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libip6t_icmp6.c | 4 ++--
- extensions/libipt_icmp.c   | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
-index 45a71875722c4..cc7bfaeb72fd7 100644
---- a/extensions/libip6t_icmp6.c
-+++ b/extensions/libip6t_icmp6.c
-@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 	type_name = icmp6_type_xlate(icmptype);
- 
- 	if (type_name) {
--		xt_xlate_add(xl, type_name);
-+		xt_xlate_add(xl, "%s", type_name);
- 	} else {
- 		for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
- 			if (icmpv6_codes[i].type == icmptype &&
-@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 				break;
- 
- 		if (i != ARRAY_SIZE(icmpv6_codes))
--			xt_xlate_add(xl, icmpv6_codes[i].name);
-+			xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
- 		else
- 			return 0;
- 	}
-diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
-index 5418997668d4c..e76257c54708c 100644
---- a/extensions/libipt_icmp.c
-+++ b/extensions/libipt_icmp.c
-@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 			if (icmp_codes[i].type == icmptype &&
- 			    icmp_codes[i].code_min == code_min &&
- 			    icmp_codes[i].code_max == code_max) {
--				xt_xlate_add(xl, icmp_codes[i].name);
-+				xt_xlate_add(xl, "%s", icmp_codes[i].name);
- 				return 1;
- 			}
- 	}
--- 
-2.21.0
-

0003-doc-Add-arptables-nft-man-pages.patch

@@ -1,486 +0,0 @@
-From 1d0089550ab9882ac90d0fc673f213c51e133552 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 13 Mar 2019 20:46:12 +0100
-Subject: [PATCH] doc: Add arptables-nft man pages
-
-These are 1:1 copies from legacy arptables repository.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 4dbb6b9118e32a9b748ead893106de59579424f5)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/Makefile.am             |   3 +
- iptables/arptables-nft-restore.8 |  41 ++++
- iptables/arptables-nft-save.8    |  37 ++++
- iptables/arptables-nft.8         | 352 +++++++++++++++++++++++++++++++
- 4 files changed, 433 insertions(+)
- create mode 100644 iptables/arptables-nft-restore.8
- create mode 100644 iptables/arptables-nft-save.8
- create mode 100644 iptables/arptables-nft.8
-
-diff --git a/iptables/Makefile.am b/iptables/Makefile.am
-index 581dc32ba846b..52309679d390c 100644
---- a/iptables/Makefile.am
-+++ b/iptables/Makefile.am
-@@ -63,6 +63,9 @@ man_MANS         = iptables.8 iptables-restore.8 iptables-save.8 \
-                    ip6tables-save.8 iptables-extensions.8 \
-                    xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
-                    xtables-monitor.8
-+if ENABLE_NFTABLES
-+man_MANS	+= arptables-nft.8 arptables-nft-restore.8 arptables-nft-save.8
-+endif
- CLEANFILES       = iptables.8 xtables-monitor.8 \
- 		   xtables-config-parser.c xtables-config-syntax.c
- 
-diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8
-new file mode 100644
-index 0000000000000..4f2f623673415
---- /dev/null
-+++ b/iptables/arptables-nft-restore.8
-@@ -0,0 +1,41 @@
-+.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" ""
-+.\"
-+.\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
-+.\" Man page written by Harald Welte <laforge@gnumonks.org>
-+.\" It is based on the iptables-restore man page.
-+.\"
-+.\"	This program is free software; you can redistribute it and/or modify
-+.\"	it under the terms of the GNU General Public License as published by
-+.\"	the Free Software Foundation; either version 2 of the License, or
-+.\"	(at your option) any later version.
-+.\"
-+.\"	This program is distributed in the hope that it will be useful,
-+.\"	but WITHOUT ANY WARRANTY; without even the implied warranty of
-+.\"	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+.\"	GNU General Public License for more details.
-+.\"
-+.\"	You should have received a copy of the GNU General Public License
-+.\"	along with this program; if not, write to the Free Software
-+.\"	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-+.\"
-+.\"
-+.SH NAME
-+arptables-restore \(em Restore ARP Tables
-+.SH SYNOPSIS
-+\fBarptables\-restore
-+.SH DESCRIPTION
-+.PP
-+.B arptables-restore
-+is used to restore ARP Tables from data specified on STDIN or
-+via a file as first argument.
-+Use I/O redirection provided by your shell to read from a file
-+.TP
-+.B arptables-restore
-+flushes (deletes) all previous contents of the respective ARP Table.
-+.SH BUGS
-+None known as of arptables-0.0.4 release
-+.SH AUTHOR
-+Jesper Dangaard Brouer <brouer@redhat.com>
-+.SH SEE ALSO
-+\fBarptables\-save\fP(8), \fBarptables\fP(8)
-+.PP
-diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8
-new file mode 100644
-index 0000000000000..34791a9c087f0
---- /dev/null
-+++ b/iptables/arptables-nft-save.8
-@@ -0,0 +1,37 @@
-+.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" ""
-+.\"
-+.\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
-+.\" Man page written by Harald Welte <laforge@gnumonks.org>
-+.\" It is based on the iptables-save man page.
-+.\"
-+.\"	This program is free software; you can redistribute it and/or modify
-+.\"	it under the terms of the GNU General Public License as published by
-+.\"	the Free Software Foundation; either version 2 of the License, or
-+.\"	(at your option) any later version.
-+.\"
-+.\"	This program is distributed in the hope that it will be useful,
-+.\"	but WITHOUT ANY WARRANTY; without even the implied warranty of
-+.\"	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+.\"	GNU General Public License for more details.
-+.\"
-+.\"	You should have received a copy of the GNU General Public License
-+.\"	along with this program; if not, write to the Free Software
-+.\"	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-+.\"
-+.\"
-+.SH NAME
-+arptables-save \(em dump arptables rules to stdout
-+.SH SYNOPSIS
-+\fBarptables\-save
-+.SH DESCRIPTION
-+.PP
-+.B arptables-save
-+is used to dump the contents of an ARP Table in easily parseable format
-+to STDOUT. Use I/O-redirection provided by your shell to write to a file.
-+.SH BUGS
-+None known as of arptables-0.0.4 release
-+.SH AUTHOR
-+Jesper Dangaard Brouer <brouer@redhat.com>
-+.SH SEE ALSO
-+\fBarptables\-restore\fP(8), \fBarptables\fP(8)
-+.PP
-diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8
-new file mode 100644
-index 0000000000000..3ce99e3757004
---- /dev/null
-+++ b/iptables/arptables-nft.8
-@@ -0,0 +1,352 @@
-+.TH ARPTABLES 8  "June 2018"
-+.\"
-+.\" Man page originally written by Jochen Friedrich <jochen@scram.de>,
-+.\" maintained by Bart De Schuymer.
-+.\" It is based on the iptables man page.
-+.\"
-+.\" Iptables page by Herve Eychenne March 2000.
-+.\"
-+.\"     This program is free software; you can redistribute it and/or modify
-+.\"     it under the terms of the GNU General Public License as published by
-+.\"     the Free Software Foundation; either version 2 of the License, or
-+.\"     (at your option) any later version.
-+.\"
-+.\"     This program is distributed in the hope that it will be useful,
-+.\"     but WITHOUT ANY WARRANTY; without even the implied warranty of
-+.\"     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+.\"     GNU General Public License for more details.
-+.\"
-+.\"     You should have received a copy of the GNU General Public License
-+.\"     along with this program; if not, write to the Free Software
-+.\"     Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-+.\"
-+.\"
-+.SH NAME
-+arptables \- ARP table administration (legacy)
-+.SH SYNOPSIS
-+.BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ]
-+.br
-+.BR "arptables " [ "-t table" ] " -" [ RI ] " chain rulenum rule-specification " [ options ]
-+.br
-+.BR "arptables " [ "-t table" ] " -D chain rulenum " [ options ]
-+.br
-+.BR "arptables " [ "-t table" ] " -" [ "LFZ" ] " " [ chain ] " " [ options ]
-+.br
-+.BR "arptables " [ "-t table" ] " -" [ "NX" ] " chain"
-+.br
-+.BR "arptables " [ "-t table" ] " -E old-chain-name new-chain-name"
-+.br
-+.BR "arptables " [ "-t table" ] " -P chain target " [ options ]
-+
-+.SH LEGACY
-+This tool uses the old xtables/setsockopt framework, and is a legacy version
-+of arptables. That means that a new, more modern tool exists with the same
-+functionality using the nf_tables framework and you are encouraged to migrate now.
-+The new binaries (formerly known as -compat) uses the same syntax and
-+semantics than this legacy one.
-+
-+You can still use this legacy tool. You should probably get some specific
-+information from your Linux distribution or vendor.
-+More docs are available at https://wiki.nftables.org
-+
-+.SH DESCRIPTION
-+.B arptables
-+is a user space tool, it is used to set up and maintain the
-+tables of ARP rules in the Linux kernel. These rules inspect
-+the ARP frames which they see.
-+.B arptables
-+is analogous to the
-+.B iptables
-+user space tool, but
-+.B arptables
-+is less complicated.
-+
-+.SS CHAINS
-+The kernel table is used to divide functionality into
-+different sets of rules. Each set of rules is called a chain.
-+Each chain is an ordered list of rules that can match ARP frames. If a
-+rule matches an ARP frame, then a processing specification tells
-+what to do with that matching frame. The processing specification is
-+called a 'target'. However, if the frame does not match the current
-+rule in the chain, then the next rule in the chain is examined and so forth.
-+The user can create new (user-defined) chains which can be used as the 'target' of a rule.
-+
-+.SS TARGETS
-+A firewall rule specifies criteria for an ARP frame and a frame
-+processing specification called a target.  When a frame matches a rule,
-+then the next action performed by the kernel is specified by the target.
-+The target can be one of these values:
-+.IR ACCEPT ,
-+.IR DROP ,
-+.IR CONTINUE ,
-+.IR RETURN ,
-+an 'extension' (see below) or a user-defined chain.
-+.PP
-+.I ACCEPT
-+means to let the frame through.
-+.I DROP
-+means the frame has to be dropped.
-+.I CONTINUE
-+means the next rule has to be checked. This can be handy to know how many
-+frames pass a certain point in the chain or to log those frames.
-+.I RETURN
-+means stop traversing this chain and resume at the next rule in the
-+previous (calling) chain.
-+For the extension targets please see the
-+.B "TARGET EXTENSIONS"
-+section of this man page.
-+.SS TABLES
-+There is only one ARP table in the Linux
-+kernel.  The table is
-+.BR filter.
-+You can drop the '-t filter' argument to the arptables command.
-+The -t argument must be the
-+first argument on the arptables command line, if used.
-+.TP
-+.B "-t, --table"
-+.br
-+.BR filter ,
-+is the only table and contains two (Linux kernels 2.4.X) or three (Linux kernels 2.6.0 and later) built-in chains:
-+.B INPUT 
-+(for frames destined for the host), 
-+.B OUTPUT 
-+(for locally-generated frames) and
-+.B FORWARD
-+(for frames being forwarded by the bridge code). The
-+.B FORWARD
-+chain doesn't exist in Linux 2.4.X kernels.
-+.br
-+.br
-+.SH ARPTABLES COMMAND LINE ARGUMENTS
-+After the initial arptables command line argument, the remaining
-+arguments can be divided into several different groups.  These groups
-+are commands, miscellaneous commands, rule-specifications, match-extensions,
-+and watcher-extensions.
-+.SS COMMANDS
-+The arptables command arguments specify the actions to perform on the table
-+defined with the -t argument.  If you do not use the -t argument to name
-+a table, the commands apply to the default filter table.
-+With the exception of the
-+.B "-Z"
-+command, only one command may be used on the command line at a time.
-+.TP
-+.B "-A, --append"
-+Append a rule to the end of the selected chain.
-+.TP
-+.B "-D, --delete"
-+Delete the specified rule from the selected chain. There are two ways to
-+use this command. The first is by specifying an interval of rule numbers
-+to delete, syntax: start_nr[:end_nr]. Using negative numbers is allowed, for more
-+details about using negative numbers, see the -I command. The second usage is by
-+specifying the complete rule as it would have been specified when it was added.
-+.TP
-+.B "-I, --insert"
-+Insert the specified rule into the selected chain at the specified rule number.
-+If the current number of rules equals N, then the specified number can be
-+between -N and N+1. For a positive number i, it holds that i and i-N-1 specify the
-+same place in the chain where the rule should be inserted. The number 0 specifies
-+the place past the last rule in the chain and using this number is therefore
-+equivalent with using the -A command.
-+.TP
-+.B "-R, --replace"
-+Replaces the specified rule into the selected chain at the specified rule number.
-+If the current number of rules equals N, then the specified number can be
-+between 1 and N. i specifies the place in the chain where the rule should be replaced.
-+.TP
-+.B "-P, --policy"
-+Set the policy for the chain to the given target. The policy can be
-+.BR ACCEPT ", " DROP " or " RETURN .
-+.TP
-+.B "-F, --flush"
-+Flush the selected chain. If no chain is selected, then every chain will be
-+flushed. Flushing the chain does not change the policy of the
-+chain, however.
-+.TP
-+.B "-Z, --zero"
-+Set the counters of the selected chain to zero. If no chain is selected, all the counters
-+are set to zero. The
-+.B "-Z"
-+command can be used in conjunction with the 
-+.B "-L"
-+command.
-+When both the
-+.B "-Z"
-+and
-+.B "-L"
-+commands are used together in this way, the rule counters are printed on the screen
-+before they are set to zero.
-+.TP
-+.B "-L, --list"
-+List all rules in the selected chain. If no chain is selected, all chains
-+are listed.
-+.TP
-+.B "-N, --new-chain"
-+Create a new user-defined chain with the given name. The number of
-+user-defined chains is unlimited. A user-defined chain name has maximum
-+length of 31 characters.
-+.TP
-+.B "-X, --delete-chain"
-+Delete the specified user-defined chain. There must be no remaining references
-+to the specified chain, otherwise
-+.B arptables
-+will refuse to delete it. If no chain is specified, all user-defined
-+chains that aren't referenced will be removed.
-+.TP
-+.B "-E, --rename-chain"
-+Rename the specified chain to a new name.  Besides renaming a user-defined
-+chain, you may rename a standard chain name to a name that suits your
-+taste. For example, if you like PREBRIDGING more than PREROUTING,
-+then you can use the -E command to rename the PREROUTING chain. If you do
-+rename one of the standard
-+.B arptables
-+chain names, please be sure to mention
-+this fact should you post a question on the
-+.B arptables
-+mailing lists.
-+It would be wise to use the standard name in your post. Renaming a standard
-+.B arptables
-+chain in this fashion has no effect on the structure or function
-+of the
-+.B arptables
-+kernel table.
-+
-+.SS MISCELLANOUS COMMANDS
-+.TP
-+.B "-V, --version"
-+Show the version of the arptables userspace program.
-+.TP
-+.B "-h, --help"
-+Give a brief description of the command syntax.
-+.TP
-+.BR "-j, --jump " "\fItarget\fP"
-+The target of the rule. This is one of the following values:
-+.BR ACCEPT ,
-+.BR DROP ,
-+.BR CONTINUE ,
-+.BR RETURN ,
-+a target extension (see
-+.BR "TARGET EXTENSIONS" ")"
-+or a user-defined chain name.
-+.TP
-+.BI "-c, --set-counters " "PKTS BYTES"
-+This enables the administrator to initialize the packet and byte
-+counters of a rule (during
-+.B INSERT,
-+.B APPEND,
-+.B REPLACE
-+operations).
-+
-+.SS RULE-SPECIFICATIONS
-+The following command line arguments make up a rule specification (as used 
-+in the add and delete commands). A "!" option before the specification 
-+inverts the test for that specification. Apart from these standard rule 
-+specifications there are some other command line arguments of interest.
-+.TP
-+.BR "-s, --source-ip " "[!] \fIaddress\fP[/\fImask]\fP"
-+The Source IP specification.
-+.TP 
-+.BR "-d, --destination-ip " "[!] \fIaddress\fP[/\fImask]\fP"
-+The Destination IP specification.
-+.TP 
-+.BR "--source-mac " "[!] \fIaddress\fP[/\fImask\fP]"
-+The source mac address. Both mask and address are written as 6 hexadecimal
-+numbers separated by colons.
-+.TP
-+.BR "--destination-mac " "[!] \fIaddress\fP[/\fImask\fP]"
-+The destination mac address. Both mask and address are written as 6 hexadecimal
-+numbers separated by colons.
-+.TP 
-+.BR "-i, --in-interface " "[!] \fIname\fP"
-+The interface via which a frame is received (for the
-+.BR INPUT " and " FORWARD
-+chains). The flag
-+.B --in-if
-+is an alias for this option.
-+.TP
-+.BR "-o, --out-interface " "[!] \fIname\fP"
-+The interface via which a frame is going to be sent (for the
-+.BR OUTPUT " and " FORWARD
-+chains). The flag
-+.B --out-if
-+is an alias for this option.
-+.TP
-+.BR "-l, --h-length " "\fIlength\fP[/\fImask\fP]"
-+The hardware length (nr of bytes)
-+.TP
-+.BR "--opcode " "\fIcode\fP[/\fImask\fP]
-+The operation code (2 bytes). Available values are:
-+.BR 1 = Request
-+.BR 2 = Reply
-+.BR 3 = Request_Reverse
-+.BR 4 = Reply_Reverse
-+.BR 5 = DRARP_Request
-+.BR 6 = DRARP_Reply
-+.BR 7 = DRARP_Error
-+.BR 8 = InARP_Request
-+.BR 9 = ARP_NAK .
-+.TP
-+.BR "--h-type " "\fItype\fP[/\fImask\fP]"
-+The hardware type (2 bytes, hexadecimal). Available values are:
-+.BR 1 = Ethernet .
-+.TP
-+.BR "--proto-type " "\fItype\fP[/\fImask\fP]"
-+The protocol type (2 bytes). Available values are:
-+.BR 0x800 = IPv4 .
-+
-+.SS TARGET-EXTENSIONS
-+.B arptables
-+extensions are precompiled into the userspace tool. So there is no need
-+to explicitly load them with a -m option like in
-+.BR iptables .
-+However, these
-+extensions deal with functionality supported by supplemental kernel modules.
-+.SS mangle
-+.TP
-+.BR "--mangle-ip-s IP address"
-+Mangles Source IP Address to given value.
-+.TP
-+.BR "--mangle-ip-d IP address"
-+Mangles Destination IP Address to given value.
-+.TP
-+.BR "--mangle-mac-s MAC address"
-+Mangles Source MAC Address to given value.
-+.TP
-+.BR "--mangle-mac-d MAC address"
-+Mangles Destination MAC Address to given value.
-+.TP
-+.BR "--mangle-target target "
-+Target of ARP mangle operation
-+.BR "" ( DROP ", " CONTINUE " or " ACCEPT " -- default is " ACCEPT ).
-+.SS CLASSIFY
-+This  module  allows you to set the skb->priority value (and thus clas-
-+sify the packet into a specific CBQ class).
-+
-+.TP
-+.BR "--set-class major:minor"
-+
-+Set the major and minor  class  value.  The  values  are  always
-+interpreted as hexadecimal even if no 0x prefix is given.
-+
-+.SS MARK
-+This  module  allows you to set the skb->mark value (and thus classify
-+the packet by the mark in u32)
-+
-+.TP
-+.BR "--set-mark mark"
-+Set the mark value. The  values  are  always
-+interpreted as hexadecimal even if no 0x prefix is given
-+
-+.TP
-+.BR "--and-mark mark"
-+Binary AND the mark with bits.
-+
-+.TP
-+.BR "--or-mark mark"
-+Binary OR the mark with bits.
-+
-+.SH MAILINGLISTS
-+.BR "" "See " http://netfilter.org/mailinglists.html
-+.SH SEE ALSO
-+.BR iptables "(8), " ebtables "(8), " arp "(8), " rarp "(8), " ifconfig "(8), " route (8)
-+.PP
-+.BR "" "See " http://ebtables.sf.net
--- 
-2.21.0
-

0004-doc-Adjust-arptables-man-pages.patch

@@ -1,192 +0,0 @@
-From 2efbd30ed9f1db90b32b556d0e3df16d05281bc7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 13 Mar 2019 20:46:13 +0100
-Subject: [PATCH] doc: Adjust arptables man pages
-
-Change content to suit the shipped nft-based variant. Most relevant
-changes:
-
-* FORWARD chain is not supported
-* arptables-nft-save supports a few parameters
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 1a0cd997d601794c7031346063b8b77f4af2a13e)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/arptables-nft-restore.8 |  6 ++--
- iptables/arptables-nft-save.8    | 20 +++++++++----
- iptables/arptables-nft.8         | 48 +++++++++++++++-----------------
- 3 files changed, 39 insertions(+), 35 deletions(-)
-
-diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8
-index 4f2f623673415..09d9082cf9fd3 100644
---- a/iptables/arptables-nft-restore.8
-+++ b/iptables/arptables-nft-restore.8
-@@ -1,4 +1,4 @@
--.TH ARPTABLES-RESTORE 8 "Nov 07, 2013" "" ""
-+.TH ARPTABLES-RESTORE 8 "March 2019" "" ""
- .\"
- .\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
- .\" Man page written by Harald Welte <laforge@gnumonks.org>
-@@ -20,7 +20,7 @@
- .\"
- .\"
- .SH NAME
--arptables-restore \(em Restore ARP Tables
-+arptables-restore \- Restore ARP Tables (nft-based)
- .SH SYNOPSIS
- \fBarptables\-restore
- .SH DESCRIPTION
-@@ -32,8 +32,6 @@ Use I/O redirection provided by your shell to read from a file
- .TP
- .B arptables-restore
- flushes (deletes) all previous contents of the respective ARP Table.
--.SH BUGS
--None known as of arptables-0.0.4 release
- .SH AUTHOR
- Jesper Dangaard Brouer <brouer@redhat.com>
- .SH SEE ALSO
-diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8
-index 34791a9c087f0..905e59854cc28 100644
---- a/iptables/arptables-nft-save.8
-+++ b/iptables/arptables-nft-save.8
-@@ -1,4 +1,4 @@
--.TH ARPTABLES-SAVE 8 "Nov 07, 2013" "" ""
-+.TH ARPTABLES-SAVE 8 "March 2019" "" ""
- .\"
- .\" Man page written by Jesper Dangaard Brouer <brouer@redhat.com> based on a
- .\" Man page written by Harald Welte <laforge@gnumonks.org>
-@@ -20,16 +20,26 @@
- .\"
- .\"
- .SH NAME
--arptables-save \(em dump arptables rules to stdout
-+arptables-save \- dump arptables rules to stdout (nft-based)
- .SH SYNOPSIS
--\fBarptables\-save
-+\fBarptables\-save\fP [\fB\-M\fP \fImodprobe\fP] [\fB\-c\fP]
-+.P
-+\fBarptables\-save\fP [\fB\-V\fP]
- .SH DESCRIPTION
- .PP
- .B arptables-save
- is used to dump the contents of an ARP Table in easily parseable format
- to STDOUT. Use I/O-redirection provided by your shell to write to a file.
--.SH BUGS
--None known as of arptables-0.0.4 release
-+.TP
-+\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP
-+Specify the path to the modprobe program. By default, arptables-save will
-+inspect /proc/sys/kernel/modprobe to determine the executable's path.
-+.TP
-+\fB\-c\fR, \fB\-\-counters\fR
-+Include the current values of all packet and byte counters in the output.
-+.TP
-+\fB\-V\fR, \fB\-\-version\fR
-+Print version information and exit.
- .SH AUTHOR
- Jesper Dangaard Brouer <brouer@redhat.com>
- .SH SEE ALSO
-diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8
-index 3ce99e3757004..ea31e0842acd4 100644
---- a/iptables/arptables-nft.8
-+++ b/iptables/arptables-nft.8
-@@ -1,4 +1,4 @@
--.TH ARPTABLES 8  "June 2018"
-+.TH ARPTABLES 8  "March 2019"
- .\"
- .\" Man page originally written by Jochen Friedrich <jochen@scram.de>,
- .\" maintained by Bart De Schuymer.
-@@ -22,7 +22,7 @@
- .\"
- .\"
- .SH NAME
--arptables \- ARP table administration (legacy)
-+arptables \- ARP table administration (nft-based)
- .SH SYNOPSIS
- .BR "arptables " [ "-t table" ] " -" [ AD ] " chain rule-specification " [ options ]
- .br
-@@ -38,17 +38,6 @@ arptables \- ARP table administration (legacy)
- .br
- .BR "arptables " [ "-t table" ] " -P chain target " [ options ]
- 
--.SH LEGACY
--This tool uses the old xtables/setsockopt framework, and is a legacy version
--of arptables. That means that a new, more modern tool exists with the same
--functionality using the nf_tables framework and you are encouraged to migrate now.
--The new binaries (formerly known as -compat) uses the same syntax and
--semantics than this legacy one.
--
--You can still use this legacy tool. You should probably get some specific
--information from your Linux distribution or vendor.
--More docs are available at https://wiki.nftables.org
--
- .SH DESCRIPTION
- .B arptables
- is a user space tool, it is used to set up and maintain the
-@@ -106,15 +95,11 @@ first argument on the arptables command line, if used.
- .B "-t, --table"
- .br
- .BR filter ,
--is the only table and contains two (Linux kernels 2.4.X) or three (Linux kernels 2.6.0 and later) built-in chains:
-+is the only table and contains two built-in chains:
- .B INPUT 
--(for frames destined for the host), 
-+(for frames destined for the host) and
- .B OUTPUT 
--(for locally-generated frames) and
--.B FORWARD
--(for frames being forwarded by the bridge code). The
--.B FORWARD
--chain doesn't exist in Linux 2.4.X kernels.
-+(for locally-generated frames).
- .br
- .br
- .SH ARPTABLES COMMAND LINE ARGUMENTS
-@@ -258,15 +243,15 @@ numbers separated by colons.
- .TP 
- .BR "-i, --in-interface " "[!] \fIname\fP"
- The interface via which a frame is received (for the
--.BR INPUT " and " FORWARD
--chains). The flag
-+.B INPUT
-+chain). The flag
- .B --in-if
- is an alias for this option.
- .TP
- .BR "-o, --out-interface " "[!] \fIname\fP"
- The interface via which a frame is going to be sent (for the
--.BR OUTPUT " and " FORWARD
--chains). The flag
-+.B OUTPUT
-+chain). The flag
- .B --out-if
- is an alias for this option.
- .TP
-@@ -344,9 +329,20 @@ Binary AND the mark with bits.
- .BR "--or-mark mark"
- Binary OR the mark with bits.
- 
-+.SH NOTES
-+In this nft-based version of
-+.BR arptables ,
-+support for
-+.B FORWARD
-+chain has not been implemented. Since ARP packets are "forwarded" only by Linux
-+bridges, the same may be achieved using
-+.B FORWARD
-+chain in
-+.BR ebtables .
-+
- .SH MAILINGLISTS
- .BR "" "See " http://netfilter.org/mailinglists.html
- .SH SEE ALSO
--.BR iptables "(8), " ebtables "(8), " arp "(8), " rarp "(8), " ifconfig "(8), " route (8)
-+.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip (8)
- .PP
--.BR "" "See " http://ebtables.sf.net
-+.BR "" "See " https://wiki.nftables.org
--- 
-2.21.0
-

0006-doc-Adjust-ebtables-man-page.patch

@@ -1,275 +0,0 @@
-From a3310b304ca75f45505b89071b1537a6fcc97228 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 13 Mar 2019 20:46:15 +0100
-Subject: [PATCH] doc: Adjust ebtables man page
-
-Change content to match nft-variant, most notably:
-
-* There is no broute table, drop all references to it
-* Comment out description of among and string matches, we don't support
-  them (yet)
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 1939cbc25e6f51cebaa7a2d71c45bb312bab8668)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/ebtables-nft.8 | 164 ++++++++++++++++------------------------
- 1 file changed, 67 insertions(+), 97 deletions(-)
-
-diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
-index 55204ab91e8a4..db8b2ab28cca5 100644
---- a/iptables/ebtables-nft.8
-+++ b/iptables/ebtables-nft.8
-@@ -24,7 +24,7 @@
- .\"     
- .\"
- .SH NAME
--ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legacy)
-+ebtables \- Ethernet bridge frame table administration (nft-based)
- .SH SYNOPSIS
- .BR "ebtables " [ -t " table ] " - [ ACDI "] chain rule specification [match extensions] [watcher extensions] target"
- .br
-@@ -51,17 +51,6 @@ ebtables-legacy (2.0.10.4@) \- Ethernet bridge frame table administration (legac
- .BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save
- .br
- 
--.SH LEGACY
--This tool uses the old xtables/setsockopt framework, and is a legacy version
--of ebtables. That means that a new, more modern tool exists with the same
--functionality using the nf_tables framework and you are encouraged to migrate now.
--The new binaries (known as ebtables-nft and formerly known as ebtables-compat)
--uses the same syntax and semantics than this legacy one.
--
--You can still use this legacy tool. You should probably get some specific
--information from your Linux distribution or vendor.
--More docs are available at https://wiki.nftables.org
--
- .SH DESCRIPTION
- .B ebtables
- is an application program used to set up and maintain the
-@@ -72,7 +61,7 @@ It is analogous to the
- application, but less complicated, due to the fact that the Ethernet protocol
- is much simpler than the IP protocol.
- .SS CHAINS
--There are three ebtables tables with built-in chains in the
-+There are two ebtables tables with built-in chains in the
- Linux kernel. These tables are used to divide functionality into
- different sets of rules. Each set of rules is called a chain.
- Each chain is an ordered list of rules that can match Ethernet frames. If a
-@@ -98,10 +87,7 @@ an 'extension' (see below) or a jump to a user-defined chain.
- .B ACCEPT
- means to let the frame through.
- .B DROP
--means the frame has to be dropped. In the
--.BR BROUTING " chain however, the " ACCEPT " and " DROP " target have different"
--meanings (see the info provided for the
--.BR -t " option)."
-+means the frame has to be dropped.
- .B CONTINUE
- means the next rule has to be checked. This can be handy, f.e., to know how many
- frames pass a certain point in the chain, to log those frames or to apply multiple
-@@ -113,14 +99,16 @@ For the extension targets please refer to the
- .B "TARGET EXTENSIONS"
- section of this man page.
- .SS TABLES
--As stated earlier, there are three ebtables tables in the Linux
-+As stated earlier, there are two ebtables tables in the Linux
- kernel.  The table names are
--.BR filter ", " nat " and " broute .
--Of these three tables,
-+.BR filter " and " nat .
-+Of these two tables,
- the filter table is the default table that the command operates on.
- If you are working with the filter table, then you can drop the '-t filter'
- argument to the ebtables command.  However, you will need to provide
--the -t argument for the other two tables.  Moreover, the -t argument must be the
-+the -t argument for
-+.B nat
-+table.  Moreover, the -t argument must be the
- first argument on the ebtables command line, if used. 
- .TP
- .B "-t, --table"
-@@ -149,25 +137,6 @@ iptables world to ebtables it is easier to have the same names. Note that you
- can change the name
- .BR "" ( -E )
- if you don't like the default.
--.br
--.br
--.B broute
--is used to make a brouter, it has one built-in chain:
--.BR BROUTING .
--The targets
--.BR DROP " and " ACCEPT
--have a special meaning in the broute table (these names are used instead of
--more descriptive names to keep the implementation generic).
--.B DROP
--actually means the frame has to be routed, while
--.B ACCEPT
--means the frame has to be bridged. The
--.B BROUTING
--chain is traversed very early. However, it is only traversed by frames entering on
--a bridge port that is in forwarding state. Normally those frames
--would be bridged, but you can decide otherwise here. The
--.B redirect
--target is very handy here.
- .SH EBTABLES COMMAND LINE ARGUMENTS
- After the initial ebtables '-t table' command line argument, the remaining
- arguments can be divided into several groups.  These groups
-@@ -553,35 +522,35 @@ If the 802.3 DSAP and SSAP values are 0xaa then the SNAP type field must
- be consulted to determine the payload protocol.  This is a two byte
- (hexadecimal) argument.  Only 802.3 frames with DSAP/SSAP 0xaa are
- checked for type.
--.SS among
--Match a MAC address or MAC/IP address pair versus a list of MAC addresses
--and MAC/IP address pairs.
--A list entry has the following format:
--.IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple"
--list entries are separated by a comma, specifying an IP address corresponding to
--the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address
--but different IP address (and vice versa) can be specified. If the MAC address doesn't
--match any entry from the list, the frame doesn't match the rule (unless "!" was used).
--.TP
--.BR "--among-dst " "[!] \fIlist\fP"
--Compare the MAC destination to the given list. If the Ethernet frame has type
--.IR IPv4 " or " ARP ,
--then comparison with MAC/IP destination address pairs from the
--list is possible.
--.TP
--.BR "--among-src " "[!] \fIlist\fP"
--Compare the MAC source to the given list. If the Ethernet frame has type
--.IR IPv4 " or " ARP ,
--then comparison with MAC/IP source address pairs from the list
--is possible.
--.TP
--.BR "--among-dst-file " "[!] \fIfile\fP"
--Same as
--.BR --among-dst " but the list is read in from the specified file."
--.TP
--.BR "--among-src-file " "[!] \fIfile\fP"
--Same as
--.BR --among-src " but the list is read in from the specified file."
-+.\" .SS among
-+.\" Match a MAC address or MAC/IP address pair versus a list of MAC addresses
-+.\" and MAC/IP address pairs.
-+.\" A list entry has the following format:
-+.\" .IR xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip][,] ". Multiple"
-+.\" list entries are separated by a comma, specifying an IP address corresponding to
-+.\" the MAC address is optional. Multiple MAC/IP address pairs with the same MAC address
-+.\" but different IP address (and vice versa) can be specified. If the MAC address doesn't
-+.\" match any entry from the list, the frame doesn't match the rule (unless "!" was used).
-+.\" .TP
-+.\" .BR "--among-dst " "[!] \fIlist\fP"
-+.\" Compare the MAC destination to the given list. If the Ethernet frame has type
-+.\" .IR IPv4 " or " ARP ,
-+.\" then comparison with MAC/IP destination address pairs from the
-+.\" list is possible.
-+.\" .TP
-+.\" .BR "--among-src " "[!] \fIlist\fP"
-+.\" Compare the MAC source to the given list. If the Ethernet frame has type
-+.\" .IR IPv4 " or " ARP ,
-+.\" then comparison with MAC/IP source address pairs from the list
-+.\" is possible.
-+.\" .TP
-+.\" .BR "--among-dst-file " "[!] \fIfile\fP"
-+.\" Same as
-+.\" .BR --among-dst " but the list is read in from the specified file."
-+.\" .TP
-+.\" .BR "--among-src-file " "[!] \fIfile\fP"
-+.\" Same as
-+.\" .BR --among-src " but the list is read in from the specified file."
- .SS arp
- Specify (R)ARP fields. The protocol must be specified as
- .IR ARP " or " RARP .
-@@ -822,26 +791,26 @@ The hello time timer (0-65535) range.
- .TP
- .BR "--stp-forward-delay " "[!] [\fIdelay\fP][:\fIdelay\fP]"
- The forward delay timer (0-65535) range.
--.SS string
--This module matches on a given string using some pattern matching strategy.
--.TP
--.BR "--string-algo " "\fIalgorithm\fP"
--The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
--.TP
--.BR "--string-from " "\fIoffset\fP"
--The lowest offset from which a match can start. (default: 0)
--.TP
--.BR "--string-to " "\fIoffset\fP"
--The highest offset from which a match can start. (default: size of frame)
--.TP
--.BR "--string " "[!] \fIpattern\fP"
--Matches the given pattern.
--.TP
--.BR "--string-hex " "[!] \fIpattern\fP"
--Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|'
--.TP
--.BR "--string-icase"
--Ignore case when searching.
-+.\" .SS string
-+.\" This module matches on a given string using some pattern matching strategy.
-+.\" .TP
-+.\" .BR "--string-algo " "\fIalgorithm\fP"
-+.\" The pattern matching strategy. (bm = Boyer-Moore, kmp = Knuth-Pratt-Morris)
-+.\" .TP
-+.\" .BR "--string-from " "\fIoffset\fP"
-+.\" The lowest offset from which a match can start. (default: 0)
-+.\" .TP
-+.\" .BR "--string-to " "\fIoffset\fP"
-+.\" The highest offset from which a match can start. (default: size of frame)
-+.\" .TP
-+.\" .BR "--string " "[!] \fIpattern\fP"
-+.\" Matches the given pattern.
-+.\" .TP
-+.\" .BR "--string-hex " "[!] \fIpattern\fP"
-+.\" Matches the given pattern in hex notation, e.g. '|0D 0A|', '|0D0A|', 'www|09|netfilter|03|org|00|'
-+.\" .TP
-+.\" .BR "--string-icase"
-+.\" Ignore case when searching.
- .SS vlan
- Specify 802.1Q Tag Control Information fields.
- The protocol must be specified as
-@@ -1026,7 +995,6 @@ The default target
- The
- .B dnat
- target can only be used in the
--.BR BROUTING " chain of the " broute " table and the "
- .BR PREROUTING " and " OUTPUT " chains of the " nat " table."
- It specifies that the destination MAC address has to be changed.
- .TP
-@@ -1089,11 +1057,8 @@ The
- .B redirect
- target will change the MAC target address to that of the bridge device the
- frame arrived on. This target can only be used in the
--.BR BROUTING " chain of the " broute " table and the "
- .BR PREROUTING " chain of the " nat " table."
--In the
--.BR BROUTING " chain, the MAC address of the bridge port is used as destination address,"
--.BR "" "in the " PREROUTING " chain, the MAC address of the bridge is used."
-+The MAC address of the bridge is used as destination address."
- .TP
- .BR "--redirect-target " "\fItarget\fP"
- .br
-@@ -1135,12 +1100,17 @@ arp message and the hardware address length in the arp header is 6 bytes.
- .br
- .SH FILES
- .I /etc/ethertypes
--.I /var/lib/ebtables/lock
- .SH ENVIRONMENT VARIABLES
- .I EBTABLES_ATOMIC_FILE
- .SH MAILINGLISTS
- .BR "" "See " http://netfilter.org/mailinglists.html
-+.SH BUGS
-+The version of ebtables this man page ships with does not support the
-+.B broute
-+table. Also there is no support for
-+.BR among " and " string
-+matches. And finally, this list is probably not complete.
- .SH SEE ALSO
--.BR iptables "(8), " brctl "(8), " ifconfig "(8), " route (8)
-+.BR xtables-nft "(8), " iptables "(8), " ip (8)
- .PP
--.BR "" "See " http://ebtables.sf.net
-+.BR "" "See " https://wiki.nftables.org
--- 
-2.21.0
-

arptables-helper

@@ -1,11 +1,19 @@
 #!/bin/sh
-# config: /etc/sysconfig/arptables
-
-# Source 'em up
-. /etc/init.d/functions
 
 ARPTABLES_CONFIG=/etc/sysconfig/arptables
 
+# compat for removed initscripts dependency
+
+success() {
+	echo "[  OK  ]"
+	return 0
+}
+
+failure() {
+	echo "[FAILED]"
+	return 1
+}
+
 start() {
 	if [ ! -x /usr/sbin/arptables ]; then
 		exit 4
@@ -13,31 +21,28 @@ start() {
 
 	# don't do squat if we don't have the config file
 	if [ -f $ARPTABLES_CONFIG ]; then
-		echo -n $"Applying arptables firewall rules: "
+		printf "Applying arptables firewall rules: "
 		/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
 			success || \
 			failure
-		echo
 		touch /var/lock/subsys/arptables
 	else
 		failure
-		echo
-		echo $"Configuration file /etc/sysconfig/arptables missing"
+		echo "Configuration file /etc/sysconfig/arptables missing"
 		exit 6
 	fi
 }
 
 stop() {
-	echo -n $"Removing user defined chains:"
+	printf "Removing user defined chains: "
 	arptables -X && success || failure
-	echo -n $"Flushing all chains:"
+	printf "Flushing all chains: "
 	arptables -F && success || failure
-	echo -n $"Resetting built-in chains to the default ACCEPT policy:"
+	printf "Resetting built-in chains to the default ACCEPT policy: "
 	arptables -P INPUT ACCEPT && \
 		arptables -P OUTPUT ACCEPT && \
 		success || \
 		failure
-	echo
 	rm -f /var/lock/subsys/arptables
 }
 

arptables.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Automates a packet filtering firewall with arptables
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/arptables-helper start
+ExecStop=/usr/libexec/arptables-helper stop
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

coreteam-gpg-key-0xD70D1A666ACF2B21.txt

@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
+o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
+2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
+nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
+P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
+qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
+5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
+ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
+u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
+/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
+cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
+tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
+VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
+CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
+LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
+8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
+5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
+AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
+Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
+VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
+RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
+uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
+zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
+ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
+3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
+iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
+wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
+UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
+M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
+97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
+FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
+IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
+0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
+GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
+bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
+QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
+Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
+3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
+yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
+C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
+klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
+zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
+Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
+X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
+5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
+woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
+njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
+yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
+hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
+BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
+ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
+hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
+tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
+E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
+fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
+CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
+EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
+gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
+9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
+oD8ElPP+m/v6iA==
+=70vD
+-----END PGP PUBLIC KEY BLOCK-----

ebtables-config

@@ -0,0 +1,11 @@
+# Save current firewall rules on stop.
+#   Value: yes|no,  default: no
+# Saves all firewall rules if firewall gets stopped
+# (e.g. on system shutdown).
+EBTABLES_SAVE_ON_STOP="no"
+
+# Save (and restore) rule counters.
+#   Value: yes|no,  default: no
+# Save rule counters when saving a kernel table to a file. If the
+# rule counters were saved, they will be restored when restoring the table.
+EBTABLES_SAVE_COUNTER="no"

ebtables-helper

@@ -0,0 +1,102 @@
+#!/bin/bash
+
+# compat for removed initscripts dependency
+
+success() {
+       echo "[  OK  ]"
+       return 0
+}
+
+failure() {
+       echo "[FAILED]"
+       return 1
+}
+
+# internal variables
+EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
+EBTABLES_DATA=/etc/sysconfig/ebtables
+EBTABLES_TABLES="broute filter nat"
+VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
+
+# ebtables-config defaults
+EBTABLES_SAVE_ON_STOP="no"
+EBTABLES_SAVE_ON_RESTART="no"
+EBTABLES_SAVE_COUNTER="no"
+
+# load config if existing
+[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
+
+initialize() {
+	local ret=0
+	for table in $EBTABLES_TABLES; do
+		ebtables -t $table --init-table || ret=1
+	done
+	return $ret
+}
+
+sanitize_dump() {
+	local drop=false
+
+	export EBTABLES_TABLES
+
+	cat $1 | while read line; do
+		case $line in
+		\**)
+			drop=false
+			local table="${line#\*}"
+			local found=false
+			for t in $EBTABLES_TABLES; do
+				if [[ $t == $table ]]; then
+					found=true
+					break
+				fi
+			done
+			$found || drop=true
+			;;
+		esac
+		$drop || echo "$line"
+	done
+}
+
+start() {
+	if [ -f $EBTABLES_DATA ]; then
+		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
+		sanitize_dump $EBTABLES_DATA | ebtables-restore
+	else
+		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
+		initialize
+	fi
+	local ret=$?
+	touch $VAR_SUBSYS_EBTABLES
+	return $ret
+}
+
+save() {
+	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
+	export EBTABLES_SAVE_COUNTER
+	ebtables-save >$EBTABLES_DATA && success || failure
+}
+
+case $1 in
+	start)
+		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
+		start && success || failure
+		RETVAL=$?
+		;;
+	stop)
+		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
+		echo -n $"ebtables: stopping firewall: "
+		initialize && success || failure
+		RETVAL=$?
+		rm -f $VAR_SUBSYS_EBTABLES
+		;;
+	save)
+		save
+		;;
+	*)
+		echo "usage: ${0##*/} {start|stop|save}" >&2
+		RETVAL=2
+		;;
+esac
+
+exit $RETVAL

ebtables.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Ethernet Bridge Filtering tables
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/ebtables-helper start
+ExecStop=/usr/libexec/ebtables-helper stop
+
+[Install]
+WantedBy=multi-user.target

iptables-1.8.11-command-options-fix.patch

@@ -0,0 +1,27 @@
+commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Wed Apr 23 12:36:13 2025 +0200
+
+    xshared: Accept an option if any given command allows it
+    
+    Fixed commit made option checking overly strict: Some commands may be
+    commbined (foremost --list and --zero), reject a given option only if it
+    is not allowed by any of the given commands.
+    
+    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
+    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index cdfd11ab..fc61e0fd 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
+ 	 */
+ 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
+ 		if ((options & optval) &&
+-		    (options_v_commands[i] & command) != command)
++		    !(options_v_commands[i] & command))
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Illegal option `%s' with this command",
+ 				      ops->option_name(optval));

iptables-1.8.11-fix-interface-comparisons.patch

@@ -0,0 +1,172 @@
+From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Mon, 18 Nov 2024 13:56:50 +0000
+Subject: nft: fix interface comparisons in `-C` commands
+
+Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
+kernel") removed code which explicitly set interface masks to all ones.  The
+result of this is that they are zero.  However, they are used to mask interfaces
+in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
+comparisons are always true, and check commands which ought to fail succeed:
+
+  # iptables -N test
+  # iptables -A test -i lo \! -o lo -j REJECT
+  # iptables -v -L test
+  Chain test (0 references)
+   pkts bytes target     prot opt in     out     source               destination
+      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
+  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
+  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
+
+Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
+
+Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ iptables/nft-arp.c                                 | 10 ++----
+ iptables/nft-ipv4.c                                |  4 +--
+ iptables/nft-ipv6.c                                |  6 +---
+ iptables/nft-shared.c                              | 36 +++++-----------------
+ iptables/nft-shared.h                              |  6 +---
+ .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
+ 6 files changed, 22 insertions(+), 49 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 264864c3..c11d64c3 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
+ 		return false;
+ 	}
+ 
+-	return is_same_interfaces(a->arp.iniface,
+-				  a->arp.outiface,
+-				  (unsigned char *)a->arp.iniface_mask,
+-				  (unsigned char *)a->arp.outiface_mask,
+-				  b->arp.iniface,
+-				  b->arp.outiface,
+-				  (unsigned char *)b->arp.iniface_mask,
+-				  (unsigned char *)b->arp.outiface_mask);
++	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
++				  b->arp.iniface, b->arp.outiface);
+ }
+ 
+ static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index 74092875..0c8bd291 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
+-				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
+-				  b->fw.ip.iniface, b->fw.ip.outiface,
+-				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
++				  b->fw.ip.iniface, b->fw.ip.outiface);
+ }
+ 
+ static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index b184f8af..4dbb2af2 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
+-				  a->fw6.ipv6.iniface_mask,
+-				  a->fw6.ipv6.outiface_mask,
+-				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
+-				  b->fw6.ipv6.iniface_mask,
+-				  b->fw6.ipv6.outiface_mask);
++				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
+ }
+ 
+ static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 6775578b..2c29e68f 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
+ }
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask)
++			const char *b_iniface, const char *b_outiface)
+ {
+-	int i;
+-
+-	for (i = 0; i < IFNAMSIZ; i++) {
+-		if (a_iniface_mask[i] != b_iniface_mask[i]) {
+-			DEBUGP("different iniface mask %x, %x (%d)\n",
+-			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
+-			return false;
+-		}
+-		if ((a_iniface[i] & a_iniface_mask[i])
+-		    != (b_iniface[i] & b_iniface_mask[i])) {
+-			DEBUGP("different iniface\n");
+-			return false;
+-		}
+-		if (a_outiface_mask[i] != b_outiface_mask[i]) {
+-			DEBUGP("different outiface mask\n");
+-			return false;
+-		}
+-		if ((a_outiface[i] & a_outiface_mask[i])
+-		    != (b_outiface[i] & b_outiface_mask[i])) {
+-			DEBUGP("different outiface\n");
+-			return false;
+-		}
++	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
++		DEBUGP("different iniface\n");
++		return false;
++	}
++	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
++		DEBUGP("different outiface\n");
++		return false;
+ 	}
+-
+ 	return true;
+ }
+ 
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 51d1e460..b57aee1f 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
+ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask);
++			const char *b_iniface, const char *b_outiface);
+ 
+ void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+new file mode 100755
+index 00000000..278cd648
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+@@ -0,0 +1,9 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++
++$XT_MULTI iptables -N test
++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
++
++exit 0
+-- 
+cgit v1.2.3
+

iptables.init

@@ -18,8 +18,22 @@
 # Description: Start, stop and save iptables firewall
 ### END INIT INFO
 
-# Source function library.
-. /etc/init.d/functions
+# compat for removed initscripts dependency
+
+success() {
+	echo -n "[  OK  ]"
+	return 0
+}
+
+warning() {
+	echo -n "[WARNING]"
+	return 1
+}
+
+failure() {
+	echo -n "[FAILED]"
+	return 1
+}
 
 IPTABLES=iptables
 IPTABLES_DATA=/etc/sysconfig/$IPTABLES
@@ -41,11 +55,6 @@ if [ ! -x /sbin/$IPTABLES ]; then
     exit 5
 fi
 
-# Old or new modutils
-/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
-    && NEW_MODUTILS=1 \
-    || NEW_MODUTILS=0
-
 # Default firewall configuration:
 IPTABLES_MODULES=""
 IPTABLES_SAVE_ON_STOP="no"
@@ -61,13 +70,33 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000
 # Load firewall configuration.
 [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
 
+is_iptables_nft() {
+	iptables --version | grep -q '(nf_tables)'
+}
+
+netfilter_active() {
+	is_iptables_nft && return 0
+	[ -e "$PROC_IPTABLES_NAMES" ]
+}
+
+netfilter_tables() {
+	netfilter_active || return 1
+	is_iptables_nft && {
+		# explicitly omit security table from this list as
+		# it should be reserved for SELinux use
+		echo "raw mangle filter nat"
+		return 0
+	}
+	cat "$PROC_IPTABLES_NAMES" 2>/dev/null
+}
+
 # Get active tables
-NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+NF_TABLES=$(netfilter_tables)
 
 
 flush_n_delete() {
     # Flush firewall rules and delete chains.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
     [ -z "$NF_TABLES" ] && return 1
@@ -99,10 +128,10 @@ set_policy() {
     policy=$1
 
     # Check if iptable module is loaded
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Check if firewall is configured (has tables)
-    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
+    tables=$(netfilter_tables)
     [ -z "$tables" ] && return 1
 
     echo -n $"${IPTABLES}: Setting chains to policy $policy: "
@@ -152,7 +181,7 @@ load_sysctl() {
         echo -n $"Loading sysctl settings: "
         ret=0
         for item in $IPTABLES_SYSCTL_LOAD_LIST; do
-            fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
+            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
             let ret+=$?;
         done
         [ $ret -eq 0 ] && success || failure
@@ -203,7 +232,7 @@ start() {
 	    return 1
 	fi
     fi
-    
+ 
     # Load additional modules (helpers)
     if [ -n "$IPTABLES_MODULES" ]; then
 	echo -n $"${IPTABLES}: Loading additional modules: "
@@ -216,7 +245,7 @@ start() {
 	[ $ret -eq 0 ] && success || failure
 	echo
     fi
-    
+ 
     # Load sysctl settings
     load_sysctl
 
@@ -226,7 +255,7 @@ start() {
 
 stop() {
     # Do not stop if iptables module is not loaded.
-    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
+    netfilter_active || return 0
 
     # Set default chain policy to ACCEPT, in order to not break shutdown
     # on systems where the default policy is DROP and root device is
@@ -234,14 +263,14 @@ stop() {
     set_policy ACCEPT
     # And then, flush the rules and delete chains
     flush_n_delete
-    
+
     rm -f $VAR_SUBSYS_IPTABLES
     return $ret
 }
 
 save() {
     # Check if iptable module is loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
 	return 0
     fi
@@ -284,7 +313,7 @@ save() {
 }
 
 status() {
-    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
 	echo $"${IPTABLES}: Firewall is not running."
 	return 3
     fi
@@ -292,7 +321,7 @@ status() {
     # Do not print status if lockfile is missing and iptables modules are not 
     # loaded.
     # Check if iptable modules are loaded
-    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
+    if ! netfilter_active; then
 	echo $"${IPTABLES}: Firewall modules are not loaded."
 	return 3
     fi
@@ -305,7 +334,7 @@ status() {
 
     NUM=
     [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
-    VERBOSE= 
+    VERBOSE=
     [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
     COUNT=
     [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

iptables.service

@@ -1,7 +1,8 @@
 [Unit]
 Description=IPv4 firewall with iptables
-After=syslog.target
 AssertPathExists=/etc/sysconfig/iptables
+Before=network-pre.target
+Wants=network-pre.target
 
 [Service]
 Type=oneshot
@@ -11,8 +12,6 @@ ExecReload=/usr/libexec/iptables/iptables.init reload
 ExecStop=/usr/libexec/iptables/iptables.init stop
 Environment=BOOTUP=serial
 Environment=CONSOLETYPE=serial
-StandardOutput=syslog
-StandardError=syslog
 
 [Install]
-WantedBy=basic.target
+WantedBy=multi-user.target

iptables.spec

@@ -4,81 +4,124 @@
 # service legacy actions (RHBZ#748134)
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 
+%global iptc_so_ver  0
+%global ipXtc_so_ver 2
+
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
-Version: 1.8.2
-Release: 3%{?dist}
-Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2
-Source1: iptables.init
-Source2: iptables-config
-Source3: iptables.service
-Source4: sysconfig_iptables
-Source5: sysconfig_ip6tables
-Source6: arptables-nft-helper
-Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
-Patch2: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
-Patch3: 0003-doc-Add-arptables-nft-man-pages.patch
-Patch4: 0004-doc-Adjust-arptables-man-pages.patch
-Patch5: 0005-doc-Add-ebtables-man-page.patch
-Patch6: 0006-doc-Adjust-ebtables-man-page.patch
-URL: http://www.netfilter.org/
+URL: https://www.netfilter.org/projects/iptables
+Version: 1.8.11
+Release: 12%{?dist}
+Source0: %{url}/files/%{name}-%{version}.tar.xz
+source1: %{url}/files/%{name}-%{version}.tar.xz.sig
+Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
+Source3: iptables.init
+Source4: iptables-config
+Source5: iptables.service
+Source6: sysconfig_iptables
+Source7: sysconfig_ip6tables
+Source8: arptables-helper
+Source9: arptables.service
+Source10: ebtables.service
+Source11: ebtables-helper
+Source12: ebtables-config
+# Patch to fix -C handling, already upstream
+# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
+Patch1: iptables-1.8.11-fix-interface-comparisons.patch
+# Patch to fix overly strict command option checking
+# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
+Patch2: iptables-1.8.11-command-options-fix.patch
+
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
-License: GPLv2 and Artistic Licence 2.0 and ISC
+License: GPL-2.0-only AND Artistic-2.0 AND ISC
 
 # libnetfilter_conntrack is needed for xt_connlabel
 BuildRequires: pkgconfig(libnetfilter_conntrack)
-# libnfnetlink-devel is requires for nfnl_osf
+# libnfnetlink-devel is required for nfnl_osf
 BuildRequires: pkgconfig(libnfnetlink)
 BuildRequires: libselinux-devel
 BuildRequires: kernel-headers
 BuildRequires: systemd
-BuildRequires: pkgconfig(libnftnl)
-BuildRequires: pkgconfig(libmnl) >= 1.0
 # libmnl, libnftnl, bison, flex for nftables
 BuildRequires: bison
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: pkgconfig(libmnl) >= 1.0
-BuildRequires: pkgconfig(libnftnl) >= 1.0.5
+BuildRequires: pkgconfig(libnftnl) >= 1.2.6
 # libpcap-devel for nfbpf_compile
 BuildRequires: libpcap-devel
-BuildRequires: autogen
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
-Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-%if 0%{?fedora} > 24
-Conflicts: setup < 2.10.4-1
-%endif
-Requires(post): %{_sbindir}/update-alternatives
-Requires(postun): %{_sbindir}/update-alternatives
+BuildRequires: make
+BuildRequires: gnupg2
 
 %description
 The iptables utility controls the network packet filtering code in the
 Linux kernel. If you need to set up firewalls and/or IP masquerading,
 you should install this package.
 
+%package legacy
+Summary: Legacy tools for managing Linux kernel packet filtering capabilities
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Conflicts: setup < 2.10.4-1
+Conflicts: alternatives < 1.32-1
+Requires(post): /usr/sbin/update-alternatives
+Requires(postun): /usr/sbin/update-alternatives
+%if 0%{?rhel} < 9
+Provides:	iptables
+%endif
+Provides:  %{name}-compat = %{version}-%{release}
+Obsoletes: %{name}-compat < 1.8.9-7
+
+%sbin_merge_compat %{_prefix}/sbin/iptables
+
+%description legacy
+The iptables utility controls the network packet filtering code in the
+Linux kernel. This package contains the legacy tools which are obsoleted by
+nft-variants in iptables-nft package for backwards compatibility reasons.
+If you need to set up firewalls and/or IP masquerading, you should not install
+this package but either nftables or iptables-nft instead.
+
 %package libs
-Summary: iptables libraries
+Summary: libxtables and iptables extensions userspace support
 
 %description libs
+libxtables and associated shared object files
+
+Libxtables provides unified access to iptables extensions in userspace. Data
+and logic for those is kept in per-extension shared object files.
+
+%package legacy-libs
+Summary: iptables legacy libraries
+
+%description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real so version.
-
-For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real
+so version. For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
-
 %package devel
 Summary: Development package for iptables
-Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+# XXX: Drop this after two releases or so
+Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %description devel
-iptables development headers and libraries.
+libxtables development headers and pkgconfig files
+
+%package legacy-devel
+Summary: Development package for legacy iptables
+Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
+Requires: pkgconfig
+
+%description legacy-devel
+Legacy iptables development headers and pkgconfig files
 
 The iptc libraries are marked as not public by upstream. The interface is not
 stable and may change with every new version. It is therefore unsupported.
@@ -86,11 +129,21 @@ stable and may change with every new version. It is therefore unsupported.
 %package services
 Summary: iptables and ip6tables services for iptables
 Requires: %{name} = %{version}-%{release}
+Requires: %{name}-utils = %{version}-%{release}
 %{?systemd_ordering}
 # obsolete old main package
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
+# Look at me, I'm the new arptables-services now!
+Conflicts: %{name}-nft < 1.8.11-5
+Obsoletes: arptables-services < 0.0.5-16
+Provides: arptables-services = %{version}-%{release}
+# Look at me, I'm the new ebtables-services now!
+# (With epoch to turn our version number higher value)
+Obsoletes: ebtables-services < 2.0.11-20
+Provides: ebtables-services = 1:%{version}-%{release}
+BuildArch: noarch
 
 %description services
 iptables services for IPv4 and IPv6
@@ -99,24 +152,38 @@ This package provides the services iptables and ip6tables that have been split
 out of the base package since they are not active by default anymore.
 
 %package utils
-Summary: iptables and ip6tables services for iptables
+Summary: iptables and ip6tables misc utilities
 Requires: %{name} = %{version}-%{release}
 
 %description utils
-Utils for iptables.
+Utils for iptables
 
-Currently only provides nfnl_osf with the pf.os database.
+This package provides nfnl_osf with the pf.os database and nfbpf_compile,
+a bytecode generator for use with xt_bpf. Also included is iptables-apply,
+a safer way to update iptables remotely.
 
 %package nft
 Summary: nftables compatibility for iptables, arptables and ebtables
-Requires: %{name} = %{version}-%{release}
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+Requires(post): /usr/sbin/update-alternatives
+Requires(post): /usr/bin/readlink
+Requires(postun): /usr/sbin/update-alternatives
 Obsoletes: iptables-compat < 1.6.2-4
 Provides: arptables-helper
+Provides: iptables
+Provides: arptables
+Provides: ebtables
+# allowing old arptables-legacy will break when switching alternatives
+# due to the dropped arptables-helper symlink
+Conflicts: arptables-legacy < 0.0.5-16
+
+%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description nft
 nftables compatibility for iptables, arptables and ebtables.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
 
 %build
@@ -130,38 +197,33 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
 rm -f include/linux/types.h
 
-make %{?_smp_mflags}
+%make_build
 
 %install
-make install DESTDIR=%{buildroot} 
+%make_install
 # remove la file(s)
-rm -f %{buildroot}/%{_libdir}/*.la
-
-# install ip*tables.h header files
-install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/
-install -d -m 755 %{buildroot}%{_includedir}/iptables
-install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/
-
-# install ipulog header file
-install -d -m 755 %{buildroot}%{_includedir}/libipulog/
-install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/
+rm -f %{buildroot}%{_libdir}/*.la
 
 # install init scripts and configuration files
 install -d -m 755 %{buildroot}%{script_path}
-install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
+install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
+install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
-install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
+install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
-install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables
-install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
+install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
+install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
+touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}
-sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service
+install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
+sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
 # install legacy actions for service command
@@ -184,223 +246,491 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic
 sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy
 install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic
 
-# install iptables-apply with man page
-install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/
-install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/
-
-%if 0%{?fedora} > 24
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
-%endif
-
-install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/
-touch %{buildroot}%{_libexecdir}/arptables-helper
 
 # prepare for alternatives
 touch %{buildroot}%{_mandir}/man8/arptables.8
 touch %{buildroot}%{_mandir}/man8/arptables-save.8
 touch %{buildroot}%{_mandir}/man8/arptables-restore.8
 touch %{buildroot}%{_mandir}/man8/ebtables.8
+rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+
+# fix absolute symlink
+ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
 
 %ldconfig_scriptlets
 
-%post
+%post legacy
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-%{_sbindir}/update-alternatives --install \
+update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--slave $pfx6 ip6tables $pfx6-legacy \
-	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
-	--slave $pfx-save iptables-save $pfx-legacy-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
 
-%postun
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
+
+%postun legacy
 if [ $1 -eq 0 ]; then
-	%{_sbindir}/update-alternatives --remove \
+	update-alternatives --remove \
 		iptables %{_sbindir}/iptables-legacy
 fi
 
+# iptables-1.8.0-1 introduced the use of alternatives
+# when upgrading, its %postun script runs due to the package renaming
+# fix this by repeating the install into alternatives
+# also keep the old alternatives configuration to not change the system
+%triggerun legacy -- iptables > 1.8.0
+alternatives --list | awk '/^iptables/{print $3; exit}' \
+		>/var/tmp/alternatives.iptables.current
+cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
+
+%triggerpostun legacy -- iptables > 1.8.0
+pfx=%{_sbindir}/iptables
+pfx6=%{_sbindir}/ip6tables
+update-alternatives --install \
+	$pfx iptables $pfx-legacy 10 \
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
+rm /var/tmp/alternatives.iptables.current
+mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
+
 %post services
+%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
+%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
 %?ldconfig
+%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
-%post nft
+%post -e nft
+[[ %%{_excludedocs} == 1 ]] || do_man=true
+
+# remove non-symlinks in spots managed by alternatives
+# to cover for updates from not-yet-alternatived versions
+for pfx in %{_prefix}/sbin/{eb,arp}tables; do
+	for sfx in "" "-restore" "-save"; do
+		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+			rm -f $pfx$sfx
+		fi
+	done
+done
+for manpfx in %{_mandir}/man8/{eb,arp}tables; do
+	for sfx in {,-restore,-save}.8.gz; do
+		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
+			rm -f $manpfx$sfx
+		fi
+	done
+done
+
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-%{_sbindir}/update-alternatives --install \
-	$pfx iptables $pfx-nft 5 \
-	--slave $pfx6 ip6tables $pfx6-nft \
-	--slave $pfx-restore iptables-restore $pfx-nft-restore \
-	--slave $pfx-save iptables-save $pfx-nft-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-nft-save
+update-alternatives --install \
+	$pfx iptables $pfx-nft 10 \
+	--follower $pfx6 ip6tables $pfx6-nft \
+	--follower $pfx-restore iptables-restore $pfx-nft-restore \
+	--follower $pfx-save iptables-save $pfx-nft-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-nft-save
 
 pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
-for sfx in "" "-restore" "-save"; do
-	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-		rm -f $pfx$sfx
-	fi
-done
-if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
-	rm -f $manpfx.8.gz
-fi
-%{_sbindir}/update-alternatives --install \
-	$pfx ebtables $pfx-nft 5 \
-	--slave $pfx-save ebtables-save $pfx-nft-save \
-	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
-	--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz
+update-alternatives --install \
+	$pfx ebtables $pfx-nft 10 \
+	--follower $pfx-save ebtables-save $pfx-nft-save \
+	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
 
 pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
-lepfx=%{_libexecdir}/arptables
-for sfx in "" "-restore" "-save"; do
-	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-		rm -f $pfx$sfx
-	fi
-	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
-		rm -f $manpfx$sfx.8.gz
-	fi
+update-alternatives --install \
+	$pfx arptables $pfx-nft 10 \
+	--follower $pfx-save arptables-save $pfx-nft-save \
+	--follower $pfx-restore arptables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
+	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
+	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
 done
-if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
-	rm -f $lepfx-helper
-fi
-%{_sbindir}/update-alternatives --install \
-	$pfx arptables $pfx-nft 5 \
-	--slave $pfx-save arptables-save $pfx-nft-save \
-	--slave $pfx-restore arptables-restore $pfx-nft-restore \
-	--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \
-	--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \
-	--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \
-	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
+%endif
 
 %postun nft
 if [ $1 -eq 0 ]; then
 	for cmd in iptables ebtables arptables; do
-		%{_sbindir}/update-alternatives --remove \
-			$cmd %{_sbindir}/$cmd-nft
+		update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
 	done
 fi
 
-%files
-%{!?_licensedir:%global license %%doc}
-%license COPYING
-%doc INCOMPATIBILITIES
-%if 0%{?fedora} <= 24
-%{_sysconfdir}/ethertypes
-%endif
-%{_sbindir}/iptables-apply
-%{_sbindir}/iptables-legacy*
-%{_sbindir}/ip6tables-legacy*
+%files legacy
+%{_sbindir}/ip{,6}tables-legacy*
 %{_sbindir}/xtables-legacy-multi
 %{_bindir}/iptables-xml
 %{_mandir}/man1/iptables-xml*
-%{_mandir}/man8/iptables*
-%{_mandir}/man8/ip6tables*
-%{_mandir}/man8/nfnl_osf*
 %{_mandir}/man8/xtables-legacy*
-%dir %{_libdir}/xtables
-%{_libdir}/xtables/libarpt*
-%{_libdir}/xtables/libebt*
-%{_libdir}/xtables/libipt*
-%{_libdir}/xtables/libip6t*
-%{_libdir}/xtables/libxt*
-%ghost %{_sbindir}/iptables
-%ghost %{_sbindir}/iptables-restore
-%ghost %{_sbindir}/iptables-save
-%ghost %{_sbindir}/ip6tables
-%ghost %{_sbindir}/ip6tables-restore
-%ghost %{_sbindir}/ip6tables-save
+%dir %{_datadir}/xtables
+%{_datadir}/xtables/iptables.xslt
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
-%{_libdir}/libip*tc.so.*
-%{_libdir}/libxtables.so.*
+%license COPYING
+%{_libdir}/libxtables.so.12*
+%dir %{_libdir}/xtables
+%{_libdir}/xtables/lib{ip,ip6,x}t*
+%{_mandir}/man8/ip{,6}tables.8.gz
+%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz
+
+%files legacy-libs
+%license COPYING
+%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
 
 %files devel
-%dir %{_includedir}/iptables
-%{_includedir}/iptables/*.h
-%{_includedir}/*.h
+%{_includedir}/xtables{,-version}.h
+%{_libdir}/libxtables.so
+%{_libdir}/pkgconfig/xtables.pc
+
+%files legacy-devel
 %dir %{_includedir}/libiptc
 %{_includedir}/libiptc/*.h
-%dir %{_includedir}/libipulog
-%{_includedir}/libipulog/*.h
 %{_libdir}/libip*tc.so
-%{_libdir}/libxtables.so
-%{_libdir}/pkgconfig/libiptc.pc
-%{_libdir}/pkgconfig/libip4tc.pc
-%{_libdir}/pkgconfig/libip6tc.pc
-%{_libdir}/pkgconfig/xtables.pc
+%{_libdir}/pkgconfig/libip{,4,6}tc.pc
 
 %files services
 %dir %{script_path}
-%{script_path}/iptables.init
-%{script_path}/ip6tables.init
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables
-%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config
-%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config
-%{_unitdir}/iptables.service
-%{_unitdir}/ip6tables.service
-%dir %{legacy_actions}/iptables
-%{legacy_actions}/iptables/save
-%{legacy_actions}/iptables/panic
-%dir %{legacy_actions}/ip6tables
-%{legacy_actions}/ip6tables/save
-%{legacy_actions}/ip6tables/panic
+%{script_path}/ip{,6}tables.init
+%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
+%config(noreplace) %{_sysconfdir}/sysconfig/arptables
+%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
+%ghost %{_sysconfdir}/sysconfig/ebtables
+%{_unitdir}/{arp,eb,ip,ip6}tables.service
+%dir %{legacy_actions}/ip{,6}tables
+%{legacy_actions}/ip{,6}tables/{save,panic}
+%{_libexecdir}/{arp,eb}tables-helper
 
 %files utils
+%license COPYING
 %{_sbindir}/nfnl_osf
 %{_sbindir}/nfbpf_compile
+%{_sbindir}/ip{,6}tables-apply
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/pf.os
+%{_mandir}/man8/nfnl_osf*
+%{_mandir}/man8/nfbpf_compile*
+%{_mandir}/man8/ip{,6}tables-apply*
 
 %files nft
-%{_sbindir}/iptables-nft*
-%{_sbindir}/iptables-restore-translate
-%{_sbindir}/iptables-translate
-%{_sbindir}/ip6tables-nft*
-%{_sbindir}/ip6tables-restore-translate
-%{_sbindir}/ip6tables-translate
-%{_sbindir}/ebtables-nft*
-%{_sbindir}/arptables-nft*
+%{_sbindir}/ip{,6}tables-nft*
+%{_sbindir}/ip{,6}tables{,-restore}-translate
+%{_sbindir}/{eb,arp}tables-nft*
 %{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
-%{_libexecdir}/arptables-nft-helper
+%{_sbindir}/ebtables-translate
+%{_sbindir}/arptables-translate
+%dir %{_libdir}/xtables
+%{_libdir}/xtables/lib{arp,eb}t*
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
-%ghost %{_sbindir}/iptables
-%ghost %{_sbindir}/iptables-restore
-%ghost %{_sbindir}/iptables-save
-%ghost %{_sbindir}/ip6tables
-%ghost %{_sbindir}/ip6tables-restore
-%ghost %{_sbindir}/ip6tables-save
-%ghost %{_sbindir}/ebtables
-%ghost %{_sbindir}/ebtables-save
-%ghost %{_sbindir}/ebtables-restore
-%ghost %{_sbindir}/arptables
-%ghost %{_sbindir}/arptables-save
-%ghost %{_sbindir}/arptables-restore
-%ghost %{_libexecdir}/arptables-helper
-%ghost %{_mandir}/man8/arptables.8.gz
-%ghost %{_mandir}/man8/arptables-save.8.gz
-%ghost %{_mandir}/man8/arptables-restore.8.gz
+%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
+%{_mandir}/man8/ebtables-translate*
+%{_mandir}/man8/arptables-translate*
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
-* Mon Jul 22 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-3
-- Bump again for updated libnftnl, this time with buildroot override
+* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
+- Pull in upstream fix for too strict command option parsing
 
-* Sat Jul 20 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-2
-- Rebuild for updated libnftnl
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
+- Fix for ghost files not present in iptables-nft RPM
+
+* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
+- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
+  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
+
+* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
+- Revert last release, it breaks alternatives symlinks
+
+* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
+- Keep symlinks managed by alternatives under /usr/bin
+
+* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
+- Add patch to fix -C handling ( fixes rhbz#2360423 )
+
+* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
+- iptables-services to assimilate arptables- and ebtables-services
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
+- Keep symlinks managed by alternatives under /usr/sbin
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
+- new version
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-14
+- Add unmerged-sbin compat also for -legacy subpackage
+
+* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-13
+- Bump release and add changelog entry
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-12
+- Rebuilt for the bin-sbin merge
+
+* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-11
+- Add missing build dependency
+
+* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-10
+- Verify tarball GPG signature
+
+* Wed Jul 03 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-9
+- Backport fixes from upstream
+
+* Tue May 21 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-8
+- Make iptables-legacy own %%{_datadir}/xtables
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jan 11 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-5
+- Backport fixes from upstream
+- Fix flatpak build
+
+* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-4
+- The actual obsoletes fix
+
+* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-3
+- Fix compat sub-package obsoletion
+
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-2
+- Obsolete dropped compat package
+
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-1
+- New version 1.8.10
+- Drop compat sub-package
+
+* Tue Aug 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-6
+- Convert license to SPDX format
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
+- Backport fixes from upstream
+
+* Thu Apr 20 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-3
+- Support %%_excludedocs macro in alternatives installation
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Jan 12 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-1
+- Make iptables-xml a relative symlink
+- Drop not needed xtables.conf
+- Ship iptables.xslt with iptables-legacy package
+- Ship ebtables-translate tool with iptables-nft package
+- Update to 1.8.9.
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Fri Jul 08 2022 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.8-2
+- iptables-services requires iptables-apply in utils to apply rules
+
+* Fri May 13 2022 Phil Sutter <psutter@redhat.com> - 1.8.8-1
+- Update to 1.8.8. Fixes rhbz#2085503
+
+* Thu Mar 03 2022 Phil Sutter <psutter@redhat.com> - 1.8.7-16
+- Improve error messages for unsupported extensions
+- xshared: Fix response to unprivileged users
+- libxtables: Register only the highest revision extension
+- Ignore typical 'fedpkg local' results in .gitignore
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sat Nov 27 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-14
+- Rebuild for new libnftnl.
+
+* Thu Aug 05 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-13
+- doc: ebtables-nft.8: Adjust for missing atomic-options
+- nft: Fix for non-verbose check command
+- Build services sub-package as noarch
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jul 01 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-11
+- Fix performance restoring large rulesets
+- Review unit file
+
+* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-10
+- Backport fixes from upstream
+
+* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-9
+- Remove bashisms from arptables-nft-helper
+
+* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8
+- iptables.init: Fix functionality for iptables-nft
+- iptables.init: Ignore sysctl files not suffixed '.conf'
+- iptables.init: Drop unused NEW_MODUTILS check
+- iptables.init: Drop some trailing whitespace
+
+* Mon Mar 29 2021 Damian Wrobel <dwrobel@ertelnet.rybnik.pl> - 1.8.7-7
+- Add missing readlink required for iptables-nft(post)
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6
+- Restore alternatives configuration after upgrade
+- Fix license location
+
+* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-5
+- Fix upgrade path with package rename
+- Add missing dependencies to iptables-nft package
+
+* Tue Feb 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-4
+- Drop bootstrap code again
+- Drop workarounds for F24 and lower
+- Fix iptables-utils summary
+- Ship iptables-apply with iptables-utils
+- Reduce files sections by use of globbing
+- Ship common man pages with iptables-libs
+- Ship *-translate man pages with iptables-nft
+- Move legacy iptables binaries, libraries and headers into sub-packages
+- Introduce compat sub-package to help with above transitions
+- Drop libipulog header from devel package, this belongs to libnetfilter_log
+- Do not ship internal headers in devel package
+
+* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-3
+- ebtables: Exit gracefully on invalid table names
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-1
+- Update to 1.8.7. Fixes rhbz#1916948
+
+* Thu Nov 19 17:32:24 CET 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-5
+- Use make macros
+
+* Tue Nov 17 14:05:30 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-4
+- ebtables: Fix for broken chain renaming
+
+* Mon Nov 16 13:39:22 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-3
+- Drop obsolete StandardOutput setting from unit file
+- Remove StandardError setting from unit file, its value is default
+
+* Thu Nov  5 2020 Florian Weimer <fweimer@redhat.com> - 1.8.6-2
+- Remove build dependency on autogen
+
+* Sat Oct 31 2020 Kevin Fenzi <kevin@scrye.com> - 1.8.6-1
+- Update to 1.8.6. Fixes bug #1893453
+
+* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-3
+- nft: cache: Check consistency with NFT_CL_FAKE, too
+- nft: Fix command name in ip6tables error message
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 23 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-1
+- Rebase onto upstream version 1.8.5 plus two late fixes
+- Drop explicit iptables-apply installation, upstream fixed that
+- Ship ip6tables-apply along with iptables package
+
+* Wed Feb 12 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-7
+- Move nft-specific extensions into iptables-nft package
+- Move remaining extensions into iptables-libs package
+- Make iptables-nft depend on iptables-libs instead of iptables
+- Add upstream-suggested fixes
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jan 15 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-5
+- Raise Alternatives priority of nft variants to match legacy ones
+- Add Provides lines to allow for iptables-nft as full legacy alternative
+
+* Thu Dec 19 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-4
+- Drop leftover include in arptables-nft-helper
+
+* Fri Dec 13 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-3
+- Remove dependencies on initscripts package
+
+* Tue Dec 10 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-2
+- iptables-services requires /etc/init.d/functions
+
+* Wed Dec 04 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-1
+- New upstream version 1.8.4
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Tue Jun 25 2019 Björn Esser <besser82@fedoraproject.org> - 1.8.3-4
+- Disable bootstrapping
+
+* Tue Jun 25 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-3
+- Change URL to point at iptables project, not netfilter overview page
+- Reuse URL value in tarball source
+- Reduce globbing of library file names to expose future SONAME changes
+- Add bootstrapping for libip*tc SONAME bump
+
+* Tue Jun 25 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-2
+- Install new man page for nfbpf_compile utility
+- Move nfnl_osf man page to utils subpackage
+
+* Wed May 29 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-1
+- New upstream version 1.8.3
 
 * Mon Apr 15 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-1
 - New upstream version 1.8.2

sources

@@ -1 +1,2 @@
-SHA512 (iptables-1.8.2.tar.bz2) = 8cf0f515764e1dc6e03284581d682d1949b33e8f25fea29c27ae856f1089fe8ca7b1814524b85f4378fd1fc7c7c7d002f06557b257ae2bbc945f8555bad0dc76
+SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
+SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2

tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh

@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 IPSET=testset6
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh

@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 TESTD=$PWD
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "source $TESTD/rules.in" 0 "read ruleset"

tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh

@@ -29,7 +29,6 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 prepare_page() {
@@ -42,7 +41,6 @@ prepare_page() {
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlLogInfo $(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
@@ -121,10 +119,14 @@ rlJournalStart
         rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
         rlRun "iptables -t raw -F"
         rlRun "ip6tables -t raw -F"
-        rlRun "rmmod nf_log_ipv4"
-        rlRun "rmmod nf_log_ipv6"
-        rlRun "rmmod nf_log_common"
-        rlRun "rmmod nfnetlink_log" 0,1
+        if rlTestVersion "$(uname -r)" "<" "4.6"; then
+            rlRun "rmmod nf_log_ipv4"
+            rlRun "rmmod nf_log_ipv6"
+            rlRun "rmmod nf_log_common"
+            rlRun "rmmod nfnetlink_log" 0,1
+	else
+            rlLogInfo "new kernel detected: skipping unloading modules"
+	fi
         rlLogInfo "restoring services"
         for svc in $SERVICES; do
             rlServiceRestore $svc

tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh

@@ -29,7 +29,6 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 CGNUM="15"
 CGNAME="15"
 CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
@@ -41,7 +40,6 @@ SKIP6=false
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel-$(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/initscript-sanity/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile

@@ -53,7 +53,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          iptables" >> $(METADATA)
-	@echo "Requires:        iptables bridge-utils ipset" >> $(METADATA)
+	@echo "Requires:        iptables iproute ipset" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2+" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh

@@ -29,16 +29,13 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ip6tables-save > ip6tables.backup"
         rlRun "iptables-save > iptables.backup"
-        rlRun "brctl addbr testbr" 0 "create bridge iface"
+        rlRun "ip link add dev testbr type bridge" 0 "create bridge iface"
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -75,7 +72,7 @@ rlJournalStart
         rlRun "ip6tables-restore < ip6tables.backup"
         rlRun "iptables-restore < iptables.backup"
         rlRun "ip link set down dev testbr"
-        rlRun "brctl delbr testbr" 0 "remove bridge iface"
+        rlRun "ip link del testbr" 0 "remove bridge iface"
         rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
         rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
         rlRun "popd"

tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "cp /etc/sysconfig/ip6tables ."

tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh

@@ -29,12 +29,10 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         for svc in $SERVICES; do

tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh

@@ -29,13 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
 IPSET4="ipsetv4"
 IPSET6="ipsetv6"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ipset create $IPSET4 hash:ip"

tests/iptables-save-cuts-space-before-j/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlServiceStart iptables

tests/iptables-save-modprobe-option/runtest.sh

@@ -30,11 +30,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartTest
-        rlAssertRpm $PACKAGE
         rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
         rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
     rlPhaseEnd

tests/tests.yml

@@ -10,7 +10,6 @@
         - iptables-services # multiple tests need iptables/ip6tables config files
         - initscripts       # multiple tests need system command
         - libcgroup-tools   # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
-        - bridge-utils      # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
         - ipset             # multiple tests need ipset command
         - strace            # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
         - policycoreutils   # initscript-sanity needs restorecon command
@@ -21,7 +20,7 @@
   roles:
   - role: standard-test-rhts
     tests:
-    - backport-iptables-add-libxt-cgroup-frontend
+#    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by
@@ -43,7 +42,7 @@
   roles:
   - role: standard-test-beakerlib
     tests:
-    - backport-iptables-add-libxt-cgroup-frontend
+#    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by

tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh

@@ -29,11 +29,8 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
-PACKAGE="iptables"
-
 rlJournalStart
     rlPhaseStartSetup
-        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd