iptables-1.8.4-9

- Fix for wrong prefix in ip6tables error messages
- Add further fixes from upstream

.gitignore

@@ -1,19 +1,5 @@
-/.build-*.log
-/iptables-*.src.rpm
-/noarch/
-/x86_64/
-/iptables.spec.orig
 /iptables-1.6.2.tar.bz2
 /iptables-1.8.0.tar.bz2
 /iptables-1.8.2.tar.bz2
 /iptables-1.8.3.tar.bz2
 /iptables-1.8.4.tar.bz2
-/iptables-1.8.5.tar.bz2
-/iptables-1.8.6.tar.bz2
-/iptables-1.8.7.tar.bz2
-/iptables-1.8.8.tar.bz2
-/iptables-1.8.9.tar.xz
-/iptables-1.8.10.tar.xz
-/iptables-1.8.10.tar.xz.sig
-/iptables-1.8.11.tar.xz
-/iptables-1.8.11.tar.xz.sig

0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch

@@ -0,0 +1,35 @@
+From ef37183c65bc1c69c8fdb198d9ee500cb7b394e5 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 12 Apr 2019 18:02:19 +0200
+Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/iptables-apply | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-apply b/iptables/iptables-apply
+index 819ca4a459c42..a685b6bbcd7dc 100755
+--- a/iptables/iptables-apply
++++ b/iptables/iptables-apply
+@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
+ 	exit 2
+ fi
+ 
+-COMMANDS=(tempfile "$SAVE" "$RESTORE")
++COMMANDS=(mktemp "$SAVE" "$RESTORE")
+ 
+ for cmd in "${COMMANDS[@]}"; do
+ 	if ! command -v $cmd >/dev/null; then
+@@ -122,7 +122,7 @@ done
+ 
+ umask 0700
+ 
+-TMPFILE=$(tempfile -p iptap)
++TMPFILE=$(mktemp)
+ trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
+ 		      FPE USR1 SEGV USR2 PIPE ALRM TERM
+ 
+-- 
+2.27.0
+

0002-Fix-DEBUG-build.patch

@@ -0,0 +1,33 @@
+From 1c05f5907661207a61767db6b0d8e5e7bb60f5be Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 4 Dec 2019 09:36:59 +0100
+Subject: [PATCH] Fix DEBUG build
+
+Fixed commit missed to update this conditional call to
+nft_rule_print_save().
+
+Fixes: 1e8ef6a584754 ("nft: family_ops: Pass nft_handle to 'rule_to_cs' callback")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 066a19596ae3d69b49a70405e2daf75c929dcd4d)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-shared.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 78e422781723f..426765641cff6 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -998,7 +998,7 @@ bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data)
+ 
+ 	DEBUGP("comparing with... ");
+ #ifdef DEBUG_DEL
+-	nft_rule_print_save(r, NFT_RULE_APPEND, 0);
++	nft_rule_print_save(h, r, NFT_RULE_APPEND, 0);
+ #endif
+ 	if (!h->ops->is_same(cs, &this))
+ 		goto out;
+-- 
+2.27.0
+

0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch

@@ -0,0 +1,60 @@
+From 6e8f0c61f4c9abc2836d772fca97ff0d84c03360 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
+Date: Wed, 14 Nov 2018 07:35:28 +0100
+Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
+introduced support for gcc feature to check format string against passed
+argument.  This commit adds missing bits to extenstions's libipt_icmp.c
+and libip6t_icmp6.c that were causing build to fail.
+
+Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
+Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libip6t_icmp6.c | 4 ++--
+ extensions/libipt_icmp.c   | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
+index 45a71875722c4..cc7bfaeb72fd7 100644
+--- a/extensions/libip6t_icmp6.c
++++ b/extensions/libip6t_icmp6.c
+@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+ 	type_name = icmp6_type_xlate(icmptype);
+ 
+ 	if (type_name) {
+-		xt_xlate_add(xl, type_name);
++		xt_xlate_add(xl, "%s", type_name);
+ 	} else {
+ 		for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
+ 			if (icmpv6_codes[i].type == icmptype &&
+@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+ 				break;
+ 
+ 		if (i != ARRAY_SIZE(icmpv6_codes))
+-			xt_xlate_add(xl, icmpv6_codes[i].name);
++			xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
+ 		else
+ 			return 0;
+ 	}
+diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
+index 5418997668d4c..e76257c54708c 100644
+--- a/extensions/libipt_icmp.c
++++ b/extensions/libipt_icmp.c
+@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
+ 			if (icmp_codes[i].type == icmptype &&
+ 			    icmp_codes[i].code_min == code_min &&
+ 			    icmp_codes[i].code_max == code_max) {
+-				xt_xlate_add(xl, icmp_codes[i].name);
++				xt_xlate_add(xl, "%s", icmp_codes[i].name);
+ 				return 1;
+ 			}
+ 	}
+-- 
+2.21.0
+

0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch

@@ -0,0 +1,59 @@
+From d46cba8bb28f3f57969ae36355801b1aade26983 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 4 Dec 2019 09:56:06 +0100
+Subject: [PATCH] xtables-restore: Fix parser feed from line buffer
+
+When called with --noflush, xtables-restore would trip over chain lines:
+Parser uses strtok() to separate chain name, policy and counters which
+inserts nul-chars into the source string. Therefore strlen() can't be
+used anymore to find end of line. Fix this by caching line length before
+calling xtables_restore_parse_line().
+
+Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../testcases/ipt-restore/0010-noflush-new-chain_0     | 10 ++++++++++
+ iptables/xtables-restore.c                             |  4 +++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+ create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+new file mode 100755
+index 0000000000000..739e684a21183
+--- /dev/null
++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+@@ -0,0 +1,10 @@
++#!/bin/sh -e
++
++# assert input feed from buffer doesn't trip over
++# added nul-chars from parsing chain line.
++
++$XT_MULTI iptables-restore --noflush <<EOF
++*filter
++:foobar - [0:0]
++-A foobar -j ACCEPT
++COMMIT
+diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
+index 2f0fe7d439d94..dd907e0b8ddd5 100644
+--- a/iptables/xtables-restore.c
++++ b/iptables/xtables-restore.c
+@@ -327,10 +327,12 @@ void xtables_restore_parse(struct nft_handle *h,
+ 	line = 0;
+ 	ptr = preload_buffer;
+ 	while (*ptr) {
++		size_t len = strlen(ptr);
++
+ 		h->error.lineno = ++line;
+ 		DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr);
+ 		xtables_restore_parse_line(h, p, &state, ptr);
+-		ptr += strlen(ptr) + 1;
++		ptr += len + 1;
+ 	}
+ 	if (*buffer) {
+ 		h->error.lineno = ++line;
+-- 
+2.27.0
+

0004-xtables-restore-Avoid-access-of-uninitialized-data.patch

@@ -0,0 +1,31 @@
+From 6ecf9d7f0ed60afdbd3637cc40e91a0b2d86d21c Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 Dec 2019 11:40:26 +0100
+Subject: [PATCH] xtables-restore: Avoid access of uninitialized data
+
+When flushing, 'buffer' is not written to prior to checking its first
+byte's value. Therefore it needs to be initialized upon declaration.
+
+Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
+(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-restore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
+index dd907e0b8ddd5..63cc15cee9621 100644
+--- a/iptables/xtables-restore.c
++++ b/iptables/xtables-restore.c
+@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h,
+ 			   const struct nft_xt_restore_parse *p)
+ {
+ 	struct nft_xt_restore_state state = {};
+-	char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr;
++	char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr;
+ 
+ 	if (!h->noflush) {
+ 		nft_fake_cache(h);
+-- 
+2.27.0
+

0005-extensions-time-Avoid-undefined-shift.patch

@@ -0,0 +1,31 @@
+From 51ec6fb324ae61a1c4e6ee8514f8b13efb14b4fd Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 Dec 2019 13:15:01 +0100
+Subject: [PATCH] extensions: time: Avoid undefined shift
+
+Value 1 is signed by default and left-shifting by 31 is undefined for
+those. Fix this by marking the value as unsigned.
+
+Fixes: ad326ef9f734a ("Add the libxt_time iptables match")
+(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libxt_time.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c
+index 5a8cc5de13031..d001f5b7f448f 100644
+--- a/extensions/libxt_time.c
++++ b/extensions/libxt_time.c
+@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable)
+ 
+ 	printf(" ");
+ 	for (i = 1; i <= 31; ++i)
+-		if (mask & (1 << i)) {
++		if (mask & (1u << i)) {
+ 			if (nbdays++ > 0)
+ 				printf(",");
+ 			printf("%u", i);
+-- 
+2.27.0
+

0006-extensions-cluster-Avoid-undefined-shift.patch

@@ -0,0 +1,31 @@
+From b32190bee5a3b9fef63a32fa7f43edd1021e2ee9 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 Dec 2019 13:36:31 +0100
+Subject: [PATCH] extensions: cluster: Avoid undefined shift
+
+Value 1 is signed by default and left-shifting by 31 is undefined for
+those. Fix this by marking the value as unsigned.
+
+Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft")
+(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libxt_cluster.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c
+index c9c35ee22e3df..d164bf6960166 100644
+--- a/extensions/libxt_cluster.c
++++ b/extensions/libxt_cluster.c
+@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl,
+ 		xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st,
+ 				info->total_nodes, info->hash_seed);
+ 		for (node = 0; node < 32; node++) {
+-			if (info->node_mask & (1 << node)) {
++			if (info->node_mask & (1u << node)) {
+ 				if (needs_set == 0) {
+ 					xt_xlate_add(xl, "{ ");
+ 					needs_set = 1;
+-- 
+2.27.0
+

0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch

@@ -0,0 +1,40 @@
+From 3d43932ba38f041c72902b894f9f90486a1a200f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 Dec 2019 16:01:29 +0100
+Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname()
+
+The function potentially fed overlong strings to strcpy(). Given that
+everything needed to avoid this is there, reorder code a bit to prevent
+those inputs, too.
+
+Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft")
+(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-translate.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index a42c60a3b64c6..77a186b905d73 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -32,14 +32,13 @@
+ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+ 		  bool invert)
+ {
++	int ifaclen = strlen(ifname);
+ 	char iface[IFNAMSIZ];
+-	int ifaclen;
+ 
+-	if (ifname[0] == '\0')
++	if (ifaclen < 1 || ifaclen >= IFNAMSIZ)
+ 		return;
+ 
+ 	strcpy(iface, ifname);
+-	ifaclen = strlen(iface);
+ 	if (iface[ifaclen - 1] == '+')
+ 		iface[ifaclen - 1] = '*';
+ 
+-- 
+2.27.0
+

0008-extensions-among-Check-call-to-fstat.patch

@@ -0,0 +1,41 @@
+From b1b60022ea6ece431f372e5c850c62ede97e61ad Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 Dec 2019 16:35:51 +0100
+Subject: [PATCH] extensions: among: Check call to fstat()
+
+If this fails, a bogus length value may be passed to mmap().
+
+Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
+(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libebt_among.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
+index 2e87db3bc06fa..715d559f432c2 100644
+--- a/extensions/libebt_among.c
++++ b/extensions/libebt_among.c
+@@ -6,6 +6,7 @@
+  * August, 2003
+  */
+ 
++#include <errno.h>
+ #include <ctype.h>
+ #include <fcntl.h>
+ #include <getopt.h>
+@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert,
+ 		if ((fd = open(optarg, O_RDONLY)) == -1)
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Couldn't open file '%s'", optarg);
+-		fstat(fd, &stats);
++		if (fstat(fd, &stats) < 0)
++			xtables_error(PARAMETER_PROBLEM,
++				      "fstat(%s) failed: '%s'",
++				      optarg, strerror(errno));
+ 		flen = stats.st_size;
+ 		/* use mmap because the file will probably be big */
+ 		optarg = mmap(0, flen, PROT_READ | PROT_WRITE,
+-- 
+2.27.0
+

0009-xtables-restore-fix-for-noflush-and-empty-lines.patch

@@ -0,0 +1,78 @@
+From 8c54e14a9d7e1fcfd30481cb50ec577edce5ce34 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 11 Feb 2020 16:52:59 +0100
+Subject: [PATCH] xtables-restore: fix for --noflush and empty lines
+
+Lookahead buffer used for cache requirements estimate in restore
+--noflush separates individual lines with nul-chars. Two consecutive
+nul-chars are interpreted as end of buffer and remaining buffer content
+is skipped.
+
+Sadly, reading an empty line (i.e., one containing a newline character
+only) caused double nul-chars to appear in buffer as well, leading to
+premature stop when reading cached lines from buffer.
+
+To fix that, make use of xtables_restore_parse_line() skipping empty
+lines without calling strtok() and just leave the newline character in
+place. A more intuitive approach, namely skipping empty lines while
+buffering, is deliberately not chosen as that would cause wrong values
+in 'line' variable.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400
+Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
+(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../ipt-restore/0011-noflush-empty-line_0        | 16 ++++++++++++++++
+ iptables/xtables-restore.c                       |  8 +++++---
+ 2 files changed, 21 insertions(+), 3 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
+
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
+new file mode 100755
+index 0000000000000..bea1a690bb624
+--- /dev/null
++++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
+@@ -0,0 +1,16 @@
++#!/bin/bash -e
++
++# make sure empty lines won't break --noflush
++
++cat <<EOF | $XT_MULTI iptables-restore --noflush
++# just a comment followed by innocent empty line
++
++*filter
++-A FORWARD -j ACCEPT
++COMMIT
++EOF
++
++EXPECT='Chain FORWARD (policy ACCEPT)
++target     prot opt source               destination         
++ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           '
++diff -u <(echo "$EXPECT") <($XT_MULTI iptables -n -L FORWARD)
+diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
+index 63cc15cee9621..fb2ac8b5c12a3 100644
+--- a/iptables/xtables-restore.c
++++ b/iptables/xtables-restore.c
+@@ -293,11 +293,13 @@ void xtables_restore_parse(struct nft_handle *h,
+ 		while (fgets(buffer, sizeof(buffer), p->in)) {
+ 			size_t blen = strlen(buffer);
+ 
+-			/* drop trailing newline; xtables_restore_parse_line()
++			/* Drop trailing newline; xtables_restore_parse_line()
+ 			 * uses strtok() which replaces them by nul-characters,
+ 			 * causing unpredictable string delimiting in
+-			 * preload_buffer */
+-			if (buffer[blen - 1] == '\n')
++			 * preload_buffer.
++			 * Unless this is an empty line which would fold into a
++			 * spurious EoB indicator (double nul-char). */
++			if (buffer[blen - 1] == '\n' && blen > 1)
+ 				buffer[blen - 1] = '\0';
+ 			else
+ 				blen++;
+-- 
+2.27.0
+

0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch

@@ -0,0 +1,32 @@
+From 604b7f0cf8dfeb25db7d739995e49f88fd9dbd45 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 Dec 2019 13:57:18 +0100
+Subject: [PATCH] libxtables: Avoid buffer overrun in
+ xtables_compatible_revision()
+
+The function is exported and accepts arbitrary strings as input. Calling
+strcpy() without length checks is not OK.
+
+(cherry picked from commit f7d3dbb82e7ed94ccbf10cf70a3c7b3f3aaef1a1)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ libxtables/xtables.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libxtables/xtables.c b/libxtables/xtables.c
+index 895f6988eaf57..777c2b08e9896 100644
+--- a/libxtables/xtables.c
++++ b/libxtables/xtables.c
+@@ -856,7 +856,8 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt)
+ 
+ 	xtables_load_ko(xtables_modprobe_program, true);
+ 
+-	strcpy(rev.name, name);
++	strncpy(rev.name, name, XT_EXTENSION_MAXNAMELEN - 1);
++	rev.name[XT_EXTENSION_MAXNAMELEN - 1] = '\0';
+ 	rev.revision = revision;
+ 
+ 	max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s);
+-- 
+2.27.0
+

0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch

@@ -0,0 +1,44 @@
+From 347fdad75554acc0a356f976920946aec6ab52a5 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Tue, 10 Dec 2019 12:27:13 +0100
+Subject: [PATCH] uapi: netfilter: Avoid undefined left-shift in xt_sctp.h
+
+This is a backport of kernel commit 164166558aace ("netfilter: uapi:
+Avoid undefined left-shift in xt_sctp.h").
+
+(cherry picked from commit fe1ac5eaa8ae482c9112aed6b89f9f2e529f4516)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ include/linux/netfilter/xt_sctp.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/netfilter/xt_sctp.h b/include/linux/netfilter/xt_sctp.h
+index a501e6196905d..5b28525a2482a 100644
+--- a/include/linux/netfilter/xt_sctp.h
++++ b/include/linux/netfilter/xt_sctp.h
+@@ -40,19 +40,19 @@ struct xt_sctp_info {
+ #define SCTP_CHUNKMAP_SET(chunkmap, type) 		\
+ 	do { 						\
+ 		(chunkmap)[type / bytes(__u32)] |= 	\
+-			1 << (type % bytes(__u32));	\
++			1u << (type % bytes(__u32));	\
+ 	} while (0)
+ 
+ #define SCTP_CHUNKMAP_CLEAR(chunkmap, type)		 	\
+ 	do {							\
+ 		(chunkmap)[type / bytes(__u32)] &= 		\
+-			~(1 << (type % bytes(__u32)));	\
++			~(1u << (type % bytes(__u32)));	\
+ 	} while (0)
+ 
+ #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) 			\
+ ({								\
+ 	((chunkmap)[type / bytes (__u32)] & 		\
+-		(1 << (type % bytes (__u32)))) ? 1: 0;	\
++		(1u << (type % bytes (__u32)))) ? 1: 0;	\
+ })
+ 
+ #define SCTP_CHUNKMAP_RESET(chunkmap) \
+-- 
+2.27.0
+

0012-xtables-translate-Fix-for-interface-name-corner-case.patch

@@ -0,0 +1,98 @@
+From 1af5c5eacd8cbfe1d942ac5c59fce9ca007aa43a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 6 Feb 2020 15:08:41 +0100
+Subject: [PATCH] xtables-translate: Fix for interface name corner-cases
+
+There are two special situations xlate_ifname() didn't cover for:
+
+* Interface name containing '*': This went unchanged, creating a command
+  nft wouldn't accept. Instead translate into '\*' which doesn't change
+  semantics.
+
+* Interface name being '+': Can't translate into nft wildcard character
+  as nft doesn't accept asterisk-only interface names. Instead decide
+  what to do based on 'invert' value: Skip match creation if false,
+  match against an invalid interface name if true.
+
+Also add a test to make sure future changes to this behaviour are
+noticed.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit e179e87a1179e272a9bdabb0220b17d61d099ee3)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/generic.txlate    | 12 ++++++++++++
+ iptables/xtables-translate.c | 33 ++++++++++++++++++++++++++++-----
+ 2 files changed, 40 insertions(+), 5 deletions(-)
+
+diff --git a/extensions/generic.txlate b/extensions/generic.txlate
+index b38fbd1fe113b..c92d082abea78 100644
+--- a/extensions/generic.txlate
++++ b/extensions/generic.txlate
+@@ -18,3 +18,15 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi
+ 
+ ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
+ nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
++
++# asterisk is not special in iptables and it is even a valid interface name
++iptables-translate -A FORWARD -i '*' -o 'eth*foo'
++nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
++
++# skip for always matching interface names
++iptables-translate -A FORWARD -i '+'
++nft add rule ip filter FORWARD counter
++
++# match against invalid interface name to simulate never matching rule
++iptables-translate -A FORWARD ! -i '+'
++nft add rule ip filter FORWARD iifname "INVAL/D" counter
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index 77a186b905d73..c4e177c0d63ba 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -32,15 +32,38 @@
+ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+ 		  bool invert)
+ {
+-	int ifaclen = strlen(ifname);
+-	char iface[IFNAMSIZ];
++	int ifaclen = strlen(ifname), i, j;
++	char iface[IFNAMSIZ * 2];
+ 
+ 	if (ifaclen < 1 || ifaclen >= IFNAMSIZ)
+ 		return;
+ 
+-	strcpy(iface, ifname);
+-	if (iface[ifaclen - 1] == '+')
+-		iface[ifaclen - 1] = '*';
++	for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
++		switch (ifname[i]) {
++		case '+':
++			iface[j] = '*';
++			break;
++		case '*':
++			iface[j++] = '\\';
++			/* fall through */
++		default:
++			iface[j] = ifname[i];
++			break;
++		}
++	}
++
++	if (ifaclen == 1 && ifname[0] == '+') {
++		/* Nftables does not support wildcard only string. Workaround
++		 * is easy, given that this will match always or never
++		 * depending on 'invert' value. To match always, simply don't
++		 * generate an expression. To match never, use an invalid
++		 * interface name (kernel doesn't accept '/' in names) to match
++		 * against. */
++		if (!invert)
++			return;
++		strcpy(iface, "INVAL/D");
++		invert = false;
++	}
+ 
+ 	xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface);
+ }
+-- 
+2.27.0
+

0013-xtables-translate-Fix-for-iface.patch

@@ -0,0 +1,60 @@
+From 027cdbb0e64904aac90f878c2491059443f92b60 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 13 Feb 2020 14:01:50 +0100
+Subject: [PATCH] xtables-translate: Fix for iface++
+
+In legacy iptables, only the last plus sign remains special, any
+previous ones are taken literally. Therefore xtables-translate must not
+replace all of them with asterisk but just the last one.
+
+Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 94488d4eb912f5af4c88d148b39b38eb8a3c1f0b)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/generic.txlate    | 4 ++++
+ iptables/xtables-translate.c | 6 +++---
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/generic.txlate b/extensions/generic.txlate
+index c92d082abea78..0e256c3727559 100644
+--- a/extensions/generic.txlate
++++ b/extensions/generic.txlate
+@@ -23,6 +23,10 @@ nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:
+ iptables-translate -A FORWARD -i '*' -o 'eth*foo'
+ nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
+ 
++# escape all asterisks but translate only the first plus character
++iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
++nft add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter
++
+ # skip for always matching interface names
+ iptables-translate -A FORWARD -i '+'
+ nft add rule ip filter FORWARD counter
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index c4e177c0d63ba..0f95855b41aa4 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -40,9 +40,6 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+ 
+ 	for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
+ 		switch (ifname[i]) {
+-		case '+':
+-			iface[j] = '*';
+-			break;
+ 		case '*':
+ 			iface[j++] = '\\';
+ 			/* fall through */
+@@ -65,6 +62,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+ 		invert = false;
+ 	}
+ 
++	if (iface[j - 2] == '+')
++		iface[j - 2] = '*';
++
+ 	xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface);
+ }
+ 
+-- 
+2.27.0
+

0014-xtables-Review-nft_init.patch

@@ -0,0 +1,274 @@
+From 60206ee04840303b4b8e7edc8fa0359633aabcbe Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 21 Feb 2020 14:55:52 +0100
+Subject: [PATCH] xtables: Review nft_init()
+
+Move common code into nft_init(), such as:
+
+* initial zeroing nft_handle fields
+* family ops lookup and assignment to 'ops' field
+* setting of 'family' field
+
+This requires minor adjustments in xtables_restore_main() so extra field
+initialization doesn't happen before nft_init() call.
+
+As a side-effect, this fixes segfaulting xtables-monitor binary when
+printing rules for trace event as in that code-path 'ops' field wasn't
+initialized.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit d0446ab11182f6ca2adc486a124895f09a220c6e)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c                |  9 ++++++++-
+ iptables/nft.h                |  2 +-
+ iptables/xtables-arp.c        |  9 +--------
+ iptables/xtables-eb.c         |  9 +--------
+ iptables/xtables-monitor.c    |  2 +-
+ iptables/xtables-restore.c    | 14 +++++++-------
+ iptables/xtables-save.c       |  9 ++-------
+ iptables/xtables-standalone.c |  6 ++----
+ iptables/xtables-translate.c  |  2 +-
+ iptables/xtables.c            |  4 ----
+ 10 files changed, 24 insertions(+), 42 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 3f2a62ae12c07..0287add3fb21f 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -789,8 +789,10 @@ int nft_restart(struct nft_handle *h)
+ 	return 0;
+ }
+ 
+-int nft_init(struct nft_handle *h, const struct builtin_table *t)
++int nft_init(struct nft_handle *h, int family, const struct builtin_table *t)
+ {
++	memset(h, 0, sizeof(*h));
++
+ 	h->nl = mnl_socket_open(NETLINK_NETFILTER);
+ 	if (h->nl == NULL)
+ 		return -1;
+@@ -800,9 +802,14 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
+ 		return -1;
+ 	}
+ 
++	h->ops = nft_family_ops_lookup(family);
++	if (!h->ops)
++		xtables_error(PARAMETER_PROBLEM, "Unknown family");
++
+ 	h->portid = mnl_socket_get_portid(h->nl);
+ 	h->tables = t;
+ 	h->cache = &h->__cache[0];
++	h->family = family;
+ 
+ 	INIT_LIST_HEAD(&h->obj_list);
+ 	INIT_LIST_HEAD(&h->err_list);
+diff --git a/iptables/nft.h b/iptables/nft.h
+index 51b5660314c0c..5cf260a6d2cd3 100644
+--- a/iptables/nft.h
++++ b/iptables/nft.h
+@@ -80,7 +80,7 @@ extern const struct builtin_table xtables_bridge[NFT_TABLE_MAX];
+ int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
+ 	     int (*cb)(const struct nlmsghdr *nlh, void *data),
+ 	     void *data);
+-int nft_init(struct nft_handle *h, const struct builtin_table *t);
++int nft_init(struct nft_handle *h, int family, const struct builtin_table *t);
+ void nft_fini(struct nft_handle *h);
+ int nft_restart(struct nft_handle *h);
+ 
+diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
+index 9cfad76263d32..c8196f08baa59 100644
+--- a/iptables/xtables-arp.c
++++ b/iptables/xtables-arp.c
+@@ -500,17 +500,10 @@ int nft_init_arp(struct nft_handle *h, const char *pname)
+ 	init_extensionsa();
+ #endif
+ 
+-	memset(h, 0, sizeof(*h));
+-	h->family = NFPROTO_ARP;
+-
+-	if (nft_init(h, xtables_arp) < 0)
++	if (nft_init(h, NFPROTO_ARP, xtables_arp) < 0)
+ 		xtables_error(OTHER_PROBLEM,
+ 			      "Could not initialize nftables layer.");
+ 
+-	h->ops = nft_family_ops_lookup(h->family);
+-	if (h->ops == NULL)
+-		xtables_error(PARAMETER_PROBLEM, "Unknown family");
+-
+ 	return 0;
+ }
+ 
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 15b971da3d425..c006bc95ac681 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -739,16 +739,9 @@ int nft_init_eb(struct nft_handle *h, const char *pname)
+ 	init_extensionsb();
+ #endif
+ 
+-	memset(h, 0, sizeof(*h));
+-
+-	h->family = NFPROTO_BRIDGE;
+-
+-	if (nft_init(h, xtables_bridge) < 0)
++	if (nft_init(h, NFPROTO_BRIDGE, xtables_bridge) < 0)
+ 		xtables_error(OTHER_PROBLEM,
+ 			      "Could not initialize nftables layer.");
+-	h->ops = nft_family_ops_lookup(h->family);
+-	if (!h->ops)
+-		xtables_error(PARAMETER_PROBLEM, "Unknown family");
+ 
+ 	/* manually registering ebt matches, given the original ebtables parser
+ 	 * don't use '-m matchname' and the match can't be loaded dynamically when
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index a5245d1422af9..c2b31dbaa0795 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -615,7 +615,7 @@ int xtables_monitor_main(int argc, char *argv[])
+ 	init_extensions4();
+ #endif
+ 
+-	if (nft_init(&h, xtables_ipv4)) {
++	if (nft_init(&h, AF_INET, xtables_ipv4)) {
+ 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+ 			xtables_globals.program_name,
+ 			xtables_globals.program_version,
+diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
+index fb2ac8b5c12a3..11834c0ea98c5 100644
+--- a/iptables/xtables-restore.c
++++ b/iptables/xtables-restore.c
+@@ -360,15 +360,13 @@ static int
+ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
+ {
+ 	const struct builtin_table *tables;
+-	struct nft_handle h = {
+-		.family = family,
+-		.restore = true,
+-	};
+-	int c;
+ 	struct nft_xt_restore_parse p = {
+ 		.commit = true,
+ 		.cb = &restore_cb,
+ 	};
++	bool noflush = false;
++	struct nft_handle h;
++	int c;
+ 
+ 	line = 0;
+ 
+@@ -402,7 +400,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
+ 				print_usage(prog_name, PACKAGE_VERSION);
+ 				exit(0);
+ 			case 'n':
+-				h.noflush = 1;
++				noflush = true;
+ 				break;
+ 			case 'M':
+ 				xtables_modprobe_program = optarg;
+@@ -464,13 +462,15 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
+ 		return 1;
+ 	}
+ 
+-	if (nft_init(&h, tables) < 0) {
++	if (nft_init(&h, family, tables) < 0) {
+ 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+ 				xtables_globals.program_name,
+ 				xtables_globals.program_version,
+ 				strerror(errno));
+ 		exit(EXIT_FAILURE);
+ 	}
++	h.noflush = noflush;
++	h.restore = true;
+ 
+ 	xtables_restore_parse(&h, &p);
+ 
+diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
+index 3a52f8c3d8209..228282deaed07 100644
+--- a/iptables/xtables-save.c
++++ b/iptables/xtables-save.c
+@@ -139,10 +139,8 @@ xtables_save_main(int family, int argc, char *argv[],
+ 	struct do_output_data d = {
+ 		.format = FMT_NOCOUNTS,
+ 	};
++	struct nft_handle h;
+ 	bool dump = false;
+-	struct nft_handle h = {
+-		.family	= family,
+-	};
+ 	FILE *file = NULL;
+ 	int ret, c;
+ 
+@@ -242,16 +240,13 @@ xtables_save_main(int family, int argc, char *argv[],
+ 		return 1;
+ 	}
+ 
+-	if (nft_init(&h, tables) < 0) {
++	if (nft_init(&h, family, tables) < 0) {
+ 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+ 				xtables_globals.program_name,
+ 				xtables_globals.program_version,
+ 				strerror(errno));
+ 		exit(EXIT_FAILURE);
+ 	}
+-	h.ops = nft_family_ops_lookup(h.family);
+-	if (!h.ops)
+-		xtables_error(PARAMETER_PROBLEM, "Unknown family");
+ 
+ 	ret = do_output(&h, tablename, &d);
+ 	nft_fini(&h);
+diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
+index 1a28c5480629f..022d5dd44abbf 100644
+--- a/iptables/xtables-standalone.c
++++ b/iptables/xtables-standalone.c
+@@ -44,9 +44,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
+ {
+ 	int ret;
+ 	char *table = "filter";
+-	struct nft_handle h = {
+-		.family = family,
+-	};
++	struct nft_handle h;
+ 
+ 	xtables_globals.program_name = progname;
+ 	ret = xtables_init_all(&xtables_globals, family);
+@@ -61,7 +59,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
+ 	init_extensions4();
+ #endif
+ 
+-	if (nft_init(&h, xtables_ipv4) < 0) {
++	if (nft_init(&h, family, xtables_ipv4) < 0) {
+ 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+ 				xtables_globals.program_name,
+ 				xtables_globals.program_version,
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index 0f95855b41aa4..76ad7eb69eca9 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -480,7 +480,7 @@ static int xtables_xlate_main_common(struct nft_handle *h,
+ 		return 1;
+ 	}
+ 
+-	if (nft_init(h, tables) < 0) {
++	if (nft_init(h, family, tables) < 0) {
+ 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
+ 				xtables_globals.program_name,
+ 				xtables_globals.program_version,
+diff --git a/iptables/xtables.c b/iptables/xtables.c
+index 8f9dc628d0029..4b24d15c46295 100644
+--- a/iptables/xtables.c
++++ b/iptables/xtables.c
+@@ -571,10 +571,6 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
+ 	   demand-load a protocol. */
+ 	opterr = 0;
+ 
+-	h->ops = nft_family_ops_lookup(h->family);
+-	if (h->ops == NULL)
+-		xtables_error(PARAMETER_PROBLEM, "Unknown family");
+-
+ 	opts = xt_params->orig_opts;
+ 	while ((cs->c = getopt_long(argc, argv,
+ 	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvw::W::nt:m:xc:g:46",
+-- 
+2.27.0
+

0015-nft-cache-Fix-nft_release_cache-under-stress.patch

@@ -0,0 +1,49 @@
+From 381597830058c20cce350a705265fb2ab0150f2f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Feb 2020 20:32:13 +0100
+Subject: [PATCH] nft: cache: Fix nft_release_cache() under stress
+
+iptables-nft-restore calls nft_action(h, NFT_COMPAT_COMMIT) for each
+COMMIT line in input. When restoring a dump containing multiple large
+tables, chances are nft_rebuild_cache() has to run multiple times.
+
+If the above happens, consecutive table contents are added to __cache[1]
+which nft_rebuild_cache() then frees, so next commit attempt accesses
+invalid memory.
+
+Fix this by making nft_release_cache() (called after each successful
+commit) return things into pre-rebuild state again, but keeping the
+fresh cache copy.
+
+Fixes: f6ad231d698c7 ("nft: keep original cache in case of ERESTART")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit c550c81fd373e5753103d20f7902171f0fa79807)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-cache.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 7345a27e2894b..6f21f2283e0fb 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -647,8 +647,14 @@ void nft_rebuild_cache(struct nft_handle *h)
+ 
+ void nft_release_cache(struct nft_handle *h)
+ {
+-	if (h->cache_index)
+-		flush_cache(h, &h->__cache[0], NULL);
++	if (!h->cache_index)
++		return;
++
++	flush_cache(h, &h->__cache[0], NULL);
++	memcpy(&h->__cache[0], &h->__cache[1], sizeof(h->__cache[0]));
++	memset(&h->__cache[1], 0, sizeof(h->__cache[1]));
++	h->cache_index = 0;
++	h->cache = &h->__cache[0];
+ }
+ 
+ struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
+-- 
+2.27.0
+

0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch

@@ -0,0 +1,84 @@
+From 02460350debd34be4342b87cac91d70240c7c431 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 13 Mar 2020 13:02:12 +0100
+Subject: [PATCH] nft: cache: Fix iptables-save segfault under stress
+
+If kernel ruleset is constantly changing, code called by
+nft_is_table_compatible() may crash: For each item in table's chain
+list, nft_is_chain_compatible() is called. This in turn calls
+nft_build_cache() to fetch chain's rules. Though if kernel genid has changed
+meanwhile, cache is flushed and rebuilt from scratch, thereby freeing
+table's chain list - the foreach loop in nft_is_table_compatible() then
+operates on freed memory.
+
+A simple reproducer (may need a few calls):
+
+| RULESET='*filter
+| :INPUT ACCEPT [10517:1483527]
+| :FORWARD ACCEPT [0:0]
+| :OUTPUT ACCEPT [1714:105671]
+| COMMIT
+| '
+|
+| for ((i = 0; i < 100; i++)); do
+|         iptables-nft-restore <<< "$RULESET" &
+| done &
+| iptables-nft-save
+
+To fix the problem, basically revert commit ab1cd3b510fa5 ("nft: ensure
+cache consistency") so that __nft_build_cache() no longer flushes the
+cache. Instead just record kernel's genid when fetching for the first
+time. If kernel rule set changes until the changes are committed, the
+commit simply fails and local cache is being rebuilt.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 200bc399651499f502ac0de45f4d4aa4c9d37ab6)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-cache.c | 16 ++--------------
+ 1 file changed, 2 insertions(+), 14 deletions(-)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 6f21f2283e0fb..07265b7795e4f 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -452,15 +452,11 @@ __nft_build_cache(struct nft_handle *h, enum nft_cache_level level,
+ 		  const struct builtin_table *t, const char *set,
+ 		  const char *chain)
+ {
+-	uint32_t genid_start, genid_stop;
+-
+ 	if (level <= h->cache_level)
+ 		return;
+-retry:
+-	mnl_genid_get(h, &genid_start);
+ 
+-	if (h->cache_level && genid_start != h->nft_genid)
+-		flush_chain_cache(h, NULL);
++	if (!h->nft_genid)
++		mnl_genid_get(h, &h->nft_genid);
+ 
+ 	switch (h->cache_level) {
+ 	case NFT_CL_NONE:
+@@ -487,18 +483,10 @@ retry:
+ 		break;
+ 	}
+ 
+-	mnl_genid_get(h, &genid_stop);
+-	if (genid_start != genid_stop) {
+-		flush_chain_cache(h, NULL);
+-		goto retry;
+-	}
+-
+ 	if (!t && !chain)
+ 		h->cache_level = level;
+ 	else if (h->cache_level < NFT_CL_TABLES)
+ 		h->cache_level = NFT_CL_TABLES;
+-
+-	h->nft_genid = genid_start;
+ }
+ 
+ void nft_build_cache(struct nft_handle *h, struct nftnl_chain *c)
+-- 
+2.27.0
+

0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch

@@ -0,0 +1,42 @@
+From 8a48c88b9cfa643e9c2783f41c6a79fd42514e6f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 9 May 2020 13:36:49 +0200
+Subject: [PATCH] nfnl_osf: Fix broken conversion to nfnl_query()
+
+Due to missing NLM_F_ACK flag in request, nfnetlink code in kernel
+didn't create an own ACK message but left it upon subsystem to ACK or
+not. Since nfnetlink_osf doesn't ACK by itself, nfnl_query() got stuck
+waiting for a reply.
+
+Whoever did the conversion from deprecated nfnl_talk() obviously didn't
+even test basic functionality of the tool.
+
+Fixes: 52aa15098ebd6 ("nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query()")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit c8332553caf48132403895bae750b3cd09a2efd8)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ utils/nfnl_osf.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c
+index 15d531975e11d..922d90ac135b7 100644
+--- a/utils/nfnl_osf.c
++++ b/utils/nfnl_osf.c
+@@ -378,9 +378,11 @@ static int osf_load_line(char *buffer, int len, int del)
+ 	memset(buf, 0, sizeof(buf));
+ 
+ 	if (del)
+-		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE, NLM_F_REQUEST);
++		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE,
++			      NLM_F_ACK | NLM_F_REQUEST);
+ 	else
+-		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD, NLM_F_REQUEST | NLM_F_CREATE);
++		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD,
++			      NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE);
+ 
+ 	nfnl_addattr_l(nmh, sizeof(buf), OSF_ATTR_FINGER, &f, sizeof(struct xt_osf_user_finger));
+ 
+-- 
+2.27.0
+

0018-nfnl_osf-Improve-error-handling.patch

@@ -0,0 +1,80 @@
+From ef30ce26ceb48402f9c028802127151e962f51cd Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 9 May 2020 13:42:56 +0200
+Subject: [PATCH] nfnl_osf: Improve error handling
+
+For some error cases, no log message was created - hence apart from the
+return code there was no indication of failing execution.
+
+If a line load fails, don't abort but continue with the remaining
+file contents. The current pf.os file in this repository serves as
+proof-of-concept:
+
+Lines 700 and 701: Duplicates of lines 698 and 699 because 'W*' and 'W0'
+parse into the same data.
+
+Line 704: Duplicate of line 702 because apart from 'W*' and 'W0', only
+the first three fields on right-hand side are sent to the kernel.
+
+When loading, these dups are ignored (they would bounce if NLM_F_EXCL
+was given). Upon deletion, they cause ENOENT response from kernel. In
+order to align duplicate-tolerance in both modes, just ignore that
+ENOENT.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 3e09bd1888575cfec136574d2b0e810ba33f1cfb)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ utils/nfnl_osf.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c
+index 922d90ac135b7..8008e83d8af4b 100644
+--- a/utils/nfnl_osf.c
++++ b/utils/nfnl_osf.c
+@@ -392,7 +392,7 @@ static int osf_load_line(char *buffer, int len, int del)
+ static int osf_load_entries(char *path, int del)
+ {
+ 	FILE *inf;
+-	int err = 0;
++	int err = 0, lineno = 0;
+ 	char buf[1024];
+ 
+ 	inf = fopen(path, "r");
+@@ -402,7 +402,9 @@ static int osf_load_entries(char *path, int del)
+ 	}
+ 
+ 	while(fgets(buf, sizeof(buf), inf)) {
+-		int len;
++		int len, rc;
++
++		lineno++;
+ 
+ 		if (buf[0] == '#' || buf[0] == '\n' || buf[0] == '\r')
+ 			continue;
+@@ -414,9 +416,11 @@ static int osf_load_entries(char *path, int del)
+ 
+ 		buf[len] = '\0';
+ 
+-		err = osf_load_line(buf, len, del);
+-		if (err)
+-			break;
++		rc = osf_load_line(buf, len, del);
++		if (rc && (!del || errno != ENOENT)) {
++			ulog_err("Failed to load line %d", lineno);
++			err = rc;
++		}
+ 
+ 		memset(buf, 0, sizeof(buf));
+ 	}
+@@ -448,6 +452,7 @@ int main(int argc, char *argv[])
+ 
+ 	if (!fingerprints) {
+ 		err = -ENOENT;
++		ulog("Missing fingerprints file argument.\n");
+ 		goto err_out_exit;
+ 	}
+ 
+-- 
+2.27.0
+

0019-nft-cache-Reset-genid-when-rebuilding-cache.patch

@@ -0,0 +1,37 @@
+From d7ac1f62d953ea2136df4bef247b635db93a537b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 29 May 2020 19:33:22 +0200
+Subject: [PATCH] nft: cache: Reset genid when rebuilding cache
+
+This is required in order to avoid a cache rebuild loop if
+iptables-nft-restore is called with '--test' parameter and a dump
+containing more than a single table.
+
+If non-zero, __nft_build_cache() never updates genid and therefore the
+incorrect genid (caused by increment in nft_action()) is never
+corrected.
+
+This is a Fedora-only fix, upstream rewrote the whole cache logic which
+implicitly resolved this problem.
+
+Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress")
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-cache.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 07265b7795e4f..bc6e7f7eaebfb 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h)
+ 	if (h->cache_level)
+ 		__nft_flush_cache(h);
+ 
++	h->nft_genid = 0;
+ 	h->cache_level = NFT_CL_NONE;
+ 	__nft_build_cache(h, level, NULL, NULL, NULL);
+ }
+-- 
+2.27.0
+

0020-nft-Fix-command-name-in-ip6tables-error-message.patch

@@ -0,0 +1,45 @@
+From 6036d70408b1d4e8760e47cdf862cc73c1de727d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 7 Aug 2020 13:48:28 +0200
+Subject: [PATCH] nft: Fix command name in ip6tables error message
+
+Upon errors, ip6tables-nft would prefix its error messages with
+'iptables:' instead of 'ip6tables:'. Turns out the command name was
+hard-coded, use 'progname' variable instead.
+While being at it, merge the two mostly identical fprintf() calls into
+one.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-standalone.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
+index 022d5dd44abbf..b5b7ccaf4e660 100644
+--- a/iptables/xtables-standalone.c
++++ b/iptables/xtables-standalone.c
+@@ -74,14 +74,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
+ 	nft_fini(&h);
+ 
+ 	if (!ret) {
+-		if (errno == EINVAL) {
+-			fprintf(stderr, "iptables: %s. "
+-					"Run `dmesg' for more information.\n",
+-				nft_strerror(errno));
+-		} else {
+-			fprintf(stderr, "iptables: %s.\n",
+-				nft_strerror(errno));
+-		}
++		fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
++			(errno == EINVAL ?
++			 " Run `dmesg' for more information." : ""));
++
+ 		if (errno == EAGAIN)
+ 			exit(RESOURCE_PROBLEM);
+ 	}
+-- 
+2.27.0
+

0021-tests-shell-Fix-skip-checks-with-host-mode.patch

@@ -0,0 +1,366 @@
+From 5d22e14bad69933519ddcc6bb39817bf7ae09db8 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 12 Feb 2020 21:26:06 +0100
+Subject: [PATCH] tests: shell: Fix skip checks with --host mode
+
+When testing host binaries, XT_MULTI variable contains just the program
+name without path component which most skip checks didn't expect. Fix
+them, and while being at it also reduce indenting level in two scripts
+by moving the skip check up front with an early exit call.
+
+Fixes: 416898e335322 ("tests/shell: Support testing host binaries")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2b2b7948c1960ba4680677664ff58477be869de6)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../arptables/0001-arptables-save-restore_0   |   2 +-
+ .../0002-arptables-restore-defaults_0         |   2 +-
+ .../arptables/0003-arptables-verbose-output_0 |   2 +-
+ .../testcases/ebtables/0001-ebtables-basic_0  | 135 +++++++++---------
+ .../ebtables/0002-ebtables-save-restore_0     |   2 +-
+ .../ebtables/0003-ebtables-restore-defaults_0 |   2 +-
+ .../testcases/ebtables/0004-save-counters_0   |   2 +-
+ .../testcases/ebtables/0005-ifnamechecks_0    |   2 +-
+ .../firewalld-restore/0001-firewalld_0        |   2 +-
+ .../testcases/ipt-restore/0004-restore-race_0 |   2 +-
+ .../shell/testcases/nft-only/0001compat_0     |  15 +-
+ .../shell/testcases/nft-only/0002invflags_0   |   2 +-
+ .../nft-only/0003delete-with-comment_0        |   2 +-
+ 13 files changed, 88 insertions(+), 84 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
+index bf04dc0a3e15a..e64e9142ee98b 100755
+--- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
++++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
+@@ -4,7 +4,7 @@ set -e
+ #set -x
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ # fill arptables manually
+ 
+diff --git a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
+index 38d387f327ebb..afd0fcb460d85 100755
+--- a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
++++ b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ # arptables-restore reuses preloaded targets and matches, make sure defaults
+ # apply to consecutive rules using the same target/match as a previous one
+diff --git a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
+index 10c5ec33ada2c..952cfa7898371 100755
+--- a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
++++ b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
+@@ -4,7 +4,7 @@ set -e
+ set -x
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ $XT_MULTI arptables -N foo
+ 
+diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
+index c7f24a383f698..0c1eb4ca66f52 100755
+--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
+@@ -1,86 +1,89 @@
+ #!/bin/sh
+ 
++case "$XT_MULTI" in
++*xtables-nft-multi)
++	;;
++*)
++	echo "skip $XT_MULTI"
++	exit 0
++	;;
++esac
++
+ get_entries_count() { # (chain)
+ 	$XT_MULTI ebtables -L $1 | sed -n 's/.*entries: \([0-9]*\).*/\1/p'
+ }
+ 
+ set -x
+-case "$XT_MULTI" in
+-*/xtables-nft-multi)
+-	for t in filter nat;do
+-		$XT_MULTI ebtables -t $t -L || exit 1
+-		$XT_MULTI ebtables -t $t -X || exit 1
+-		$XT_MULTI ebtables -t $t -F || exit 1
+-	done
+-
+-	for t in broute foobar ;do
+-		$XT_MULTI ebtables -t $t -L &&
+-		$XT_MULTI ebtables -t $t -X &&
+-		$XT_MULTI ebtables -t $t -F
+-		if [ $? -eq 0 ]; then
+-			echo "Expect nonzero return for unsupported table"
+-			exit 1
+-		fi
+-	done
+ 
++for t in filter nat;do
++	$XT_MULTI ebtables -t $t -L || exit 1
++	$XT_MULTI ebtables -t $t -X || exit 1
++	$XT_MULTI ebtables -t $t -F || exit 1
++done
+ 
+-	$XT_MULTI ebtables -t filter -N FOO || exit 1
+-	$XT_MULTI ebtables -t filter -N FOO
++for t in broute foobar ;do
++	$XT_MULTI ebtables -t $t -L &&
++	$XT_MULTI ebtables -t $t -X &&
++	$XT_MULTI ebtables -t $t -F
+ 	if [ $? -eq 0 ]; then
+-		echo "Duplicate chain FOO"
+-		$XT_MULTI ebtables -t filter -L
++		echo "Expect nonzero return for unsupported table"
+ 		exit 1
+ 	fi
++done
+ 
+-	entries=$(get_entries_count FOO)
+-	if [ $entries -ne 0 ]; then
+-		echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
+-		$XT_MULTI ebtables -L
+-		exit 1
+-	fi
+ 
+-	$XT_MULTI ebtables -A FORWARD -j FOO
+-	entries=$(get_entries_count FORWARD)
+-	if [ $entries -ne 1 ]; then
+-		echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
+-		$XT_MULTI ebtables -L
+-		exit 1
+-	fi
++$XT_MULTI ebtables -t filter -N FOO || exit 1
++$XT_MULTI ebtables -t filter -N FOO
++if [ $? -eq 0 ]; then
++	echo "Duplicate chain FOO"
++	$XT_MULTI ebtables -t filter -L
++	exit 1
++fi
+ 
+-	entries=$(get_entries_count FOO)
+-	if [ $entries -ne 0 ]; then
+-		echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
+-		$XT_MULTI ebtables -L
+-		exit 1
+-	fi
++entries=$(get_entries_count FOO)
++if [ $entries -ne 0 ]; then
++	echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
++	$XT_MULTI ebtables -L
++	exit 1
++fi
+ 
+-	$XT_MULTI ebtables -A FOO -j ACCEPT
+-	entries=$(get_entries_count FOO)
+-	if [ $entries -ne 1 ]; then
+-		echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
+-		$XT_MULTI ebtables -L
+-		exit 1
+-	fi
++$XT_MULTI ebtables -A FORWARD -j FOO
++entries=$(get_entries_count FORWARD)
++if [ $entries -ne 1 ]; then
++	echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
++	$XT_MULTI ebtables -L
++	exit 1
++fi
+ 
+-	$XT_MULTI ebtables -t filter -N BAR || exit 1
+-	$XT_MULTI ebtables -t filter -N BAZ || exit 1
++entries=$(get_entries_count FOO)
++if [ $entries -ne 0 ]; then
++	echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
++	$XT_MULTI ebtables -L
++	exit 1
++fi
+ 
+-	$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
+-	$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
+-	$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
++$XT_MULTI ebtables -A FOO -j ACCEPT
++entries=$(get_entries_count FOO)
++if [ $entries -ne 1 ]; then
++	echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
++	$XT_MULTI ebtables -L
++	exit 1
++fi
+ 
+-	$XT_MULTI ebtables -t filter -L BAZ || exit 1
+-	$XT_MULTI ebtables -t filter -X BAZ || exit 1
+-	$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
+-	if [ $? -eq 0 ]; then
+-		echo "Deleted chain -L BAZ ok, expected failure"
+-		$XT_MULTI ebtables -t filter -L
+-		exit 1
+-	fi
++$XT_MULTI ebtables -t filter -N BAR || exit 1
++$XT_MULTI ebtables -t filter -N BAZ || exit 1
+ 
+-	$XT_MULTI ebtables -t $t -F || exit 0
+-	;;
+-*)
+-	echo "skip $XT_MULTI"
+-	;;
+-esac
++$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
++$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
++
++$XT_MULTI ebtables -t filter -L BAZ || exit 1
++$XT_MULTI ebtables -t filter -X BAZ || exit 1
++$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
++if [ $? -eq 0 ]; then
++	echo "Deleted chain -L BAZ ok, expected failure"
++	$XT_MULTI ebtables -t filter -L
++	exit 1
++fi
++
++$XT_MULTI ebtables -t $t -F || exit 0
+diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+index e18d46551509d..b84f63a7c3672 100755
+--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+@@ -4,7 +4,7 @@ set -e
+ #set -x
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ # fill ebtables manually
+ 
+diff --git a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
+index 62d224134456b..63891c1bb731a 100755
+--- a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
++++ b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ # ebtables-restore reuses preloaded targets and matches, make sure defaults
+ # apply to consecutive rules using the same target/match as a previous one
+diff --git a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
+index 46966f433139a..d52db900604ef 100755
+--- a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
++++ b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ $XT_MULTI ebtables --init-table
+ $XT_MULTI ebtables -A FORWARD -i nodev123 -o nodev432 -j ACCEPT
+diff --git a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
+index 2163d364b318b..0b3acfd7613db 100755
+--- a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
++++ b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ # there is no legacy backend to test
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ EXPECT='*filter
+ :INPUT ACCEPT
+diff --git a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
+index 8bf0c2c6c194e..0174b03f4ebc7 100755
+--- a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
++++ b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
+@@ -231,7 +231,7 @@ for table in nat mangle raw filter;do
+ done
+ 
+ case "$XT_MULTI" in
+-*/xtables-nft-multi)
++*xtables-nft-multi)
+ 	# nft-multi displays chain names in different order, work around this for now
+ 	tmpfile2=$(mktemp)
+ 	sort "$tmpfile" > "$tmpfile2"
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
+index 96a5e66d0ab81..9fc50615b8926 100755
+--- a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
++++ b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
+@@ -86,7 +86,7 @@ if [ $LINES1 -ne $LINES2 ]; then
+ fi
+ 
+ case "$XT_MULTI" in
+-*/xtables-nft-multi)
++*xtables-nft-multi)
+ 	attempts=$((RANDOM%10))
+ 	attempts=$((attempts+1))
+ 	;;
+diff --git a/iptables/tests/shell/testcases/nft-only/0001compat_0 b/iptables/tests/shell/testcases/nft-only/0001compat_0
+index 4319ea5a6a797..a617c52f53695 100755
+--- a/iptables/tests/shell/testcases/nft-only/0001compat_0
++++ b/iptables/tests/shell/testcases/nft-only/0001compat_0
+@@ -5,17 +5,18 @@
+ # xtables: avoid bogus 'is incompatible' warning
+ 
+ case "$XT_MULTI" in
+-*/xtables-nft-multi)
+-	nft -v >/dev/null || exit 0
+-	nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42;  }' || exit 1
+-	nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42;  }' || exit 1
+-
+-	$XT_MULTI iptables -L -t filter || exit 1
+-	$XT_MULTI ip6tables -L -t filter || exit 1
++*xtables-nft-multi)
+ 	;;
+ *)
+ 	echo skip $XT_MULTI
++	exit 0
+ 	;;
+ esac
+ 
++nft -v >/dev/null || exit 0
++nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42;  }' || exit 1
++nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42;  }' || exit 1
++
++$XT_MULTI iptables -L -t filter || exit 1
++$XT_MULTI ip6tables -L -t filter || exit 1
+ exit 0
+diff --git a/iptables/tests/shell/testcases/nft-only/0002invflags_0 b/iptables/tests/shell/testcases/nft-only/0002invflags_0
+index 406b6081a98a4..fe33874dde7f2 100755
+--- a/iptables/tests/shell/testcases/nft-only/0002invflags_0
++++ b/iptables/tests/shell/testcases/nft-only/0002invflags_0
+@@ -2,7 +2,7 @@
+ 
+ set -e
+ 
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ $XT_MULTI iptables -A INPUT -p tcp --dport 53 ! -s 192.168.0.1 -j ACCEPT
+ $XT_MULTI ip6tables -A INPUT -p tcp --dport 53 ! -s feed:babe::1 -j ACCEPT
+diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
+index 67af9fd897410..ccb009e469076 100755
+--- a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
++++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
+@@ -2,7 +2,7 @@
+ 
+ set -e
+ 
+-[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
+ 
+ comment1="foo bar"
+ comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+-- 
+2.27.0
+

0022-nft-Drop-pointless-assignment.patch

@@ -0,0 +1,31 @@
+From 056fc7c35441f666952f4fd1d5cf09a6f83e7b89 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Mon, 17 Feb 2020 12:56:24 +0100
+Subject: [PATCH] nft: Drop pointless assignment
+
+No need to set 'i' to zero here, it is not used before the next
+assignment.
+
+Fixes: 77e6a93d5c9dc ("xtables: add and set "implict" flag on transaction objects")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ef10c1b8fc1e1f4d4019b2df4fcfb93f71430c85)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 0287add3fb21f..eb517e0264e5b 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -2810,7 +2810,6 @@ retry:
+ 
+ 		nft_refresh_transaction(h);
+ 
+-		i=0;
+ 		list_for_each_entry_safe(err, ne, &h->err_list, head)
+ 			mnl_err_list_free(err);
+ 
+-- 
+2.27.0
+

0023-iptables-test.py-Fix-host-mode.patch

@@ -0,0 +1,43 @@
+From 109208e73d7448556e62a29f65b9fc0ef2837b32 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 18 Feb 2020 16:43:16 +0100
+Subject: [PATCH] iptables-test.py: Fix --host mode
+
+In some cases, the script still called repo binaries. Avoid this when in
+--host mode to allow testing without the need to compile sources in
+beforehand.
+
+Fixes: 1b5d762c1865e ("iptables-test: Support testing host binaries")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ba2af278e8836977a8cfb35c54dac60ca9b40000)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables-test.py | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index fdb4e6a3644e4..e986d7a318218 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -119,8 +119,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
+         elif splitted[0] == EBTABLES:
+             command = EBTABLES_SAVE
+ 
+-    path = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE
+-    command = path + " " + command
++    command = EXECUTEABLE + " " + command
+ 
+     if netns:
+             command = "ip netns exec ____iptables-container-test " + command
+@@ -165,7 +164,7 @@ def execute_cmd(cmd, filename, lineno):
+     '''
+     global log_file
+     if cmd.startswith('iptables ') or cmd.startswith('ip6tables ') or cmd.startswith('ebtables ') or cmd.startswith('arptables '):
+-        cmd = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE + " " + cmd
++        cmd = EXECUTEABLE + " " + cmd
+ 
+     print("command: {}".format(cmd), file=log_file)
+     ret = subprocess.call(cmd, shell=True, universal_newlines=True,
+-- 
+2.27.0
+

0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch

@@ -0,0 +1,54 @@
+From e0c60af65b142a3c954a9f489bfdfcb1e09125db Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 4 Mar 2020 02:43:27 +0100
+Subject: [PATCH] connlabel: Allow numeric labels even if connlabel.conf exists
+
+Existing code is a bit quirky: If no connlabel.conf was found, the local
+function connlabel_value_parse() is called which tries to interpret
+given label as a number. If the config exists though,
+nfct_labelmap_get_bit() is called instead which doesn't care about
+"undefined" connlabel names. So unless installed connlabel.conf contains
+entries for all possible numeric labels, rules added by users may stop
+working if a connlabel.conf is created.
+
+Related man page snippet states: "Using a number always overrides
+connlabel.conf", so try numeric parsing and fall back to nfct only if
+that failed.
+
+Fixes: 51340f7b6a110 ("extensions: libxt_connlabel: use libnetfilter_conntrack")
+Fixes: 3a3bb480a738a ("extensions: connlabel: Fallback on missing connlabel.conf")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit f56d91bd80f0e86aaad56a32ddc84f373bb80745)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libxt_connlabel.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/extensions/libxt_connlabel.c b/extensions/libxt_connlabel.c
+index 5a01fe7237bd8..565b8c796b017 100644
+--- a/extensions/libxt_connlabel.c
++++ b/extensions/libxt_connlabel.c
+@@ -70,18 +70,15 @@ static int connlabel_value_parse(const char *in)
+ static void connlabel_mt_parse(struct xt_option_call *cb)
+ {
+ 	struct xt_connlabel_mtinfo *info = cb->data;
+-	bool have_labelmap = !connlabel_open();
+ 	int tmp;
+ 
+ 	xtables_option_parse(cb);
+ 
+ 	switch (cb->entry->id) {
+ 	case O_LABEL:
+-		if (have_labelmap)
++		tmp = connlabel_value_parse(cb->arg);
++		if (tmp < 0 && !connlabel_open())
+ 			tmp = nfct_labelmap_get_bit(map, cb->arg);
+-		else
+-			tmp = connlabel_value_parse(cb->arg);
+-
+ 		if (tmp < 0)
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "label '%s' not found or invalid value",
+-- 
+2.27.0
+

0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch

@@ -0,0 +1,73 @@
+From ceeef92ea4d1ede8f6a2481fae977b9aba443e00 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Mon, 4 May 2020 19:30:29 +0200
+Subject: [PATCH] nft: Fix leaks in ebt_add_policy_rule()
+
+The function leaked memory allocated in temporary struct
+iptables_command_state, clean it immediately after use.
+
+In any of the udata-related error cases, allocated nftnl_rule would
+leak, fix this by introducing a common error path to goto.
+
+In regular code path, the allocated nftnl_rule would still leak:
+batch_obj_del() does not free rules in NFT_COMPAT_RULE_APPEND jobs, as
+they typically sit in cache as well. Policy rules in turn weren't added
+to cache: They are created immediately before commit and never
+referenced from other rules. Add them now so they are freed just like
+regular rules.
+
+Fixes: aff1162b3e4b7 ("ebtables-nft: Support user-defined chain policies")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5fdb447fdfe877bd6236830b4a2507d4d61bc1a1)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index eb517e0264e5b..a5816824f09d6 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -2884,27 +2884,33 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 
+ 	r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
+ 			 nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs);
++	ebt_cs_clean(&cs);
++
+ 	if (!r)
+ 		return -1;
+ 
+ 	udata = nftnl_udata_buf_alloc(NFT_USERDATA_MAXLEN);
+ 	if (!udata)
+-		return -1;
++		goto err_free_rule;
+ 
+ 	if (!nftnl_udata_put_u32(udata, UDATA_TYPE_EBTABLES_POLICY, 1))
+-		return -1;
++		goto err_free_rule;
+ 
+ 	nftnl_rule_set_data(r, NFTNL_RULE_USERDATA,
+ 			    nftnl_udata_buf_data(udata),
+ 			    nftnl_udata_buf_len(udata));
+ 	nftnl_udata_buf_free(udata);
+ 
+-	if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r)) {
+-		nftnl_rule_free(r);
+-		return -1;
+-	}
++	if (!batch_rule_add(h, NFT_COMPAT_RULE_APPEND, r))
++		goto err_free_rule;
++
++	/* add the rule to chain so it is freed later */
++	nftnl_chain_rule_add_tail(r, c);
+ 
+ 	return 0;
++err_free_rule:
++	nftnl_rule_free(r);
++	return -1;
+ }
+ 
+ int ebt_set_user_chain_policy(struct nft_handle *h, const char *table,
+-- 
+2.27.0
+

0026-nft-Fix-leak-when-replacing-a-rule.patch

@@ -0,0 +1,35 @@
+From bb8d1b774e42d56a303f99723410608db3e25ff6 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 6 May 2020 13:33:20 +0200
+Subject: [PATCH] nft: Fix leak when replacing a rule
+
+If nft_rule_append() is called with a reference rule, it is supposed to
+insert the new rule at the reference position and then remove the
+reference from cache. Instead, it removed the new rule from cache again
+right after inserting it. Also, it missed to free the removed rule.
+
+Fixes: 5ca9acf51adf9 ("xtables: Fix position of replaced rules in cache")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b199aca80da5741add50cce244492cc005230b66)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index a5816824f09d6..b5bfcf64e51a4 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1376,7 +1376,8 @@ nft_rule_append(struct nft_handle *h, const char *chain, const char *table,
+ 
+ 	if (ref) {
+ 		nftnl_chain_rule_insert_at(r, ref);
+-		nftnl_chain_rule_del(r);
++		nftnl_chain_rule_del(ref);
++		nftnl_rule_free(ref);
+ 	} else {
+ 		c = nft_chain_find(h, table, chain);
+ 		if (!c) {
+-- 
+2.27.0
+

0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch

@@ -0,0 +1,34 @@
+From 9e2217200016ff23bf8646fbd6119eff5079434e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 20 May 2020 01:00:57 +0200
+Subject: [PATCH] doc: libxt_MARK: OUTPUT chain is fine, too
+
+In order to route packets originating from the host itself based on
+fwmark, mangle table's OUTPUT chain must be used. Mention this chain as
+alternative to PREROUTING.
+
+Fixes: c9be7f153f7bf ("doc: libxt_MARK: no longer restricted to mangle table")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 7f0a69c8fe78da130cc52ea9fc35ffb9cbc2b8ef)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libxt_MARK.man | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/extensions/libxt_MARK.man b/extensions/libxt_MARK.man
+index 712fb76f7340c..b2408597e98f1 100644
+--- a/extensions/libxt_MARK.man
++++ b/extensions/libxt_MARK.man
+@@ -1,7 +1,7 @@
+ This target is used to set the Netfilter mark value associated with the packet.
+ It can, for example, be used in conjunction with routing based on fwmark (needs
+-iproute2). If you plan on doing so, note that the mark needs to be set in the
+-PREROUTING chain of the mangle table to affect routing.
++iproute2). If you plan on doing so, note that the mark needs to be set in
++either the PREROUTING or the OUTPUT chain of the mangle table to affect routing.
+ The mark field is 32 bits wide.
+ .TP
+ \fB\-\-set\-xmark\fP \fIvalue\fP[\fB/\fP\fImask\fP]
+-- 
+2.27.0
+

0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch

@@ -0,0 +1,29 @@
+From e6abc8bc94bcbb2de0784fe9cd3a8fd7560726e5 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 29 May 2020 16:39:31 +0200
+Subject: [PATCH] tests: shell: Fix syntax in
+ ipt-restore/0010-noflush-new-chain_0
+
+The here-doc statement missed the final delimiter. Worked anyways
+because end-of-file would do the trick.
+
+Fixes: a103fbfadf4c1 ("xtables-restore: Fix parser feed from line buffer")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit fe1cfd89c239cb6ce54f0c7b99ec2eb517db5f12)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0   | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+index 739e684a21183..2817376ed913e 100755
+--- a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
++++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
+@@ -8,3 +8,4 @@ $XT_MULTI iptables-restore --noflush <<EOF
+ :foobar - [0:0]
+ -A foobar -j ACCEPT
+ COMMIT
++EOF
+-- 
+2.27.0
+

arptables-nft-helper

@@ -5,12 +5,12 @@ ARPTABLES_CONFIG=/etc/sysconfig/arptables
 # compat for removed initscripts dependency
 
 success() {
-	echo "[  OK  ]"
+	echo -n "[  OK  ]"
 	return 0
 }
 
 failure() {
-	echo "[FAILED]"
+	echo -n "[FAILED]"
 	return 1
 }
 
@@ -21,28 +21,31 @@ start() {
 
 	# don't do squat if we don't have the config file
 	if [ -f $ARPTABLES_CONFIG ]; then
-		printf "Applying arptables firewall rules: "
+		echo -n $"Applying arptables firewall rules: "
 		/usr/sbin/arptables-restore < $ARPTABLES_CONFIG && \
 			success || \
 			failure
+		echo
 		touch /var/lock/subsys/arptables
 	else
 		failure
-		echo "Configuration file /etc/sysconfig/arptables missing"
+		echo
+		echo $"Configuration file /etc/sysconfig/arptables missing"
 		exit 6
 	fi
 }
 
 stop() {
-	printf "Removing user defined chains: "
+	echo -n $"Removing user defined chains:"
 	arptables -X && success || failure
-	printf "Flushing all chains: "
+	echo -n $"Flushing all chains:"
 	arptables -F && success || failure
-	printf "Resetting built-in chains to the default ACCEPT policy: "
+	echo -n $"Resetting built-in chains to the default ACCEPT policy:"
 	arptables -P INPUT ACCEPT && \
 		arptables -P OUTPUT ACCEPT && \
 		success || \
 		failure
+	echo
 	rm -f /var/lock/subsys/arptables
 }
 

arptables.service

@@ -1,12 +0,0 @@
-[Unit]
-Description=Automates a packet filtering firewall with arptables
-After=network.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/arptables-helper start
-ExecStop=/usr/libexec/arptables-helper stop
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target

coreteam-gpg-key-0xD70D1A666ACF2B21.txt

@@ -1,64 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
-o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
-2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
-nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
-P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
-qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
-5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
-ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
-u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
-/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
-cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
-tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
-VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
-CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
-LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
-8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
-5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
-AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
-Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
-VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
-RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
-uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
-zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
-ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
-3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
-iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
-wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
-UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
-M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
-97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
-FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
-IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
-0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
-GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
-bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
-QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
-Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
-3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
-yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
-C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
-klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
-zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
-Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
-X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
-5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
-woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
-njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
-yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
-hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
-BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
-ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
-hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
-tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
-E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
-fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
-CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
-EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
-gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
-9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
-oD8ElPP+m/v6iA==
-=70vD
------END PGP PUBLIC KEY BLOCK-----

ebtables-config

@@ -1,11 +0,0 @@
-# Save current firewall rules on stop.
-#   Value: yes|no,  default: no
-# Saves all firewall rules if firewall gets stopped
-# (e.g. on system shutdown).
-EBTABLES_SAVE_ON_STOP="no"
-
-# Save (and restore) rule counters.
-#   Value: yes|no,  default: no
-# Save rule counters when saving a kernel table to a file. If the
-# rule counters were saved, they will be restored when restoring the table.
-EBTABLES_SAVE_COUNTER="no"

ebtables-helper

@@ -1,102 +0,0 @@
-#!/bin/bash
-
-# compat for removed initscripts dependency
-
-success() {
-       echo "[  OK  ]"
-       return 0
-}
-
-failure() {
-       echo "[FAILED]"
-       return 1
-}
-
-# internal variables
-EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
-EBTABLES_DATA=/etc/sysconfig/ebtables
-EBTABLES_TABLES="broute filter nat"
-VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
-
-# ebtables-config defaults
-EBTABLES_SAVE_ON_STOP="no"
-EBTABLES_SAVE_ON_RESTART="no"
-EBTABLES_SAVE_COUNTER="no"
-
-# load config if existing
-[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
-
-initialize() {
-	local ret=0
-	for table in $EBTABLES_TABLES; do
-		ebtables -t $table --init-table || ret=1
-	done
-	return $ret
-}
-
-sanitize_dump() {
-	local drop=false
-
-	export EBTABLES_TABLES
-
-	cat $1 | while read line; do
-		case $line in
-		\**)
-			drop=false
-			local table="${line#\*}"
-			local found=false
-			for t in $EBTABLES_TABLES; do
-				if [[ $t == $table ]]; then
-					found=true
-					break
-				fi
-			done
-			$found || drop=true
-			;;
-		esac
-		$drop || echo "$line"
-	done
-}
-
-start() {
-	if [ -f $EBTABLES_DATA ]; then
-		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
-		sanitize_dump $EBTABLES_DATA | ebtables-restore
-	else
-		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
-		initialize
-	fi
-	local ret=$?
-	touch $VAR_SUBSYS_EBTABLES
-	return $ret
-}
-
-save() {
-	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
-	export EBTABLES_SAVE_COUNTER
-	ebtables-save >$EBTABLES_DATA && success || failure
-}
-
-case $1 in
-	start)
-		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
-		start && success || failure
-		RETVAL=$?
-		;;
-	stop)
-		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
-		echo -n $"ebtables: stopping firewall: "
-		initialize && success || failure
-		RETVAL=$?
-		rm -f $VAR_SUBSYS_EBTABLES
-		;;
-	save)
-		save
-		;;
-	*)
-		echo "usage: ${0##*/} {start|stop|save}" >&2
-		RETVAL=2
-		;;
-esac
-
-exit $RETVAL

ebtables.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=Ethernet Bridge Filtering tables
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/libexec/ebtables-helper start
-ExecStop=/usr/libexec/ebtables-helper stop
-
-[Install]
-WantedBy=multi-user.target

iptables-1.8.11-command-options-fix.patch

@@ -1,27 +0,0 @@
-commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
-Author: Phil Sutter <phil@nwl.cc>
-Date:   Wed Apr 23 12:36:13 2025 +0200
-
-    xshared: Accept an option if any given command allows it
-    
-    Fixed commit made option checking overly strict: Some commands may be
-    commbined (foremost --list and --zero), reject a given option only if it
-    is not allowed by any of the given commands.
-    
-    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
-    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
-    Signed-off-by: Phil Sutter <phil@nwl.cc>
-
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index cdfd11ab..fc61e0fd 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
- 	 */
- 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
- 		if ((options & optval) &&
--		    (options_v_commands[i] & command) != command)
-+		    !(options_v_commands[i] & command))
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "Illegal option `%s' with this command",
- 				      ops->option_name(optval));

iptables-1.8.11-fix-interface-comparisons.patch

@@ -1,172 +0,0 @@
-From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
-From: Jeremy Sowden <jeremy@azazel.net>
-Date: Mon, 18 Nov 2024 13:56:50 +0000
-Subject: nft: fix interface comparisons in `-C` commands
-
-Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
-kernel") removed code which explicitly set interface masks to all ones.  The
-result of this is that they are zero.  However, they are used to mask interfaces
-in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
-comparisons are always true, and check commands which ought to fail succeed:
-
-  # iptables -N test
-  # iptables -A test -i lo \! -o lo -j REJECT
-  # iptables -v -L test
-  Chain test (0 references)
-   pkts bytes target     prot opt in     out     source               destination
-      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
-  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
-  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
-
-Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
-
-Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
-Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
----
- iptables/nft-arp.c                                 | 10 ++----
- iptables/nft-ipv4.c                                |  4 +--
- iptables/nft-ipv6.c                                |  6 +---
- iptables/nft-shared.c                              | 36 +++++-----------------
- iptables/nft-shared.h                              |  6 +---
- .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
- 6 files changed, 22 insertions(+), 49 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 264864c3..c11d64c3 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
- 		return false;
- 	}
- 
--	return is_same_interfaces(a->arp.iniface,
--				  a->arp.outiface,
--				  (unsigned char *)a->arp.iniface_mask,
--				  (unsigned char *)a->arp.outiface_mask,
--				  b->arp.iniface,
--				  b->arp.outiface,
--				  (unsigned char *)b->arp.iniface_mask,
--				  (unsigned char *)b->arp.outiface_mask);
-+	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
-+				  b->arp.iniface, b->arp.outiface);
- }
- 
- static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index 74092875..0c8bd291 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
- 	}
- 
- 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
--				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
--				  b->fw.ip.iniface, b->fw.ip.outiface,
--				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
-+				  b->fw.ip.iniface, b->fw.ip.outiface);
- }
- 
- static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
-diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index b184f8af..4dbb2af2 100644
---- a/iptables/nft-ipv6.c
-+++ b/iptables/nft-ipv6.c
-@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
- 	}
- 
- 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
--				  a->fw6.ipv6.iniface_mask,
--				  a->fw6.ipv6.outiface_mask,
--				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
--				  b->fw6.ipv6.iniface_mask,
--				  b->fw6.ipv6.outiface_mask);
-+				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
- }
- 
- static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 6775578b..2c29e68f 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
- }
- 
- bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
--			unsigned const char *a_iniface_mask,
--			unsigned const char *a_outiface_mask,
--			const char *b_iniface, const char *b_outiface,
--			unsigned const char *b_iniface_mask,
--			unsigned const char *b_outiface_mask)
-+			const char *b_iniface, const char *b_outiface)
- {
--	int i;
--
--	for (i = 0; i < IFNAMSIZ; i++) {
--		if (a_iniface_mask[i] != b_iniface_mask[i]) {
--			DEBUGP("different iniface mask %x, %x (%d)\n",
--			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
--			return false;
--		}
--		if ((a_iniface[i] & a_iniface_mask[i])
--		    != (b_iniface[i] & b_iniface_mask[i])) {
--			DEBUGP("different iniface\n");
--			return false;
--		}
--		if (a_outiface_mask[i] != b_outiface_mask[i]) {
--			DEBUGP("different outiface mask\n");
--			return false;
--		}
--		if ((a_outiface[i] & a_outiface_mask[i])
--		    != (b_outiface[i] & b_outiface_mask[i])) {
--			DEBUGP("different outiface\n");
--			return false;
--		}
-+	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
-+		DEBUGP("different iniface\n");
-+		return false;
-+	}
-+	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
-+		DEBUGP("different outiface\n");
-+		return false;
- 	}
--
- 	return true;
- }
- 
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 51d1e460..b57aee1f 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
- void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
- 
- bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
--			unsigned const char *a_iniface_mask,
--			unsigned const char *a_outiface_mask,
--			const char *b_iniface, const char *b_outiface,
--			unsigned const char *b_iniface_mask,
--			unsigned const char *b_outiface_mask);
-+			const char *b_iniface, const char *b_outiface);
- 
- void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
- void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
-diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
-new file mode 100755
-index 00000000..278cd648
---- /dev/null
-+++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
-@@ -0,0 +1,9 @@
-+#!/bin/bash
-+
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+
-+$XT_MULTI iptables -N test
-+$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
-+$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
-+
-+exit 0
--- 
-cgit v1.2.3
-

iptables.init

@@ -55,6 +55,11 @@ if [ ! -x /sbin/$IPTABLES ]; then
     exit 5
 fi
 
+# Old or new modutils
+/sbin/modprobe --version 2>&1 | grep -q 'kmod version' \
+    && NEW_MODUTILS=1 \
+    || NEW_MODUTILS=0
+
 # Default firewall configuration:
 IPTABLES_MODULES=""
 IPTABLES_SAVE_ON_STOP="no"
@@ -70,33 +75,13 @@ IPTABLES_RESTORE_WAIT_INTERVAL=1000000
 # Load firewall configuration.
 [ -f "$IPTABLES_CONFIG" ] && . "$IPTABLES_CONFIG"
 
-is_iptables_nft() {
-	iptables --version | grep -q '(nf_tables)'
-}
-
-netfilter_active() {
-	is_iptables_nft && return 0
-	[ -e "$PROC_IPTABLES_NAMES" ]
-}
-
-netfilter_tables() {
-	netfilter_active || return 1
-	is_iptables_nft && {
-		# explicitly omit security table from this list as
-		# it should be reserved for SELinux use
-		echo "raw mangle filter nat"
-		return 0
-	}
-	cat "$PROC_IPTABLES_NAMES" 2>/dev/null
-}
-
 # Get active tables
-NF_TABLES=$(netfilter_tables)
+NF_TABLES=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
 
 
 flush_n_delete() {
     # Flush firewall rules and delete chains.
-    netfilter_active || return 0
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
 
     # Check if firewall is configured (has tables)
     [ -z "$NF_TABLES" ] && return 1
@@ -128,10 +113,10 @@ set_policy() {
     policy=$1
 
     # Check if iptable module is loaded
-    netfilter_active || return 0
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
 
     # Check if firewall is configured (has tables)
-    tables=$(netfilter_tables)
+    tables=$(cat "$PROC_IPTABLES_NAMES" 2>/dev/null)
     [ -z "$tables" ] && return 1
 
     echo -n $"${IPTABLES}: Setting chains to policy $policy: "
@@ -181,7 +166,7 @@ load_sysctl() {
         echo -n $"Loading sysctl settings: "
         ret=0
         for item in $IPTABLES_SYSCTL_LOAD_LIST; do
-            fgrep -hs $item /etc/sysctl.d/*.conf | sysctl -p - >/dev/null
+            fgrep -hs $item /etc/sysctl.d/* | sysctl -p - >/dev/null
             let ret+=$?;
         done
         [ $ret -eq 0 ] && success || failure
@@ -232,7 +217,7 @@ start() {
 	    return 1
 	fi
     fi
- 
+    
     # Load additional modules (helpers)
     if [ -n "$IPTABLES_MODULES" ]; then
 	echo -n $"${IPTABLES}: Loading additional modules: "
@@ -245,7 +230,7 @@ start() {
 	[ $ret -eq 0 ] && success || failure
 	echo
     fi
- 
+    
     # Load sysctl settings
     load_sysctl
 
@@ -255,7 +240,7 @@ start() {
 
 stop() {
     # Do not stop if iptables module is not loaded.
-    netfilter_active || return 0
+    [ ! -e "$PROC_IPTABLES_NAMES" ] && return 0
 
     # Set default chain policy to ACCEPT, in order to not break shutdown
     # on systems where the default policy is DROP and root device is
@@ -263,14 +248,14 @@ stop() {
     set_policy ACCEPT
     # And then, flush the rules and delete chains
     flush_n_delete
-
+    
     rm -f $VAR_SUBSYS_IPTABLES
     return $ret
 }
 
 save() {
     # Check if iptable module is loaded
-    if ! netfilter_active; then
+    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
 	echo -n $"${IPTABLES}: Nothing to save."; warning; echo
 	return 0
     fi
@@ -313,7 +298,7 @@ save() {
 }
 
 status() {
-    if [ ! -f "$VAR_SUBSYS_IPTABLES" ]; then
+    if [ ! -f "$VAR_SUBSYS_IPTABLES" -a -z "$NF_TABLES" ]; then
 	echo $"${IPTABLES}: Firewall is not running."
 	return 3
     fi
@@ -321,7 +306,7 @@ status() {
     # Do not print status if lockfile is missing and iptables modules are not 
     # loaded.
     # Check if iptable modules are loaded
-    if ! netfilter_active; then
+    if [ ! -e "$PROC_IPTABLES_NAMES" ]; then
 	echo $"${IPTABLES}: Firewall modules are not loaded."
 	return 3
     fi
@@ -334,7 +319,7 @@ status() {
 
     NUM=
     [ "x$IPTABLES_STATUS_NUMERIC" = "xyes" ] && NUM="-n"
-    VERBOSE=
+    VERBOSE= 
     [ "x$IPTABLES_STATUS_VERBOSE" = "xyes" ] && VERBOSE="--verbose"
     COUNT=
     [ "x$IPTABLES_STATUS_LINENUMBERS" = "xyes" ] && COUNT="--line-numbers"

iptables.service

@@ -1,8 +1,7 @@
 [Unit]
 Description=IPv4 firewall with iptables
+After=syslog.target
 AssertPathExists=/etc/sysconfig/iptables
-Before=network-pre.target
-Wants=network-pre.target
 
 [Service]
 Type=oneshot
@@ -12,6 +11,8 @@ ExecReload=/usr/libexec/iptables/iptables.init reload
 ExecStop=/usr/libexec/iptables/iptables.init stop
 Environment=BOOTUP=serial
 Environment=CONSOLETYPE=serial
+StandardOutput=syslog
+StandardError=syslog
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=basic.target

iptables.spec

@@ -4,41 +4,70 @@
 # service legacy actions (RHBZ#748134)
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 
+# Bootstrap mode providing old and new versions of libip{4,6}tc in parallel
+%global bootstrap 0
+
+%if 0%{?bootstrap}
+%global version_old      1.8.2
+%global iptc_so_ver_old  0
+%global ipXtc_so_ver_old 0
+%endif
 %global iptc_so_ver  0
 %global ipXtc_so_ver 2
 
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
-URL: https://www.netfilter.org/projects/iptables
-Version: 1.8.11
-Release: 12%{?dist}
-Source0: %{url}/files/%{name}-%{version}.tar.xz
-source1: %{url}/files/%{name}-%{version}.tar.xz.sig
-Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
-Source3: iptables.init
-Source4: iptables-config
-Source5: iptables.service
-Source6: sysconfig_iptables
-Source7: sysconfig_ip6tables
-Source8: arptables-helper
-Source9: arptables.service
-Source10: ebtables.service
-Source11: ebtables-helper
-Source12: ebtables-config
-# Patch to fix -C handling, already upstream
-# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
-Patch1: iptables-1.8.11-fix-interface-comparisons.patch
-# Patch to fix overly strict command option checking
-# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
-Patch2: iptables-1.8.11-command-options-fix.patch
+URL: http://www.netfilter.org/projects/iptables
+Version: 1.8.4
+Release: 9%{?dist}
+Source: %{url}/files/%{name}-%{version}.tar.bz2
+Source1: iptables.init
+Source2: iptables-config
+Source3: iptables.service
+Source4: sysconfig_iptables
+Source5: sysconfig_ip6tables
+Source6: arptables-nft-helper
+%if 0%{?bootstrap}
+Source7: %{url}/files/%{name}-%{version_old}.tar.bz2
+Source8: 0002-extensions-format-security-fixes-in-libip-6-t_icmp.patch
+%endif
+
+Patch1: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
+Patch2: 0002-Fix-DEBUG-build.patch
+Patch3: 0003-xtables-restore-Fix-parser-feed-from-line-buffer.patch
+Patch4: 0004-xtables-restore-Avoid-access-of-uninitialized-data.patch
+Patch5: 0005-extensions-time-Avoid-undefined-shift.patch
+Patch6: 0006-extensions-cluster-Avoid-undefined-shift.patch
+Patch7: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch
+Patch8: 0008-extensions-among-Check-call-to-fstat.patch
+Patch9: 0009-xtables-restore-fix-for-noflush-and-empty-lines.patch
+Patch10: 0010-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch
+Patch11: 0011-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch
+Patch12: 0012-xtables-translate-Fix-for-interface-name-corner-case.patch
+Patch13: 0013-xtables-translate-Fix-for-iface.patch
+Patch14: 0014-xtables-Review-nft_init.patch
+Patch15: 0015-nft-cache-Fix-nft_release_cache-under-stress.patch
+Patch16: 0016-nft-cache-Fix-iptables-save-segfault-under-stress.patch
+Patch17: 0017-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
+Patch18: 0018-nfnl_osf-Improve-error-handling.patch
+Patch19: 0019-nft-cache-Reset-genid-when-rebuilding-cache.patch
+Patch20: 0020-nft-Fix-command-name-in-ip6tables-error-message.patch
+Patch21: 0021-tests-shell-Fix-skip-checks-with-host-mode.patch
+Patch22: 0022-nft-Drop-pointless-assignment.patch
+Patch23: 0023-iptables-test.py-Fix-host-mode.patch
+Patch24: 0024-connlabel-Allow-numeric-labels-even-if-connlabel.con.patch
+Patch25: 0025-nft-Fix-leaks-in-ebt_add_policy_rule.patch
+Patch26: 0026-nft-Fix-leak-when-replacing-a-rule.patch
+Patch27: 0027-doc-libxt_MARK-OUTPUT-chain-is-fine-too.patch
+Patch28: 0028-tests-shell-Fix-syntax-in-ipt-restore-0010-noflush-n.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
-License: GPL-2.0-only AND Artistic-2.0 AND ISC
+License: GPLv2 and Artistic Licence 2.0 and ISC
 
 # libnetfilter_conntrack is needed for xt_connlabel
 BuildRequires: pkgconfig(libnetfilter_conntrack)
-# libnfnetlink-devel is required for nfnl_osf
+# libnfnetlink-devel is requires for nfnl_osf
 BuildRequires: pkgconfig(libnfnetlink)
 BuildRequires: libselinux-devel
 BuildRequires: kernel-headers
@@ -48,80 +77,45 @@ BuildRequires: bison
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: pkgconfig(libmnl) >= 1.0
-BuildRequires: pkgconfig(libnftnl) >= 1.2.6
+BuildRequires: pkgconfig(libnftnl) >= 1.1.5
 # libpcap-devel for nfbpf_compile
 BuildRequires: libpcap-devel
+BuildRequires: autogen
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
-BuildRequires: make
-BuildRequires: gnupg2
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
+%if 0%{?fedora} > 24
+Conflicts: setup < 2.10.4-1
+%endif
+Requires(post): %{_sbindir}/update-alternatives
+Requires(postun): %{_sbindir}/update-alternatives
 
 %description
 The iptables utility controls the network packet filtering code in the
 Linux kernel. If you need to set up firewalls and/or IP masquerading,
 you should install this package.
 
-%package legacy
-Summary: Legacy tools for managing Linux kernel packet filtering capabilities
-Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
-Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-Conflicts: setup < 2.10.4-1
-Conflicts: alternatives < 1.32-1
-Requires(post): /usr/sbin/update-alternatives
-Requires(postun): /usr/sbin/update-alternatives
-%if 0%{?rhel} < 9
-Provides:	iptables
-%endif
-Provides:  %{name}-compat = %{version}-%{release}
-Obsoletes: %{name}-compat < 1.8.9-7
-
-%sbin_merge_compat %{_prefix}/sbin/iptables
-
-%description legacy
-The iptables utility controls the network packet filtering code in the
-Linux kernel. This package contains the legacy tools which are obsoleted by
-nft-variants in iptables-nft package for backwards compatibility reasons.
-If you need to set up firewalls and/or IP masquerading, you should not install
-this package but either nftables or iptables-nft instead.
-
 %package libs
-Summary: libxtables and iptables extensions userspace support
+Summary: iptables libraries
 
 %description libs
-libxtables and associated shared object files
-
-Libxtables provides unified access to iptables extensions in userspace. Data
-and logic for those is kept in per-extension shared object files.
-
-%package legacy-libs
-Summary: iptables legacy libraries
-
-%description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real
-so version. For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real so version.
+
+For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
+
 %package devel
 Summary: Development package for iptables
-Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-# XXX: Drop this after two releases or so
-Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release}
+Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %description devel
-libxtables development headers and pkgconfig files
-
-%package legacy-devel
-Summary: Development package for legacy iptables
-Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
-Requires: pkgconfig
-
-%description legacy-devel
-Legacy iptables development headers and pkgconfig files
+iptables development headers and libraries.
 
 The iptc libraries are marked as not public by upstream. The interface is not
 stable and may change with every new version. It is therefore unsupported.
@@ -129,21 +123,11 @@ stable and may change with every new version. It is therefore unsupported.
 %package services
 Summary: iptables and ip6tables services for iptables
 Requires: %{name} = %{version}-%{release}
-Requires: %{name}-utils = %{version}-%{release}
 %{?systemd_ordering}
 # obsolete old main package
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
-# Look at me, I'm the new arptables-services now!
-Conflicts: %{name}-nft < 1.8.11-5
-Obsoletes: arptables-services < 0.0.5-16
-Provides: arptables-services = %{version}-%{release}
-# Look at me, I'm the new ebtables-services now!
-# (With epoch to turn our version number higher value)
-Obsoletes: ebtables-services < 2.0.11-20
-Provides: ebtables-services = 1:%{version}-%{release}
-BuildArch: noarch
 
 %description services
 iptables services for IPv4 and IPv6
@@ -152,40 +136,38 @@ This package provides the services iptables and ip6tables that have been split
 out of the base package since they are not active by default anymore.
 
 %package utils
-Summary: iptables and ip6tables misc utilities
+Summary: iptables and ip6tables services for iptables
 Requires: %{name} = %{version}-%{release}
 
 %description utils
 Utils for iptables
 
 This package provides nfnl_osf with the pf.os database and nfbpf_compile,
-a bytecode generator for use with xt_bpf. Also included is iptables-apply,
-a safer way to update iptables remotely.
+a bytecode generator for use with xt_bpf.
 
 %package nft
 Summary: nftables compatibility for iptables, arptables and ebtables
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-Requires(post): /usr/sbin/update-alternatives
-Requires(post): /usr/bin/readlink
-Requires(postun): /usr/sbin/update-alternatives
 Obsoletes: iptables-compat < 1.6.2-4
 Provides: arptables-helper
 Provides: iptables
 Provides: arptables
 Provides: ebtables
-# allowing old arptables-legacy will break when switching alternatives
-# due to the dropped arptables-helper symlink
-Conflicts: arptables-legacy < 0.0.5-16
-
-%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description nft
 nftables compatibility for iptables, arptables and ebtables.
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
 
+%if 0%{?bootstrap}
+%{__mkdir} -p bootstrap_ver
+pushd bootstrap_ver
+%{__tar} --strip-components=1 -xf %{SOURCE7}
+%{__patch} -p1 <%{SOURCE8}
+popd
+%endif
+
 %build
 ./autogen.sh
 CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
@@ -197,33 +179,62 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 
 rm -f include/linux/types.h
 
-%make_build
+make %{?_smp_mflags}
+
+%if 0%{?bootstrap}
+pushd bootstrap_ver
+./autogen.sh
+CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
+%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
+
+# do not use rpath
+sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
+sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
+
+rm -f include/linux/types.h
+
+make %{?_smp_mflags}
+popd
+%endif
 
 %install
-%make_install
+%if 0%{?bootstrap}
+%make_install -C bootstrap_ver
+%{_bindir}/find %{buildroot} -xtype f -not \
+	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
+%{_bindir}/find %{buildroot} -type l -not \
+	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
+%endif
+
+make install DESTDIR=%{buildroot}
 # remove la file(s)
-rm -f %{buildroot}%{_libdir}/*.la
+rm -f %{buildroot}/%{_libdir}/*.la
+
+# install ip*tables.h header files
+install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/
+install -d -m 755 %{buildroot}%{_includedir}/iptables
+install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/
+
+# install ipulog header file
+install -d -m 755 %{buildroot}%{_includedir}/libipulog/
+install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/
 
 # install init scripts and configuration files
 install -d -m 755 %{buildroot}%{script_path}
-install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
+install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
-install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
-install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
+install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
-install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
-install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
-echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
-install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
-touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
+install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables
+install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
-sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
+install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}
+sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
 # install legacy actions for service command
@@ -246,447 +257,230 @@ chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic
 sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy
 install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic
 
+# install iptables-apply with man page
+install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/
+install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/
+
+%if 0%{?fedora} > 24
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
+%endif
+
+install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/
+touch %{buildroot}%{_libexecdir}/arptables-helper
 
 # prepare for alternatives
 touch %{buildroot}%{_mandir}/man8/arptables.8
 touch %{buildroot}%{_mandir}/man8/arptables-save.8
 touch %{buildroot}%{_mandir}/man8/arptables-restore.8
 touch %{buildroot}%{_mandir}/man8/ebtables.8
-rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
-touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
-
-# fix absolute symlink
-ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
 
 %ldconfig_scriptlets
 
-%post legacy
+%post
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-update-alternatives --install \
+%{_sbindir}/update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--follower $pfx6 ip6tables $pfx6-legacy \
-	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
-	--follower $pfx-save iptables-save $pfx-legacy-save \
-	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+	--slave $pfx6 ip6tables $pfx6-legacy \
+	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
+	--slave $pfx-save iptables-save $pfx-legacy-save \
+	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
 
-%if "%{_sbindir}" == "%{_bindir}"
-# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
-# directory. Those symlinks will only be created if there is no symlink
-# or file already.
-for name in ip{,6}tables{,-save,-restore}; do
-    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
-done
-%endif
-
-%postun legacy
+%postun
 if [ $1 -eq 0 ]; then
-	update-alternatives --remove \
+	%{_sbindir}/update-alternatives --remove \
 		iptables %{_sbindir}/iptables-legacy
 fi
 
-# iptables-1.8.0-1 introduced the use of alternatives
-# when upgrading, its %postun script runs due to the package renaming
-# fix this by repeating the install into alternatives
-# also keep the old alternatives configuration to not change the system
-%triggerun legacy -- iptables > 1.8.0
-alternatives --list | awk '/^iptables/{print $3; exit}' \
-		>/var/tmp/alternatives.iptables.current
-cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
-
-%triggerpostun legacy -- iptables > 1.8.0
-pfx=%{_sbindir}/iptables
-pfx6=%{_sbindir}/ip6tables
-update-alternatives --install \
-	$pfx iptables $pfx-legacy 10 \
-	--follower $pfx6 ip6tables $pfx6-legacy \
-	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
-	--follower $pfx-save iptables-save $pfx-legacy-save \
-	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
-alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
-rm /var/tmp/alternatives.iptables.current
-mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
-# directory. Those symlinks will only be created if there is no symlink
-# or file already.
-for name in ip{,6}tables{,-save,-restore}; do
-    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
-done
-%endif
-
 %post services
-%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
-%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
 %?ldconfig
-%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
-%post -e nft
-[[ %%{_excludedocs} == 1 ]] || do_man=true
-
-# remove non-symlinks in spots managed by alternatives
-# to cover for updates from not-yet-alternatived versions
-for pfx in %{_prefix}/sbin/{eb,arp}tables; do
-	for sfx in "" "-restore" "-save"; do
-		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-			rm -f $pfx$sfx
-		fi
-	done
-done
-for manpfx in %{_mandir}/man8/{eb,arp}tables; do
-	for sfx in {,-restore,-save}.8.gz; do
-		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
-			rm -f $manpfx$sfx
-		fi
-	done
-done
-
+%post nft
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-update-alternatives --install \
+%{_sbindir}/update-alternatives --install \
 	$pfx iptables $pfx-nft 10 \
-	--follower $pfx6 ip6tables $pfx6-nft \
-	--follower $pfx-restore iptables-restore $pfx-nft-restore \
-	--follower $pfx-save iptables-save $pfx-nft-save \
-	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
-	--follower $pfx6-save ip6tables-save $pfx6-nft-save
+	--slave $pfx6 ip6tables $pfx6-nft \
+	--slave $pfx-restore iptables-restore $pfx-nft-restore \
+	--slave $pfx-save iptables-save $pfx-nft-save \
+	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--slave $pfx6-save ip6tables-save $pfx6-nft-save
 
 pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
-update-alternatives --install \
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+done
+if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
+	rm -f $manpfx.8.gz
+fi
+%{_sbindir}/update-alternatives --install \
 	$pfx ebtables $pfx-nft 10 \
-	--follower $pfx-save ebtables-save $pfx-nft-save \
-	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
-	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
+	--slave $pfx-save ebtables-save $pfx-nft-save \
+	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
+	--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz
 
 pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
-update-alternatives --install \
-	$pfx arptables $pfx-nft 10 \
-	--follower $pfx-save arptables-save $pfx-nft-save \
-	--follower $pfx-restore arptables-restore $pfx-nft-restore \
-	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
-	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
-	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
-# directory. Those symlinks will only be created if there is no symlink
-# or file already.
-for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
-    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+lepfx=%{_libexecdir}/arptables
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
+		rm -f $manpfx$sfx.8.gz
+	fi
 done
-%endif
+if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
+	rm -f $lepfx-helper
+fi
+%{_sbindir}/update-alternatives --install \
+	$pfx arptables $pfx-nft 10 \
+	--slave $pfx-save arptables-save $pfx-nft-save \
+	--slave $pfx-restore arptables-restore $pfx-nft-restore \
+	--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \
+	--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \
+	--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \
+	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
 
 %postun nft
 if [ $1 -eq 0 ]; then
 	for cmd in iptables ebtables arptables; do
-		update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
+		%{_sbindir}/update-alternatives --remove \
+			$cmd %{_sbindir}/$cmd-nft
 	done
 fi
 
-%files legacy
-%{_sbindir}/ip{,6}tables-legacy*
+%files
+%{!?_licensedir:%global license %%doc}
+%license COPYING
+%doc INCOMPATIBILITIES
+%if 0%{?fedora} <= 24
+%{_sysconfdir}/ethertypes
+%endif
+%{_sbindir}/iptables-apply
+%{_sbindir}/iptables-legacy*
+%{_sbindir}/ip6tables-legacy*
 %{_sbindir}/xtables-legacy-multi
 %{_bindir}/iptables-xml
 %{_mandir}/man1/iptables-xml*
+%{_mandir}/man8/iptables*
+%{_mandir}/man8/ip6tables*
 %{_mandir}/man8/xtables-legacy*
-%dir %{_datadir}/xtables
-%{_datadir}/xtables/iptables.xslt
-%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/iptables
+%ghost %{_sbindir}/iptables-restore
+%ghost %{_sbindir}/iptables-save
+%ghost %{_sbindir}/ip6tables
+%ghost %{_sbindir}/ip6tables-restore
+%ghost %{_sbindir}/ip6tables-save
 
 %files libs
-%license COPYING
+%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
+%if 0%{?bootstrap}
+%{_libdir}/libiptc.so.%{iptc_so_ver_old}*
+%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver_old}*
+%endif
 %{_libdir}/libxtables.so.12*
 %dir %{_libdir}/xtables
-%{_libdir}/xtables/lib{ip,ip6,x}t*
-%{_mandir}/man8/ip{,6}tables.8.gz
-%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz
-
-%files legacy-libs
-%license COPYING
-%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*
+%{_libdir}/xtables/libipt*
+%{_libdir}/xtables/libip6t*
+%{_libdir}/xtables/libxt*
 
 %files devel
-%{_includedir}/xtables{,-version}.h
-%{_libdir}/libxtables.so
-%{_libdir}/pkgconfig/xtables.pc
-
-%files legacy-devel
+%dir %{_includedir}/iptables
+%{_includedir}/iptables/*.h
+%{_includedir}/*.h
 %dir %{_includedir}/libiptc
 %{_includedir}/libiptc/*.h
+%dir %{_includedir}/libipulog
+%{_includedir}/libipulog/*.h
 %{_libdir}/libip*tc.so
-%{_libdir}/pkgconfig/libip{,4,6}tc.pc
+%{_libdir}/libxtables.so
+%{_libdir}/pkgconfig/libiptc.pc
+%{_libdir}/pkgconfig/libip4tc.pc
+%{_libdir}/pkgconfig/libip6tc.pc
+%{_libdir}/pkgconfig/xtables.pc
 
 %files services
 %dir %{script_path}
-%{script_path}/ip{,6}tables.init
-%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
-%config(noreplace) %{_sysconfdir}/sysconfig/arptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
-%ghost %{_sysconfdir}/sysconfig/ebtables
-%{_unitdir}/{arp,eb,ip,ip6}tables.service
-%dir %{legacy_actions}/ip{,6}tables
-%{legacy_actions}/ip{,6}tables/{save,panic}
-%{_libexecdir}/{arp,eb}tables-helper
+%{script_path}/iptables.init
+%{script_path}/ip6tables.init
+%config(noreplace) %{_sysconfdir}/sysconfig/iptables
+%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables
+%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config
+%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config
+%{_unitdir}/iptables.service
+%{_unitdir}/ip6tables.service
+%dir %{legacy_actions}/iptables
+%{legacy_actions}/iptables/save
+%{legacy_actions}/iptables/panic
+%dir %{legacy_actions}/ip6tables
+%{legacy_actions}/ip6tables/save
+%{legacy_actions}/ip6tables/panic
 
 %files utils
-%license COPYING
 %{_sbindir}/nfnl_osf
 %{_sbindir}/nfbpf_compile
-%{_sbindir}/ip{,6}tables-apply
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/pf.os
 %{_mandir}/man8/nfnl_osf*
 %{_mandir}/man8/nfbpf_compile*
-%{_mandir}/man8/ip{,6}tables-apply*
 
 %files nft
-%{_sbindir}/ip{,6}tables-nft*
-%{_sbindir}/ip{,6}tables{,-restore}-translate
-%{_sbindir}/{eb,arp}tables-nft*
+%{_sbindir}/iptables-nft*
+%{_sbindir}/iptables-restore-translate
+%{_sbindir}/iptables-translate
+%{_sbindir}/ip6tables-nft*
+%{_sbindir}/ip6tables-restore-translate
+%{_sbindir}/ip6tables-translate
+%{_sbindir}/ebtables-nft*
+%{_sbindir}/arptables-nft*
 %{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
-%{_sbindir}/ebtables-translate
-%{_sbindir}/arptables-translate
 %dir %{_libdir}/xtables
-%{_libdir}/xtables/lib{arp,eb}t*
+%{_libdir}/xtables/libarpt*
+%{_libdir}/xtables/libebt*
+%{_libexecdir}/arptables-nft-helper
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
-%{_mandir}/man8/ip{,6}tables{,-restore}-translate*
-%{_mandir}/man8/ebtables-translate*
-%{_mandir}/man8/arptables-translate*
-%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
-%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
-%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
+%ghost %{_sbindir}/iptables
+%ghost %{_sbindir}/iptables-restore
+%ghost %{_sbindir}/iptables-save
+%ghost %{_sbindir}/ip6tables
+%ghost %{_sbindir}/ip6tables-restore
+%ghost %{_sbindir}/ip6tables-save
+%ghost %{_sbindir}/ebtables
+%ghost %{_sbindir}/ebtables-save
+%ghost %{_sbindir}/ebtables-restore
+%ghost %{_sbindir}/arptables
+%ghost %{_sbindir}/arptables-save
+%ghost %{_sbindir}/arptables-restore
+%ghost %{_libexecdir}/arptables-helper
+%ghost %{_mandir}/man8/arptables.8.gz
+%ghost %{_mandir}/man8/arptables-save.8.gz
+%ghost %{_mandir}/man8/arptables-restore.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
-* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
-- Pull in upstream fix for too strict command option parsing
+* Tue Aug 25 03:32:14 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-9
+- Fix for wrong prefix in ip6tables error messages
+- Add further fixes from upstream
 
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
-- Fix for ghost files not present in iptables-nft RPM
-
-* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
-- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
-  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
-
-* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
-- Revert last release, it breaks alternatives symlinks
-
-* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
-- Keep symlinks managed by alternatives under /usr/bin
-
-* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
-- Add patch to fix -C handling ( fixes rhbz#2360423 )
-
-* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
-- iptables-services to assimilate arptables- and ebtables-services
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
-- Keep symlinks managed by alternatives under /usr/sbin
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
-- new version
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-14
-- Add unmerged-sbin compat also for -legacy subpackage
-
-* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-13
-- Bump release and add changelog entry
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-12
-- Rebuilt for the bin-sbin merge
-
-* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-11
-- Add missing build dependency
-
-* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-10
-- Verify tarball GPG signature
-
-* Wed Jul 03 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-9
-- Backport fixes from upstream
-
-* Tue May 21 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-8
-- Make iptables-legacy own %%{_datadir}/xtables
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jan 11 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-5
-- Backport fixes from upstream
-- Fix flatpak build
-
-* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-4
-- The actual obsoletes fix
-
-* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-3
-- Fix compat sub-package obsoletion
-
-* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-2
-- Obsolete dropped compat package
-
-* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-1
-- New version 1.8.10
-- Drop compat sub-package
-
-* Tue Aug 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-6
-- Convert license to SPDX format
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
-- Backport fixes from upstream
-
-* Thu Apr 20 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-3
-- Support %%_excludedocs macro in alternatives installation
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jan 12 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-1
-- Make iptables-xml a relative symlink
-- Drop not needed xtables.conf
-- Ship iptables.xslt with iptables-legacy package
-- Ship ebtables-translate tool with iptables-nft package
-- Update to 1.8.9.
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.8-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Fri Jul 08 2022 Peter Robinson <pbrobinson@fedoraproject.org> - 1.8.8-2
-- iptables-services requires iptables-apply in utils to apply rules
-
-* Fri May 13 2022 Phil Sutter <psutter@redhat.com> - 1.8.8-1
-- Update to 1.8.8. Fixes rhbz#2085503
-
-* Thu Mar 03 2022 Phil Sutter <psutter@redhat.com> - 1.8.7-16
-- Improve error messages for unsupported extensions
-- xshared: Fix response to unprivileged users
-- libxtables: Register only the highest revision extension
-- Ignore typical 'fedpkg local' results in .gitignore
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-15
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Sat Nov 27 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-14
-- Rebuild for new libnftnl.
-
-* Thu Aug 05 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-13
-- doc: ebtables-nft.8: Adjust for missing atomic-options
-- nft: Fix for non-verbose check command
-- Build services sub-package as noarch
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-12
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Thu Jul 01 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-11
-- Fix performance restoring large rulesets
-- Review unit file
-
-* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-10
-- Backport fixes from upstream
-
-* Wed Jun 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-9
-- Remove bashisms from arptables-nft-helper
-
-* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8
-- iptables.init: Fix functionality for iptables-nft
-- iptables.init: Ignore sysctl files not suffixed '.conf'
-- iptables.init: Drop unused NEW_MODUTILS check
-- iptables.init: Drop some trailing whitespace
-
-* Mon Mar 29 2021 Damian Wrobel <dwrobel@ertelnet.rybnik.pl> - 1.8.7-7
-- Add missing readlink required for iptables-nft(post)
-
-* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6
-- Restore alternatives configuration after upgrade
-- Fix license location
-
-* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-5
-- Fix upgrade path with package rename
-- Add missing dependencies to iptables-nft package
-
-* Tue Feb 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-4
-- Drop bootstrap code again
-- Drop workarounds for F24 and lower
-- Fix iptables-utils summary
-- Ship iptables-apply with iptables-utils
-- Reduce files sections by use of globbing
-- Ship common man pages with iptables-libs
-- Ship *-translate man pages with iptables-nft
-- Move legacy iptables binaries, libraries and headers into sub-packages
-- Introduce compat sub-package to help with above transitions
-- Drop libipulog header from devel package, this belongs to libnetfilter_log
-- Do not ship internal headers in devel package
-
-* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-3
-- ebtables: Exit gracefully on invalid table names
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-1
-- Update to 1.8.7. Fixes rhbz#1916948
-
-* Thu Nov 19 17:32:24 CET 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-5
-- Use make macros
-
-* Tue Nov 17 14:05:30 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-4
-- ebtables: Fix for broken chain renaming
-
-* Mon Nov 16 13:39:22 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-3
-- Drop obsolete StandardOutput setting from unit file
-- Remove StandardError setting from unit file, its value is default
-
-* Thu Nov  5 2020 Florian Weimer <fweimer@redhat.com> - 1.8.6-2
-- Remove build dependency on autogen
-
-* Sat Oct 31 2020 Kevin Fenzi <kevin@scrye.com> - 1.8.6-1
-- Update to 1.8.6. Fixes bug #1893453
-
-* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-3
-- nft: cache: Check consistency with NFT_CL_FAKE, too
-- nft: Fix command name in ip6tables error message
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.5-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jun 23 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-1
-- Rebase onto upstream version 1.8.5 plus two late fixes
-- Drop explicit iptables-apply installation, upstream fixed that
-- Ship ip6tables-apply along with iptables package
+* Tue Jun 23 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-8
+- Add further fixes from upstream
 
 * Wed Feb 12 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-7
 - Move nft-specific extensions into iptables-nft package

sources

@@ -1,2 +1 @@
-SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
-SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2
+SHA512 (iptables-1.8.4.tar.bz2) = a7faaab58608ffaa51e26e8056551c0e91a49187439d30fcf5cce2800274cc3c0515db6cfba0f4c85613fb80779cf96089b8915db0e89161e9980a6384faebdb

tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh

@@ -29,10 +29,12 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 IPSET=testset6
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh

@@ -29,10 +29,12 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 TESTD=$PWD
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "source $TESTD/rules.in" 0 "read ruleset"

tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh

@@ -29,6 +29,7 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 prepare_page() {
@@ -41,6 +42,7 @@ prepare_page() {
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlLogInfo $(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
@@ -119,14 +121,10 @@ rlJournalStart
         rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
         rlRun "iptables -t raw -F"
         rlRun "ip6tables -t raw -F"
-        if rlTestVersion "$(uname -r)" "<" "4.6"; then
-            rlRun "rmmod nf_log_ipv4"
-            rlRun "rmmod nf_log_ipv6"
-            rlRun "rmmod nf_log_common"
-            rlRun "rmmod nfnetlink_log" 0,1
-	else
-            rlLogInfo "new kernel detected: skipping unloading modules"
-	fi
+        rlRun "rmmod nf_log_ipv4"
+        rlRun "rmmod nf_log_ipv6"
+        rlRun "rmmod nf_log_common"
+        rlRun "rmmod nfnetlink_log" 0,1
         rlLogInfo "restoring services"
         for svc in $SERVICES; do
             rlServiceRestore $svc

tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh

@@ -29,6 +29,7 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 CGNUM="15"
 CGNAME="15"
 CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
@@ -40,6 +41,7 @@ SKIP6=false
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel-$(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/initscript-sanity/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/Makefile

@@ -53,7 +53,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          iptables" >> $(METADATA)
-	@echo "Requires:        iptables iproute ipset" >> $(METADATA)
+	@echo "Requires:        iptables bridge-utils ipset" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2+" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh

@@ -29,13 +29,16 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ip6tables-save > ip6tables.backup"
         rlRun "iptables-save > iptables.backup"
-        rlRun "ip link add dev testbr type bridge" 0 "create bridge iface"
+        rlRun "brctl addbr testbr" 0 "create bridge iface"
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -72,7 +75,7 @@ rlJournalStart
         rlRun "ip6tables-restore < ip6tables.backup"
         rlRun "iptables-restore < iptables.backup"
         rlRun "ip link set down dev testbr"
-        rlRun "ip link del testbr" 0 "remove bridge iface"
+        rlRun "brctl delbr testbr" 0 "remove bridge iface"
         rlRun "ipset destroy ipsetv6" 0 "remove ipv6 ipset"
         rlRun "ipset destroy ipsetv4" 0 "remove ipv4 ipset"
         rlRun "popd"

tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "cp /etc/sysconfig/ip6tables ."

tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh

@@ -29,10 +29,12 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         for svc in $SERVICES; do

tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh

@@ -29,11 +29,13 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 IPSET4="ipsetv4"
 IPSET6="ipsetv6"
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ipset create $IPSET4 hash:ip"

tests/iptables-save-cuts-space-before-j/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlServiceStart iptables

tests/iptables-save-modprobe-option/runtest.sh

@@ -30,8 +30,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartTest
+        rlAssertRpm $PACKAGE
         rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
         rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
     rlPhaseEnd

tests/tests.yml

@@ -10,6 +10,7 @@
         - iptables-services # multiple tests need iptables/ip6tables config files
         - initscripts       # multiple tests need system command
         - libcgroup-tools   # backport-iptables-add-libxt-cgroup-frontend needs cg* commands
+        - bridge-utils      # ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets needs brctl command
         - ipset             # multiple tests need ipset command
         - strace            # xtables-tools-locking-vulnerable-to-local-DoS needs strace command
         - policycoreutils   # initscript-sanity needs restorecon command
@@ -20,7 +21,7 @@
   roles:
   - role: standard-test-rhts
     tests:
-#    - backport-iptables-add-libxt-cgroup-frontend
+    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by
@@ -42,7 +43,7 @@
   roles:
   - role: standard-test-beakerlib
     tests:
-#    - backport-iptables-add-libxt-cgroup-frontend
+    - backport-iptables-add-libxt-cgroup-frontend
     - initscript-sanity
     - ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets
     - ip6tables-service-does-not-allow-dhcpv6-client-by

tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd