- Pull in upstream fix for too strict command option parsing

upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281

	xshared: Accept an option if any given command allows it

	Fixed commit made option checking overly strict: Some commands may be
	commbined (foremost --list and --zero), reject a given option only if it
	is not allowed by any of the given commands.

arptables.service

@@ -1,12 +0,0 @@
-[Unit]
-Description=Automates a packet filtering firewall with arptables
-After=network.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/arptables-helper start
-ExecStop=/usr/libexec/arptables-helper stop
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target

ebtables-config

@@ -1,11 +0,0 @@
-# Save current firewall rules on stop.
-#   Value: yes|no,  default: no
-# Saves all firewall rules if firewall gets stopped
-# (e.g. on system shutdown).
-EBTABLES_SAVE_ON_STOP="no"
-
-# Save (and restore) rule counters.
-#   Value: yes|no,  default: no
-# Save rule counters when saving a kernel table to a file. If the
-# rule counters were saved, they will be restored when restoring the table.
-EBTABLES_SAVE_COUNTER="no"

ebtables-helper

@@ -1,102 +0,0 @@
-#!/bin/bash
-
-# compat for removed initscripts dependency
-
-success() {
-       echo "[  OK  ]"
-       return 0
-}
-
-failure() {
-       echo "[FAILED]"
-       return 1
-}
-
-# internal variables
-EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
-EBTABLES_DATA=/etc/sysconfig/ebtables
-EBTABLES_TABLES="broute filter nat"
-VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
-
-# ebtables-config defaults
-EBTABLES_SAVE_ON_STOP="no"
-EBTABLES_SAVE_ON_RESTART="no"
-EBTABLES_SAVE_COUNTER="no"
-
-# load config if existing
-[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
-
-initialize() {
-	local ret=0
-	for table in $EBTABLES_TABLES; do
-		ebtables -t $table --init-table || ret=1
-	done
-	return $ret
-}
-
-sanitize_dump() {
-	local drop=false
-
-	export EBTABLES_TABLES
-
-	cat $1 | while read line; do
-		case $line in
-		\**)
-			drop=false
-			local table="${line#\*}"
-			local found=false
-			for t in $EBTABLES_TABLES; do
-				if [[ $t == $table ]]; then
-					found=true
-					break
-				fi
-			done
-			$found || drop=true
-			;;
-		esac
-		$drop || echo "$line"
-	done
-}
-
-start() {
-	if [ -f $EBTABLES_DATA ]; then
-		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
-		sanitize_dump $EBTABLES_DATA | ebtables-restore
-	else
-		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
-		initialize
-	fi
-	local ret=$?
-	touch $VAR_SUBSYS_EBTABLES
-	return $ret
-}
-
-save() {
-	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
-	export EBTABLES_SAVE_COUNTER
-	ebtables-save >$EBTABLES_DATA && success || failure
-}
-
-case $1 in
-	start)
-		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
-		start && success || failure
-		RETVAL=$?
-		;;
-	stop)
-		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
-		echo -n $"ebtables: stopping firewall: "
-		initialize && success || failure
-		RETVAL=$?
-		rm -f $VAR_SUBSYS_EBTABLES
-		;;
-	save)
-		save
-		;;
-	*)
-		echo "usage: ${0##*/} {start|stop|save}" >&2
-		RETVAL=2
-		;;
-esac
-
-exit $RETVAL

ebtables.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=Ethernet Bridge Filtering tables
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/libexec/ebtables-helper start
-ExecStop=/usr/libexec/ebtables-helper stop
-
-[Install]
-WantedBy=multi-user.target

iptables.spec

@@ -11,7 +11,7 @@ Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: https://www.netfilter.org/projects/iptables
 Version: 1.8.11
-Release: 12%{?dist}
+Release: 9%{?dist}
 Source0: %{url}/files/%{name}-%{version}.tar.xz
 source1: %{url}/files/%{name}-%{version}.tar.xz.sig
 Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
@@ -20,11 +20,8 @@ Source4: iptables-config
 Source5: iptables.service
 Source6: sysconfig_iptables
 Source7: sysconfig_ip6tables
-Source8: arptables-helper
-Source9: arptables.service
-Source10: ebtables.service
-Source11: ebtables-helper
-Source12: ebtables-config
+Source8: arptables-nft-helper
+
 # Patch to fix -C handling, already upstream
 # https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
 Patch1: iptables-1.8.11-fix-interface-comparisons.patch
@@ -76,7 +73,7 @@ Provides:	iptables
 Provides:  %{name}-compat = %{version}-%{release}
 Obsoletes: %{name}-compat < 1.8.9-7
 
-%sbin_merge_compat %{_prefix}/sbin/iptables
+%sbin_merge_compat /usr/sbin/iptables
 
 %description legacy
 The iptables utility controls the network packet filtering code in the
@@ -100,8 +97,9 @@ Summary: iptables legacy libraries
 %description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real
-so version. For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real so version.
+
+For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
@@ -135,14 +133,6 @@ Requires: %{name}-utils = %{version}-%{release}
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
-# Look at me, I'm the new arptables-services now!
-Conflicts: %{name}-nft < 1.8.11-5
-Obsoletes: arptables-services < 0.0.5-16
-Provides: arptables-services = %{version}-%{release}
-# Look at me, I'm the new ebtables-services now!
-# (With epoch to turn our version number higher value)
-Obsoletes: ebtables-services < 2.0.11-20
-Provides: ebtables-services = 1:%{version}-%{release}
 BuildArch: noarch
 
 %description services
@@ -173,11 +163,8 @@ Provides: arptables-helper
 Provides: iptables
 Provides: arptables
 Provides: ebtables
-# allowing old arptables-legacy will break when switching alternatives
-# due to the dropped arptables-helper symlink
-Conflicts: arptables-legacy < 0.0.5-16
 
-%sbin_merge_compat %{_prefix}/sbin/iptables
+%sbin_merge_compat /usr/sbin/iptables
 
 %description nft
 nftables compatibility for iptables, arptables and ebtables.
@@ -209,20 +196,16 @@ install -d -m 755 %{buildroot}%{script_path}
 install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
 sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
-install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
 install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
 sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
 install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
 install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
-echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
-install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
-touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
+install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir}
 sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
@@ -249,13 +232,14 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
 
+install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/
+touch %{buildroot}%{_libexecdir}/arptables-helper
+
 # prepare for alternatives
 touch %{buildroot}%{_mandir}/man8/arptables.8
 touch %{buildroot}%{_mandir}/man8/arptables-save.8
 touch %{buildroot}%{_mandir}/man8/arptables-restore.8
 touch %{buildroot}%{_mandir}/man8/ebtables.8
-rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
-touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
 
 # fix absolute symlink
 ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
@@ -321,38 +305,18 @@ done
 %endif
 
 %post services
-%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
-%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
 %?ldconfig
-%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
 %post -e nft
 [[ %%{_excludedocs} == 1 ]] || do_man=true
 
-# remove non-symlinks in spots managed by alternatives
-# to cover for updates from not-yet-alternatived versions
-for pfx in %{_prefix}/sbin/{eb,arp}tables; do
-	for sfx in "" "-restore" "-save"; do
-		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-			rm -f $pfx$sfx
-		fi
-	done
-done
-for manpfx in %{_mandir}/man8/{eb,arp}tables; do
-	for sfx in {,-restore,-save}.8.gz; do
-		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
-			rm -f $manpfx$sfx
-		fi
-	done
-done
-
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
@@ -365,6 +329,14 @@ update-alternatives --install \
 
 pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+done
+if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
+	rm -f $manpfx.8.gz
+fi
 update-alternatives --install \
 	$pfx ebtables $pfx-nft 10 \
 	--follower $pfx-save ebtables-save $pfx-nft-save \
@@ -373,13 +345,26 @@ update-alternatives --install \
 
 pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
+lepfx=%{_libexecdir}/arptables
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
+		rm -f $manpfx$sfx.8.gz
+	fi
+done
+if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
+	rm -f $lepfx-helper
+fi
 update-alternatives --install \
 	$pfx arptables $pfx-nft 10 \
 	--follower $pfx-save arptables-save $pfx-nft-save \
 	--follower $pfx-restore arptables-restore $pfx-nft-restore \
 	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
 	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
-	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
+	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \
+	--follower $lepfx-helper arptables-helper $lepfx-nft-helper
 
 %if "%{_sbindir}" == "%{_bindir}"
 # Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
@@ -405,7 +390,7 @@ fi
 %{_mandir}/man8/xtables-legacy*
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/iptables.xslt
-%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
 %license COPYING
@@ -434,13 +419,9 @@ fi
 %dir %{script_path}
 %{script_path}/ip{,6}tables.init
 %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
-%config(noreplace) %{_sysconfdir}/sysconfig/arptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
-%ghost %{_sysconfdir}/sysconfig/ebtables
-%{_unitdir}/{arp,eb,ip,ip6}tables.service
+%{_unitdir}/ip{,6}tables.service
 %dir %{legacy_actions}/ip{,6}tables
 %{legacy_actions}/ip{,6}tables/{save,panic}
-%{_libexecdir}/{arp,eb}tables-helper
 
 %files utils
 %license COPYING
@@ -463,44 +444,37 @@ fi
 %{_sbindir}/arptables-translate
 %dir %{_libdir}/xtables
 %{_libdir}/xtables/lib{arp,eb}t*
+%{_libexecdir}/arptables-nft-helper
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
 %{_mandir}/man8/ip{,6}tables{,-restore}-translate*
 %{_mandir}/man8/ebtables-translate*
 %{_mandir}/man8/arptables-translate*
-%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
-%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_libexecdir}/arptables-helper
 %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
-* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
+* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-9
 - Pull in upstream fix for too strict command option parsing
 
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
-- Fix for ghost files not present in iptables-nft RPM
-
-* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
+* Wed May 07 2025 Zbigniew Jędrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-8
 - Reapply the change to keep symlinks managed by alternatives under /usr/bin,
   this time with a scriptlet create symlinks if /usr/sbin is unmerged.
 
-* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
+* Tue Apr 29 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-7
 - Revert last release, it breaks alternatives symlinks
 
-* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
+* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-6
 - Keep symlinks managed by alternatives under /usr/bin
 
-* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
+* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-5
 - Add patch to fix -C handling ( fixes rhbz#2360423 )
 
-* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
-- iptables-services to assimilate arptables- and ebtables-services
-
 * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild