# install init scripts to /usr/libexec with systemd

%global script_path %{_libexecdir}/iptables

# service legacy actions (RHBZ#748134)

%global legacy_actions %{_libexecdir}/initscripts/legacy-actions

# boostrap mode to assist in libip{4,6}tc SONAME bump

%global bootstrap 1

%if 0%{?bootstrap}

%global version_old 1.8.2

%global iptc_so_ver_old 0

%endif

%global iptc_so_ver 2

Name: iptables

Summary: Tools for managing Linux kernel packet filtering capabilities

URL: http://www.netfilter.org/projects/iptables

Version: 1.8.4

Release: 17%{?dist}

Source: %{url}/files/%{name}-%{version}.tar.bz2

Source1: iptables.init

Source2: iptables-config

Source3: iptables.service

Source4: sysconfig_iptables

Source5: sysconfig_ip6tables

Source6: arptables.service

Source7: arptables-helper

Source8: ebtables.systemd

Source9: ebtables.service

Source10: ebtables-config

%if 0%{?bootstrap}

Source11: %{url}/files/%{name}-%{version_old}.tar.bz2

Source12: 0003-extensions-format-security-fixes-in-libip-6-t_icmp.patch

%endif

Patch01: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch

Patch02: 0002-xtables-restore-Fix-parser-feed-from-line-buffer.patch

Patch03: 0003-xtables-restore-Avoid-access-of-uninitialized-data.patch

Patch04: 0004-extensions-time-Avoid-undefined-shift.patch

Patch05: 0005-extensions-cluster-Avoid-undefined-shift.patch

Patch06: 0006-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch

Patch07: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch

Patch08: 0008-extensions-among-Check-call-to-fstat.patch

Patch09: 0009-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch

Patch10: 0010-xtables-translate-Fix-for-interface-name-corner-case.patch

Patch11: 0011-xtables-translate-Fix-for-iface.patch

Patch12: 0012-tests-shell-Fix-skip-checks-with-host-mode.patch

Patch13: 0013-xtables-restore-fix-for-noflush-and-empty-lines.patch

Patch14: 0014-iptables-test.py-Fix-host-mode.patch

Patch15: 0015-xtables-Review-nft_init.patch

Patch16: 0016-nft-cache-Fix-nft_release_cache-under-stress.patch

Patch17: 0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch

Patch18: 0018-ebtables-among-Support-mixed-MAC-and-MAC-IP-entries.patch

Patch19: 0019-xtables-Align-effect-of-4-6-options-with-legacy.patch

Patch20: 0020-xtables-Drop-4-and-6-support-from-xtables-save-resto.patch

Patch21: 0021-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch

Patch22: 0022-nfnl_osf-Improve-error-handling.patch

Patch23: 0023-nft-cache-Reset-genid-when-rebuilding-cache.patch

Patch24: 0024-nft-Fix-for-F-in-iptables-dumps.patch

Patch25: 0025-tests-shell-Test-F-in-dump-files.patch

Patch26: 0026-nft-Make-batch_add_chain-return-the-added-batch-obje.patch

Patch27: 0027-nft-Fix-error-reporting-for-refreshed-transactions.patch

Patch28: 0028-nft-Fix-for-concurrent-noflush-restore-calls.patch

Patch29: 0029-tests-shell-Improve-concurrent-noflush-restore-test-.patch

Patch30: 0030-nft-cache-Make-nft_rebuild_cache-respect-fake-cache.patch

Patch31: 0031-nft-Fix-for-broken-address-mask-match-detection.patch

Patch32: 0032-nft-Optimize-class-based-IP-prefix-matches.patch

Patch33: 0033-ebtables-Optimize-masked-MAC-address-matches.patch

Patch34: 0034-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch

Patch35: 0035-libxtables-Make-sure-extensions-register-in-revision.patch

Patch36: 0036-libxtables-Simplify-pending-extension-registration.patch

Patch37: 0037-libxtables-Register-multiple-extensions-in-ascending.patch

Patch38: 0038-tests-shell-Test-for-fixed-extension-registration.patch

Patch39: 0039-extensions-libipt_icmp-Fix-translation-of-type-any.patch

Patch40: 0040-extensions-libxt_CT-add-translation-for-NOTRACK.patch

Patch41: 0041-nft-Fix-command-name-in-ip6tables-error-message.patch

Patch42: 0042-tests-shell-Merge-and-extend-return-codes-test.patch

Patch43: 0043-extensions-dccp-Fix-for-DCCP-type-INVALID.patch

# pf.os: ISC license

# iptables-apply: Artistic Licence 2.0

License: GPLv2 and Artistic 2.0 and ISC

# libnetfilter_conntrack is needed for xt_connlabel

BuildRequires: pkgconfig(libnetfilter_conntrack)

# libnfnetlink-devel is requires for nfnl_osf

BuildRequires: pkgconfig(libnfnetlink)

BuildRequires: libselinux-devel

BuildRequires: kernel-headers

BuildRequires: systemd

# libmnl, libnftnl, bison, flex for nftables

BuildRequires: bison

BuildRequires: flex

BuildRequires: gcc

BuildRequires: pkgconfig(libmnl) >= 1.0

BuildRequires: pkgconfig(libnftnl) >= 1.1.5-1

# libpcap-devel for nfbpf_compile

BuildRequires: libpcap-devel

BuildRequires:  autoconf

BuildRequires:  automake

BuildRequires:  libtool

Requires: %{name}-libs%{?_isa} = %{version}-%{release}

%if 0%{?fedora} > 24

Conflicts: setup < 2.10.4-1

%endif

%description

The iptables utility controls the network packet filtering code in the

Linux kernel. If you need to set up firewalls and/or IP masquerading,

you should either install nftables or this package.

Note: This package contains the nftables-based variants of iptables and

ip6tables, which are drop-in replacements of the legacy tools.

%package libs

Summary: iptables libraries

Group: System Environment/Base

%description libs

iptables libraries.

Please remember that libip*tc libraries do neither have a stable API nor a real so version.

For more information about this, please have a look at

  http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5

%package devel

Summary: Development package for iptables

Group: System Environment/Base

Requires: %{name}%{?_isa} = %{version}-%{release}

Requires: iptables-libs = %{version}-%{release}

Requires: pkgconfig

%description devel

iptables development headers and libraries.

The iptc libraries are marked as not public by upstream. The interface is not

stable and may change with every new version. It is therefore unsupported.

%package services

Summary: iptables and ip6tables services for iptables

Group: System Environment/Base

Requires: %{name} = %{version}-%{release}

Requires(post): systemd

Requires(preun): systemd

Requires(postun): systemd

# obsolete old main package

Obsoletes: %{name} < 1.4.16.1

# obsolete ipv6 sub package

Obsoletes: %{name}-ipv6 < 1.4.11.1

%description services

iptables services for IPv4 and IPv6

This package provides the services iptables and ip6tables that have been split

out of the base package since they are not active by default anymore.

%package utils

Summary: iptables and ip6tables services for iptables

Group: System Environment/Base

Requires: %{name} = %{version}-%{release}

%description utils

Utils for iptables.

Currently only provides nfnl_osf with the pf.os database.

%package arptables

Summary: User space tool to set up tables of ARP rules in kernel

Group: System Environment/Base

Requires: %{name} = %{version}-%{release}

Obsoletes: arptables

Provides: arptables

%description arptables

The arptables tool is used to set up and maintain

the tables of ARP rules in the Linux kernel. These rules inspect

the ARP frames which they see. arptables is analogous to the iptables

user space tool, but is less complicated.

Note: This package contains the nftables-based variant of arptables, a drop-in

replacement of the legacy tool.

%package ebtables

Summary: Ethernet Bridge frame table administration tool

Group: System Environment/Base

Requires: %{name} = %{version}-%{release}

Obsoletes: ebtables

Provides: ebtables

%description ebtables

Ethernet bridge tables is a firewalling tool to transparently filter network

traffic passing a bridge. The filtering possibilities are limited to link

layer filtering and some basic filtering on higher network layers.

This tool is the userspace control for the bridge and ebtables kernel

components (built by default in RHEL kernels).

The ebtables tool can be used together with the other Linux filtering tools,

like iptables. There are no known incompatibility issues.

Note: This package contains the nftables-based variant of ebtables, a drop-in

replacement of the legacy tool.

%prep

%autosetup -p1

%if 0%{?bootstrap}

%{__mkdir} -p bootstrap_ver

pushd bootstrap_ver

%{__tar} --strip-components=1 -xf %{SOURCE11}

%{__patch} -p1 <%{SOURCE12}

popd

%endif

%build

./autogen.sh

CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \

%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr

# do not use rpath

sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool

sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool

rm -f include/linux/types.h

make %{?_smp_mflags} V=1

%if 0%{?bootstrap}

pushd bootstrap_ver

./autogen.sh

CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \

%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr

# do not use rpath

sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool

sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool

rm -f include/linux/types.h

make %{?_smp_mflags} V=1

popd

%endif

%install

%if 0%{?bootstrap}

%make_install -C bootstrap_ver

find %{buildroot} -xtype f -not \

	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print

find %{buildroot} -type l -not \

	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print

%endif

make install DESTDIR=%{buildroot} 

# remove la file(s)

rm -f %{buildroot}/%{_libdir}/*.la

# install ip*tables.h header files

install -m 644 include/ip*tables.h %{buildroot}%{_includedir}/

install -d -m 755 %{buildroot}%{_includedir}/iptables

install -m 644 include/iptables/internal.h %{buildroot}%{_includedir}/iptables/

# install ipulog header file

install -d -m 755 %{buildroot}%{_includedir}/libipulog/

install -m 644 include/libipulog/*.h %{buildroot}%{_includedir}/libipulog/

# install init scripts and configuration files

install -d -m 755 %{buildroot}%{script_path}

install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init

sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init

install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init

install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig

install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config

sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config

install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config

install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables

install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables

# install systemd service files

install -d -m 755 %{buildroot}/%{_unitdir}

install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}

sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service

install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}

# install legacy actions for service command

install -d %{buildroot}/%{legacy_actions}/iptables

install -d %{buildroot}/%{legacy_actions}/ip6tables

cat << EOF > %{buildroot}/%{legacy_actions}/iptables/save

#!/bin/bash

exec %{script_path}/iptables.init save

EOF

chmod 755 %{buildroot}/%{legacy_actions}/iptables/save

sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/save > ip6tabes.save-legacy

install -c -m 755 ip6tabes.save-legacy %{buildroot}/%{legacy_actions}/ip6tables/save

cat << EOF > %{buildroot}/%{legacy_actions}/iptables/panic

#!/bin/bash

exec %{script_path}/iptables.init panic

EOF

chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic

sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy

install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic

# install iptables-apply with man page

install -m 755 iptables/iptables-apply %{buildroot}%{_sbindir}/

install -m 644 iptables/iptables-apply.8 %{buildroot}%{_mandir}/man8/

%if 0%{?fedora} > 24

# Remove /etc/ethertypes (now part of setup)

rm -f %{buildroot}%{_sysconfdir}/ethertypes

%endif

# drop all legacy tools

rm -f %{buildroot}%{_sbindir}/*legacy*

rm -f %{buildroot}%{_bindir}/iptables-xml

rm -f %{buildroot}%{_mandir}/man1/iptables-xml*

rm -f %{buildroot}%{_mandir}/man8/xtables-legacy*

# rename nft versions to standard name

pfx=%{buildroot}%{_sbindir}/iptables

for pfx in %{buildroot}%{_sbindir}/{iptables,ip6tables,arptables,ebtables}; do

	mv $pfx-nft $pfx

	mv $pfx-nft-restore $pfx-restore

	mv $pfx-nft-save $pfx-save

done

# extra sources for arptables

install -p -D -m 644 %{SOURCE6} %{buildroot}%{_unitdir}/arptables.service

mkdir -p %{buildroot}%{_libexecdir}/

install -p -D -m 755 %{SOURCE7} %{buildroot}%{_libexecdir}/

mkdir -p %{buildroot}%{_sysconfdir}/sysconfig

echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables

for sfx in "" "-restore" "-save"; do

	echo '.so man8/arptables-nft${sfx}.8' > \

		%{buildroot}%{_mandir}/man8/arptables${sfx}.8

done

# extra sources for ebtables

install -p %{SOURCE9} %{buildroot}%{_unitdir}/

install -m0755 %{SOURCE8} %{buildroot}%{_libexecdir}/ebtables

install -m0600 %{SOURCE10} %{buildroot}%{_sysconfdir}/sysconfig/ebtables-config

touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables

echo '.so man8/ebtables-nft.8' > %{buildroot}%{_mandir}/man8/ebtables.8

%if 0%{?rhel}

%pre

for p in %{_sysconfdir}/alternatives/{iptables,ip6tables}.*; do

    if [ -h "$p" ]; then

        ipt=$(readlink "$p")

        echo "Removing alternatives for ${p##*/} with path $ipt"

        %{_sbindir}/alternatives --remove "${p##*/}" "$ipt"

    fi

done

%endif

%post -p /sbin/ldconfig

%postun -p /sbin/ldconfig

%post services

%systemd_post iptables.service ip6tables.service

%preun services

%systemd_preun iptables.service ip6tables.service

%postun services

/sbin/ldconfig

%systemd_postun iptables.service ip6tables.service

%post arptables

%systemd_post arptables.service

%preun arptables

%systemd_preun arptables.service

%postun arptables

%systemd_postun arptables.service

%post ebtables

%systemd_post ebtables.service

%preun ebtables

%systemd_preun ebtables.service

%postun ebtables

%systemd_postun_with_restart ebtables.service

%files

%{!?_licensedir:%global license %%doc}

%license COPYING

%doc INCOMPATIBILITIES

%config(noreplace) %{_sysconfdir}/sysconfig/iptables-config

%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables-config

%if 0%{?fedora} <= 24

%{_sysconfdir}/ethertypes

%endif

%{_sbindir}/iptables

%{_sbindir}/iptables-apply

%{_sbindir}/iptables-restore

%{_sbindir}/iptables-restore-translate

%{_sbindir}/iptables-save

%{_sbindir}/iptables-translate

%{_sbindir}/ip6tables

%{_sbindir}/ip6tables-restore

%{_sbindir}/ip6tables-restore-translate

%{_sbindir}/ip6tables-save

%{_sbindir}/ip6tables-translate

%{_sbindir}/xtables-monitor

%{_sbindir}/xtables-nft-multi

%doc %{_mandir}/man8/iptables*

%doc %{_mandir}/man8/ip6tables*

%doc %{_mandir}/man8/xtables-monitor*

%doc %{_mandir}/man8/xtables-nft*

%doc %{_mandir}/man8/*tables-translate*

%doc %{_mandir}/man8/*tables-restore-translate*

%dir %{_libdir}/xtables

%{_libdir}/xtables/libarpt*

%{_libdir}/xtables/libebt*

%{_libdir}/xtables/libipt*

%{_libdir}/xtables/libip6t*

%{_libdir}/xtables/libxt*

%files libs

%{_libdir}/libip*tc.so.%{iptc_so_ver}*

%if 0%{?bootstrap}

%{_libdir}/libip*tc.so.%{iptc_so_ver_old}*

%endif

%{_libdir}/libxtables.so.12*

%files devel

%dir %{_includedir}/iptables

%{_includedir}/iptables/*.h

%{_includedir}/*.h

%dir %{_includedir}/libiptc

%{_includedir}/libiptc/*.h

%dir %{_includedir}/libipulog

%{_includedir}/libipulog/*.h

%{_libdir}/libip*tc.so

%{_libdir}/libxtables.so

%{_libdir}/pkgconfig/libiptc.pc

%{_libdir}/pkgconfig/libip4tc.pc

%{_libdir}/pkgconfig/libip6tc.pc

%{_libdir}/pkgconfig/xtables.pc

%files services

%dir %{script_path}

%{script_path}/iptables.init

%{script_path}/ip6tables.init

%config(noreplace) %{_sysconfdir}/sysconfig/iptables

%config(noreplace) %{_sysconfdir}/sysconfig/ip6tables

%{_unitdir}/iptables.service

%{_unitdir}/ip6tables.service

%dir %{legacy_actions}/iptables

%{legacy_actions}/iptables/save

%{legacy_actions}/iptables/panic

%dir %{legacy_actions}/ip6tables

%{legacy_actions}/ip6tables/save

%{legacy_actions}/ip6tables/panic

%files utils

%{_sbindir}/nfnl_osf

%{_sbindir}/nfbpf_compile

%dir %{_datadir}/xtables

%{_datadir}/xtables/pf.os

%doc %{_mandir}/man8/nfnl_osf*

%doc %{_mandir}/man8/nfbpf_compile*

%files arptables

%{_sbindir}/arptables*

%{_libexecdir}/arptables-helper

%{_unitdir}/arptables.service

%config(noreplace) %{_sysconfdir}/sysconfig/arptables

%doc %{_mandir}/man8/arptables*.8*

%files ebtables

%{_sbindir}/ebtables*

%{_libexecdir}/ebtables

%{_unitdir}/ebtables.service

%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config

%ghost %{_sysconfdir}/sysconfig/ebtables

%doc %{_mandir}/man8/ebtables*.8*

%changelog

* Thu Dec 10 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-17

- extensions: dccp: Fix for DCCP type 'INVALID'

- tests: shell: Merge and extend return codes test

- nft: Fix command name in ip6tables error message

- extensions: libxt_CT: add translation for NOTRACK

- extensions: libipt_icmp: Fix translation of type 'any'

- tests/shell: Test for fixed extension registration

- libxtables: Register multiple extensions in ascending order

- libxtables: Simplify pending extension registration

- libxtables: Make sure extensions register in revision order

* Wed Oct 28 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-16

- tests/shell: Add test for bitwise avoidance fixes

- ebtables: Optimize masked MAC address matches

- nft: Optimize class-based IP prefix matches

- nft: Fix for broken address mask match detection

- nft: cache: Make nft_rebuild_cache() respect fake cache

- tests: shell: Improve concurrent noflush restore test a bit

- nft: Fix for concurrent noflush restore calls

- nft: Fix error reporting for refreshed transactions

- nft: Make batch_add_chain() return the added batch object

* Sat Aug 15 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-15

- Ignore sysctl files not suffixed '.conf'

* Wed Jun 24 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-14

- nft: Fix for '-F' in iptables dumps

- tests: shell: Test -F in dump files

* Fri May 29 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-13

- Fix for endless loop in iptables-restore --test

* Tue May 26 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-12

- Unbreak nfnl_osf tool

* Tue May 19 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-11

- Complete ebtables-nft among match support

- Replace RHEL-only xtables-monitor fix with upstream solution

- xtables: Align effect of -4/-6 options with legacy

- xtables: Drop -4 and -6 support from xtables-{save,restore}

- Review systemd unit files

* Tue Mar 17 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-10

- Fix for iptables-restore segfault under pressure

- Fix for iptables-save segfault under pressure

* Mon Feb 24 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-9

- iptables-test.py: Fix --host mode

- xtables-monitor: Fix segfault when tracing

* Sat Feb 15 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-8

- xtables-translate: Fix for iface++

- tests: shell: Fix skip checks with --host mode

- xtables-restore: fix for --noflush and empty lines

* Wed Feb 12 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-7

- xtables-translate: Fix for interface name corner-cases

* Mon Dec 09 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-6

- Add missing patch in last release, uAPI covscan fix

* Mon Dec 09 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-5

- Fix covscan-indicated problems

* Wed Dec 04 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-4

- Fix for broken xtables-restore --noflush

* Tue Dec 03 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-3

- Reduce globbing in library file names to expose future SONAME changes

- Add bootstrapping for libip*tc SONAME bump

* Mon Dec 02 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-2

- Use upstream-provided man pages for ebtables and arptables

* Mon Dec 02 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-1

- Rebase onto upstream release 1.8.4

* Thu Aug 08 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-16

- nft: Set socket receive buffer

* Wed Jul 31 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-15

- doc: Install ip{6,}tables-restore-translate.8 man pages

* Tue Jul 02 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-14

- arptables: Print space before comma and counters

- extensions: Fix ipvs vproto parsing

- extensions: Fix ipvs vproto option printing

- extensions: Add testcase for libxt_ipvs

* Mon Jul 01 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-13

- doc: Install ip{6,}tables-translate.8 manpages

- nft: Eliminate dead code in __nft_rule_list

* Wed Jun 12 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-12

- Add iptables-test.py testsuite to sources

- extensions: libip6t_mh: fix bogus translation error

- extensions: AUDIT: Document ineffective --type option

- xtables-restore: Fix program names in help texts

- xtables-save: Point at existing man page in help text

- utils: Add a manpage for nfbpf_compile

- Mark man pages in base package as documentation files

* Thu May 23 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-11

- Enable verbose output when building

* Thu May 09 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-10

- arptables-nft: fix decoding of hlen on bigendian platforms

- xtables-save: Fix table not found error message

- xtables: Catch errors when zeroing rule rounters

- extensions: TRACE: Point at xtables-monitor in documentation

- extensions: libipt_realm: Document allowed realm values

* Fri Feb 08 2019 Phil Sutter - 1.8.2-9

- ebtables-nft: Support user-defined chain policies

* Thu Feb 07 2019 Phil Sutter - 1.8.2-8

- arptables.8: Document --set-counters option

* Thu Feb 07 2019 Phil Sutter - 1.8.2-7

- arptables: Support --set-counters option

* Fri Feb 01 2019 Phil Sutter - 1.8.2-6

- Improve performance with large rulesets

- Fix for changes in arptables output

- Fix for inserting rules at wrong position

- Fix segfault when comparing rules with standard target

- Fix ebtables output for negated values

- Document missing arptables FORWARD chain

* Tue Dec 18 2018 Phil Sutter - 1.8.2-5

- Drop change to test snippet not included in tarball from Patch4

* Tue Dec 18 2018 Phil Sutter - 1.8.2-4

- Fix iptables init script for nftables-backend

- Drop references to unsupported broute table from ebtables man page

- xtables: Don't use native nftables comments

* Thu Dec 06 2018 Phil Sutter - 1.8.2-3

- Drop change to test snippet not included in tarball from Patch3

* Thu Dec 06 2018 Phil Sutter - 1.8.2-2

- Point out that nftables-variants are installed in package description

- Fix for deleting arptables rules by referencing them

* Thu Dec 06 2018 Phil Sutter - 1.8.2-1

- Rebase onto upstream version 1.8.2

* Thu Oct 25 2018 Phil Sutter - 1.8.1-2

- Add upstream fixes to 1.8.1 release

* Thu Oct 25 2018 Phil Sutter - 1.8.1-1

- Rebase onto upstream version 1.8.1

* Thu Sep 27 2018 Phil Sutter - 1.8.0-11

- Fix for covscan warnings in init scripts

* Wed Sep 26 2018 Phil Sutter - 1.8.0-10

- Fix short name of Artistic Licence

* Wed Sep 26 2018 Phil Sutter - 1.8.0-9

- Add further fixes for issues identified by covscan

- Fix for bogus "is incompatible" warnings

- Fix layout in License tag

- Replace "Fedora" with "RHEL" in description

- Make devel sub-package depend on libs sub-package

* Mon Sep 17 2018 Phil Sutter - 1.8.0-8

- Fix issues identified by covscan

- xtables-restore: Fix flushing referenced custom chains

- xtables: Accept --wait in iptables-nft-restore

* Mon Sep 03 2018 Phil Sutter - 1.8.0-7

- xtables: Align return codes with legacy iptables

- xtables: Drop use of IP6T_F_PROTO

* Wed Aug 29 2018 Phil Sutter - 1.8.0-6

- xtables: Fix for deleting rules with comment

* Fri Aug 24 2018 Phil Sutter - 1.8.0-5

- xtables: Use meta l4proto for -p match

- ebtables: Fix for listing of non-existent chains

- xtables: Fix for no output in iptables-nft -S

* Sat Aug 18 2018 Phil Sutter - 1.8.0-4

- xtables: Fix for segfault in iptables-nft

- ebtables: Fix entries count in chain listing

- Use %%autosetup macro in %%prep

* Fri Aug 17 2018 Phil Sutter - 1.8.0-3

- xtables: Make 'iptables -S nonexisting' return non-zero

* Fri Aug 10 2018 Phil Sutter - 1.8.0-2

- Rebase onto upstream master commit 514de4801b731db4712

- Add arptables and ebtables sub-packages

* Wed Jul 11 2018 Phil Sutter - 1.8.0-1

- New upstream version 1.8.0

- Drop compat sub-package

- Use nft tool versions, drop legacy ones

* Thu Mar 01 2018 Phil Sutter <psutter@redhat.com> - 1.6.2-2

- Kill module unloading support

- Support /etc/sysctl.d

- Don't restart services after package update

- Add support for --wait options to restore commands

* Wed Feb 21 2018 Michael Cronenworth <mike@cchtml.com> - 1.6.2-1

- New upstream version 1.6.2

  http://www.netfilter.org/projects/iptables/files/changes-iptables-1.6.2.txt

* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-6

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

* Sun Oct 22 2017 Kevin Fenzi <kevin@scrye.com> - 1.6.1-5

- Rebuild for new libnftnl

* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

* Thu Feb 02 2017 Thomas Woerner <twoerner@redhat.com> - 1.6.1-1

- New upstream version 1.6.1 with enhanced translation to nft support and

  several fixes (RHBZ#1417323)

  http://netfilter.org/projects/iptables/files/changes-iptables-1.6.1.txt

- Enable parallel build again

* Thu Feb 02 2017 Petr Šabata <contyk@redhat.com> - 1.6.0-4