Blame SPECS/nftables.spec

168a1c
Name:           nftables
168a1c
Version:        0.9.8
ea236d
Release:        10%{?dist}
168a1c
# Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track.
168a1c
Epoch:          1
168a1c
Summary:        Netfilter Tables userspace utillites
168a1c
168a1c
License:        GPLv2
168a1c
URL:            https://netfilter.org/projects/nftables/
168a1c
Source0:        %{url}/files/%{name}-%{version}.tar.bz2
168a1c
Source1:        nftables.service
168a1c
Source2:        nftables.conf
168a1c
Source3:        main.nft
168a1c
Source4:        router.nft
168a1c
Source5:        nat.nft
168a1c
168a1c
Patch01: 0001-payload-check-icmp-dependency-before-removing-previo.patch
168a1c
Patch02: 0002-tests-add-icmp-6-test-where-dependency-should-be-lef.patch
168a1c
Patch03: 0003-main-fix-nft-help-output-fallout-from-719e4427.patch
168a1c
Patch04: 0004-parser_bison-Fix-for-implicit-declaration-of-isalnum.patch
168a1c
Patch05: 0005-parser_json-Fix-for-memleak-in-tcp-option-error-path.patch
168a1c
Patch06: 0006-evaluate-Mark-fall-through-case-in-str2hooknum.patch
168a1c
Patch07: 0007-json-Drop-pointless-assignment-in-exthdr_expr_json.patch
168a1c
Patch08: 0008-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
168a1c
Patch09: 0009-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
168a1c
Patch10: 0010-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
168a1c
Patch11: 0011-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
168a1c
Patch12: 0012-netlink_delinearize-Fix-suspicious-calloc-call.patch
168a1c
Patch13: 0013-rule-Fix-for-potential-off-by-one-in-cmd_add_loc.patch
168a1c
Patch14: 0014-src-add-xzalloc_array-and-use-it-to-allocate-the-exp.patch
168a1c
Patch15: 0015-json-init-parser-state-for-every-new-buffer-file.patch
954d1a
Patch16: 0016-segtree-Fix-segfault-when-restoring-a-huge-interval-.patch
954d1a
Patch17: 0017-tests-cover-baecd1cf2685-segtree-Fix-segfault-when-r.patch
954d1a
Patch18: 0018-doc-nft.8-Extend-monitor-description-by-trace.patch
ea236d
Patch19: 0019-tests-shell-NFT-needs-to-be-invoked-unquoted.patch
ea236d
Patch20: 0020-tests-shell-better-parameters-for-the-interval-stack.patch
168a1c
168a1c
#BuildRequires: autogen
168a1c
#BuildRequires: autoconf
168a1c
#BuildRequires: automake
168a1c
#BuildRequires: libtool
168a1c
BuildRequires: make
168a1c
BuildRequires:  gcc
168a1c
BuildRequires: flex
168a1c
BuildRequires: bison
168a1c
BuildRequires: libmnl-devel
168a1c
BuildRequires: gmp-devel
168a1c
BuildRequires: readline-devel
168a1c
BuildRequires: libnftnl-devel
168a1c
BuildRequires: systemd
168a1c
BuildRequires: asciidoc
168a1c
BuildRequires: iptables-devel
168a1c
BuildRequires: jansson-devel
168a1c
BuildRequires: python3-devel
168a1c
168a1c
%description
168a1c
Netfilter Tables userspace utilities.
168a1c
168a1c
%package        devel
168a1c
Summary:        Development library for nftables / libnftables
168a1c
Requires:       %{name} = %{epoch}:%{version}-%{release}
168a1c
Requires:       pkgconfig
168a1c
168a1c
%description devel
168a1c
Development tools and static libraries and header files for the libnftables library.
168a1c
168a1c
%package -n     python3-nftables
168a1c
Summary:        Python module providing an interface to libnftables
168a1c
Requires:       %{name} = %{epoch}:%{version}-%{release}
168a1c
%{?python_provide:%python_provide python3-nftables}
168a1c
168a1c
%description -n python3-nftables
168a1c
The nftables python module provides an interface to libnftables via ctypes.
168a1c
168a1c
%prep
168a1c
%autosetup -p1
168a1c
168a1c
%build
168a1c
#./autogen.sh
168a1c
%configure --disable-silent-rules --with-xtables --with-json \
168a1c
	--enable-python --with-python-bin=%{__python3}
168a1c
%make_build
168a1c
168a1c
%install
168a1c
%make_install
168a1c
find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'
168a1c
168a1c
# Don't ship static lib (for now at least)
168a1c
rm -f $RPM_BUILD_ROOT/%{_libdir}/libnftables.a
168a1c
168a1c
chmod 644 $RPM_BUILD_ROOT/%{_mandir}/man8/nft*
168a1c
168a1c
mkdir -p $RPM_BUILD_ROOT/%{_unitdir}
168a1c
cp -a %{SOURCE1} $RPM_BUILD_ROOT/%{_unitdir}/
168a1c
168a1c
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sysconfig
168a1c
cp -a %{SOURCE2} $RPM_BUILD_ROOT/%{_sysconfdir}/sysconfig/
168a1c
168a1c
rm $RPM_BUILD_ROOT/%{_sysconfdir}/nftables/*.nft
168a1c
cp %{SOURCE3} %{SOURCE4} %{SOURCE5} \
168a1c
	$RPM_BUILD_ROOT/%{_sysconfdir}/nftables/
168a1c
168a1c
find $RPM_BUILD_ROOT/%{_sysconfdir} \
168a1c
	\( -type d -exec chmod 0700 {} \; \) , \
168a1c
	\( -type f -exec chmod 0600 {} \; \)
168a1c
168a1c
# make nftables.py use the real library file name
168a1c
# to avoid nftables-devel package dependency
168a1c
sofile=$(readlink $RPM_BUILD_ROOT/%{_libdir}/libnftables.so)
168a1c
sed -i -e 's/\(sofile=\)".*"/\1"'$sofile'"/' \
168a1c
	$RPM_BUILD_ROOT/%{python3_sitelib}/nftables/nftables.py
168a1c
168a1c
%post
168a1c
%systemd_post nftables.service
168a1c
%ldconfig_post
168a1c
168a1c
%preun
168a1c
%systemd_preun nftables.service
168a1c
168a1c
%postun
168a1c
%systemd_postun_with_restart nftables.service
168a1c
%ldconfig_postun
168a1c
168a1c
%files
168a1c
%license COPYING
168a1c
%config(noreplace) %{_sysconfdir}/nftables/
168a1c
%config(noreplace) %{_sysconfdir}/sysconfig/nftables.conf
168a1c
%{_sbindir}/nft
168a1c
%{_libdir}/libnftables.so.*
168a1c
%{_mandir}/man5/libnftables-json.5*
168a1c
%{_mandir}/man8/nft*
168a1c
%{_unitdir}/nftables.service
168a1c
%{_docdir}/nftables/examples/*.nft
168a1c
168a1c
%files devel
168a1c
%{_libdir}/libnftables.so
168a1c
%{_libdir}/pkgconfig/libnftables.pc
168a1c
%{_includedir}/nftables/libnftables.h
168a1c
%{_mandir}/man3/libnftables.3*
168a1c
168a1c
%files -n python3-nftables
168a1c
%{python3_sitelib}/nftables-*.egg-info
168a1c
%{python3_sitelib}/nftables/
168a1c
168a1c
%changelog
ea236d
* Wed Dec 08 2021 Phil Sutter <psutter@redhat.com> - 1:0.9.8-10
ea236d
- tests: shell: better parameters for the interval stack overflow test
ea236d
- tests: shell: $NFT needs to be invoked unquoted
ea236d
954d1a
* Thu Nov 11 2021 Phil Sutter <psutter@redhat.com> - 1:0.9.8-9
954d1a
- doc: nft.8: Extend monitor description by trace
954d1a
954d1a
* Fri Nov 05 2021 Phil Sutter <psutter@redhat.com> - 1:0.9.8-8
954d1a
- tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set")
954d1a
- segtree: Fix segfault when restoring a huge interval set
954d1a
168a1c
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1:0.9.8-7
168a1c
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
168a1c
  Related: rhbz#1991688
168a1c
168a1c
* Fri Jun 18 2021 Phil Sutter <psutter@redhat.com> - 1:0.9.8-6
168a1c
- json: init parser state for every new buffer/file
168a1c
168a1c
* Tue Jun 15 2021 Phil Sutter <psutter@redhat.com> - 1:0.9.8-5
168a1c
- src: add xzalloc_array() and use it to allocate the expression hashtable
168a1c
168a1c
* Mon Jun 14 2021 Phil Sutter <psutter@redhat.com> - 1:0.9.8-4
168a1c
- Install an improved sample config
168a1c
- Fix permissions of osf-related configs
168a1c
- rule: Fix for potential off-by-one in cmd_add_loc()
168a1c
- netlink_delinearize: Fix suspicious calloc() call
168a1c
- netlink: Avoid memleak in error path of netlink_delinearize_obj()
168a1c
- netlink: Avoid memleak in error path of netlink_delinearize_table()
168a1c
- netlink: Avoid memleak in error path of netlink_delinearize_chain()
168a1c
- netlink: Avoid memleak in error path of netlink_delinearize_set()
168a1c
- json: Drop pointless assignment in exthdr_expr_json()
168a1c
- evaluate: Mark fall through case in str2hooknum()
168a1c
- parser_json: Fix for memleak in tcp option error path
168a1c
- parser_bison: Fix for implicit declaration of isalnum
168a1c
- main: fix nft --help output fallout from 719e4427
168a1c
- tests: add icmp/6 test where dependency should be left alone
168a1c
- payload: check icmp dependency before removing previous icmp expression
168a1c
168a1c
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1:0.9.8-3
168a1c
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
168a1c
168a1c
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.8-2
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
168a1c
168a1c
* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 0.9.8-1
168a1c
- Update to 0.9.8. Fixes rhbz#1916940
168a1c
168a1c
* Sat Oct 31 2020 Kevin Fenzi <kevin@scrye.com> - 0.9.7-1
168a1c
- Update to 0.9.7. Fixes bug #1891769
168a1c
168a1c
* Thu Oct 29 2020 Stephen Gallagher <sgallagh@redhat.com> - 1:0.9.6-2
168a1c
- Drop upstreamed patch
168a1c
168a1c
* Sat Sep 05 2020 Neal Gompa <ngompa13@gmail.com> - 1:0.9.6-1
168a1c
- Update to 0.9.6 (RH#1846663)
168a1c
168a1c
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.3-6
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
168a1c
168a1c
* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 1:0.9.3-5
168a1c
- Use make macros
168a1c
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
168a1c
168a1c
* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 1:0.9.3-4
168a1c
- Rebuilt for Python 3.9
168a1c
168a1c
* Fri May 15 2020 Richard Shaw <hobbes1069@gmail.com> - 1:0.9.3-3
168a1c
- Add patch for json performance with ipsets, fixes RHBZ#1834853.
168a1c
168a1c
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.3-2
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
168a1c
168a1c
* Wed Dec 04 2019 Phil Sutter <psutter@redhat.com> - 1:0.9.3-1
168a1c
- Update to 0.9.3. Fixes bug #1778959
168a1c
168a1c
* Tue Oct 01 2019 Phil Sutter <psutter@redhat.com> - 1:0.9.2-3
168a1c
- Drop unneeded docbook2X build dependency
168a1c
- Add python3-nftables sub-package
168a1c
168a1c
* Fri Aug 23 2019 Kevin Fenzi <kevin@scrye.com> - 0.9.2-2
168a1c
- Move libnftables section 3 man page to devel package.
168a1c
168a1c
* Fri Aug 23 2019 Kevin Fenzi <kevin@scrye.com> - 0.9.2-1
168a1c
- Update to 0.9.2. Fixes bug #1743223
168a1c
168a1c
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.1-3
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
168a1c
168a1c
* Fri Jun 28 2019 Kevin Fenzi <kevin@scrye.com> - 0.9.1-2
168a1c
- Add some filters to nftables.conf
168a1c
168a1c
* Tue Jun 25 2019 Kevin Fenzi <kevin@scrye.com> - 0.9.1-1
168a1c
- Update to 0.9.1. Fixes bug #1723515
168a1c
168a1c
* Mon Jun 17 2019 Kevin Fenzi <kevin@scrye.com> - 0.9.0-7
168a1c
- Rebuild for new libnftnl.
168a1c
168a1c
* Sat Mar 16 2019 Kevin Fenzi <kevin@scrye.com> - 1:0.9.0-6
168a1c
- Fix permissions. Bug #1685242
168a1c
168a1c
* Sun Feb 17 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1:0.9.0-5
168a1c
- Rebuild for readline 8.0
168a1c
168a1c
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.0-4
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
168a1c
168a1c
* Sun Nov 04 2018 Kevin Fenzi <kevin@scrye.com> - 0.9.0-3
168a1c
- Fix config file to have correct include names. Fixes bug #1642103
168a1c
168a1c
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.9.0-2
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
168a1c
168a1c
* Sat Jun 09 2018 Kevin Fenzi <kevin@scrye.com> - 0.9.0-1
168a1c
- Update to 0.9.0. Fixes bug #1589404
168a1c
168a1c
* Fri May 11 2018 Kevin Fenzi <kevin@scrye.com> - 0.8.5-1
168a1c
- Update to 0.8.5. Fixes bug #1576802
168a1c
168a1c
* Sun May 06 2018 Kevin Fenzi <kevin@scrye.com> - 0.8.4-2
168a1c
- Fix devel package to require the Epoch too.
168a1c
- Fix libraries split
168a1c
168a1c
* Fri May 04 2018 Kevin Fenzi <kevin@scrye.com> - 0.8.4-1
168a1c
- Update to 0.8.4. Fixes bug #1574096
168a1c
168a1c
* Sat Mar 03 2018 Kevin Fenzi <kevin@scrye.com> - 0.8.3-1
168a1c
- Update to 0.8.3. Fixes bug #1551207
168a1c
168a1c
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.8.2-2
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
168a1c
168a1c
* Mon Feb 05 2018 Kevin Fenzi <kevin@scrye.com> - 0.8.2-1
168a1c
- Update to 0.8.2. Fixes bug #1541582
168a1c
168a1c
* Tue Jan 16 2018 Kevin Fenzi <kevin@scrye.com> - 0.8.1-1
168a1c
- Update to 0.8.1. Fixes bug #1534982
168a1c
168a1c
* Sun Oct 22 2017 Kevin Fenzi <kevin@scrye.com> - 0.8-1
168a1c
- Update to 0.8. 
168a1c
168a1c
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.7-5
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
168a1c
168a1c
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.7-4
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
168a1c
168a1c
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.7-3
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
168a1c
168a1c
* Thu Jan 12 2017 Igor Gnatenko <ignatenko@redhat.com> - 1:0.7-2
168a1c
- Rebuild for readline 7.x
168a1c
168a1c
* Thu Dec 22 2016 Kevin Fenzi <kevin@scrye.com> - 0.7-1
168a1c
- Update to 0.7
168a1c
168a1c
* Fri Jul 15 2016 Kevin Fenzi <kevin@scrye.com> - 0.6-2
168a1c
- Rebuild for new glibc symbols
168a1c
168a1c
* Thu Jun 02 2016 Kevin Fenzi <kevin@scrye.com> - 0.6-1
168a1c
- Update to 0.6.
168a1c
168a1c
* Sun Apr 10 2016 Kevin Fenzi <kevin@scrye.com> - 0.5-4
168a1c
- Add example config files and move config to /etc/sysconfig. Fixes bug #1313936
168a1c
168a1c
* Fri Mar 25 2016 Kevin Fenzi <kevin@scrye.com> - 0.5-3
168a1c
- Add systemd unit file. Fixes bug #1313936
168a1c
168a1c
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1:0.5-2
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
168a1c
168a1c
* Thu Sep 17 2015 Kevin Fenzi <kevin@scrye.com> 0.5-1
168a1c
- Update to 0.5
168a1c
168a1c
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:0.4-3
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
168a1c
168a1c
* Sat Jan 10 2015 Kevin Fenzi <kevin@scrye.com> 0.4-2
168a1c
- Add patch to fix nft -f dep gen.
168a1c
168a1c
* Fri Dec 26 2014 Kevin Fenzi <kevin@scrye.com> 0.4-1
168a1c
- Update to 0.4
168a1c
- Add Epoch to fix versioning. 
168a1c
168a1c
* Wed Sep 03 2014 Kevin Fenzi <kevin@scrye.com> 0.100-4.20140903git
168a1c
- Update to 20140903 snapshot
168a1c
168a1c
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.100-4.20140704git
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
168a1c
168a1c
* Fri Jul 04 2014 Kevin Fenzi <kevin@scrye.com> 0.100-3.20140704git
168a1c
- Update to new snapshot
168a1c
168a1c
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.100-2.20140426git
168a1c
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
168a1c
168a1c
* Sat Apr 26 2014 Kevin Fenzi <kevin@scrye.com> 0.100-1.20140426git
168a1c
- Update t0 20140426
168a1c
168a1c
* Sun Mar 30 2014 Kevin Fenzi <kevin@scrye.com> 0.100-1.20140330git
168a1c
- Update to 20140330 snapshot
168a1c
- Sync versions to be post 0.100 release.
168a1c
168a1c
* Wed Mar 26 2014 Kevin Fenzi <kevin@scrye.com> 0-0.7.20140326git
168a1c
- Update to 20140326 snapshot
168a1c
- Fix permissions on man pages. 
168a1c
168a1c
* Mon Mar 24 2014 Kevin Fenzi <kevin@scrye.com> 0-0.6.20140324git
168a1c
- Update to 20140324 snapshot
168a1c
168a1c
* Fri Mar 07 2014 Kevin Fenzi <kevin@scrye.com> 0-0.5.20140307git
168a1c
- Update to 20140307
168a1c
168a1c
* Sat Jan 25 2014 Kevin Fenzi <kevin@scrye.com> 0-0.4.20140125git
168a1c
- Update to 20140125 snapshot
168a1c
168a1c
* Sat Jan 18 2014 Kevin Fenzi <kevin@scrye.com> 0-0.3.20140118git
168a1c
- Update to 20140118 snapshot
168a1c
- Fixed License tag to be correct
168a1c
- Fixed changelog
168a1c
- nft scripts now use full path for nft
168a1c
- Fixed man page building
168a1c
- Dropped unneeded rm in install
168a1c
- Patched build to not be silent. 
168a1c
168a1c
* Tue Dec 03 2013 Kevin Fenzi <kevin@scrye.com> 0-0.2.20131202git
168a1c
- Use upstream snapshots for source.
168a1c
- Use 0 for version. 
168a1c
168a1c
* Sat Nov 30 2013 Kevin Fenzi <kevin@scrye.com> 0-0.1
168a1c
- initial version for Fedora review