# install init scripts to /usr/libexec with systemd

%global script_path %{_libexecdir}/iptables

# service legacy actions (RHBZ#748134)

%global legacy_actions %{_libexecdir}/initscripts/legacy-actions

%global iptc_so_ver  0

%global ipXtc_so_ver 2

Name: iptables

Summary: Tools for managing Linux kernel packet filtering capabilities

URL: https://www.netfilter.org/projects/iptables

Version: 1.8.7

Release: 8%{?dist}

Source: %{url}/files/%{name}-%{version}.tar.bz2

Source1: iptables.init

Source2: iptables-config

Source3: iptables.service

Source4: sysconfig_iptables

Source5: sysconfig_ip6tables

Source6: arptables-nft-helper

Patch1: 0001-ebtables-Exit-gracefully-on-invalid-table-names.patch

# pf.os: ISC license

# iptables-apply: Artistic Licence 2.0

License: GPLv2 and Artistic Licence 2.0 and ISC

# libnetfilter_conntrack is needed for xt_connlabel

BuildRequires: pkgconfig(libnetfilter_conntrack)

# libnfnetlink-devel is requires for nfnl_osf

BuildRequires: pkgconfig(libnfnetlink)

BuildRequires: libselinux-devel

BuildRequires: kernel-headers

BuildRequires: systemd

# libmnl, libnftnl, bison, flex for nftables

BuildRequires: bison

BuildRequires: flex

BuildRequires: gcc

BuildRequires: pkgconfig(libmnl) >= 1.0

BuildRequires: pkgconfig(libnftnl) >= 1.1.5

# libpcap-devel for nfbpf_compile

BuildRequires: libpcap-devel

BuildRequires: autoconf

BuildRequires: automake

BuildRequires: libtool

BuildRequires: make

%description

The iptables utility controls the network packet filtering code in the

Linux kernel. If you need to set up firewalls and/or IP masquerading,

you should install this package.

%package compat

Summary: Temporary transitioning package

Obsoletes: %{name} < 1.8.7-4

Requires: %{name}-legacy = %{version}-%{release}

Requires: %{name}-utils = %{version}-%{release}

%description compat

This package only exists to help transition iptables users to the new

package split. It will be removed after one distribution release cycle, please

do not reference it or depend on it in any way.

%package legacy

Summary: Legacy tools for managing Linux kernel packet filtering capabilities

Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}

Requires: %{name}-libs%{?_isa} = %{version}-%{release}

Conflicts: setup < 2.10.4-1

Requires(post): %{_sbindir}/update-alternatives

Requires(postun): %{_sbindir}/update-alternatives

%if 0%{?rhel} < 9

Provides:	iptables

%endif

%description legacy

The iptables utility controls the network packet filtering code in the

Linux kernel. This package contains the legacy tools which are obsoleted by

nft-variants in iptables-nft package for backwards compatibility reasons.

If you need to set up firewalls and/or IP masquerading, you should not install

this package but either nftables or iptables-nft instead.

%package libs

Summary: libxtables and iptables extensions userspace support

%description libs

libxtables and associated shared object files

Libxtables provides unified access to iptables extensions in userspace. Data

and logic for those is kept in per-extension shared object files.

%package legacy-libs

Summary: iptables legacy libraries

%description legacy-libs

iptables libraries.

Please remember that libip*tc libraries do neither have a stable API nor a real so version.

For more information about this, please have a look at

  http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5

%package devel

Summary: Development package for iptables

Requires: %{name}-libs%{?_isa} = %{version}-%{release}

# XXX: Drop this after two releases or so

Requires: %{name}-legacy-devel%{?_isa} = %{version}-%{release}

Requires: pkgconfig

%description devel

libxtables development headers and pkgconfig files

%package legacy-devel

Summary: Development package for legacy iptables

Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}

Requires: pkgconfig

%description legacy-devel

Legacy iptables development headers and pkgconfig files

The iptc libraries are marked as not public by upstream. The interface is not

stable and may change with every new version. It is therefore unsupported.

%package services

Summary: iptables and ip6tables services for iptables

Requires: %{name} = %{version}-%{release}

%{?systemd_ordering}

# obsolete old main package

Obsoletes: %{name} < 1.4.16.1

# obsolete ipv6 sub package

Obsoletes: %{name}-ipv6 < 1.4.11.1

%description services

iptables services for IPv4 and IPv6

This package provides the services iptables and ip6tables that have been split

out of the base package since they are not active by default anymore.

%package utils

Summary: iptables and ip6tables misc utilities

Requires: %{name} = %{version}-%{release}

%description utils

Utils for iptables

This package provides nfnl_osf with the pf.os database and nfbpf_compile,

a bytecode generator for use with xt_bpf. Also included is iptables-apply,

a safer way to update iptables remotely.

%package nft

Summary: nftables compatibility for iptables, arptables and ebtables

Requires: %{name}-libs%{?_isa} = %{version}-%{release}

Requires(post): %{_sbindir}/update-alternatives

Requires(post): %{_bindir}/readlink

Requires(postun): %{_sbindir}/update-alternatives

Obsoletes: iptables-compat < 1.6.2-4

Provides: arptables-helper

Provides: iptables

Provides: arptables

Provides: ebtables

%description nft

nftables compatibility for iptables, arptables and ebtables.

%prep

%autosetup -p1

%build

./autogen.sh

CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \

%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr

# do not use rpath

sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool

sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool

rm -f include/linux/types.h

%make_build

%install

%make_install

# remove la file(s)

rm -f %{buildroot}%{_libdir}/*.la

# install init scripts and configuration files

install -d -m 755 %{buildroot}%{script_path}

install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init

sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init

install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init

install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig

install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config

sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config

install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config

install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables

install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables

# install systemd service files

install -d -m 755 %{buildroot}/%{_unitdir}

install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}

sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service

install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}

# install legacy actions for service command

install -d %{buildroot}/%{legacy_actions}/iptables

install -d %{buildroot}/%{legacy_actions}/ip6tables

cat << EOF > %{buildroot}/%{legacy_actions}/iptables/save

#!/bin/bash

exec %{script_path}/iptables.init save

EOF

chmod 755 %{buildroot}/%{legacy_actions}/iptables/save

sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/save > ip6tabes.save-legacy

install -c -m 755 ip6tabes.save-legacy %{buildroot}/%{legacy_actions}/ip6tables/save

cat << EOF > %{buildroot}/%{legacy_actions}/iptables/panic

#!/bin/bash

exec %{script_path}/iptables.init panic

EOF

chmod 755 %{buildroot}/%{legacy_actions}/iptables/panic

sed -e 's;iptables.init;ip6tables.init;g' -e 's;IPTABLES;IP6TABLES;g' < %{buildroot}/%{legacy_actions}/iptables/panic > ip6tabes.panic-legacy

install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables/panic

# Remove /etc/ethertypes (now part of setup)

rm -f %{buildroot}%{_sysconfdir}/ethertypes

install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/

touch %{buildroot}%{_libexecdir}/arptables-helper

# prepare for alternatives

touch %{buildroot}%{_mandir}/man8/arptables.8

touch %{buildroot}%{_mandir}/man8/arptables-save.8

touch %{buildroot}%{_mandir}/man8/arptables-restore.8

touch %{buildroot}%{_mandir}/man8/ebtables.8

%ldconfig_scriptlets

%post legacy

pfx=%{_sbindir}/iptables

pfx6=%{_sbindir}/ip6tables

%{_sbindir}/update-alternatives --install \

	$pfx iptables $pfx-legacy 10 \

	--slave $pfx6 ip6tables $pfx6-legacy \

	--slave $pfx-restore iptables-restore $pfx-legacy-restore \

	--slave $pfx-save iptables-save $pfx-legacy-save \

	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \

	--slave $pfx6-save ip6tables-save $pfx6-legacy-save

%postun legacy

if [ $1 -eq 0 ]; then

	%{_sbindir}/update-alternatives --remove \

		iptables %{_sbindir}/iptables-legacy

fi

# iptables-1.8.0-1 introduced the use of alternatives

# when upgrading, its %postun script runs due to the package renaming

# fix this by repeating the install into alternatives

# also keep the old alternatives configuration to not change the system

%triggerun legacy -- iptables > 1.8.0

alternatives --list | awk '/^iptables/{print $3; exit}' \

		>/var/tmp/alternatives.iptables.current

cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup

%triggerpostun legacy -- iptables > 1.8.0

pfx=%{_sbindir}/iptables

pfx6=%{_sbindir}/ip6tables

%{_sbindir}/update-alternatives --install \

	$pfx iptables $pfx-legacy 10 \

	--slave $pfx6 ip6tables $pfx6-legacy \

	--slave $pfx-restore iptables-restore $pfx-legacy-restore \

	--slave $pfx-save iptables-save $pfx-legacy-save \

	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \

	--slave $pfx6-save ip6tables-save $pfx6-legacy-save

alternatives --set iptables $(

rm /var/tmp/alternatives.iptables.current

mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables

%post services

%systemd_post iptables.service ip6tables.service

%preun services

%systemd_preun iptables.service ip6tables.service

%postun services

%?ldconfig

%systemd_postun iptables.service ip6tables.service

%post nft

pfx=%{_sbindir}/iptables

pfx6=%{_sbindir}/ip6tables

%{_sbindir}/update-alternatives --install \

	$pfx iptables $pfx-nft 10 \

	--slave $pfx6 ip6tables $pfx6-nft \

	--slave $pfx-restore iptables-restore $pfx-nft-restore \

	--slave $pfx-save iptables-save $pfx-nft-save \

	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \

	--slave $pfx6-save ip6tables-save $pfx6-nft-save

pfx=%{_sbindir}/ebtables

manpfx=%{_mandir}/man8/ebtables

for sfx in "" "-restore" "-save"; do

	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then

		rm -f $pfx$sfx

	fi

done

if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then

	rm -f $manpfx.8.gz

fi

%{_sbindir}/update-alternatives --install \

	$pfx ebtables $pfx-nft 10 \

	--slave $pfx-save ebtables-save $pfx-nft-save \

	--slave $pfx-restore ebtables-restore $pfx-nft-restore \

	--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz

pfx=%{_sbindir}/arptables

manpfx=%{_mandir}/man8/arptables

lepfx=%{_libexecdir}/arptables

for sfx in "" "-restore" "-save"; do

	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then

		rm -f $pfx$sfx

	fi

	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then

		rm -f $manpfx$sfx.8.gz

	fi

done

if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then

	rm -f $lepfx-helper

fi

%{_sbindir}/update-alternatives --install \

	$pfx arptables $pfx-nft 10 \

	--slave $pfx-save arptables-save $pfx-nft-save \

	--slave $pfx-restore arptables-restore $pfx-nft-restore \

	--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz \

	--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz \

	--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz \

	--slave $lepfx-helper arptables-helper $lepfx-nft-helper

%postun nft

if [ $1 -eq 0 ]; then

	for cmd in iptables ebtables arptables; do

		%{_sbindir}/update-alternatives --remove \

			$cmd %{_sbindir}/$cmd-nft

	done

fi

%files compat

%files legacy

%doc INCOMPATIBILITIES

%{_sbindir}/ip{,6}tables-legacy*

%{_sbindir}/xtables-legacy-multi

%{_bindir}/iptables-xml

%{_mandir}/man1/iptables-xml*

%{_mandir}/man8/xtables-legacy*

%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}

%files libs

%license COPYING

%{_libdir}/libxtables.so.12*

%dir %{_libdir}/xtables

%{_libdir}/xtables/lib{ip,ip6,x}t*

%{_mandir}/man8/ip{,6}tables.8.gz

%{_mandir}/man8/ip{,6}tables-{extensions,save,restore}.8.gz

%files legacy-libs

%license COPYING

%{_libdir}/libip{4,6}tc.so.%{ipXtc_so_ver}*

%files devel

%{_includedir}/xtables{,-version}.h

%{_libdir}/libxtables.so

%{_libdir}/pkgconfig/xtables.pc

%files legacy-devel

%dir %{_includedir}/libiptc

%{_includedir}/libiptc/*.h

%{_libdir}/libip*tc.so

%{_libdir}/pkgconfig/libip{,4,6}tc.pc

%files services

%dir %{script_path}

%{script_path}/ip{,6}tables.init

%config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}

%{_unitdir}/ip{,6}tables.service

%dir %{legacy_actions}/ip{,6}tables

%{legacy_actions}/ip{,6}tables/{save,panic}

%files utils

%license COPYING

%{_sbindir}/nfnl_osf

%{_sbindir}/nfbpf_compile

%{_sbindir}/ip{,6}tables-apply

%dir %{_datadir}/xtables

%{_datadir}/xtables/pf.os

%{_mandir}/man8/nfnl_osf*

%{_mandir}/man8/nfbpf_compile*

%{_mandir}/man8/ip{,6}tables-apply*

%files nft

%{_sbindir}/ip{,6}tables-nft*

%{_sbindir}/ip{,6}tables{,-restore}-translate

%{_sbindir}/{eb,arp}tables-nft*

%{_sbindir}/xtables-nft-multi

%{_sbindir}/xtables-monitor

%dir %{_libdir}/xtables

%{_libdir}/xtables/lib{arp,eb}t*

%{_libexecdir}/arptables-nft-helper

%{_mandir}/man8/xtables-monitor*

%{_mandir}/man8/xtables-translate*

%{_mandir}/man8/*-nft*

%{_mandir}/man8/ip{,6}tables{,-restore}-translate*

%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}

%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}

%ghost %{_libexecdir}/arptables-helper

%ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz

%ghost %{_mandir}/man8/ebtables.8.gz

%changelog

* Fri May 07 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-8

- iptables.init: Fix functionality for iptables-nft

- iptables.init: Ignore sysctl files not suffixed '.conf'

- iptables.init: Drop unused NEW_MODUTILS check

- iptables.init: Drop some trailing whitespace

* Mon Mar 29 2021 Damian Wrobel <dwrobel@ertelnet.rybnik.pl> - 1.8.7-7

- Add missing readlink required for iptables-nft(post)

* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-6

- Restore alternatives configuration after upgrade

- Fix license location

* Tue Mar 23 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-5

- Fix upgrade path with package rename

- Add missing dependencies to iptables-nft package

* Tue Feb 16 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-4

- Drop bootstrap code again

- Drop workarounds for F24 and lower

- Fix iptables-utils summary

- Ship iptables-apply with iptables-utils

- Reduce files sections by use of globbing

- Ship common man pages with iptables-libs

- Ship *-translate man pages with iptables-nft

- Move legacy iptables binaries, libraries and headers into sub-packages

- Introduce compat sub-package to help with above transitions

- Drop libipulog header from devel package, this belongs to libnetfilter_log

- Do not ship internal headers in devel package

* Thu Jan 28 2021 Phil Sutter <psutter@redhat.com> - 1.8.7-3

- ebtables: Exit gracefully on invalid table names

* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.8.7-1

- Update to 1.8.7. Fixes rhbz#1916948

* Thu Nov 19 17:32:24 CET 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-5

- Use make macros

* Tue Nov 17 14:05:30 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-4

- ebtables: Fix for broken chain renaming

* Mon Nov 16 13:39:22 CET 2020 Phil Sutter <psutter@redhat.com> - 1.8.6-3

- Drop obsolete StandardOutput setting from unit file

- Remove StandardError setting from unit file, its value is default

* Thu Nov  5 2020 Florian Weimer <fweimer@redhat.com> - 1.8.6-2

- Remove build dependency on autogen

* Sat Oct 31 2020 Kevin Fenzi <kevin@scrye.com> - 1.8.6-1

- Update to 1.8.6. Fixes bug #1893453

* Tue Aug 25 15:56:10 GMT 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-3

- nft: cache: Check consistency with NFT_CL_FAKE, too

- nft: Fix command name in ip6tables error message

* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.5-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

* Tue Jun 23 2020 Phil Sutter <psutter@redhat.com> - 1.8.5-1

- Rebase onto upstream version 1.8.5 plus two late fixes

- Drop explicit iptables-apply installation, upstream fixed that

- Ship ip6tables-apply along with iptables package

* Wed Feb 12 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-7

- Move nft-specific extensions into iptables-nft package

- Move remaining extensions into iptables-libs package

- Make iptables-nft depend on iptables-libs instead of iptables

- Add upstream-suggested fixes

* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-6

- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

* Wed Jan 15 2020 Phil Sutter <psutter@redhat.com> - 1.8.4-5

- Raise Alternatives priority of nft variants to match legacy ones

- Add Provides lines to allow for iptables-nft as full legacy alternative

* Thu Dec 19 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-4

- Drop leftover include in arptables-nft-helper

* Fri Dec 13 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-3

- Remove dependencies on initscripts package

* Tue Dec 10 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-2

- iptables-services requires /etc/init.d/functions

* Wed Dec 04 2019 Phil Sutter <psutter@redhat.com> - 1.8.4-1

- New upstream version 1.8.4

* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

* Tue Jun 25 2019 Björn Esser <besser82@fedoraproject.org> - 1.8.3-4

- Disable bootstrapping

* Tue Jun 25 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-3

- Change URL to point at iptables project, not netfilter overview page

- Reuse URL value in tarball source

- Reduce globbing of library file names to expose future SONAME changes

- Add bootstrapping for libip*tc SONAME bump

* Tue Jun 25 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-2

- Install new man page for nfbpf_compile utility

- Move nfnl_osf man page to utils subpackage

* Wed May 29 2019 Phil Sutter <psutter@redhat.com> - 1.8.3-1

- New upstream version 1.8.3

* Mon Apr 15 2019 Phil Sutter <psutter@redhat.com> - 1.8.2-1

- New upstream version 1.8.2

- Integrate ebtables and arptables save/restore scripts with alternatives

- Add nft-specific ebtables and arptables man pages

- Move /etc/sysconfig/ip*tables-config files into services sub-package

* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.0-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

* Wed Jan 23 2019 Bogdan Dobrelya <bdobreli@redhat.com> - 1.8.0-4

- Use systemd_ordering macro

* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.0-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

* Tue Jul 10 2018 Phil Sutter <psutter@redhat.com> - 1.8.0-2

- Fix calling ebtables-nft and arptables-nft via their new names.

* Mon Jul 09 2018 Phil Sutter <psutter@redhat.com> - 1.8.0-1

- New upstream version 1.8.0.

- Replace ldconfig calls with newly introduced macros.

- Rename compat subpackage to iptables-nft to clarify its purpose.

- Make use of Alternatives system.

* Fri May 04 2018 Phil Sutter <psutter@redhat.com> - 1.6.2-3

- Fix License: tag in spec-file

- Fix separation into compat subpackage

* Thu Mar 01 2018 Phil Sutter <psutter@redhat.com> - 1.6.2-2

- Kill module unloading support

- Support /etc/sysctl.d

- Don't restart services after package update

- Add support for --wait options to restore commands

* Wed Feb 21 2018 Michael Cronenworth <mike@cchtml.com> - 1.6.2-1

- New upstream version 1.6.2

  http://www.netfilter.org/projects/iptables/files/changes-iptables-1.6.2.txt

* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-6

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

* Sun Oct 22 2017 Kevin Fenzi <kevin@scrye.com> - 1.6.1-5

- Rebuild for new libnftnl

* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

* Thu Feb 02 2017 Thomas Woerner <twoerner@redhat.com> - 1.6.1-1

- New upstream version 1.6.1 with enhanced translation to nft support and

  several fixes (RHBZ#1417323)

  http://netfilter.org/projects/iptables/files/changes-iptables-1.6.1.txt

- Enable parallel build again

* Thu Feb 02 2017 Petr Šabata <contyk@redhat.com> - 1.6.0-4

- Disabling parallel build to avoid build issues with xtables

- See http://patchwork.alpinelinux.org/patch/1787/ for reference

- This should be fixed in 1.6.1; parallel build can be restored after the

  update

* Mon Dec 19 2016 Thomas Woerner <twoerner@redhat.com> - 1.6.0-3

- Dropped bad provides for iptables in services sub package (RHBZ#1327786)

* Fri Jul 22 2016 Thomas Woerner <twoerner@redhat.com> - 1.6.0-2

- /etc/ethertypes has been moved into the setup package for F-25+.

  (RHBZ#1329256)

* Wed Apr 13 2016 Thomas Woerner <twoerner@redhat.com> - 1.6.0-1

- New upstream version 1.6.0 with nft-compat support and lots of fixes (RHBZ#1292990)

  Upstream changelog:

  http://netfilter.org/projects/iptables/files/changes-iptables-1.6.0.txt

- New libs sub package containing libxtables and unstable libip*tc libraries (RHBZ#1323161)

- Using scripts form RHEL-7 (RHBZ#1240366)

- New compat sub package for nftables compatibility

- Install iptables-apply (RHBZ#912047)

- Fixed module uninstall (RHBZ#1324101)

- Incorporated changes by Petr Pisar

- Enabled bpf compiler (RHBZ#1170227) Thanks to Yanko Kaneti for the patch

* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.21-16

- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.21-15

- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

* Mon Dec 01 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-14

- add dhcpv6-client to /etc/sysconfig/ip6tables (RHBZ#1169036)

* Mon Nov 03 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-13

- iptables.init: use /run/lock/subsys/ instead of /var/lock/subsys/ (RHBZ#1159573)

* Mon Sep 29 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-12

- ip[6]tables.init: change shebang from /bin/sh to /bin/bash (RHBZ#1147272)

* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.21-11

- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild

* Sat Jul 12 2014 Tom Callaway <spot@fedoraproject.org> - 1.4.21-10

- fix license handling

* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.21-9

- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

* Wed Mar 12 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-8

- add missing reload and panic actions

- BuildRequires: pkgconfig(x) instead of x-devel

- no need to specify file mode bits twice (in %%install and %%files)

* Sun Jan 19 2014 Ville Skyttä <ville.skytta@iki.fi> - 1.4.21-7

- Don't order services after syslog.target.

* Wed Jan 15 2014 Thomas Woerner <twoerner@redhat.com> 1.4.21-6

- Enable connlabel support again, needs libnetfilter_conntrack

* Wed Jan 15 2014 Thomas Woerner <twoerner@redhat.com> 1.4.21-6

- fixed update from RHEL-6 to RHEL-7 (RHBZ#1043901)

* Tue Jan 14 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-5

- chmod /etc/sysconfig/ip[6]tables 755 -> 600

* Fri Jan 10 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-4

- drop virtual provide for xtables.so.9

- add default /etc/sysconfig/ip[6]tables (RHBZ#1034494)

* Thu Jan 09 2014 Jiri Popelka <jpopelka@redhat.com> - 1.4.21-3

- no need to support the pre-systemd things

- use systemd macros (#850166)

- remove scriptlets for migrating to a systemd unit from a SysV initscripts

- ./configure -> %%configure

- spec clean up

- fix self-obsoletion

* Thu Jan  9 2014 Thomas Woerner <twoerner@redhat.com> 1.4.21-2

- fixed system hang at shutdown if root device is network based (RHBZ#1007934)

  Thanks to Rodrigo A B Freire for the patch

* Thu Jan  9 2014 Thomas Woerner <twoerner@redhat.com> 1.4.21-1

- no connlabel.conf upstream anymore

- new version 1.4.21

  - doc: clarify DEBUG usage macro

  - iptables: use autoconf to process .in man pages

  - extensions: libipt_ULOG: man page should mention NFLOG as replacement

  - extensions: libxt_connlabel: use libnetfilter_conntrack

  - Introduce a new revision for the set match with the counters support

  - libxt_CT: Add the "NOTRACK" alias

  - libip6t_mh: Correct command to list named mh types in manpage

  - extensions: libxt_DNAT, libxt_REDIRECT, libxt_NETMAP, libxt_SNAT, libxt_MASQUERADE, libxt_LOG: rename IPv4 manpage and tell about IPv6 support

  - extensions: libxt_LED: fix parsing of delay

  - ip{6}tables-restore: fix breakage due to new locking approach

  - libxt_recent: restore minimum value for --seconds

  - iptables-xml: fix parameter parsing (similar to 2165f38)

  - extensions: add copyright statements

  - xtables: improve get_modprobe handling

  - ip[6]tables: Add locking to prevent concurrent instances

  - iptables: Fix connlabel.conf install location

  - ip6tables: don't print out /128

  - libip6t_LOG: target output is different to libipt_LOG

  - build: additional include path required after UAPI changes

  - iptables: iptables-xml: Fix various parsing bugs

  - libxt_recent: restore reap functionality to recent module

  - build: fail in configure on missing dependency with --enable-bpf-compiler

  - extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameter

  - extensions: libxt_set, libxt_SET: check the set family too

  - ip6tables: Use consistent exit code for EAGAIN

  - iptables: libxt_hashlimit.man: correct address

  - iptables: libxt_conntrack.man extraneous commas

  - iptables: libip(6)t_REJECT.man default icmp types

  - iptables: iptables-xm1.1 correct man section

  - iptables: libxt_recent.{c,man} dead URL

  - iptables: libxt_string.man add examples

  - extensions: libxt_LOG: use generic syslog reference in manpage

  - iptables: extensions/GNUMakefile.in use CPPFLAGS

  - iptables: correctly reference generated file

  - ip[6]tables: fix incorrect alignment in commands_v_options

  - build: add software version to manpage first line at configure stage

  - extensions: libxt_cluster: add note on arptables-jf

  - utils: nfsynproxy: fix error while compiling the BPF filter

  - extensions: add SYNPROXY extension

  - utils: add nfsynproxy tool

  - iptables: state match incompatibilty across versions

  - libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks

  - iptables: improve chain name validation

  - iptables: spurious error in load_extension

  - xtables: trivial spelling fix

* Sun Dec 22 2013 Ville Skyttä <ville.skytta@iki.fi> - 1.4.19.1-2