diff --git a/0001-build-resolve-link-failure-for-ip6t_NETMAP.patch b/0001-build-resolve-link-failure-for-ip6t_NETMAP.patch
new file mode 100644
index 0000000..a824a62
--- /dev/null
+++ b/0001-build-resolve-link-failure-for-ip6t_NETMAP.patch
@@ -0,0 +1,42 @@
+From 070e9ad8fe6380be3fe19924cd50619e540382d0 Mon Sep 17 00:00:00 2001
+From: Jan Engelhardt <jengelh@inai.de>
+Date: Sun, 2 Dec 2012 19:09:38 +0100
+Subject: [PATCH] build: resolve link failure for ip6t_NETMAP
+
+Link stage of libip6t_NETMAP failed since recently.
+
+  CCLD     libip6t_NETMAP.so
+/usr/lib64/gcc/x86_64-suse-linux/4.7/../../../../x86_64-suse-linux/bin/ld:
+cannot find -lip6tc
+
+libip6t_NETMAP.c uses the "ipv6_prefix_length" function from
+libip6tc.so; "-lip6tc" is used in the Makefile, but, the directory to
+it is not specified.
+
+Why does the link succeed for some people? Because
+/usr/lib(64)/libip6tc.so satisfies -lip6tc, but not all environments,
+especially those without iptables development files, have that file,
+hence this link error can happen.
+
+Signed-off-by: Jan Engelhardt <jengelh@inai.de>
+---
+ extensions/GNUmakefile.in |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in
+index e71e3ff..68e0b9b 100644
+--- a/extensions/GNUmakefile.in
++++ b/extensions/GNUmakefile.in
+@@ -101,7 +101,8 @@ libxt_state.so: libxt_conntrack.so
+ 	ln -fs $< $@
+ 
+ # Need the LIBADDs in iptables/Makefile.am too for libxtables_la_LIBADD
+-ip6t_NETMAP_LIBADD  = -lip6tc
++ip6t_NETMAP_LIBADD  = -L${top_builddir}/libiptc/.libs \
++                      -L${top_builddir}/libiptc -lip6tc
+ xt_RATEEST_LIBADD   = -lm
+ xt_statistic_LIBADD = -lm
+ 
+-- 
+1.7.10.4
+
diff --git a/iptables-1.4.16.3.tar.bz2 b/iptables-1.4.16.3.tar.bz2
deleted file mode 100644
index 09df979..0000000
--- a/iptables-1.4.16.3.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:643ccf34099d53d5b839e1d889c05627745a51ec122648e76a9fcec3a8a9ec79
-size 536872
diff --git a/iptables-1.4.16.3.tar.bz2.sig b/iptables-1.4.16.3.tar.bz2.sig
deleted file mode 100644
index 1ea44ba..0000000
Binary files a/iptables-1.4.16.3.tar.bz2.sig and /dev/null differ
diff --git a/iptables-1.4.17.tar.bz2 b/iptables-1.4.17.tar.bz2
new file mode 100644
index 0000000..f323a8b
--- /dev/null
+++ b/iptables-1.4.17.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:51e7a769469383b6ad308a6a19cdd2bd813cf4593e21a156a543a1cd70554925
+size 541137
diff --git a/iptables-1.4.17.tar.bz2.sig b/iptables-1.4.17.tar.bz2.sig
new file mode 100644
index 0000000..8b29515
Binary files /dev/null and b/iptables-1.4.17.tar.bz2.sig differ
diff --git a/iptables.changes b/iptables.changes
index 3f46a9e..d86488c 100644
--- a/iptables.changes
+++ b/iptables.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Tue Dec 25 22:47:56 UTC 2012 - jengelh@inai.de
+
+- Update to new upstream release 1.4.17
+* libxt_time: add support to ignore day transition
+* libxt_statistic: fix save output
+
 -------------------------------------------------------------------
 Wed Nov 28 17:07:29 CET 2012 - sbrabec@suse.cz
 
diff --git a/iptables.spec b/iptables.spec
index 80f22c7..5ad5c4b 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -20,7 +20,7 @@ Name:           iptables
 %define lname_ipq	libipq0
 %define lname_iptc	libiptc0
 %define lname_xt	libxtables9
-Version:        1.4.16.3
+Version:        1.4.17
 Release:        0
 Summary:        IP Packet Filter Administration utilities
 License:        GPL-2.0+
@@ -36,6 +36,7 @@ Source2:        http://netfilter.org/projects/iptables/files/%name-%version.tar.
 Source3:        %name.keyring
 Patch1:         iptables-batch.patch
 Patch2:         iptables-apply-mktemp-fix.patch
+Patch3:         0001-build-resolve-link-failure-for-ip6t_NETMAP.patch
 
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 %if 0%{?suse_version}
@@ -147,7 +148,7 @@ xtables --variable=xtlibdir).
 tar -xf "%{S:0}" --use=bzip2;
 %setup -DTq
 %endif
-%patch -P 1 -P 2 -p1
+%patch -P 1 -P 2 -P 3 -p1
 
 %build
 # We have the iptables-batch patch, so always regenerate.