From a0ae64b6a1adeeef03a06a1139ef08f47c6173c8b8b7e6a1912eac7e01af344f Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Fri, 13 May 2022 16:00:07 +0000
Subject: [PATCH] - Update to release 1.8.8

OBS-URL: https://build.opensuse.org/package/show/security:netfilter/iptables?expand=0&rev=151
---
 iptables-1.8.7.tar.bz2     |   3 ---
 iptables-1.8.7.tar.bz2.sig | Bin 566 -> 0 bytes
 iptables-1.8.8.tar.bz2     |   3 +++
 iptables-1.8.8.tar.bz2.sig | Bin 0 -> 566 bytes
 iptables-batch-lock.patch  |  46 ++++++++++++++++++-------------------
 iptables.changes           |  14 +++++++++++
 iptables.spec              |   4 ++--
 7 files changed, 42 insertions(+), 28 deletions(-)
 delete mode 100644 iptables-1.8.7.tar.bz2
 delete mode 100644 iptables-1.8.7.tar.bz2.sig
 create mode 100644 iptables-1.8.8.tar.bz2
 create mode 100644 iptables-1.8.8.tar.bz2.sig

diff --git a/iptables-1.8.7.tar.bz2 b/iptables-1.8.7.tar.bz2
deleted file mode 100644
index 1c24da2..0000000
--- a/iptables-1.8.7.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0
-size 717862
diff --git a/iptables-1.8.7.tar.bz2.sig b/iptables-1.8.7.tar.bz2.sig
deleted file mode 100644
index e2ba9695e335cc3ee09374c0eeb580b76cfcd16c9f6a04ee3c5c7903ed089567..0000000000000000000000000000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 566
zcmV-60?GY}0y6{v0SW*e79j*T*<`H1NrA^z0Q;NOU6+cA6d>dU0$>6X<Nyi@5Y=6m
zii#8<<P>QS|4dvMo1UhGdXU~^%pl3S>CVJ5M$z<S(L*4D7fmgmno|-MEk0q^dOxS)
zJ2OHM3lG|H$kjDqp09bbOd~Jyirw?A4TqB904~{4vR!qoG$>NspMeuLuX~*f_7Upr
z$MK!o%fw`{LgdJ-a-pvROx*7KmCK4ma*?Q;*=+mQ_h#-&gU&+b2NXY3aOWcvHweS%
ztDSA|sTQ~D?-AX>lqO06xd)sUfN$b2$;tkTLOsXYC5+<Lt9D7j2<yy0YJj`%!$q4t
z2&{E!IUGr`f$f_ZCs8JCvBu!?S+UWWiqPiG1DM}=wZ)kvGH_QVig=q=fy|=SRbX<4
zbKMJqMj*@#?X&IS^J@TnJ81q`rkln>E)Ew!a`a`YUJCOY8Go#l$@j|3WH^XeLv}u|
zS23DWw<?*_m@_^P?!N=U)u;Y!_^-2;LrX<AV*a4v3rFre&U8&KIF%{n@Ngn7As0jy
z!7TT;DIQrWp)Py5mb%dvFxlwzo6&RbsadF-x^4Dtf^;cLFBNfl^!g4VwDJYp)ALE&
z(qOjGnXLfXp&Jl8j0T+DhAZ%F2YIvJQubdRAonlz>{QeI-cp@|zfa`)cg^PObjzel
z=~5#YFOh9M5SJZ+el`cq+g>nSB~NzJx2)6<3C895-nTYK$YuR?Hy`=2EH;3#WqutZ
E46VW#3jhEB

diff --git a/iptables-1.8.8.tar.bz2 b/iptables-1.8.8.tar.bz2
new file mode 100644
index 0000000..123c4d7
--- /dev/null
+++ b/iptables-1.8.8.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:71c75889dc710676631553eb1511da0177bbaaf1b551265b912d236c3f51859f
+size 746985
diff --git a/iptables-1.8.8.tar.bz2.sig b/iptables-1.8.8.tar.bz2.sig
new file mode 100644
index 0000000000000000000000000000000000000000000000000000000000000000..088b87b0cf2fedede57866d7927c0b7ca37927ac490dca26c8e3b27ec9457178
GIT binary patch
literal 566
zcmV-60?GY}0y6{v0SW*e79j*T*<`H1NrA^z0Q;NOU6+cA6d>dU0%Cq*2LK8Q5Y=6m
zii#8<<jd|4|8mL7cfqeiNDWkcV~sBCx+fpr8|m{_>4YP`6gV;*xa**0(Wn~ezeef7
zS164YpCstGw|tG9o`W|qOP@XYI?w>?9jT8mj=z-tNyhqj4!;j;oWO_c{cZPgTGzE<
zuGI1=D{7tJaf85rBT5M^jxF#z1Ts#Cd>VX)rcvF)&eyZ{o;5<$CsraOm&__;*T!c@
znb4CY4^3$JVR2l;uRq?2ZVtnc8#<pGBhbF)^vBsYkc^&|5bT-1iIl$j#-lybg1}Eh
z9u(z8yfMbx>{ga|fuVI+yWfeG!d<^Mtm8fSJJ+hHOld<amI~6!vA%Bd*F67&{)$^k
zMZx@wI*$QhATREs7i)Gnah(u@gN_wsxhmusbL24JwYcihkYSyU9jmqU^s;~61j2-B
zVMVasS~Zy+4r2do#Tm(bTPg<M#8wWIn(ebrc*$)ju>Bupp&EIJ!&UBnLaq+TiQ*-l
z9v_xu^<|>_sFqXHm2sBY&cu=HnGG&11JRpAhi6LS&OLvuF_s*FlUDP1D=23*0Lrm~
z<4(?3=j3qk#3PjAG<PF}Xl$KwQ;3O<`^%R2etd}c87~weZ=YeJ^JRn`2Q{|{YET_m
z|LC$26Q!Vu*<5*3Kxdz#-NY8MwCEul^m82Xw4t>52D#Z`>`)meVS|4HFBwNHJ2HFd
E3<ydXYXATM

literal 0
HcmV?d00001

diff --git a/iptables-batch-lock.patch b/iptables-batch-lock.patch
index 018eff3..abf2825 100644
--- a/iptables-batch-lock.patch
+++ b/iptables-batch-lock.patch
@@ -10,10 +10,10 @@ Date: 2017-06-26T10:53:24+0000
  iptables/xshared.c        |    8 +++++++-
  2 files changed, 28 insertions(+), 1 deletion(-)
 
-Index: iptables-1.8.6/iptables/iptables-batch.c
+Index: iptables-1.8.8/iptables/iptables-batch.c
 ===================================================================
---- iptables-1.8.6.orig/iptables/iptables-batch.c
-+++ iptables-1.8.6/iptables/iptables-batch.c
+--- iptables-1.8.8.orig/iptables/iptables-batch.c
++++ iptables-1.8.8/iptables/iptables-batch.c
 @@ -403,6 +403,27 @@ main(int argc, char *argv[])
  	tables[3].name = "raw";
  	tables[3].handle = NULL;
@@ -27,7 +27,7 @@ Index: iptables-1.8.6/iptables/iptables-batch.c
 +	 * call sequence needs to be locked until the commit is performed.
 +	 *
 +	 * Sadly, the xtables_lock() implementation is not very cooperative.
-+	 * There is no unlock() equivalent. The lock file descriptor is smiply
++	 * There is no unlock() equivalent. The lock file descriptor is simply
 +	 * left open until the process exits. Thus, we would have deadlocks
 +	 * when calling do_command{4,6} the second time.
 +	 *
@@ -42,34 +42,34 @@ Index: iptables-1.8.6/iptables/iptables-batch.c
  
  	while((r = getline(&iline, &llen, fp)) != -1)
  	{
-Index: iptables-1.8.6/iptables/xshared.c
+Index: iptables-1.8.8/iptables/xshared.c
 ===================================================================
---- iptables-1.8.6.orig/iptables/xshared.c
-+++ iptables-1.8.6/iptables/xshared.c
-@@ -248,10 +248,14 @@ void xs_init_match(struct xtables_match
+--- iptables-1.8.8.orig/iptables/xshared.c
++++ iptables-1.8.8/iptables/xshared.c
+@@ -262,10 +262,14 @@ static void alarm_ignore(int i) {
  
- static int xtables_lock(int wait, struct timeval *wait_interval)
+ static int xtables_lock(int wait)
  {
 +	static bool already_locked = false;
- 	struct timeval time_left, wait_time;
+ 	struct sigaction sigact_alarm;
  	const char *lock_file;
- 	int fd, i = 0;
+ 	int fd;
  
 +	if (already_locked)
 +		/* Avoid deadlocks, see iptables-batch.c */
 +		return true;
- 	time_left.tv_sec = wait;
- 	time_left.tv_usec = 0;
- 
-@@ -267,8 +271,10 @@ static int xtables_lock(int wait, struct
+ 	lock_file = getenv("XTABLES_LOCKFILE");
+ 	if (lock_file == NULL || lock_file[0] == '\0')
+ 		lock_file = XT_LOCK_NAME;
+@@ -285,8 +289,10 @@ static int xtables_lock(int wait)
+ 		alarm(wait);
  	}
  
- 	if (wait == -1) {
--		if (flock(fd, LOCK_EX) == 0)
-+		if (flock(fd, LOCK_EX) == 0) {
-+			already_locked = true;
- 			return fd;
-+		}
+-	if (flock(fd, LOCK_EX) == 0)
++	if (flock(fd, LOCK_EX) == 0) {
++		already_locked = true;
+ 		return fd;
++	}
  
- 		fprintf(stderr, "Can't lock %s: %s\n", lock_file,
- 			strerror(errno));
+ 	if (errno == EINTR) {
+ 		errno = EWOULDBLOCK;
diff --git a/iptables.changes b/iptables.changes
index 4e94cea..2f5668f 100644
--- a/iptables.changes
+++ b/iptables.changes
@@ -1,3 +1,17 @@
+-------------------------------------------------------------------
+Fri May 13 15:39:33 UTC 2022 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 1.8.8
+  * Add iptables-translate support for: sctp match's
+    --chunk-types option, connlimit match, multiport match's
+    --ports option, and the tcpmss match.
+  * Reject setuid executables in libxtables for safety reasons
+  * Extended arptables-nft with -C, -I, -R, -S cmomands and the
+    "-c N,M" counter syntax.
+  * Debug output in iptables-restore (all variants), iptables-nft
+    and ebtables-nft when specifying -v multiple times
+  * Improved performance of iptables-save and -restore
+
 -------------------------------------------------------------------
 Thu Dec 30 15:05:20 UTC 2021 - Danilo Spinella <danilo.spinella@suse.com>
 
diff --git a/iptables.spec b/iptables.spec
index af7fbf0..a5d893c 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package iptables
 #
-# Copyright (c) 2021 SUSE LLC
+# Copyright (c) 2022 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -23,7 +23,7 @@
 %endif
 
 Name:           iptables
-Version:        1.8.7
+Version:        1.8.8
 Release:        0
 Summary:        IP packet filter administration utilities
 License:        Artistic-2.0 AND GPL-2.0-only