From 9ebef7d7fe477a78bb603a7b68882968629ba9dfe84fbc2dd59d7d43ab70b7b7 Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Sat, 3 Feb 2018 14:28:48 +0000
Subject: [PATCH] iptables-1.6.2

OBS-URL: https://build.opensuse.org/package/show/security:netfilter/iptables?expand=0&rev=94
---
 iptables-1.6.1.tar.bz2     |   3 --
 iptables-1.6.1.tar.bz2.sig | Bin 543 -> 0 bytes
 iptables-1.6.2.tar.bz2     |   3 ++
 iptables-1.6.2.tar.bz2.sig | Bin 0 -> 543 bytes
 iptables-batch-lock.patch  |  83 ++++++++++++++++++-------------------
 iptables.changes           |   8 ++++
 iptables.spec              |  22 +++++-----
 7 files changed, 63 insertions(+), 56 deletions(-)
 delete mode 100644 iptables-1.6.1.tar.bz2
 delete mode 100644 iptables-1.6.1.tar.bz2.sig
 create mode 100644 iptables-1.6.2.tar.bz2
 create mode 100644 iptables-1.6.2.tar.bz2.sig

diff --git a/iptables-1.6.1.tar.bz2 b/iptables-1.6.1.tar.bz2
deleted file mode 100644
index 7a5ad4c..0000000
--- a/iptables-1.6.1.tar.bz2
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:0fc2d7bd5d7be11311726466789d4c65fb4c8e096c9182b56ce97440864f0cf5
-size 620890
diff --git a/iptables-1.6.1.tar.bz2.sig b/iptables-1.6.1.tar.bz2.sig
deleted file mode 100644
index 4fd55987854a64d8189415748a175b224e7706d2d2854d3fc7988356501ef5da..0000000000000000000000000000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 543
zcmV+)0^t3L0vrSY0RjL91p-)$tNZ{82@tDBRiP%*lH_&g5C2+Hc$X`!TtL;aN)nge
z{92#H)+ih~r~n}=<epd??;uY74uq4*yNE4|4G-{0w8_~0|Mxfjp%s}$vJ|`o5NCd3
z0%2=zI(FZJ4jeU${ZpT#56ZDf$huv4>93U}vTW-<Pi-b1d>OtTZ7bZDvc23R_8A4y
zP8MM#OY^k<65xF`;GI15x-GT4h|bk@;Q^y6*Gz}@2Z?zz$|v_}h%OGP(9e%_iZHG>
z_cgIEHiBSmA$tx(FwV$=EVPMn)m5Tu3C*(Q-gj7A9~{Qfey>K+Q7iPqc>##o>a3bG
z$*omuk<Di9M6RDngH--{4icyn7As_TGyXOV;&M-h0O&;ZK`aQ<bsqbRkoZKBRw9Q<
zVWl-C*aQM;6<`CDsy@t|{@3z1CtLR<OoqhzoUgNWk`@8Yh~16Ucmnw%3u))yZ_**@
zbmh>WkNN^S6sgj-FgZf&JDR`kE4`3AmS4H;8~(Gh#ZM-Xe|@!(T!}mDEUj0mO!pZ*
zPs3oTL4FH_G5AngWdE#kjRPIs!_*hRgH%9eJ3AGggWRt3d?4|pN!nVqBXa6Ys4xZ%
zdxj7ltC*DC(L(>t679|<m1`w%SH+no?hd`^igwY(&WENaY~Vh64lzHU4=G2!S62!7
hH1=cm?;rjbjhg;WJ9+?7R)CcDO&DkV^-#ZOjLRMf1`q%M

diff --git a/iptables-1.6.2.tar.bz2 b/iptables-1.6.2.tar.bz2
new file mode 100644
index 0000000..2d4ae79
--- /dev/null
+++ b/iptables-1.6.2.tar.bz2
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:55d02dfa46263343a401f297d44190f2a3e5113c8933946f094ed40237053733
+size 639785
diff --git a/iptables-1.6.2.tar.bz2.sig b/iptables-1.6.2.tar.bz2.sig
new file mode 100644
index 0000000000000000000000000000000000000000000000000000000000000000..9e4819d8ab2cb574a00510766f61a1a02daaab20377d335f4f99df3519673405
GIT binary patch
literal 543
zcmV+)0^t3L0vrSY0RjL91p-=hh6(@*2@tDBRiP%*lH|&m5Bv>gHC)c|rt*N>wz=Jg
zPf~^<N4S^{&T(g;(g2Y(OvpPyo#77nm$LR8T^~qhAQBzlde|xPLw2Ofr-p_5ob`b`
zTCOj}%OBwDJpjw6?Vy=4J0dLm>>v_T?y*yh{P>9x8MS7<tk&y>s`f(3p+ik*6mG`7
zW%A7)fbfqqL&1c1eUd*1?zOFuL2e$e0F**c?*yiXJ-p=akdI)L$j1&onBStn<N8g~
zZazieF)0qgj@kOr%)B*+a*6Ev%xgT$7=)+)kCXx9kE%hXdp9E?WmP{Q7^Y6P>d-7y
zN?m$HLu4$BQSR~8EA2YW+cujj4)-Q<Za~qrh~_pw*soJWoO-^xWmpym65rqG?&L*0
zSbNn!mw25m6>~-JU*V>^RGfHur6Hd;ev2Dr6Wft~mKERpv>WPbC1yGMz}P^jXIUYJ
zIGJtF^G@TKsIIDXYYTy~Lai`8rId)fOOo9uQ?}etfJo!!P4o60J}dZ^FdR7m|FYXN
zZ7u?$dUBLA0R+U+?i!!28`b)0TP@xok^*>)tC1G<rhQK7{C;@#<Dt`LZak%1Ljx70
za7ex$OfV@w_Lw50v&Ez2tmcq<XJ87^9FTK6%k2qVL#^BqrRxV>2kWsCcuDl3GNsI?
h!@D_Im^GH&bVaDFcV0Pzjzz%P0+`~8ctE7ze1?tG4R`<m

literal 0
HcmV?d00001

diff --git a/iptables-batch-lock.patch b/iptables-batch-lock.patch
index f99ade5..588c667 100644
--- a/iptables-batch-lock.patch
+++ b/iptables-batch-lock.patch
@@ -1,70 +1,67 @@
-Index: iptables-1.6.1/iptables/iptables-batch.c
+---
+ iptables/iptables-batch.c |   21 +++++++++++++++++++++
+ iptables/xshared.c        |    8 +++++++-
+ 2 files changed, 28 insertions(+), 1 deletion(-)
+
+Index: iptables-1.6.2/iptables/iptables-batch.c
 ===================================================================
---- iptables-1.6.1.orig/iptables/iptables-batch.c
-+++ iptables-1.6.1/iptables/iptables-batch.c
-@@ -404,6 +404,34 @@ main(int argc, char *argv[])
+--- iptables-1.6.2.orig/iptables/iptables-batch.c
++++ iptables-1.6.2/iptables/iptables-batch.c
+@@ -403,6 +403,27 @@ main(int argc, char *argv[])
+ 	tables[3].name = "raw";
  	tables[3].handle = NULL;
  	current_table = &tables[0];
- 
 +	/*
-+	 * we need to lock the complete batch processing against parallel
-+	 * modification by other processes. Otherwise we can end up with
++	 * We need to lock the complete batch processing against parallel
++	 * modification by other processes. Otherwise, we can end up with
 +	 * EAGAIN errors.
 +	 *
-+	 * the do_command{4,6} function already locks itself, but the
-+	 * complete call sequence needs to be locked until the commit is
-+	 * performed.
++	 * The do_command{4,6} function already locks itself, but the complete
++	 * call sequence needs to be locked until the commit is performed.
 +	 *
-+	 * sadly the xtables_lock() implementation is not very cooperative.
-+	 * There's no unlock() equivalent. The lock file descriptor is smiply
-+	 * left open until the process exits. Thus we'd have deadlocks when
-+	 * calling do_command{4,6} the second time.
++	 * Sadly, the xtables_lock() implementation is not very cooperative.
++	 * There is no unlock() equivalent. The lock file descriptor is smiply
++	 * left open until the process exits. Thus, we would have deadlocks
++	 * when calling do_command{4,6} the second time.
 +	 *
 +	 * To prevent this, part of this patch adds logic to avoid taking the
 +	 * lock a second time in the same process in xtables_lock()
 +	 */
-+
-+	const struct timeval wait_interval = {
-+		.tv_sec = 1,
-+	};
-+
-+	if( xtables_lock(-1, &wait_interval) != true )
-+	{
++	const struct timeval wait_interval = {.tv_sec = 1};
++	if (!xtables_lock_or_exit(-1, &wait_interval)) {
 +		fprintf(stderr, "failed to acquire the xtables lock\n");
 +		exit(1);
 +	}
-+
+ 
  	while((r = getline(&iline, &llen, fp)) != -1)
  	{
- 		if(llen < 1 || !*iline)
-Index: iptables-1.6.1/iptables/xshared.c
+Index: iptables-1.6.2/iptables/xshared.c
 ===================================================================
---- iptables-1.6.1.orig/iptables/xshared.c
-+++ iptables-1.6.1/iptables/xshared.c
-@@ -250,8 +250,14 @@ void xs_init_match(struct xtables_match
- bool xtables_lock(int wait, struct timeval *wait_interval)
+--- iptables-1.6.2.orig/iptables/xshared.c
++++ iptables-1.6.2/iptables/xshared.c
+@@ -248,9 +248,13 @@ void xs_init_match(struct xtables_match
+ 
+ static int xtables_lock(int wait, struct timeval *wait_interval)
  {
- 	struct timeval time_left, wait_time, waited_time;
 +	static bool already_locked = false;
+ 	struct timeval time_left, wait_time;
  	int fd, i = 0;
  
-+	if( already_locked ) {
-+		// avoid dead-locks, see iptables-batch.c
++	if (already_locked)
++		/* Avoid deadlocks, see iptables-batch.c */
 +		return true;
-+	}
-+
  	time_left.tv_sec = wait;
  	time_left.tv_usec = 0;
- 	waited_time.tv_sec = 0;
-@@ -262,8 +268,10 @@ bool xtables_lock(int wait, struct timev
- 		return true;
  
- 	while (1) {
--		if (flock(fd, LOCK_EX | LOCK_NB) == 0)
-+		if (flock(fd, LOCK_EX | LOCK_NB) == 0) {
+@@ -262,8 +266,10 @@ static int xtables_lock(int wait, struct
+ 	}
+ 
+ 	if (wait == -1) {
+-		if (flock(fd, LOCK_EX) == 0)
++		if (flock(fd, LOCK_EX) == 0) {
 +			already_locked = true;
- 			return true;
+ 			return fd;
 +		}
- 		if (++i % 10 == 0) {
- 			if (wait != -1)
- 				fprintf(stderr, "Another app is currently holding the xtables lock; "
+ 
+ 		fprintf(stderr, "Can't lock %s: %s\n", XT_LOCK_NAME,
+ 			strerror(errno));
diff --git a/iptables.changes b/iptables.changes
index 410856d..015c83b 100644
--- a/iptables.changes
+++ b/iptables.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Sat Feb  3 14:02:59 UTC 2018 - jengelh@inai.de
+
+- Update to new upstream release 1.6.2
+  * add support for the "srh" match
+  * add randomize-full for the "MASQUERADE" target
+  * add rate match mode to the "hashlimit" match
+
 -------------------------------------------------------------------
 Thu Jun 22 15:34:40 UTC 2017 - matthias.gerstner@suse.com
 
diff --git a/iptables.spec b/iptables.spec
index 24c9158..f17a502 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package iptables
 #
-# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -17,12 +17,13 @@
 
 
 Name:           iptables
-Version:        1.6.1
+Version:        1.6.2
 Release:        0
-Summary:        IP Packet Filter Administration utilities
+Summary:        IP packet filter administration utilities
 License:        GPL-2.0 and Artistic-2.0
 Group:          Productivity/Networking/Security
 Url:            http://netfilter.org/projects/iptables/
+#Git-Clone:     git://git.netfilter.org/iptables
 Source:         http://netfilter.org/projects/iptables/files/%name-%version.tar.bz2
 Source2:        http://netfilter.org/projects/iptables/files/%name-%version.tar.bz2.sig
 Source3:        %name.keyring
@@ -55,19 +56,19 @@ the classic "ip6_tables" and "ip_tables" packet filters in the Linux
 kernel.
 
 %package nft
-Summary:        NFT Packet Filter Administration utilties in the style of Xtables
+Summary:        nft packet filter administration utilties in the style of Xtables
 Group:          Productivity/Networking/Security
 Requires:       xtables-plugins = %version-%release
 Conflicts:      ebtables
 
 %description nft
 The programs shipped in this subpackage behave like iptables on the
-command line, but instead edit the rules of the NFT packet filter in
+command line, but instead edits the rules of the nft packet filter in
 the Linux kernel. Linux kernel 4.2 or newer is recommended to exploit
-all features.
+the features.
 
 %package -n xtables-plugins
-Summary:        Match and Target Extension plugins for iptables
+Summary:        Match and target extension plugins for iptables
 Group:          Productivity/Networking/Security
 Conflicts:      iptables < 1.4.18
 
@@ -128,7 +129,7 @@ ip6tables, their extensions, and for external integration for e.g.
 iproute2's m_xt.
 
 %package -n libxtables-devel
-Summary:        Libraries, Headers and Development Man Pages for iptables
+Summary:        Headers and manpages for iptables
 Group:          Development/Libraries/C and C++
 Requires:       libxtables12 = %version
 
@@ -147,7 +148,7 @@ xtables --variable=xtlibdir).
 %build
 # We have the iptables-batch patch, so always regenerate.
 if true || [ ! -e configure ]; then
-	./autogen.sh;
+	./autogen.sh
 fi
 # bnc#561793 - do not include unclean module in iptables manpage
 rm -f extensions/libipt_unclean.man
@@ -161,7 +162,7 @@ make DESTDIR=%buildroot install
 # iptables-apply is not installed by upstream Makefile
 install -m0755 iptables/iptables-apply %buildroot%_sbindir/
 install -m0644 iptables/iptables-apply.8 %buildroot%_mandir/man8/
-rm -f "%buildroot/%_libdir"/*.la;
+rm -f "%buildroot/%_libdir"/*.la
 %if 0%{?suse_version}
 %fdupes %buildroot/%_prefix
 %endif
@@ -200,6 +201,7 @@ rm -f "%buildroot/%_libdir"/*.la;
 %defattr(-,root,root)
 %_libdir/xtables/
 %_sbindir/nfnl_osf
+%_mandir/man8/nfnl_osf.8*
 %_datadir/xtables/
 
 %files -n libipq0