From mboxrd@z Thu Jan 1 00:00:00 1970
From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] iptables: Update to version 1.8.11
Date: Fri, 15 Nov 2024 22:36:38 +0100
Message-ID: <20241115213640.899223-7-adolf.belka@ipfire.org>
In-Reply-To: <20241115213640.899223-1-adolf.belka@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0587592182942345318=="
List-Id: <development.lists.ipfire.org>
--===============0587592182942345318==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
- Update from version 1.8.10 to 1.8.11
- Update of rootfile not required
- Changelog
1.8.11
new features:
- New arptables-translate tool
- ebtables-nft:
- Support for --change-counters command, albeit not atomic
- Specify rule counters using iptables' '-c N,M' syntax
- Support --replace and --list-rules commands
- Support zeroing individual rules
- Print negations (exclamation marks) extrapositioned (i.e., before
the match they invert) for consistency with iptables
- iptables-translate:
- Align protocol name lookups with iptables
- iptables-translate: Support socket match and TPROXY target
- iptables-translate: Slightly improved avoidance of redundant 'ip
protocol'/'meta l4proto' matches
- iptables:
- Undo numeric protocol printing of v1.8.9 for well-known protocols
for consistency with iptables-save
- Enable implicit extension lookup for dccp and ipcomp protocols (so
no extra '-m <proto>' is needed after '-p <proto>')
- iptables-save: Avoid calls to getprotobynumber() for consistency and
improved performance with huge rule sets
- libxtables: Support use of both xtables_ipaddr_to_numeric() and
xtables_ipmask_to_numeric() as parameters to the same function call
- configure: Support disabling use of libnfnetlink
- Prefix xtables-monitor rule events by a typical command (iptables,
ip6tables) instead of -4/-6 flags for consistency with ebtables and
arptables events
fixes:
- arptables-nft:
- Ineffective masks when specified in --h-type, --opcode and
--proto-type matches
- Wrong formatting of --h-type values and --proto-type masks causing
misinterpretation by arptables-restore
- iptables-nft:
- Wrong error messages in corner-case error conditions
- Zeroing single rule counters broken (again!)
- Incorrect combination of inverted payload matches
- Spurious error when zeroing a specific builtin chain which doesn't
exist - Calling -Z command with bogus rule number must fail
- libiptc: Corner-case segfault upon renaming a chain
- ebtables-restore:
- Corner-case bug with --noflush
- Spurious failures when deleting multiple rules with among matches
- ebtables-nft:
- Different line number (--Ln) formatting than ebtables-legacy
- Off-by-one rule number when using -S command with rule number
- iptables-legacy: Broken --wait without timeout
- libxtables: Leak of matches' udata buffer
- Some matches stripped full value ranges from output even if inverted
- Illegal memory access when parsing '-c ""' (i.e., empty string
argument)
- Inverted full interface wildcards (e.g. '! -i +') stripped from
iptables-save output
- xtables-monitor:
- Incorrect output when not called with -4 or -6 options
- Flush stdout after each line to prevent buffers and help with
scripting
- Align output for builtin chains with that of tables
- Capture arptables chain events, too
- Empty 'EVENT:' lines printed for ebtables rule changes
- Fix for compiling against musl libc
- xtables-translate: Fix translation of TPROXY target
documentation updates:
- Extensions: string: Starting with linux-6.7, pattern matching no
longer extends past 'to' offset - update the man page accordingly
- Extensions: recent: Clarify ip_list_hash_size default value and
obsoleted state of ip_pkt_list_tot
- ebtables-nft.8: Note that --concurrent is a NOP
- Misc. typesetting, spelling and grammar fixes in man pages
Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
lfs/iptables | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/iptables b/lfs/iptables
index 572d9f212..e8c4069d6 100644
--- a/lfs/iptables
+++ b/lfs/iptables
@@ -1,7 +1,7 @@
############################################################################=
###
# =
#
# IPFire.org - A linux based firewall =
#
-# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> =
#
+# Copyright (C) 2007-2024 IPFire Team <info(a)ipfire.org> =
#
# =
#
# This program is free software: you can redistribute it and/or modify =
#
# it under the terms of the GNU General Public License as published by =
#
@@ -24,7 +24,7 @@
=20
include Config
=20
-VER =3D 1.8.10
+VER =3D 1.8.11
=20
THISAPP =3D iptables-$(VER)
DL_FILE =3D $(THISAPP).tar.xz
@@ -41,7 +41,7 @@ objects =3D $(DL_FILE) \
$(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
netfilter-layer7-v2.23.tar.gz =3D $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz
=20
-$(DL_FILE)_BLAKE2 =3D 417b33fcfc7edeba169caef26ed0322798f6b82500840509f6c10b=
97b4ef3f11932c0393fc8dcc5946264442bf8ee959a594b6fbd5dc92012cfad30edf130520
+$(DL_FILE)_BLAKE2 =3D 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae264=
5ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1
netfilter-layer7-v2.23.tar.gz_BLAKE2 =3D 5c8ab722f6fbc126f2f65ecf401de5fc405=
60c20e3be52f783db34410446185dcb6781b3148e4a174e8b2d2c290bec0342dea95e8cefc35c=
39345617fa7a8fdc
=20
install : $(TARGET)
--=20
2.47.0
--===============0587592182942345318==--