iptables: Update to version 1.8.11

  - Update from version 1.8.10 to 1.8.11
- Update of rootfile not required
- Changelog
    1.8.11
	new features:
		- New arptables-translate tool
		- ebtables-nft:
		  - Support for --change-counters command, albeit not atomic
		  - Specify rule counters using iptables' '-c N,M' syntax
		  - Support --replace and --list-rules commands
		  - Support zeroing individual rules
		  - Print negations (exclamation marks) extrapositioned (i.e., before
		    the match they invert) for consistency with iptables
		- iptables-translate:
		  - Align protocol name lookups with iptables
		  - iptables-translate: Support socket match and TPROXY target
		  - iptables-translate: Slightly improved avoidance of redundant 'ip
		    protocol'/'meta l4proto' matches
		- iptables:
		  - Undo numeric protocol printing of v1.8.9 for well-known protocols
		    for consistency with iptables-save
		  - Enable implicit extension lookup for dccp and ipcomp protocols (so
		    no extra '-m <proto>' is needed after '-p <proto>')
		- iptables-save: Avoid calls to getprotobynumber() for consistency and
		  improved performance with huge rule sets
		- libxtables: Support use of both xtables_ipaddr_to_numeric() and
		  xtables_ipmask_to_numeric() as parameters to the same function call
		- configure: Support disabling use of libnfnetlink
		- Prefix xtables-monitor rule events by a typical command (iptables,
		  ip6tables) instead of -4/-6 flags for consistency with ebtables and
		  arptables events
	fixes:
		- arptables-nft:
		  - Ineffective masks when specified in --h-type, --opcode and
		    --proto-type matches
		  - Wrong formatting of --h-type values and --proto-type masks causing
		    misinterpretation by  arptables-restore
		- iptables-nft:
		  - Wrong error messages in corner-case error conditions
		  - Zeroing single rule counters broken (again!)
		  - Incorrect combination of inverted payload matches
		  - Spurious error when zeroing a specific builtin chain which doesn't
		    exist - Calling -Z command with bogus rule number must fail
		- libiptc: Corner-case segfault upon renaming a chain
		- ebtables-restore:
		  - Corner-case bug with --noflush
		  - Spurious failures when deleting multiple rules with among matches
		- ebtables-nft:
		  - Different line number (--Ln) formatting than ebtables-legacy
		  - Off-by-one rule number when using -S command with rule number
		- iptables-legacy: Broken --wait without timeout
		- libxtables: Leak of matches' udata buffer
		- Some matches stripped full value ranges from output even if inverted
		- Illegal memory access when parsing '-c ""' (i.e., empty string
		  argument)
		- Inverted full interface wildcards (e.g. '! -i +') stripped from
		  iptables-save output
		- xtables-monitor:
		  - Incorrect output when not called with -4 or -6 options
		  - Flush stdout after each line to prevent buffers and help with
		    scripting
		  - Align output for builtin chains with that of tables
		  - Capture arptables chain events, too
		  - Empty 'EVENT:' lines printed for ebtables rule changes
		- Fix for compiling against musl libc
		- xtables-translate: Fix translation of TPROXY target
	documentation updates:
		- Extensions: string: Starting with linux-6.7, pattern matching no
		  longer extends past 'to' offset - update the man page accordingly
		- Extensions: recent: Clarify ip_list_hash_size default value and
		  obsoleted state of ip_pkt_list_tot
		- ebtables-nft.8: Note that --concurrent is a NOP
		- Misc. typesetting, spelling and grammar fixes in man pages

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 lfs/iptables | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
  

Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

> On 15 Nov 2024, at 21:36, Adolf Belka <adolf.belka@ipfire.org> wrote:
> 
> - Update from version 1.8.10 to 1.8.11
> - Update of rootfile not required
> - Changelog
>    1.8.11
> new features:
> - New arptables-translate tool
> - ebtables-nft:
>  - Support for --change-counters command, albeit not atomic
>  - Specify rule counters using iptables' '-c N,M' syntax
>  - Support --replace and --list-rules commands
>  - Support zeroing individual rules
>  - Print negations (exclamation marks) extrapositioned (i.e., before
>    the match they invert) for consistency with iptables
> - iptables-translate:
>  - Align protocol name lookups with iptables
>  - iptables-translate: Support socket match and TPROXY target
>  - iptables-translate: Slightly improved avoidance of redundant 'ip
>    protocol'/'meta l4proto' matches
> - iptables:
>  - Undo numeric protocol printing of v1.8.9 for well-known protocols
>    for consistency with iptables-save
>  - Enable implicit extension lookup for dccp and ipcomp protocols (so
>    no extra '-m <proto>' is needed after '-p <proto>')
> - iptables-save: Avoid calls to getprotobynumber() for consistency and
>  improved performance with huge rule sets
> - libxtables: Support use of both xtables_ipaddr_to_numeric() and
>  xtables_ipmask_to_numeric() as parameters to the same function call
> - configure: Support disabling use of libnfnetlink
> - Prefix xtables-monitor rule events by a typical command (iptables,
>  ip6tables) instead of -4/-6 flags for consistency with ebtables and
>  arptables events
> fixes:
> - arptables-nft:
>  - Ineffective masks when specified in --h-type, --opcode and
>    --proto-type matches
>  - Wrong formatting of --h-type values and --proto-type masks causing
>    misinterpretation by  arptables-restore
> - iptables-nft:
>  - Wrong error messages in corner-case error conditions
>  - Zeroing single rule counters broken (again!)
>  - Incorrect combination of inverted payload matches
>  - Spurious error when zeroing a specific builtin chain which doesn't
>    exist - Calling -Z command with bogus rule number must fail
> - libiptc: Corner-case segfault upon renaming a chain
> - ebtables-restore:
>  - Corner-case bug with --noflush
>  - Spurious failures when deleting multiple rules with among matches
> - ebtables-nft:
>  - Different line number (--Ln) formatting than ebtables-legacy
>  - Off-by-one rule number when using -S command with rule number
> - iptables-legacy: Broken --wait without timeout
> - libxtables: Leak of matches' udata buffer
> - Some matches stripped full value ranges from output even if inverted
> - Illegal memory access when parsing '-c ""' (i.e., empty string
>  argument)
> - Inverted full interface wildcards (e.g. '! -i +') stripped from
>  iptables-save output
> - xtables-monitor:
>  - Incorrect output when not called with -4 or -6 options
>  - Flush stdout after each line to prevent buffers and help with
>    scripting
>  - Align output for builtin chains with that of tables
>  - Capture arptables chain events, too
>  - Empty 'EVENT:' lines printed for ebtables rule changes
> - Fix for compiling against musl libc
> - xtables-translate: Fix translation of TPROXY target
> documentation updates:
> - Extensions: string: Starting with linux-6.7, pattern matching no
>  longer extends past 'to' offset - update the man page accordingly
> - Extensions: recent: Clarify ip_list_hash_size default value and
>  obsoleted state of ip_pkt_list_tot
> - ebtables-nft.8: Note that --concurrent is a NOP
> - Misc. typesetting, spelling and grammar fixes in man pages
> 
> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
> ---
> lfs/iptables | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/lfs/iptables b/lfs/iptables
> index 572d9f212..e8c4069d6 100644
> --- a/lfs/iptables
> +++ b/lfs/iptables
> @@ -1,7 +1,7 @@
> ###############################################################################
> #                                                                             #
> # IPFire.org - A linux based firewall                                         #
> -# Copyright (C) 2007-2023  IPFire Team  <info@ipfire.org>                     #
> +# Copyright (C) 2007-2024  IPFire Team  <info@ipfire.org>                     #
> #                                                                             #
> # This program is free software: you can redistribute it and/or modify        #
> # it under the terms of the GNU General Public License as published by        #
> @@ -24,7 +24,7 @@
> 
> include Config
> 
> -VER        = 1.8.10
> +VER        = 1.8.11
> 
> THISAPP    = iptables-$(VER)
> DL_FILE    = $(THISAPP).tar.xz
> @@ -41,7 +41,7 @@ objects = $(DL_FILE) \
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz
> 
> -$(DL_FILE)_BLAKE2 = 417b33fcfc7edeba169caef26ed0322798f6b82500840509f6c10b97b4ef3f11932c0393fc8dcc5946264442bf8ee959a594b6fbd5dc92012cfad30edf130520
> +$(DL_FILE)_BLAKE2 = 82daca3940e253f6fda7cf5b3332488c31391ff66c0112c0cae2645ab61918f81e6028ea2b1e1385f21e4c5ff8cd64cba31072a2417a2ab696fe1c6b5464cea1
> netfilter-layer7-v2.23.tar.gz_BLAKE2 = 5c8ab722f6fbc126f2f65ecf401de5fc40560c20e3be52f783db34410446185dcb6781b3148e4a174e8b2d2c290bec0342dea95e8cefc35c39345617fa7a8fdc
> 
> install : $(TARGET)
> -- 
> 2.47.0
>