diff mbox series

iptables: Update to 1.8.2

Message ID	20190303080918.5899-1-ummeegge@ipfire.org
State	Accepted
Commit	3f2341da8d3b517466f42338956342fde6e45eec
Headers	From: Erik Kapfer <ummeegge@ipfire.org> To: development@lists.ipfire.org Subject: [PATCH] iptables: Update to 1.8.2 Date: Sun, 3 Mar 2019 09:09:18 +0100 Message-Id: <20190303080918.5899-1-ummeegge@ipfire.org> Precedence: list Errors-To: development-bounces@lists.ipfire.org Sender: "Development" <development-bounces@lists.ipfire.org>
Series	iptables: Update to 1.8.2 \| iptables: Update to 1.8.2

Commit Message

ummeegge March 3, 2019, 7:09 p.m. UTC

  netfilter-layer7 has also been updated to v2.23 .

Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
---
 config/rootfiles/common/iptables | 19 ++++++++++++-------
 lfs/iptables                     | 17 +++++++++--------
 2 files changed, 21 insertions(+), 15 deletions(-)

Comments

Michael Tremer March 4, 2019, 3:04 a.m. UTC | #1

Hi,

This release of iptables has some interesting changes:

We now have multiple binaries with -legacy in name.

Did you test this? Is there anything we need to think about?

-Michael

> On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> wrote:
> 
> netfilter-layer7 has also been updated to v2.23 .
> 
> Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
> ---
> config/rootfiles/common/iptables | 19 ++++++++++++-------
> lfs/iptables                     | 17 +++++++++--------
> 2 files changed, 21 insertions(+), 15 deletions(-)
> 
> diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables
> index d7584c0ad..9aa9e51cb 100644
> --- a/config/rootfiles/common/iptables
> +++ b/config/rootfiles/common/iptables
> @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0
> #lib/libxtables.la
> lib/libxtables.so
> lib/libxtables.so.12
> -lib/libxtables.so.12.0.0
> +lib/libxtables.so.12.2.0
> #lib/xtables
> -lib/xtables/libebt_802_3.so
> -lib/xtables/libebt_ip.so
> -lib/xtables/libebt_log.so
> -lib/xtables/libebt_mark_m.so
> lib/xtables/libip6t_DNAT.so
> lib/xtables/libip6t_DNPT.so
> lib/xtables/libip6t_HL.so
> @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so
> lib/xtables/libxt_length.so
> lib/xtables/libxt_limit.so
> lib/xtables/libxt_mac.so
> -lib/xtables/libxt_mangle.so
> lib/xtables/libxt_mark.so
> lib/xtables/libxt_multiport.so
> lib/xtables/libxt_nfacct.so
> @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so
> lib/xtables/libxt_u32.so
> lib/xtables/libxt_udp.so
> sbin/ip6tables
> +sbin/ip6tables-legacy
> +sbin/ip6tables-legacy-restore
> +sbin/ip6tables-legacy-save
> sbin/ip6tables-restore
> sbin/ip6tables-save
> sbin/iptables
> +sbin/iptables-legacy
> +sbin/iptables-legacy-restore
> +sbin/iptables-legacy-save
> sbin/iptables-restore
> sbin/iptables-save
> sbin/iptables-xml
> #sbin/nfnl_osf
> -sbin/xtables-multi
> +sbin/xtables-legacy-multi
> #usr/include/libipq.h
> #usr/include/libiptc
> #usr/include/libiptc/ipt_kernel_headers.h
> @@ -178,5 +179,9 @@ sbin/xtables-multi
> #usr/share/man/man8/iptables-save.8
> #usr/share/man/man8/iptables.8
> #usr/share/man/man8/nfnl_osf.8
> +#usr/share/man/man8/xtables-legacy.8
> +#usr/share/man/man8/xtables-monitor.8
> +#usr/share/man/man8/xtables-nft.8
> +#usr/share/man/man8/xtables-translate.8
> #usr/share/xtables
> usr/share/xtables/pf.os
> diff --git a/lfs/iptables b/lfs/iptables
> index b4a2834b8..17817a9ef 100644
> --- a/lfs/iptables
> +++ b/lfs/iptables
> @@ -1,7 +1,7 @@
> ###############################################################################
> #                                                                             #
> # IPFire.org - A linux based firewall                                         #
> -# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
> +# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>                     #
> #                                                                             #
> # This program is free software: you can redistribute it and/or modify        #
> # it under the terms of the GNU General Public License as published by        #
> @@ -24,7 +24,7 @@
> 
> include Config
> 
> -VER        = 1.6.2
> +VER        = 1.8.2
> 
> THISAPP    = iptables-$(VER)
> DL_FILE    = $(THISAPP).tar.bz2
> @@ -36,13 +36,13 @@ TARGET     = $(DIR_INFO)/$(THISAPP)
> # Top-level Rules
> ###############################################################################
> objects = $(DL_FILE) \
> -	netfilter-layer7-v2.22.tar.gz
> +	netfilter-layer7-v2.23.tar.gz
> 
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz
> +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz
> 
> -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d
> -netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f
> +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599
> +netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb
> 
> install : $(TARGET)
> 
> @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
> 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
> 
> 	# Layer7
> -	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.22.tar.gz
> -	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
> +	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.23.tar.gz
> +	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
> 	                 ./extensions/
> 
> 	# imq
> @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
> 		--libdir=/lib \
> 		--includedir=/usr/include \
> 		--enable-libipq \
> +		--with-xtlibdir=/lib/xtables \
> 		--libexecdir=/lib \
> 		--bindir=/sbin \
> 		--sbindir=/sbin \
> -- 
> 2.12.2
>

ummeegge March 4, 2019, 5:54 p.m. UTC | #2

Hi Michael,

On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote:
> Hi,
> 
> This release of iptables has some interesting changes:
> 
> We now have multiple binaries with -legacy in name.
Yes i was also a little in wonder about that although it looked a
little like a helper tool if nftables and iptables running at the same
time. Looking at linuxfromscratch --> 
http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html
if '--disable-nftables' has been set, there are no *-legacy* binaries
listed under "Installed Programs:".
There is also the xtables-legacy-multi binary and looking into the
nftables-wiki -->
https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools 
(please check the 'link to a summary') it appears that all setsockopt
based tools are all now considered as 'legacy'.

> 
> Did you test this? Is there anything we need to think about?
Am running iptables-1.8.2 currently with a backup of my production
machine with ~ 50 rules and a vast IPset configuration (firewall.local)
and i haven´t recognized problems.

Some other tests i made:
Made also a diff between 'iptables-legacy-save' and 'iptables-save'
whereby the output seems to be pretty much the same.
Moved then also all iptables-legacy* binaries away, restarted the
machine and all seems to work as it should.

Since it is a little a sensible update, it is great to go for some more
overviews/testings/thinking_abouts.

Best,


Erik

> 
> -Michael
> 
> > On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> wrote:
> > 
> > netfilter-layer7 has also been updated to v2.23 .
> > 
> > Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
> > ---
> > config/rootfiles/common/iptables | 19 ++++++++++++-------
> > lfs/iptables                     | 17 +++++++++--------
> > 2 files changed, 21 insertions(+), 15 deletions(-)
> > 
> > diff --git a/config/rootfiles/common/iptables
> > b/config/rootfiles/common/iptables
> > index d7584c0ad..9aa9e51cb 100644
> > --- a/config/rootfiles/common/iptables
> > +++ b/config/rootfiles/common/iptables
> > @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0
> > #lib/libxtables.la
> > lib/libxtables.so
> > lib/libxtables.so.12
> > -lib/libxtables.so.12.0.0
> > +lib/libxtables.so.12.2.0
> > #lib/xtables
> > -lib/xtables/libebt_802_3.so
> > -lib/xtables/libebt_ip.so
> > -lib/xtables/libebt_log.so
> > -lib/xtables/libebt_mark_m.so
> > lib/xtables/libip6t_DNAT.so
> > lib/xtables/libip6t_DNPT.so
> > lib/xtables/libip6t_HL.so
> > @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so
> > lib/xtables/libxt_length.so
> > lib/xtables/libxt_limit.so
> > lib/xtables/libxt_mac.so
> > -lib/xtables/libxt_mangle.so
> > lib/xtables/libxt_mark.so
> > lib/xtables/libxt_multiport.so
> > lib/xtables/libxt_nfacct.so
> > @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so
> > lib/xtables/libxt_u32.so
> > lib/xtables/libxt_udp.so
> > sbin/ip6tables
> > +sbin/ip6tables-legacy
> > +sbin/ip6tables-legacy-restore
> > +sbin/ip6tables-legacy-save
> > sbin/ip6tables-restore
> > sbin/ip6tables-save
> > sbin/iptables
> > +sbin/iptables-legacy
> > +sbin/iptables-legacy-restore
> > +sbin/iptables-legacy-save
> > sbin/iptables-restore
> > sbin/iptables-save
> > sbin/iptables-xml
> > #sbin/nfnl_osf
> > -sbin/xtables-multi
> > +sbin/xtables-legacy-multi
> > #usr/include/libipq.h
> > #usr/include/libiptc
> > #usr/include/libiptc/ipt_kernel_headers.h
> > @@ -178,5 +179,9 @@ sbin/xtables-multi
> > #usr/share/man/man8/iptables-save.8
> > #usr/share/man/man8/iptables.8
> > #usr/share/man/man8/nfnl_osf.8
> > +#usr/share/man/man8/xtables-legacy.8
> > +#usr/share/man/man8/xtables-monitor.8
> > +#usr/share/man/man8/xtables-nft.8
> > +#usr/share/man/man8/xtables-translate.8
> > #usr/share/xtables
> > usr/share/xtables/pf.os
> > diff --git a/lfs/iptables b/lfs/iptables
> > index b4a2834b8..17817a9ef 100644
> > --- a/lfs/iptables
> > +++ b/lfs/iptables
> > @@ -1,7 +1,7 @@
> > ###################################################################
> > ############
> > #                                                                  
> >            #
> > # IPFire.org - A linux based
> > firewall                                         #
> > -# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>         
> >             #
> > +# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>         
> >             #
> > #                                                                  
> >            #
> > # This program is free software: you can redistribute it and/or
> > modify        #
> > # it under the terms of the GNU General Public License as published
> > by        #
> > @@ -24,7 +24,7 @@
> > 
> > include Config
> > 
> > -VER        = 1.6.2
> > +VER        = 1.8.2
> > 
> > THISAPP    = iptables-$(VER)
> > DL_FILE    = $(THISAPP).tar.bz2
> > @@ -36,13 +36,13 @@ TARGET     = $(DIR_INFO)/$(THISAPP)
> > # Top-level Rules
> > ###################################################################
> > ############
> > objects = $(DL_FILE) \
> > -	netfilter-layer7-v2.22.tar.gz
> > +	netfilter-layer7-v2.23.tar.gz
> > 
> > $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> > -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-
> > v2.22.tar.gz
> > +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-
> > v2.23.tar.gz
> > 
> > -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d
> > -netfilter-layer7-v2.22.tar.gz_MD5 =
> > 98dff8a3d5a31885b73341633f69501f
> > +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599
> > +netfilter-layer7-v2.23.tar.gz_MD5 =
> > 10910b6173d18e426cb56ae7e1300eeb
> > 
> > install : $(TARGET)
> > 
> > @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
> > 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
> > 
> > 	# Layer7
> > -	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
> > v2.22.tar.gz
> > -	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
> > v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
> > +	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
> > v2.23.tar.gz
> > +	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
> > v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
> > 	                 ./extensions/
> > 
> > 	# imq
> > @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
> > 		--libdir=/lib \
> > 		--includedir=/usr/include \
> > 		--enable-libipq \
> > +		--with-xtlibdir=/lib/xtables \
> > 		--libexecdir=/lib \
> > 		--bindir=/sbin \
> > 		--sbindir=/sbin \
> > -- 
> > 2.12.2
> > 
> 
>

Michael Tremer March 5, 2019, 8:47 p.m. UTC | #3

Hi,

I will just merge this and then we will see during testing of the Core Update.

What could possibly go wrong?

Best,
-Michael

> On 4 Mar 2019, at 06:54, ummeegge <ummeegge@ipfire.org> wrote:
> 
> Hi Michael,
> 
> On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote:
>> Hi,
>> 
>> This release of iptables has some interesting changes:
>> 
>> We now have multiple binaries with -legacy in name.
> Yes i was also a little in wonder about that although it looked a
> little like a helper tool if nftables and iptables running at the same
> time. Looking at linuxfromscratch --> 
> http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html
> if '--disable-nftables' has been set, there are no *-legacy* binaries
> listed under "Installed Programs:".
> There is also the xtables-legacy-multi binary and looking into the
> nftables-wiki -->
> https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools 
> (please check the 'link to a summary') it appears that all setsockopt
> based tools are all now considered as 'legacy'.
> 
>> 
>> Did you test this? Is there anything we need to think about?
> Am running iptables-1.8.2 currently with a backup of my production
> machine with ~ 50 rules and a vast IPset configuration (firewall.local)
> and i haven´t recognized problems.
> 
> Some other tests i made:
> Made also a diff between 'iptables-legacy-save' and 'iptables-save'
> whereby the output seems to be pretty much the same.
> Moved then also all iptables-legacy* binaries away, restarted the
> machine and all seems to work as it should.
> 
> Since it is a little a sensible update, it is great to go for some more
> overviews/testings/thinking_abouts.
> 
> Best,
> 
> 
> Erik
> 
>> 
>> -Michael
>> 
>>> On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org> wrote:
>>> 
>>> netfilter-layer7 has also been updated to v2.23 .
>>> 
>>> Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
>>> ---
>>> config/rootfiles/common/iptables | 19 ++++++++++++-------
>>> lfs/iptables                     | 17 +++++++++--------
>>> 2 files changed, 21 insertions(+), 15 deletions(-)
>>> 
>>> diff --git a/config/rootfiles/common/iptables
>>> b/config/rootfiles/common/iptables
>>> index d7584c0ad..9aa9e51cb 100644
>>> --- a/config/rootfiles/common/iptables
>>> +++ b/config/rootfiles/common/iptables
>>> @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0
>>> #lib/libxtables.la
>>> lib/libxtables.so
>>> lib/libxtables.so.12
>>> -lib/libxtables.so.12.0.0
>>> +lib/libxtables.so.12.2.0
>>> #lib/xtables
>>> -lib/xtables/libebt_802_3.so
>>> -lib/xtables/libebt_ip.so
>>> -lib/xtables/libebt_log.so
>>> -lib/xtables/libebt_mark_m.so
>>> lib/xtables/libip6t_DNAT.so
>>> lib/xtables/libip6t_DNPT.so
>>> lib/xtables/libip6t_HL.so
>>> @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so
>>> lib/xtables/libxt_length.so
>>> lib/xtables/libxt_limit.so
>>> lib/xtables/libxt_mac.so
>>> -lib/xtables/libxt_mangle.so
>>> lib/xtables/libxt_mark.so
>>> lib/xtables/libxt_multiport.so
>>> lib/xtables/libxt_nfacct.so
>>> @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so
>>> lib/xtables/libxt_u32.so
>>> lib/xtables/libxt_udp.so
>>> sbin/ip6tables
>>> +sbin/ip6tables-legacy
>>> +sbin/ip6tables-legacy-restore
>>> +sbin/ip6tables-legacy-save
>>> sbin/ip6tables-restore
>>> sbin/ip6tables-save
>>> sbin/iptables
>>> +sbin/iptables-legacy
>>> +sbin/iptables-legacy-restore
>>> +sbin/iptables-legacy-save
>>> sbin/iptables-restore
>>> sbin/iptables-save
>>> sbin/iptables-xml
>>> #sbin/nfnl_osf
>>> -sbin/xtables-multi
>>> +sbin/xtables-legacy-multi
>>> #usr/include/libipq.h
>>> #usr/include/libiptc
>>> #usr/include/libiptc/ipt_kernel_headers.h
>>> @@ -178,5 +179,9 @@ sbin/xtables-multi
>>> #usr/share/man/man8/iptables-save.8
>>> #usr/share/man/man8/iptables.8
>>> #usr/share/man/man8/nfnl_osf.8
>>> +#usr/share/man/man8/xtables-legacy.8
>>> +#usr/share/man/man8/xtables-monitor.8
>>> +#usr/share/man/man8/xtables-nft.8
>>> +#usr/share/man/man8/xtables-translate.8
>>> #usr/share/xtables
>>> usr/share/xtables/pf.os
>>> diff --git a/lfs/iptables b/lfs/iptables
>>> index b4a2834b8..17817a9ef 100644
>>> --- a/lfs/iptables
>>> +++ b/lfs/iptables
>>> @@ -1,7 +1,7 @@
>>> ###################################################################
>>> ############
>>> #                                                                  
>>>           #
>>> # IPFire.org - A linux based
>>> firewall                                         #
>>> -# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>         
>>>            #
>>> +# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>         
>>>            #
>>> #                                                                  
>>>           #
>>> # This program is free software: you can redistribute it and/or
>>> modify        #
>>> # it under the terms of the GNU General Public License as published
>>> by        #
>>> @@ -24,7 +24,7 @@
>>> 
>>> include Config
>>> 
>>> -VER        = 1.6.2
>>> +VER        = 1.8.2
>>> 
>>> THISAPP    = iptables-$(VER)
>>> DL_FILE    = $(THISAPP).tar.bz2
>>> @@ -36,13 +36,13 @@ TARGET     = $(DIR_INFO)/$(THISAPP)
>>> # Top-level Rules
>>> ###################################################################
>>> ############
>>> objects = $(DL_FILE) \
>>> -	netfilter-layer7-v2.22.tar.gz
>>> +	netfilter-layer7-v2.23.tar.gz
>>> 
>>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>>> -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-
>>> v2.22.tar.gz
>>> +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-
>>> v2.23.tar.gz
>>> 
>>> -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d
>>> -netfilter-layer7-v2.22.tar.gz_MD5 =
>>> 98dff8a3d5a31885b73341633f69501f
>>> +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599
>>> +netfilter-layer7-v2.23.tar.gz_MD5 =
>>> 10910b6173d18e426cb56ae7e1300eeb
>>> 
>>> install : $(TARGET)
>>> 
>>> @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>>> 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
>>> 
>>> 	# Layer7
>>> -	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
>>> v2.22.tar.gz
>>> -	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
>>> v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
>>> +	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
>>> v2.23.tar.gz
>>> +	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
>>> v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
>>> 	                 ./extensions/
>>> 
>>> 	# imq
>>> @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>>> 		--libdir=/lib \
>>> 		--includedir=/usr/include \
>>> 		--enable-libipq \
>>> +		--with-xtlibdir=/lib/xtables \
>>> 		--libexecdir=/lib \
>>> 		--bindir=/sbin \
>>> 		--sbindir=/sbin \
>>> -- 
>>> 2.12.2
>>> 
>> 
>> 
>

ummeegge March 5, 2019, 11:37 p.m. UTC | #4

Hi Michael,

On Di, 2019-03-05 at 09:47 +0000, Michael Tremer wrote:
> Hi,
> 
> I will just merge this and then we will see during testing of the
> Core Update.
Have deleted all the *legacy* binaries and as before, no problems at
all. Should i send another patch without them ?

> 
> What could possibly go wrong?
Have currently no problems in focus.
Have build also nftables (with libnftnl with an extended iptables-1.8.2 
version which incl. also ebtables, arptables, the translation stuff and
a lot more) to check there for some possible usage of the *legacy*
stuff. It is currently possible to use both (iptables beneath nftables)
which offers some funky new possiblities :D but in there the same, did
NOT needed the *legacy* binaries since all known iptables binaries are
still presant but possibly i have missed/overseen something.

At least all is working.

Best,

Erik

> 
> Best,
> -Michael
> 
> > On 4 Mar 2019, at 06:54, ummeegge <ummeegge@ipfire.org> wrote:
> > 
> > Hi Michael,
> > 
> > On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote:
> > > Hi,
> > > 
> > > This release of iptables has some interesting changes:
> > > 
> > > We now have multiple binaries with -legacy in name.
> > 
> > Yes i was also a little in wonder about that although it looked a
> > little like a helper tool if nftables and iptables running at the
> > same
> > time. Looking at linuxfromscratch --> 
> > http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html
> > if '--disable-nftables' has been set, there are no *-legacy*
> > binaries
> > listed under "Installed Programs:".
> > There is also the xtables-legacy-multi binary and looking into the
> > nftables-wiki -->
> > 
https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools
> >  
> > (please check the 'link to a summary') it appears that all
> > setsockopt
> > based tools are all now considered as 'legacy'.
> > 
> > > 
> > > Did you test this? Is there anything we need to think about?
> > 
> > Am running iptables-1.8.2 currently with a backup of my production
> > machine with ~ 50 rules and a vast IPset configuration
> > (firewall.local)
> > and i haven´t recognized problems.
> > 
> > Some other tests i made:
> > Made also a diff between 'iptables-legacy-save' and 'iptables-save'
> > whereby the output seems to be pretty much the same.
> > Moved then also all iptables-legacy* binaries away, restarted the
> > machine and all seems to work as it should.
> > 
> > Since it is a little a sensible update, it is great to go for some
> > more
> > overviews/testings/thinking_abouts.
> > 
> > Best,
> > 
> > 
> > Erik
> > 
> > > 
> > > -Michael
> > > 
> > > > On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org>
> > > > wrote:
> > > > 
> > > > netfilter-layer7 has also been updated to v2.23 .
> > > > 
> > > > Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
> > > > ---
> > > > config/rootfiles/common/iptables | 19 ++++++++++++-------
> > > > lfs/iptables                     | 17 +++++++++--------
> > > > 2 files changed, 21 insertions(+), 15 deletions(-)
> > > > 
> > > > diff --git a/config/rootfiles/common/iptables
> > > > b/config/rootfiles/common/iptables
> > > > index d7584c0ad..9aa9e51cb 100644
> > > > --- a/config/rootfiles/common/iptables
> > > > +++ b/config/rootfiles/common/iptables
> > > > @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0
> > > > #lib/libxtables.la
> > > > lib/libxtables.so
> > > > lib/libxtables.so.12
> > > > -lib/libxtables.so.12.0.0
> > > > +lib/libxtables.so.12.2.0
> > > > #lib/xtables
> > > > -lib/xtables/libebt_802_3.so
> > > > -lib/xtables/libebt_ip.so
> > > > -lib/xtables/libebt_log.so
> > > > -lib/xtables/libebt_mark_m.so
> > > > lib/xtables/libip6t_DNAT.so
> > > > lib/xtables/libip6t_DNPT.so
> > > > lib/xtables/libip6t_HL.so
> > > > @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so
> > > > lib/xtables/libxt_length.so
> > > > lib/xtables/libxt_limit.so
> > > > lib/xtables/libxt_mac.so
> > > > -lib/xtables/libxt_mangle.so
> > > > lib/xtables/libxt_mark.so
> > > > lib/xtables/libxt_multiport.so
> > > > lib/xtables/libxt_nfacct.so
> > > > @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so
> > > > lib/xtables/libxt_u32.so
> > > > lib/xtables/libxt_udp.so
> > > > sbin/ip6tables
> > > > +sbin/ip6tables-legacy
> > > > +sbin/ip6tables-legacy-restore
> > > > +sbin/ip6tables-legacy-save
> > > > sbin/ip6tables-restore
> > > > sbin/ip6tables-save
> > > > sbin/iptables
> > > > +sbin/iptables-legacy
> > > > +sbin/iptables-legacy-restore
> > > > +sbin/iptables-legacy-save
> > > > sbin/iptables-restore
> > > > sbin/iptables-save
> > > > sbin/iptables-xml
> > > > #sbin/nfnl_osf
> > > > -sbin/xtables-multi
> > > > +sbin/xtables-legacy-multi
> > > > #usr/include/libipq.h
> > > > #usr/include/libiptc
> > > > #usr/include/libiptc/ipt_kernel_headers.h
> > > > @@ -178,5 +179,9 @@ sbin/xtables-multi
> > > > #usr/share/man/man8/iptables-save.8
> > > > #usr/share/man/man8/iptables.8
> > > > #usr/share/man/man8/nfnl_osf.8
> > > > +#usr/share/man/man8/xtables-legacy.8
> > > > +#usr/share/man/man8/xtables-monitor.8
> > > > +#usr/share/man/man8/xtables-nft.8
> > > > +#usr/share/man/man8/xtables-translate.8
> > > > #usr/share/xtables
> > > > usr/share/xtables/pf.os
> > > > diff --git a/lfs/iptables b/lfs/iptables
> > > > index b4a2834b8..17817a9ef 100644
> > > > --- a/lfs/iptables
> > > > +++ b/lfs/iptables
> > > > @@ -1,7 +1,7 @@
> > > > ###############################################################
> > > > ####
> > > > ############
> > > > #                                                              
> > > >     
> > > >           #
> > > > # IPFire.org - A linux based
> > > > firewall                                         #
> > > > -# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>     
> > > >     
> > > >            #
> > > > +# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>     
> > > >     
> > > >            #
> > > > #                                                              
> > > >     
> > > >           #
> > > > # This program is free software: you can redistribute it and/or
> > > > modify        #
> > > > # it under the terms of the GNU General Public License as
> > > > published
> > > > by        #
> > > > @@ -24,7 +24,7 @@
> > > > 
> > > > include Config
> > > > 
> > > > -VER        = 1.6.2
> > > > +VER        = 1.8.2
> > > > 
> > > > THISAPP    = iptables-$(VER)
> > > > DL_FILE    = $(THISAPP).tar.bz2
> > > > @@ -36,13 +36,13 @@ TARGET     = $(DIR_INFO)/$(THISAPP)
> > > > # Top-level Rules
> > > > ###############################################################
> > > > ####
> > > > ############
> > > > objects = $(DL_FILE) \
> > > > -	netfilter-layer7-v2.22.tar.gz
> > > > +	netfilter-layer7-v2.23.tar.gz
> > > > 
> > > > $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> > > > -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-
> > > > layer7-
> > > > v2.22.tar.gz
> > > > +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-
> > > > layer7-
> > > > v2.23.tar.gz
> > > > 
> > > > -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d
> > > > -netfilter-layer7-v2.22.tar.gz_MD5 =
> > > > 98dff8a3d5a31885b73341633f69501f
> > > > +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599
> > > > +netfilter-layer7-v2.23.tar.gz_MD5 =
> > > > 10910b6173d18e426cb56ae7e1300eeb
> > > > 
> > > > install : $(TARGET)
> > > > 
> > > > @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst
> > > > %,$(DIR_DL)/%,$(objects))
> > > > 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
> > > > 
> > > > 	# Layer7
> > > > -	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
> > > > v2.22.tar.gz
> > > > -	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
> > > > v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
> > > > +	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
> > > > v2.23.tar.gz
> > > > +	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
> > > > v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
> > > > 	                 ./extensions/
> > > > 
> > > > 	# imq
> > > > @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst
> > > > %,$(DIR_DL)/%,$(objects))
> > > > 		--libdir=/lib \
> > > > 		--includedir=/usr/include \
> > > > 		--enable-libipq \
> > > > +		--with-xtlibdir=/lib/xtables \
> > > > 		--libexecdir=/lib \
> > > > 		--bindir=/sbin \
> > > > 		--sbindir=/sbin \
> > > > -- 
> > > > 2.12.2
> > > > 
> > > 
> > > 
> 
>

Michael Tremer March 6, 2019, 12:50 a.m. UTC | #5

Hi,

> On 5 Mar 2019, at 12:37, ummeegge <ummeegge@ipfire.org> wrote:
> 
> Hi Michael,
> 
> On Di, 2019-03-05 at 09:47 +0000, Michael Tremer wrote:
>> Hi,
>> 
>> I will just merge this and then we will see during testing of the
>> Core Update.
> Have deleted all the *legacy* binaries and as before, no problems at
> all. Should i send another patch without them ?

If those are all symlinks, I guess it makes sense to remove them, because they are more confusing than anything else.

Please submit another patch. Remember that I have already merged this one.

> 
>> 
>> What could possibly go wrong?
> Have currently no problems in focus.
> Have build also nftables (with libnftnl with an extended iptables-1.8.2 
> version which incl. also ebtables, arptables, the translation stuff and
> a lot more) to check there for some possible usage of the *legacy*
> stuff. It is currently possible to use both (iptables beneath nftables)
> which offers some funky new possiblities :D but in there the same, did
> NOT needed the *legacy* binaries since all known iptables binaries are
> still presant but possibly i have missed/overseen something.

I do not think that there is any sense to build notables for IPFire 2. It is disabled in the kernel, we are using some extensions that only work for iptables (l7 filter, geoid, ipp2p) and therefore we can never use it.

-Michael

> 
> At least all is working.
> 
> Best,
> 
> Erik
> 
>> 
>> Best,
>> -Michael
>> 
>>> On 4 Mar 2019, at 06:54, ummeegge <ummeegge@ipfire.org> wrote:
>>> 
>>> Hi Michael,
>>> 
>>> On So, 2019-03-03 at 16:04 +0000, Michael Tremer wrote:
>>>> Hi,
>>>> 
>>>> This release of iptables has some interesting changes:
>>>> 
>>>> We now have multiple binaries with -legacy in name.
>>> 
>>> Yes i was also a little in wonder about that although it looked a
>>> little like a helper tool if nftables and iptables running at the
>>> same
>>> time. Looking at linuxfromscratch --> 
>>> http://www.linuxfromscratch.org/blfs/view/8.3/postlfs/iptables.html
>>> if '--disable-nftables' has been set, there are no *-legacy*
>>> binaries
>>> listed under "Installed Programs:".
>>> There is also the xtables-legacy-multi binary and looking into the
>>> nftables-wiki -->
>>> 
> https://wiki.nftables.org/wiki-nftables/index.php/Legacy_xtables_tools
>>> 
>>> (please check the 'link to a summary') it appears that all
>>> setsockopt
>>> based tools are all now considered as 'legacy'.
>>> 
>>>> 
>>>> Did you test this? Is there anything we need to think about?
>>> 
>>> Am running iptables-1.8.2 currently with a backup of my production
>>> machine with ~ 50 rules and a vast IPset configuration
>>> (firewall.local)
>>> and i haven´t recognized problems.
>>> 
>>> Some other tests i made:
>>> Made also a diff between 'iptables-legacy-save' and 'iptables-save'
>>> whereby the output seems to be pretty much the same.
>>> Moved then also all iptables-legacy* binaries away, restarted the
>>> machine and all seems to work as it should.
>>> 
>>> Since it is a little a sensible update, it is great to go for some
>>> more
>>> overviews/testings/thinking_abouts.
>>> 
>>> Best,
>>> 
>>> 
>>> Erik
>>> 
>>>> 
>>>> -Michael
>>>> 
>>>>> On 3 Mar 2019, at 08:09, Erik Kapfer <ummeegge@ipfire.org>
>>>>> wrote:
>>>>> 
>>>>> netfilter-layer7 has also been updated to v2.23 .
>>>>> 
>>>>> Signed-off-by: Erik Kapfer <ummeegge@ipfire.org>
>>>>> ---
>>>>> config/rootfiles/common/iptables | 19 ++++++++++++-------
>>>>> lfs/iptables                     | 17 +++++++++--------
>>>>> 2 files changed, 21 insertions(+), 15 deletions(-)
>>>>> 
>>>>> diff --git a/config/rootfiles/common/iptables
>>>>> b/config/rootfiles/common/iptables
>>>>> index d7584c0ad..9aa9e51cb 100644
>>>>> --- a/config/rootfiles/common/iptables
>>>>> +++ b/config/rootfiles/common/iptables
>>>>> @@ -17,12 +17,8 @@ lib/libiptc.so.0.0.0
>>>>> #lib/libxtables.la
>>>>> lib/libxtables.so
>>>>> lib/libxtables.so.12
>>>>> -lib/libxtables.so.12.0.0
>>>>> +lib/libxtables.so.12.2.0
>>>>> #lib/xtables
>>>>> -lib/xtables/libebt_802_3.so
>>>>> -lib/xtables/libebt_ip.so
>>>>> -lib/xtables/libebt_log.so
>>>>> -lib/xtables/libebt_mark_m.so
>>>>> lib/xtables/libip6t_DNAT.so
>>>>> lib/xtables/libip6t_DNPT.so
>>>>> lib/xtables/libip6t_HL.so
>>>>> @@ -109,7 +105,6 @@ lib/xtables/libxt_layer7.so
>>>>> lib/xtables/libxt_length.so
>>>>> lib/xtables/libxt_limit.so
>>>>> lib/xtables/libxt_mac.so
>>>>> -lib/xtables/libxt_mangle.so
>>>>> lib/xtables/libxt_mark.so
>>>>> lib/xtables/libxt_multiport.so
>>>>> lib/xtables/libxt_nfacct.so
>>>>> @@ -136,14 +131,20 @@ lib/xtables/libxt_tos.so
>>>>> lib/xtables/libxt_u32.so
>>>>> lib/xtables/libxt_udp.so
>>>>> sbin/ip6tables
>>>>> +sbin/ip6tables-legacy
>>>>> +sbin/ip6tables-legacy-restore
>>>>> +sbin/ip6tables-legacy-save
>>>>> sbin/ip6tables-restore
>>>>> sbin/ip6tables-save
>>>>> sbin/iptables
>>>>> +sbin/iptables-legacy
>>>>> +sbin/iptables-legacy-restore
>>>>> +sbin/iptables-legacy-save
>>>>> sbin/iptables-restore
>>>>> sbin/iptables-save
>>>>> sbin/iptables-xml
>>>>> #sbin/nfnl_osf
>>>>> -sbin/xtables-multi
>>>>> +sbin/xtables-legacy-multi
>>>>> #usr/include/libipq.h
>>>>> #usr/include/libiptc
>>>>> #usr/include/libiptc/ipt_kernel_headers.h
>>>>> @@ -178,5 +179,9 @@ sbin/xtables-multi
>>>>> #usr/share/man/man8/iptables-save.8
>>>>> #usr/share/man/man8/iptables.8
>>>>> #usr/share/man/man8/nfnl_osf.8
>>>>> +#usr/share/man/man8/xtables-legacy.8
>>>>> +#usr/share/man/man8/xtables-monitor.8
>>>>> +#usr/share/man/man8/xtables-nft.8
>>>>> +#usr/share/man/man8/xtables-translate.8
>>>>> #usr/share/xtables
>>>>> usr/share/xtables/pf.os
>>>>> diff --git a/lfs/iptables b/lfs/iptables
>>>>> index b4a2834b8..17817a9ef 100644
>>>>> --- a/lfs/iptables
>>>>> +++ b/lfs/iptables
>>>>> @@ -1,7 +1,7 @@
>>>>> ###############################################################
>>>>> ####
>>>>> ############
>>>>> #                                                              
>>>>> 
>>>>>          #
>>>>> # IPFire.org - A linux based
>>>>> firewall                                         #
>>>>> -# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>     
>>>>> 
>>>>>           #
>>>>> +# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>     
>>>>> 
>>>>>           #
>>>>> #                                                              
>>>>> 
>>>>>          #
>>>>> # This program is free software: you can redistribute it and/or
>>>>> modify        #
>>>>> # it under the terms of the GNU General Public License as
>>>>> published
>>>>> by        #
>>>>> @@ -24,7 +24,7 @@
>>>>> 
>>>>> include Config
>>>>> 
>>>>> -VER        = 1.6.2
>>>>> +VER        = 1.8.2
>>>>> 
>>>>> THISAPP    = iptables-$(VER)
>>>>> DL_FILE    = $(THISAPP).tar.bz2
>>>>> @@ -36,13 +36,13 @@ TARGET     = $(DIR_INFO)/$(THISAPP)
>>>>> # Top-level Rules
>>>>> ###############################################################
>>>>> ####
>>>>> ############
>>>>> objects = $(DL_FILE) \
>>>>> -	netfilter-layer7-v2.22.tar.gz
>>>>> +	netfilter-layer7-v2.23.tar.gz
>>>>> 
>>>>> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>>>>> -netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-
>>>>> layer7-
>>>>> v2.22.tar.gz
>>>>> +netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-
>>>>> layer7-
>>>>> v2.23.tar.gz
>>>>> 
>>>>> -$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d
>>>>> -netfilter-layer7-v2.22.tar.gz_MD5 =
>>>>> 98dff8a3d5a31885b73341633f69501f
>>>>> +$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599
>>>>> +netfilter-layer7-v2.23.tar.gz_MD5 =
>>>>> 10910b6173d18e426cb56ae7e1300eeb
>>>>> 
>>>>> install : $(TARGET)
>>>>> 
>>>>> @@ -75,8 +75,8 @@ $(TARGET) : $(patsubst
>>>>> %,$(DIR_DL)/%,$(objects))
>>>>> 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
>>>>> 
>>>>> 	# Layer7
>>>>> -	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
>>>>> v2.22.tar.gz
>>>>> -	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
>>>>> v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
>>>>> +	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-
>>>>> v2.23.tar.gz
>>>>> +	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-
>>>>> v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
>>>>> 	                 ./extensions/
>>>>> 
>>>>> 	# imq
>>>>> @@ -88,6 +88,7 @@ $(TARGET) : $(patsubst
>>>>> %,$(DIR_DL)/%,$(objects))
>>>>> 		--libdir=/lib \
>>>>> 		--includedir=/usr/include \
>>>>> 		--enable-libipq \
>>>>> +		--with-xtlibdir=/lib/xtables \
>>>>> 		--libexecdir=/lib \
>>>>> 		--bindir=/sbin \
>>>>> 		--sbindir=/sbin \
>>>>> -- 
>>>>> 2.12.2
>>>>> 
>>>> 
>>>> 
>> 
>> 
>

diff mbox series

Patch

diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables
index d7584c0ad..9aa9e51cb 100644
--- a/config/rootfiles/common/iptables
+++ b/config/rootfiles/common/iptables
@@ -17,12 +17,8 @@  lib/libiptc.so.0.0.0
 #lib/libxtables.la
 lib/libxtables.so
 lib/libxtables.so.12
-lib/libxtables.so.12.0.0
+lib/libxtables.so.12.2.0
 #lib/xtables
-lib/xtables/libebt_802_3.so
-lib/xtables/libebt_ip.so
-lib/xtables/libebt_log.so
-lib/xtables/libebt_mark_m.so
 lib/xtables/libip6t_DNAT.so
 lib/xtables/libip6t_DNPT.so
 lib/xtables/libip6t_HL.so
@@ -109,7 +105,6 @@  lib/xtables/libxt_layer7.so
 lib/xtables/libxt_length.so
 lib/xtables/libxt_limit.so
 lib/xtables/libxt_mac.so
-lib/xtables/libxt_mangle.so
 lib/xtables/libxt_mark.so
 lib/xtables/libxt_multiport.so
 lib/xtables/libxt_nfacct.so
@@ -136,14 +131,20 @@  lib/xtables/libxt_tos.so
 lib/xtables/libxt_u32.so
 lib/xtables/libxt_udp.so
 sbin/ip6tables
+sbin/ip6tables-legacy
+sbin/ip6tables-legacy-restore
+sbin/ip6tables-legacy-save
 sbin/ip6tables-restore
 sbin/ip6tables-save
 sbin/iptables
+sbin/iptables-legacy
+sbin/iptables-legacy-restore
+sbin/iptables-legacy-save
 sbin/iptables-restore
 sbin/iptables-save
 sbin/iptables-xml
 #sbin/nfnl_osf
-sbin/xtables-multi
+sbin/xtables-legacy-multi
 #usr/include/libipq.h
 #usr/include/libiptc
 #usr/include/libiptc/ipt_kernel_headers.h
@@ -178,5 +179,9 @@  sbin/xtables-multi
 #usr/share/man/man8/iptables-save.8
 #usr/share/man/man8/iptables.8
 #usr/share/man/man8/nfnl_osf.8
+#usr/share/man/man8/xtables-legacy.8
+#usr/share/man/man8/xtables-monitor.8
+#usr/share/man/man8/xtables-nft.8
+#usr/share/man/man8/xtables-translate.8
 #usr/share/xtables
 usr/share/xtables/pf.os
diff --git a/lfs/iptables b/lfs/iptables
index b4a2834b8..17817a9ef 100644
--- a/lfs/iptables
+++ b/lfs/iptables
@@ -1,7 +1,7 @@ 
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2018  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2019  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -24,7 +24,7 @@ 
 
 include Config
 
-VER        = 1.6.2
+VER        = 1.8.2
 
 THISAPP    = iptables-$(VER)
 DL_FILE    = $(THISAPP).tar.bz2
@@ -36,13 +36,13 @@  TARGET     = $(DIR_INFO)/$(THISAPP)
 # Top-level Rules
 ###############################################################################
 objects = $(DL_FILE) \
-	netfilter-layer7-v2.22.tar.gz
+	netfilter-layer7-v2.23.tar.gz
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-netfilter-layer7-v2.22.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.22.tar.gz
+netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz
 
-$(DL_FILE)_MD5 = 7d2b7847e4aa8832a18437b8a4c1873d
-netfilter-layer7-v2.22.tar.gz_MD5 = 98dff8a3d5a31885b73341633f69501f
+$(DL_FILE)_MD5 = 944558e88ddcc3b9b0d9550070fa3599
+netfilter-layer7-v2.23.tar.gz_MD5 = 10910b6173d18e426cb56ae7e1300eeb
 
 install : $(TARGET)
 
@@ -75,8 +75,8 @@  $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
 
 	# Layer7
-	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.22.tar.gz
-	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
+	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.23.tar.gz
+	cd $(DIR_APP) && cp -vf $(DIR_SRC)/netfilter-layer7-v2.23/iptables-1.4.3forward-for-kernel-2.6.20forward/* \
 	                 ./extensions/
 
 	# imq
@@ -88,6 +88,7 @@  $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 		--libdir=/lib \
 		--includedir=/usr/include \
 		--enable-libipq \
+		--with-xtlibdir=/lib/xtables \
 		--libexecdir=/lib \
 		--bindir=/sbin \
 		--sbindir=/sbin \