iptables: Update to version 1.8.9

  - Update from version 1.8.8 to 1.8.9
- Update of rootfile
- Changelog
      xtables-monitor: add missing spaces in printed str
      build: Fix error during out of tree build
      iptables: xshared: Ouptut '--' in the opt field in ipv6's fake mode
      iptables.8: mention that iptables exits when setuid
      extensions: libxt_conntrack: remove always-false conditionals
      nft: fix ebtables among match when mac+ip addresses are used
      nft: support dissection of meta pkktype mode
      nft: prefer native 'meta pkttype' instead of xt match
      extensions: libxt_pkttype: support otherhost
      nft: support ttl/hoplimit dissection
      nft: prefer payload to ttl/hl module
      nft: un-break among match with concatenation
      Revert "nft: prefer payload to ttl/hl module"/'meta pkttype' match.
      nft: track each register individually
      tests: extend native delinearize script
      nft: check for unknown meta keys
      iptables-nft: exit nonzero when iptables-save cannot decode all expressions
      xlate: get rid of escape_quotes
      extensions: change expected output for new format
      xlate-test: avoid shell entanglements
      nft-bridge: work around recent "among" decode breakage
      extensions: add xt_statistics random mode translation
      netfilter: add nf_log.h
      treewide: use uint* instead of u_int*
      nft: replace nftnl_.*_nlmsg_build_hdr() by nftnl_nlmsg_build_hdr()
      nft-shared: replace nftnl_expr_get_data() by nftnl_expr_get()
      xshared: Fix build for -Werror=format-security
      Revert "fix build for missing ETH_ALEN definition"
      tests: shell: Check overhead in iptables-save and -restore
      libxtables: Unexport init_extensions*() declarations
      arptables: Support -x/--exact flag
      iptables-legacy: Drop redundant include of xtables-multi.h
      xshared: Make some functions static
      Makefile: Add --enable-profiling configure option
      tests: shell: Add some more rules to 0002-verbose-output_0
      tests: shell: Extend iptables-xml test a bit
      tests: shell: Extend zero counters test a bit further
      extensions: libebt_standard.t: Test logical-{in,out} as well
      ebtables-restore: Deny --init-table
      extensions: string: Do not print default --to value
      extensions: string: Review parse_string() function
      extensions: string: Fix and enable tests
      nft: Exit if nftnl_alloc_expr fails
      libxtables: Move struct xtables_afinfo into xtables.h
      libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.h
      libxtables: Fix unsupported extension warning corner case
      tests: shell: Fix testcases for changed ip6tables opts output
      xshared: Fix for missing space after 'prot' column
      xshared: Print protocol numbers if --numeric was given
      xtables-restore: Extend failure error message
      nft: Expand extended error reporting to nft_cmd, too
      tests: shell: Test delinearization of native nftables expressions
      ebtables: Drop unused OPT_* defines
      ebtables: Eliminate OPT_TABLE
      ebtables: Merge OPT_* flags with xshared ones
      nft-shared: Introduce __get_cmp_data()
      ebtables: Support '-p Length'
      ebtables: Fix among match
      nft: Fix meta statement parsing
      nft-bridge: Drop 'sreg_count' variable
      tests: iptables-test: Simplify '-N' option a bit
      tests: iptables-test: Simplify execute_cmd() calling
      tests: iptables-test: Pass netns to execute_cmd()
      tests: iptables-test: Test both variants by default
      extensions: among: Remove pointless fall through
      extensions: among: Fix for use with ebtables-restore
      extensions: libebt_stp: Eliminate duplicate space in output
      extensions: libip6t_dst: Fix output for empty options
      extensions: TCPOPTSTRIP: Do not print empty options
      extensions: libebt_log: Avoid empty log-prefix in output
      tests: IDLETIMER.t: Fix syntax, support for restore input
      tests: libebt_stp.t: Drop duplicate whitespace
      tests: shell: Fix expected output for ip6tables dst match
      tests: shell: Fix expected ebtables log target output
      libiptc: Fix for segfault when renaming a chain
      nft: Fix compile with -DDEBUG
      extensions: NFQUEUE: Document queue-balance limitation
      tests: iptables-test: Implement fast test mode
      tests: iptables-test: Cover for obligatory -j CONTINUE in ebtables
      tests: *.t: Fix expected output for simple calls
      tests: *.t: Fix for hexadecimal output
      tests: libebt_redirect.t: Plain redirect prints with trailing whitespace
      tests: libxt_length.t: Fix odd use-case output
      tests: libxt_recent.t: Add missing default values
      tests: libxt_tos.t, libxt_TOS.t: Add missing masks in output
      tests: libebt_vlan.t: Drop trailing whitespace from rules
      tests: libxt_connlimit.t: Add missing default values
      tests: *.t: Add missing all-one's netmasks to expected output
      extensions: DNAT: Fix bad IP address error reporting
      extensions: *NAT: Drop NF_NAT_RANGE_PROTO_RANDOM* flag checks
      extensions: DNAT: Use __DNAT_xlate for REDIRECT, too
      extensions: DNAT: Generate print, save and xlate callbacks
      extensions: DNAT: Rename some symbols
      extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE
      tests: xlate-test: Cleanup file reading loop
      tests: xlate-test.py: Introduce run_proc()
      tests: xlate-test: Replay results for reverse direction testing
      xshared: Share make_delete_mask() between ip{,6}tables
      nft-shared: Introduce port_match_single_to_range()
      extensions: libip*t_LOG: Merge extensions
      extensions: libebt_ip: Include kernel header
      extensions: libebt_arp, libebt_ip: Use xtables_ipparse_any()
      extensions: Collate ICMP types/codes in libxt_icmp.h
      extensions: Unify ICMP parser into libxt_icmp.h
      Drop extra newline from xtables_error() calls
      extensions: mark: Test double bitwise in a rule
      extensions: libebt_mark: Fix mark target xlate
      extensions: libebt_mark: Fix xlate test case
      extensions: libebt_redirect: Fix xlate return code
      extensions: libipt_ttl: Sanitize xlate callback
      extensions: CONNMARK: Fix xlate callback
      extensions: MARK: Sanitize MARK_xlate()
      extensions: TCPMSS: Use xlate callback for IPv6, too
      extensions: TOS: Fix v1 xlate callback
      extensions: ecn: Sanitize xlate callback
      extensions: tcp: Translate TCP option match
      extensions: libebt_log: Add comment to clarify xlate callback
      extensions: frag: Add comment to clarify xlate callback
      extensions: ipcomp: Add comment to clarify xlate callback
      libxtables: xt_xlate_add() to take care of spacing
      extensions: Leverage xlate auto-spacing
      extensions: libxt_conntrack: Drop extra whitespace in xlate
      extensions: xlate: Format sets consistently
      tests: shell: Test selective ebtables flushing
      tests: shell: Fix valgrind mode for 0008-unprivileged_0
      iptables-restore: Free handle with --test also
      iptables-xml: Free allocated chain strings
      nft: Plug memleak in nft_rule_zero_counters()
      iptables: Plug memleaks in print_firewall()
      xtables: Introduce xtables_clear_iptables_command_state()
      iptables: Properly clear iptables_command_state object
      xshared: Free data after printing help
      libiptc: Eliminate garbage access
      ebtables: Implement --check command
      tests: xlate: Use --check to verify replay
      nft: Fix for comparing ifname matches against nft-generated ones
      nft: Fix match generator for '! -i +'
      nft: Recognize INVAL/D interface name
      xtables-translate: Fix for interfaces with asterisk mid-string
      ebtables: Fix MAC address match translation
      Makefile: Create LZMA-compressed dist-files
      Drop INCOMPATIBILITIES file
      Drop libiptc/linux_stddef.h
      Makefile: Generate ip6tables man pages on the fly
      extensions: Makefile: Merge initext targets
      iptables/Makefile: Reorg variable assignments
      iptables/Makefile: Split nft-variant man page list
      Makefile: Fix for 'make distcheck'
      Makefile: Generate .tar.xz archive with 'make dist'
      include/Makefile: xtables-version.h is generated
      tests: Adjust testsuite return codes to automake guidelines
      Makefile.am: Integrate testsuites
      nft: Parse icmp header matches
      arptables: Check the mandatory ar_pln match
      nft: Increase rule parser strictness
      nft: Make rule parsing errors fatal
      nft: Reject tcp/udp extension without proper protocol match
      gitignore: Ignore utils/nfsynproxy
      gitignore: Ignore generated ip6tables man pages
      ebtables-translate: Install symlink
      Makefile: Replace brace expansion
      configure: Bump version for 1.8.9 release
      tests: add ebtables among testcase
      xt_sctp: support a couple of new chunk types

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/iptables | 13 ++++++-------
 lfs/iptables                     |  8 ++++----
 2 files changed, 10 insertions(+), 11 deletions(-)
  

Reviewed-by: Peter Müller <peter.mueller@ipfire.org>

> - Update from version 1.8.8 to 1.8.9
> - Update of rootfile
> - Changelog
>       xtables-monitor: add missing spaces in printed str
>       build: Fix error during out of tree build
>       iptables: xshared: Ouptut '--' in the opt field in ipv6's fake mode
>       iptables.8: mention that iptables exits when setuid
>       extensions: libxt_conntrack: remove always-false conditionals
>       nft: fix ebtables among match when mac+ip addresses are used
>       nft: support dissection of meta pkktype mode
>       nft: prefer native 'meta pkttype' instead of xt match
>       extensions: libxt_pkttype: support otherhost
>       nft: support ttl/hoplimit dissection
>       nft: prefer payload to ttl/hl module
>       nft: un-break among match with concatenation
>       Revert "nft: prefer payload to ttl/hl module"/'meta pkttype' match.
>       nft: track each register individually
>       tests: extend native delinearize script
>       nft: check for unknown meta keys
>       iptables-nft: exit nonzero when iptables-save cannot decode all expressions
>       xlate: get rid of escape_quotes
>       extensions: change expected output for new format
>       xlate-test: avoid shell entanglements
>       nft-bridge: work around recent "among" decode breakage
>       extensions: add xt_statistics random mode translation
>       netfilter: add nf_log.h
>       treewide: use uint* instead of u_int*
>       nft: replace nftnl_.*_nlmsg_build_hdr() by nftnl_nlmsg_build_hdr()
>       nft-shared: replace nftnl_expr_get_data() by nftnl_expr_get()
>       xshared: Fix build for -Werror=format-security
>       Revert "fix build for missing ETH_ALEN definition"
>       tests: shell: Check overhead in iptables-save and -restore
>       libxtables: Unexport init_extensions*() declarations
>       arptables: Support -x/--exact flag
>       iptables-legacy: Drop redundant include of xtables-multi.h
>       xshared: Make some functions static
>       Makefile: Add --enable-profiling configure option
>       tests: shell: Add some more rules to 0002-verbose-output_0
>       tests: shell: Extend iptables-xml test a bit
>       tests: shell: Extend zero counters test a bit further
>       extensions: libebt_standard.t: Test logical-{in,out} as well
>       ebtables-restore: Deny --init-table
>       extensions: string: Do not print default --to value
>       extensions: string: Review parse_string() function
>       extensions: string: Fix and enable tests
>       nft: Exit if nftnl_alloc_expr fails
>       libxtables: Move struct xtables_afinfo into xtables.h
>       libxtables: Define XT_OPTION_OFFSET_SCALE in xtables.h
>       libxtables: Fix unsupported extension warning corner case
>       tests: shell: Fix testcases for changed ip6tables opts output
>       xshared: Fix for missing space after 'prot' column
>       xshared: Print protocol numbers if --numeric was given
>       xtables-restore: Extend failure error message
>       nft: Expand extended error reporting to nft_cmd, too
>       tests: shell: Test delinearization of native nftables expressions
>       ebtables: Drop unused OPT_* defines
>       ebtables: Eliminate OPT_TABLE
>       ebtables: Merge OPT_* flags with xshared ones
>       nft-shared: Introduce __get_cmp_data()
>       ebtables: Support '-p Length'
>       ebtables: Fix among match
>       nft: Fix meta statement parsing
>       nft-bridge: Drop 'sreg_count' variable
>       tests: iptables-test: Simplify '-N' option a bit
>       tests: iptables-test: Simplify execute_cmd() calling
>       tests: iptables-test: Pass netns to execute_cmd()
>       tests: iptables-test: Test both variants by default
>       extensions: among: Remove pointless fall through
>       extensions: among: Fix for use with ebtables-restore
>       extensions: libebt_stp: Eliminate duplicate space in output
>       extensions: libip6t_dst: Fix output for empty options
>       extensions: TCPOPTSTRIP: Do not print empty options
>       extensions: libebt_log: Avoid empty log-prefix in output
>       tests: IDLETIMER.t: Fix syntax, support for restore input
>       tests: libebt_stp.t: Drop duplicate whitespace
>       tests: shell: Fix expected output for ip6tables dst match
>       tests: shell: Fix expected ebtables log target output
>       libiptc: Fix for segfault when renaming a chain
>       nft: Fix compile with -DDEBUG
>       extensions: NFQUEUE: Document queue-balance limitation
>       tests: iptables-test: Implement fast test mode
>       tests: iptables-test: Cover for obligatory -j CONTINUE in ebtables
>       tests: *.t: Fix expected output for simple calls
>       tests: *.t: Fix for hexadecimal output
>       tests: libebt_redirect.t: Plain redirect prints with trailing whitespace
>       tests: libxt_length.t: Fix odd use-case output
>       tests: libxt_recent.t: Add missing default values
>       tests: libxt_tos.t, libxt_TOS.t: Add missing masks in output
>       tests: libebt_vlan.t: Drop trailing whitespace from rules
>       tests: libxt_connlimit.t: Add missing default values
>       tests: *.t: Add missing all-one's netmasks to expected output
>       extensions: DNAT: Fix bad IP address error reporting
>       extensions: *NAT: Drop NF_NAT_RANGE_PROTO_RANDOM* flag checks
>       extensions: DNAT: Use __DNAT_xlate for REDIRECT, too
>       extensions: DNAT: Generate print, save and xlate callbacks
>       extensions: DNAT: Rename some symbols
>       extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE
>       tests: xlate-test: Cleanup file reading loop
>       tests: xlate-test.py: Introduce run_proc()
>       tests: xlate-test: Replay results for reverse direction testing
>       xshared: Share make_delete_mask() between ip{,6}tables
>       nft-shared: Introduce port_match_single_to_range()
>       extensions: libip*t_LOG: Merge extensions
>       extensions: libebt_ip: Include kernel header
>       extensions: libebt_arp, libebt_ip: Use xtables_ipparse_any()
>       extensions: Collate ICMP types/codes in libxt_icmp.h
>       extensions: Unify ICMP parser into libxt_icmp.h
>       Drop extra newline from xtables_error() calls
>       extensions: mark: Test double bitwise in a rule
>       extensions: libebt_mark: Fix mark target xlate
>       extensions: libebt_mark: Fix xlate test case
>       extensions: libebt_redirect: Fix xlate return code
>       extensions: libipt_ttl: Sanitize xlate callback
>       extensions: CONNMARK: Fix xlate callback
>       extensions: MARK: Sanitize MARK_xlate()
>       extensions: TCPMSS: Use xlate callback for IPv6, too
>       extensions: TOS: Fix v1 xlate callback
>       extensions: ecn: Sanitize xlate callback
>       extensions: tcp: Translate TCP option match
>       extensions: libebt_log: Add comment to clarify xlate callback
>       extensions: frag: Add comment to clarify xlate callback
>       extensions: ipcomp: Add comment to clarify xlate callback
>       libxtables: xt_xlate_add() to take care of spacing
>       extensions: Leverage xlate auto-spacing
>       extensions: libxt_conntrack: Drop extra whitespace in xlate
>       extensions: xlate: Format sets consistently
>       tests: shell: Test selective ebtables flushing
>       tests: shell: Fix valgrind mode for 0008-unprivileged_0
>       iptables-restore: Free handle with --test also
>       iptables-xml: Free allocated chain strings
>       nft: Plug memleak in nft_rule_zero_counters()
>       iptables: Plug memleaks in print_firewall()
>       xtables: Introduce xtables_clear_iptables_command_state()
>       iptables: Properly clear iptables_command_state object
>       xshared: Free data after printing help
>       libiptc: Eliminate garbage access
>       ebtables: Implement --check command
>       tests: xlate: Use --check to verify replay
>       nft: Fix for comparing ifname matches against nft-generated ones
>       nft: Fix match generator for '! -i +'
>       nft: Recognize INVAL/D interface name
>       xtables-translate: Fix for interfaces with asterisk mid-string
>       ebtables: Fix MAC address match translation
>       Makefile: Create LZMA-compressed dist-files
>       Drop INCOMPATIBILITIES file
>       Drop libiptc/linux_stddef.h
>       Makefile: Generate ip6tables man pages on the fly
>       extensions: Makefile: Merge initext targets
>       iptables/Makefile: Reorg variable assignments
>       iptables/Makefile: Split nft-variant man page list
>       Makefile: Fix for 'make distcheck'
>       Makefile: Generate .tar.xz archive with 'make dist'
>       include/Makefile: xtables-version.h is generated
>       tests: Adjust testsuite return codes to automake guidelines
>       Makefile.am: Integrate testsuites
>       nft: Parse icmp header matches
>       arptables: Check the mandatory ar_pln match
>       nft: Increase rule parser strictness
>       nft: Make rule parsing errors fatal
>       nft: Reject tcp/udp extension without proper protocol match
>       gitignore: Ignore utils/nfsynproxy
>       gitignore: Ignore generated ip6tables man pages
>       ebtables-translate: Install symlink
>       Makefile: Replace brace expansion
>       configure: Bump version for 1.8.9 release
>       tests: add ebtables among testcase
>       xt_sctp: support a couple of new chunk types
> 
> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
> ---
>  config/rootfiles/common/iptables | 13 ++++++-------
>  lfs/iptables                     |  8 ++++----
>  2 files changed, 10 insertions(+), 11 deletions(-)
> 
> diff --git a/config/rootfiles/common/iptables b/config/rootfiles/common/iptables
> index d7d87bee7..06e4ab7b4 100644
> --- a/config/rootfiles/common/iptables
> +++ b/config/rootfiles/common/iptables
> @@ -13,15 +13,12 @@ lib/libipq.so.0.0.0
>  #lib/libxtables.la
>  lib/libxtables.so
>  lib/libxtables.so.12
> -lib/libxtables.so.12.6.0
> +lib/libxtables.so.12.7.0
>  #lib/xtables
>  lib/xtables/libip6t_DNPT.so
>  lib/xtables/libip6t_HL.so
> -lib/xtables/libip6t_LOG.so
> -lib/xtables/libip6t_MASQUERADE.so
>  lib/xtables/libip6t_NETMAP.so
>  lib/xtables/libip6t_REJECT.so
> -lib/xtables/libip6t_SNAT.so
>  lib/xtables/libip6t_SNPT.so
>  lib/xtables/libip6t_ah.so
>  lib/xtables/libip6t_dst.so
> @@ -36,11 +33,8 @@ lib/xtables/libip6t_rt.so
>  lib/xtables/libip6t_srh.so
>  lib/xtables/libipt_CLUSTERIP.so
>  lib/xtables/libipt_ECN.so
> -lib/xtables/libipt_LOG.so
> -lib/xtables/libipt_MASQUERADE.so
>  lib/xtables/libipt_NETMAP.so
>  lib/xtables/libipt_REJECT.so
> -lib/xtables/libipt_SNAT.so
>  lib/xtables/libipt_TTL.so
>  lib/xtables/libipt_ULOG.so
>  lib/xtables/libipt_ah.so
> @@ -58,7 +52,10 @@ lib/xtables/libxt_DSCP.so
>  lib/xtables/libxt_HMARK.so
>  lib/xtables/libxt_IDLETIMER.so
>  lib/xtables/libxt_LED.so
> +lib/xtables/libxt_LOG.so
>  lib/xtables/libxt_MARK.so
> +lib/xtables/libxt_MASQUERADE.so
> +lib/xtables/libxt_NAT.so
>  lib/xtables/libxt_NFLOG.so
>  lib/xtables/libxt_NFQUEUE.so
>  lib/xtables/libxt_NOTRACK.so
> @@ -66,6 +63,7 @@ lib/xtables/libxt_RATEEST.so
>  lib/xtables/libxt_REDIRECT.so
>  lib/xtables/libxt_SECMARK.so
>  lib/xtables/libxt_SET.so
> +lib/xtables/libxt_SNAT.so
>  lib/xtables/libxt_SYNPROXY.so
>  lib/xtables/libxt_TCPMSS.so
>  lib/xtables/libxt_TCPOPTSTRIP.so
> @@ -177,4 +175,5 @@ sbin/xtables-legacy-multi
>  #usr/share/man/man8/iptables.8
>  #usr/share/man/man8/nfnl_osf.8
>  #usr/share/xtables
> +usr/share/xtables/iptables.xslt
>  usr/share/xtables/pf.os
> diff --git a/lfs/iptables b/lfs/iptables
> index 275559bfe..30c6e1d94 100644
> --- a/lfs/iptables
> +++ b/lfs/iptables
> @@ -24,10 +24,10 @@
>  
>  include Config
>  
> -VER        = 1.8.8
> +VER        = 1.8.9
>  
>  THISAPP    = iptables-$(VER)
> -DL_FILE    = $(THISAPP).tar.bz2
> +DL_FILE    = $(THISAPP).tar.xz
>  DL_FROM    = $(URL_IPFIRE)
>  DIR_APP    = $(DIR_SRC)/$(THISAPP)
>  TARGET     = $(DIR_INFO)/$(THISAPP)
> @@ -41,7 +41,7 @@ objects = $(DL_FILE) \
>  $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
>  netfilter-layer7-v2.23.tar.gz = $(URL_IPFIRE)/netfilter-layer7-v2.23.tar.gz
>  
> -$(DL_FILE)_BLAKE2 = 0da021cc7313b86af331768904956dab3eee3de245a7b03965129f3d7f13097fc03fbb1390167dcd971eff216eabad9e59b261a9c0f54bfc48a77453aa40d164
> +$(DL_FILE)_BLAKE2 = 37ba80be0ee7049c4d3ee5689b273b4d2cc6e6fb9ebb297e86976b5750f987f2ae4536013fe1749ae79b6989c241eaece3202019fafd47d842c7a4fe3e5093b1
>  netfilter-layer7-v2.23.tar.gz_BLAKE2 = 5c8ab722f6fbc126f2f65ecf401de5fc40560c20e3be52f783db34410446185dcb6781b3148e4a174e8b2d2c290bec0342dea95e8cefc35c39345617fa7a8fdc
>  
>  install : $(TARGET)
> @@ -72,7 +72,7 @@ $(subst %,%_BLAKE2,$(objects)) :
>  $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
>  	@$(PREBUILD)
>  	@rm -rf $(DIR_APP) $(DIR_SRC)/netfilter-layer7*
> -	@cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
> +	@cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
>  
>  	# Layer7
>  	cd $(DIR_SRC) && tar zxf $(DIR_DL)/netfilter-layer7-v2.23.tar.gz