From 7b2367e316ab8e178b8c502b42ae68e0fc77955b Mon Sep 17 00:00:00 2001
From: Steve Conklin <sconklin@fedoraproject.org>
Date: Mon, 16 Jul 2007 22:03:39 +0000
Subject: [PATCH] Rebase to upstream release 1.3.8

---
 .cvsignore                     |   8 +-
 iptables-1.2.10-counters.patch |  14 -
 iptables-1.2.11-autoload.patch |  48 ---
 iptables-1.2.11-cleanup.patch  |  12 -
 iptables-1.2.11-free.patch     |  18 -
 iptables-1.2.9-netlink.patch   |  13 -
 iptables-1.2.9-selinux.patch   |  42 --
 iptables-1.3.0-autoload.patch  |  11 -
 iptables-1.3.0-cleanup.patch   |  74 ----
 iptables-1.3.0-no_root.patch   |  11 -
 iptables-1.3.0-selinux.patch   |  42 --
 iptables-1.3.2-free_opts.patch |  20 -
 iptables-1.3.5-secmark.patch   | 699 ---------------------------------
 iptables-1.3.7-nolibnsl.patch  |  11 -
 iptables.spec                  |  21 +-
 sources                        |   2 +-
 16 files changed, 7 insertions(+), 1039 deletions(-)
 delete mode 100644 iptables-1.2.10-counters.patch
 delete mode 100644 iptables-1.2.11-autoload.patch
 delete mode 100644 iptables-1.2.11-cleanup.patch
 delete mode 100644 iptables-1.2.11-free.patch
 delete mode 100644 iptables-1.2.9-netlink.patch
 delete mode 100644 iptables-1.2.9-selinux.patch
 delete mode 100644 iptables-1.3.0-autoload.patch
 delete mode 100644 iptables-1.3.0-cleanup.patch
 delete mode 100644 iptables-1.3.0-no_root.patch
 delete mode 100644 iptables-1.3.0-selinux.patch
 delete mode 100644 iptables-1.3.2-free_opts.patch
 delete mode 100644 iptables-1.3.5-secmark.patch
 delete mode 100644 iptables-1.3.7-nolibnsl.patch

diff --git a/.cvsignore b/.cvsignore
index b41a2c7..9801098 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,7 +1 @@
-iptables-1.2.11.tar.bz2
-iptables-1.3.0.tar.bz2
-iptables-1.3.1.tar.bz2
-iptables-1.3.2.tar.bz2
-iptables-1.3.4.tar.bz2
-iptables-1.3.5.tar.bz2
-iptables-1.3.7.tar.bz2
+iptables-1.3.8.tar.bz2
diff --git a/iptables-1.2.10-counters.patch b/iptables-1.2.10-counters.patch
deleted file mode 100644
index b037a94..0000000
--- a/iptables-1.2.10-counters.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- iptables-1.2.10/iptables-restore.c.counters	2004-06-15 00:02:16.000000000 +0200
-+++ iptables-1.2.10/iptables-restore.c	2004-06-17 14:01:50.953645355 +0200
-@@ -73,7 +73,10 @@
- 
- int parse_counters(char *string, struct ipt_counters *ctr)
- {
--	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)&ctr->pcnt, (unsigned long long *)&ctr->bcnt) == 2);
-+	if (string != NULL)
-+		return (sscanf(string, "[%llu:%llu]", (unsigned long long *)&ctr->pcnt, (unsigned long long *)&ctr->bcnt) == 2);
-+	else
-+		return (0 == 2);
- }
- 
- /* global new argv and argc */
diff --git a/iptables-1.2.11-autoload.patch b/iptables-1.2.11-autoload.patch
deleted file mode 100644
index 2bdefef..0000000
--- a/iptables-1.2.11-autoload.patch
+++ /dev/null
@@ -1,48 +0,0 @@
---- iptables-1.2.11/ip6tables.c.autoload	2004-11-11 12:03:35.221306429 +0100
-+++ iptables-1.2.11/ip6tables.c	2004-11-11 12:04:43.382900379 +0100
-@@ -1595,15 +1595,18 @@
- 	int procfile;
- 	char *ret;
- 
-+#define PROCFILE_BUFSIZ 1024
-+
- 	procfile = open(PROC_SYS_MODPROBE, O_RDONLY);
- 	if (procfile < 0)
- 		return NULL;
- 
--	ret = malloc(1024);
-+	ret = malloc(PROCFILE_BUFSIZ);
- 	if (ret) {
--		switch (read(procfile, ret, 1024)) {
-+		memset(ret, 0, PROCFILE_BUFSIZ);
-+		switch (read(procfile, ret, PROCFILE_BUFSIZ)) {
- 		case -1: goto fail;
--		case 1024: goto fail; /* Partial read.  Wierd */
-+		case PROCFILE_BUFSIZ: goto fail; /* Partial read.  Wierd */
- 		}
- 		if (ret[strlen(ret)-1]=='\n') 
- 			ret[strlen(ret)-1]=0;
---- iptables-1.2.11/iptables.c.autoload	2004-11-11 12:01:35.601815606 +0100
-+++ iptables-1.2.11/iptables.c	2004-11-11 12:02:50.496478760 +0100
-@@ -1593,15 +1593,18 @@
- 	int procfile;
- 	char *ret;
- 
-+#define PROCFILE_BUFSIZ 1024
-+
- 	procfile = open(PROC_SYS_MODPROBE, O_RDONLY);
- 	if (procfile < 0)
- 		return NULL;
- 
--	ret = malloc(1024);
-+	ret = malloc(PROCFILE_BUFSIZ);
- 	if (ret) {
--		switch (read(procfile, ret, 1024)) {
-+		memset(ret, 0, PROCFILE_BUFSIZ);
-+		switch (read(procfile, ret, PROCFILE_BUFSIZ)) {
- 		case -1: goto fail;
--		case 1024: goto fail; /* Partial read.  Wierd */
-+		case PROCFILE_BUFSIZ: goto fail; /* Partial read.  Wierd */
- 		}
- 		if (ret[strlen(ret)-1]=='\n') 
- 			ret[strlen(ret)-1]=0;
diff --git a/iptables-1.2.11-cleanup.patch b/iptables-1.2.11-cleanup.patch
deleted file mode 100644
index e4a9b3d..0000000
--- a/iptables-1.2.11-cleanup.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -ur iptables-1.2.11.orig/extensions/libipt_rpc.c iptables-1.2.11/extensions/libipt_rpc.c
---- iptables-1.2.11.orig/extensions/libipt_rpc.c	2004-09-05 11:27:50.000000000 -0400
-+++ iptables-1.2.11/extensions/libipt_rpc.c	2004-09-05 11:41:11.000000000 -0400
-@@ -252,7 +252,7 @@
- 
- 			idup = 0;
- 			memset(buf, 0, sizeof(buf));
--			dst = (char *)buf - 1;
-+			dst = (char *)buf;
- 		}
- 	}
- 
diff --git a/iptables-1.2.11-free.patch b/iptables-1.2.11-free.patch
deleted file mode 100644
index 7787867..0000000
--- a/iptables-1.2.11-free.patch
+++ /dev/null
@@ -1,18 +0,0 @@
---- iptables-1.2.11/iptables.c.free	2004-08-25 19:10:34.098917816 +0200
-+++ iptables-1.2.11/iptables.c	2004-08-25 19:12:42.366228649 +0200
-@@ -2344,11 +2344,11 @@
- 		e = NULL;
- 	}
- 
--	for (c = 0; c < nsaddrs; c++)
--		free(&saddrs[c]);
-+	/* free the whole array - allocated with calloc */
-+	free(saddrs);
- 
--	for (c = 0; c < ndaddrs; c++)
--		free(&daddrs[c]);
-+	/* free the whole array - allocated with calloc */
-+	free(daddrs);
- 
- 	if (opts != original_opts) {
- 		free(opts);
diff --git a/iptables-1.2.9-netlink.patch b/iptables-1.2.9-netlink.patch
deleted file mode 100644
index b25fe3d..0000000
--- a/iptables-1.2.9-netlink.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- iptables-1.2.9/libipq/libipq.c.netlink	2003-12-05 17:00:07.000000000 +0100
-+++ iptables-1.2.9/libipq/libipq.c	2003-12-05 17:00:39.000000000 +0100
-@@ -171,6 +171,10 @@
- 		ipq_errno = IPQ_ERR_RECV;
- 		return -1;
- 	}
-+	if (h->peer.nl_pid != 0) {
-+		ipq_errno = IPQ_ERR_RECV;
-+		return -1;
-+	}
- 	if (status == 0) {
- 		ipq_errno = IPQ_ERR_NLEOF;
- 		return -1;
diff --git a/iptables-1.2.9-selinux.patch b/iptables-1.2.9-selinux.patch
deleted file mode 100644
index c9f32dc..0000000
--- a/iptables-1.2.9-selinux.patch
+++ /dev/null
@@ -1,42 +0,0 @@
---- iptables-1.2.9/ip6tables.c.selinux	2004-01-25 13:39:58.652465653 -0500
-+++ iptables-1.2.9/ip6tables.c	2004-01-25 13:52:50.291335019 -0500
-@@ -1587,6 +1587,7 @@
- {
- 	char *buf = NULL;
- 	char *argv[3];
-+	int i=0;
- 
- 	/* If they don't explicitly set it, read out of kernel */
- 	if (!modprobe) {
-@@ -1598,6 +1599,10 @@
- 
- 	switch (fork()) {
- 	case 0:
-+	        /* close open file descriptors */
-+	        for (i=0; i< 10; i++) {
-+		  close(i);
-+		}
- 		argv[0] = (char *)modprobe;
- 		argv[1] = (char *)modname;
- 		argv[2] = NULL;
---- iptables-1.2.9/iptables.c.selinux	2004-01-25 13:39:58.702460379 -0500
-+++ iptables-1.2.9/iptables.c	2004-01-25 13:52:55.940802957 -0500
-@@ -1583,6 +1583,7 @@
- {
- 	char *buf = NULL;
- 	char *argv[3];
-+	int i=0;
- 
- 	/* If they don't explicitly set it, read out of kernel */
- 	if (!modprobe) {
-@@ -1594,6 +1595,10 @@
- 
- 	switch (fork()) {
- 	case 0:
-+	        /* close open file descriptors */
-+	        for (i=0; i< 10; i++) {
-+		  close(i);
-+		}
- 		argv[0] = (char *)modprobe;
- 		argv[1] = (char *)modname;
- 		argv[2] = NULL;
diff --git a/iptables-1.3.0-autoload.patch b/iptables-1.3.0-autoload.patch
deleted file mode 100644
index b6b5889..0000000
--- a/iptables-1.3.0-autoload.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- iptables-1.3.0/ip6tables.c.autoload	2005-02-21 17:52:46.502379964 +0100
-+++ iptables-1.3.0/ip6tables.c	2005-02-21 18:01:38.113422285 +0100
-@@ -1589,7 +1589,7 @@
- 	if (procfile < 0)
- 		return NULL;
- 
--	ret = malloc(PROCFILE_BUFSIZ);
-+	ret = (char *) malloc(PROCFILE_BUFSIZ);
- 	if (ret) {
- 		memset(ret, 0, PROCFILE_BUFSIZ);
- 		switch (read(procfile, ret, PROCFILE_BUFSIZ)) {
diff --git a/iptables-1.3.0-cleanup.patch b/iptables-1.3.0-cleanup.patch
deleted file mode 100644
index d108040..0000000
--- a/iptables-1.3.0-cleanup.patch
+++ /dev/null
@@ -1,74 +0,0 @@
---- iptables-1.3.0/extensions/libipt_rpc.c.cleanup	2005-11-09 16:37:34.000000000 +0100
-+++ iptables-1.3.0/extensions/libipt_rpc.c	2005-11-09 16:37:38.000000000 +0100
-@@ -205,7 +205,7 @@
- 
- 	memset(buf, 0, sizeof(buf));
- 
--	for (src=string, dst=buf; term != 1 ; src++, dst++) {
-+	for (src=string, dst=buf; term != 1 ; src++) {
- 
- 		if ( *src != ',' && *src != '\0' ) {
- 			if ( ( *src >= 65 && *src <= 90 ) || ( *src >= 97 && *src <= 122) ) {
-@@ -220,7 +220,7 @@
- 					   string, src - string + 1);
- 
- 			}
--
-+			dst++;
- 		} else {
- 			*dst = '\0';
- 			if ( idup == 1 ) {
---- iptables-1.3.0/extensions/libipt_rpc.c.cleanup	2005-03-18 16:25:34.174370567 +0100
-+++ iptables-1.3.0/extensions/libipt_rpc.c	2005-03-18 16:25:32.000000000 +0100
-@@ -252,7 +252,7 @@
- 
- 			idup = 0;
- 			memset(buf, 0, sizeof(buf));
--			dst = (char *)buf - 1;
-+			dst = (char *)buf;
- 		}
- 	}
- 
---- iptables-1.3.0/extensions/libipt_REJECT.c.cleanup	2005-03-18 16:29:21.611549462 +0100
-+++ iptables-1.3.0/extensions/libipt_REJECT.c	2005-03-18 16:31:26.951045260 +0100
-@@ -147,13 +147,16 @@
- {
- 	const struct ipt_reject_info *reject
- 		= (const struct ipt_reject_info *)target->data;
--	unsigned int i;
-+	unsigned int i, limit=sizeof(reject_table)/sizeof(struct reject_names);
- 
--	for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++) {
-+	for (i = 0; i < limit; i++) {
- 		if (reject_table[i].with == reject->with)
- 			break;
- 	}
--	printf("reject-with %s ", reject_table[i].name);
-+	if (i < limit)
-+		printf("reject-with %s ", reject_table[i].name);
-+	else
-+		fprintf(stderr, "reject-with: error reject->with not found ");
- }
- 
- /* Saves ipt_reject in parsable form to stdout. */
-@@ -161,13 +164,16 @@
- {
- 	const struct ipt_reject_info *reject
- 		= (const struct ipt_reject_info *)target->data;
--	unsigned int i;
-+	unsigned int i, limit=sizeof(reject_table)/sizeof(struct reject_names);
- 
--	for (i = 0; i < sizeof(reject_table)/sizeof(struct reject_names); i++)
-+	for (i = 0; i < limit; i++) {
- 		if (reject_table[i].with == reject->with)
- 			break;
--
--	printf("--reject-with %s ", reject_table[i].name);
-+	}
-+	if (i < limit)
-+		printf("--reject-with %s ", reject_table[i].name);
-+	else
-+		fprintf(stderr, "--reject-with error reject->with not found");
- }
- 
- static struct iptables_target reject = { 
diff --git a/iptables-1.3.0-no_root.patch b/iptables-1.3.0-no_root.patch
deleted file mode 100644
index 4b5ce85..0000000
--- a/iptables-1.3.0-no_root.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- iptables-1.3.0/iptables.c.no_root	2005-03-18 17:29:57.109501987 +0100
-+++ iptables-1.3.0/iptables.c	2005-03-18 17:29:58.321405982 +0100
-@@ -2300,7 +2300,7 @@
- 		*handle = iptc_init(*table);
- 
- 	if (!*handle)
--		exit_error(VERSION_PROBLEM,
-+		exit_error(errno == EPERM ? OTHER_PROBLEM : VERSION_PROBLEM,
- 			   "can't initialize iptables table `%s': %s",
- 			   *table, iptc_strerror(errno));
- 
diff --git a/iptables-1.3.0-selinux.patch b/iptables-1.3.0-selinux.patch
deleted file mode 100644
index 82571a9..0000000
--- a/iptables-1.3.0-selinux.patch
+++ /dev/null
@@ -1,42 +0,0 @@
---- iptables-1.3.0/ip6tables.c.selinux	2005-01-04 11:38:39.000000000 +0100
-+++ iptables-1.3.0/ip6tables.c	2005-02-21 17:51:24.811668259 +0100
-@@ -1612,6 +1612,7 @@
- 	char *buf = NULL;
- 	char *argv[3];
- 	int status;
-+	int i = 0;
- 
- 	/* If they don't explicitly set it, read out of kernel */
- 	if (!modprobe) {
-@@ -1623,6 +1624,10 @@
- 
- 	switch (fork()) {
- 	case 0:
-+	        /* close open file descriptors */
-+	        for (i=0; i< 10; i++) {
-+		  close(i);
-+		}
- 		argv[0] = (char *)modprobe;
- 		argv[1] = (char *)modname;
- 		argv[2] = NULL;
---- iptables-1.3.0/iptables.c.selinux	2005-01-04 11:38:38.000000000 +0100
-+++ iptables-1.3.0/iptables.c	2005-02-21 17:51:33.409499635 +0100
-@@ -1708,6 +1708,7 @@
- 	char *buf = NULL;
- 	char *argv[3];
- 	int status;
-+	int i = 0;
- 
- 	/* If they don't explicitly set it, read out of kernel */
- 	if (!modprobe) {
-@@ -1719,6 +1720,10 @@
- 
- 	switch (fork()) {
- 	case 0:
-+	        /* close open file descriptors */
-+	        for (i=0; i< 10; i++) {
-+		  close(i);
-+		}
- 		argv[0] = (char *)modprobe;
- 		argv[1] = (char *)modname;
- 		argv[2] = NULL;
diff --git a/iptables-1.3.2-free_opts.patch b/iptables-1.3.2-free_opts.patch
deleted file mode 100644
index 9f86874..0000000
--- a/iptables-1.3.2-free_opts.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- iptables-1.3.2/iptables.c.free_opts	2005-07-18 14:06:41.000000000 +0200
-+++ iptables-1.3.2/iptables.c	2005-07-18 14:06:40.000000000 +0200
-@@ -1028,9 +1028,6 @@
- 	unsigned int num_old, num_new, i;
- 	struct option *merge;
- 
--	/* Release previous options merged if any */
--	free_opts(0);
--	
- 	for (num_old = 0; oldopts[num_old].name; num_old++);
- 	for (num_new = 0; newopts[num_new].name; num_new++);
- 
-@@ -1039,6 +1036,7 @@
- 
- 	merge = malloc(sizeof(struct option) * (num_new + num_old + 1));
- 	memcpy(merge, oldopts, num_old * sizeof(struct option));
-+	free_opts(0); /* Release previous options merged if any */
- 	for (i = 0; i < num_new; i++) {
- 		merge[num_old + i] = newopts[i];
- 		merge[num_old + i].val += *option_offset;
diff --git a/iptables-1.3.5-secmark.patch b/iptables-1.3.5-secmark.patch
deleted file mode 100644
index b6c4ab4..0000000
--- a/iptables-1.3.5-secmark.patch
+++ /dev/null
@@ -1,699 +0,0 @@
-diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.c iptables-1.3.5/extensions/libip6t_CONNSECMARK.c
---- iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.c	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libip6t_CONNSECMARK.c	2006-09-07 15:09:40.000000000 +0200
-@@ -0,0 +1,124 @@
-+/*
-+ * Shared library add-on to ip6tables to add CONNSECMARK target support.
-+ *
-+ * Based on the MARK and CONNMARK targets.
-+ *
-+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
-+ */
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <getopt.h>
-+#include <ip6tables.h>
-+#include <linux/netfilter/xt_CONNSECMARK.h>
-+
-+#define PFX "CONNSECMARK target: "
-+
-+static void help(void)
-+{
-+	printf(
-+"CONNSECMARK target v%s options:\n"
-+"  --save                   Copy security mark from packet to conntrack\n"
-+"  --restore                Copy security mark from connection to packet\n"
-+"\n",
-+IPTABLES_VERSION);
-+}
-+
-+static struct option opts[] = {
-+	{ "save", 0, 0, '1' },
-+	{ "restore", 0, 0, '2' },
-+	{ 0 }
-+};
-+
-+static int parse(int c, char **argv, int invert, unsigned int *flags,
-+                 const struct ip6t_entry *entry, struct ip6t_entry_target **target)
-+{
-+	struct xt_connsecmark_target_info *info =
-+		(struct xt_connsecmark_target_info*)(*target)->data;
-+
-+	switch (c) {
-+	case '1':
-+		if (*flags & CONNSECMARK_SAVE)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Can't specify --save twice");
-+		info->mode = CONNSECMARK_SAVE;
-+		*flags |= CONNSECMARK_SAVE;
-+		break;
-+
-+	case '2':
-+		if (*flags & CONNSECMARK_RESTORE)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Can't specify --restore twice");
-+		info->mode = CONNSECMARK_RESTORE;
-+		*flags |= CONNSECMARK_RESTORE;
-+		break;
-+
-+	default:
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+	if (!flags)
-+		exit_error(PARAMETER_PROBLEM, PFX "parameter required");
-+
-+	if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE))
-+		exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save "
-+		           "or --restore is allowed");
-+}
-+
-+static void print_connsecmark(struct xt_connsecmark_target_info *info)
-+{
-+	switch (info->mode) {
-+	case CONNSECMARK_SAVE:
-+		printf("save ");
-+		break;
-+		
-+	case CONNSECMARK_RESTORE:
-+		printf("restore ");
-+		break;
-+		
-+	default:
-+		exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
-+	}
-+}
-+
-+static void print(const struct ip6t_ip6 *ip,
-+		  const struct ip6t_entry_target *target, int numeric)
-+{
-+	struct xt_connsecmark_target_info *info =
-+		(struct xt_connsecmark_target_info*)(target)->data;
-+
-+	printf("CONNSECMARK ");
-+	print_connsecmark(info);
-+}
-+
-+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
-+{
-+	struct xt_connsecmark_target_info *info =
-+		(struct xt_connsecmark_target_info*)target->data;
-+
-+	printf("--");
-+	print_connsecmark(info);
-+}
-+
-+static struct ip6tables_target connsecmark = {
-+	.name		= "CONNSECMARK",
-+	.version	= IPTABLES_VERSION,
-+	.size		= IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)),
-+	.userspacesize	= IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)),
-+	.parse		= &parse,
-+	.help		= &help,
-+	.final_check	= &final_check,
-+	.print		= &print,
-+	.save		= &save,
-+	.extra_opts	= opts
-+};
-+
-+void _init(void)
-+{
-+	register_target6(&connsecmark);
-+}
-diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.man iptables-1.3.5/extensions/libip6t_CONNSECMARK.man
---- iptables-1.3.5.no_secmark/extensions/libip6t_CONNSECMARK.man	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libip6t_CONNSECMARK.man	2006-09-07 15:09:40.000000000 +0200
-@@ -0,0 +1,15 @@
-+This module copies security markings from packets to connections
-+(if unlabeled), and from connections back to packets (also only
-+if unlabeled).  Typically used in conjunction with SECMARK, it is
-+only valid in the
-+.B mangle
-+table.
-+.TP
-+.B --save
-+If the packet has a security marking, copy it to the connection
-+if the connection is not marked.
-+.TP
-+.B --restore
-+If the packet does not have a security marking, and the connection
-+does, copy the security marking from the connection to the packet.
-+
-diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.c iptables-1.3.5/extensions/libip6t_SECMARK.c
---- iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.c	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libip6t_SECMARK.c	2006-09-07 15:09:32.000000000 +0200
-@@ -0,0 +1,125 @@
-+/*
-+ * Shared library add-on to iptables to add SECMARK target support.
-+ *
-+ * Based on the MARK target.
-+ *
-+ * IPv6 version.
-+ *
-+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
-+ */
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <getopt.h>
-+#include <ip6tables.h>
-+#include <linux/netfilter/xt_SECMARK.h>
-+
-+#define PFX "SECMARK target: "
-+
-+static void help(void)
-+{
-+	printf(
-+"SECMARK target v%s options:\n"
-+"  --selctx value                     Set the SELinux security context\n"
-+"\n",
-+IPTABLES_VERSION);
-+}
-+
-+static struct option opts[] = {
-+	{ "selctx", 1, 0, '1' },
-+	{ 0 }
-+};
-+
-+/* Initialize the target. */
-+static void init(struct ip6t_entry_target *t, unsigned int *nfcache)
-+{ }
-+
-+/*
-+ * Function which parses command options; returns true if it
-+ * ate an option.
-+ */
-+static int parse(int c, char **argv, int invert, unsigned int *flags,
-+                 const struct ip6t_entry *entry, struct ip6t_entry_target **target)
-+{
-+	struct xt_secmark_target_info *info =
-+		(struct xt_secmark_target_info*)(*target)->data;
-+
-+	switch (c) {
-+	case '1':
-+		if (*flags & SECMARK_MODE_SEL)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Can't specify --selctx twice");
-+		info->mode = SECMARK_MODE_SEL;
-+
-+		if (strlen(optarg) > SECMARK_SELCTX_MAX-1)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Maximum length %u exceeded by --selctx"
-+				   " parameter (%zu)",
-+				   SECMARK_SELCTX_MAX-1, strlen(optarg));
-+
-+		strcpy(info->u.sel.selctx, optarg);
-+		*flags |= SECMARK_MODE_SEL;
-+		break;
-+	default:
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+	if (!flags)
-+		exit_error(PARAMETER_PROBLEM, PFX "parameter required");
-+}
-+
-+static void print_secmark(struct xt_secmark_target_info *info)
-+{
-+	switch (info->mode) {
-+	case SECMARK_MODE_SEL:
-+		printf("selctx %s ", info->u.sel.selctx);\
-+		break;
-+	
-+	default:
-+		exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
-+	}
-+}
-+
-+static void print(const struct ip6t_ip6 *ip,
-+		  const struct ip6t_entry_target *target, int numeric)
-+{
-+	struct xt_secmark_target_info *info =
-+		(struct xt_secmark_target_info*)(target)->data;
-+
-+	printf("SECMARK ");
-+	print_secmark(info);
-+}
-+
-+/* Saves the target info in parsable form to stdout. */
-+static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
-+{
-+	struct xt_secmark_target_info *info =
-+		(struct xt_secmark_target_info*)target->data;
-+
-+	printf("--");
-+	print_secmark(info);
-+}
-+
-+static struct ip6tables_target secmark = {
-+	.name		= "SECMARK",
-+	.version	= IPTABLES_VERSION,
-+	.size		= IP6T_ALIGN(sizeof(struct xt_secmark_target_info)),
-+	.userspacesize	= IP6T_ALIGN(sizeof(struct xt_secmark_target_info)),
-+	.help		= &help,
-+	.init		= &init,
-+	.parse		= &parse,
-+	.final_check	= &final_check,
-+	.print		= &print,
-+	.save		= &save,
-+	.extra_opts	= opts
-+};
-+
-+void _init(void)
-+{
-+	register_target6(&secmark);
-+}
-diff -urN iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.man iptables-1.3.5/extensions/libip6t_SECMARK.man
---- iptables-1.3.5.no_secmark/extensions/libip6t_SECMARK.man	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libip6t_SECMARK.man	2006-09-07 15:09:32.000000000 +0200
-@@ -0,0 +1,7 @@
-+This is used to set the security mark value associated with the
-+packet for use by security subsystems such as SELinux.  It is only
-+valid in the
-+.B mangle
-+table.
-+.TP
-+.BI "--selctx " "security_context"
-diff -urN iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.c iptables-1.3.5/extensions/libipt_CONNSECMARK.c
---- iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.c	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libipt_CONNSECMARK.c	2006-09-07 15:09:36.000000000 +0200
-@@ -0,0 +1,126 @@
-+/*
-+ * Shared library add-on to iptables to add CONNSECMARK target support.
-+ *
-+ * Based on the MARK and CONNMARK targets.
-+ *
-+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
-+ */
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <getopt.h>
-+#include <iptables.h>
-+#include <linux/netfilter/xt_CONNSECMARK.h>
-+
-+#define PFX "CONNSECMARK target: "
-+
-+static void help(void)
-+{
-+	printf(
-+"CONNSECMARK target v%s options:\n"
-+"  --save                   Copy security mark from packet to conntrack\n"
-+"  --restore                Copy security mark from connection to packet\n"
-+"\n",
-+IPTABLES_VERSION);
-+}
-+
-+static struct option opts[] = {
-+	{ "save", 0, 0, '1' },
-+	{ "restore", 0, 0, '2' },
-+	{ 0 }
-+};
-+
-+static int parse(int c, char **argv, int invert, unsigned int *flags,
-+                 const struct ipt_entry *entry, struct ipt_entry_target **target)
-+{
-+	struct xt_connsecmark_target_info *info =
-+		(struct xt_connsecmark_target_info*)(*target)->data;
-+
-+	switch (c) {
-+	case '1':
-+		if (*flags & CONNSECMARK_SAVE)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Can't specify --save twice");
-+		info->mode = CONNSECMARK_SAVE;
-+		*flags |= CONNSECMARK_SAVE;
-+		break;
-+
-+	case '2':
-+		if (*flags & CONNSECMARK_RESTORE)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Can't specify --restore twice");
-+		info->mode = CONNSECMARK_RESTORE;
-+		*flags |= CONNSECMARK_RESTORE;
-+		break;
-+
-+	default:
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+	if (!flags)
-+		exit_error(PARAMETER_PROBLEM, PFX "parameter required");
-+
-+	if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE))
-+		exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save "
-+		           "or --restore is allowed");
-+}
-+
-+static void print_connsecmark(struct xt_connsecmark_target_info *info)
-+{
-+	switch (info->mode) {
-+	case CONNSECMARK_SAVE:
-+		printf("save ");
-+		break;
-+		
-+	case CONNSECMARK_RESTORE:
-+		printf("restore ");
-+		break;
-+		
-+	default:
-+		exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
-+	}
-+}
-+
-+static void print(const struct ipt_ip *ip,
-+		  const struct ipt_entry_target *target, int numeric)
-+{
-+	struct xt_connsecmark_target_info *info =
-+		(struct xt_connsecmark_target_info*)(target)->data;
-+
-+	printf("CONNSECMARK ");
-+	print_connsecmark(info);
-+}
-+
-+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
-+{
-+	struct xt_connsecmark_target_info *info =
-+		(struct xt_connsecmark_target_info*)target->data;
-+
-+	printf("--");
-+	print_connsecmark(info);
-+}
-+
-+static struct iptables_target connsecmark = {
-+	.next		= NULL,
-+	.name		= "CONNSECMARK",
-+	.version	= IPTABLES_VERSION,
-+	.revision	= 0,
-+	.size		= IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
-+	.userspacesize	= IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
-+	.parse		= &parse,
-+	.help		= &help,
-+	.final_check	= &final_check,
-+	.print		= &print,
-+	.save		= &save,
-+	.extra_opts	= opts
-+};
-+
-+void _init(void)
-+{
-+	register_target(&connsecmark);
-+}
-diff -urN iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.man iptables-1.3.5/extensions/libipt_CONNSECMARK.man
---- iptables-1.3.5.no_secmark/extensions/libipt_CONNSECMARK.man	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libipt_CONNSECMARK.man	2006-09-07 15:09:36.000000000 +0200
-@@ -0,0 +1,15 @@
-+This module copies security markings from packets to connections
-+(if unlabeled), and from connections back to packets (also only
-+if unlabeled).  Typically used in conjunction with SECMARK, it is
-+only valid in the
-+.B mangle
-+table.
-+.TP
-+.B --save
-+If the packet has a security marking, copy it to the connection
-+if the connection is not marked.
-+.TP
-+.B --restore
-+If the packet does not have a security marking, and the connection
-+does, copy the security marking from the connection to the packet.
-+
-diff -urN iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.c iptables-1.3.5/extensions/libipt_SECMARK.c
---- iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.c	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libipt_SECMARK.c	2006-09-07 15:09:24.000000000 +0200
-@@ -0,0 +1,125 @@
-+/*
-+ * Shared library add-on to iptables to add SECMARK target support.
-+ *
-+ * Based on the MARK target.
-+ *
-+ * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
-+ */
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <getopt.h>
-+#include <iptables.h>
-+#include <linux/netfilter/xt_SECMARK.h>
-+
-+#define PFX "SECMARK target: "
-+
-+static void help(void)
-+{
-+	printf(
-+"SECMARK target v%s options:\n"
-+"  --selctx value                     Set the SELinux security context\n"
-+"\n",
-+IPTABLES_VERSION);
-+}
-+
-+static struct option opts[] = {
-+	{ "selctx", 1, 0, '1' },
-+	{ 0 }
-+};
-+
-+/* Initialize the target. */
-+static void init(struct ipt_entry_target *t, unsigned int *nfcache)
-+{ }
-+
-+/*
-+ * Function which parses command options; returns true if it
-+ * ate an option.
-+ */
-+static int parse(int c, char **argv, int invert, unsigned int *flags,
-+                 const struct ipt_entry *entry, struct ipt_entry_target **target)
-+{
-+	struct xt_secmark_target_info *info =
-+		(struct xt_secmark_target_info*)(*target)->data;
-+
-+	switch (c) {
-+	case '1':
-+		if (*flags & SECMARK_MODE_SEL)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Can't specify --selctx twice");
-+		info->mode = SECMARK_MODE_SEL;
-+
-+		if (strlen(optarg) > SECMARK_SELCTX_MAX-1)
-+			exit_error(PARAMETER_PROBLEM, PFX
-+				   "Maximum length %u exceeded by --selctx"
-+				   " parameter (%zu)",
-+				   SECMARK_SELCTX_MAX-1, strlen(optarg));
-+
-+		strcpy(info->u.sel.selctx, optarg);
-+		*flags |= SECMARK_MODE_SEL;
-+		break;
-+	default:
-+		return 0;
-+	}
-+
-+	return 1;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+	if (!flags)
-+		exit_error(PARAMETER_PROBLEM, PFX "parameter required");
-+}
-+
-+static void print_secmark(struct xt_secmark_target_info *info)
-+{
-+	switch (info->mode) {
-+	case SECMARK_MODE_SEL:
-+		printf("selctx %s ", info->u.sel.selctx);\
-+		break;
-+	
-+	default:
-+		exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
-+	}
-+}
-+
-+static void print(const struct ipt_ip *ip,
-+		  const struct ipt_entry_target *target, int numeric)
-+{
-+	struct xt_secmark_target_info *info =
-+		(struct xt_secmark_target_info*)(target)->data;
-+
-+	printf("SECMARK ");
-+	print_secmark(info);
-+}
-+
-+/* Saves the target info in parsable form to stdout. */
-+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
-+{
-+	struct xt_secmark_target_info *info =
-+		(struct xt_secmark_target_info*)target->data;
-+
-+	printf("--");
-+	print_secmark(info);
-+}
-+
-+static struct iptables_target secmark = {
-+	.next		= NULL,
-+	.name		= "SECMARK",
-+	.version	= IPTABLES_VERSION,
-+	.revision	= 0,
-+	.size		= IPT_ALIGN(sizeof(struct xt_secmark_target_info)),
-+	.userspacesize	= IPT_ALIGN(sizeof(struct xt_secmark_target_info)),
-+	.help		= &help,
-+	.init		= &init,
-+	.parse		= &parse,
-+	.final_check	= &final_check,
-+	.print		= &print,
-+	.save		= &save,
-+	.extra_opts	= opts
-+};
-+
-+void _init(void)
-+{
-+	register_target(&secmark);
-+}
-diff -urN iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.man iptables-1.3.5/extensions/libipt_SECMARK.man
---- iptables-1.3.5.no_secmark/extensions/libipt_SECMARK.man	1970-01-01 01:00:00.000000000 +0100
-+++ iptables-1.3.5/extensions/libipt_SECMARK.man	2006-09-07 15:09:24.000000000 +0200
-@@ -0,0 +1,7 @@
-+This is used to set the security mark value associated with the
-+packet for use by security subsystems such as SELinux.  It is only
-+valid in the
-+.B mangle
-+table.
-+.TP
-+.BI "--selctx " "security_context"
-diff -urN iptables-1.3.5.no_secmark/extensions/Makefile iptables-1.3.5/extensions/Makefile
---- iptables-1.3.5.no_secmark/extensions/Makefile	2006-09-07 14:48:35.000000000 +0200
-+++ iptables-1.3.5/extensions/Makefile	2006-09-07 15:09:40.000000000 +0200
-@@ -8,6 +8,11 @@
- PF_EXT_SLIB:=ah addrtype comment connlimit connmark conntrack dscp ecn esp hashlimit helper icmp iprange length limit mac mark multiport owner physdev pkttype policy realm rpc sctp standard state tcp tcpmss tos ttl udp unclean CLASSIFY CONNMARK DNAT DSCP ECN LOG MARK MASQUERADE MIRROR NETMAP NFQUEUE NOTRACK REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TRACE TTL ULOG
- PF6_EXT_SLIB:=connmark eui64 hl icmpv6 length limit mac mark multiport owner physdev policy standard state tcp udp CONNMARK HL LOG NFQUEUE MARK TRACE
- 
-+ifeq ($(DO_SELINUX), 1)
-+PF_EXT_SE_SLIB:=SECMARK CONNSECMARK
-+PF6_EXT_SE_SLIB:=SECMARK CONNSECMARK
-+endif
-+
- # Optionals
- PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
- PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
-@@ -43,26 +48,34 @@
- 
- ifndef NO_SHARED_LIBS
- SHARED_LIBS+=$(foreach T,$(PF_EXT_SLIB),extensions/libipt_$(T).so)
-+SHARED_SE_LIBS+=$(foreach T,$(PF_EXT_SE_SLIB),extensions/libipt_$(T).so)
- EXTRA_INSTALLS+=$(foreach T, $(PF_EXT_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libipt_$(T).so)
-+EXTRA_INSTALLS+=$(foreach T, $(PF_EXT_SE_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libipt_$(T).so)
- 
- ifeq ($(DO_IPV6), 1)
- SHARED_LIBS+=$(foreach T,$(PF6_EXT_SLIB),extensions/libip6t_$(T).so)
-+SHARED_SE_LIBS+=$(foreach T,$(PF6_EXT_SE_SLIB),extensions/libip6t_$(T).so)
- EXTRA_INSTALLS+=$(foreach T, $(PF6_EXT_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libip6t_$(T).so)
-+EXTRA_INSTALLS+=$(foreach T, $(PF6_EXT_SE_SLIB), $(DESTDIR)$(LIBDIR)/iptables/libip6t_$(T).so)
- endif
- else 	# NO_SHARED_LIBS
- EXT_OBJS+=$(foreach T,$(PF_EXT_SLIB),extensions/libipt_$(T).o)
-+EXT_OBJS+=$(foreach T,$(PF_EXT_SE_SLIB),extensions/libipt_$(T).o)
- EXT_FUNC+=$(foreach T,$(PF_EXT_SLIB),ipt_$(T))
-+EXT_FUNC+=$(foreach T,$(PF_EXT_SE_SLIB),ipt_$(T))
- EXT_OBJS+= extensions/initext.o
- ifeq ($(DO_IPV6), 1)
- EXT6_OBJS+=$(foreach T,$(PF6_EXT_SLIB),extensions/libip6t_$(T).o)
-+EXT6_OBJS+=$(foreach T,$(PF6_EXT_SE_SLIB),extensions/libip6t_$(T).o)
- EXT6_FUNC+=$(foreach T,$(PF6_EXT_SLIB),ip6t_$(T))
-+EXT6_FUNC+=$(foreach T,$(PF6_EXT_SE_SLIB),ip6t_$(T))
- EXT6_OBJS+= extensions/initext6.o
- endif	# DO_IPV6
- endif	# NO_SHARED_LIBS
- 
- ifndef TOPLEVEL_INCLUDED
- local:
--	cd .. && $(MAKE) $(SHARED_LIBS)
-+	cd .. && $(MAKE) $(SHARED_LIBS) $(SHARED_SE_LIBS)
- endif
- 
- ifdef NO_SHARED_LIBS
-diff -urN iptables-1.3.5.no_secmark/Makefile iptables-1.3.5/Makefile
---- iptables-1.3.5.no_secmark/Makefile	2006-09-07 14:48:34.000000000 +0200
-+++ iptables-1.3.5/Makefile	2006-09-07 15:08:41.000000000 +0200
-@@ -31,6 +31,11 @@
- DO_IPV6:=1
- endif
- 
-+# Enable linking to libselinux via enviornment 'DO_SELINUX=1'
-+ifndef DO_SELINUX
-+DO_SELINUX=0
-+endif
-+
- COPT_FLAGS:=-O2
- CFLAGS:=$(COPT_FLAGS) -Wall -Wunused -I$(KERNEL_DIR)/include -Iinclude/ -DIPTABLES_VERSION=\"$(IPTABLES_VERSION)\" #-g -DDEBUG #-pg # -DIPTC_DEBUG
- 
-@@ -93,17 +98,24 @@
- 
- ifndef NO_SHARED_LIBS
- DEPFILES = $(SHARED_LIBS:%.so=%.d)
-+DEPFILES += $(SHARED_SE_LIBS:%.so=%.d)
- SH_CFLAGS:=$(CFLAGS) -fPIC
- STATIC_LIBS  =
- STATIC6_LIBS =
- LDFLAGS      = -rdynamic
- LDLIBS       = -ldl
-+ifeq ($(DO_SELINUX), 1)
-+LDLIBS       += -lselinux
-+endif
- else
- DEPFILES = $(EXT_OBJS:%.o=%.d)
- STATIC_LIBS  = extensions/libext.a
- STATIC6_LIBS = extensions/libext6.a
- LDFLAGS      = -static
- LDLIBS       =
-+ifeq ($(DO_SELINUX), 1)
-+LDLIBS       += -lselinux
-+endif
- endif
- 
- .PHONY: default
-diff -urN iptables-1.3.5.no_secmark/Rules.make iptables-1.3.5/Rules.make
---- iptables-1.3.5.no_secmark/Rules.make	2006-09-07 14:48:36.000000000 +0200
-+++ iptables-1.3.5/Rules.make	2006-09-07 15:08:04.000000000 +0200
-@@ -1,12 +1,12 @@
- #! /usr/bin/make
- 
--all: $(SHARED_LIBS) $(EXTRAS)
-+all: $(SHARED_LIBS) $(SHARED_SE_LIBS) $(EXTRAS)
- 
- experimental: $(EXTRAS_EXP)
- 
- # Have to handle extensions which no longer exist.
- clean: $(EXTRA_CLEANS)
--	rm -f $(SHARED_LIBS) $(EXTRAS) $(EXTRAS_EXP) $(SHARED_LIBS:%.so=%_sh.o)
-+	rm -f $(SHARED_LIBS) $(SHARED_SE_LIBS) $(EXTRAS) $(EXTRAS_EXP) $(SHARED_LIBS:%.so=%_sh.o) $(SHARED_SE_LIBS:%.so=%_sh.o)
- 	rm -f extensions/initext.c extensions/initext6.c
- 	@find . -name '*.[ao]' -o -name '*.so' | xargs rm -f
- 
-@@ -33,6 +33,13 @@
- $(SHARED_LIBS): %.so : %_sh.o
- 	$(CC) -shared $(EXT_LDFLAGS) -o $@ $<
- 
-+$(SHARED_SE_LIBS:%.so=%.d): %.d: %.c
-+	@-$(CC) -M -MG $(CFLAGS) $< | \
-+	    sed -e 's@^.*\.o:@$*.d $*_sh.o:@' > $@
-+
-+$(SHARED_SE_LIBS): %.so : %_sh.o
-+	$(LD) -shared $(EXT_LDFLAGS) -o $@ $< $(LDLIBS)
-+
- %_sh.o : %.c
- 	$(CC) $(SH_CFLAGS) -o $@ -c $<
- 
diff --git a/iptables-1.3.7-nolibnsl.patch b/iptables-1.3.7-nolibnsl.patch
deleted file mode 100644
index 5940458..0000000
--- a/iptables-1.3.7-nolibnsl.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- iptables-1.3.7/Makefile.nolibnsl	2006-12-04 12:16:01.000000000 +0100
-+++ iptables-1.3.7/Makefile	2007-01-09 19:34:28.000000000 +0100
-@@ -103,7 +103,7 @@
- STATIC_LIBS  =
- STATIC6_LIBS =
- LDFLAGS      = -rdynamic
--LDLIBS       = -ldl -lnsl
-+LDLIBS       = -ldl
- ifeq ($(DO_SELINUX), 1)
- LDLIBS       += -lselinux
- endif
diff --git a/iptables.spec b/iptables.spec
index 0ccb17b..3003782 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -2,18 +2,11 @@
 
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities.
-Version: 1.3.7
-Release: 2
+Version: 1.3.8
+Release: 1
 Source: http://www.netfilter.org/%{name}-%{version}.tar.bz2
 Source1: iptables.init
 Source2: iptables-config
-Patch2: iptables-1.3.7-nolibnsl.patch
-Patch4: iptables-1.2.9-netlink.patch
-Patch5: iptables-1.3.0-selinux.patch
-Patch6: iptables-1.2.10-counters.patch
-Patch8: iptables-1.3.0-cleanup.patch
-Patch9: iptables-1.3.0-autoload.patch
-Patch10: iptables-1.3.0-no_root.patch
 Group: System Environment/Base
 URL: http://www.netfilter.org/
 BuildRoot: %{_tmppath}/%{name}-buildroot
@@ -61,13 +54,6 @@ you should install this package.
 rm -rf %{buildroot}
 
 %setup -q
-%patch2 -p1 -b .nolibnsl
-%patch4 -p1 -b .netlink
-%patch5 -p1 -b .selinux
-%patch6 -p1 -b .counters
-%patch8 -p1 -b .cleanup
-%patch9 -p1 -b .autoload
-%patch10 -p1 -b .no_root
 
 # Put it to a reasonable place
 find . -type f -exec perl -pi -e "s,/usr/local,%{prefix},g" {} \;
@@ -153,6 +139,9 @@ fi
 %endif
 
 %changelog
+* Fri Jul 13 2007 Steve Conklin <sconklin@redhat.com> - 1.3.8-1
+- New version 1.3.8
+
 * Mon Apr 23 2007 Jeremy Katz <katzj@redhat.com> - 1.3.7-2
 - fix error when ipv6 support isn't loaded in the kernel (#236888)
 
diff --git a/sources b/sources
index 3af7690..5c3c67d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-dd965bdacbb86ce2a6498829fddda6b7  iptables-1.3.7.tar.bz2
+0a9209f928002e5eee9cdff8fef4d4b3  iptables-1.3.8.tar.bz2