diff --git a/iptables-1.4.11-cloexec.patch b/iptables-1.4.11-cloexec.patch
new file mode 100644
index 0000000..f791e6d
--- /dev/null
+++ b/iptables-1.4.11-cloexec.patch
@@ -0,0 +1,50 @@
+diff -up iptables-1.4.11/extensions/libxt_set.h.cloexec iptables-1.4.11/extensions/libxt_set.h
+--- iptables-1.4.11/extensions/libxt_set.h.cloexec	2011-05-26 18:12:12.000000000 +0200
++++ iptables-1.4.11/extensions/libxt_set.h	2011-06-07 16:39:04.308403784 +0200
+@@ -2,6 +2,7 @@
+ #define _LIBXT_SET_H
+ 
+ #include <unistd.h>
++#include <fcntl.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <errno.h>
+@@ -23,6 +24,12 @@ get_version(unsigned *version)
+ 		xtables_error(OTHER_PROBLEM,
+ 			      "Can't open socket to ipset.\n");
+ 
++	if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
++		xtables_error(OTHER_PROBLEM,
++			      "Could not set close on exec: %s\n",
++			      strerror(errno));
++	}
++
+ 	req_version.op = IP_SET_OP_VERSION;
+ 	res = getsockopt(sockfd, SOL_IP, SO_IP_SET, &req_version, &size);
+ 	if (res != 0)
+diff -up iptables-1.4.11/libiptc/libiptc.c.cloexec iptables-1.4.11/libiptc/libiptc.c
+--- iptables-1.4.11/libiptc/libiptc.c.cloexec	2011-05-26 18:12:12.000000000 +0200
++++ iptables-1.4.11/libiptc/libiptc.c	2011-06-07 16:43:15.283421508 +0200
+@@ -29,6 +29,8 @@
+  * 	- performance work: speedup initial ruleset parsing.
+  * 	- sponsored by ComX Networks A/S (http://www.comx.dk/)
+  */
++#include <unistd.h>
++#include <fcntl.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <stdbool.h>
+@@ -1329,6 +1331,12 @@ TC_INIT(const char *tablename)
+ 	if (sockfd < 0)
+ 		return NULL;
+ 
++	if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) {
++		fprintf(stderr, "Could not set close on exec: %s\n",
++			strerror(errno));
++		abort();
++	}
++
+ retry:
+ 	s = sizeof(info);
+ 
+diff -up iptables-1.4.11/xtables.c.cloexec iptables-1.4.11/xtables.c
diff --git a/iptables.spec b/iptables.spec
index ae2dd8f..f8b8898 100644
--- a/iptables.spec
+++ b/iptables.spec
@@ -1,11 +1,11 @@
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
-Version: 1.4.10
-Release: 2%{?dist}
+Version: 1.4.11.1
+Release: 1%{?dist}
 Source: http://www.netfilter.org/projects/iptables/files/%{name}-%{version}.tar.bz2
 Source1: iptables.init
 Source2: iptables-config
-Patch5: iptables-1.4.10-cloexec.patch
+Patch5: iptables-1.4.11-cloexec.patch
 Group: System Environment/Base
 URL: http://www.netfilter.org/
 BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
@@ -126,7 +126,9 @@ fi
 %attr(0755,root,root) /etc/rc.d/init.d/iptables
 %config(noreplace) %attr(0600,root,root) /etc/sysconfig/iptables-config
 /sbin/iptables*
+/sbin/xtables-multi
 /bin/iptables-xml
+%{_mandir}/man1/iptables-xml*
 %{_mandir}/man8/iptables*
 %dir /%{_lib}/xtables
 /%{_lib}/xtables/libipt*
@@ -163,6 +165,15 @@ fi
 %{_libdir}/pkgconfig/xtables.pc
 
 %changelog
+* Mon Jul 11 2011 Thomas Woerner <twoerner@redhat.com> 1.4.11.1-1
+- new version 1.4.11.1, bug and doc fix release for 1.4.11
+
+* Tue Jun  7 2011 Thomas Woerner <twoerner@redhat.com> 1.4.11-1
+- new version 1.4.11 with all new features of 2.6.37-39 (not usable)
+  - lots of changes and bugfixes for base and extensions
+  - complete changelog:
+    http://www.netfilter.org/projects/iptables/files/changes-iptables-1.4.11.txt
+
 * Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.10-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild