3 # - update BR to real required llh version
4 # - check if kernel-headers are still required to properly build iptabels for dist kernel
5 # - fix makefile (-D_UNKNOWN_KERNEL_POINTER_SIZE issue)
6 # - owner needs rewrite to xt
9 %bcond_without doc # without documentation (HOWTOS) which needed TeX
10 %bcond_without dist_kernel # without distribution kernel
11 %bcond_with vserver # build xt_owner module for non-dist kernel with vserver support
12 %bcond_with batch # build iptables-batch
13 %bcond_with static # build static libraries, no dynamic modules (all linked into binaries)
14 %bcond_with ipt_IPV4OPTSSTRIP # enable ipt_IPV4OPTSSTRIP for non-dist kernel
15 %bcond_with ipt_rpc # enable ipt_rpc for non-dist kernel
16 %bcond_with xt_layer7 # enable xt_layer7 for non-dist kernel
17 %bcond_with usekernelsrc # include kernel headers from %{_kernelsrcdir}
19 %if %{with dist_kernel}
20 %define with_ipt_IPV4OPTSSTRIP 1
21 %define with_ipt_rpc 1
22 %define with_xt_layer7 1
23 %define with_vserver 1
24 %define with_usekernelsrc 1
27 %define name6 ip6tables
28 Summary: Extensible packet filtering system && extensible NAT system
29 Summary(pl.UTF-8): System filtrowania pakietów oraz system translacji adresów (NAT)
30 Summary(pt_BR.UTF-8): Ferramenta para controlar a filtragem de pacotes no kernel-2.6.x
31 Summary(ru.UTF-8): Утилиты для управления пакетными фильтрами ядра Linux
32 Summary(uk.UTF-8): Утиліти для керування пакетними фільтрами ядра Linux
33 Summary(zh_CN.UTF-8): Linux内核包过滤管理工具
38 Group: Networking/Admin
39 Source0: ftp://ftp.netfilter.org/pub/iptables/%{name}-%{version}.tar.bz2
40 # Source0-md5: 40a15608ec57b50e9377cace546dd115
41 Source1: cvs://cvs.samba.org/netfilter/%{name}-howtos.tar.bz2
42 # Source1-md5: 2ed2b452daefe70ededd75dc0061fd07
44 Source3: %{name6}.init
45 Source4: %{name}.upstart
46 Source5: %{name6}.upstart
47 Source6: %{name}-config
48 Source7: %{name6}-config
49 Source8: %{name}.service
50 Source9: %{name6}.service
51 # --- GENERAL CHANGES (patches<10):
52 Patch0: %{name}-man.patch
53 # additional utils; off by default
54 Patch1: %{name}-batch.patch
55 Patch2: no-libiptc.patch
56 Patch3: %{name}-aligned_u64.patch
57 # --- ADDITIONAL/CHANGED EXTENSIONS:
58 # just ipt_IPV4OPTSSTRIP now
59 Patch10: %{name}-20070806.patch
60 # xt_layer7; almost based on iptables-1.4-for-kernel-2.6.20forward-layer7-2.18.patch
61 # http://downloads.sourceforge.net/l7-filter/netfilter-layer7-v2.18.tar.gz
62 Patch11: %{name}-layer7.patch
64 Patch12: %{name}-old-1.3.7.patch
65 # xt_IMQ; http://linuximq.net/patchs/iptables-1.4.12-IMQ-test4.diff
66 Patch13: %{name}-imq.patch
67 # enhances ipt_owner/ip6t_owner; http://people.linux-vserver.org/~dhozac/p/m/iptables-1.3.5-owner-xid.patch (currently disabled, needs update for xt_owner)
68 Patch14: %{name}-1.3.5-owner-xid.patch
69 # adjusts xt_owner for vserver-enabled kernel
70 Patch15: %{name}-owner-struct-size-vs.patch
71 # ipt_stealth; currently disabled (broken, see below)
72 Patch16: %{name}-stealth.patch
73 URL: http://www.netfilter.org/
74 BuildRequires: autoconf >= 2.50
75 BuildRequires: automake
77 BuildRequires: libnfnetlink-devel >= 1.0
78 BuildRequires: libtool
79 BuildRequires: pkgconfig >= 1:0.9.0
80 BuildRequires: rpmbuild(macros) >= 1.647
82 BuildRequires: sed >= 4.0
83 BuildRequires: sgml-tools
85 BuildRequires: tetex-dvips
86 BuildRequires: tetex-format-latex
87 BuildRequires: tetex-latex
88 BuildRequires: tetex-tex-babel
89 BuildRequires: texlive-fonts-cmsuper
90 BuildRequires: texlive-fonts-jknappen
92 %if %{with dist_kernel}
93 BuildRequires: kernel%{_alt_kernel}-headers(netfilter)
95 BuildRequires: linux-libc-headers >= 7:2.6.22.1
96 Requires: %{name}-libs = %{version}-%{release}
97 Requires: libnfnetlink >= 1.0
98 Provides: firewall-userspace-tool
100 Obsoletes: iptables24-compat
102 Conflicts: xtables-addons < 1.25
103 BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
106 An extensible NAT system, and an extensible packet filtering system.
107 Replacement of ipchains in 2.4 and higher kernels.
109 %description -l pl.UTF-8
110 Wydajny system translacji adresów (NAT) oraz system filtrowania
111 pakietów. Zamiennik ipchains w jądrach 2.4 i nowszych.
113 %description -l pt_BR.UTF-8
114 Esta é a ferramenta que controla o código de filtragem de pacotes do
115 kernel 2.4, obsoletando ipchains. Com esta ferramenta você pode
116 configurar filtros de pacotes, NAT, mascaramento (masquerading),
117 regras dinâmicas (stateful inspection), etc.
119 %description -l ru.UTF-8
120 iptables управляют кодом фильтрации сетевых пакетов в ядре Linux. Они
121 позволяют вам устанавливать межсетевые экраны (firewalls) и IP
124 %description -l uk.UTF-8
125 iptables управляють кодом фільтрації пакетів мережі в ядрі Linux. Вони
126 дозволяють вам встановлювати міжмережеві екрани (firewalls) та IP
130 Summary: iptables libraries
131 Summary(pl.UTF-8): Biblioteki iptables
133 Conflicts: iptables < 1.4.3-1
138 %description libs -l pl.UTF-8
142 Summary: Libraries and headers for developing iptables extensions
143 Summary(pl.UTF-8): Biblioteki i nagłówki do tworzenia rozszerzeń iptables
144 Group: Development/Libraries
145 Requires: %{name}-libs = %{epoch}:%{version}-%{release}
146 Obsoletes: iptables24-devel
149 Libraries and headers for developing iptables extensions.
151 %description devel -l pl.UTF-8
152 Biblioteki i pliki nagłówkowe niezbędne do tworzenia rozszerzeń dla
156 Summary: Static iptables libraries
157 Summary(pl.UTF-8): Biblioteki statyczne iptables
158 Group: Development/Libraries
159 Requires: %{name}-devel = %{epoch}:%{version}-%{release}
162 Static iptables libraries.
164 %description static -l pl.UTF-8
165 Biblioteki statyczne iptables.
168 Summary: Iptables init (RedHat style)
169 Summary(pl.UTF-8): Iptables init (w stylu RedHata)
170 Group: Networking/Admin
171 Requires(post,preun): /sbin/chkconfig
172 Requires(post,preun,postun): systemd-units >= 38
174 Requires: rc-scripts >= 0.4.3.0
175 Requires: systemd-units >= 38
176 Obsoletes: firewall-init
177 Obsoletes: firewall-init-ipchains
178 Obsoletes: iptables24-init
181 Iptables-init is meant to provide an alternate way than firewall-init
182 to start and stop packet filtering through iptables(8).
184 %description init -l pl.UTF-8
185 Iptables-init ma na celu udostępnienie alternatywnego w stosunku do
186 firewall-init sposobu włączania i wyłączania filtrów IP jądra poprzez
198 %{?with_ipt_IPV4OPTSSTRIP:%patch10 -p1}
199 %{?with_xt_layer7:%patch11 -p1}
200 %{?with_ipt_rpc:%patch12 -p1}
206 # builds but init() api is broken, see warnings
216 CFLAGS="%{rpmcflags} %{rpmcppflags} -D%{!?debug:N}DEBUG" \
217 %{?with_usekernelsrc:--with-kernel=%{_kernelsrcdir}} \
219 %{?with_static:--enable-static}
225 %{__make} -j1 -C iptables-howtos
226 sed -i 's:$(HTML_HOWTOS)::g; s:$(PSUS_HOWTOS)::g' iptables-howtos/Makefile
230 rm -rf $RPM_BUILD_ROOT
231 install -d $RPM_BUILD_ROOT/etc/{rc.d/init.d,sysconfig} \
232 $RPM_BUILD_ROOT{%{_includedir},%{_libdir},%{_mandir}/man3} \
233 $RPM_BUILD_ROOT%{systemdunitdir}
236 DESTDIR=$RPM_BUILD_ROOT \
241 install -p %{SOURCE2} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name}
242 install -p %{SOURCE3} $RPM_BUILD_ROOT/etc/rc.d/init.d/%{name6}
243 install -d $RPM_BUILD_ROOT/etc/init
244 cp -p %{SOURCE4} $RPM_BUILD_ROOT/etc/init/%{name}.conf
245 cp -p %{SOURCE5} $RPM_BUILD_ROOT/etc/init/%{name6}.conf
247 install -p %{SOURCE6} $RPM_BUILD_ROOT/etc/sysconfig/%{name}-config
248 install -p %{SOURCE7} $RPM_BUILD_ROOT/etc/sysconfig/%{name6}-config
250 install -p %{SOURCE8} $RPM_BUILD_ROOT%{systemdunitdir}/%{name}.service
251 install -p %{SOURCE9} $RPM_BUILD_ROOT%{systemdunitdir}/%{name6}.service
254 rm -rf $RPM_BUILD_ROOT
256 %post libs -p /sbin/ldconfig
257 %postun libs -p /sbin/ldconfig
260 /sbin/chkconfig --add %{name}
261 /sbin/chkconfig --add %{name6}
262 %systemd_post %{name}.service %{name6}.service
265 if [ "$1" = "0" ]; then
266 /sbin/chkconfig --del %{name}
267 /sbin/chkconfig --del %{name6}
269 %systemd_preun %{name}.service %{name6}.service
274 %triggerpostun init -- %{name}-init < 1.4.13-2
275 %systemd_trigger %{name}.service %{name6}.service
278 %defattr(644,root,root,755)
279 %{?with_doc:%doc iptables-howtos/{NAT,networking-concepts,packet-filtering}-HOWTO*}
280 %attr(755,root,root) %{_bindir}/iptables-xml
281 %attr(755,root,root) %{_sbindir}/iptables
282 %attr(755,root,root) %{_sbindir}/iptables-restore
283 %attr(755,root,root) %{_sbindir}/iptables-save
284 %attr(755,root,root) %{_sbindir}/ip6tables
285 %attr(755,root,root) %{_sbindir}/ip6tables-restore
286 %attr(755,root,root) %{_sbindir}/ip6tables-save
288 %attr(755,root,root) %{_sbindir}/iptables-batch
289 %attr(755,root,root) %{_sbindir}/ip6tables-batch
291 %attr(755,root,root) %{_sbindir}/nfnl_osf
292 %attr(755,root,root) %{_sbindir}/xtables-multi
294 %dir %{_libdir}/xtables
295 %attr(755,root,root) %{_libdir}/xtables/libip6t_HL.so
296 %attr(755,root,root) %{_libdir}/xtables/libip6t_LOG.so
297 %attr(755,root,root) %{_libdir}/xtables/libip6t_REJECT.so
298 %attr(755,root,root) %{_libdir}/xtables/libip6t_ah.so
299 %attr(755,root,root) %{_libdir}/xtables/libip6t_dst.so
300 %attr(755,root,root) %{_libdir}/xtables/libip6t_eui64.so
301 %attr(755,root,root) %{_libdir}/xtables/libip6t_frag.so
302 %attr(755,root,root) %{_libdir}/xtables/libip6t_hbh.so
303 %attr(755,root,root) %{_libdir}/xtables/libip6t_hl.so
304 %attr(755,root,root) %{_libdir}/xtables/libip6t_icmp6.so
305 %attr(755,root,root) %{_libdir}/xtables/libip6t_ipv6header.so
306 %attr(755,root,root) %{_libdir}/xtables/libip6t_mh.so
307 %attr(755,root,root) %{_libdir}/xtables/libip6t_rt.so
308 %attr(755,root,root) %{_libdir}/xtables/libipt_CLUSTERIP.so
309 %attr(755,root,root) %{_libdir}/xtables/libipt_DNAT.so
310 %attr(755,root,root) %{_libdir}/xtables/libipt_ECN.so
311 %attr(755,root,root) %{_libdir}/xtables/libipt_LOG.so
312 %attr(755,root,root) %{_libdir}/xtables/libipt_MASQUERADE.so
313 %attr(755,root,root) %{_libdir}/xtables/libipt_MIRROR.so
314 %attr(755,root,root) %{_libdir}/xtables/libipt_NETMAP.so
315 %attr(755,root,root) %{_libdir}/xtables/libipt_REDIRECT.so
316 %attr(755,root,root) %{_libdir}/xtables/libipt_REJECT.so
317 %attr(755,root,root) %{_libdir}/xtables/libipt_SAME.so
318 %attr(755,root,root) %{_libdir}/xtables/libipt_SNAT.so
319 %attr(755,root,root) %{_libdir}/xtables/libipt_TTL.so
320 %attr(755,root,root) %{_libdir}/xtables/libipt_ULOG.so
321 %attr(755,root,root) %{_libdir}/xtables/libipt_ah.so
322 %attr(755,root,root) %{_libdir}/xtables/libipt_icmp.so
323 %attr(755,root,root) %{_libdir}/xtables/libipt_realm.so
324 # disabled, see above
325 #%attr(755,root,root) %{_libdir}/xtables/libipt_stealth.so
326 %attr(755,root,root) %{_libdir}/xtables/libipt_ttl.so
327 %attr(755,root,root) %{_libdir}/xtables/libipt_unclean.so
328 %attr(755,root,root) %{_libdir}/xtables/libxt_AUDIT.so
329 %attr(755,root,root) %{_libdir}/xtables/libxt_CHECKSUM.so
330 %attr(755,root,root) %{_libdir}/xtables/libxt_CLASSIFY.so
331 %attr(755,root,root) %{_libdir}/xtables/libxt_CONNMARK.so
332 %attr(755,root,root) %{_libdir}/xtables/libxt_CONNSECMARK.so
333 %attr(755,root,root) %{_libdir}/xtables/libxt_CT.so
334 %attr(755,root,root) %{_libdir}/xtables/libxt_DSCP.so
335 %attr(755,root,root) %{_libdir}/xtables/libxt_IDLETIMER.so
336 %attr(755,root,root) %{_libdir}/xtables/libxt_IMQ.so
337 %attr(755,root,root) %{_libdir}/xtables/libxt_LED.so
338 %attr(755,root,root) %{_libdir}/xtables/libxt_MARK.so
339 %attr(755,root,root) %{_libdir}/xtables/libxt_NFLOG.so
340 %attr(755,root,root) %{_libdir}/xtables/libxt_NFQUEUE.so
341 %attr(755,root,root) %{_libdir}/xtables/libxt_NOTRACK.so
342 %attr(755,root,root) %{_libdir}/xtables/libxt_RATEEST.so
343 %attr(755,root,root) %{_libdir}/xtables/libxt_SECMARK.so
344 %attr(755,root,root) %{_libdir}/xtables/libxt_SET.so
345 %attr(755,root,root) %{_libdir}/xtables/libxt_TCPMSS.so
346 %attr(755,root,root) %{_libdir}/xtables/libxt_TCPOPTSTRIP.so
347 %attr(755,root,root) %{_libdir}/xtables/libxt_TEE.so
348 %attr(755,root,root) %{_libdir}/xtables/libxt_TOS.so
349 %attr(755,root,root) %{_libdir}/xtables/libxt_TPROXY.so
350 %attr(755,root,root) %{_libdir}/xtables/libxt_TRACE.so
351 %attr(755,root,root) %{_libdir}/xtables/libxt_addrtype.so
352 %attr(755,root,root) %{_libdir}/xtables/libxt_cluster.so
353 %attr(755,root,root) %{_libdir}/xtables/libxt_comment.so
354 %attr(755,root,root) %{_libdir}/xtables/libxt_connbytes.so
355 %attr(755,root,root) %{_libdir}/xtables/libxt_connlimit.so
356 %attr(755,root,root) %{_libdir}/xtables/libxt_connmark.so
357 %attr(755,root,root) %{_libdir}/xtables/libxt_conntrack.so
358 %attr(755,root,root) %{_libdir}/xtables/libxt_cpu.so
359 %attr(755,root,root) %{_libdir}/xtables/libxt_dccp.so
360 %attr(755,root,root) %{_libdir}/xtables/libxt_devgroup.so
361 %attr(755,root,root) %{_libdir}/xtables/libxt_dscp.so
362 %attr(755,root,root) %{_libdir}/xtables/libxt_ecn.so
363 %attr(755,root,root) %{_libdir}/xtables/libxt_esp.so
364 %attr(755,root,root) %{_libdir}/xtables/libxt_hashlimit.so
365 %attr(755,root,root) %{_libdir}/xtables/libxt_helper.so
366 %attr(755,root,root) %{_libdir}/xtables/libxt_iprange.so
367 %attr(755,root,root) %{_libdir}/xtables/libxt_ipvs.so
368 %attr(755,root,root) %{_libdir}/xtables/libxt_length.so
369 %attr(755,root,root) %{_libdir}/xtables/libxt_limit.so
370 %attr(755,root,root) %{_libdir}/xtables/libxt_mac.so
371 %attr(755,root,root) %{_libdir}/xtables/libxt_mark.so
372 %attr(755,root,root) %{_libdir}/xtables/libxt_multiport.so
373 %attr(755,root,root) %{_libdir}/xtables/libxt_nfacct.so
374 %attr(755,root,root) %{_libdir}/xtables/libxt_osf.so
375 %attr(755,root,root) %{_libdir}/xtables/libxt_owner.so
376 %attr(755,root,root) %{_libdir}/xtables/libxt_physdev.so
377 %attr(755,root,root) %{_libdir}/xtables/libxt_pkttype.so
378 %attr(755,root,root) %{_libdir}/xtables/libxt_policy.so
379 %attr(755,root,root) %{_libdir}/xtables/libxt_quota.so
380 %attr(755,root,root) %{_libdir}/xtables/libxt_rateest.so
381 %attr(755,root,root) %{_libdir}/xtables/libxt_recent.so
382 %attr(755,root,root) %{_libdir}/xtables/libxt_rpfilter.so
383 %attr(755,root,root) %{_libdir}/xtables/libxt_sctp.so
384 %attr(755,root,root) %{_libdir}/xtables/libxt_set.so
385 %attr(755,root,root) %{_libdir}/xtables/libxt_socket.so
386 %attr(755,root,root) %{_libdir}/xtables/libxt_standard.so
387 %attr(755,root,root) %{_libdir}/xtables/libxt_state.so
388 %attr(755,root,root) %{_libdir}/xtables/libxt_statistic.so
389 %attr(755,root,root) %{_libdir}/xtables/libxt_string.so
390 %attr(755,root,root) %{_libdir}/xtables/libxt_tcp.so
391 %attr(755,root,root) %{_libdir}/xtables/libxt_tcpmss.so
392 %attr(755,root,root) %{_libdir}/xtables/libxt_time.so
393 %attr(755,root,root) %{_libdir}/xtables/libxt_tos.so
394 %attr(755,root,root) %{_libdir}/xtables/libxt_u32.so
395 %attr(755,root,root) %{_libdir}/xtables/libxt_udp.so
396 %{?with_ipt_IPV4OPTSSTRIP:%attr(755,root,root) %{_libdir}/xtables/libipt_IPV4OPTSSTRIP.so}
397 %{?with_ipt_rpc:%attr(755,root,root) %{_libdir}/xtables/libipt_rpc.so}
398 %{?with_xt_layer7:%attr(755,root,root) %{_libdir}/xtables/libxt_layer7.so}
399 %{_mandir}/man1/iptables-xml.1*
400 %{_mandir}/man8/ip6tables.8*
401 %{_mandir}/man8/ip6tables-restore.8*
402 %{_mandir}/man8/ip6tables-save.8*
403 %{_mandir}/man8/iptables.8*
404 %{_mandir}/man8/iptables-restore.8*
405 %{_mandir}/man8/iptables-save.8*
408 %defattr(644,root,root,755)
409 %attr(755,root,root) %{_libdir}/libip4tc.so.*.*.*
410 %attr(755,root,root) %ghost %{_libdir}/libip4tc.so.0
411 %attr(755,root,root) %{_libdir}/libip6tc.so.*.*.*
412 %attr(755,root,root) %ghost %{_libdir}/libip6tc.so.0
413 %attr(755,root,root) %{_libdir}/libipq.so.*.*.*
414 %attr(755,root,root) %ghost %{_libdir}/libipq.so.0
415 %attr(755,root,root) %{_libdir}/libxtables.so.*.*.*
416 %attr(755,root,root) %ghost %{_libdir}/libxtables.so.7
419 %defattr(644,root,root,755)
420 %{?with_doc:%doc iptables-howtos/netfilter-hacking-HOWTO*}
421 %attr(755,root,root) %{_libdir}/libip4tc.so
422 %attr(755,root,root) %{_libdir}/libip6tc.so
423 %attr(755,root,root) %{_libdir}/libipq.so
424 %attr(755,root,root) %{_libdir}/libxtables.so
425 %{_libdir}/libip4tc.la
426 %{_libdir}/libip6tc.la
428 %{_libdir}/libxtables.la
429 %{_includedir}/libipq.h
430 %{_includedir}/xtables.h
431 %{_includedir}/libiptc
432 %{_pkgconfigdir}/libip4tc.pc
433 %{_pkgconfigdir}/libip6tc.pc
434 %{_pkgconfigdir}/libipq.pc
435 %{_pkgconfigdir}/libiptc.pc
436 %{_pkgconfigdir}/xtables.pc
437 %{_mandir}/man3/ipq_*.3*
438 %{_mandir}/man3/libipq.3*
442 %defattr(644,root,root,755)
443 %{_libdir}/libip4tc.a
444 %{_libdir}/libip6tc.a
446 %{_libdir}/libxtables.a
450 %defattr(644,root,root,755)
451 %config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/%{name}-config
452 %config(noreplace) %verify(not md5 mtime size) /etc/sysconfig/%{name6}-config
453 %attr(754,root,root) /etc/rc.d/init.d/iptables
454 %attr(754,root,root) /etc/rc.d/init.d/ip6tables
455 %config(noreplace) %verify(not md5 mtime size) /etc/init/%{name}.conf
456 %config(noreplace) %verify(not md5 mtime size) /etc/init/%{name6}.conf
457 %{systemdunitdir}/%{name}.service
458 %{systemdunitdir}/%{name6}.service