Merge lp:~ari-tczew/ubuntu/saucy/iptables/lp-1228525-1134554-1187177 into lp:ubuntu/saucy/iptables

[Artur Rona]

[Daniel Holbach (dholbach)]

Thanks for your work on this.

It seems you're not mentioning the Ubuntu changes from the last merge. Were they all dropped? Are they still relevant?

+ - debian/control: add linuxdoc-tools dep, remove libipq references
+ - debian/rules: compile with --disable-libipq
+ - 9000-howtos.patch: add howtos/ and install them
+ - 9002-libxt_recent-Add-support-for-reap-option.patch: Some changes are
+ upstream, patch needed for additional reap option checks.
+ - debian/iptables.install: install NAT and packetfilter howtos into
+ /usr/share/doc
+ - debian/iptables-dev.doc-base.netfilter-extensions,
+ debian/iptables-dev.doc-base.netfilter-hacking,
+ debian/iptables.doc-base.nat, debian/iptables.doc-base.packet-filter:
+ add howtos
+ - debian/iptables-dev.install: remove usr/share/man/man3 only used with
+ libipq manpages

review: Needs Information

[Artur Rona (ari-tczew)]

Well, Ubuntu delta since last merge is unchanged. These changes have been not dropped and they still remain. I didn't mention them, because it's not standard merge from Debian, when the latest revision will be merged. Else it's 'fake merge' - Debian's revision from snapshot/archive has been merged due to fix FTBFS in another package (perlipq). In this case, the 2 lines (in debian/{control;iptables-dev.install}) have been changed. Then I've added following changes to fix next 2 bugs.
Also, we're coming to the question: what's more worth? Again copying long d/changelog description about remaining changes only for 2 above mentioned changes lines or just describe that it's non-standard merge? In the next development cycle we can do normal merge iptables from Debian unstable including mentioned remaining changes in d/changelog.

Sorry for misunderstanding, but I'm preparing such as 'fake/non-standard' merge first time. I'm not sure whether there is a documentation for.

BTW, The whole changes can be dropped while merging current iptables from Debian unstable.

review: Needs Resubmitting

Unmerged revisions

39. By Artur Rona on 2013-09-21

* Merge changes from Debian, version 1.4.18-1.1 to fix FTBFS
  in package perlipq due to missing dependecy: (LP: #1228525)
  - debian/control
  - debian/iptables-dev.install
* Fix unresolved @PACKAGE_VERSION@ in manpage. Cherry-pick from
  Debian, version 1.4.20-2: (LP: #1134554)
  - debian/iptables.install
  - debian/iptables.manpages
  - debian/nfnl_osf.8
  - 0201-iptables-xml_man_section.patch
* Fix incorrectly calling setsockopt, cherry-pick: (LP: #1187177)
  - debian/patches/calling-setsockopt-incorrectly.patch
[ gregor herrmann ]
* Fix "libipq.h includes non-existing linux/netfilter_ipv4/ip_queue.h":
  ship /usr/include/linux/netfilter_ipv4/ip_queue.h in iptables-dev;
  add Breaks on linux-libc-dev << 3.5
  (Closes: #707535)
[ Dominic Hargreaves ]
* Non-maintainer upload

=== modified file 'debian/changelog'
--- debian/changelog	2013-06-07 09:50:09 +0000
+++ debian/changelog	2013-09-21 09:47:55 +0000
@@ -1,3 +1,33 @@
+iptables (1.4.18-1.1ubuntu1) saucy; urgency=low
+
+  * Merge changes from Debian, version 1.4.18-1.1 to fix FTBFS
+    in package perlipq due to missing dependecy: (LP: #1228525)
+    - debian/control
+    - debian/iptables-dev.install
+  * Fix unresolved @PACKAGE_VERSION@ in manpage. Cherry-pick from
+    Debian, version 1.4.20-2: (LP: #1134554)
+    - debian/iptables.install
+    - debian/iptables.manpages
+    - debian/nfnl_osf.8
+    - 0201-iptables-xml_man_section.patch
+  * Fix incorrectly calling setsockopt, cherry-pick: (LP: #1187177)
+    - debian/patches/calling-setsockopt-incorrectly.patch
+
+ -- Artur Rona <[e-mail]>  Fri, 20 Sep 2013 00:26:08 +0200
+
+iptables (1.4.18-1.1) unstable; urgency=low
+
+  [ gregor herrmann ]
+  * Fix "libipq.h includes non-existing linux/netfilter_ipv4/ip_queue.h":
+    ship /usr/include/linux/netfilter_ipv4/ip_queue.h in iptables-dev;
+    add Breaks on linux-libc-dev << 3.5
+    (Closes: #707535)
+
+  [ Dominic Hargreaves ]
+  * Non-maintainer upload
+
+ -- Dominic Hargreaves <[e-mail]>  Sat, 13 Jul 2013 16:09:01 +0100
+
 iptables (1.4.18-1ubuntu1) saucy; urgency=low
 
   [ Chris J Arges ]

=== modified file 'debian/control'
--- debian/control	2013-06-07 09:50:09 +0000
+++ debian/control	2013-09-21 09:47:55 +0000
@@ -34,6 +34,7 @@
 Priority: optional
 Depends: ${misc:Depends}, iptables (=${binary:Version})
 Conflicts: iptables (<<1.4.2-2)
+Breaks: linux-libc-dev (<< 3.5)
 Section: devel
 Description: iptables development files
  iptables is used to setup, maintain, and inspect the tables of

=== modified file 'debian/iptables-dev.install'
--- debian/iptables-dev.install	2013-06-07 09:50:09 +0000
+++ debian/iptables-dev.install	2013-09-21 09:47:55 +0000
@@ -1,4 +1,5 @@
 usr/include
 lib/lib*.so
 lib/pkgconfig usr/lib
+include/linux/netfilter_ipv4/ip_queue.h usr/include/linux/netfilter_ipv4/
 howtos/netfilter*html usr/share/doc/iptables-dev/html

=== modified file 'debian/iptables.install'
--- debian/iptables.install	2013-06-07 09:50:09 +0000
+++ debian/iptables.install	2013-09-21 09:47:55 +0000
@@ -5,4 +5,6 @@
 lib/xtables
 iptables/iptables-apply usr/sbin
 iptables/iptables.xslt usr/share/iptables
+usr/share/man/man8
+usr/share/man/man1
 howtos/NAT*html debian/tmp/howtos/packet*html usr/share/doc/iptables/html

=== modified file 'debian/iptables.manpages'
--- debian/iptables.manpages	2012-10-28 09:40:00 +0000
+++ debian/iptables.manpages	2013-09-21 09:47:55 +0000
@@ -1,3 +1,2 @@
 iptables/*.8
-iptables/*.1
-utils/*.8
+debian/*.8

=== added file 'debian/nfnl_osf.8'
--- debian/nfnl_osf.8	1970-01-01 00:00:00 +0000
+++ debian/nfnl_osf.8	2013-09-21 09:47:55 +0000
@@ -0,0 +1,80 @@
+.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
+.\"
+.\" Standard preamble:
+.\" ========================================================================
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Vb \" Begin verbatim text
+.ft CW
+.nf
+.ne \\$1
+..
+.de Ve \" End verbatim text
+.ft R
+.fi
+..
+.\" Set up some character translations and predefined strings.  \*(-- will
+.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
+.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
+.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
+.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
+.\" nothing in troff, for use with C<>.
+.tr \(*W-
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.ie n \{\
+.    ds -- \(*W-
+.    ds PI pi
+.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
+.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
+.    ds L" ""
+.    ds R" ""
+.    ds C` ""
+.    ds C' ""
+'br\}
+.el\{\
+.    ds -- \|\(em\|
+.    ds PI \(*p
+.    ds L" ``
+.    ds R" ''
+'br\}
+.\"
+.\" Escape single quotes in literal strings from groff's Unicode transform.
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\"
+.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
+.\" entries marked with X<> in POD.  Of course, you'll have to process the
+.\" output yourself in some meaningful fashion.
+.ie \nF \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
+..
+.    nr % 0
+.    rr F
+.\}
+.el \{\
+.    de IX
+..
+.\}
+.\" ========================================================================
+.\"
+.IX Title "NFNL_OSF 8"
+.TH NFNL_OSF 8 "2012-10-27" "nfnl_osf" "nfnl_osf"
+.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
+.\" way too many mistakes in technical documents.
+.if n .ad l
+.nh
+.SH "NAME"
+nfnl_osf \- load and unload os fingerprint database
+.SH "SYNOPSIS"
+.IX Header "SYNOPSIS"
+load and unload osf fingerprint database for the netfilter osf extension
+.SH "DESCRIPTION"
+.IX Header "DESCRIPTION"
+nffl_osf has no official man page.  Look at the osf module in \fB\f(BIiptables\-extensions\fB\|(8)\fR for more information.
+.SH "SEE ALSO"
+.IX Header "SEE ALSO"
+\&\fIiptables\-extensions\fR\|(8)

=== added file 'debian/patches/0201-iptables-xml_man_section.patch'
--- debian/patches/0201-iptables-xml_man_section.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/0201-iptables-xml_man_section.patch	2013-09-21 09:47:55 +0000
@@ -0,0 +1,8 @@
+--- a/iptables/iptables-xml.1
++++ b/iptables/iptables-xml.1
+@@ -1,4 +1,4 @@
+-.TH IPTABLES-XML 8 "Jul 16, 2007" "" ""
++.TH IPTABLES-XML 1 "Jul 16, 2007" "" ""
+ .\"
+ .\" Man page written by Sam Liddicott <[e-mail]>
+ .\" It is based on the iptables-save man page.

=== added file 'debian/patches/calling-setsockopt-incorrectly.patch'
--- debian/patches/calling-setsockopt-incorrectly.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/calling-setsockopt-incorrectly.patch	2013-09-21 09:47:55 +0000
@@ -0,0 +1,338 @@
+From: Artur Rona <[e-mail]>
+Description: Add locking to prevent concurrent instances.
+Bug-Ubuntu: https://launchpad.net/bugs/1187177
+Bug-Debian: http://bugs.debian.org/710997
+Origin: upstream,	http://git.netfilter.org/iptables/commit/?id=93587a04d0f2511e108bbc4d87a8b9d28a5c5dd8
+					http://git.netfilter.org/iptables/commit/?id=d7aeda5ed45ac7ca959f12180690caa371b5b14b
+Author: Phil Oester <[e-mail]>,
+		Pablo Neira Ayuso <[e-mail]>
+
+diff -pruN -x '*~' iptables-1.4.18.orig/include/ip6tables.h iptables-1.4.18/include/ip6tables.h
+--- iptables-1.4.18.orig/include/ip6tables.h	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/include/ip6tables.h	2013-09-21 09:59:39.000000000 +0200
+@@ -8,7 +8,7 @@
+ 
+ /* Your shared library should call one of these. */
+ extern int do_command6(int argc, char *argv[], char **table,
+-		       struct xtc_handle **handle);
++		       struct xtc_handle **handle, bool restore);
+ 
+ extern int for_each_chain6(int (*fn)(const xt_chainlabel, int, struct xtc_handle *), int verbose, int builtinstoo, struct xtc_handle *handle);
+ extern int flush_entries6(const xt_chainlabel chain, int verbose, struct xtc_handle *handle);
+diff -pruN -x '*~' iptables-1.4.18.orig/include/iptables.h iptables-1.4.18/include/iptables.h
+--- iptables-1.4.18.orig/include/iptables.h	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/include/iptables.h	2013-09-21 09:59:39.000000000 +0200
+@@ -8,7 +8,7 @@
+ 
+ /* Your shared library should call one of these. */
+ extern int do_command4(int argc, char *argv[], char **table,
+-		      struct xtc_handle **handle);
++		      struct xtc_handle **handle, bool restore);
+ extern int delete_chain4(const xt_chainlabel chain, int verbose,
+ 			struct xtc_handle *handle);
+ extern int flush_entries4(const xt_chainlabel chain, int verbose, 
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables.8.in iptables-1.4.18/iptables/ip6tables.8.in
+--- iptables-1.4.18.orig/iptables/ip6tables.8.in	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables.8.in	2013-09-21 09:59:19.000000000 +0200
+@@ -363,6 +363,13 @@ For appending, insertion, deletion and r
+ detailed information on the rule or rules to be printed. \fB\-v\fP may be
+ specified multiple times to possibly emit more detailed debug statements.
+ .TP
++\fB\-w\fP, \fB\-\-wait\fP
++Wait for the xtables lock.
++To prevent multiple instances of the program from running concurrently,
++an attempt will be made to obtain an exclusive lock at launch.  By default,
++the program will exit if the lock cannot be obtained.  This option will
++make the program wait until the exclusive lock can be obtained.
++.TP
+ \fB\-n\fP, \fB\-\-numeric\fP
+ Numeric output.
+ IP addresses and port numbers will be printed in numeric format.
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables.c iptables-1.4.18/iptables/ip6tables.c
+--- iptables-1.4.18.orig/iptables/ip6tables.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables.c	2013-09-21 09:59:39.000000000 +0200
+@@ -102,6 +102,7 @@ static struct option original_opts[] = {
+ 	{.name = "numeric",       .has_arg = 0, .val = 'n'},
+ 	{.name = "out-interface", .has_arg = 1, .val = 'o'},
+ 	{.name = "verbose",       .has_arg = 0, .val = 'v'},
++	{.name = "wait",          .has_arg = 0, .val = 'w'},
+ 	{.name = "exact",         .has_arg = 0, .val = 'x'},
+ 	{.name = "version",       .has_arg = 0, .val = 'V'},
+ 	{.name = "help",          .has_arg = 2, .val = 'h'},
+@@ -257,6 +258,7 @@ exit_printhelp(const struct xtables_rule
+ "				network interface name ([+] for wildcard)\n"
+ "  --table	-t table	table to manipulate (default: `filter')\n"
+ "  --verbose	-v		verbose mode\n"
++"  --wait	-w		wait for the xtables lock\n"
+ "  --line-numbers		print line numbers when listing\n"
+ "  --exact	-x		expand numbers (display exact values)\n"
+ /*"[!] --fragment	-f		match second or further fragments only\n"*/
+@@ -1284,7 +1286,8 @@ static void command_match(struct iptable
+ 					     m->extra_opts, &m->option_offset);
+ }
+ 
+-int do_command6(int argc, char *argv[], char **table, struct xtc_handle **handle)
++int do_command6(int argc, char *argv[], char **table,
++		struct xtc_handle **handle, bool restore)
+ {
+ 	struct iptables_command_state cs;
+ 	struct ip6t_entry *e = NULL;
+@@ -1293,6 +1296,7 @@ int do_command6(int argc, char *argv[],
+ 	struct in6_addr *smasks = NULL, *dmasks = NULL;
+ 
+ 	int verbose = 0;
++	bool wait = false;
+ 	const char *chain = NULL;
+ 	const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
+ 	const char *policy = NULL, *newname = NULL;
+@@ -1328,7 +1332,7 @@ int do_command6(int argc, char *argv[],
+ 
+ 	opts = xt_params->orig_opts;
+ 	while ((cs.c = getopt_long(argc, argv,
+-	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:46",
++	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvwnt:m:xc:g:46",
+ 					   opts, NULL)) != -1) {
+ 		switch (cs.c) {
+ 			/*
+@@ -1573,6 +1577,15 @@ int do_command6(int argc, char *argv[],
+ 			verbose++;
+ 			break;
+ 
++		case 'w':
++			if (restore) {
++				xtables_error(PARAMETER_PROBLEM,
++					      "You cannot use `-w' from "
++					      "ip6tables-restore");
++			}
++			wait = true;
++			break;
++
+ 		case 'm':
+ 			command_match(&cs);
+ 			break;
+@@ -1724,6 +1737,14 @@ int do_command6(int argc, char *argv[],
+ 			   "chain name `%s' too long (must be under %u chars)",
+ 			   chain, XT_EXTENSION_MAXNAMELEN);
+ 
++	/* Attempt to acquire the xtables lock */
++	if (!restore && !xtables_lock(wait)) {
++		fprintf(stderr, "Another app is currently holding the xtables lock. "
++			"Perhaps you want to use the -w option?\n");
++		xtables_free_opts(1);
++		exit(RESOURCE_PROBLEM);
++	}
++
+ 	/* only allocate handle if we weren't called with a handle */
+ 	if (!*handle)
+ 		*handle = ip6tc_init(*table);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables-restore.c iptables-1.4.18/iptables/ip6tables-restore.c
+--- iptables-1.4.18.orig/iptables/ip6tables-restore.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables-restore.c	2013-09-21 09:59:39.000000000 +0200
+@@ -438,7 +438,7 @@ int ip6tables_restore_main(int argc, cha
+ 				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
+ 
+ 			ret = do_command6(newargc, newargv,
+-					 &newargv[2], &handle);
++					 &newargv[2], &handle, true);
+ 
+ 			free_argv();
+ 			fflush(stdout);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables-standalone.c iptables-1.4.18/iptables/ip6tables-standalone.c
+--- iptables-1.4.18.orig/iptables/ip6tables-standalone.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables-standalone.c	2013-09-21 09:59:39.000000000 +0200
+@@ -58,7 +58,7 @@ ip6tables_main(int argc, char *argv[])
+ 	init_extensions6();
+ #endif
+ 
+-	ret = do_command6(argc, argv, &table, &handle);
++	ret = do_command6(argc, argv, &table, &handle, false);
+ 	if (ret) {
+ 		ret = ip6tc_commit(handle);
+ 		ip6tc_free(handle);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables.8.in iptables-1.4.18/iptables/iptables.8.in
+--- iptables-1.4.18.orig/iptables/iptables.8.in	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables.8.in	2013-09-21 09:59:19.000000000 +0200
+@@ -351,6 +351,13 @@ For appending, insertion, deletion and r
+ detailed information on the rule or rules to be printed. \fB\-v\fP may be
+ specified multiple times to possibly emit more detailed debug statements.
+ .TP
++\fB\-w\fP, \fB\-\-wait\fP
++Wait for the xtables lock.
++To prevent multiple instances of the program from running concurrently,
++an attempt will be made to obtain an exclusive lock at launch.  By default,
++the program will exit if the lock cannot be obtained.  This option will
++make the program wait until the exclusive lock can be obtained.
++.TP
+ \fB\-n\fP, \fB\-\-numeric\fP
+ Numeric output.
+ IP addresses and port numbers will be printed in numeric format.
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables.c iptables-1.4.18/iptables/iptables.c
+--- iptables-1.4.18.orig/iptables/iptables.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables.c	2013-09-21 09:59:39.000000000 +0200
+@@ -99,6 +99,7 @@ static struct option original_opts[] = {
+ 	{.name = "numeric",       .has_arg = 0, .val = 'n'},
+ 	{.name = "out-interface", .has_arg = 1, .val = 'o'},
+ 	{.name = "verbose",       .has_arg = 0, .val = 'v'},
++	{.name = "wait",          .has_arg = 0, .val = 'w'},
+ 	{.name = "exact",         .has_arg = 0, .val = 'x'},
+ 	{.name = "fragments",     .has_arg = 0, .val = 'f'},
+ 	{.name = "version",       .has_arg = 0, .val = 'V'},
+@@ -251,6 +252,7 @@ exit_printhelp(const struct xtables_rule
+ "				network interface name ([+] for wildcard)\n"
+ "  --table	-t table	table to manipulate (default: `filter')\n"
+ "  --verbose	-v		verbose mode\n"
++"  --wait	-w		wait for the xtables lock\n"
+ "  --line-numbers		print line numbers when listing\n"
+ "  --exact	-x		expand numbers (display exact values)\n"
+ "[!] --fragment	-f		match second or further fragments only\n"
+@@ -1280,7 +1282,8 @@ static void command_match(struct iptable
+ 		xtables_error(OTHER_PROBLEM, "can't alloc memory!");
+ }
+ 
+-int do_command4(int argc, char *argv[], char **table, struct xtc_handle **handle)
++int do_command4(int argc, char *argv[], char **table,
++		struct xtc_handle **handle, bool restore)
+ {
+ 	struct iptables_command_state cs;
+ 	struct ipt_entry *e = NULL;
+@@ -1289,6 +1292,7 @@ int do_command4(int argc, char *argv[],
+ 	struct in_addr *daddrs = NULL, *dmasks = NULL;
+ 
+ 	int verbose = 0;
++	bool wait = false;
+ 	const char *chain = NULL;
+ 	const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
+ 	const char *policy = NULL, *newname = NULL;
+@@ -1324,7 +1328,7 @@ int do_command4(int argc, char *argv[],
+ 
+ 	opts = xt_params->orig_opts;
+ 	while ((cs.c = getopt_long(argc, argv,
+-	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:46",
++	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvwnt:m:xc:g:46",
+ 					   opts, NULL)) != -1) {
+ 		switch (cs.c) {
+ 			/*
+@@ -1567,6 +1571,15 @@ int do_command4(int argc, char *argv[],
+ 			verbose++;
+ 			break;
+ 
++		case 'w':
++			if (restore) {
++				xtables_error(PARAMETER_PROBLEM,
++					      "You cannot use `-w' from "
++					      "iptables-restore");
++			}
++			wait = true;
++			break;
++
+ 		case 'm':
+ 			command_match(&cs);
+ 			break;
+@@ -1721,6 +1734,14 @@ int do_command4(int argc, char *argv[],
+ 			   "chain name `%s' too long (must be under %u chars)",
+ 			   chain, XT_EXTENSION_MAXNAMELEN);
+ 
++	/* Attempt to acquire the xtables lock */
++	if (!restore && !xtables_lock(wait)) {
++		fprintf(stderr, "Another app is currently holding the xtables lock. "
++			"Perhaps you want to use the -w option?\n");
++		xtables_free_opts(1);
++		exit(RESOURCE_PROBLEM);
++	}
++
+ 	/* only allocate handle if we weren't called with a handle */
+ 	if (!*handle)
+ 		*handle = iptc_init(*table);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables-restore.c iptables-1.4.18/iptables/iptables-restore.c
+--- iptables-1.4.18.orig/iptables/iptables-restore.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables-restore.c	2013-09-21 09:59:39.000000000 +0200
+@@ -438,7 +438,7 @@ iptables_restore_main(int argc, char *ar
+ 				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
+ 
+ 			ret = do_command4(newargc, newargv,
+-					 &newargv[2], &handle);
++					 &newargv[2], &handle, true);
+ 
+ 			free_argv();
+ 			fflush(stdout);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables-standalone.c iptables-1.4.18/iptables/iptables-standalone.c
+--- iptables-1.4.18.orig/iptables/iptables-standalone.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables-standalone.c	2013-09-21 09:59:39.000000000 +0200
+@@ -58,7 +58,7 @@ iptables_main(int argc, char *argv[])
+ 	init_extensions4();
+ #endif
+ 
+-	ret = do_command4(argc, argv, &table, &handle);
++	ret = do_command4(argc, argv, &table, &handle, false);
+ 	if (ret) {
+ 		ret = iptc_commit(handle);
+ 		iptc_free(handle);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/xshared.c iptables-1.4.18/iptables/xshared.c
+--- iptables-1.4.18.orig/iptables/xshared.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/xshared.c	2013-09-21 09:59:19.000000000 +0200
+@@ -6,9 +6,15 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <sys/socket.h>
++#include <sys/un.h>
++#include <unistd.h>
+ #include <xtables.h>
+ #include "xshared.h"
+ 
++#define XT_SOCKET_NAME "xtables"
++#define XT_SOCKET_LEN 8
++
+ /*
+  * Print out any special helps. A user might like to be able to add a --help
+  * to the commandline, and see expected results. So we call help for all
+@@ -236,3 +242,30 @@ void xs_init_match(struct xtables_match
+ 	if (match->init != NULL)
+ 		match->init(match->m);
+ }
++
++bool xtables_lock(bool wait)
++{
++	int i = 0, ret, xt_socket;
++	struct sockaddr_un xt_addr;
++
++	memset(&xt_addr, 0, sizeof(xt_addr));
++	xt_addr.sun_family = AF_UNIX;
++	strcpy(xt_addr.sun_path+1, XT_SOCKET_NAME);
++	xt_socket = socket(AF_UNIX, SOCK_STREAM, 0);
++	/* If we can't even create a socket, fall back to prior (lockless) behavior */
++	if (xt_socket < 0)
++		return true;
++
++	while (1) {
++		ret = bind(xt_socket, (struct sockaddr*)&xt_addr,
++			   offsetof(struct sockaddr_un, sun_path)+XT_SOCKET_LEN);
++		if (ret == 0)
++			return true;
++		else if (wait == false)
++			return false;
++		if (++i % 2 == 0)
++			fprintf(stderr, "Another app is currently holding the xtables lock; "
++				"waiting for it to exit...\n");
++		sleep(1);
++	}
++}
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/xshared.h iptables-1.4.18/iptables/xshared.h
+--- iptables-1.4.18.orig/iptables/xshared.h	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/xshared.h	2013-09-21 09:59:19.000000000 +0200
+@@ -2,6 +2,7 @@
+ #define IPTABLES_XSHARED_H 1
+ 
+ #include <limits.h>
++#include <stdbool.h>
+ #include <stdint.h>
+ #include <netinet/in.h>
+ #include <net/if.h>
+@@ -83,6 +84,7 @@ extern struct xtables_match *load_proto(
+ extern int subcmd_main(int, char **, const struct subcommand *);
+ extern void xs_init_target(struct xtables_target *);
+ extern void xs_init_match(struct xtables_match *);
++extern bool xtables_lock(bool wait);
+ 
+ extern const struct xtables_afinfo *afinfo;
+ 

=== modified file 'debian/patches/series'
--- debian/patches/series	2013-06-07 09:50:09 +0000
+++ debian/patches/series	2013-09-21 09:47:55 +0000
@@ -1,6 +1,8 @@
 0101-changelog.patch
 0102-add_manpages.patch
+0201-iptables-xml_man_section.patch
 0503-extension_cppflags.patch
 0504-configure_dccp_ipvs.patch
 9000-howtos.patch
 9002-libxt_recent-Add-support-for-reap-option.patch
+calling-setsockopt-incorrectly.patch