Merge lp:~ari-tczew/ubuntu/saucy/iptables/lp-1228525-1134554-1187177 into lp:ubuntu/saucy/iptables

[Artur Rona]

[Daniel Holbach (dholbach)]

Thanks for your work on this.

It seems you're not mentioning the Ubuntu changes from the last merge. Were they all dropped? Are they still relevant?

+ - debian/control: add linuxdoc-tools dep, remove libipq references
+ - debian/rules: compile with --disable-libipq
+ - 9000-howtos.patch: add howtos/ and install them
+ - 9002-libxt_recent-Add-support-for-reap-option.patch: Some changes are
+ upstream, patch needed for additional reap option checks.
+ - debian/iptables.install: install NAT and packetfilter howtos into
+ /usr/share/doc
+ - debian/iptables-dev.doc-base.netfilter-extensions,
+ debian/iptables-dev.doc-base.netfilter-hacking,
+ debian/iptables.doc-base.nat, debian/iptables.doc-base.packet-filter:
+ add howtos
+ - debian/iptables-dev.install: remove usr/share/man/man3 only used with
+ libipq manpages

review: Needs Information

[Artur Rona (ari-tczew)]

Well, Ubuntu delta since last merge is unchanged. These changes have been not dropped and they still remain. I didn't mention them, because it's not standard merge from Debian, when the latest revision will be merged. Else it's 'fake merge' - Debian's revision from snapshot/archive has been merged due to fix FTBFS in another package (perlipq). In this case, the 2 lines (in debian/{control;iptables-dev.install}) have been changed. Then I've added following changes to fix next 2 bugs.
Also, we're coming to the question: what's more worth? Again copying long d/changelog description about remaining changes only for 2 above mentioned changes lines or just describe that it's non-standard merge? In the next development cycle we can do normal merge iptables from Debian unstable including mentioned remaining changes in d/changelog.

Sorry for misunderstanding, but I'm preparing such as 'fake/non-standard' merge first time. I'm not sure whether there is a documentation for.

BTW, The whole changes can be dropped while merging current iptables from Debian unstable.

review: Needs Resubmitting

[Dimitri John Ledkov (xnox)]

"review: Resubmit" -> means that "ari-tczew" has reviewed this proposal and says that submitter should resubmit this merge proposal again using resubmit button on top of the merge proposal.....

Imho, it's ok to do this it's just it's a "cherry-pick"

"Cherry-pick changes from Debian upload 1.4.18-1.1 to fix FTBFS" would be more appropriate. Seems reasonable to pick up all of these fixes for saucy.

=== modified file 'debian/changelog'
--- debian/changelog	2013-06-07 09:50:09 +0000
+++ debian/changelog	2013-09-26 17:47:06 +0000
@@ -1,3 +1,33 @@
+iptables (1.4.18-1.1ubuntu1) saucy; urgency=low
+
+  * Merge changes from Debian, version 1.4.18-1.1 to fix FTBFS
+    in package perlipq due to missing dependecy: (LP: #1228525)
+    - debian/control
+    - debian/iptables-dev.install
+  * Fix unresolved @PACKAGE_VERSION@ in manpage. Cherry-pick from
+    Debian, version 1.4.20-2: (LP: #1134554)
+    - debian/iptables.install
+    - debian/iptables.manpages
+    - debian/nfnl_osf.8
+    - 0201-iptables-xml_man_section.patch
+  * Fix incorrectly calling setsockopt, cherry-pick: (LP: #1187177)
+    - debian/patches/calling-setsockopt-incorrectly.patch
+
+ -- Artur Rona <[e-mail]>  Fri, 20 Sep 2013 00:26:08 +0200
+
+iptables (1.4.18-1.1) unstable; urgency=low
+
+  [ gregor herrmann ]
+  * Fix "libipq.h includes non-existing linux/netfilter_ipv4/ip_queue.h":
+    ship /usr/include/linux/netfilter_ipv4/ip_queue.h in iptables-dev;
+    add Breaks on linux-libc-dev << 3.5
+    (Closes: #707535)
+
+  [ Dominic Hargreaves ]
+  * Non-maintainer upload
+
+ -- Dominic Hargreaves <[e-mail]>  Sat, 13 Jul 2013 16:09:01 +0100
+
 iptables (1.4.18-1ubuntu1) saucy; urgency=low
 
   [ Chris J Arges ]

=== modified file 'debian/control'
--- debian/control	2013-06-07 09:50:09 +0000
+++ debian/control	2013-09-26 17:47:06 +0000
@@ -34,6 +34,7 @@
 Priority: optional
 Depends: ${misc:Depends}, iptables (=${binary:Version})
 Conflicts: iptables (<<1.4.2-2)
+Breaks: linux-libc-dev (<< 3.5)
 Section: devel
 Description: iptables development files
  iptables is used to setup, maintain, and inspect the tables of

=== modified file 'debian/iptables-dev.install'
--- debian/iptables-dev.install	2013-06-07 09:50:09 +0000
+++ debian/iptables-dev.install	2013-09-26 17:47:06 +0000
@@ -1,4 +1,5 @@
 usr/include
 lib/lib*.so
 lib/pkgconfig usr/lib
+include/linux/netfilter_ipv4/ip_queue.h usr/include/linux/netfilter_ipv4/
 howtos/netfilter*html usr/share/doc/iptables-dev/html

=== modified file 'debian/iptables.install'
--- debian/iptables.install	2013-06-07 09:50:09 +0000
+++ debian/iptables.install	2013-09-26 17:47:06 +0000
@@ -5,4 +5,6 @@
 lib/xtables
 iptables/iptables-apply usr/sbin
 iptables/iptables.xslt usr/share/iptables
+usr/share/man/man8
+usr/share/man/man1
 howtos/NAT*html debian/tmp/howtos/packet*html usr/share/doc/iptables/html

=== modified file 'debian/iptables.manpages'
--- debian/iptables.manpages	2012-10-28 09:40:00 +0000
+++ debian/iptables.manpages	2013-09-26 17:47:06 +0000
@@ -1,3 +1,2 @@
 iptables/*.8
-iptables/*.1
-utils/*.8
+debian/*.8

=== added file 'debian/nfnl_osf.8'
--- debian/nfnl_osf.8	1970-01-01 00:00:00 +0000
+++ debian/nfnl_osf.8	2013-09-26 17:47:06 +0000
@@ -0,0 +1,80 @@
+.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
+.\"
+.\" Standard preamble:
+.\" ========================================================================
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Vb \" Begin verbatim text
+.ft CW
+.nf
+.ne \\$1
+..
+.de Ve \" End verbatim text
+.ft R
+.fi
+..
+.\" Set up some character translations and predefined strings.  \*(-- will
+.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
+.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
+.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
+.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
+.\" nothing in troff, for use with C<>.
+.tr \(*W-
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.ie n \{\
+.    ds -- \(*W-
+.    ds PI pi
+.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
+.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
+.    ds L" ""
+.    ds R" ""
+.    ds C` ""
+.    ds C' ""
+'br\}
+.el\{\
+.    ds -- \|\(em\|
+.    ds PI \(*p
+.    ds L" ``
+.    ds R" ''
+'br\}
+.\"
+.\" Escape single quotes in literal strings from groff's Unicode transform.
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\"
+.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
+.\" entries marked with X<> in POD.  Of course, you'll have to process the
+.\" output yourself in some meaningful fashion.
+.ie \nF \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
+..
+.    nr % 0
+.    rr F
+.\}
+.el \{\
+.    de IX
+..
+.\}
+.\" ========================================================================
+.\"
+.IX Title "NFNL_OSF 8"
+.TH NFNL_OSF 8 "2012-10-27" "nfnl_osf" "nfnl_osf"
+.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
+.\" way too many mistakes in technical documents.
+.if n .ad l
+.nh
+.SH "NAME"
+nfnl_osf \- load and unload os fingerprint database
+.SH "SYNOPSIS"
+.IX Header "SYNOPSIS"
+load and unload osf fingerprint database for the netfilter osf extension
+.SH "DESCRIPTION"
+.IX Header "DESCRIPTION"
+nffl_osf has no official man page.  Look at the osf module in \fB\f(BIiptables\-extensions\fB\|(8)\fR for more information.
+.SH "SEE ALSO"
+.IX Header "SEE ALSO"
+\&\fIiptables\-extensions\fR\|(8)

=== added file 'debian/patches/0201-iptables-xml_man_section.patch'
--- debian/patches/0201-iptables-xml_man_section.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/0201-iptables-xml_man_section.patch	2013-09-26 17:47:06 +0000
@@ -0,0 +1,8 @@
+--- a/iptables/iptables-xml.1
++++ b/iptables/iptables-xml.1
+@@ -1,4 +1,4 @@
+-.TH IPTABLES-XML 8 "Jul 16, 2007" "" ""
++.TH IPTABLES-XML 1 "Jul 16, 2007" "" ""
+ .\"
+ .\" Man page written by Sam Liddicott <[e-mail]>
+ .\" It is based on the iptables-save man page.

=== added file 'debian/patches/calling-setsockopt-incorrectly.patch'
--- debian/patches/calling-setsockopt-incorrectly.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/calling-setsockopt-incorrectly.patch	2013-09-26 17:47:06 +0000
@@ -0,0 +1,338 @@
+From: Artur Rona <[e-mail]>
+Description: Add locking to prevent concurrent instances.
+Bug-Ubuntu: https://launchpad.net/bugs/1187177
+Bug-Debian: http://bugs.debian.org/710997
+Origin: upstream,	http://git.netfilter.org/iptables/commit/?id=93587a04d0f2511e108bbc4d87a8b9d28a5c5dd8
+					http://git.netfilter.org/iptables/commit/?id=d7aeda5ed45ac7ca959f12180690caa371b5b14b
+Author: Phil Oester <[e-mail]>,
+		Pablo Neira Ayuso <[e-mail]>
+
+diff -pruN -x '*~' iptables-1.4.18.orig/include/ip6tables.h iptables-1.4.18/include/ip6tables.h
+--- iptables-1.4.18.orig/include/ip6tables.h	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/include/ip6tables.h	2013-09-21 09:59:39.000000000 +0200
+@@ -8,7 +8,7 @@
+ 
+ /* Your shared library should call one of these. */
+ extern int do_command6(int argc, char *argv[], char **table,
+-		       struct xtc_handle **handle);
++		       struct xtc_handle **handle, bool restore);
+ 
+ extern int for_each_chain6(int (*fn)(const xt_chainlabel, int, struct xtc_handle *), int verbose, int builtinstoo, struct xtc_handle *handle);
+ extern int flush_entries6(const xt_chainlabel chain, int verbose, struct xtc_handle *handle);
+diff -pruN -x '*~' iptables-1.4.18.orig/include/iptables.h iptables-1.4.18/include/iptables.h
+--- iptables-1.4.18.orig/include/iptables.h	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/include/iptables.h	2013-09-21 09:59:39.000000000 +0200
+@@ -8,7 +8,7 @@
+ 
+ /* Your shared library should call one of these. */
+ extern int do_command4(int argc, char *argv[], char **table,
+-		      struct xtc_handle **handle);
++		      struct xtc_handle **handle, bool restore);
+ extern int delete_chain4(const xt_chainlabel chain, int verbose,
+ 			struct xtc_handle *handle);
+ extern int flush_entries4(const xt_chainlabel chain, int verbose, 
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables.8.in iptables-1.4.18/iptables/ip6tables.8.in
+--- iptables-1.4.18.orig/iptables/ip6tables.8.in	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables.8.in	2013-09-21 09:59:19.000000000 +0200
+@@ -363,6 +363,13 @@ For appending, insertion, deletion and r
+ detailed information on the rule or rules to be printed. \fB\-v\fP may be
+ specified multiple times to possibly emit more detailed debug statements.
+ .TP
++\fB\-w\fP, \fB\-\-wait\fP
++Wait for the xtables lock.
++To prevent multiple instances of the program from running concurrently,
++an attempt will be made to obtain an exclusive lock at launch.  By default,
++the program will exit if the lock cannot be obtained.  This option will
++make the program wait until the exclusive lock can be obtained.
++.TP
+ \fB\-n\fP, \fB\-\-numeric\fP
+ Numeric output.
+ IP addresses and port numbers will be printed in numeric format.
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables.c iptables-1.4.18/iptables/ip6tables.c
+--- iptables-1.4.18.orig/iptables/ip6tables.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables.c	2013-09-21 09:59:39.000000000 +0200
+@@ -102,6 +102,7 @@ static struct option original_opts[] = {
+ 	{.name = "numeric",       .has_arg = 0, .val = 'n'},
+ 	{.name = "out-interface", .has_arg = 1, .val = 'o'},
+ 	{.name = "verbose",       .has_arg = 0, .val = 'v'},
++	{.name = "wait",          .has_arg = 0, .val = 'w'},
+ 	{.name = "exact",         .has_arg = 0, .val = 'x'},
+ 	{.name = "version",       .has_arg = 0, .val = 'V'},
+ 	{.name = "help",          .has_arg = 2, .val = 'h'},
+@@ -257,6 +258,7 @@ exit_printhelp(const struct xtables_rule
+ "				network interface name ([+] for wildcard)\n"
+ "  --table	-t table	table to manipulate (default: `filter')\n"
+ "  --verbose	-v		verbose mode\n"
++"  --wait	-w		wait for the xtables lock\n"
+ "  --line-numbers		print line numbers when listing\n"
+ "  --exact	-x		expand numbers (display exact values)\n"
+ /*"[!] --fragment	-f		match second or further fragments only\n"*/
+@@ -1284,7 +1286,8 @@ static void command_match(struct iptable
+ 					     m->extra_opts, &m->option_offset);
+ }
+ 
+-int do_command6(int argc, char *argv[], char **table, struct xtc_handle **handle)
++int do_command6(int argc, char *argv[], char **table,
++		struct xtc_handle **handle, bool restore)
+ {
+ 	struct iptables_command_state cs;
+ 	struct ip6t_entry *e = NULL;
+@@ -1293,6 +1296,7 @@ int do_command6(int argc, char *argv[],
+ 	struct in6_addr *smasks = NULL, *dmasks = NULL;
+ 
+ 	int verbose = 0;
++	bool wait = false;
+ 	const char *chain = NULL;
+ 	const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
+ 	const char *policy = NULL, *newname = NULL;
+@@ -1328,7 +1332,7 @@ int do_command6(int argc, char *argv[],
+ 
+ 	opts = xt_params->orig_opts;
+ 	while ((cs.c = getopt_long(argc, argv,
+-	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:46",
++	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvwnt:m:xc:g:46",
+ 					   opts, NULL)) != -1) {
+ 		switch (cs.c) {
+ 			/*
+@@ -1573,6 +1577,15 @@ int do_command6(int argc, char *argv[],
+ 			verbose++;
+ 			break;
+ 
++		case 'w':
++			if (restore) {
++				xtables_error(PARAMETER_PROBLEM,
++					      "You cannot use `-w' from "
++					      "ip6tables-restore");
++			}
++			wait = true;
++			break;
++
+ 		case 'm':
+ 			command_match(&cs);
+ 			break;
+@@ -1724,6 +1737,14 @@ int do_command6(int argc, char *argv[],
+ 			   "chain name `%s' too long (must be under %u chars)",
+ 			   chain, XT_EXTENSION_MAXNAMELEN);
+ 
++	/* Attempt to acquire the xtables lock */
++	if (!restore && !xtables_lock(wait)) {
++		fprintf(stderr, "Another app is currently holding the xtables lock. "
++			"Perhaps you want to use the -w option?\n");
++		xtables_free_opts(1);
++		exit(RESOURCE_PROBLEM);
++	}
++
+ 	/* only allocate handle if we weren't called with a handle */
+ 	if (!*handle)
+ 		*handle = ip6tc_init(*table);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables-restore.c iptables-1.4.18/iptables/ip6tables-restore.c
+--- iptables-1.4.18.orig/iptables/ip6tables-restore.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables-restore.c	2013-09-21 09:59:39.000000000 +0200
+@@ -438,7 +438,7 @@ int ip6tables_restore_main(int argc, cha
+ 				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
+ 
+ 			ret = do_command6(newargc, newargv,
+-					 &newargv[2], &handle);
++					 &newargv[2], &handle, true);
+ 
+ 			free_argv();
+ 			fflush(stdout);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/ip6tables-standalone.c iptables-1.4.18/iptables/ip6tables-standalone.c
+--- iptables-1.4.18.orig/iptables/ip6tables-standalone.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/ip6tables-standalone.c	2013-09-21 09:59:39.000000000 +0200
+@@ -58,7 +58,7 @@ ip6tables_main(int argc, char *argv[])
+ 	init_extensions6();
+ #endif
+ 
+-	ret = do_command6(argc, argv, &table, &handle);
++	ret = do_command6(argc, argv, &table, &handle, false);
+ 	if (ret) {
+ 		ret = ip6tc_commit(handle);
+ 		ip6tc_free(handle);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables.8.in iptables-1.4.18/iptables/iptables.8.in
+--- iptables-1.4.18.orig/iptables/iptables.8.in	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables.8.in	2013-09-21 09:59:19.000000000 +0200
+@@ -351,6 +351,13 @@ For appending, insertion, deletion and r
+ detailed information on the rule or rules to be printed. \fB\-v\fP may be
+ specified multiple times to possibly emit more detailed debug statements.
+ .TP
++\fB\-w\fP, \fB\-\-wait\fP
++Wait for the xtables lock.
++To prevent multiple instances of the program from running concurrently,
++an attempt will be made to obtain an exclusive lock at launch.  By default,
++the program will exit if the lock cannot be obtained.  This option will
++make the program wait until the exclusive lock can be obtained.
++.TP
+ \fB\-n\fP, \fB\-\-numeric\fP
+ Numeric output.
+ IP addresses and port numbers will be printed in numeric format.
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables.c iptables-1.4.18/iptables/iptables.c
+--- iptables-1.4.18.orig/iptables/iptables.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables.c	2013-09-21 09:59:39.000000000 +0200
+@@ -99,6 +99,7 @@ static struct option original_opts[] = {
+ 	{.name = "numeric",       .has_arg = 0, .val = 'n'},
+ 	{.name = "out-interface", .has_arg = 1, .val = 'o'},
+ 	{.name = "verbose",       .has_arg = 0, .val = 'v'},
++	{.name = "wait",          .has_arg = 0, .val = 'w'},
+ 	{.name = "exact",         .has_arg = 0, .val = 'x'},
+ 	{.name = "fragments",     .has_arg = 0, .val = 'f'},
+ 	{.name = "version",       .has_arg = 0, .val = 'V'},
+@@ -251,6 +252,7 @@ exit_printhelp(const struct xtables_rule
+ "				network interface name ([+] for wildcard)\n"
+ "  --table	-t table	table to manipulate (default: `filter')\n"
+ "  --verbose	-v		verbose mode\n"
++"  --wait	-w		wait for the xtables lock\n"
+ "  --line-numbers		print line numbers when listing\n"
+ "  --exact	-x		expand numbers (display exact values)\n"
+ "[!] --fragment	-f		match second or further fragments only\n"
+@@ -1280,7 +1282,8 @@ static void command_match(struct iptable
+ 		xtables_error(OTHER_PROBLEM, "can't alloc memory!");
+ }
+ 
+-int do_command4(int argc, char *argv[], char **table, struct xtc_handle **handle)
++int do_command4(int argc, char *argv[], char **table,
++		struct xtc_handle **handle, bool restore)
+ {
+ 	struct iptables_command_state cs;
+ 	struct ipt_entry *e = NULL;
+@@ -1289,6 +1292,7 @@ int do_command4(int argc, char *argv[],
+ 	struct in_addr *daddrs = NULL, *dmasks = NULL;
+ 
+ 	int verbose = 0;
++	bool wait = false;
+ 	const char *chain = NULL;
+ 	const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
+ 	const char *policy = NULL, *newname = NULL;
+@@ -1324,7 +1328,7 @@ int do_command4(int argc, char *argv[],
+ 
+ 	opts = xt_params->orig_opts;
+ 	while ((cs.c = getopt_long(argc, argv,
+-	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:46",
++	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvwnt:m:xc:g:46",
+ 					   opts, NULL)) != -1) {
+ 		switch (cs.c) {
+ 			/*
+@@ -1567,6 +1571,15 @@ int do_command4(int argc, char *argv[],
+ 			verbose++;
+ 			break;
+ 
++		case 'w':
++			if (restore) {
++				xtables_error(PARAMETER_PROBLEM,
++					      "You cannot use `-w' from "
++					      "iptables-restore");
++			}
++			wait = true;
++			break;
++
+ 		case 'm':
+ 			command_match(&cs);
+ 			break;
+@@ -1721,6 +1734,14 @@ int do_command4(int argc, char *argv[],
+ 			   "chain name `%s' too long (must be under %u chars)",
+ 			   chain, XT_EXTENSION_MAXNAMELEN);
+ 
++	/* Attempt to acquire the xtables lock */
++	if (!restore && !xtables_lock(wait)) {
++		fprintf(stderr, "Another app is currently holding the xtables lock. "
++			"Perhaps you want to use the -w option?\n");
++		xtables_free_opts(1);
++		exit(RESOURCE_PROBLEM);
++	}
++
+ 	/* only allocate handle if we weren't called with a handle */
+ 	if (!*handle)
+ 		*handle = iptc_init(*table);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables-restore.c iptables-1.4.18/iptables/iptables-restore.c
+--- iptables-1.4.18.orig/iptables/iptables-restore.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables-restore.c	2013-09-21 09:59:39.000000000 +0200
+@@ -438,7 +438,7 @@ iptables_restore_main(int argc, char *ar
+ 				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
+ 
+ 			ret = do_command4(newargc, newargv,
+-					 &newargv[2], &handle);
++					 &newargv[2], &handle, true);
+ 
+ 			free_argv();
+ 			fflush(stdout);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/iptables-standalone.c iptables-1.4.18/iptables/iptables-standalone.c
+--- iptables-1.4.18.orig/iptables/iptables-standalone.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/iptables-standalone.c	2013-09-21 09:59:39.000000000 +0200
+@@ -58,7 +58,7 @@ iptables_main(int argc, char *argv[])
+ 	init_extensions4();
+ #endif
+ 
+-	ret = do_command4(argc, argv, &table, &handle);
++	ret = do_command4(argc, argv, &table, &handle, false);
+ 	if (ret) {
+ 		ret = iptc_commit(handle);
+ 		iptc_free(handle);
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/xshared.c iptables-1.4.18/iptables/xshared.c
+--- iptables-1.4.18.orig/iptables/xshared.c	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/xshared.c	2013-09-21 09:59:19.000000000 +0200
+@@ -6,9 +6,15 @@
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <sys/socket.h>
++#include <sys/un.h>
++#include <unistd.h>
+ #include <xtables.h>
+ #include "xshared.h"
+ 
++#define XT_SOCKET_NAME "xtables"
++#define XT_SOCKET_LEN 8
++
+ /*
+  * Print out any special helps. A user might like to be able to add a --help
+  * to the commandline, and see expected results. So we call help for all
+@@ -236,3 +242,30 @@ void xs_init_match(struct xtables_match
+ 	if (match->init != NULL)
+ 		match->init(match->m);
+ }
++
++bool xtables_lock(bool wait)
++{
++	int i = 0, ret, xt_socket;
++	struct sockaddr_un xt_addr;
++
++	memset(&xt_addr, 0, sizeof(xt_addr));
++	xt_addr.sun_family = AF_UNIX;
++	strcpy(xt_addr.sun_path+1, XT_SOCKET_NAME);
++	xt_socket = socket(AF_UNIX, SOCK_STREAM, 0);
++	/* If we can't even create a socket, fall back to prior (lockless) behavior */
++	if (xt_socket < 0)
++		return true;
++
++	while (1) {
++		ret = bind(xt_socket, (struct sockaddr*)&xt_addr,
++			   offsetof(struct sockaddr_un, sun_path)+XT_SOCKET_LEN);
++		if (ret == 0)
++			return true;
++		else if (wait == false)
++			return false;
++		if (++i % 2 == 0)
++			fprintf(stderr, "Another app is currently holding the xtables lock; "
++				"waiting for it to exit...\n");
++		sleep(1);
++	}
++}
+diff -pruN -x '*~' iptables-1.4.18.orig/iptables/xshared.h iptables-1.4.18/iptables/xshared.h
+--- iptables-1.4.18.orig/iptables/xshared.h	2013-03-03 22:40:11.000000000 +0100
++++ iptables-1.4.18/iptables/xshared.h	2013-09-21 09:59:19.000000000 +0200
+@@ -2,6 +2,7 @@
+ #define IPTABLES_XSHARED_H 1
+ 
+ #include <limits.h>
++#include <stdbool.h>
+ #include <stdint.h>
+ #include <netinet/in.h>
+ #include <net/if.h>
+@@ -83,6 +84,7 @@ extern struct xtables_match *load_proto(
+ extern int subcmd_main(int, char **, const struct subcommand *);
+ extern void xs_init_target(struct xtables_target *);
+ extern void xs_init_match(struct xtables_match *);
++extern bool xtables_lock(bool wait);
+ 
+ extern const struct xtables_afinfo *afinfo;
+ 

=== modified file 'debian/patches/series'
--- debian/patches/series	2013-06-07 09:50:09 +0000
+++ debian/patches/series	2013-09-26 17:47:06 +0000
@@ -1,6 +1,8 @@
 0101-changelog.patch
 0102-add_manpages.patch
+0201-iptables-xml_man_section.patch
 0503-extension_cppflags.patch
 0504-configure_dccp_ipvs.patch
 9000-howtos.patch
 9002-libxt_recent-Add-support-for-reap-option.patch
+calling-setsockopt-incorrectly.patch