Index: archive/firewalld.xml
===================================================================
--- archive/firewalld.xml	(revision d3717bff725c32c2070108cdfb45d258cf320476)
+++ archive/firewalld.xml	(revision d3717bff725c32c2070108cdfb45d258cf320476)
@@ -0,0 +1,336 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY firewalld-download-http "https://github.com/firewalld/firewalld/releases/download/v&firewalld-version;/firewalld-&firewalld-version;.tar.gz">
+  <!ENTITY firewalld-download-ftp  " ">
+  <!ENTITY firewalld-md5sum        "644a8970b43fcf875178ae3bec640db4">
+  <!ENTITY firewalld-size          "1.6 MB">
+  <!ENTITY firewalld-buildsize     "19 MB (additionall 2 MB for tests)">
+  <!ENTITY firewalld-time          "less than 0.1 SBU (add 6.2 SBU for tests)">
+]>
+
+<sect1 id="firewalld" xreflabel="firewalld-&firewalld-version;">
+  <?dbhtml filename="firewalld.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>firewalld-&firewalld-version;</title>
+
+  <indexterm zone="firewalld">
+    <primary sortas="a-firewalld">firewalld</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to firewalld</title>
+
+    <para>
+      The <application>firewalld</application> package provides a dynamically
+      managed firewall with support for network or firewall zones to define the
+      trust level of network connections or interfaces. It has support for
+      IPv4, IPv6 firewall settings and for ethernet bridges and a separation of
+      runtime and permanent configuration options. It also provides an
+      interface for services or applications to add nftables or iptables and
+      ebtables rules directly.
+    </para>
+
+    &lfs90_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing="compact">
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&firewalld-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&firewalld-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &firewalld-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &firewalld-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &firewalld-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &firewalld-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">firewalld Dependencies</bridgehead>
+
+    <bridgehead renderas="sect4">Required</bridgehead>
+    <para role="required">
+      <xref linkend="nftables"/>,
+      and <xref linkend="python-slip"/>
+    </para>
+
+    <bridgehead renderas="sect4">Recommended</bridgehead>
+    <para role="recommended">
+      <xref linkend="DocBook"/>,
+      <xref linkend="iptables"/>, and
+      <xref linkend="libxslt"/> (for building the manual pages)
+    </para>
+
+    <bridgehead renderas="sect4">Optional</bridgehead>
+    <para role="optional">
+      <xref linkend="gtk3" role="runtime"/> (runtime only, required for
+      <application>fireall-config</application>),
+      <xref linkend="qt5" role="runtime"/> (runtime only, required for 
+      <application>fireall-applet</application>), and
+      <ulink url="https://netfilter.org/projects/ipset/index.html">ipset</ulink>
+      for ipset support (only when used with iptables)
+    </para>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/firewalld"/>
+    </para>
+  </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of firewalld</title>
+
+    <para>
+      Install <application>firewalld</application> by
+      running the following commands:
+    </para>
+
+<screen revision="systemd"><userinput>PYTHON=/usr/bin/python3           \
+    ./configure --sysconfdir=/etc \
+                --without-ipset   &amp;&amp;
+make</userinput></screen>
+
+<screen revision="sysv"><userinput>PYTHON=/usr/bin/python3           \
+    ./configure --sysconfdir=/etc \
+                --without-ipset   \
+                --disable-systemd &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      The testsuite for <application>firewalld</application> is very dependent
+      on the running kernel and system configuration. It requires
+      <application>ipset</application> as well as both backends, and all
+      supported kernel options available.
+    </para>
+
+    <para>
+      If the above conditions are met, run the testsuite as the
+      <systemitem class="username">root</systemitem> user with the command
+      <command>make -C src check</command>. Any test failures are likely the
+      result of an incomplete configuration. Failed tests will give a detailed
+      failure status at
+      <filename>src/test/testsuite.dir/&lt;###&gt;/testsuite.log</filename>.
+    </para>
+
+    <para revision="sysv">
+      Prevent installation of the distributed firewalld init script with the
+      following command:
+    </para>
+
+<screen revision="sysv"><userinput>sed '/^am__append_3/,+1d' -i config/Makefile</userinput></screen>
+
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+    <para>
+      <parameter>--without-ipset</parameter>: This switch disables use of the
+      <command>ipset</command> utility. Omit if it is installed.
+    </para>
+
+    <para revision="sysv">
+      <parameter>--disable-systemd</parameter>: This command prevents
+      installation of <application>systemd</application> services.
+    </para>
+
+    <para>
+      <option>--without-{ip{,6},eb}tables{,-restore}</option>: These switches
+      disable <application>iptables</application> support and are required if
+      you wish to build without iptables support.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring firewalld</title>
+
+    <sect3 id="firewalld-conf">
+      <title>Config Files</title>
+
+      <para>
+        <filename>/etc/firewall/applet.conf</filename>,
+        <filename>/etc/firewalld/firewalld.conf</filename>,
+        and <filename>/etc/sysconfig/firewalld</filename>
+      </para>
+
+      <indexterm zone="firewalld firewalld-conf">
+        <primary sortas="e-etc-firewalld.conf">/etc/firewalld/firewalld.conf</primary>
+      </indexterm>
+
+      <para>
+        Configuration of <application>firewalld</application> is generally done
+        without modification of the above configuration files using the
+        <command>firewall-cmd</command> command. Within the above configuration
+        files you can set daemon behavior only. E.g.: whether runtime rules are
+        retained on restart, which firewall backend to use (default is
+        nftables), or whether to turn on debugging.
+      </para>
+
+      <para>
+        Detailed documentation is provided by the
+        <application>firewalld</application> developers at
+        <ulink url="https://firewalld.org/documentation/"/>.
+      </para>
+
+    </sect3>
+
+    <sect3 id="firewalld-init">
+      <title><phrase revision="sysv">Init Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">
+        If you need to run the <command>firewalld</command> daemon at system
+        startup, install the <filename>/etc/rc.d/init.d/firewalld</filename>
+        init script included in the
+        <xref linkend="bootscripts"/> package using the following command:
+      </para>
+
+      <para revision="systemd">
+        If you need to run the <command>firewalld</command> daemon at system
+        startup, enable the previously installed
+        <filename>firewalld.service</filename> unit with the following command:
+      </para>
+
+      <indexterm zone="firewalld firewalld-init">
+        <primary sortas="f-firewalld">firewalld</primary>
+      </indexterm>
+
+<screen role="root" revision="sysv"><userinput>make install-firewalld</userinput></screen>
+
+<screen role="root" revision="systemd"><userinput>systemctl enable firewalld</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          firewall-applet, firewall-cmd, firewall-config, firewall-offline-cmd,
+          and firewalld
+        </seg>
+        <seg>
+          None
+        </seg>
+        <seg>
+          /etc/firewalld,
+          /etc/firewall,
+          /usr/lib/firewalld, and
+          /usr/lib/python-&python3-version;/site-packages/firewall
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="firewall-applet">
+        <term><command>firewall-applet</command></term>
+        <listitem>
+          <para>
+            is a tray applet using QSettings backend.
+          </para>
+          <indexterm zone="firewalld firewall-applet">
+            <primary sortas="b-firewall-applet">firwall-applet</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="firewall-cmd">
+        <term><command>firewall-cmd</command></term>
+        <listitem>
+          <para>
+            is the primary command line frontend.
+          </para>
+          <indexterm zone="firewalld firewall-cmd">
+            <primary sortas="b-firewall-cmd">firewall-cmd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="firewall-config">
+        <term><command>firewall-config</command></term>
+        <listitem>
+          <para>
+            is a GUI configuration tool using GTK+-3.
+          </para>
+          <indexterm zone="firewalld firewall-config">
+            <primary sortas="b-firewall-config">firewall-config</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="firewall-offline-cmd">
+        <term><command>firewall-offline-cmd</command></term>
+        <listitem>
+          <para>
+            is a command line client used for permanent configuration while
+            firewalld is not running.
+          </para>
+          <indexterm zone="firewalld firewall-offline-cmd">
+            <primary sortas="b-firewall-offline-cmd">firewall-offline-cmd</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="firewalld-daemon">
+        <term><command>firewalld</command></term>
+        <listitem>
+          <para>
+            is the Dynamic Firewall Manager daemon.
+          </para>
+          <indexterm zone="firewalld firewalld-daemon">
+            <primary sortas="b-firewalld">firewalld</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: archive/nftables.xml
===================================================================
--- archive/nftables.xml	(revision d3717bff725c32c2070108cdfb45d258cf320476)
+++ archive/nftables.xml	(revision d3717bff725c32c2070108cdfb45d258cf320476)
@@ -0,0 +1,434 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
+  <!ENTITY % general-entities SYSTEM "../../general.ent">
+  %general-entities;
+
+  <!ENTITY nftables-download-http "https://netfilter.org/projects/nftables/files/nftables-&nftables-version;.tar.bz2">
+  <!ENTITY nftables-download-ftp  " ">
+  <!ENTITY nftables-md5sum        "9913b2b46864394d41916b74638e0875">
+  <!ENTITY nftables-size          "772 KB">
+  <!ENTITY nftables-buildsize     "34 MB">
+  <!ENTITY nftables-time          "0.2 SBU">
+]>
+
+<sect1 id="nftables" xreflabel="nftables-&nftables-version;">
+  <?dbhtml filename="nftables.html"?>
+
+  <sect1info>
+    <othername>$LastChangedBy$</othername>
+    <date>$Date$</date>
+  </sect1info>
+
+  <title>nftables-&nftables-version;</title>
+
+  <indexterm zone="nftables">
+    <primary sortas="a-nftables">nftables</primary>
+  </indexterm>
+
+  <sect2 role="package">
+    <title>Introduction to nftables</title>
+
+    <para>
+      The <application>nftables</application> package, intended to be the
+      successor to <xref linkend="iptables"/>,  provides a low-level netlink
+      programming interface (API), and userspace uitlities for the in-kernel
+      nf_tables subsystem.
+    </para>
+
+    &lfs90_checked;
+
+    <bridgehead renderas="sect3">Package Information</bridgehead>
+    <itemizedlist spacing='compact'>
+      <listitem>
+        <para>
+          Download (HTTP): <ulink url="&nftables-download-http;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download (FTP): <ulink url="&nftables-download-ftp;"/>
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download MD5 sum: &nftables-md5sum;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Download size: &nftables-size;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated disk space required: &nftables-buildsize;
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          Estimated build time: &nftables-time;
+        </para>
+      </listitem>
+    </itemizedlist>
+
+    <bridgehead renderas="sect3">nftables Dependencies</bridgehead>
+
+    <bridgehead renderas="sect4">Required</bridgehead>
+    <para role="required">
+      <xref linkend="libnftnl"/>
+    </para>
+
+    <bridgehead renderas="sect4">Recommended</bridgehead>
+    <para role="recommended">
+        <xref linkend="jansson"/> (for JSON rules table support)
+    </para>
+
+    <bridgehead renderas="sect4">Optional</bridgehead>
+    <para role="optional">
+      <xref linkend="iptables"/> and
+      <xref linkend="docbook-utils"/>
+    </para>
+
+    <bridgehead renderas="sect4">Optional (runtime)</bridgehead>
+
+    <para role="optional">
+      <ulink url="https://netfilter.org/projects/conntrack-tools/index.html">
+      contrack-tools</ulink>
+      <ulink url="https://netfilter.org/projects/nfacct/index.html">
+      nfacct</ulink>
+      <ulink url="https://netfilter.org/projects/ulogd/index.html">
+      ulogd</ulink>
+    </para>
+
+    <para condition="html" role="usernotes">User Notes:
+      <ulink url="&blfs-wiki;/nftables"/>
+    </para>
+  </sect2>
+
+    <sect2 role="kernel">
+      <title>Kernel Configuration</title>
+
+    <para>
+      Enable the following options in the kernel configuration and recompile the
+      kernel if necessary (add any additional nf_tables features as needed):
+    </para>
+
+<screen><literal>[*] Networking support [CONFIG_NET] ---&gt;
+    Networking options ---&gt;
+    [*] Network packet filtering framework (Netfilter) [CONFIG_NETFILTER] ---&gt;
+        Core Netfilter Configuration ---&gt;
+          &lt;*&gt; * protocol support [CONFIG_NF_CONNTRACK_*]
+          &lt;*&gt; Netfilter nf_tables support [CONFIG_NF_TABLES]
+          [*]   Netfilter nf_tables * support [CONFIG_NF_TABLES_*]</literal></screen>
+
+    <para>
+      Include any connection tracking protocols that will be used, and
+      any protocols that you wish to use for match suppport under the
+      "Core Netfilter Configuration" section. Additionally, include any
+      "Netfilter nf_tables * module" that will be used under the
+      "Netfilter nf_tables support" section.
+    </para>
+
+
+    </sect2>
+
+  <sect2 role="installation">
+    <title>Installation of nftables</title>
+
+    <para>
+      Install <application>nftables</application> by running the following
+      commands:
+    </para>
+
+<screen><userinput>./configure --prefix=/usr     \
+            --sbindir=/sbin   \
+            --sysconfdir=/etc \
+            --with-json       \
+            --with-python-bin=/usr/bin/python3 &amp;&amp;
+make</userinput></screen>
+
+    <para>
+      This package does not come with a test suite.
+    </para>
+
+    <para>
+      Now, as the <systemitem class="username">root</systemitem> user:
+    </para>
+
+<screen role="root"><userinput>make install                   &amp;&amp;
+mv /usr/lib/libnftables.so.* /lib &amp;&amp;
+ln -sfv ../../lib/$(readlink /usr/lib/libnftables.so) /usr/lib/libnftables.so</userinput></screen>
+
+  </sect2>
+
+  <sect2 role="commands">
+    <title>Command Explanations</title>
+
+<!-- there is no disable-static option in the configure string
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
+      href="../../xincludes/static-libraries.xml"/>
+-->
+    <para>
+      <parameter>--with-json</parameter>: build with support for JSON rules.
+      Omit if <xref linkend="jansson"/> is not available.
+    </para>
+
+    <para>
+      <parameter>--with-python-bin=/usr/bin/python3</parameter>: force use of
+      <application>Python3</application>.
+    </para>
+
+    <para>
+      <option>--enable-man-doc</option>: build man pages if
+      <xref linkend="asciidoc"/> is installed (required if adding
+      json support).
+    </para>
+
+    <para>
+      <option>--with-xtables</option>: build with
+      <xref linkend="iptables"/> libxtables support.
+    </para>
+
+    <para>
+      <command>mv -v /usr/lib/nftables.so.* ...</command>: Move shared
+      libraries into /lib so they are available before /usr is mounted.
+    </para>
+
+  </sect2>
+
+  <sect2 role="configuration">
+    <title>Configuring nftables</title>
+
+    <note>
+      <para>
+        If you intend to use <xref linkend="firewalld"/> to configure your
+        firewall rules, you should not use the example configuration provided
+        here, nor should you enable the
+        <phrase revision="sysv">bootscript.</phrase>
+        <phrase revision="systemd">systemd unit.</phrase>
+      </para>
+    </note>
+
+    <sect3 id="fw-masqRouter-nft"
+     xreflabel="Creating a Masquerading Router With nftables">
+      <title>Masquerading Router</title>
+
+      <para>
+        A network Firewall has two interfaces, one connected to an
+        intranet, in this example <emphasis role="strong">LAN1</emphasis>,
+        and one connected to the Internet, here <emphasis
+        role="strong">WAN1</emphasis>. You will need to adjust these value to
+        match your particular system. To provide the maximum security
+        for the firewall itself, make sure that there are no unnecessary
+        servers running on it such as <application>X11</application> et al.
+        As a general principle, the firewall itself should not access
+        any untrusted service (think of a remote server giving answers that
+        makes a daemon on your system crash, or even worse, that implements
+        a worm via a buffer-overflow).
+      </para>
+
+    <note>
+      <para>
+        In the following example configuration, <emphasis
+        role="strong">LAN1</emphasis> is used for the internal LAN interface,
+        and <emphasis role="strong">WAN1</emphasis> is used for the external
+        interface connected to the Internet. You will need to replace these
+        values with appropriate interface names for your system.
+      </para>
+    </note>
+
+
+<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/nftables/nftables.conf &lt;&lt; "EOF"
+<literal>#!/sbin/nft -f
+
+# You're using the example configuration for a setup of a firewall
+# from Beyond Linux From Scratch.
+#
+# This example is far from being complete, it is only meant
+# to be a reference.
+#
+# Firewall security is a complex issue, that exceeds the scope
+# of the configuration rules below.
+#
+# You can find additional information
+# about firewalls in Chapter 4 of the BLFS book.
+# http://www.&lfs-domainname;/blfs
+
+# Drop all existing rules
+flush ruleset
+
+# Filter for both ip4 and ip6 (inet)
+table inet filter {
+
+        # filter incomming packets
+        chain input {
+
+                # Drop everything that doesn't match policy
+                type filter hook input priority 0; policy drop;
+
+                # accept packets for established connections
+                ct state { established, related } accept
+
+                # Drop packets that have a connection state of invalid
+                ct state invalid drop
+
+                # Allow connections to the loopback adapter
+                iifname "lo" accept
+
+                # Allow connections to the LAN1 interface
+                iifname "LAN1" accept
+
+                # Accept icmp requests
+                ip protocol icmp accept
+
+                # Allow ssh connections on LAN1
+                iifname "LAN1" tcp dport ssh accept
+
+                # Drop everything else
+                drop
+        }
+
+        # Allow forwarding for external connections to WAN1
+        chain forward {
+
+                # Drop if it doesn't match policy
+                type filter hook forward priority 0; policy drop;
+
+                # Accept connections on WAN1
+                oifname "WAN1" accept
+
+                # Allow forwarding to another host via this interface
+                # Uncomment the following line to allow connections
+                # ip daddr 192.168.0.2 ct status dnat accept
+
+                # Allow established and related connections
+                iifname "WAN1" ct state { established, related } accept
+        }
+
+        # Filter output traffic
+        chain output {
+
+                # Allow everything outbound
+                type filter hook output priority 0; policy accept;
+        }
+}
+
+# Allow NAT for ip protocol (both ip4 and ip6)
+table ip nat {
+
+        chain prerouting {
+
+                # Accept on inbound interface for policy match
+                type nat hook prerouting priority 0; policy accept;
+
+                # Accept http and https on 192.168.0.2
+                # Uncomment the following line to allow http and https
+                #iifname "WAN1" tcp dport { http, https } dnat to 192.168.0.2
+        }
+
+        chain postrouting {
+
+                # accept outbound
+                type nat hook postrouting priority 0; policy accept;
+
+                # Masquerade on WAN1 outbound
+                oifname "WAN1" masquerade
+        }
+}</literal>
+EOF</userinput></screen>
+
+      <para>
+        With this configuration your intranet should be reasonably secure
+        against external attacks. No one should be able to setup a new
+        connection to any internal service not configured above.
+      </para>
+
+      <para>
+        There are several other examples in the
+        <filename class="directory">/etc/nftables</filename> directory.
+      </para>
+
+    </sect3>
+
+    <sect3  id="nftables-init">
+      <title><phrase revision="sysv">Boot Script</phrase>
+             <phrase revision="systemd">Systemd Unit</phrase></title>
+
+      <para revision="sysv">
+        To set up the nftables firewall at boot, install the
+        <filename>/etc/rc.d/init.d/nftables</filename> init script included
+        in the <xref linkend="bootscripts"/> package.
+      </para>
+
+      <para revision="systemd">
+        To set up the nftables firewall at boot, install the
+        <filename>nftables.service</filename> unit included in the
+        <xref linkend="systemd-units"/> package.
+      </para>
+
+      <indexterm zone="nftables nftables-init">
+        <primary sortas="f-nftables">nftables</primary>
+      </indexterm>
+
+<screen role="root"><userinput>make install-nftables</userinput></screen>
+
+    </sect3>
+
+  </sect2>
+
+  <sect2 role="content">
+    <title>Contents</title>
+
+    <segmentedlist>
+      <segtitle>Installed Programs</segtitle>
+      <segtitle>Installed Libraries</segtitle>
+      <segtitle>Installed Directories</segtitle>
+
+      <seglistitem>
+        <seg>
+          nft
+        </seg>
+        <seg>
+          libnftables.{a,so}
+        </seg>
+        <seg>
+          /etc/nftables
+        </seg>
+      </seglistitem>
+    </segmentedlist>
+
+    <variablelist>
+      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
+      <?dbfo list-presentation="list"?>
+      <?dbhtml list-presentation="table"?>
+
+      <varlistentry id="nft">
+        <term><filename>nft</filename></term>
+        <listitem>
+          <para>
+            command line interface for the nf_tables subsystem.
+          </para>
+          <indexterm zone="nftables nft">
+            <primary sortas="a-nft">nft</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry id="libnftables">
+        <term><filename class="libraryfile">libnftables.{a,so}</filename></term>
+        <listitem>
+          <para>
+            provides functions for manipulating the nf_tables subsystem.
+          </para>
+          <indexterm zone="nftables libnftables">
+            <primary sortas="c-libnftables">libnftables.so</primary>
+          </indexterm>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
+
+  </sect2>
+
+</sect1>
Index: stlfs/security/firewalld.xml
===================================================================
--- postlfs/security/firewalld.xml	(revision 0aa72821d1ac3df6e85bb5340b230cd16eb52703)
+++ 	(revision )
@@ -1,336 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY firewalld-download-http "https://github.com/firewalld/firewalld/releases/download/v&firewalld-version;/firewalld-&firewalld-version;.tar.gz">
-  <!ENTITY firewalld-download-ftp  " ">
-  <!ENTITY firewalld-md5sum        "644a8970b43fcf875178ae3bec640db4">
-  <!ENTITY firewalld-size          "1.6 MB">
-  <!ENTITY firewalld-buildsize     "19 MB (additionall 2 MB for tests)">
-  <!ENTITY firewalld-time          "less than 0.1 SBU (add 6.2 SBU for tests)">
-]>
-
-<sect1 id="firewalld" xreflabel="firewalld-&firewalld-version;">
-  <?dbhtml filename="firewalld.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>firewalld-&firewalld-version;</title>
-
-  <indexterm zone="firewalld">
-    <primary sortas="a-firewalld">firewalld</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to firewalld</title>
-
-    <para>
-      The <application>firewalld</application> package provides a dynamically
-      managed firewall with support for network or firewall zones to define the
-      trust level of network connections or interfaces. It has support for
-      IPv4, IPv6 firewall settings and for ethernet bridges and a separation of
-      runtime and permanent configuration options. It also provides an
-      interface for services or applications to add nftables or iptables and
-      ebtables rules directly.
-    </para>
-
-    &lfs90_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing="compact">
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&firewalld-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&firewalld-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &firewalld-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &firewalld-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &firewalld-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &firewalld-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">firewalld Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="nftables"/>,
-      and <xref linkend="python-slip"/>
-    </para>
-
-    <bridgehead renderas="sect4">Recommended</bridgehead>
-    <para role="recommended">
-      <xref linkend="DocBook"/>,
-      <xref linkend="iptables"/>, and
-      <xref linkend="libxslt"/> (for building the manual pages)
-    </para>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <xref linkend="gtk3" role="runtime"/> (runtime only, required for
-      <application>fireall-config</application>),
-      <xref linkend="qt5" role="runtime"/> (runtime only, required for 
-      <application>fireall-applet</application>), and
-      <ulink url="https://netfilter.org/projects/ipset/index.html">ipset</ulink>
-      for ipset support (only when used with iptables)
-    </para>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/firewalld"/>
-    </para>
-  </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of firewalld</title>
-
-    <para>
-      Install <application>firewalld</application> by
-      running the following commands:
-    </para>
-
-<screen revision="systemd"><userinput>PYTHON=/usr/bin/python3           \
-    ./configure --sysconfdir=/etc \
-                --without-ipset   &amp;&amp;
-make</userinput></screen>
-
-<screen revision="sysv"><userinput>PYTHON=/usr/bin/python3           \
-    ./configure --sysconfdir=/etc \
-                --without-ipset   \
-                --disable-systemd &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      The testsuite for <application>firewalld</application> is very dependent
-      on the running kernel and system configuration. It requires
-      <application>ipset</application> as well as both backends, and all
-      supported kernel options available.
-    </para>
-
-    <para>
-      If the above conditions are met, run the testsuite as the
-      <systemitem class="username">root</systemitem> user with the command
-      <command>make -C src check</command>. Any test failures are likely the
-      result of an incomplete configuration. Failed tests will give a detailed
-      failure status at
-      <filename>src/test/testsuite.dir/&lt;###&gt;/testsuite.log</filename>.
-    </para>
-
-    <para revision="sysv">
-      Prevent installation of the distributed firewalld init script with the
-      following command:
-    </para>
-
-<screen revision="sysv"><userinput>sed '/^am__append_3/,+1d' -i config/Makefile</userinput></screen>
-
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-    <para>
-      <parameter>--without-ipset</parameter>: This switch disables use of the
-      <command>ipset</command> utility. Omit if it is installed.
-    </para>
-
-    <para revision="sysv">
-      <parameter>--disable-systemd</parameter>: This command prevents
-      installation of <application>systemd</application> services.
-    </para>
-
-    <para>
-      <option>--without-{ip{,6},eb}tables{,-restore}</option>: These switches
-      disable <application>iptables</application> support and are required if
-      you wish to build without iptables support.
-    </para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring firewalld</title>
-
-    <sect3 id="firewalld-conf">
-      <title>Config Files</title>
-
-      <para>
-        <filename>/etc/firewall/applet.conf</filename>,
-        <filename>/etc/firewalld/firewalld.conf</filename>,
-        and <filename>/etc/sysconfig/firewalld</filename>
-      </para>
-
-      <indexterm zone="firewalld firewalld-conf">
-        <primary sortas="e-etc-firewalld.conf">/etc/firewalld/firewalld.conf</primary>
-      </indexterm>
-
-      <para>
-        Configuration of <application>firewalld</application> is generally done
-        without modification of the above configuration files using the
-        <command>firewall-cmd</command> command. Within the above configuration
-        files you can set daemon behavior only. E.g.: whether runtime rules are
-        retained on restart, which firewall backend to use (default is
-        nftables), or whether to turn on debugging.
-      </para>
-
-      <para>
-        Detailed documentation is provided by the
-        <application>firewalld</application> developers at
-        <ulink url="https://firewalld.org/documentation/"/>.
-      </para>
-
-    </sect3>
-
-    <sect3 id="firewalld-init">
-      <title><phrase revision="sysv">Init Script</phrase>
-             <phrase revision="systemd">Systemd Unit</phrase></title>
-
-      <para revision="sysv">
-        If you need to run the <command>firewalld</command> daemon at system
-        startup, install the <filename>/etc/rc.d/init.d/firewalld</filename>
-        init script included in the
-        <xref linkend="bootscripts"/> package using the following command:
-      </para>
-
-      <para revision="systemd">
-        If you need to run the <command>firewalld</command> daemon at system
-        startup, enable the previously installed
-        <filename>firewalld.service</filename> unit with the following command:
-      </para>
-
-      <indexterm zone="firewalld firewalld-init">
-        <primary sortas="f-firewalld">firewalld</primary>
-      </indexterm>
-
-<screen role="root" revision="sysv"><userinput>make install-firewalld</userinput></screen>
-
-<screen role="root" revision="systemd"><userinput>systemctl enable firewalld</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>
-          firewall-applet, firewall-cmd, firewall-config, firewall-offline-cmd,
-          and firewalld
-        </seg>
-        <seg>
-          None
-        </seg>
-        <seg>
-          /etc/firewalld,
-          /etc/firewall,
-          /usr/lib/firewalld, and
-          /usr/lib/python-&python3-version;/site-packages/firewall
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="firewall-applet">
-        <term><command>firewall-applet</command></term>
-        <listitem>
-          <para>
-            is a tray applet using QSettings backend.
-          </para>
-          <indexterm zone="firewalld firewall-applet">
-            <primary sortas="b-firewall-applet">firwall-applet</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="firewall-cmd">
-        <term><command>firewall-cmd</command></term>
-        <listitem>
-          <para>
-            is the primary command line frontend.
-          </para>
-          <indexterm zone="firewalld firewall-cmd">
-            <primary sortas="b-firewall-cmd">firewall-cmd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="firewall-config">
-        <term><command>firewall-config</command></term>
-        <listitem>
-          <para>
-            is a GUI configuration tool using GTK+-3.
-          </para>
-          <indexterm zone="firewalld firewall-config">
-            <primary sortas="b-firewall-config">firewall-config</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="firewall-offline-cmd">
-        <term><command>firewall-offline-cmd</command></term>
-        <listitem>
-          <para>
-            is a command line client used for permanent configuration while
-            firewalld is not running.
-          </para>
-          <indexterm zone="firewalld firewall-offline-cmd">
-            <primary sortas="b-firewall-offline-cmd">firewall-offline-cmd</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="firewalld-daemon">
-        <term><command>firewalld</command></term>
-        <listitem>
-          <para>
-            is the Dynamic Firewall Manager daemon.
-          </para>
-          <indexterm zone="firewalld firewalld-daemon">
-            <primary sortas="b-firewalld">firewalld</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
Index: stlfs/security/nftables.xml
===================================================================
--- postlfs/security/nftables.xml	(revision 0aa72821d1ac3df6e85bb5340b230cd16eb52703)
+++ 	(revision )
@@ -1,434 +1,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
-   "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
-  <!ENTITY % general-entities SYSTEM "../../general.ent">
-  %general-entities;
-
-  <!ENTITY nftables-download-http "https://netfilter.org/projects/nftables/files/nftables-&nftables-version;.tar.bz2">
-  <!ENTITY nftables-download-ftp  " ">
-  <!ENTITY nftables-md5sum        "9913b2b46864394d41916b74638e0875">
-  <!ENTITY nftables-size          "772 KB">
-  <!ENTITY nftables-buildsize     "34 MB">
-  <!ENTITY nftables-time          "0.2 SBU">
-]>
-
-<sect1 id="nftables" xreflabel="nftables-&nftables-version;">
-  <?dbhtml filename="nftables.html"?>
-
-  <sect1info>
-    <othername>$LastChangedBy$</othername>
-    <date>$Date$</date>
-  </sect1info>
-
-  <title>nftables-&nftables-version;</title>
-
-  <indexterm zone="nftables">
-    <primary sortas="a-nftables">nftables</primary>
-  </indexterm>
-
-  <sect2 role="package">
-    <title>Introduction to nftables</title>
-
-    <para>
-      The <application>nftables</application> package, intended to be the
-      successor to <xref linkend="iptables"/>,  provides a low-level netlink
-      programming interface (API), and userspace uitlities for the in-kernel
-      nf_tables subsystem.
-    </para>
-
-    &lfs90_checked;
-
-    <bridgehead renderas="sect3">Package Information</bridgehead>
-    <itemizedlist spacing='compact'>
-      <listitem>
-        <para>
-          Download (HTTP): <ulink url="&nftables-download-http;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download (FTP): <ulink url="&nftables-download-ftp;"/>
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download MD5 sum: &nftables-md5sum;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Download size: &nftables-size;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated disk space required: &nftables-buildsize;
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Estimated build time: &nftables-time;
-        </para>
-      </listitem>
-    </itemizedlist>
-
-    <bridgehead renderas="sect3">nftables Dependencies</bridgehead>
-
-    <bridgehead renderas="sect4">Required</bridgehead>
-    <para role="required">
-      <xref linkend="libnftnl"/>
-    </para>
-
-    <bridgehead renderas="sect4">Recommended</bridgehead>
-    <para role="recommended">
-        <xref linkend="jansson"/> (for JSON rules table support)
-    </para>
-
-    <bridgehead renderas="sect4">Optional</bridgehead>
-    <para role="optional">
-      <xref linkend="iptables"/> and
-      <xref linkend="docbook-utils"/>
-    </para>
-
-    <bridgehead renderas="sect4">Optional (runtime)</bridgehead>
-
-    <para role="optional">
-      <ulink url="https://netfilter.org/projects/conntrack-tools/index.html">
-      contrack-tools</ulink>
-      <ulink url="https://netfilter.org/projects/nfacct/index.html">
-      nfacct</ulink>
-      <ulink url="https://netfilter.org/projects/ulogd/index.html">
-      ulogd</ulink>
-    </para>
-
-    <para condition="html" role="usernotes">User Notes:
-      <ulink url="&blfs-wiki;/nftables"/>
-    </para>
-  </sect2>
-
-    <sect2 role="kernel">
-      <title>Kernel Configuration</title>
-
-    <para>
-      Enable the following options in the kernel configuration and recompile the
-      kernel if necessary (add any additional nf_tables features as needed):
-    </para>
-
-<screen><literal>[*] Networking support [CONFIG_NET] ---&gt;
-    Networking options ---&gt;
-    [*] Network packet filtering framework (Netfilter) [CONFIG_NETFILTER] ---&gt;
-        Core Netfilter Configuration ---&gt;
-          &lt;*&gt; * protocol support [CONFIG_NF_CONNTRACK_*]
-          &lt;*&gt; Netfilter nf_tables support [CONFIG_NF_TABLES]
-          [*]   Netfilter nf_tables * support [CONFIG_NF_TABLES_*]</literal></screen>
-
-    <para>
-      Include any connection tracking protocols that will be used, and
-      any protocols that you wish to use for match suppport under the
-      "Core Netfilter Configuration" section. Additionally, include any
-      "Netfilter nf_tables * module" that will be used under the
-      "Netfilter nf_tables support" section.
-    </para>
-
-
-    </sect2>
-
-  <sect2 role="installation">
-    <title>Installation of nftables</title>
-
-    <para>
-      Install <application>nftables</application> by running the following
-      commands:
-    </para>
-
-<screen><userinput>./configure --prefix=/usr     \
-            --sbindir=/sbin   \
-            --sysconfdir=/etc \
-            --with-json       \
-            --with-python-bin=/usr/bin/python3 &amp;&amp;
-make</userinput></screen>
-
-    <para>
-      This package does not come with a test suite.
-    </para>
-
-    <para>
-      Now, as the <systemitem class="username">root</systemitem> user:
-    </para>
-
-<screen role="root"><userinput>make install                   &amp;&amp;
-mv /usr/lib/libnftables.so.* /lib &amp;&amp;
-ln -sfv ../../lib/$(readlink /usr/lib/libnftables.so) /usr/lib/libnftables.so</userinput></screen>
-
-  </sect2>
-
-  <sect2 role="commands">
-    <title>Command Explanations</title>
-
-<!-- there is no disable-static option in the configure string
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"
-      href="../../xincludes/static-libraries.xml"/>
--->
-    <para>
-      <parameter>--with-json</parameter>: build with support for JSON rules.
-      Omit if <xref linkend="jansson"/> is not available.
-    </para>
-
-    <para>
-      <parameter>--with-python-bin=/usr/bin/python3</parameter>: force use of
-      <application>Python3</application>.
-    </para>
-
-    <para>
-      <option>--enable-man-doc</option>: build man pages if
-      <xref linkend="asciidoc"/> is installed (required if adding
-      json support).
-    </para>
-
-    <para>
-      <option>--with-xtables</option>: build with
-      <xref linkend="iptables"/> libxtables support.
-    </para>
-
-    <para>
-      <command>mv -v /usr/lib/nftables.so.* ...</command>: Move shared
-      libraries into /lib so they are available before /usr is mounted.
-    </para>
-
-  </sect2>
-
-  <sect2 role="configuration">
-    <title>Configuring nftables</title>
-
-    <note>
-      <para>
-        If you intend to use <xref linkend="firewalld"/> to configure your
-        firewall rules, you should not use the example configuration provided
-        here, nor should you enable the
-        <phrase revision="sysv">bootscript.</phrase>
-        <phrase revision="systemd">systemd unit.</phrase>
-      </para>
-    </note>
-
-    <sect3 id="fw-masqRouter-nft"
-     xreflabel="Creating a Masquerading Router With nftables">
-      <title>Masquerading Router</title>
-
-      <para>
-        A network Firewall has two interfaces, one connected to an
-        intranet, in this example <emphasis role="strong">LAN1</emphasis>,
-        and one connected to the Internet, here <emphasis
-        role="strong">WAN1</emphasis>. You will need to adjust these value to
-        match your particular system. To provide the maximum security
-        for the firewall itself, make sure that there are no unnecessary
-        servers running on it such as <application>X11</application> et al.
-        As a general principle, the firewall itself should not access
-        any untrusted service (think of a remote server giving answers that
-        makes a daemon on your system crash, or even worse, that implements
-        a worm via a buffer-overflow).
-      </para>
-
-    <note>
-      <para>
-        In the following example configuration, <emphasis
-        role="strong">LAN1</emphasis> is used for the internal LAN interface,
-        and <emphasis role="strong">WAN1</emphasis> is used for the external
-        interface connected to the Internet. You will need to replace these
-        values with appropriate interface names for your system.
-      </para>
-    </note>
-
-
-<screen role="root"><?dbfo keep-together="auto"?><userinput>cat &gt; /etc/nftables/nftables.conf &lt;&lt; "EOF"
-<literal>#!/sbin/nft -f
-
-# You're using the example configuration for a setup of a firewall
-# from Beyond Linux From Scratch.
-#
-# This example is far from being complete, it is only meant
-# to be a reference.
-#
-# Firewall security is a complex issue, that exceeds the scope
-# of the configuration rules below.
-#
-# You can find additional information
-# about firewalls in Chapter 4 of the BLFS book.
-# http://www.&lfs-domainname;/blfs
-
-# Drop all existing rules
-flush ruleset
-
-# Filter for both ip4 and ip6 (inet)
-table inet filter {
-
-        # filter incomming packets
-        chain input {
-
-                # Drop everything that doesn't match policy
-                type filter hook input priority 0; policy drop;
-
-                # accept packets for established connections
-                ct state { established, related } accept
-
-                # Drop packets that have a connection state of invalid
-                ct state invalid drop
-
-                # Allow connections to the loopback adapter
-                iifname "lo" accept
-
-                # Allow connections to the LAN1 interface
-                iifname "LAN1" accept
-
-                # Accept icmp requests
-                ip protocol icmp accept
-
-                # Allow ssh connections on LAN1
-                iifname "LAN1" tcp dport ssh accept
-
-                # Drop everything else
-                drop
-        }
-
-        # Allow forwarding for external connections to WAN1
-        chain forward {
-
-                # Drop if it doesn't match policy
-                type filter hook forward priority 0; policy drop;
-
-                # Accept connections on WAN1
-                oifname "WAN1" accept
-
-                # Allow forwarding to another host via this interface
-                # Uncomment the following line to allow connections
-                # ip daddr 192.168.0.2 ct status dnat accept
-
-                # Allow established and related connections
-                iifname "WAN1" ct state { established, related } accept
-        }
-
-        # Filter output traffic
-        chain output {
-
-                # Allow everything outbound
-                type filter hook output priority 0; policy accept;
-        }
-}
-
-# Allow NAT for ip protocol (both ip4 and ip6)
-table ip nat {
-
-        chain prerouting {
-
-                # Accept on inbound interface for policy match
-                type nat hook prerouting priority 0; policy accept;
-
-                # Accept http and https on 192.168.0.2
-                # Uncomment the following line to allow http and https
-                #iifname "WAN1" tcp dport { http, https } dnat to 192.168.0.2
-        }
-
-        chain postrouting {
-
-                # accept outbound
-                type nat hook postrouting priority 0; policy accept;
-
-                # Masquerade on WAN1 outbound
-                oifname "WAN1" masquerade
-        }
-}</literal>
-EOF</userinput></screen>
-
-      <para>
-        With this configuration your intranet should be reasonably secure
-        against external attacks. No one should be able to setup a new
-        connection to any internal service not configured above.
-      </para>
-
-      <para>
-        There are several other examples in the
-        <filename class="directory">/etc/nftables</filename> directory.
-      </para>
-
-    </sect3>
-
-    <sect3  id="nftables-init">
-      <title><phrase revision="sysv">Boot Script</phrase>
-             <phrase revision="systemd">Systemd Unit</phrase></title>
-
-      <para revision="sysv">
-        To set up the nftables firewall at boot, install the
-        <filename>/etc/rc.d/init.d/nftables</filename> init script included
-        in the <xref linkend="bootscripts"/> package.
-      </para>
-
-      <para revision="systemd">
-        To set up the nftables firewall at boot, install the
-        <filename>nftables.service</filename> unit included in the
-        <xref linkend="systemd-units"/> package.
-      </para>
-
-      <indexterm zone="nftables nftables-init">
-        <primary sortas="f-nftables">nftables</primary>
-      </indexterm>
-
-<screen role="root"><userinput>make install-nftables</userinput></screen>
-
-    </sect3>
-
-  </sect2>
-
-  <sect2 role="content">
-    <title>Contents</title>
-
-    <segmentedlist>
-      <segtitle>Installed Programs</segtitle>
-      <segtitle>Installed Libraries</segtitle>
-      <segtitle>Installed Directories</segtitle>
-
-      <seglistitem>
-        <seg>
-          nft
-        </seg>
-        <seg>
-          libnftables.{a,so}
-        </seg>
-        <seg>
-          /etc/nftables
-        </seg>
-      </seglistitem>
-    </segmentedlist>
-
-    <variablelist>
-      <bridgehead renderas="sect3">Short Descriptions</bridgehead>
-      <?dbfo list-presentation="list"?>
-      <?dbhtml list-presentation="table"?>
-
-      <varlistentry id="nft">
-        <term><filename>nft</filename></term>
-        <listitem>
-          <para>
-            command line interface for the nf_tables subsystem.
-          </para>
-          <indexterm zone="nftables nft">
-            <primary sortas="a-nft">nft</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry id="libnftables">
-        <term><filename class="libraryfile">libnftables.{a,so}</filename></term>
-        <listitem>
-          <para>
-            provides functions for manipulating the nf_tables subsystem.
-          </para>
-          <indexterm zone="nftables libnftables">
-            <primary sortas="c-libnftables">libnftables.so</primary>
-          </indexterm>
-        </listitem>
-      </varlistentry>
-
-    </variablelist>
-
-  </sect2>
-
-</sect1>
