- Pull in upstream fix for too strict command option parsing

upstream patch 192c3a6bc18f206895ec5e38812d648ccfe7e281

	xshared: Accept an option if any given command allows it

	Fixed commit made option checking overly strict: Some commands may be
	commbined (foremost --list and --zero), reject a given option only if it
	is not allowed by any of the given commands.

.gitignore

@@ -15,3 +15,5 @@
 /iptables-1.8.9.tar.xz
 /iptables-1.8.10.tar.xz
 /iptables-1.8.10.tar.xz.sig
+/iptables-1.8.11.tar.xz
+/iptables-1.8.11.tar.xz.sig

0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch

@@ -1,81 +0,0 @@
-From 88d7c7c51b4523add8b7d48209b5b6a316442e0f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 12 Oct 2023 17:27:42 +0200
-Subject: [PATCH] libiptc: Fix for another segfault due to chain index NULL
- pointer
-
-Chain rename code missed to adjust the num_chains value which is used to
-calculate the number of chain index buckets to allocate during an index
-rebuild. So with the right number of chains present, the last chain in a
-middle bucket being renamed (and ending up in another bucket) triggers
-an index rebuild based on false data. The resulting NULL pointer index
-bucket then causes a segfault upon reinsertion.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1713
-Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc")
-(cherry picked from commit e2d7ee9c49b582f399ad4ba2da2ee1b3e1f89620)
----
- .../testcases/chain/0008rename-segfault2_0    | 32 +++++++++++++++++++
- libiptc/libiptc.c                             |  4 +++
- 2 files changed, 36 insertions(+)
- create mode 100755 iptables/tests/shell/testcases/chain/0008rename-segfault2_0
-
-diff --git a/iptables/tests/shell/testcases/chain/0008rename-segfault2_0 b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0
-new file mode 100755
-index 0000000000000..bc473d2511bbd
---- /dev/null
-+++ b/iptables/tests/shell/testcases/chain/0008rename-segfault2_0
-@@ -0,0 +1,32 @@
-+#!/bin/bash
-+#
-+# Another funny rename bug in libiptc:
-+# If there is a chain index bucket with only a single chain in it and it is not
-+# the last one and that chain is renamed, a chain index rebuild is triggered.
-+# Since TC_RENAME_CHAIN missed to temporarily decrement num_chains value, an
-+# extra index is allocated and remains NULL. The following insert of renamed
-+# chain then segfaults.
-+
-+(
-+	echo "*filter"
-+	# first bucket
-+	for ((i = 0; i < 40; i++)); do
-+		echo ":chain-a-$i - [0:0]"
-+	done
-+	# second bucket
-+	for ((i = 0; i < 40; i++)); do
-+		echo ":chain-b-$i - [0:0]"
-+	done
-+	# third bucket, just make sure it exists
-+	echo ":chain-c-0 - [0:0]"
-+	echo "COMMIT"
-+) | $XT_MULTI iptables-restore
-+
-+# rename all chains of the middle bucket
-+(
-+	echo "*filter"
-+	for ((i = 0; i < 40; i++)); do
-+		echo "-E chain-b-$i chain-d-$i"
-+	done
-+	echo "COMMIT"
-+) | $XT_MULTI iptables-restore --noflush
-diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c
-index e475063367c26..9712a36353b9a 100644
---- a/libiptc/libiptc.c
-+++ b/libiptc/libiptc.c
-@@ -2384,12 +2384,16 @@ int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname,
- 		return 0;
- 	}
- 
-+	handle->num_chains--;
-+
- 	/* This only unlinks "c" from the list, thus no free(c) */
- 	iptcc_chain_index_delete_chain(c, handle);
- 
- 	/* Change the name of the chain */
- 	strncpy(c->name, newname, sizeof(IPT_CHAINLABEL) - 1);
- 
-+	handle->num_chains++;
-+
- 	/* Insert sorted into to list again */
- 	iptc_insert_chain(handle, c);
- 

0002-arptables-nft-remove-ARPT_INV-flags-usage.patch

@@ -1,81 +0,0 @@
-From 5d2e24d37d56eef0570aca06b590079527678707 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Fri, 3 Nov 2023 17:33:22 +0100
-Subject: [PATCH] arptables-nft: remove ARPT_INV flags usage
-
-ARPT_ and IPT_INV flags are not interchangeable, e.g.:
-define IPT_INV_SRCDEVADDR	0x0080
-define ARPT_INV_SRCDEVADDR	0x0010
-
-as these flags can be tested by libarp_foo.so such checks can yield
-incorrect results.
-
-Because arptables-nft uses existing code, e.g. xt_mark, it makes
-sense to unify this completely by converting the last users of
-ARPT_INV_ constants.
-
-Note that arptables-legacy does not do run-time module loading via
-dlopen(). Functionaliy implemented by "extensions" in the
-arptables-legacy git tree are built-in, so this doesn't break
-arptables-legacy binaries.
-
-Fixes: 44457c080590 ("xtables-arp: Don't use ARPT_INV_*")
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 3493d40cbba9dbfc00018b419241c93646a97a68)
----
- extensions/libarpt_mangle.c | 4 ++--
- iptables/nft-arp.c          | 2 +-
- iptables/xshared.h          | 4 +++-
- 3 files changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/extensions/libarpt_mangle.c b/extensions/libarpt_mangle.c
-index 765edf34781f3..a846e97ec8f27 100644
---- a/extensions/libarpt_mangle.c
-+++ b/extensions/libarpt_mangle.c
-@@ -77,7 +77,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags,
- 		if (e->arp.arhln_mask == 0)
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "no --h-length defined");
--		if (e->arp.invflags & ARPT_INV_ARPHLN)
-+		if (e->arp.invflags & IPT_INV_ARPHLN)
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "! --h-length not allowed for "
- 				      "--mangle-mac-s");
-@@ -95,7 +95,7 @@ arpmangle_parse(int c, char **argv, int invert, unsigned int *flags,
- 		if (e->arp.arhln_mask == 0)
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "no --h-length defined");
--		if (e->arp.invflags & ARPT_INV_ARPHLN)
-+		if (e->arp.invflags & IPT_INV_ARPHLN)
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "! hln not allowed for --mangle-mac-d");
- 		if (e->arp.arhln != 6)
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index aed39ebdd5166..535dd6b83237b 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -490,7 +490,7 @@ static void nft_arp_post_parse(int command,
- 					 &args->d.naddrs);
- 
- 	if ((args->s.naddrs > 1 || args->d.naddrs > 1) &&
--	    (cs->arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP)))
-+	    (cs->arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP)))
- 		xtables_error(PARAMETER_PROBLEM,
- 			      "! not allowed with multiple"
- 			      " source or destination IP addresses");
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index a200e0d620ad3..5586385456a4d 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -80,7 +80,9 @@ struct xtables_target;
- #define ARPT_OPTSTRING	OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */
- #define EBT_OPTSTRING	OPTSTRING_COMMON "hv"
- 
--/* define invflags which won't collide with IPT ones */
-+/* define invflags which won't collide with IPT ones.
-+ * arptables-nft does NOT use the legacy ARPT_INV_* defines.
-+ */
- #define IPT_INV_SRCDEVADDR	0x0080
- #define IPT_INV_TGTDEVADDR	0x0100
- #define IPT_INV_ARPHLN		0x0200

0003-ebtables-Fix-corner-case-noflush-restore-bug.patch

@@ -1,63 +0,0 @@
-From b7051898e28854b21bc7a37ef24ca037ef977e4a Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 7 Nov 2023 19:12:14 +0100
-Subject: [PATCH] ebtables: Fix corner-case noflush restore bug
-
-Report came from firwalld, but this is actually rather hard to trigger.
-Since a regular chain line prevents it, typical dump/restore use-cases
-are unaffected.
-
-Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation")
-Cc: Eric Garver <eric@garver.life>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c1083acea70787eea3f7929fd04718434bb05ba8)
----
- .../testcases/ebtables/0009-broute-bug_0      | 25 +++++++++++++++++++
- iptables/xtables-eb.c                         |  2 ++
- 2 files changed, 27 insertions(+)
- create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
-
-diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
-new file mode 100755
-index 0000000000000..0def0ac58e7be
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
-@@ -0,0 +1,25 @@
-+#!/bin/sh
-+#
-+# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring:
-+# - with --noflush
-+# - a second table after the broute one
-+# - A policy command but no chain line for BROUTING chain
-+
-+set -e
-+
-+case "$XT_MULTI" in
-+*xtables-nft-multi)
-+	;;
-+*)
-+	echo "skip $XT_MULTI"
-+	exit 0
-+	;;
-+esac
-+
-+$XT_MULTI ebtables-restore --noflush <<EOF
-+*broute
-+-P BROUTING ACCEPT
-+*nat
-+-P PREROUTING ACCEPT
-+COMMIT
-+EOF
-diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index 08eec79d80400..a8ad57c735cc5 100644
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -169,6 +169,8 @@ int ebt_get_current_chain(const char *chain)
- 		return NF_BR_LOCAL_OUT;
- 	else if (strcmp(chain, "POSTROUTING") == 0)
- 		return NF_BR_POST_ROUTING;
-+	else if (strcmp(chain, "BROUTING") == 0)
-+		return NF_BR_BROUTING;
- 
- 	/* placeholder for user defined chain */
- 	return NF_BR_NUMHOOKS;

0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch

@@ -1,42 +0,0 @@
-From 37622ca0f4c29c9a06b0d2f3f1abc6695c57d560 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sun, 19 Nov 2023 13:18:26 +0100
-Subject: [PATCH] xshared: struct xt_cmd_parse::xlate is unused
-
-Drop the boolean, it was meant to disable some existence checks in
-do_parse() prior to the caching rework. Now that do_parse() runs before
-any caching is done, the checks in question don't exist anymore so drop
-this relict.
-
-Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit b180d9c86d2cce6ab6fd3e3617faf320a8a1babb)
----
- iptables/xshared.h           | 1 -
- iptables/xtables-translate.c | 1 -
- 2 files changed, 2 deletions(-)
-
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 5586385456a4d..c77556a1987dc 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -284,7 +284,6 @@ struct xt_cmd_parse {
- 	bool				restore;
- 	int				line;
- 	int				verbose;
--	bool				xlate;
- 	struct xt_cmd_parse_ops		*ops;
- };
- 
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index 88e0a6b639494..c019cd2991305 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -249,7 +249,6 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
- 		.table		= *table,
- 		.restore	= restore,
- 		.line		= line,
--		.xlate		= true,
- 		.ops		= &h->ops->cmd_parse,
- 	};
- 	struct iptables_command_state cs = {

0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch

@@ -1,31 +0,0 @@
-From 436dd5a6ba5639c8e83183f6252ce7bd37760e1c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sun, 19 Nov 2023 13:25:36 +0100
-Subject: [PATCH] xshared: All variants support -v, update OPTSTRING_COMMON
-
-Fixes: 51d9d9e081344 ("ebtables: Support verbose mode")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 9a9ff768cab58aea02828e422184873e52e9846a)
----
- iptables/xshared.h | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index c77556a1987dc..815b9d3e98726 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -75,10 +75,10 @@ struct xtables_globals;
- struct xtables_rule_match;
- struct xtables_target;
- 
--#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:"
--#define IPT_OPTSTRING	OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nvw::x"
--#define ARPT_OPTSTRING	OPTSTRING_COMMON "R:S::" "h::l:nvx" /* "m:" */
--#define EBT_OPTSTRING	OPTSTRING_COMMON "hv"
-+#define OPTSTRING_COMMON "-:A:C:D:E:F::I:L::M:N:P:VX::Z::" "c:d:i:j:o:p:s:t:v"
-+#define IPT_OPTSTRING	OPTSTRING_COMMON "R:S::W::" "46bfg:h::m:nw::x"
-+#define ARPT_OPTSTRING	OPTSTRING_COMMON "R:S::" "h::l:nx" /* "m:" */
-+#define EBT_OPTSTRING	OPTSTRING_COMMON "h"
- 
- /* define invflags which won't collide with IPT ones.
-  * arptables-nft does NOT use the legacy ARPT_INV_* defines.

0006-ebtables-Align-line-number-formatting-with-legacy.patch

@@ -1,28 +0,0 @@
-From ffd0c96de7bbc558b9b7a8bcbeebd9576fec8e59 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 21 Nov 2023 22:58:47 +0100
-Subject: [PATCH] ebtables: Align line number formatting with legacy
-
-Legacy ebtables appends a dot to the number printed in first column if
---Ln flag was given.
-
-Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 74253799f0ca0735256327e834b7dffedde96ebf)
----
- iptables/nft-bridge.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index d9a8ad2b0f373..e414ef5584392 100644
---- a/iptables/nft-bridge.c
-+++ b/iptables/nft-bridge.c
-@@ -354,7 +354,7 @@ static void nft_bridge_print_rule(struct nft_handle *h, struct nftnl_rule *r,
- 	struct iptables_command_state cs = {};
- 
- 	if (format & FMT_LINENUMBERS)
--		printf("%d ", num);
-+		printf("%d. ", num);
- 
- 	nft_rule_to_ebtables_command_state(h, r, &cs);
- 	__nft_bridge_save_rule(&cs, format);

0007-man-Do-not-escape-exclamation-marks.patch

@@ -1,44 +0,0 @@
-From 1c9549af3566e6c0b5573d6f91b25934d8d99f79 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 28 Nov 2023 13:29:17 +0100
-Subject: [PATCH] man: Do not escape exclamation marks
-
-This appears to be not necessary, also mandoc complains about it:
-
-| mandoc: iptables/iptables-extensions.8:2170:52: UNSUPP: unsupported escape sequence: \!
-
-Fixes: 71eddedcbf7ae ("libip6t_DNPT: add manpage")
-Fixes: 0a4c357cb91e1 ("libip6t_SNPT: add manpage")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit d8c64911cfd602f57354f36e5ca79bbedd62aa7a)
----
- extensions/libip6t_DNPT.man | 2 +-
- extensions/libip6t_SNPT.man | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/extensions/libip6t_DNPT.man b/extensions/libip6t_DNPT.man
-index 9b060f5b7179b..72c6ae5d422a2 100644
---- a/extensions/libip6t_DNPT.man
-+++ b/extensions/libip6t_DNPT.man
-@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length
- .PP
- You have to use the SNPT target to undo the translation. Example:
- .IP
--ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0
-+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0
- \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64
- .IP
- ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64
-diff --git a/extensions/libip6t_SNPT.man b/extensions/libip6t_SNPT.man
-index 97e0071b43cc1..0c926978377a7 100644
---- a/extensions/libip6t_SNPT.man
-+++ b/extensions/libip6t_SNPT.man
-@@ -15,7 +15,7 @@ Set destination prefix that you want to use in the translation and length
- .PP
- You have to use the DNPT target to undo the translation. Example:
- .IP
--ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 \! \-o vboxnet0
-+ip6tables \-t mangle \-I POSTROUTING \-s fd00::/64 ! \-o vboxnet0
- \-j SNPT \-\-src-pfx fd00::/64 \-\-dst-pfx 2001:e20:2000:40f::/64
- .IP
- ip6tables \-t mangle \-I PREROUTING \-i wlan0 \-d 2001:e20:2000:40f::/64

0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch

@@ -1,49 +0,0 @@
-From f667f577e6d29e62f55cdc4e1e39414913bf7c4c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 28 Nov 2023 20:21:49 +0100
-Subject: [PATCH] libxtables: xtoptions: Fix for non-CIDR-compatible hostmasks
-
-In order to parse the mask, xtopt_parse_hostmask() calls
-xtopt_parse_plenmask() thereby limiting netmask support to prefix
-lengths (alternatively specified in IP address notation).
-
-In order to lift this impractical restriction, make
-xtopt_parse_plenmask() aware of the fact that xtopt_parse_plen() may
-fall back to xtopt_parse_mask() which correctly initializes val.hmask
-itself and indicates non-CIDR-compatible masks by setting val.hlen to
--1.
-
-So in order to support these odd masks, it is sufficient for
-xtopt_parse_plenmask() to skip its mask building from val.hlen value and
-take whatever val.hmask contains.
-
-Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 41139aee5e53304182a25f1e573f034b313f7232)
----
- libxtables/xtoptions.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
-index b16bbfbe32311..d91a78f470eda 100644
---- a/libxtables/xtoptions.c
-+++ b/libxtables/xtoptions.c
-@@ -711,6 +711,10 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb)
- 
- 	xtopt_parse_plen(cb);
- 
-+	/* may not be convertible to CIDR notation */
-+	if (cb->val.hlen == (uint8_t)-1)
-+		goto out_put;
-+
- 	memset(mask, 0xFF, sizeof(union nf_inet_addr));
- 	/* This shifting is AF-independent. */
- 	if (cb->val.hlen == 0) {
-@@ -731,6 +735,7 @@ static void xtopt_parse_plenmask(struct xt_option_call *cb)
- 	mask[1] = htonl(mask[1]);
- 	mask[2] = htonl(mask[2]);
- 	mask[3] = htonl(mask[3]);
-+out_put:
- 	if (entry->flags & XTOPT_PUT)
- 		memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr));
- }

0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch

@@ -1,114 +0,0 @@
-From 2568af12c3cf96a8b28082e6188dba94441b21c1 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 19 Dec 2023 00:56:07 +0100
-Subject: [PATCH] iptables-legacy: Fix for mandatory lock waiting
-
-Parameter 'wait' passed to xtables_lock() signals three modes of
-operation, depending on its value:
-
- 0: --wait not specified, do not wait if lock is busy
--1: --wait specified without value, wait indefinitely until lock becomes
-    free
->0: Wait for 'wait' seconds for lock to become free, abort otherwise
-
-Since fixed commit, the first two cases were treated the same apart from
-calling alarm(0), but that is a nop if no alarm is pending. Fix the code
-by requesting a non-blocking flock() in the second case. While at it,
-restrict the alarm setup to the third case only.
-
-Cc: Jethro Beekman <jethro@fortanix.com>
-Cc: howardjohn@google.com
-Cc: Antonio Ojea <antonio.ojea.garcia@gmail.com>
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1728
-Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 63ab5b8906f6913a14d38ec231f21daa760339a9)
----
- .../shell/testcases/iptables/0010-wait_0      | 55 +++++++++++++++++++
- iptables/xshared.c                            |  4 +-
- 2 files changed, 57 insertions(+), 2 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/iptables/0010-wait_0
-
-diff --git a/iptables/tests/shell/testcases/iptables/0010-wait_0 b/iptables/tests/shell/testcases/iptables/0010-wait_0
-new file mode 100755
-index 0000000000000..4481f966ce435
---- /dev/null
-+++ b/iptables/tests/shell/testcases/iptables/0010-wait_0
-@@ -0,0 +1,55 @@
-+#!/bin/bash
-+
-+case "$XT_MULTI" in
-+*xtables-legacy-multi)
-+	;;
-+*)
-+	echo skip $XT_MULTI
-+	exit 0
-+	;;
-+esac
-+
-+coproc RESTORE { $XT_MULTI iptables-restore; }
-+echo "*filter" >&${RESTORE[1]}
-+
-+
-+$XT_MULTI iptables -A FORWARD -j ACCEPT &
-+ipt_pid=$!
-+
-+waitpid -t 1 $ipt_pid
-+[[ $? -eq 3 ]] && {
-+	echo "process waits when it should not"
-+	exit 1
-+}
-+wait $ipt_pid
-+[[ $? -eq 0 ]] && {
-+	echo "process exited 0 despite busy lock"
-+	exit 1
-+}
-+
-+t0=$(date +%s)
-+$XT_MULTI iptables -w 3 -A FORWARD -j ACCEPT
-+t1=$(date +%s)
-+[[ $((t1 - t0)) -ge 3 ]] || {
-+	echo "wait time not expired"
-+	exit 1
-+}
-+
-+$XT_MULTI iptables -w -A FORWARD -j ACCEPT &
-+ipt_pid=$!
-+
-+waitpid -t 3 $ipt_pid
-+[[ $? -eq 3 ]] || {
-+	echo "no indefinite wait"
-+	exit 1
-+}
-+kill $ipt_pid
-+waitpid -t 3 $ipt_pid
-+[[ $? -eq 3 ]] && {
-+	echo "killed waiting iptables call did not exit in time"
-+	exit 1
-+}
-+
-+kill $RESTORE_PID
-+wait
-+exit 0
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 5f75a0a57a023..690502c457dd0 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -270,7 +270,7 @@ static int xtables_lock(int wait)
- 		return XT_LOCK_FAILED;
- 	}
- 
--	if (wait != -1) {
-+	if (wait > 0) {
- 		sigact_alarm.sa_handler = alarm_ignore;
- 		sigact_alarm.sa_flags = SA_RESETHAND;
- 		sigemptyset(&sigact_alarm.sa_mask);
-@@ -278,7 +278,7 @@ static int xtables_lock(int wait)
- 		alarm(wait);
- 	}
- 
--	if (flock(fd, LOCK_EX) == 0)
-+	if (flock(fd, LOCK_EX | (wait ? 0 : LOCK_NB)) == 0)
- 		return fd;
- 
- 	if (errno == EINTR) {

0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch

@@ -1,40 +0,0 @@
-From 07ab8c7e7a1eeb6a5bb4028d92d713034df39167 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sun, 17 Dec 2023 13:02:36 +0100
-Subject: [PATCH] libxtables: xtoptions: Prevent XTOPT_PUT with XTTYPE_HOSTMASK
-
-Do as the comment in xtopt_parse_hostmask() claims and omit
-XTTYPE_HOSTMASK from xtopt_psize array so xtables_option_metavalidate()
-will catch the incompatibility.
-
-Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
-(cherry picked from commit 17d724f20e3c97ea8ce8765ca532a3cf49a98b31)
----
- include/xtables.h      | 1 -
- libxtables/xtoptions.c | 1 -
- 2 files changed, 2 deletions(-)
-
-diff --git a/include/xtables.h b/include/xtables.h
-index 087a1d600f9ae..9def9b43b6e58 100644
---- a/include/xtables.h
-+++ b/include/xtables.h
-@@ -61,7 +61,6 @@ struct in_addr;
-  * %XTTYPE_SYSLOGLEVEL:	syslog level by name or number
-  * %XTTYPE_HOST:	one host or address (ptr: union nf_inet_addr)
-  * %XTTYPE_HOSTMASK:	one host or address, with an optional prefix length
-- * 			(ptr: union nf_inet_addr; only host portion is stored)
-  * %XTTYPE_PROTOCOL:	protocol number/name from /etc/protocols (ptr: uint8_t)
-  * %XTTYPE_PORT:	16-bit port name or number (supports %XTOPT_NBO)
-  * %XTTYPE_PORTRC:	colon-separated port range (names acceptable),
-diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
-index d91a78f470eda..ba68056dc99f7 100644
---- a/libxtables/xtoptions.c
-+++ b/libxtables/xtoptions.c
-@@ -57,7 +57,6 @@ static const size_t xtopt_psize[] = {
- 	[XTTYPE_STRING]      = -1,
- 	[XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t),
- 	[XTTYPE_HOST]        = sizeof(union nf_inet_addr),
--	[XTTYPE_HOSTMASK]    = sizeof(union nf_inet_addr),
- 	[XTTYPE_PROTOCOL]    = sizeof(uint8_t),
- 	[XTTYPE_PORT]        = sizeof(uint16_t),
- 	[XTTYPE_PORTRC]      = sizeof(uint16_t[2]),

0011-nft-ruleparse-Add-missing-braces-around-ternary.patch

@@ -1,36 +0,0 @@
-From 560cda26c8ba30bcb79708974c8a039dbd474cf5 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 26 Jan 2024 18:43:10 +0100
-Subject: [PATCH] nft: ruleparse: Add missing braces around ternary
-
-The expression evaluated the sum before the ternay, consequently not
-adding target->size if tgsize was zero.
-
-Identified by ASAN for a simple rule using standard target:
-| # ebtables -A INPUT -s de:ad:be:ef:0:00 -j RETURN
-| # ebtables -D INPUT -s de:ad:be:ef:0:00 -j RETURN
-| =================================================================
-| ==18925==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000120 at pc 0x7f627a4c75c5 bp 0x7ffe882b5180 sp 0x7ffe882b4928
-| READ of size 8 at 0x603000000120 thread T0
-| [...]
-
-Fixes: 2a6eee89083c8 ("nft-ruleparse: Introduce nft_create_target()")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 2026b08bce7fe87b5964f7912e1eef30f04922c1)
----
- iptables/nft-ruleparse.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/nft-ruleparse.c b/iptables/nft-ruleparse.c
-index c8322f936acd9..57fe27276de35 100644
---- a/iptables/nft-ruleparse.c
-+++ b/iptables/nft-ruleparse.c
-@@ -94,7 +94,7 @@ __nft_create_target(struct nft_xt_ctx *ctx, const char *name, size_t tgsize)
- 	if (!target)
- 		return NULL;
- 
--	size = XT_ALIGN(sizeof(*target->t)) + tgsize ?: target->size;
-+	size = XT_ALIGN(sizeof(*target->t)) + (tgsize ?: target->size);
- 
- 	target->t = xtables_calloc(1, size);
- 	target->t->u.target_size = size;

0012-libxtables-Fix-memleak-of-matches-udata.patch

@@ -1,32 +0,0 @@
-From 4a8ba6fe255a4948bc0f421a22741a313326d7e2 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 31 Jan 2024 14:58:17 +0100
-Subject: [PATCH] libxtables: Fix memleak of matches' udata
-
-If the extension specifies a non-zero udata_size, field 'udata' points
-to an allocated buffer which needs to be freed upon extension deinit.
-
-Interestingly, this bug was identified by ASAN and missed by valgrind.
-
-Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit e7366db80740d34d2fe4ba8d12ef86a423e66280)
----
- libxtables/xtables.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index ba9ceaeb3da41..0f617d80ae37e 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -1414,6 +1414,10 @@ void xtables_rule_matches_free(struct xtables_rule_match **matches)
- 			free(matchp->match->m);
- 			matchp->match->m = NULL;
- 		}
-+		if (matchp->match->udata_size) {
-+			free(matchp->match->udata);
-+			matchp->match->udata = NULL;
-+		}
- 		if (matchp->match == matchp->match->next) {
- 			free(matchp->match);
- 			matchp->match = NULL;

0013-extensions-ah-Save-xlate-inverted-full-ranges.patch

@@ -1,200 +0,0 @@
-From 55e4e4b53604a2389c73fc2c38091a067495ec2e Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 15:27:03 +0100
-Subject: [PATCH] extensions: ah: Save/xlate inverted full ranges
-
-While at it, fix xlate output for plain '-m ah' matches: With
-ip6tables-translate, one should emit an extdhr exists match since
-ip6t_ah.c in kernel also uses ipv6_find_hdr(). With iptables-translate,
-a simple 'meta l4proto ah' was missing.
-
-Fixes: bb498c8ba7bb3 ("extensions: libip6t_ah: Fix translation of plain '-m ah'")
-Fixes: b9a46ee406165 ("extensions: libipt_ah: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c5d75387131e8cb1fc4d22b2e2e264297baf4622)
-
-Conflicts:
-	extensions/libip6t_ah.t
-	extensions/libip6t_ah.txlate
-	extensions/libipt_ah.t
-	extensions/libipt_ah.txlate
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libip6t_ah.c      | 22 +++++++++++++---------
- extensions/libip6t_ah.t      |  1 +
- extensions/libip6t_ah.txlate |  6 ++++++
- extensions/libipt_ah.c       | 22 ++++++++++++++--------
- extensions/libipt_ah.t       |  1 +
- extensions/libipt_ah.txlate  |  6 ++++++
- 6 files changed, 41 insertions(+), 17 deletions(-)
-
-diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c
-index f35982f379d76..0f95c4735eabd 100644
---- a/extensions/libip6t_ah.c
-+++ b/extensions/libip6t_ah.c
-@@ -58,13 +58,18 @@ static void ah_parse(struct xt_option_call *cb)
- 	}
- }
- 
-+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv)
-+{
-+	return min == 0 && max == UINT32_MAX && !inv;
-+}
-+
- static void
- print_spis(const char *name, uint32_t min, uint32_t max,
- 	    int invert)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFFFFFF || invert) {
-+	if (!skip_spi_match(min, max, invert)) {
- 		if (min == max)
- 			printf("%s:%s%u", name, inv, min);
- 		else
-@@ -103,11 +108,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match,
- static void ah_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data;
-+	bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI;
- 
--	if (!(ahinfo->spis[0] == 0
--	    && ahinfo->spis[1] == 0xFFFFFFFF)) {
--		printf("%s --ahspi ",
--			(ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : "");
-+	if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) {
-+		printf("%s --ahspi ", inv_spi ? " !" : "");
- 		if (ahinfo->spis[0]
- 		    != ahinfo->spis[1])
- 			printf("%u:%u",
-@@ -132,11 +136,11 @@ static int ah_xlate(struct xt_xlate *xl,
- 		    const struct xt_xlate_mt_params *params)
- {
- 	const struct ip6t_ah *ahinfo = (struct ip6t_ah *)params->match->data;
-+	bool inv_spi = ahinfo->invflags & IP6T_AH_INV_SPI;
- 	char *space = "";
- 
--	if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) {
--		xt_xlate_add(xl, "ah spi%s ",
--			(ahinfo->invflags & IP6T_AH_INV_SPI) ? " !=" : "");
-+	if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) {
-+		xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : "");
- 		if (ahinfo->spis[0] != ahinfo->spis[1])
- 			xt_xlate_add(xl, "%u-%u", ahinfo->spis[0],
- 				     ahinfo->spis[1]);
-@@ -158,7 +162,7 @@ static int ah_xlate(struct xt_xlate *xl,
- 	}
- 
- 	if (!space[0]) /* plain '-m ah' */
--		xt_xlate_add(xl, "meta l4proto ah");
-+		xt_xlate_add(xl, "exthdr ah exists");
- 
- 	return 1;
- }
-diff --git a/extensions/libip6t_ah.t b/extensions/libip6t_ah.t
-index c1898d44cf193..9099bdc9259c3 100644
---- a/extensions/libip6t_ah.t
-+++ b/extensions/libip6t_ah.t
-@@ -13,3 +13,4 @@
- -m ah --ahspi 0:invalid;;FAIL
- -m ah --ahspi;;FAIL
- -m ah;=;OK
-+-m ah ! --ahspi :;-m ah ! --ahspi 0:4294967295;OK
-diff --git a/extensions/libip6t_ah.txlate b/extensions/libip6t_ah.txlate
-index cc33ac2718c0c..32c6b7de00937 100644
---- a/extensions/libip6t_ah.txlate
-+++ b/extensions/libip6t_ah.txlate
-@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength != 120 counter drop'
- 
- ip6tables-translate -A INPUT -m ah --ahspi 500 --ahlen 120 --ahres -j ACCEPT
- nft 'add rule ip6 filter INPUT ah spi 500 ah hdrlength 120 ah reserved 1 counter accept'
-+
-+ip6tables-translate -A INPUT -m ah --ahspi 0:4294967295
-+nft 'add rule ip6 filter INPUT exthdr ah exists counter'
-+
-+ip6tables-translate -A INPUT -m ah ! --ahspi 0:4294967295
-+nft 'add rule ip6 filter INPUT ah spi != 0-4294967295 counter'
-diff --git a/extensions/libipt_ah.c b/extensions/libipt_ah.c
-index fec5705ce6f53..39e3013d3e74b 100644
---- a/extensions/libipt_ah.c
-+++ b/extensions/libipt_ah.c
-@@ -39,13 +39,18 @@ static void ah_parse(struct xt_option_call *cb)
- 		ahinfo->invflags |= IPT_AH_INV_SPI;
- }
- 
-+static bool skip_spi_match(uint32_t min, uint32_t max, bool inv)
-+{
-+	return min == 0 && max == UINT32_MAX && !inv;
-+}
-+
- static void
- print_spis(const char *name, uint32_t min, uint32_t max,
- 	    int invert)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFFFFFF || invert) {
-+	if (!skip_spi_match(min, max, invert)) {
- 		printf("%s", name);
- 		if (min == max) {
- 			printf(":%s", inv);
-@@ -75,11 +80,10 @@ static void ah_print(const void *ip, const struct xt_entry_match *match,
- static void ah_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data;
-+	bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI;
- 
--	if (!(ahinfo->spis[0] == 0
--	    && ahinfo->spis[1] == 0xFFFFFFFF)) {
--		printf("%s --ahspi ",
--			(ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : "");
-+	if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) {
-+		printf("%s --ahspi ", inv_spi ? " !" : "");
- 		if (ahinfo->spis[0]
- 		    != ahinfo->spis[1])
- 			printf("%u:%u",
-@@ -96,15 +100,17 @@ static int ah_xlate(struct xt_xlate *xl,
- 		    const struct xt_xlate_mt_params *params)
- {
- 	const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data;
-+	bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI;
- 
--	if (!(ahinfo->spis[0] == 0 && ahinfo->spis[1] == 0xFFFFFFFF)) {
--		xt_xlate_add(xl, "ah spi%s ",
--			   (ahinfo->invflags & IPT_AH_INV_SPI) ? " !=" : "");
-+	if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) {
-+		xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : "");
- 		if (ahinfo->spis[0] != ahinfo->spis[1])
- 			xt_xlate_add(xl, "%u-%u", ahinfo->spis[0],
- 				   ahinfo->spis[1]);
- 		else
- 			xt_xlate_add(xl, "%u", ahinfo->spis[0]);
-+	} else {
-+		xt_xlate_add(xl, "meta l4proto ah");
- 	}
- 
- 	return 1;
-diff --git a/extensions/libipt_ah.t b/extensions/libipt_ah.t
-index cd853865638e8..1aeb607e9e986 100644
---- a/extensions/libipt_ah.t
-+++ b/extensions/libipt_ah.t
-@@ -11,3 +11,4 @@
- -m ah --ahspi;;FAIL
- -m ah;;FAIL
- -p ah -m ah;=;OK
-+-p ah -m ah ! --ahspi :;-p ah -m ah ! --ahspi 0:4294967295;OK
-diff --git a/extensions/libipt_ah.txlate b/extensions/libipt_ah.txlate
-index 897c82b5f95c6..baf5a0ae6182a 100644
---- a/extensions/libipt_ah.txlate
-+++ b/extensions/libipt_ah.txlate
-@@ -6,3 +6,9 @@ nft 'add rule ip filter INPUT ah spi 500-600 counter drop'
- 
- iptables-translate -A INPUT -p 51 -m ah ! --ahspi 50 -j DROP
- nft 'add rule ip filter INPUT ah spi != 50 counter drop'
-+
-+iptables-translate -A INPUT -p 51 -m ah --ahspi 0:4294967295 -j DROP
-+nft 'add rule ip filter INPUT meta l4proto ah counter drop'
-+
-+iptables-translate -A INPUT -p 51 -m ah ! --ahspi 0:4294967295 -j DROP
-+nft 'add rule ip filter INPUT ah spi != 0-4294967295 counter drop'

0014-extensions-frag-Save-xlate-inverted-full-ranges.patch

@@ -1,117 +0,0 @@
-From f1eae87209ad10753249eeea6a53c1cd470e8e69 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 15:39:52 +0100
-Subject: [PATCH] extensions: frag: Save/xlate inverted full ranges
-
-Also translate plain '-m frag' match into an exthdr exists one.
-
-Fixes: bd5bbc7a0fbd8 ("extensions: libip6t_frag: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit d71eb186e7d165d7120f122dd07c35cd935a1955)
-
-Conflicts:
-	extensions/libip6t_frag.t
-	extensions/libip6t_frag.txlate
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libip6t_frag.c      | 27 ++++++++++++++++++---------
- extensions/libip6t_frag.t      |  1 +
- extensions/libip6t_frag.txlate |  6 ++++++
- 3 files changed, 25 insertions(+), 9 deletions(-)
-
-diff --git a/extensions/libip6t_frag.c b/extensions/libip6t_frag.c
-index 49c787e709a9e..ed7fe10a4716d 100644
---- a/extensions/libip6t_frag.c
-+++ b/extensions/libip6t_frag.c
-@@ -89,13 +89,18 @@ static void frag_parse(struct xt_option_call *cb)
- 	}
- }
- 
-+static bool skip_ids_match(uint32_t min, uint32_t max, bool inv)
-+{
-+	return min == 0 && max == UINT32_MAX && !inv;
-+}
-+
- static void
- print_ids(const char *name, uint32_t min, uint32_t max,
- 	    int invert)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFFFFFF || invert) {
-+	if (!skip_ids_match(min, max, invert)) {
- 		printf("%s", name);
- 		if (min == max)
- 			printf(":%s%u", inv, min);
-@@ -139,11 +144,10 @@ static void frag_print(const void *ip, const struct xt_entry_match *match,
- static void frag_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct ip6t_frag *fraginfo = (struct ip6t_frag *)match->data;
-+	bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS;
- 
--	if (!(fraginfo->ids[0] == 0
--	    && fraginfo->ids[1] == 0xFFFFFFFF)) {
--		printf("%s --fragid ",
--			(fraginfo->invflags & IP6T_FRAG_INV_IDS) ? " !" : "");
-+	if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) {
-+		printf("%s --fragid ", inv_ids ? " !" : "");
- 		if (fraginfo->ids[0]
- 		    != fraginfo->ids[1])
- 			printf("%u:%u",
-@@ -173,22 +177,27 @@ static void frag_save(const void *ip, const struct xt_entry_match *match)
- 		printf(" --fraglast");
- }
- 
-+#define XLATE_FLAGS (IP6T_FRAG_RES | IP6T_FRAG_FST | \
-+		     IP6T_FRAG_MF | IP6T_FRAG_NMF)
-+
- static int frag_xlate(struct xt_xlate *xl,
- 		      const struct xt_xlate_mt_params *params)
- {
- 	const struct ip6t_frag *fraginfo =
- 		(struct ip6t_frag *)params->match->data;
-+	bool inv_ids = fraginfo->invflags & IP6T_FRAG_INV_IDS;
- 
--	if (!(fraginfo->ids[0] == 0 && fraginfo->ids[1] == 0xFFFFFFFF)) {
--		xt_xlate_add(xl, "frag id %s",
--			     (fraginfo->invflags & IP6T_FRAG_INV_IDS) ?
--			     "!= " : "");
-+	if (!skip_ids_match(fraginfo->ids[0], fraginfo->ids[1], inv_ids)) {
-+		xt_xlate_add(xl, "frag id %s", inv_ids ?  "!= " : "");
- 		if (fraginfo->ids[0] != fraginfo->ids[1])
- 			xt_xlate_add(xl, "%u-%u", fraginfo->ids[0],
- 				     fraginfo->ids[1]);
- 		else
- 			xt_xlate_add(xl, "%u", fraginfo->ids[0]);
- 
-+	} else if (!(fraginfo->flags & XLATE_FLAGS)) {
-+		xt_xlate_add(xl, "exthdr frag exists");
-+		return 1;
- 	}
- 
- 	/* ignore ineffective IP6T_FRAG_LEN bit */
-diff --git a/extensions/libip6t_frag.t b/extensions/libip6t_frag.t
-index 299fa03f8845b..58417c90e9217 100644
---- a/extensions/libip6t_frag.t
-+++ b/extensions/libip6t_frag.t
-@@ -1,4 +1,5 @@
- :INPUT,FORWARD,OUTPUT
-+-m frag ! --fragid :;-m frag ! --fragid 0:4294967295;OK
- -m frag --fragid 1:42;=;OK
- -m frag --fraglen 42;=;OK
- -m frag --fragres;=;OK
-diff --git a/extensions/libip6t_frag.txlate b/extensions/libip6t_frag.txlate
-index 33fc0631dc792..e250587e7682c 100644
---- a/extensions/libip6t_frag.txlate
-+++ b/extensions/libip6t_frag.txlate
-@@ -15,3 +15,9 @@ nft 'add rule ip6 filter INPUT frag id 100-200 frag frag-off 0 counter accept'
- 
- ip6tables-translate -t filter -A INPUT -m frag --fraglast -j ACCEPT
- nft 'add rule ip6 filter INPUT frag more-fragments 0 counter accept'
-+
-+ip6tables-translate -t filter -A INPUT -m frag --fragid 0:4294967295
-+nft 'add rule ip6 filter INPUT exthdr frag exists counter'
-+
-+ip6tables-translate -t filter -A INPUT -m frag ! --fragid 0:4294967295
-+nft 'add rule ip6 filter INPUT frag id != 0-4294967295 counter'

0015-extensions-mh-Save-xlate-inverted-full-ranges.patch

@@ -1,111 +0,0 @@
-From f280f261d1a573f133b34a12250ec30137549ff4 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 15:42:10 +0100
-Subject: [PATCH] extensions: mh: Save/xlate inverted full ranges
-
-Also translate '-m mh' into an exthdr exists match unless '-p mh' is
-also present. The latter is converted into 'meta l4proto mh' which might
-need fixing itself at a later point.
-
-Fixes: 6d4b93485055a ("extensions: libip6t_mh: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 83f60fb37d594d1984a4e8a197d8f99eb8b2db30)
-
-Conflicts:
-	extensions/libip6t_mh.t
-	extensions/libip6t_mh.txlate
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libip6t_mh.c      | 20 ++++++++++++++++----
- extensions/libip6t_mh.t      |  1 +
- extensions/libip6t_mh.txlate |  9 +++++++++
- 3 files changed, 26 insertions(+), 4 deletions(-)
-
-diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c
-index 1410d324b5d42..3f80e28ec94c8 100644
---- a/extensions/libip6t_mh.c
-+++ b/extensions/libip6t_mh.c
-@@ -17,6 +17,7 @@
- #include <stdlib.h>
- #include <xtables.h>
- #include <linux/netfilter_ipv6/ip6t_mh.h>
-+#include <linux/netfilter_ipv6/ip6_tables.h>
- 
- enum {
- 	O_MH_TYPE = 0,
-@@ -154,11 +155,16 @@ static void print_type(uint8_t type, int numeric)
- 		printf("%s", name);
- }
- 
-+static bool skip_types_match(uint8_t min, uint8_t max, bool inv)
-+{
-+	return min == 0 && max == UINT8_MAX && !inv;
-+}
-+
- static void print_types(uint8_t min, uint8_t max, int invert, int numeric)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFF || invert) {
-+	if (!skip_types_match(min, max, invert)) {
- 		printf(" ");
- 		if (min == max) {
- 			printf("%s", inv);
-@@ -189,11 +195,12 @@ static void mh_print(const void *ip, const struct xt_entry_match *match,
- static void mh_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct ip6t_mh *mhinfo = (struct ip6t_mh *)match->data;
-+	bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE;
- 
--	if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xFF)
-+	if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type))
- 		return;
- 
--	if (mhinfo->invflags & IP6T_MH_INV_TYPE)
-+	if (inv_type)
- 		printf(" !");
- 
- 	if (mhinfo->types[0] != mhinfo->types[1])
-@@ -206,9 +213,14 @@ static int mh_xlate(struct xt_xlate *xl,
- 		    const struct xt_xlate_mt_params *params)
- {
- 	const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data;
-+	bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE;
-+	uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto;
- 
--	if (mhinfo->types[0] == 0 && mhinfo->types[1] == 0xff)
-+	if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) {
-+		if (proto != IPPROTO_MH)
-+			xt_xlate_add(xl, "exthdr mh exists");
- 		return 1;
-+	}
- 
- 	if (mhinfo->types[0] != mhinfo->types[1])
- 		xt_xlate_add(xl, "mh type %s%u-%u",
-diff --git a/extensions/libip6t_mh.t b/extensions/libip6t_mh.t
-index 6b76d13d0a00f..be5439edc9520 100644
---- a/extensions/libip6t_mh.t
-+++ b/extensions/libip6t_mh.t
-@@ -4,3 +4,4 @@
- -p mobility-header -m mh --mh-type 1;=;OK
- -p mobility-header -m mh ! --mh-type 4;=;OK
- -p mobility-header -m mh --mh-type 4:123;=;OK
-+-p mobility-header -m mh ! --mh-type :;-p mobility-header -m mh ! --mh-type 0:255;OK
-diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate
-index 4dfaf46a2b8d7..3364ce574468f 100644
---- a/extensions/libip6t_mh.txlate
-+++ b/extensions/libip6t_mh.txlate
-@@ -3,3 +3,12 @@ nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1 counter ac
- 
- ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT
- nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept'
-+
-+ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT
-+nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept'
-+
-+ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT
-+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept'
-+
-+ip6tables-translate -A INPUT -p mh ! --mh-type 0:255 -j ACCEPT
-+nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type != 0-255 counter accept'

0016-extensions-rt-Save-xlate-inverted-full-ranges.patch

@@ -1,131 +0,0 @@
-From 53f2730073668186625d96a8730b514280d379f4 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 15:45:42 +0100
-Subject: [PATCH] extensions: rt: Save/xlate inverted full ranges
-
-Also translate plain '-m rt' match into an exthdr exists one.
-
-Fixes: 9dbb616c2f0c3 ("extensions: libip6t_rt.c: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit a0e5dad34a6410e4960feb621780c4b06f374477)
-
-Conflicts:
-	extensions/libip6t_rt.t
-	extensions/libip6t_rt.txlate
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libip6t_rt.c      | 28 ++++++++++++++++++++--------
- extensions/libip6t_rt.t      |  1 +
- extensions/libip6t_rt.txlate |  9 +++++++++
- 3 files changed, 30 insertions(+), 8 deletions(-)
-
-diff --git a/extensions/libip6t_rt.c b/extensions/libip6t_rt.c
-index d5b0458bb397e..6db09f0b2cdc8 100644
---- a/extensions/libip6t_rt.c
-+++ b/extensions/libip6t_rt.c
-@@ -152,13 +152,18 @@ static void rt_parse(struct xt_option_call *cb)
- 	}
- }
- 
-+static bool skip_segsleft_match(uint32_t min, uint32_t max, bool inv)
-+{
-+	return min == 0 && max == UINT32_MAX && !inv;
-+}
-+
- static void
- print_nums(const char *name, uint32_t min, uint32_t max,
- 	    int invert)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFFFFFF || invert) {
-+	if (!skip_segsleft_match(min, max, invert)) {
- 		printf(" %s", name);
- 		if (min == max) {
- 			printf(":%s", inv);
-@@ -210,6 +215,7 @@ static void rt_print(const void *ip, const struct xt_entry_match *match,
- static void rt_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct ip6t_rt *rtinfo = (struct ip6t_rt *)match->data;
-+	bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS;
- 
- 	if (rtinfo->flags & IP6T_RT_TYP) {
- 		printf("%s --rt-type %u",
-@@ -217,10 +223,9 @@ static void rt_save(const void *ip, const struct xt_entry_match *match)
- 			rtinfo->rt_type);
- 	}
- 
--	if (!(rtinfo->segsleft[0] == 0
--	    && rtinfo->segsleft[1] == 0xFFFFFFFF)) {
--		printf("%s --rt-segsleft ",
--			(rtinfo->invflags & IP6T_RT_INV_SGS) ? " !" : "");
-+	if (!skip_segsleft_match(rtinfo->segsleft[0],
-+				 rtinfo->segsleft[1], inv_sgs)) {
-+		printf("%s --rt-segsleft ", inv_sgs ? " !" : "");
- 		if (rtinfo->segsleft[0]
- 		    != rtinfo->segsleft[1])
- 			printf("%u:%u",
-@@ -244,10 +249,14 @@ static void rt_save(const void *ip, const struct xt_entry_match *match)
- 
- }
- 
-+#define XLATE_FLAGS (IP6T_RT_TYP | IP6T_RT_LEN | \
-+		     IP6T_RT_RES | IP6T_RT_FST | IP6T_RT_FST_NSTRICT)
-+
- static int rt_xlate(struct xt_xlate *xl,
- 		    const struct xt_xlate_mt_params *params)
- {
- 	const struct ip6t_rt *rtinfo = (struct ip6t_rt *)params->match->data;
-+	bool inv_sgs = rtinfo->invflags & IP6T_RT_INV_SGS;
- 
- 	if (rtinfo->flags & IP6T_RT_TYP) {
- 		xt_xlate_add(xl, "rt type%s %u",
-@@ -255,15 +264,18 @@ static int rt_xlate(struct xt_xlate *xl,
- 			      rtinfo->rt_type);
- 	}
- 
--	if (!(rtinfo->segsleft[0] == 0 && rtinfo->segsleft[1] == 0xFFFFFFFF)) {
--		xt_xlate_add(xl, "rt seg-left%s ",
--			     (rtinfo->invflags & IP6T_RT_INV_SGS) ? " !=" : "");
-+	if (!skip_segsleft_match(rtinfo->segsleft[0],
-+				 rtinfo->segsleft[1], inv_sgs)) {
-+		xt_xlate_add(xl, "rt seg-left%s ", inv_sgs ? " !=" : "");
- 
- 		if (rtinfo->segsleft[0] != rtinfo->segsleft[1])
- 			xt_xlate_add(xl, "%u-%u", rtinfo->segsleft[0],
- 					rtinfo->segsleft[1]);
- 		else
- 			xt_xlate_add(xl, "%u", rtinfo->segsleft[0]);
-+	} else if (!(rtinfo->flags & XLATE_FLAGS)) {
-+		xt_xlate_add(xl, "exthdr rt exists");
-+		return 1;
- 	}
- 
- 	if (rtinfo->flags & IP6T_RT_LEN) {
-diff --git a/extensions/libip6t_rt.t b/extensions/libip6t_rt.t
-index 3c7b2d981324a..047b6880e354d 100644
---- a/extensions/libip6t_rt.t
-+++ b/extensions/libip6t_rt.t
-@@ -3,3 +3,4 @@
- -m rt --rt-type 0 ! --rt-segsleft 1:23 ! --rt-len 42 --rt-0-res;=;OK
- -m rt ! --rt-type 1 ! --rt-segsleft 12:23 ! --rt-len 42;=;OK
- -m rt;=;OK
-+-m rt ! --rt-segsleft :;-m rt ! --rt-segsleft 0:4294967295;OK
-diff --git a/extensions/libip6t_rt.txlate b/extensions/libip6t_rt.txlate
-index 3578bcba0157e..1c2f74a588750 100644
---- a/extensions/libip6t_rt.txlate
-+++ b/extensions/libip6t_rt.txlate
-@@ -12,3 +12,12 @@ nft 'add rule ip6 filter INPUT rt type 0 rt hdrlength 22 counter drop'
- 
- ip6tables-translate -A INPUT -m rt --rt-type 0 --rt-len 22 ! --rt-segsleft 26 -j ACCEPT
- nft 'add rule ip6 filter INPUT rt type 0 rt seg-left != 26 rt hdrlength 22 counter accept'
-+
-+ip6tables-translate -A INPUT -m rt --rt-segsleft 13:42 -j ACCEPT
-+nft 'add rule ip6 filter INPUT rt seg-left 13-42 counter accept'
-+
-+ip6tables-translate -A INPUT -m rt --rt-segsleft 0:4294967295 -j ACCEPT
-+nft 'add rule ip6 filter INPUT exthdr rt exists counter accept'
-+
-+ip6tables-translate -A INPUT -m rt ! --rt-segsleft 0:4294967295 -j ACCEPT
-+nft 'add rule ip6 filter INPUT rt seg-left != 0-4294967295 counter accept'

0017-extensions-esp-Save-xlate-inverted-full-ranges.patch

@@ -1,119 +0,0 @@
-From dd615a9a4664fb3618c9d2bff4f63f82608ba3c5 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 15:47:09 +0100
-Subject: [PATCH] extensions: esp: Save/xlate inverted full ranges
-
-Also add a translation for plain '-m esp' match which depends on the
-address family: While ip6tables-translate may emit an exthdr exists
-match, iptables-translate must stick to meta l4proto.
-
-Fixes: 6cfa723a83d45 ("extensions: libxt_esp: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit da13460f05eaee3b92c3b6d0ca2023c5377f4aca)
-
-Conflicts:
-	extensions/libxt_esp.t
-	extensions/libxt_esp.txlate
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libxt_esp.c      | 26 ++++++++++++++++++--------
- extensions/libxt_esp.t      |  1 +
- extensions/libxt_esp.txlate | 12 ++++++++++++
- 3 files changed, 31 insertions(+), 8 deletions(-)
-
-diff --git a/extensions/libxt_esp.c b/extensions/libxt_esp.c
-index 2c7ff942cb9e0..8e9766d71ed57 100644
---- a/extensions/libxt_esp.c
-+++ b/extensions/libxt_esp.c
-@@ -39,13 +39,18 @@ static void esp_parse(struct xt_option_call *cb)
- 		espinfo->invflags |= XT_ESP_INV_SPI;
- }
- 
-+static bool skip_spis_match(uint32_t min, uint32_t max, bool inv)
-+{
-+	return min == 0 && max == UINT32_MAX && !inv;
-+}
-+
- static void
- print_spis(const char *name, uint32_t min, uint32_t max,
- 	    int invert)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFFFFFF || invert) {
-+	if (!skip_spis_match(min, max, invert)) {
- 		if (min == max)
- 			printf(" %s:%s%u", name, inv, min);
- 		else
-@@ -69,11 +74,10 @@ esp_print(const void *ip, const struct xt_entry_match *match, int numeric)
- static void esp_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct xt_esp *espinfo = (struct xt_esp *)match->data;
-+	bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI;
- 
--	if (!(espinfo->spis[0] == 0
--	    && espinfo->spis[1] == 0xFFFFFFFF)) {
--		printf("%s --espspi ",
--			(espinfo->invflags & XT_ESP_INV_SPI) ? " !" : "");
-+	if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) {
-+		printf("%s --espspi ", inv_spi ? " !" : "");
- 		if (espinfo->spis[0]
- 		    != espinfo->spis[1])
- 			printf("%u:%u",
-@@ -90,15 +94,21 @@ static int esp_xlate(struct xt_xlate *xl,
- 		     const struct xt_xlate_mt_params *params)
- {
- 	const struct xt_esp *espinfo = (struct xt_esp *)params->match->data;
-+	bool inv_spi = espinfo->invflags & XT_ESP_INV_SPI;
- 
--	if (!(espinfo->spis[0] == 0 && espinfo->spis[1] == 0xFFFFFFFF)) {
--		xt_xlate_add(xl, "esp spi%s",
--			   (espinfo->invflags & XT_ESP_INV_SPI) ? " !=" : "");
-+	if (!skip_spis_match(espinfo->spis[0], espinfo->spis[1], inv_spi)) {
-+		xt_xlate_add(xl, "esp spi%s", inv_spi ? " !=" : "");
- 		if (espinfo->spis[0] != espinfo->spis[1])
- 			xt_xlate_add(xl, " %u-%u", espinfo->spis[0],
- 				   espinfo->spis[1]);
- 		else
- 			xt_xlate_add(xl, " %u", espinfo->spis[0]);
-+	} else if (afinfo->family == NFPROTO_IPV4) {
-+		xt_xlate_add(xl, "meta l4proto esp");
-+	} else if (afinfo->family == NFPROTO_IPV6) {
-+		xt_xlate_add(xl, "exthdr esp exists");
-+	} else {
-+		return 0;
- 	}
- 
- 	return 1;
-diff --git a/extensions/libxt_esp.t b/extensions/libxt_esp.t
-index 92c5779f860f1..37259d6b3a08f 100644
---- a/extensions/libxt_esp.t
-+++ b/extensions/libxt_esp.t
-@@ -4,5 +4,6 @@
- -p esp -m esp --espspi 0:4294967295;-p esp -m esp;OK
- -p esp -m esp ! --espspi 0:4294967294;=;OK
- -p esp -m esp --espspi -1;;FAIL
-+-p esp -m esp ! --espspi :;-p esp -m esp ! --espspi 0:4294967295;OK
- -p esp -m esp;=;OK
- -m esp;;FAIL
-diff --git a/extensions/libxt_esp.txlate b/extensions/libxt_esp.txlate
-index f6aba52f52235..5e8fb241beaf4 100644
---- a/extensions/libxt_esp.txlate
-+++ b/extensions/libxt_esp.txlate
-@@ -9,3 +9,15 @@ nft 'add rule ip filter INPUT esp spi 500 counter drop'
- 
- iptables-translate -A INPUT -p 50 -m esp --espspi 500:600 -j DROP
- nft 'add rule ip filter INPUT esp spi 500-600 counter drop'
-+
-+iptables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP
-+nft 'add rule ip filter INPUT meta l4proto esp counter drop'
-+
-+iptables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP
-+nft 'add rule ip filter INPUT esp spi != 0-4294967295 counter drop'
-+
-+ip6tables-translate -A INPUT -p 50 -m esp --espspi 0:4294967295 -j DROP
-+nft 'add rule ip6 filter INPUT exthdr esp exists counter drop'
-+
-+ip6tables-translate -A INPUT -p 50 -m esp ! --espspi 0:4294967295 -j DROP
-+nft 'add rule ip6 filter INPUT esp spi != 0-4294967295 counter drop'

0018-extensions-ipcomp-Save-inverted-full-ranges.patch

@@ -1,47 +0,0 @@
-From 7f61fe3b33a6fbeb1cb536cda3aa33369ba7b956 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 15:57:46 +0100
-Subject: [PATCH] extensions: ipcomp: Save inverted full ranges
-
-Fixes: 0bb8765cc28cf ("iptables: Add IPv4/6 IPcomp match support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 9d400db20cf9f1c4a57c0791e563f22bafcd841a)
-
-Conflicts:
-	extensions/libxt_ipcomp.t
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libxt_ipcomp.c | 7 ++++---
- extensions/libxt_ipcomp.t | 1 +
- 2 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libxt_ipcomp.c b/extensions/libxt_ipcomp.c
-index 4171c4a1c4eb7..961c17e584933 100644
---- a/extensions/libxt_ipcomp.c
-+++ b/extensions/libxt_ipcomp.c
-@@ -76,11 +76,12 @@ static void comp_print(const void *ip, const struct xt_entry_match *match,
- static void comp_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct xt_ipcomp *compinfo = (struct xt_ipcomp *)match->data;
-+	bool inv_spi = compinfo->invflags & XT_IPCOMP_INV_SPI;
- 
- 	if (!(compinfo->spis[0] == 0
--	    && compinfo->spis[1] == 0xFFFFFFFF)) {
--		printf("%s --ipcompspi ",
--			(compinfo->invflags & XT_IPCOMP_INV_SPI) ? " !" : "");
-+	    && compinfo->spis[1] == UINT32_MAX
-+	    && !inv_spi)) {
-+		printf("%s --ipcompspi ", inv_spi ? " !" : "");
- 		if (compinfo->spis[0]
- 		    != compinfo->spis[1])
- 			printf("%u:%u",
-diff --git a/extensions/libxt_ipcomp.t b/extensions/libxt_ipcomp.t
-index 8546ba9ce416f..47c1fbc220c6a 100644
---- a/extensions/libxt_ipcomp.t
-+++ b/extensions/libxt_ipcomp.t
-@@ -1,3 +1,4 @@
- :INPUT,OUTPUT
- -p ipcomp -m ipcomp --ipcompspi 18 -j DROP;=;OK
- -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT;=;OK
-+-p ipcomp -m ipcomp ! --ipcompspi :;-p ipcomp -m ipcomp ! --ipcompspi 0:4294967295;OK

0019-nft-Do-not-omit-full-ranges-if-inverted.patch

@@ -1,70 +0,0 @@
-From 9334c226a2650d2fcadb531c8cf628472bf88791 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 2 Feb 2024 13:14:29 +0100
-Subject: [PATCH] nft: Do not omit full ranges if inverted
-
-Otherwise this turns a never matching rule into an always matching one.
-
-Fixes: c034cf31dd1a9 ("nft: prefer native expressions instead of udp match")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 4195a89ab2e2bd690ba255e40a5c3d309f031796)
-
-Conflicts:
-	extensions/libxt_tcp.t
-	extensions/libxt_udp.t
-- Missing commits adding test cases, add relevant ones manually instead
-  of adjusting the wrong ones as the original commit does.
----
- extensions/libxt_tcp.t | 2 ++
- extensions/libxt_udp.t | 2 ++
- iptables/nft.c         | 4 ++--
- 3 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t
-index 7a3bbd08952f0..3caa3e3f50271 100644
---- a/extensions/libxt_tcp.t
-+++ b/extensions/libxt_tcp.t
-@@ -6,6 +6,8 @@
- -p tcp -m tcp --sport 1:1023;=;OK
- -p tcp -m tcp --sport 1024:65535;=;OK
- -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK
-+-p tcp -m tcp ! --sport :;-p tcp -m tcp;OK
-+-p tcp -m tcp ! --dport :;-p tcp -m tcp;OK
- -p tcp -m tcp ! --sport 1;=;OK
- -p tcp -m tcp ! --sport 65535;=;OK
- -p tcp -m tcp ! --dport 1;=;OK
-diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t
-index f534770191a6e..aa2c91770e63f 100644
---- a/extensions/libxt_udp.t
-+++ b/extensions/libxt_udp.t
-@@ -6,6 +6,8 @@
- -p udp -m udp --sport 1:1023;=;OK
- -p udp -m udp --sport 1024:65535;=;OK
- -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK
-+-p udp -m udp ! --sport :;-p udp -m udp;OK
-+-p udp -m udp ! --dport :;-p udp -m udp;OK
- -p udp -m udp ! --sport 1;=;OK
- -p udp -m udp ! --sport 65535;=;OK
- -p udp -m udp ! --dport 1;=;OK
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 97fd4f49fdb4c..8e7a38ac93a3e 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -1323,7 +1323,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r,
- 		return 0;
- 	}
- 
--	if (src[0] || src[1] < 0xffff) {
-+	if (src[0] || src[1] < UINT16_MAX || invert_src) {
- 		expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 0, 2, &reg);
- 		if (!expr)
- 			return -ENOMEM;
-@@ -1334,7 +1334,7 @@ static int add_nft_tcpudp(struct nft_handle *h,struct nftnl_rule *r,
- 			return ret;
- 	}
- 
--	if (dst[0] || dst[1] < 0xffff) {
-+	if (dst[0] || dst[1] < UINT16_MAX || invert_dst) {
- 		expr = gen_payload(h, NFT_PAYLOAD_TRANSPORT_HEADER, 2, 2, &reg);
- 		if (!expr)
- 			return -ENOMEM;

0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch

@@ -1,304 +0,0 @@
-From 0688ef2b69f07afabfca2ab171260de9f09d0821 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 1 Feb 2024 17:42:12 +0100
-Subject: [PATCH] extensions: tcp/udp: Save/xlate inverted full ranges
-
-Also translate a bare '-m tcp/udp' to 'meta l4proto' match.
-
-Fixes: 04f569ded54a7 ("extensions: libxt_udp: add translation to nft")
-Fixes: fb2593ebbf656 ("extensions: libxt_tcp: add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit a86eb41ef2987a9f99cb2ef644fbe2a2096d58b2)
-
-Conflicts:
-	extensions/libxt_tcp.t
-	extensions/libxt_tcp.txlate
-	extensions/libxt_udp.t
-	extensions/libxt_udp.txlate
-- Context change due to Missing commits adding test cases.
----
- extensions/libxt_tcp.c      | 48 +++++++++++++++++++++++--------------
- extensions/libxt_tcp.t      |  4 ++--
- extensions/libxt_tcp.txlate |  6 +++++
- extensions/libxt_udp.c      | 43 ++++++++++++++++++++-------------
- extensions/libxt_udp.t      |  4 ++--
- extensions/libxt_udp.txlate |  6 +++++
- 6 files changed, 72 insertions(+), 39 deletions(-)
-
-diff --git a/extensions/libxt_tcp.c b/extensions/libxt_tcp.c
-index f82572828649b..32bbd684fd5d7 100644
---- a/extensions/libxt_tcp.c
-+++ b/extensions/libxt_tcp.c
-@@ -225,13 +225,18 @@ print_port(uint16_t port, int numeric)
- 		printf("%s", service);
- }
- 
-+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv)
-+{
-+	return min == 0 && max == UINT16_MAX && !inv;
-+}
-+
- static void
- print_ports(const char *name, uint16_t min, uint16_t max,
- 	    int invert, int numeric)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFF || invert) {
-+	if (!skip_ports_match(min, max, invert)) {
- 		printf(" %s", name);
- 		if (min == max) {
- 			printf(":%s", inv);
-@@ -315,10 +320,11 @@ tcp_print(const void *ip, const struct xt_entry_match *match, int numeric)
- static void tcp_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct xt_tcp *tcpinfo = (struct xt_tcp *)match->data;
-+	bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT;
-+	bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT;
- 
--	if (tcpinfo->spts[0] != 0
--	    || tcpinfo->spts[1] != 0xFFFF) {
--		if (tcpinfo->invflags & XT_TCP_INV_SRCPT)
-+	if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) {
-+		if (inv_srcpt)
- 			printf(" !");
- 		if (tcpinfo->spts[0]
- 		    != tcpinfo->spts[1])
-@@ -330,9 +336,8 @@ static void tcp_save(const void *ip, const struct xt_entry_match *match)
- 			       tcpinfo->spts[0]);
- 	}
- 
--	if (tcpinfo->dpts[0] != 0
--	    || tcpinfo->dpts[1] != 0xFFFF) {
--		if (tcpinfo->invflags & XT_TCP_INV_DSTPT)
-+	if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) {
-+		if (inv_dstpt)
- 			printf(" !");
- 		if (tcpinfo->dpts[0]
- 		    != tcpinfo->dpts[1])
-@@ -397,39 +402,42 @@ static int tcp_xlate(struct xt_xlate *xl,
- {
- 	const struct xt_tcp *tcpinfo =
- 		(const struct xt_tcp *)params->match->data;
-+	bool inv_srcpt = tcpinfo->invflags & XT_TCP_INV_SRCPT;
-+	bool inv_dstpt = tcpinfo->invflags & XT_TCP_INV_DSTPT;
-+	bool xlated = false;
- 
--	if (tcpinfo->spts[0] != 0 || tcpinfo->spts[1] != 0xffff) {
-+	if (!skip_ports_match(tcpinfo->spts[0], tcpinfo->spts[1], inv_srcpt)) {
- 		if (tcpinfo->spts[0] != tcpinfo->spts[1]) {
- 			xt_xlate_add(xl, "tcp sport %s%u-%u",
--				   tcpinfo->invflags & XT_TCP_INV_SRCPT ?
--					"!= " : "",
-+				   inv_srcpt ? "!= " : "",
- 				   tcpinfo->spts[0], tcpinfo->spts[1]);
- 		} else {
- 			xt_xlate_add(xl, "tcp sport %s%u",
--				   tcpinfo->invflags & XT_TCP_INV_SRCPT ?
--					"!= " : "",
-+				   inv_srcpt ? "!= " : "",
- 				   tcpinfo->spts[0]);
- 		}
-+		xlated = true;
- 	}
- 
--	if (tcpinfo->dpts[0] != 0 || tcpinfo->dpts[1] != 0xffff) {
-+	if (!skip_ports_match(tcpinfo->dpts[0], tcpinfo->dpts[1], inv_dstpt)) {
- 		if (tcpinfo->dpts[0] != tcpinfo->dpts[1]) {
- 			xt_xlate_add(xl, "tcp dport %s%u-%u",
--				   tcpinfo->invflags & XT_TCP_INV_DSTPT ?
--					"!= " : "",
-+				   inv_dstpt ? "!= " : "",
- 				   tcpinfo->dpts[0], tcpinfo->dpts[1]);
- 		} else {
- 			xt_xlate_add(xl, "tcp dport %s%u",
--				   tcpinfo->invflags & XT_TCP_INV_DSTPT ?
--					"!= " : "",
-+				   inv_dstpt ? "!= " : "",
- 				   tcpinfo->dpts[0]);
- 		}
-+		xlated = true;
- 	}
- 
--	if (tcpinfo->option)
-+	if (tcpinfo->option) {
- 		xt_xlate_add(xl, "tcp option %u %s", tcpinfo->option,
- 			     tcpinfo->invflags & XT_TCP_INV_OPTION ?
- 			     "missing" : "exists");
-+		xlated = true;
-+	}
- 
- 	if (tcpinfo->flg_mask || (tcpinfo->invflags & XT_TCP_INV_FLAGS)) {
- 		xt_xlate_add(xl, "tcp flags %s",
-@@ -437,8 +445,12 @@ static int tcp_xlate(struct xt_xlate *xl,
- 		print_tcp_xlate(xl, tcpinfo->flg_cmp);
- 		xt_xlate_add(xl, " / ");
- 		print_tcp_xlate(xl, tcpinfo->flg_mask);
-+		xlated = true;
- 	}
- 
-+	if (!xlated)
-+		xt_xlate_add(xl, "meta l4proto tcp");
-+
- 	return 1;
- }
- 
-diff --git a/extensions/libxt_tcp.t b/extensions/libxt_tcp.t
-index 3caa3e3f50271..8baeeff2fc94b 100644
---- a/extensions/libxt_tcp.t
-+++ b/extensions/libxt_tcp.t
-@@ -6,8 +6,8 @@
- -p tcp -m tcp --sport 1:1023;=;OK
- -p tcp -m tcp --sport 1024:65535;=;OK
- -p tcp -m tcp --sport 1024:;-p tcp -m tcp --sport 1024:65535;OK
---p tcp -m tcp ! --sport :;-p tcp -m tcp;OK
---p tcp -m tcp ! --dport :;-p tcp -m tcp;OK
-+-p tcp -m tcp ! --sport :;-p tcp -m tcp ! --sport 0:65535;OK
-+-p tcp -m tcp ! --dport :;-p tcp -m tcp ! --dport 0:65535;OK
- -p tcp -m tcp ! --sport 1;=;OK
- -p tcp -m tcp ! --sport 65535;=;OK
- -p tcp -m tcp ! --dport 1;=;OK
-diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate
-index 9802ddfe0039e..b3ddcc15833cf 100644
---- a/extensions/libxt_tcp.txlate
-+++ b/extensions/libxt_tcp.txlate
-@@ -30,3 +30,9 @@ nft 'add rule ip filter INPUT tcp option 23 exists counter'
- 
- iptables-translate -A INPUT -p tcp ! --tcp-option 23
- nft 'add rule ip filter INPUT tcp option 23 missing counter'
-+
-+iptables-translate -I OUTPUT -p tcp --sport 0:65535 -j ACCEPT
-+nft 'insert rule ip filter OUTPUT meta l4proto tcp counter accept'
-+
-+iptables-translate -I OUTPUT -p tcp ! --sport 0:65535 -j ACCEPT
-+nft 'insert rule ip filter OUTPUT tcp sport != 0-65535 counter accept'
-diff --git a/extensions/libxt_udp.c b/extensions/libxt_udp.c
-index ba1c3eb768592..748d418039c3a 100644
---- a/extensions/libxt_udp.c
-+++ b/extensions/libxt_udp.c
-@@ -82,13 +82,18 @@ print_port(uint16_t port, int numeric)
- 		printf("%s", service);
- }
- 
-+static bool skip_ports_match(uint16_t min, uint16_t max, bool inv)
-+{
-+	return min == 0 && max == UINT16_MAX && !inv;
-+}
-+
- static void
- print_ports(const char *name, uint16_t min, uint16_t max,
- 	    int invert, int numeric)
- {
- 	const char *inv = invert ? "!" : "";
- 
--	if (min != 0 || max != 0xFFFF || invert) {
-+	if (!skip_ports_match(min, max, invert)) {
- 		printf(" %s", name);
- 		if (min == max) {
- 			printf(":%s", inv);
-@@ -122,10 +127,11 @@ udp_print(const void *ip, const struct xt_entry_match *match, int numeric)
- static void udp_save(const void *ip, const struct xt_entry_match *match)
- {
- 	const struct xt_udp *udpinfo = (struct xt_udp *)match->data;
-+	bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT;
-+	bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT;
- 
--	if (udpinfo->spts[0] != 0
--	    || udpinfo->spts[1] != 0xFFFF) {
--		if (udpinfo->invflags & XT_UDP_INV_SRCPT)
-+	if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) {
-+		if (inv_srcpt)
- 			printf(" !");
- 		if (udpinfo->spts[0]
- 		    != udpinfo->spts[1])
-@@ -137,9 +143,8 @@ static void udp_save(const void *ip, const struct xt_entry_match *match)
- 			       udpinfo->spts[0]);
- 	}
- 
--	if (udpinfo->dpts[0] != 0
--	    || udpinfo->dpts[1] != 0xFFFF) {
--		if (udpinfo->invflags & XT_UDP_INV_DSTPT)
-+	if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) {
-+		if (inv_dstpt)
- 			printf(" !");
- 		if (udpinfo->dpts[0]
- 		    != udpinfo->dpts[1])
-@@ -156,35 +161,39 @@ static int udp_xlate(struct xt_xlate *xl,
- 		     const struct xt_xlate_mt_params *params)
- {
- 	const struct xt_udp *udpinfo = (struct xt_udp *)params->match->data;
-+	bool inv_srcpt = udpinfo->invflags & XT_UDP_INV_SRCPT;
-+	bool inv_dstpt = udpinfo->invflags & XT_UDP_INV_DSTPT;
-+	bool xlated = false;
- 
--	if (udpinfo->spts[0] != 0 || udpinfo->spts[1] != 0xFFFF) {
-+	if (!skip_ports_match(udpinfo->spts[0], udpinfo->spts[1], inv_srcpt)) {
- 		if (udpinfo->spts[0] != udpinfo->spts[1]) {
- 			xt_xlate_add(xl,"udp sport %s%u-%u",
--				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
--					 "!= ": "",
-+				   inv_srcpt ? "!= ": "",
- 				   udpinfo->spts[0], udpinfo->spts[1]);
- 		} else {
- 			xt_xlate_add(xl, "udp sport %s%u",
--				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
--					 "!= ": "",
-+				   inv_srcpt ? "!= ": "",
- 				   udpinfo->spts[0]);
- 		}
-+		xlated = true;
- 	}
- 
--	if (udpinfo->dpts[0] != 0 || udpinfo->dpts[1] != 0xFFFF) {
-+	if (!skip_ports_match(udpinfo->dpts[0], udpinfo->dpts[1], inv_dstpt)) {
- 		if (udpinfo->dpts[0]  != udpinfo->dpts[1]) {
- 			xt_xlate_add(xl,"udp dport %s%u-%u",
--				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
--					 "!= ": "",
-+				   inv_dstpt ? "!= ": "",
- 				   udpinfo->dpts[0], udpinfo->dpts[1]);
- 		} else {
- 			xt_xlate_add(xl,"udp dport %s%u",
--				   udpinfo->invflags & XT_UDP_INV_SRCPT ?
--					 "!= ": "",
-+				   inv_dstpt ? "!= ": "",
- 				   udpinfo->dpts[0]);
- 		}
-+		xlated = true;
- 	}
- 
-+	if (!xlated)
-+		xt_xlate_add(xl, "meta l4proto udp");
-+
- 	return 1;
- }
- 
-diff --git a/extensions/libxt_udp.t b/extensions/libxt_udp.t
-index aa2c91770e63f..0cde6ac30cc15 100644
---- a/extensions/libxt_udp.t
-+++ b/extensions/libxt_udp.t
-@@ -6,8 +6,8 @@
- -p udp -m udp --sport 1:1023;=;OK
- -p udp -m udp --sport 1024:65535;=;OK
- -p udp -m udp --sport 1024:;-p udp -m udp --sport 1024:65535;OK
---p udp -m udp ! --sport :;-p udp -m udp;OK
---p udp -m udp ! --dport :;-p udp -m udp;OK
-+-p udp -m udp ! --sport :;-p udp -m udp ! --sport 0:65535;OK
-+-p udp -m udp ! --dport :;-p udp -m udp ! --dport 0:65535;OK
- -p udp -m udp ! --sport 1;=;OK
- -p udp -m udp ! --sport 65535;=;OK
- -p udp -m udp ! --dport 1;=;OK
-diff --git a/extensions/libxt_udp.txlate b/extensions/libxt_udp.txlate
-index 28e7ca206b26b..d6bbb96f5d744 100644
---- a/extensions/libxt_udp.txlate
-+++ b/extensions/libxt_udp.txlate
-@@ -9,3 +9,9 @@ nft 'insert rule ip filter OUTPUT ip protocol udp ip daddr 8.8.8.8 counter accep
- 
- iptables-translate -I OUTPUT -p udp --dport 1020:1023 --sport 53 -j ACCEPT
- nft 'insert rule ip filter OUTPUT udp sport 53 udp dport 1020-1023 counter accept'
-+
-+iptables-translate -I OUTPUT -p udp --sport 0:65535 -j ACCEPT
-+nft 'insert rule ip filter OUTPUT meta l4proto udp counter accept'
-+
-+iptables-translate -I OUTPUT -p udp ! --sport 0:65535 -j ACCEPT
-+nft 'insert rule ip filter OUTPUT udp sport != 0-65535 counter accept'

0021-nft-Fix-for-broken-recover_rule_compat.patch

@@ -1,89 +0,0 @@
-From 81496d5fb59ed50eca69424561203fe25014425f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 27 Feb 2024 18:47:39 +0100
-Subject: [PATCH] nft: Fix for broken recover_rule_compat()
-
-When IPv4 rule generator was changed to emit payload instead of
-meta expressions for l4proto matches, the code reinserting
-NFTNL_RULE_COMPAT_* attributes into rules being reused for counter
-zeroing was broken by accident.
-
-Make rule compat recovery aware of the alternative match, basically
-reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules
-with NFTA_RULE_COMPAT") but add a test case this time to make sure
-things stay intact.
-
-Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305)
----
- iptables/nft.c                                | 27 ++++++++++++++++---
- .../nft-only/0011-zero-needs-compat_0         | 12 +++++++++
- 2 files changed, 35 insertions(+), 4 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 8e7a38ac93a3e..42907a431a99e 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err)
- 	return strerror(err);
- }
- 
-+static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp)
-+{
-+	const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME);
-+	uint32_t poff = offsetof(struct iphdr, protocol);
-+	uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER;
-+
-+	if (!strcmp(name, "payload") &&
-+	    nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase &&
-+	    nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff &&
-+	    nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) {
-+		*dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG);
-+		return 0;
-+	}
-+	if (!strcmp(name, "meta") &&
-+	    nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) {
-+		*dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG);
-+		return 0;
-+	}
-+	return -1;
-+}
-+
- static int recover_rule_compat(struct nftnl_rule *r)
- {
- 	struct nftnl_expr_iter *iter;
-@@ -3695,12 +3716,10 @@ static int recover_rule_compat(struct nftnl_rule *r)
- 	if (!e)
- 		goto out;
- 
--	if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) ||
--	    nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO)
-+	/* may be 'ip protocol' or 'meta l4proto' with identical RHS */
-+	if (l4proto_expr_get_dreg(e, &reg) < 0)
- 		goto next_expr;
- 
--	reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG);
--
- 	e = nftnl_expr_iter_next(iter);
- 	if (!e)
- 		goto out;
-diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0
-new file mode 100755
-index 0000000000000..e276a953234cf
---- /dev/null
-+++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0
-@@ -0,0 +1,12 @@
-+#!/bin/bash
-+
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+
-+set -e
-+
-+rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080"
-+for cmd in iptables ip6tables; do
-+	$XT_MULTI $cmd -t mangle -A PREROUTING $rule
-+	$XT_MULTI $cmd -t mangle -Z
-+	$XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}"
-+done

0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch

@@ -1,48 +0,0 @@
-From b656e2c619d1c617a028dcb9a98378bf0e58b636 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 5 Mar 2024 17:02:56 +0100
-Subject: [PATCH] xlate: libip6t_mh: Fix and simplify plain '-m mh' match
-
-Since core xlate code now ignores '-p mh' if an mh extension is also
-present in the rule, mh extension has to emit the l4proto match itself.
-Therefore emit the exthdr match irrespective of '-p' argument value just
-like other IPv6 extension header matches do.
-
-Fixes: 83f60fb37d594 ("extensions: mh: Save/xlate inverted full ranges")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 400fb98dde882da4c1d2c763de3f16a8ba1484b4)
----
- extensions/libip6t_mh.c      | 4 +---
- extensions/libip6t_mh.txlate | 2 +-
- 2 files changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/extensions/libip6t_mh.c b/extensions/libip6t_mh.c
-index 3f80e28ec94c8..1a1cee832b584 100644
---- a/extensions/libip6t_mh.c
-+++ b/extensions/libip6t_mh.c
-@@ -214,11 +214,9 @@ static int mh_xlate(struct xt_xlate *xl,
- {
- 	const struct ip6t_mh *mhinfo = (struct ip6t_mh *)params->match->data;
- 	bool inv_type = mhinfo->invflags & IP6T_MH_INV_TYPE;
--	uint8_t proto = ((const struct ip6t_ip6 *)params->ip)->proto;
- 
- 	if (skip_types_match(mhinfo->types[0], mhinfo->types[1], inv_type)) {
--		if (proto != IPPROTO_MH)
--			xt_xlate_add(xl, "exthdr mh exists");
-+		xt_xlate_add(xl, "exthdr mh exists");
- 		return 1;
- 	}
- 
-diff --git a/extensions/libip6t_mh.txlate b/extensions/libip6t_mh.txlate
-index 3364ce574468f..7eeaeefab6116 100644
---- a/extensions/libip6t_mh.txlate
-+++ b/extensions/libip6t_mh.txlate
-@@ -5,7 +5,7 @@ ip6tables-translate -A INPUT -p mh --mh-type 1:3 -j ACCEPT
- nft 'add rule ip6 filter INPUT meta l4proto mobility-header mh type 1-3 counter accept'
- 
- ip6tables-translate -A INPUT -p mh --mh-type 0:255 -j ACCEPT
--nft 'add rule ip6 filter INPUT meta l4proto mobility-header counter accept'
-+nft 'add rule ip6 filter INPUT exthdr mh exists counter accept'
- 
- ip6tables-translate -A INPUT -m mh --mh-type 0:255 -j ACCEPT
- nft 'add rule ip6 filter INPUT exthdr mh exists counter accept'

0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch

@@ -1,48 +0,0 @@
-From 2ce2cd546e199387d315a6f9b3d12b172c1f9b2c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 9 Apr 2024 13:18:12 +0200
-Subject: [PATCH] xshared: Fix parsing of empty string arg in '-c' option
-
-Calling iptables with '-c ""' resulted in a call to strchr() with an
-invalid pointer as 'optarg + 1' points to past the buffer. The most
-simple fix is to drop the offset: The global optstring part specifies a
-single colon after 'c', so getopt() enforces a valid pointer in optarg.
-If it contains a comma at first position, packet counter value parsing
-will fail so all cases are covered.
-
-Reported-by: gorbanev.es@gmail.com
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1741
-Fixes: 60a6073690a45 ("Make --set-counters (-c) accept comma separated counters")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit a2911408959d7e86bc4bad4f1be2551a19ad125c)
----
- extensions/iptables.t | 5 +++++
- iptables/xshared.c    | 2 +-
- 2 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/extensions/iptables.t b/extensions/iptables.t
-index b4b6d677abab1..5d6d3d15cc5fd 100644
---- a/extensions/iptables.t
-+++ b/extensions/iptables.t
-@@ -4,3 +4,8 @@
- -i eth+ -o alongifacename+;=;OK
- ! -i eth0;=;OK
- ! -o eth+;=;OK
-+-c "";;FAIL
-+-c ,3;;FAIL
-+-c 3,;;FAIL
-+-c ,;;FAIL
-+-c 2,3 -j ACCEPT;-j ACCEPT;OK
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 690502c457dd0..f2e3bc03a2824 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -1748,7 +1748,7 @@ void do_parse(int argc, char *argv[],
- 			set_option(&cs->options, OPT_COUNTERS, &args->invflags,
- 				   invert);
- 			args->pcnt = optarg;
--			args->bcnt = strchr(args->pcnt + 1, ',');
-+			args->bcnt = strchr(args->pcnt, ',');
- 			if (args->bcnt)
- 			    args->bcnt++;
- 			if (!args->bcnt && xs_has_arg(argc, argv))

arptables.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=Automates a packet filtering firewall with arptables
+After=network.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/arptables-helper start
+ExecStop=/usr/libexec/arptables-helper stop
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

coreteam-gpg-key-0xD55D978A8A1420E4.txt

@@ -1,64 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBF+HdQgBEACzteJUJGtj3N6u5mcGh4Nu/9GQfwrrphZuI7jto2N6+ZoURded
-660mFLnax7wgIE8ugAa085jwFWbFY3FzGutUs/kDmnqy9WneYNBLIAF3ZTFfY+oi
-V1C09bBlHKDj9gSEM2TZ/qU14exKdSloqcMKSdIqLQX27w/D6WmO1crDjOKKN9F2
-zjc3uLjo1gIPrY+Kdld29aI0W4gYvNLOo+ewhVC5Q6ymWOdR3eKaP2HIAt8CYf0t
-Sx8ChHdBvXQITDmXoGPLTTiCHBoUzaJ/N8m4AZTuSUTr9g3jUNFmL48OrJjFPhHh
-KDY0V59id5nPu4RX3fa/XW+4FNlrthA5V9dQSIPh7r7uHynDtkcCHT5m4mn0NqG3
-dsUqeYQlrWKCVDTfX/WQB3Rq1tgmOssFG9kZkXcVTmis3KFP1ZAahBRB33OJgSfi
-WKc/mWLMEQcljbysbJzq74Vrjg44DNK7vhAXGoR35kjj5saduxTywdb3iZhGXEsg
-9zqV0uOIfMQsQJQCZTlkqvZibdB3xlRyiCwqlf1eHB2Vo7efWbRIizX2da4c5xUj
-+IL1eSPmTV+52x1dYXpn/cSVKJAROtcSmwvMRyjuGOcTNtir0XHCxC5YYBow6tKR
-U1hrFiulCMH80HeS+u/g4SpT4lcv+x0DlN5BfWQuN5k5ZzwKb6EQs092qQARAQAB
-tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
-VAQTAQoAPhYhBDfZZKzASYHHVQD7m9Vdl4qKFCDkBQJfh3UIAhsDBQkHhM4ABQsJ
-CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENVdl4qKFCDk0msQAJTIK8TLHw2IJDc6
-+ZfUJc+znSNwskO+A4lwvb1vRY5qFV+CA2S1eUS4HGDWDT0sPKie6Nx4+FBczkWd
-RA+eaKDqQeS5Vzc2f0bl74un91h7yE8O2NsVnpL166MnAAk3/ACjHsZX2PzF12F6
-4stvGQFpjZRWItj0I6bvPY6CTtqVPB98a6RpdbS9kGxCCMrL3CFGDXGSjXes5KwN
-IvngmVB36wjb3QgEtQIv13jrWFfiXeuieqMRyC6Z3KNYVcvis34eGxPFD9MHrK+w
-bdw3KzMBJd7hMoVRl32Q13T/PX8H3pqWMqKaL41wHUswRt0IQjNZnRvRnlJ0VDFf
-Wep/3dFK+uQbdABuiwCiRli5mWeOMCP+qJodP1OZSGqg0VwZWUGdCGG5+qIhngOj
-QVomvJ7N4eRLU3xuPVjLoBeHzvViUPpYtWQ/YiZK5rWTJHhu88xZaysFJRaV+Uz3
-wPkeqdArRRXl1Tpy+cKy7D5BZAr7OjT1wboon23IM2DJRurbaHD8blMsjZ07pbvb
-4hdpiE6mqq7CYskDz2UGTaFfEW4bFnKtvKTXEnmcqc4mWcr2z9BBYouGmcFczgET
-tE02XejmExXV2RPUtXfLuNIbVpuXG1qhzNuXAfm+S/68XDSFrwyK8/Dgq5ga0iIP
-n8Uvz12Xu/Qde+NicogLNWF90QJ2iQIzBBABCgAdFiEEwJ2yBj8dcDS6YVKtq0ZV
-oSbSkuQFAl+HdTEACgkQq0ZVoSbSkuSrmhAAi64OqYjb2ZbAJbFAPM6pijyys6Y9
-o8ZyLoCRCUXNrjWkNIozTgmj5fm0ECrUXKyrB6OJhTvaRXmqLcBwWOAnP1v7wb+S
-ZhEwP0n6E1mZW0t1Qt0xX8yifM5Tpvy+757OSrsuoRpXwwz4Ubuc6G4N/McoRSfU
-tVUcz3sKF8hcbETD/hVZb9Qfv0ZjQxu8LiBfKfgy2Eg8yExTdO027hYqQc5q2HEp
-HRjD2PMyI33V8KqffWn0AkofweOOFxg1ePV5X9M8rYP+k/2gjPkrrvnZgF/4SxDM
-FATmHaIbO3zEQg+u2f1mVCZASBBN1MLth7dMOoClHBmxnQ8uapRg9GNxs7TnXmV/
-diZZbqLf6i9bW/scvWEIdM8EGKpbGjdWIlgQJTIuz3seB+9zOdq9L3uTQWHnYLid
-R3YkyOsBRqQvM7Gb3zYgvlPjZ+L2FeGg5rD/eeLbv+k027E0TSAgtHoSA2pVTDDK
-uqCXVKfmk1I0SO83L9teBblxed07LeVaS9/uK00rWM/TM1bwogfF/4ZEsmAWznzv
-Xan/QmrYNgK3C3AZ4pMX7pGCGV1w93Fw3tUzaEJeS2LlsiL5aPOF63b/DqM6W2nl
-UqGjKTdVLuF+JgoRH5U2wCyHYhDFm+CaFsYUu2Jf5hTmVWOR3anBoXy6Ty8SoV8q
-KxtKpmKmIdPhDe65Ag0EX4d1CAEQANJMZApYzeeLrc7Rs6fGDK4Z3ejEST+aq7vO
-RT9YEppRBG1QoUDBuNodAFxIWM6SpwvN7X9AZeIML2EOjDabF5Q6RNHbwODyLDYc
-wmqtWh0NNpK85fXwDgcLOQW+dPimsk3ni1crXhhjZgs6syb9yM/pDi0Tf7wzNZt0
-0p736zlpQPMORfO+mFgac0FVt/GQsTdIwTBzZ36fcV3W8iPH334Sqsatp617R+z+
-q2alH8Vynz12iHi2oJFtmTxhghCROPcLWz3XMKv9A7BfuZeE0k+pK7xnBKrpZzKU
-k1j2uzTKzV2Bquo5HNDsy9PgQn16BlXVrxdHfQnBz2w67aHMKnPD/v+K81oxtnuk
-pwBAT8Wovkyy1VTLhQH5F0y5bpQrVH/Lwq0/q421hfD3iPHtb2tC1heT9ze/sqkY
-plctFb81fx3o8xcBpvuIaTB3URptf8JNvh5KjETZFMQvAddq8oYovoKu+Z/585uC
-qwO0Fohpw9qRwmhq7UBvGDVAVgo6kKjMW2Z9U3OnfggrDCytCIZh8eLNagfRL2cu
-iq8Sx+cGGt1zoCPhjDN1MaNt/KHm8Gxr+lP+RxH3Et3pEX6mmhSCaU4wr0W5Bf3p
-jEtiOwnqajisBQCHh49OGiV8Vg9uQN5GpLpPpbvnGS4vq8jdj6p3gsiS2F7JMy7O
-ysBENBkXABEBAAGJAjwEGAEKACYWIQQ32WSswEmBx1UA+5vVXZeKihQg5AUCX4d1
-CAIbDAUJB4TOAAAKCRDVXZeKihQg5NMIEACBdwXwDMRB8rQeqNrhbh7pjbHHFmag
-8bPvkmCq/gYGx9MQEKFUFtEGNSBh6m5pXr9hJ9HD2V16q9ERbuBcA6wosz4efQFB
-bbage7ZSECCN+xMLirQGRVbTozu2eS8FXedH0X9f0JWLDGWwRg+pAqSOtuFjHhYM
-jVpwbH/s71BhH84x5RgWezh2BWLbP3UuY7JtWNAvAaeo53Js2dzzgjDopPis4qZR
-rLR9cTGjqa6ZTc/PlLfaCsm6rGBlNx/bFJjz75+yn7vMQa47fOBt4qfriHX7G/Tg
-3s8xsQSLEm3IBEYh27hoc9ZD45EXgm9ZiGA21t9v1jA27yTVaUrPbC40iDv/CMcQ
-7N2Y1sJRvmrd+2pKxtNNutujjwgBguo5bKK253R5Hy0a+NzK2LSc/GmR8EJJEwW1
-7r6road7Ss6YImCZExeY+CAW0FEzwQpmqfOdlusvIyk4x4r12JH8Q8NWHMzU3Ym/
-yqdopn/SCwCfXJsL4/eHLCaWuyiWjljNa7MwPDITx2ZPRE5QEqCqi4gaDWXyVHt8
-leGE1G3zoXNJogWhDswh105UnlZEEfOvbHbaxgWPjLV/xkuHhVlaqdyXbTExrgK6
-U2wevNS03dBuQ6bjNIbMIt9ulbiBV8MJWR0PZtnNJ958f1QXC4GT+L3FG1g5Jtz+
-rlbu70nh2kSJrg==
-=wukb
------END PGP PUBLIC KEY BLOCK-----

coreteam-gpg-key-0xD70D1A666ACF2B21.txt

@@ -0,0 +1,64 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
+o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
+2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
+nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
+P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
+qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
+5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
+ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
+u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
+/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
+cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
+tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
+VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
+CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
+LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
+8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
+5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
+AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
+Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
+VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
+RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
+uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
+zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
+ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
+3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
+iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
+wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
+UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
+M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
+97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
+FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
+IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
+0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
+GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
+bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
+QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
+Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
+3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
+yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
+C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
+klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
+zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
+Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
+X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
+5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
+woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
+njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
+yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
+hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
+BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
+ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
+hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
+tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
+E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
+fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
+CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
+EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
+gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
+9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
+oD8ElPP+m/v6iA==
+=70vD
+-----END PGP PUBLIC KEY BLOCK-----

ebtables-config

@@ -0,0 +1,11 @@
+# Save current firewall rules on stop.
+#   Value: yes|no,  default: no
+# Saves all firewall rules if firewall gets stopped
+# (e.g. on system shutdown).
+EBTABLES_SAVE_ON_STOP="no"
+
+# Save (and restore) rule counters.
+#   Value: yes|no,  default: no
+# Save rule counters when saving a kernel table to a file. If the
+# rule counters were saved, they will be restored when restoring the table.
+EBTABLES_SAVE_COUNTER="no"

ebtables-helper

@@ -0,0 +1,102 @@
+#!/bin/bash
+
+# compat for removed initscripts dependency
+
+success() {
+       echo "[  OK  ]"
+       return 0
+}
+
+failure() {
+       echo "[FAILED]"
+       return 1
+}
+
+# internal variables
+EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
+EBTABLES_DATA=/etc/sysconfig/ebtables
+EBTABLES_TABLES="broute filter nat"
+VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
+
+# ebtables-config defaults
+EBTABLES_SAVE_ON_STOP="no"
+EBTABLES_SAVE_ON_RESTART="no"
+EBTABLES_SAVE_COUNTER="no"
+
+# load config if existing
+[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
+
+initialize() {
+	local ret=0
+	for table in $EBTABLES_TABLES; do
+		ebtables -t $table --init-table || ret=1
+	done
+	return $ret
+}
+
+sanitize_dump() {
+	local drop=false
+
+	export EBTABLES_TABLES
+
+	cat $1 | while read line; do
+		case $line in
+		\**)
+			drop=false
+			local table="${line#\*}"
+			local found=false
+			for t in $EBTABLES_TABLES; do
+				if [[ $t == $table ]]; then
+					found=true
+					break
+				fi
+			done
+			$found || drop=true
+			;;
+		esac
+		$drop || echo "$line"
+	done
+}
+
+start() {
+	if [ -f $EBTABLES_DATA ]; then
+		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
+		sanitize_dump $EBTABLES_DATA | ebtables-restore
+	else
+		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
+		initialize
+	fi
+	local ret=$?
+	touch $VAR_SUBSYS_EBTABLES
+	return $ret
+}
+
+save() {
+	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
+	export EBTABLES_SAVE_COUNTER
+	ebtables-save >$EBTABLES_DATA && success || failure
+}
+
+case $1 in
+	start)
+		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
+		start && success || failure
+		RETVAL=$?
+		;;
+	stop)
+		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
+		echo -n $"ebtables: stopping firewall: "
+		initialize && success || failure
+		RETVAL=$?
+		rm -f $VAR_SUBSYS_EBTABLES
+		;;
+	save)
+		save
+		;;
+	*)
+		echo "usage: ${0##*/} {start|stop|save}" >&2
+		RETVAL=2
+		;;
+esac
+
+exit $RETVAL

ebtables.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Ethernet Bridge Filtering tables
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/libexec/ebtables-helper start
+ExecStop=/usr/libexec/ebtables-helper stop
+
+[Install]
+WantedBy=multi-user.target

iptables-1.8.11-command-options-fix.patch

@@ -0,0 +1,27 @@
+commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Wed Apr 23 12:36:13 2025 +0200
+
+    xshared: Accept an option if any given command allows it
+    
+    Fixed commit made option checking overly strict: Some commands may be
+    commbined (foremost --list and --zero), reject a given option only if it
+    is not allowed by any of the given commands.
+    
+    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
+    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index cdfd11ab..fc61e0fd 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
+ 	 */
+ 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
+ 		if ((options & optval) &&
+-		    (options_v_commands[i] & command) != command)
++		    !(options_v_commands[i] & command))
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Illegal option `%s' with this command",
+ 				      ops->option_name(optval));

iptables-1.8.11-fix-interface-comparisons.patch

@@ -0,0 +1,172 @@
+From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Mon, 18 Nov 2024 13:56:50 +0000
+Subject: nft: fix interface comparisons in `-C` commands
+
+Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
+kernel") removed code which explicitly set interface masks to all ones.  The
+result of this is that they are zero.  However, they are used to mask interfaces
+in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
+comparisons are always true, and check commands which ought to fail succeed:
+
+  # iptables -N test
+  # iptables -A test -i lo \! -o lo -j REJECT
+  # iptables -v -L test
+  Chain test (0 references)
+   pkts bytes target     prot opt in     out     source               destination
+      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
+  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
+  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
+
+Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
+
+Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ iptables/nft-arp.c                                 | 10 ++----
+ iptables/nft-ipv4.c                                |  4 +--
+ iptables/nft-ipv6.c                                |  6 +---
+ iptables/nft-shared.c                              | 36 +++++-----------------
+ iptables/nft-shared.h                              |  6 +---
+ .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
+ 6 files changed, 22 insertions(+), 49 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 264864c3..c11d64c3 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
+ 		return false;
+ 	}
+ 
+-	return is_same_interfaces(a->arp.iniface,
+-				  a->arp.outiface,
+-				  (unsigned char *)a->arp.iniface_mask,
+-				  (unsigned char *)a->arp.outiface_mask,
+-				  b->arp.iniface,
+-				  b->arp.outiface,
+-				  (unsigned char *)b->arp.iniface_mask,
+-				  (unsigned char *)b->arp.outiface_mask);
++	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
++				  b->arp.iniface, b->arp.outiface);
+ }
+ 
+ static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index 74092875..0c8bd291 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
+-				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
+-				  b->fw.ip.iniface, b->fw.ip.outiface,
+-				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
++				  b->fw.ip.iniface, b->fw.ip.outiface);
+ }
+ 
+ static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index b184f8af..4dbb2af2 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
+ 	}
+ 
+ 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
+-				  a->fw6.ipv6.iniface_mask,
+-				  a->fw6.ipv6.outiface_mask,
+-				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
+-				  b->fw6.ipv6.iniface_mask,
+-				  b->fw6.ipv6.outiface_mask);
++				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
+ }
+ 
+ static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 6775578b..2c29e68f 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
+ }
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask)
++			const char *b_iniface, const char *b_outiface)
+ {
+-	int i;
+-
+-	for (i = 0; i < IFNAMSIZ; i++) {
+-		if (a_iniface_mask[i] != b_iniface_mask[i]) {
+-			DEBUGP("different iniface mask %x, %x (%d)\n",
+-			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
+-			return false;
+-		}
+-		if ((a_iniface[i] & a_iniface_mask[i])
+-		    != (b_iniface[i] & b_iniface_mask[i])) {
+-			DEBUGP("different iniface\n");
+-			return false;
+-		}
+-		if (a_outiface_mask[i] != b_outiface_mask[i]) {
+-			DEBUGP("different outiface mask\n");
+-			return false;
+-		}
+-		if ((a_outiface[i] & a_outiface_mask[i])
+-		    != (b_outiface[i] & b_outiface_mask[i])) {
+-			DEBUGP("different outiface\n");
+-			return false;
+-		}
++	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
++		DEBUGP("different iniface\n");
++		return false;
++	}
++	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
++		DEBUGP("different outiface\n");
++		return false;
+ 	}
+-
+ 	return true;
+ }
+ 
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 51d1e460..b57aee1f 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
+ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
+ 
+ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+-			unsigned const char *a_iniface_mask,
+-			unsigned const char *a_outiface_mask,
+-			const char *b_iniface, const char *b_outiface,
+-			unsigned const char *b_iniface_mask,
+-			unsigned const char *b_outiface_mask);
++			const char *b_iniface, const char *b_outiface);
+ 
+ void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+new file mode 100755
+index 00000000..278cd648
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
+@@ -0,0 +1,9 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++
++$XT_MULTI iptables -N test
++$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
++$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
++
++exit 0
+-- 
+cgit v1.2.3
+

iptables.spec

@@ -10,41 +10,27 @@
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: https://www.netfilter.org/projects/iptables
-Version: 1.8.10
-Release: 15%{?dist}
+Version: 1.8.11
+Release: 12%{?dist}
 Source0: %{url}/files/%{name}-%{version}.tar.xz
 source1: %{url}/files/%{name}-%{version}.tar.xz.sig
-Source2: coreteam-gpg-key-0xD55D978A8A1420E4.txt
+Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
 Source3: iptables.init
 Source4: iptables-config
 Source5: iptables.service
 Source6: sysconfig_iptables
 Source7: sysconfig_ip6tables
-Source8: arptables-nft-helper
-
-Patch001: 0001-libiptc-Fix-for-another-segfault-due-to-chain-index-.patch
-Patch002: 0002-arptables-nft-remove-ARPT_INV-flags-usage.patch
-Patch003: 0003-ebtables-Fix-corner-case-noflush-restore-bug.patch
-Patch004: 0004-xshared-struct-xt_cmd_parse-xlate-is-unused.patch
-Patch005: 0005-xshared-All-variants-support-v-update-OPTSTRING_COMM.patch
-Patch006: 0006-ebtables-Align-line-number-formatting-with-legacy.patch
-Patch007: 0007-man-Do-not-escape-exclamation-marks.patch
-Patch008: 0008-libxtables-xtoptions-Fix-for-non-CIDR-compatible-hos.patch
-Patch009: 0009-iptables-legacy-Fix-for-mandatory-lock-waiting.patch
-Patch010: 0010-libxtables-xtoptions-Prevent-XTOPT_PUT-with-XTTYPE_H.patch
-Patch011: 0011-nft-ruleparse-Add-missing-braces-around-ternary.patch
-Patch012: 0012-libxtables-Fix-memleak-of-matches-udata.patch
-Patch013: 0013-extensions-ah-Save-xlate-inverted-full-ranges.patch
-Patch014: 0014-extensions-frag-Save-xlate-inverted-full-ranges.patch
-Patch015: 0015-extensions-mh-Save-xlate-inverted-full-ranges.patch
-Patch016: 0016-extensions-rt-Save-xlate-inverted-full-ranges.patch
-Patch017: 0017-extensions-esp-Save-xlate-inverted-full-ranges.patch
-Patch018: 0018-extensions-ipcomp-Save-inverted-full-ranges.patch
-Patch019: 0019-nft-Do-not-omit-full-ranges-if-inverted.patch
-Patch020: 0020-extensions-tcp-udp-Save-xlate-inverted-full-ranges.patch
-Patch021: 0021-nft-Fix-for-broken-recover_rule_compat.patch
-Patch022: 0022-xlate-libip6t_mh-Fix-and-simplify-plain-m-mh-match.patch
-Patch023: 0023-xshared-Fix-parsing-of-empty-string-arg-in-c-option.patch
+Source8: arptables-helper
+Source9: arptables.service
+Source10: ebtables.service
+Source11: ebtables-helper
+Source12: ebtables-config
+# Patch to fix -C handling, already upstream
+# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
+Patch1: iptables-1.8.11-fix-interface-comparisons.patch
+# Patch to fix overly strict command option checking
+# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
+Patch2: iptables-1.8.11-command-options-fix.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
@@ -81,6 +67,7 @@ Summary: Legacy tools for managing Linux kernel packet filtering capabilities
 Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Conflicts: setup < 2.10.4-1
+Conflicts: alternatives < 1.32-1
 Requires(post): /usr/sbin/update-alternatives
 Requires(postun): /usr/sbin/update-alternatives
 %if 0%{?rhel} < 9
@@ -89,12 +76,7 @@ Provides:	iptables
 Provides:  %{name}-compat = %{version}-%{release}
 Obsoletes: %{name}-compat < 1.8.9-7
 
-%if "%{_sbindir}" == "%{_bindir}"
-# Compat symlinks for Requires in other packages.
-# We rely on filesystem to create the symlinks for us.
-Requires:       filesystem(unmerged-sbin-symlinks)
-Provides:       /usr/sbin/iptables
-%endif
+%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description legacy
 The iptables utility controls the network packet filtering code in the
@@ -118,9 +100,8 @@ Summary: iptables legacy libraries
 %description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real so version.
-
-For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real
+so version. For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
@@ -154,6 +135,14 @@ Requires: %{name}-utils = %{version}-%{release}
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
+# Look at me, I'm the new arptables-services now!
+Conflicts: %{name}-nft < 1.8.11-5
+Obsoletes: arptables-services < 0.0.5-16
+Provides: arptables-services = %{version}-%{release}
+# Look at me, I'm the new ebtables-services now!
+# (With epoch to turn our version number higher value)
+Obsoletes: ebtables-services < 2.0.11-20
+Provides: ebtables-services = 1:%{version}-%{release}
 BuildArch: noarch
 
 %description services
@@ -184,13 +173,11 @@ Provides: arptables-helper
 Provides: iptables
 Provides: arptables
 Provides: ebtables
+# allowing old arptables-legacy will break when switching alternatives
+# due to the dropped arptables-helper symlink
+Conflicts: arptables-legacy < 0.0.5-16
 
-%if "%{_sbindir}" == "%{_bindir}"
-# Compat symlinks for Requires in other packages.
-# We rely on filesystem to create the symlinks for us.
-Requires:       filesystem(unmerged-sbin-symlinks)
-Provides:       /usr/sbin/iptables
-%endif
+%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description nft
 nftables compatibility for iptables, arptables and ebtables.
@@ -222,16 +209,20 @@ install -d -m 755 %{buildroot}%{script_path}
 install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
 sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
+install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
 install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
 sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
 install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
 install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
+echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
+install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
+touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE5} %{buildroot}/%{_unitdir}
+install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
 sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
@@ -258,14 +249,13 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
 
-install -p -D -m 755 %{SOURCE8} %{buildroot}%{_libexecdir}/
-touch %{buildroot}%{_libexecdir}/arptables-helper
-
 # prepare for alternatives
 touch %{buildroot}%{_mandir}/man8/arptables.8
 touch %{buildroot}%{_mandir}/man8/arptables-save.8
 touch %{buildroot}%{_mandir}/man8/arptables-restore.8
 touch %{buildroot}%{_mandir}/man8/ebtables.8
+rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
 
 # fix absolute symlink
 ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
@@ -277,11 +267,20 @@ pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--slave $pfx6 ip6tables $pfx6-legacy \
-	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
-	--slave $pfx-save iptables-save $pfx-legacy-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
 
 %postun legacy
 if [ $1 -eq 0 ]; then
@@ -303,76 +302,93 @@ pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--slave $pfx6 ip6tables $pfx6-legacy \
-	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
-	--slave $pfx-save iptables-save $pfx-legacy-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
+	--follower $pfx6 ip6tables $pfx6-legacy \
+	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
+	--follower $pfx-save iptables-save $pfx-legacy-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
 alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
 rm /var/tmp/alternatives.iptables.current
 mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
 
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
+
 %post services
+%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
+%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
 %?ldconfig
+%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
 %post -e nft
 [[ %%{_excludedocs} == 1 ]] || do_man=true
 
+# remove non-symlinks in spots managed by alternatives
+# to cover for updates from not-yet-alternatived versions
+for pfx in %{_prefix}/sbin/{eb,arp}tables; do
+	for sfx in "" "-restore" "-save"; do
+		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+			rm -f $pfx$sfx
+		fi
+	done
+done
+for manpfx in %{_mandir}/man8/{eb,arp}tables; do
+	for sfx in {,-restore,-save}.8.gz; do
+		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
+			rm -f $manpfx$sfx
+		fi
+	done
+done
+
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
 update-alternatives --install \
 	$pfx iptables $pfx-nft 10 \
-	--slave $pfx6 ip6tables $pfx6-nft \
-	--slave $pfx-restore iptables-restore $pfx-nft-restore \
-	--slave $pfx-save iptables-save $pfx-nft-save \
-	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
-	--slave $pfx6-save ip6tables-save $pfx6-nft-save
+	--follower $pfx6 ip6tables $pfx6-nft \
+	--follower $pfx-restore iptables-restore $pfx-nft-restore \
+	--follower $pfx-save iptables-save $pfx-nft-save \
+	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--follower $pfx6-save ip6tables-save $pfx6-nft-save
 
 pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
-for sfx in "" "-restore" "-save"; do
-	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-		rm -f $pfx$sfx
-	fi
-done
-if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
-	rm -f $manpfx.8.gz
-fi
 update-alternatives --install \
 	$pfx ebtables $pfx-nft 10 \
-	--slave $pfx-save ebtables-save $pfx-nft-save \
-	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
-	${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
+	--follower $pfx-save ebtables-save $pfx-nft-save \
+	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
 
 pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
-lepfx=%{_libexecdir}/arptables
-for sfx in "" "-restore" "-save"; do
-	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-		rm -f $pfx$sfx
-	fi
-	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
-		rm -f $manpfx$sfx.8.gz
-	fi
-done
-if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
-	rm -f $lepfx-helper
-fi
 update-alternatives --install \
 	$pfx arptables $pfx-nft 10 \
-	--slave $pfx-save arptables-save $pfx-nft-save \
-	--slave $pfx-restore arptables-restore $pfx-nft-restore \
-	${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
-	${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
-	${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \
-	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
+	--follower $pfx-save arptables-save $pfx-nft-save \
+	--follower $pfx-restore arptables-restore $pfx-nft-restore \
+	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
+	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
+	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
+
+%if "%{_sbindir}" == "%{_bindir}"
+# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
+# directory. Those symlinks will only be created if there is no symlink
+# or file already.
+for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
+    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+done
+%endif
 
 %postun nft
 if [ $1 -eq 0 ]; then
@@ -389,7 +405,7 @@ fi
 %{_mandir}/man8/xtables-legacy*
 %dir %{_datadir}/xtables
 %{_datadir}/xtables/iptables.xslt
-%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
 %license COPYING
@@ -418,9 +434,13 @@ fi
 %dir %{script_path}
 %{script_path}/ip{,6}tables.init
 %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
-%{_unitdir}/ip{,6}tables.service
+%config(noreplace) %{_sysconfdir}/sysconfig/arptables
+%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
+%ghost %{_sysconfdir}/sysconfig/ebtables
+%{_unitdir}/{arp,eb,ip,ip6}tables.service
 %dir %{legacy_actions}/ip{,6}tables
 %{legacy_actions}/ip{,6}tables/{save,panic}
+%{_libexecdir}/{arp,eb}tables-helper
 
 %files utils
 %license COPYING
@@ -440,22 +460,59 @@ fi
 %{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
 %{_sbindir}/ebtables-translate
+%{_sbindir}/arptables-translate
 %dir %{_libdir}/xtables
 %{_libdir}/xtables/lib{arp,eb}t*
-%{_libexecdir}/arptables-nft-helper
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
 %{_mandir}/man8/ip{,6}tables{,-restore}-translate*
 %{_mandir}/man8/ebtables-translate*
-%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
-%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
-%ghost %{_libexecdir}/arptables-helper
+%{_mandir}/man8/arptables-translate*
+%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
 %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
+* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
+- Pull in upstream fix for too strict command option parsing
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
+- Fix for ghost files not present in iptables-nft RPM
+
+* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
+- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
+  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
+
+* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
+- Revert last release, it breaks alternatives symlinks
+
+* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
+- Keep symlinks managed by alternatives under /usr/bin
+
+* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
+- Add patch to fix -C handling ( fixes rhbz#2360423 )
+
+* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
+- iptables-services to assimilate arptables- and ebtables-services
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
+- Keep symlinks managed by alternatives under /usr/sbin
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
+- new version
+
 * Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 

sources

@@ -1,2 +1,2 @@
-SHA512 (iptables-1.8.10.tar.xz) = 71e6ed2260859157d61981a4fe5039dc9e8d7da885a626a4b5dae8164c509a9d9f874286b9468bb6a462d6e259d4d32d5967777ecefdd8a293011ae80c00f153
-SHA512 (iptables-1.8.10.tar.xz.sig) = d1159008cc864ba7cd5e386afe885f7a7e5760107750ddc380c0ce8585681315b8c0412af69b9c6659806c8364d7ca70d7a481f11a11957c3bc87e629d619748
+SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
+SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2