iptables-1.8.9-4.1

- Backport fixes from upstream
2023-10-10 18:41:06 +02:00
30 changed files with 1982 additions and 1 deletions
--- a/0018-iptables-Fix-setting-of-ipv6-counters.patch
+++ b/0018-iptables-Fix-setting-of-ipv6-counters.patch
@ -0,0 +1,102 @@
+From 935dddbb219eb09a289507e609ff8e9b4429c1ea Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 12:44:54 +0200
+Subject: [PATCH] iptables: Fix setting of ipv6 counters
+
+When setting counters using ip6tables-nft -c X Y the X and Y values were
+not stored.
+
+This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but
+applied to the nft variant of ipv6 not the legacy.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647
+Fixes: 0391677c1a0b2 ("xtables: add IPv6 support")
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ed839159edf8bda8e9196f1056c4038c22d78bfd)
+---
+ iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 | 6 +++---
+ iptables/tests/shell/testcases/iptables/0003-list-rules_0  | 6 +++---
+ iptables/xshared.c                                         | 3 +++
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+index c98bdd6e501aa..09e39927ef390 100755
+--- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $XT_MULTI ip6tables -N foo
+-$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT
+$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
+ $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo
+ $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+ 
+@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
+ -P FORWARD ACCEPT -c 0 0
+ -P OUTPUT ACCEPT -c 0 0
+ -N foo
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S)
+@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
+ 
+ EXPECT='-P FORWARD ACCEPT -c 0 0
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD)
+diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+index d335d44257a49..d07bd151be76b 100755
+--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $XT_MULTI iptables -N foo
+-$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT
+$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
+ $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo
+ $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+ 
+@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
+ -P FORWARD ACCEPT -c 0 0
+ -P OUTPUT ACCEPT -c 0 0
+ -N foo
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S)
+@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD)
+ 
+ EXPECT='-P FORWARD ACCEPT -c 0 0
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
+-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD)
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index 17aed04e02b09..71ee94d6f2f83 100644
+--- a/iptables/xshared.c
+++ b/iptables/xshared.c
+@@ -1992,6 +1992,9 @@ void ipv6_post_parse(int command, struct iptables_command_state *cs,
+ 	if (args->goto_set)
+ 		cs->fw6.ipv6.flags |= IP6T_F_GOTO;
+ 
+	/* nft-variants use cs->counters, legacy uses cs->fw6.counters */
+	cs->counters.pcnt = args->pcnt_cnt;
+	cs->counters.bcnt = args->bcnt_cnt;
+ 	cs->fw6.counters.pcnt = args->pcnt_cnt;
+ 	cs->fw6.counters.bcnt = args->bcnt_cnt;
+ 
+-- 
+2.41.0
+
--- a/0019-iptables-Fix-handling-of-non-existent-chains.patch
+++ b/0019-iptables-Fix-handling-of-non-existent-chains.patch
@ -0,0 +1,53 @@
+From cd3a8274e9e904d227b81ae7158d6e82b1311bf8 Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 13:46:36 +0200
+Subject: [PATCH] iptables: Fix handling of non-existent chains
+
+Since 694612adf87 the "compatibility" check considers non-existent
+chains as "incompatible". This broke some scripts which used calls
+like `iptables -L CHAIN404` to test for chain existence and expect
+"No chain/target/match by that name." in the output.
+
+This patch changes the logic of `nft_is_table_compatible()` to
+report non-existent chains as "compatible" which restores the old
+behavior.
+
+Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 82ccfb488eeac5507471099b9b4e6d136cc06e3b)
+---
+ iptables/nft.c                                              | 2 +-
+ iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 5896fd410ca78..5e4cd76b05504 100644
+--- a/iptables/nft.c
+++ b/iptables/nft.c
+@@ -3847,7 +3847,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
+ 	if (chain) {
+ 		struct nft_chain *c = nft_chain_find(h, table, chain);
+ 
+-		return c && !nft_is_chain_compatible(c, h);
+		return !c || !nft_is_chain_compatible(c, h);
+ 	}
+ 
+ 	return !nft_chain_foreach(h, table, nft_is_chain_compatible, h);
+diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+index 33c5f1f35d17f..234f3040516e1 100755
+--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar
+ cmd 0 -E foo bar
+ cmd 1 "$EEXIST_F" -E foo bar
+ cmd 1 "$ENOENT" -E foo bar2
+cmd 1 "$ENOENT" -L foo
+ cmd 0 -N foo2
+ cmd 1 "$EEXIST_F" -E foo2 bar
+ 
+-- 
+2.41.0
+
--- a/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch
+++ b/0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch
@ -0,0 +1,42 @@
+From 90ca86dfed56510ebc52ab2924800eb28ce0d951 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 20:08:09 +0100
+Subject: [PATCH] ebtables: ip and ip6 matches depend on protocol match
+
+This is consistent with legacy ebtables, also avoids invalid
+combinations like '-p IPv6 --ip-source 1.2.3.4'.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 267a26363826553280a5928043df30a07cdc63bb)
+---
+ iptables/nft-bridge.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index 83cbe31559d4b..b9983b203f6d0 100644
+--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
+@@ -104,11 +104,18 @@ static int
+ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+ 		     struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+-	if (!strcmp(m->u.user.name, "802_3") &&
+-	    !(fw->bitmask & EBT_802_3))
+	if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3))
+ 		xtables_error(PARAMETER_PROBLEM,
+ 			      "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH");
+ 
+	if (!strcmp(m->u.user.name, "ip") && fw->ethproto != htons(ETH_P_IP))
+		xtables_error(PARAMETER_PROBLEM,
+			      "For IP filtering the protocol must be specified as IPv4.");
+
+	if (!strcmp(m->u.user.name, "ip6") && fw->ethproto != htons(ETH_P_IPV6))
+		xtables_error(PARAMETER_PROBLEM,
+			      "For IPv6 filtering the protocol must be specified as IPv6.");
+
+ 	return add_match(h, r, m);
+ }
+ 
+-- 
+2.41.0
+
--- a/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
+++ b/0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
@ -0,0 +1,348 @@
+From a61cac5cdd4332cf84b9e2f554a1c8852d40dc0a Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 11 Jul 2023 22:06:44 +0200
+Subject: [PATCH] nft-bridge: pass context structure to ops->add() to improve
+ anonymous set support
+
+Add context structure to improve bridge among support which creates an
+anonymous set. This context structure specifies the command and it
+allows to optionally store a anonymous set.
+
+Use this context to generate native bytecode only if this is an
+add/insert/replace command.
+
+This fixes a dangling anonymous set that is created on rule removal.
+
+Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
+Reported-and-tested-by: Igor Raits <igor@gooddata.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 4e95200ded923f0eb5579c33b91176193c59dbe0)
+---
+ iptables/nft-arp.c    |  4 ++--
+ iptables/nft-bridge.c |  9 ++++----
+ iptables/nft-cmd.c    |  6 ++++-
+ iptables/nft-ipv4.c   |  6 ++---
+ iptables/nft-ipv6.c   |  6 ++---
+ iptables/nft-shared.h |  5 ++--
+ iptables/nft.c        | 54 ++++++++++++++++++++++++++++---------------
+ iptables/nft.h        |  9 +++++---
+ 8 files changed, 62 insertions(+), 37 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index df3ad430cf701..889387e4db592 100644
+--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
+@@ -40,8 +40,8 @@ static bool need_devaddr(struct arpt_devaddr_info *info)
+ 	return false;
+ }
+ 
+-static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r,
+-		       struct iptables_command_state *cs)
+static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+		       struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	struct arpt_entry *fw = &cs->arp;
+ 	uint32_t op;
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index b9983b203f6d0..a41f411fbba14 100644
+--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
+@@ -102,7 +102,8 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
+ 
+ static int
+ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+-		     struct nftnl_rule *r, struct xt_entry_match *m)
+		     struct nft_rule_ctx *ctx, struct nftnl_rule *r,
+		     struct xt_entry_match *m)
+ {
+ 	if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3))
+ 		xtables_error(PARAMETER_PROBLEM,
+@@ -116,10 +117,10 @@ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+ 		xtables_error(PARAMETER_PROBLEM,
+ 			      "For IPv6 filtering the protocol must be specified as IPv6.");
+ 
+-	return add_match(h, r, m);
+	return add_match(h, ctx, r, m);
+ }
+ 
+-static int nft_bridge_add(struct nft_handle *h,
+static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 			  struct nftnl_rule *r,
+ 			  struct iptables_command_state *cs)
+ {
+@@ -181,7 +182,7 @@ static int nft_bridge_add(struct nft_handle *h,
+ 
+ 	for (iter = cs->match_list; iter; iter = iter->next) {
+ 		if (iter->ismatch) {
+-			if (nft_bridge_add_match(h, fw, r, iter->u.match->m))
+			if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m))
+ 				break;
+ 		} else {
+ 			if (add_target(r, iter->u.watcher->t))
+diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
+index f16ea0e6eaf8b..8cf8027e7465d 100644
+--- a/iptables/nft-cmd.c
+++ b/iptables/nft-cmd.c
+@@ -14,12 +14,16 @@
+ #include <xtables.h>
+ #include "nft.h"
+ #include "nft-cmd.h"
+#include <libnftnl/set.h>
+ 
+ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 			    const char *table, const char *chain,
+ 			    struct iptables_command_state *state,
+ 			    int rulenum, bool verbose)
+ {
+	struct nft_rule_ctx ctx = {
+		.command = command,
+	};
+ 	struct nftnl_rule *rule;
+ 	struct nft_cmd *cmd;
+ 
+@@ -33,7 +37,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 	cmd->verbose = verbose;
+ 
+ 	if (state) {
+-		rule = nft_rule_new(h, chain, table, state);
+		rule = nft_rule_new(h, &ctx, chain, table, state);
+ 		if (!rule) {
+ 			nft_cmd_free(cmd);
+ 			return NULL;
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index dcc4a8edfc87f..fb62103fd38d7 100644
+--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
+@@ -26,8 +26,8 @@
+ #include "nft.h"
+ #include "nft-shared.h"
+ 
+-static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r,
+-			struct iptables_command_state *cs)
+static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+			struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	struct xtables_rule_match *matchp;
+ 	uint32_t op;
+@@ -81,7 +81,7 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r,
+ 	add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO);
+ 
+ 	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+-		ret = add_match(h, r, matchp->match->m);
+		ret = add_match(h, ctx, r, matchp->match->m);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index e98921856c75d..d36e06812e08d 100644
+--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
+@@ -25,8 +25,8 @@
+ #include "nft.h"
+ #include "nft-shared.h"
+ 
+-static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r,
+-			struct iptables_command_state *cs)
+static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+			struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	struct xtables_rule_match *matchp;
+ 	uint32_t op;
+@@ -68,7 +68,7 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r,
+ 	add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
+ 
+ 	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+-		ret = add_match(h, r, matchp->match->m);
+		ret = add_match(h, ctx, r, matchp->match->m);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 07d39131cb0d6..9065e52f669e1 100644
+--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
+@@ -34,6 +34,7 @@
+ 			| FMT_NUMERIC | FMT_NOTABLE)
+ #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
+ 
+struct nft_rule_ctx;
+ struct xtables_args;
+ struct nft_handle;
+ struct xt_xlate;
+@@ -126,8 +127,8 @@ static inline struct nft_xt_ctx_reg *nft_xt_ctx_get_dreg(struct nft_xt_ctx *ctx,
+ }
+ 
+ struct nft_family_ops {
+-	int (*add)(struct nft_handle *h, struct nftnl_rule *r,
+-		   struct iptables_command_state *cs);
+	int (*add)(struct nft_handle *h, struct nft_rule_ctx *ctx,
+		   struct nftnl_rule *r, struct iptables_command_state *cs);
+ 	bool (*is_same)(const struct iptables_command_state *cs_a,
+ 			const struct iptables_command_state *cs_b);
+ 	void (*print_payload)(struct nftnl_expr *e,
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 5e4cd76b05504..8029d70a7fbae 100644
+--- a/iptables/nft.c
+++ b/iptables/nft.c
+@@ -1141,7 +1141,8 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags)
+ #define NFT_DATATYPE_ETHERADDR	9
+ 
+ static int __add_nft_among(struct nft_handle *h, const char *table,
+-			   struct nftnl_rule *r, struct nft_among_pair *pairs,
+			   struct nft_rule_ctx *ctx, struct nftnl_rule *r,
+			   struct nft_among_pair *pairs,
+ 			   int cnt, bool dst, bool inv, bool ip)
+ {
+ 	uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN;
+@@ -1222,7 +1223,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 	return 0;
+ }
+ 
+-static int add_nft_among(struct nft_handle *h,
+static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 			 struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)m->data;
+@@ -1238,10 +1239,10 @@ static int add_nft_among(struct nft_handle *h,
+ 	}
+ 
+ 	if (data->src.cnt)
+-		__add_nft_among(h, table, r, data->pairs, data->src.cnt,
+		__add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt,
+ 				false, data->src.inv, data->src.ip);
+ 	if (data->dst.cnt)
+-		__add_nft_among(h, table, r, data->pairs + data->src.cnt,
+		__add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt,
+ 				data->dst.cnt, true, data->dst.inv,
+ 				data->dst.ip);
+ 	return 0;
+@@ -1449,22 +1450,30 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r,
+ 	return 0;
+ }
+ 
+-int add_match(struct nft_handle *h,
+int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 	      struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nftnl_expr *expr;
+ 	int ret;
+ 
+-	if (!strcmp(m->u.user.name, "limit"))
+-		return add_nft_limit(r, m);
+-	else if (!strcmp(m->u.user.name, "among"))
+-		return add_nft_among(h, r, m);
+-	else if (!strcmp(m->u.user.name, "udp"))
+-		return add_nft_udp(h, r, m);
+-	else if (!strcmp(m->u.user.name, "tcp"))
+-		return add_nft_tcp(h, r, m);
+-	else if (!strcmp(m->u.user.name, "mark"))
+-		return add_nft_mark(h, r, m);
+	switch (ctx->command) {
+	case NFT_COMPAT_RULE_APPEND:
+	case NFT_COMPAT_RULE_INSERT:
+	case NFT_COMPAT_RULE_REPLACE:
+		if (!strcmp(m->u.user.name, "limit"))
+			return add_nft_limit(r, m);
+		else if (!strcmp(m->u.user.name, "among"))
+			return add_nft_among(h, ctx, r, m);
+		else if (!strcmp(m->u.user.name, "udp"))
+			return add_nft_udp(h, r, m);
+		else if (!strcmp(m->u.user.name, "tcp"))
+			return add_nft_tcp(h, r, m);
+		else if (!strcmp(m->u.user.name, "mark"))
+			return add_nft_mark(h, r, m);
+		break;
+	default:
+		break;
+	}
+ 
+ 	expr = nftnl_expr_alloc("match");
+ 	if (expr == NULL)
+@@ -1692,7 +1701,8 @@ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv)
+ }
+ 
+ struct nftnl_rule *
+-nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
+nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *ctx,
+	     const char *chain, const char *table,
+ 	     struct iptables_command_state *cs)
+ {
+ 	struct nftnl_rule *r;
+@@ -1705,7 +1715,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
+ 	nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table);
+ 	nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain);
+ 
+-	if (h->ops->add(h, r, cs) < 0)
+	if (h->ops->add(h, ctx, r, cs) < 0)
+ 		goto err;
+ 
+ 	return r;
+@@ -2865,6 +2875,9 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ {
+ 	struct iptables_command_state cs = {};
+ 	struct nftnl_rule *r, *new_rule;
+	struct nft_rule_ctx ctx = {
+		.command = NFT_COMPAT_RULE_APPEND,
+	};
+ 	struct nft_chain *c;
+ 	int ret = 0;
+ 
+@@ -2883,7 +2896,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ 
+ 	h->ops->rule_to_cs(h, r, &cs);
+ 	cs.counters.pcnt = cs.counters.bcnt = 0;
+-	new_rule = nft_rule_new(h, chain, table, &cs);
+	new_rule = nft_rule_new(h, &ctx, chain, table, &cs);
+ 	h->ops->clear_cs(&cs);
+ 
+ 	if (!new_rule)
+@@ -3261,6 +3274,9 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 		.eb.bitmask = EBT_NOPROTO,
+ 	};
+ 	struct nftnl_udata_buf *udata;
+	struct nft_rule_ctx ctx = {
+		.command	= NFT_COMPAT_RULE_APPEND,
+	};
+ 	struct nft_handle *h = data;
+ 	struct nftnl_rule *r;
+ 	const char *pname;
+@@ -3288,7 +3304,7 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 
+ 	command_jump(&cs, pname);
+ 
+-	r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
+	r = nft_rule_new(h, &ctx, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
+ 			 nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs);
+ 	ebt_cs_clean(&cs);
+ 
+diff --git a/iptables/nft.h b/iptables/nft.h
+index caff1fdeff92e..1c479fce3fc2e 100644
+--- a/iptables/nft.h
+++ b/iptables/nft.h
+@@ -171,9 +171,11 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h,
+ /*
+  * Operations with rule-set.
+  */
+-struct nftnl_rule;
+struct nft_rule_ctx {
+	int			command;
+};
+ 
+-struct nftnl_rule *nft_rule_new(struct nft_handle *h, const char *chain, const char *table, struct iptables_command_state *cs);
+struct nftnl_rule *nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *rule, const char *chain, const char *table, struct iptables_command_state *cs);
+ int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, struct nftnl_rule *ref, bool verbose);
+ int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, int rulenum, bool verbose);
+ int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, bool verbose);
+@@ -191,7 +193,8 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char *
+  */
+ int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes);
+ int add_verdict(struct nftnl_rule *r, int verdict);
+-int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match *m);
+int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+	      struct nftnl_rule *r, struct xt_entry_match *m);
+ int add_target(struct nftnl_rule *r, struct xt_entry_target *t);
+ int add_jumpto(struct nftnl_rule *r, const char *name, int verdict);
+ int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set);
+-- 
+2.41.0
+
--- a/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
+++ b/0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
@ -0,0 +1,34 @@
+From 48f29413f7db0e3e889733705be368915a16a228 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 19 Jul 2023 14:58:11 +0200
+Subject: [PATCH] tests: shell: Sanitize nft-only/0009-needless-bitwise_0
+
+Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the
+non-debug ruleset listing's empty lines, causing the diff to fail. Catch
+this by exiting upon seeing the first table heading. For the sake of
+comparing bytecode, the actual ruleset listing is not interesting,
+anyway.
+
+Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2746726e03d9017d4c940a247590f8d5c5d5a73e)
+---
+ iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+index 41588a10863ec..34802cc26aad4 100755
+--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+@@ -340,7 +340,7 @@ bridge filter OUTPUT 10 9
+ # - lines with bytecode (starting with '  [')
+ # - empty lines (so printed diff is not a complete mess)
+ filter() {
+-	awk '/^(  \[|$)/{print}'
+	awk '/^table /{exit} /^(  \[|$)/{print}'
+ }
+ 
+ diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter)
+-- 
+2.41.0
+
--- a/0023-nft-Special-casing-for-among-match-in-compare_matche.patch
+++ b/0023-nft-Special-casing-for-among-match-in-compare_matche.patch
@ -0,0 +1,46 @@
+From da02d12210c4be7bcc6a5c3141ef96d3c68f6e49 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 21 Jul 2023 13:14:36 +0200
+Subject: [PATCH] nft: Special casing for among match in compare_matches()
+
+When other extensions may have "garbage" appended to their data which
+should not be considered for match comparison, among match is the
+opposite in that it extends its data beyond the value in 'size' field.
+Add special casing to cover for this, avoiding false-positive rule
+comparison.
+
+Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 10583537004f7ecd4aa11f6c12b7ba73fb77fc11)
+---
+ iptables/nft-shared.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 4ba44a4aa4d17..413503ed86932 100644
+--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
+@@ -1505,6 +1505,7 @@ bool compare_matches(struct xtables_rule_match *mt1,
+ 	for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) {
+ 		struct xt_entry_match *m1 = mp1->match->m;
+ 		struct xt_entry_match *m2 = mp2->match->m;
+		size_t cmplen = mp1->match->userspacesize;
+ 
+ 		if (strcmp(m1->u.user.name, m2->u.user.name) != 0) {
+ 			DEBUGP("mismatching match name\n");
+@@ -1516,8 +1517,10 @@ bool compare_matches(struct xtables_rule_match *mt1,
+ 			return false;
+ 		}
+ 
+-		if (memcmp(m1->data, m2->data,
+-			   mp1->match->userspacesize) != 0) {
+		if (!strcmp(m1->u.user.name, "among"))
+			cmplen = m1->u.match_size - sizeof(*m1);
+
+		if (memcmp(m1->data, m2->data, cmplen) != 0) {
+ 			DEBUGP("mismatch match data\n");
+ 			return false;
+ 		}
+-- 
+2.41.0
+
--- a/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
+++ b/0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
@ -0,0 +1,63 @@
+From 009e5643a6e6d4ee395d8956f418bbcef0f960a8 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 15 Jul 2023 01:35:39 +0200
+Subject: [PATCH] nft: Do not pass nft_rule_ctx to add_nft_among()
+
+It is not used, must be a left-over from an earlier version of the fixed
+commit.
+
+Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit bd71c11a95ab2b44794843fd8a3698039a7db211)
+---
+ iptables/nft.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 8029d70a7fbae..66b47d72e3ae8 100644
+--- a/iptables/nft.c
+++ b/iptables/nft.c
+@@ -1141,8 +1141,7 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags)
+ #define NFT_DATATYPE_ETHERADDR	9
+ 
+ static int __add_nft_among(struct nft_handle *h, const char *table,
+-			   struct nft_rule_ctx *ctx, struct nftnl_rule *r,
+-			   struct nft_among_pair *pairs,
+			   struct nftnl_rule *r, struct nft_among_pair *pairs,
+ 			   int cnt, bool dst, bool inv, bool ip)
+ {
+ 	uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN;
+@@ -1223,7 +1222,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 	return 0;
+ }
+ 
+-static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+static int add_nft_among(struct nft_handle *h,
+ 			 struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)m->data;
+@@ -1239,10 +1238,10 @@ static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 	}
+ 
+ 	if (data->src.cnt)
+-		__add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt,
+		__add_nft_among(h, table, r, data->pairs, data->src.cnt,
+ 				false, data->src.inv, data->src.ip);
+ 	if (data->dst.cnt)
+-		__add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt,
+		__add_nft_among(h, table, r, data->pairs + data->src.cnt,
+ 				data->dst.cnt, true, data->dst.inv,
+ 				data->dst.ip);
+ 	return 0;
+@@ -1463,7 +1462,7 @@ int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 		if (!strcmp(m->u.user.name, "limit"))
+ 			return add_nft_limit(r, m);
+ 		else if (!strcmp(m->u.user.name, "among"))
+-			return add_nft_among(h, ctx, r, m);
+			return add_nft_among(h, r, m);
+ 		else if (!strcmp(m->u.user.name, "udp"))
+ 			return add_nft_udp(h, r, m);
+ 		else if (!strcmp(m->u.user.name, "tcp"))
+-- 
+2.41.0
+
--- a/0025-tables-Reject-invalid-chain-names-when-renaming.patch
+++ b/0025-tables-Reject-invalid-chain-names-when-renaming.patch
@ -0,0 +1,31 @@
+From 2feb8fba886cb9586d6cdc1b5711cff49fe5cf5d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 21 Jul 2023 20:14:09 +0200
+Subject: [PATCH] *tables: Reject invalid chain names when renaming
+
+While given chain name was sanity checked with --new-chain command,
+--rename-chain command allowed to choose an invalid name. Keep things
+consistent by adding the missing check.
+
+Fixes: e6869a8f59d77 ("reorganized tree after kernel merge")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 344e9b260ba2bbbdd0c32f112273fd552d0b73f4)
+---
+ iptables/xshared.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index 71ee94d6f2f83..6812da501a288 100644
+--- a/iptables/xshared.c
+++ b/iptables/xshared.c
+@@ -1521,6 +1521,7 @@ void do_parse(int argc, char *argv[],
+ 					   "-%c requires old-chain-name and "
+ 					   "new-chain-name",
+ 					    cmd2char(CMD_RENAME_CHAIN));
+			assert_valid_chain_name(p->newname);
+ 			break;
+ 
+ 		case 'P':
+-- 
+2.41.0
+
--- a/0026-ebtables-Improve-invalid-chain-name-detection.patch
+++ b/0026-ebtables-Improve-invalid-chain-name-detection.patch
@ -0,0 +1,94 @@
+From d841d7a1f438e56226cc26b2f8e8525d5aeaa5c6 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Jul 2023 13:50:11 +0200
+Subject: [PATCH] ebtables: Improve invalid chain name detection
+
+Fix several issues:
+
+- Most importantly, --new-chain command accepted any name. Introduce
+  ebt_assert_valid_chain_name() for use with both --new-chain and
+  --rename-chain.
+- Restrict maximum name length to what legacy ebtables allows - this is
+  a bit more than iptables-nft, subject to be unified.
+- Like iptables, legacy ebtables rejects names prefixed by '-' or '!'.
+- Use xs_has_arg() for consistency, keep the check for extra args for
+  now.
+
+Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 687d76937be799a405e63e58861f7e4a965dfa8d)
+---
+ iptables/xtables-eb.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 3a73e79725489..33f55aee32c8f 100644
+--- a/iptables/xtables-eb.c
+++ b/iptables/xtables-eb.c
+@@ -42,6 +42,10 @@
+ #include "nft.h"
+ #include "nft-bridge.h"
+ 
+/* from linux/netfilter_bridge/ebtables.h */
+#define EBT_TABLE_MAXNAMELEN 32
+#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
+
+ /*
+  * From include/ebtables_u.h
+  */
+@@ -74,6 +78,26 @@ static int ebt_check_inverse2(const char option[], int argc, char **argv)
+ 	return ebt_invert;
+ }
+ 
+/* XXX: merge with assert_valid_chain_name()? */
+static void ebt_assert_valid_chain_name(const char *chainname)
+{
+	if (strlen(chainname) >= EBT_CHAIN_MAXNAMELEN)
+		xtables_error(PARAMETER_PROBLEM,
+			      "Chain name length can't exceed %d",
+			      EBT_CHAIN_MAXNAMELEN - 1);
+
+	if (*chainname == '-' || *chainname == '!')
+		xtables_error(PARAMETER_PROBLEM, "No chain name specified");
+
+	if (xtables_find_target(chainname, XTF_TRY_LOAD))
+		xtables_error(PARAMETER_PROBLEM,
+			      "Target with name %s exists", chainname);
+
+	if (strchr(chainname, ' ') != NULL)
+		xtables_error(PARAMETER_PROBLEM,
+			      "Use of ' ' not allowed in chain names");
+}
+
+ /*
+  * Glue code to use libxtables
+  */
+@@ -750,6 +774,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 			flags |= OPT_COMMAND;
+ 
+ 			if (c == 'N') {
+				ebt_assert_valid_chain_name(chain);
+ 				ret = nft_cmd_chain_user_add(h, chain, *table);
+ 				break;
+ 			} else if (c == 'X') {
+@@ -763,14 +788,12 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 			}
+ 
+ 			if (c == 'E') {
+-				if (optind >= argc)
+				if (!xs_has_arg(argc, argv))
+ 					xtables_error(PARAMETER_PROBLEM, "No new chain name specified");
+ 				else if (optind < argc - 1)
+ 					xtables_error(PARAMETER_PROBLEM, "No extra options allowed with -E");
+-				else if (strlen(argv[optind]) >= NFT_CHAIN_MAXNAMELEN)
+-					xtables_error(PARAMETER_PROBLEM, "Chain name length can't exceed %d"" characters", NFT_CHAIN_MAXNAMELEN - 1);
+-				else if (strchr(argv[optind], ' ') != NULL)
+-					xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
+
+				ebt_assert_valid_chain_name(argv[optind]);
+ 
+ 				errno = 0;
+ 				ret = nft_cmd_chain_user_rename(h, chain, *table,
+-- 
+2.41.0
+
--- a/0027-tests-shell-Fix-and-extend-chain-rename-test.patch
+++ b/0027-tests-shell-Fix-and-extend-chain-rename-test.patch
@ -0,0 +1,87 @@
+From 9ca7dcde885b9dad98761273eecd3921d0064ed2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Jul 2023 13:58:46 +0200
+Subject: [PATCH] tests: shell: Fix and extend chain rename test
+
+The old version exited unintentionally before testing ip6tables. Replace
+it by a more complete variant testing for all tools, creating and
+renaming of,chains with various illegal names instead of just renaming
+to a clashing name.
+
+Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 3bbf5269f25d7bc8cb6ecf2c44e6358579acc459)
+---
+ .../tests/shell/testcases/chain/0003rename_0  | 40 +++++++++++++++++++
+ .../tests/shell/testcases/chain/0003rename_1  | 12 ------
+ 2 files changed, 40 insertions(+), 12 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/chain/0003rename_0
+ delete mode 100755 iptables/tests/shell/testcases/chain/0003rename_1
+
+diff --git a/iptables/tests/shell/testcases/chain/0003rename_0 b/iptables/tests/shell/testcases/chain/0003rename_0
+new file mode 100755
+index 0000000000000..4cb2745bc2523
+--- /dev/null
+++ b/iptables/tests/shell/testcases/chain/0003rename_0
+@@ -0,0 +1,40 @@
+#!/bin/bash -x
+
+die() {
+	echo "E: $@"
+	exit 1
+}
+
+cmds="iptables ip6tables"
+[[ $XT_MULTI == *xtables-nft-multi ]] && cmds+=" arptables ebtables"
+
+declare -A invnames
+invnames["existing"]="c2"
+invnames["spaced"]="foo bar"
+invnames["dashed"]="-foo"
+invnames["negated"]="!foo"
+# XXX: ebtables-nft accepts 255 chars
+#invnames["overlong"]="thisisquitealongnameforachain"
+invnames["standard target"]="ACCEPT"
+invnames["extension target"]="DNAT"
+
+for cmd in $cmds; do
+	$XT_MULTI $cmd -N c1 || die "$cmd: can't add chain c1"
+	$XT_MULTI $cmd -N c2 || die "$cmd: can't add chain c2"
+	for key in "${!invnames[@]}"; do
+		val="${invnames[$key]}"
+		if [[ $key == "extension target" ]]; then
+			if [[ $cmd == "arptables" ]]; then
+				val="mangle"
+			elif [[ $cmd == "ebtables" ]]; then
+				val="dnat"
+			fi
+		fi
+		$XT_MULTI $cmd -N "$val" && \
+			die "$cmd: added chain with $key name"
+		$XT_MULTI $cmd -E c1 "$val" && \
+			die "$cmd: renamed to $key name"
+	done
+done
+
+exit 0
+diff --git a/iptables/tests/shell/testcases/chain/0003rename_1 b/iptables/tests/shell/testcases/chain/0003rename_1
+deleted file mode 100755
+index 975c8e196b9f5..0000000000000
+--- a/iptables/tests/shell/testcases/chain/0003rename_1
+++ /dev/null
+@@ -1,12 +0,0 @@
+-#!/bin/bash
+-
+-$XT_MULTI iptables -N c1 || exit 0
+-$XT_MULTI iptables -N c2 || exit 0
+-$XT_MULTI iptables -E c1 c2 || exit 1
+-
+-$XT_MULTI ip6tables -N c1 || exit 0
+-$XT_MULTI ip6tables -N c2 || exit 0
+-$XT_MULTI ip6tables -E c1 c2 || exit 1
+-
+-echo "E: Renamed with existing chain" >&2
+-exit 0
+-- 
+2.41.0
+
--- a/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch
+++ b/0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch
@ -0,0 +1,52 @@
+From 2eb44e79329b713e4eb50f4816beaa6e6babe1da Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 1 Aug 2023 23:28:20 +0200
+Subject: [PATCH] extensions: libipt_icmp: Fix confusion between 255/255 and
+ any
+
+Per definition, ICMP type "any" is type 255 and the full range of codes
+(0-255). Save callback though ignored the actual code values, printing
+"any" for every type 255 match. This at least confuses users as they
+can't find their rule added as '--icmp-type 255/255' anymore.
+
+It is not entirely clear what the fixed commit was trying to establish,
+but the save output is certainly not correct (especially since print
+callback gets things right).
+
+Reported-by: Amelia Downs <adowns@vmware.com>
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600
+Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5b5430d627bbc227a2d51d4312c371f2015834c6)
+---
+ extensions/libipt_icmp.c | 3 ++-
+ extensions/libipt_icmp.t | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
+index b0318aebc2c57..171b3b3949e54 100644
+--- a/extensions/libipt_icmp.c
+++ b/extensions/libipt_icmp.c
+@@ -108,7 +108,8 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
+ 		printf(" !");
+ 
+ 	/* special hack for 'any' case */
+-	if (icmp->type == 0xFF) {
+	if (icmp->type == 0xFF &&
+	    icmp->code[0] == 0 && icmp->code[1] == 0xFF) {
+ 		printf(" --icmp-type any");
+ 	} else {
+ 		printf(" --icmp-type %u", icmp->type);
+diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t
+index f4ba65c27f032..ce4a33f9633b5 100644
+--- a/extensions/libipt_icmp.t
+++ b/extensions/libipt_icmp.t
+@@ -13,3 +13,5 @@
+ # we accept "iptables -I INPUT -p tcp -m tcp", why not this below?
+ # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp
+ # -p icmp -m icmp;=;OK
+-p icmp -m icmp --icmp-type 255/255;=;OK
+-p icmp -m icmp --icmp-type 255/0:255;-p icmp -m icmp --icmp-type any;OK
+-- 
+2.41.0
+
--- a/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch
+++ b/0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch
@ -0,0 +1,39 @@
+From 329a8bb4d4b701b2903b182e8d8950dadbed4752 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 1 Aug 2023 23:42:24 +0200
+Subject: [PATCH] tests: libipt_icmp.t: Enable tests with numeric output
+
+Unrelated to the question whether numeric (save) output is desired or
+not, enable the tests and expect the known format.
+
+Using --list without --numeric prints the names, BTW.
+
+Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 99d861c64cda5289e141b2084836663450f1eff0)
+---
+ extensions/libipt_icmp.t | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t
+index ce4a33f9633b5..4ea936217c09a 100644
+--- a/extensions/libipt_icmp.t
+++ b/extensions/libipt_icmp.t
+@@ -1,11 +1,8 @@
+ :INPUT,FORWARD,OUTPUT
+ -p icmp -m icmp --icmp-type any;=;OK
+-# output uses the number, better use the name?
+-# ERROR: cannot find: iptables -I INPUT -p icmp -m icmp --icmp-type echo-reply
+-# -p icmp -m icmp --icmp-type echo-reply;=;OK
+-# output uses the number, better use the name?
+-# ERROR: annot find: iptables -I INPUT -p icmp -m icmp --icmp-type destination-unreachable
+-# -p icmp -m icmp --icmp-type destination-unreachable;=;OK
+# XXX: output uses the number, better use the name?
+-p icmp -m icmp --icmp-type echo-reply;-p icmp -m icmp --icmp-type 0;OK
+-p icmp -m icmp --icmp-type destination-unreachable;-p icmp -m icmp --icmp-type 3;OK
+ # it does not acccept name/name, should we accept this?
+ # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable
+ # -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable;=;OK
+-- 
+2.41.0
+
--- a/0030-man-iptables.8-Fix-intra-page-reference.patch
+++ b/0030-man-iptables.8-Fix-intra-page-reference.patch
@ -0,0 +1,33 @@
+From ea90131706ccc3a806d9d0ee0bc196e64690f7e1 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 00:23:37 +0200
+Subject: [PATCH] man: iptables.8: Fix intra page reference
+
+When sections MATCH EXTENSIONS and TARGET EXTENSIONS were combined, the
+reference could have been updated to specify the exact title.
+
+Fixes: 4496801821c01 ("doc: deduplicate extension descriptions into a new manpage")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 3bda308b32847d08b2c27077fa3c02200b59cdca)
+---
+ iptables/iptables.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
+index f81c632f2be86..c336ddf6e4f95 100644
+--- a/iptables/iptables.8.in
+++ b/iptables/iptables.8.in
+@@ -307,8 +307,8 @@ false, evaluation will stop.
+ This specifies the target of the rule; i.e., what to do if the packet
+ matches it.  The target can be a user-defined chain (other than the
+ one this rule is in), one of the special builtin targets which decide
+-the fate of the packet immediately, or an extension (see \fBEXTENSIONS\fP
+-below).  If this
+the fate of the packet immediately, or an extension (see \fBMATCH AND TARGET
+EXTENSIONS\fP below).  If this
+ option is omitted in a rule (and \fB\-g\fP
+ is not used), then matching the rule will have no
+ effect on the packet's fate, but the counters on the rule will be
+-- 
+2.41.0
+
--- a/0031-man-iptables.8-Clarify-goto-description.patch
+++ b/0031-man-iptables.8-Clarify-goto-description.patch
@ -0,0 +1,32 @@
+From 4e13b0b775522b2da8951c01713c47f235af8110 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 00:28:03 +0200
+Subject: [PATCH] man: iptables.8: Clarify --goto description
+
+Text speaks about behaviour of RETURN target when used in chains
+redirected to using --goto instead of --jump, not the difference between
+--jump option and "return".
+
+Fixes: 17fc163babc34 ("add 'goto' support (Henrik Nordstrom <hno@marasystems.com>)")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 94c19939744dbbbc6ff0fedf6cdba661769fdc87)
+---
+ iptables/iptables.8.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
+index c336ddf6e4f95..2365380490d52 100644
+--- a/iptables/iptables.8.in
+++ b/iptables/iptables.8.in
+@@ -316,7 +316,7 @@ incremented.
+ .TP
+ \fB\-g\fP, \fB\-\-goto\fP \fIchain\fP
+ This specifies that the processing should continue in a user
+-specified chain. Unlike the \-\-jump option return will not continue
+specified chain. Unlike with the \-\-jump option, \fBRETURN\fP will not continue
+ processing in this chain but instead in the chain that called us via
+ \-\-jump.
+ .TP
+-- 
+2.41.0
+
--- a/0032-man-iptables-restore.8-Fix-modprobe-description.patch
+++ b/0032-man-iptables-restore.8-Fix-modprobe-description.patch
@ -0,0 +1,37 @@
+From 1a62df2225b0d087a417d04455fe1e10384837e0 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:27:11 +0200
+Subject: [PATCH] man: iptables-restore.8: Fix --modprobe description
+
+- Consistently use 'modprobe' as option argument name
+- Add a reference to modprobe man page
+- Put the path in italics, and the command in bold
+
+Fixes: 8c46901ff5785 ("doc: document iptables-restore's -M option")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 0f05f523ac02843ab7bbd09a96ba3fa384ae9523)
+---
+ iptables/iptables-restore.8.in | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index 20216842d8358..f95f00acd8d49 100644
+--- a/iptables/iptables-restore.8.in
+++ b/iptables/iptables-restore.8.in
+@@ -67,9 +67,10 @@ the program will exit if the lock cannot be obtained.  This option will
+ make the program wait (indefinitely or for optional \fIseconds\fP) until
+ the exclusive lock can be obtained.
+ .TP
+-\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe_program\fP
+-Specify the path to the modprobe program. By default, iptables-restore will
+-inspect /proc/sys/kernel/modprobe to determine the executable's path.
+\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe\fP
+Specify the path to the modprobe(8) program. By default,
+iptables-restore will inspect \fI/proc/sys/kernel/modprobe\fP to
+determine the executable's path.
+ .TP
+ \fB\-T\fP, \fB\-\-table\fP \fIname\fP
+ Restore only the named table even if the input stream contains other ones.
+-- 
+2.41.0
+
--- a/0033-man-iptables-restore.8-Consistently-document-w-optio.patch
+++ b/0033-man-iptables-restore.8-Consistently-document-w-optio.patch
@ -0,0 +1,35 @@
+From 2b2c2310a61d17bf63845e7f70352342a072f08a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:33:26 +0200
+Subject: [PATCH] man: iptables-restore.8: Consistently document -w option
+
+Use the same name for the option's argument.
+
+Fixes: 65801d02a482b ("iptables-restore.8: document -w/-W options")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit e7bc6cc8aca993b743e83f20b2f579aed2f5d954)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index f95f00acd8d49..a63a344c0bd72 100644
+--- a/iptables/iptables-restore.8.in
+++ b/iptables/iptables-restore.8.in
+@@ -23,11 +23,11 @@ iptables-restore \(em Restore IP Tables
+ .P
+ ip6tables-restore \(em Restore IPv6 Tables
+ .SH SYNOPSIS
+-\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP]
+\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .P
+-\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP]
+\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .SH DESCRIPTION
+-- 
+2.41.0
+
--- a/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch
+++ b/0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch
@ -0,0 +1,36 @@
+From 41257615e8d30c5969e3639d6ad5cd6f34f9143e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:34:51 +0200
+Subject: [PATCH] man: iptables-restore.8: Drop -W option from synopsis
+
+The description was dropped already, there is no benefit in still
+listing it.
+
+Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 193107df55541ced2e783bcce9b71b97f88a5398)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index a63a344c0bd72..bfd2fc355dd49 100644
+--- a/iptables/iptables-restore.8.in
+++ b/iptables/iptables-restore.8.in
+@@ -24,11 +24,11 @@ iptables-restore \(em Restore IP Tables
+ ip6tables-restore \(em Restore IPv6 Tables
+ .SH SYNOPSIS
+ \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .P
+ \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .SH DESCRIPTION
+ .PP
+-- 
+2.41.0
+
--- a/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch
+++ b/0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch
@ -0,0 +1,35 @@
+From 97baff1f10262947c0feb6d6d14e67f1e7eb1bb0 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:37:09 +0200
+Subject: [PATCH] man: iptables-restore.8: Put 'file' in italics in synopsis
+
+The text has it this way already, be consistent.
+
+Fixes: 081d57839e91e ("iptables-restore.8: file to read from can be specified as argument")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b200f0870bc17046d6db64a1a65937ad5f263633)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index bfd2fc355dd49..ff8179091eeee 100644
+--- a/iptables/iptables-restore.8.in
+++ b/iptables/iptables-restore.8.in
+@@ -25,11 +25,11 @@ ip6tables-restore \(em Restore IPv6 Tables
+ .SH SYNOPSIS
+ \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+-[\fBfile\fP]
+[\fIfile\fP]
+ .P
+ \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+-[\fBfile\fP]
+[\fIfile\fP]
+ .SH DESCRIPTION
+ .PP
+ .B iptables-restore
+-- 
+2.41.0
+
--- a/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch
+++ b/0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch
@ -0,0 +1,37 @@
+From 868d7b3a16741bfa7e0c89ee1c840e4a3e51e2b2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:40:17 +0200
+Subject: [PATCH] man: iptables-restore.8: Start paragraphs in upper-case
+
+Also add a missing full stop in one spot.
+
+Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 935a5cf8afa96daa1c688efd59b9025e3a78fba4)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index ff8179091eeee..ce4520e626772 100644
+--- a/iptables/iptables-restore.8.in
+++ b/iptables/iptables-restore.8.in
+@@ -40,13 +40,13 @@ are used to restore IP and IPv6 Tables from data specified on STDIN or in
+ specify \fIfile\fP as an argument.
+ .TP
+ \fB\-c\fR, \fB\-\-counters\fR
+-restore the values of all packet and byte counters
+Restore the values of all packet and byte counters.
+ .TP
+ \fB\-h\fP, \fB\-\-help\fP
+ Print a short option summary.
+ .TP
+ \fB\-n\fR, \fB\-\-noflush\fR
+-don't flush the previous contents of the table. If not specified,
+Don't flush the previous contents of the table. If not specified,
+ both commands flush (delete) all previous contents of the respective table.
+ .TP
+ \fB\-t\fP, \fB\-\-test\fP
+-- 
+2.41.0
+
--- a/0037-man-Trivial-Missing-space-after-comma.patch
+++ b/0037-man-Trivial-Missing-space-after-comma.patch
@ -0,0 +1,42 @@
+From 1016392a3d59afcda3eae03efe87353a3706a331 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:48:14 +0200
+Subject: [PATCH] man: Trivial: Missing space after comma
+
+Fixes: 6a79d78986c02 ("iptables: mention iptables-apply(8) in manpages")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b0092a80656da7cf66f15ce906b17ab040ece12f)
+---
+ iptables/iptables-restore.8.in | 2 +-
+ iptables/iptables-save.8.in    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index ce4520e626772..aa816f794d6f3 100644
+--- a/iptables/iptables-restore.8.in
+++ b/iptables/iptables-restore.8.in
+@@ -82,7 +82,7 @@ from Rusty Russell.
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-restore.
+ .SH SEE ALSO
+-\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8)
+\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 7683fd3780f72..253907719acee 100644
+--- a/iptables/iptables-save.8.in
+++ b/iptables/iptables-save.8.in
+@@ -62,7 +62,7 @@ Rusty Russell <rusty@rustcorp.com.au>
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
+ .SH SEE ALSO
+-\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8)
+\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+-- 
+2.41.0
+
--- a/0038-man-iptables-save.8-Fix-modprobe-description.patch
+++ b/0038-man-iptables-save.8-Fix-modprobe-description.patch
@ -0,0 +1,37 @@
+From 5e144f6fc73baafada7c34779ebaafbbd3ecf45b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 02:01:59 +0200
+Subject: [PATCH] man: iptables-save.8: Fix --modprobe description
+
+- Consistently use 'modprobe' as option argument name
+- Add a reference to modprobe man page
+- Put the path in italics and the command in bold
+
+Fixes: fbb5639c02218 ("iptables-save: module loading corrections")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit f1fd95ccefe483f0e3f2da593c6d4b671a7de522)
+---
+ iptables/iptables-save.8.in | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 253907719acee..4a2c90c2f5956 100644
+--- a/iptables/iptables-save.8.in
+++ b/iptables/iptables-save.8.in
+@@ -36,9 +36,10 @@ and
+ are used to dump the contents of IP or IPv6 Table in easily parseable format
+ either to STDOUT or to a specified file.
+ .TP
+-\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP
+-Specify the path to the modprobe program. By default, iptables-save will
+-inspect /proc/sys/kernel/modprobe to determine the executable's path.
+\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe\fP
+Specify the path to the modprobe(8) program. By default,
+iptables-save will inspect \fI/proc/sys/kernel/modprobe\fP to determine
+the executable's path.
+ .TP
+ \fB\-f\fR, \fB\-\-file\fR \fIfilename\fP
+ Specify a filename to log the output to. If not specified, iptables-save
+-- 
+2.41.0
+
--- a/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch
+++ b/0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch
@ -0,0 +1,34 @@
+From 13aa85e1a27f50f91d6cfe521cca55cf37f4ac48 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 02:06:00 +0200
+Subject: [PATCH] man: iptables-save.8: Start paragraphs in upper-case
+
+Also add a missing full stop.
+
+Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 952186aa0342f6bf3c4614a609525338d057d8d9)
+---
+ iptables/iptables-save.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 4a2c90c2f5956..7c0d2552e8b97 100644
+--- a/iptables/iptables-save.8.in
+++ b/iptables/iptables-save.8.in
+@@ -46,10 +46,10 @@ Specify a filename to log the output to. If not specified, iptables-save
+ will log to STDOUT.
+ .TP
+ \fB\-c\fR, \fB\-\-counters\fR
+-include the current values of all packet and byte counters in the output
+Include the current values of all packet and byte counters in the output.
+ .TP
+ \fB\-t\fR, \fB\-\-table\fR \fItablename\fP
+-restrict output to only one table. If the kernel is configured with automatic
+Restrict output to only one table. If the kernel is configured with automatic
+ module loading, an attempt will be made to load the appropriate module for
+ that table if it is not already there.
+ .br
+-- 
+2.41.0
+
--- a/0040-tests-iptables-test-Fix-command-segfault-reports.patch
+++ b/0040-tests-iptables-test-Fix-command-segfault-reports.patch
@ -0,0 +1,52 @@
+From 9b0b0db6aa82c8433002880f73a7614bb453320d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 26 Jul 2023 19:43:20 +0200
+Subject: [PATCH] tests: iptables-test: Fix command segfault reports
+
+Logging produced a stack trace due to undefined variable 'cmd'.
+
+Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5412ccba55b2318160d32efec3b8aad162608af9)
+---
+ iptables-test.py | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index de1e1e95fda55..065c322a173ca 100755
+--- a/iptables-test.py
+++ b/iptables-test.py
+@@ -136,7 +136,7 @@ STDERR_IS_TTY = sys.stderr.isatty()
+     # check for segfaults
+     #
+     if proc.returncode == -11:
+-        reason = "iptables-save segfaults: " + cmd
+        reason = command + " segfaults!"
+         print_error(reason, filename, lineno)
+         delete_rule(iptables, rule, filename, lineno, netns)
+         return -1
+@@ -333,8 +333,11 @@ STDERR_IS_TTY = sys.stderr.isatty()
+     out, err = proc.communicate(input = restore_data)
+ 
+     if proc.returncode == -11:
+-        reason = iptables + "-restore segfaults: " + cmd
+        reason = iptables + "-restore segfaults!"
+         print_error(reason, filename, lineno)
+        msg = [iptables + "-restore segfault from:"]
+        msg.extend(["input: " + l for l in restore_data.split("\n")])
+        print("\n".join(msg), file=log_file)
+         return -1
+ 
+     if proc.returncode != 0:
+@@ -355,7 +358,7 @@ STDERR_IS_TTY = sys.stderr.isatty()
+     out, err = proc.communicate()
+ 
+     if proc.returncode == -11:
+-        reason = iptables + "-save segfaults: " + cmd
+        reason = iptables + "-save segfaults!"
+         print_error(reason, filename, lineno)
+         return -1
+ 
+-- 
+2.41.0
+
--- a/0041-nft-Create-builtin-chains-with-counters-enabled.patch
+++ b/0041-nft-Create-builtin-chains-with-counters-enabled.patch
@ -0,0 +1,63 @@
+From 85746b658b9eedafd5523b5501ce0f8b5f5bdcbf Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 10 Aug 2023 11:30:59 +0200
+Subject: [PATCH] nft: Create builtin chains with counters enabled
+
+The kernel enables policy counters for nftables chains only if
+NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one
+has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the
+allocated nftnl_chain object.
+
+The above happened for base chains only with iptables-nft-restore if
+called with --counters flag. Since this is very unintuitive to users,
+fix the situation by adding counters to base chains in any case.
+
+Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 39a067bb3b1b4ffb50a925f66e7db56658c0dfa7)
+---
+ iptables/nft.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 66b47d72e3ae8..2b5a27922a06e 100644
+--- a/iptables/nft.c
+++ b/iptables/nft.c
+@@ -686,6 +686,9 @@ nft_chain_builtin_alloc(int family, const char *tname,
+ 
+ 	nftnl_chain_set_str(c, NFTNL_CHAIN_TYPE, chain->type);
+ 
+	nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
+	nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
+
+ 	return c;
+ }
+ 
+@@ -946,6 +949,7 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h,
+ 				       int policy,
+ 				       const struct xt_counters *counters)
+ {
+	static const struct xt_counters zero = {};
+ 	struct nftnl_chain *c;
+ 	const struct builtin_table *_t;
+ 	const struct builtin_chain *_c;
+@@ -970,12 +974,10 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h,
+ 		return NULL;
+ 	}
+ 
+-	if (counters) {
+-		nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES,
+-					counters->bcnt);
+-		nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS,
+-					counters->pcnt);
+-	}
+	if (!counters)
+		counters = &zero;
+	nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, counters->bcnt);
+	nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, counters->pcnt);
+ 
+ 	return c;
+ }
+-- 
+2.41.0
+
--- a/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch
+++ b/0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch
@ -0,0 +1,37 @@
+From 4cec9d5fec5c5bcc51b84e3ed9ba9619fe8b2909 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 3 Aug 2023 17:59:03 +0200
+Subject: [PATCH] Revert "libiptc: fix wrong maptype of base chain counters on
+ restore"
+
+This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4.
+
+The change can't be right: A simple rule append call will reset all
+built-in chains' counters. The old code works fine even given the
+mentioned "empty restore" use-case, at least if counters don't change on
+the fly in-kernel.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912
+Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 43f78733059ecd28d8567d8205cab5ed62d93458)
+---
+ libiptc/libiptc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c
+index f9b7779efdba5..29ff356f2324e 100644
+--- a/libiptc/libiptc.c
+++ b/libiptc/libiptc.c
+@@ -822,7 +822,7 @@ static int __iptcc_p_del_policy(struct xtc_handle *h, unsigned int num)
+ 
+ 		/* save counter and counter_map information */
+ 		h->chain_iterator_cur->counter_map.maptype =
+-						COUNTER_MAP_ZEROED;
+						COUNTER_MAP_NORMAL_MAP;
+ 		h->chain_iterator_cur->counter_map.mappos = num-1;
+ 		memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters,
+ 			sizeof(h->chain_iterator_cur->counters));
+-- 
+2.41.0
+
--- a/0043-doc-fix-example-of-xt_cpu.patch
+++ b/0043-doc-fix-example-of-xt_cpu.patch
@ -0,0 +1,35 @@
+From 12e7024d3e8d245bb5645167f3aeb4c0187f75fd Mon Sep 17 00:00:00 2001
+From: Victor Julien <victor@inliniac.net>
+Date: Tue, 29 Aug 2023 14:59:32 +0200
+Subject: [PATCH] doc: fix example of xt_cpu
+
+REDIRECT uses --to-ports instead of --to-port.
+
+Fixes: 2d59208943a3 ("extension: add xt_cpu match")
+
+Signed-off-by: Victor Julien <victor@inliniac.net>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit 63e4a64e943be64a7e0486838071b981074e696d)
+---
+ extensions/libxt_cpu.man | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/extensions/libxt_cpu.man b/extensions/libxt_cpu.man
+index d9ea5c2faa20b..c89ef08afbfbb 100644
+--- a/extensions/libxt_cpu.man
+++ b/extensions/libxt_cpu.man
+@@ -7,9 +7,9 @@ multiqueue NICs to spread network traffic on different queues.
+ Example:
+ .PP
+ iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 0 
+-\-j REDIRECT \-\-to\-port 8080
+\-j REDIRECT \-\-to\-ports 8080
+ .PP
+ iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 1 
+-\-j REDIRECT \-\-to\-port 8081
+\-j REDIRECT \-\-to\-ports 8081
+ .PP
+ Available since Linux 2.6.36.
+-- 
+2.41.0
+
--- a/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch
+++ b/0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch
@ -0,0 +1,92 @@
+From 16822c25bf795b54b13ada62da762ee7e9c2b12f Mon Sep 17 00:00:00 2001
+From: Quentin Armitage <quentin@armitage.org.uk>
+Date: Sat, 23 Nov 2013 08:41:58 +0000
+Subject: [PATCH] extensions: Fix checking of conntrack --ctproto 0
+
+There are three issues in the code:
+1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask
+2) in conntrack_mt_parse it is testing (info->invert_flags &
+   XT_INV_PROTO) before the invert bit has been set.
+3) the sense of the error message is the wrong way round
+
+1) To get the error, ! -ctstatus XXX has to be specified, since
+   XT_INV_PROTO == XT_CONNTRACK_STATUS e.g.
+   | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ...
+
+3) Unlike --proto 0 (where 0 means all protocols), in the conntrack
+   match --ctproto 0 appears to mean protocol 0, which can never be.
+   Therefore --ctproto 0 could never match and ! --ctproto 0 will always
+   match. Both of these should be rejected, since the user clearly
+   cannot be intending what was specified.
+
+The attached patch resolves the issue, and also produces an error
+message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since
+--ctproto 0 will never match, and ! --ctproto 0 will always match.
+
+[Phil: - Added Fixes: tag - it's a day 1 bug
+       - Copied patch description from Bugzilla
+       - Reorganized changes to reduce diff
+       - Added test cases]
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874
+Fixes: 5054e85be3068 ("general conntrack match module userspace support files")
+Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2e704f6ddd6d056e360f3d9c11e8b6c56a20cf23)
+---
+ extensions/libxt_conntrack.c | 17 ++++++++---------
+ extensions/libxt_conntrack.t |  2 ++
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
+index 09548c297695f..ffbc7467bbf2e 100644
+--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
+@@ -346,14 +346,13 @@ static void conntrack_parse(struct xt_option_call *cb)
+ 			sinfo->invflags |= XT_CONNTRACK_STATE;
+ 		break;
+ 	case O_CTPROTO:
+		if (cb->val.protocol == 0)
+			xtables_error(PARAMETER_PROBLEM, cb->invert ?
+				      "condition would always match protocol" :
+				      "rule would never match protocol");
+ 		sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum = cb->val.protocol;
+ 		if (cb->invert)
+ 			sinfo->invflags |= XT_CONNTRACK_PROTO;
+-		if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0
+-		    && (sinfo->invflags & XT_INV_PROTO))
+-			xtables_error(PARAMETER_PROBLEM,
+-				   "rule would never match protocol");
+-
+ 		sinfo->flags |= XT_CONNTRACK_PROTO;
+ 		break;
+ 	case O_CTORIGSRC:
+@@ -411,11 +410,11 @@ static void conntrack_mt_parse(struct xt_option_call *cb, uint8_t rev)
+ 			info->invert_flags |= XT_CONNTRACK_STATE;
+ 		break;
+ 	case O_CTPROTO:
+		if (cb->val.protocol == 0)
+			xtables_error(PARAMETER_PROBLEM, cb->invert ?
+				      "conntrack: condition would always match protocol" :
+				      "conntrack: rule would never match protocol");
+ 		info->l4proto = cb->val.protocol;
+-		if (info->l4proto == 0 && (info->invert_flags & XT_INV_PROTO))
+-			xtables_error(PARAMETER_PROBLEM, "conntrack: rule would "
+-			           "never match protocol");
+-
+ 		info->match_flags |= XT_CONNTRACK_PROTO;
+ 		if (cb->invert)
+ 			info->invert_flags |= XT_CONNTRACK_PROTO;
+diff --git a/extensions/libxt_conntrack.t b/extensions/libxt_conntrack.t
+index db53147532afd..2b3c5de9cd3ab 100644
+--- a/extensions/libxt_conntrack.t
+++ b/extensions/libxt_conntrack.t
+@@ -25,3 +25,5 @@
+ -m conntrack --ctstatus EXPECTED;=;OK
+ -m conntrack --ctstatus SEEN_REPLY;=;OK
+ -m conntrack;;FAIL
+-m conntrack --ctproto 0;;FAIL
+-m conntrack ! --ctproto 0;;FAIL
+-- 
+2.41.0
+
--- a/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch
+++ b/0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch
@ -0,0 +1,44 @@
+From 73f49fada3a73b321a0c01fc3014d7617180f1ed Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 1 Sep 2023 13:16:56 +0200
+Subject: [PATCH] tests: shell: Fix for ineffective 0007-mid-restore-flush_0
+
+The test did not catch non-zero exit status of the spawned coprocess. To
+make it happen, Drop the line killing it (it will exit anyway) and pass
+its PID to 'wait'.
+
+While being at it, put the sleep into the correct spot (otherwise the
+check for chain 'foo' existence fails as it runs too early) and make
+said chain existence check effective.
+
+Fixes: 4e3c11a6f5a94 ("nft: Fix for ruleset flush while restoring")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ea12b1d2b191f100a6fdb83af4681364e4dba12a)
+---
+ .../shell/testcases/nft-only/0007-mid-restore-flush_0  | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
+index 43880ffbc5851..981f007f205b9 100755
+--- a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
+++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
+@@ -13,11 +13,11 @@ COMMIT
+ :foo [0:0]
+ EOF
+ 
+-$XT_MULTI iptables-save | grep -q ':foo'
+sleep 1
+$XT_MULTI iptables-save | grep -q ':foo' || exit 1
+ nft flush ruleset
+ 
+ echo "COMMIT" >&"${COPROC[1]}"
+-sleep 1
+-
+-[[ -n $COPROC_PID ]] && kill $COPROC_PID
+-wait
+# close the pipe to make iptables-restore exit if it didn't error out yet
+eval "exec ${COPROC[1]}>&-"
+wait $COPROC_PID
+-- 
+2.41.0
+
--- a/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch
+++ b/0046-nft-Fix-for-useless-meta-expressions-in-rule.patch
@ -0,0 +1,277 @@
+From fea09f9273e279d0a18a9db368546897fe3b2edd Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 6 Sep 2023 16:32:47 +0200
+Subject: [PATCH] nft: Fix for useless meta expressions in rule
+
+A relict of legacy iptables' mandatory matching on interfaces and IP
+addresses is support for the '-i +' notation, basically a "match any
+input interface". Trying to make things better than its predecessor,
+iptables-nft boldly optimizes that nop away - not entirely though, the
+meta expression loading the interface name was left in place. While not
+a problem (apart from pointless overhead) in current HEAD, v1.8.7 would
+trip over this as a following cmp expression (for another match) was
+incorrectly linked to that stale meta expression, loading strange values
+into the respective interface name field.
+
+While being at it, merge and generalize the functions into a common one
+for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too.
+
+Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 52ed0ac516db9f3a44f61dfd8b65d20631bfa95b)
+---
+ extensions/libebt_standard.t  |  4 ++++
+ extensions/libip6t_standard.t |  3 +++
+ extensions/libxt_standard.t   |  2 ++
+ iptables/nft-arp.c            |  4 ++--
+ iptables/nft-bridge.c         | 38 ++++-------------------------
+ iptables/nft-ipv4.c           |  4 ++--
+ iptables/nft-ipv6.c           |  4 ++--
+ iptables/nft-shared.c         | 45 ++++++++++++-----------------------
+ iptables/nft-shared.h         |  4 ++--
+ 9 files changed, 36 insertions(+), 72 deletions(-)
+
+diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t
+index 97cb3baaf6d21..370a12f4a2cec 100644
+--- a/extensions/libebt_standard.t
+++ b/extensions/libebt_standard.t
+@@ -14,6 +14,10 @@
+ -o foobar;=;FAIL
+ --logical-in br0;=;OK
+ --logical-out br1;=;FAIL
+-i + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK
+-i + -p ip;-p IPv4;OK
+--logical-in + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK
+--logical-in + -p ip;-p IPv4;OK
+ :FORWARD
+ -i foobar;=;OK
+ -o foobar;=;OK
+diff --git a/extensions/libip6t_standard.t b/extensions/libip6t_standard.t
+index a528af10ea152..0c559cc5021f6 100644
+--- a/extensions/libip6t_standard.t
+++ b/extensions/libip6t_standard.t
+@@ -3,3 +3,6 @@
+ ! -d ::;! -d ::/128;OK
+ ! -s ::;! -s ::/128;OK
+ -s ::/64;=;OK
+:INPUT
+-i + -d c0::fe;-d c0::fe/128;OK
+-i + -p tcp;-p tcp;OK
+diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t
+index 6ed978e442b80..7c83cfa3ba232 100644
+--- a/extensions/libxt_standard.t
+++ b/extensions/libxt_standard.t
+@@ -24,3 +24,5 @@
+ :FORWARD
+ --protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK
+ -ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK
+-i + -d 1.2.3.4;-d 1.2.3.4/32;OK
+-i + -p tcp;-p tcp;OK
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 889387e4db592..54cddbc5f07cc 100644
+--- a/iptables/nft-arp.c
+++ b/iptables/nft-arp.c
+@@ -49,12 +49,12 @@ static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (fw->arp.iniface[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN);
+-		add_iniface(h, r, fw->arp.iniface, op);
+		add_iface(h, r, fw->arp.iniface, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (fw->arp.outiface[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT);
+-		add_outiface(h, r, fw->arp.outiface, op);
+		add_iface(h, r, fw->arp.outiface, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (fw->arp.arhrd != 0 ||
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index a41f411fbba14..9e349813ee5b3 100644
+--- a/iptables/nft-bridge.c
+++ b/iptables/nft-bridge.c
+@@ -65,36 +65,6 @@ static void ebt_print_mac_and_mask(const unsigned char *mac, const unsigned char
+ 		xtables_print_mac_and_mask(mac, mask);
+ }
+ 
+-static void add_logical_iniface(struct nft_handle *h, struct nftnl_rule *r,
+-				char *iface, uint32_t op)
+-{
+-	int iface_len;
+-	uint8_t reg;
+-
+-	iface_len = strlen(iface);
+-
+-	add_meta(h, r, NFT_META_BRI_IIFNAME, &reg);
+-	if (iface[iface_len - 1] == '+')
+-		add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-	else
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+-}
+-
+-static void add_logical_outiface(struct nft_handle *h, struct nftnl_rule *r,
+-				 char *iface, uint32_t op)
+-{
+-	int iface_len;
+-	uint8_t reg;
+-
+-	iface_len = strlen(iface);
+-
+-	add_meta(h, r, NFT_META_BRI_OIFNAME, &reg);
+-	if (iface[iface_len - 1] == '+')
+-		add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-	else
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+-}
+-
+ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	return add_action(r, cs, false);
+@@ -130,22 +100,22 @@ static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (fw->in[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_IIN);
+-		add_iniface(h, r, fw->in, op);
+		add_iface(h, r, fw->in, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (fw->out[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_IOUT);
+-		add_outiface(h, r, fw->out, op);
+		add_iface(h, r, fw->out, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (fw->logical_in[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALIN);
+-		add_logical_iniface(h, r, fw->logical_in, op);
+		add_iface(h, r, fw->logical_in, NFT_META_BRI_IIFNAME, op);
+ 	}
+ 
+ 	if (fw->logical_out[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALOUT);
+-		add_logical_outiface(h, r, fw->logical_out, op);
+		add_iface(h, r, fw->logical_out, NFT_META_BRI_OIFNAME, op);
+ 	}
+ 
+ 	if (fw->bitmask & EBT_ISOURCE) {
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index fb62103fd38d7..8449407bd40ed 100644
+--- a/iptables/nft-ipv4.c
+++ b/iptables/nft-ipv4.c
+@@ -35,12 +35,12 @@ static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (cs->fw.ip.iniface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN);
+-		add_iniface(h, r, cs->fw.ip.iniface, op);
+		add_iface(h, r, cs->fw.ip.iniface, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw.ip.outiface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_OUT);
+-		add_outiface(h, r, cs->fw.ip.outiface, op);
+		add_iface(h, r, cs->fw.ip.outiface, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw.ip.proto != 0) {
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index d36e06812e08d..443815da77acf 100644
+--- a/iptables/nft-ipv6.c
+++ b/iptables/nft-ipv6.c
+@@ -34,12 +34,12 @@ static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (cs->fw6.ipv6.iniface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN);
+-		add_iniface(h, r, cs->fw6.ipv6.iniface, op);
+		add_iface(h, r, cs->fw6.ipv6.iniface, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw6.ipv6.outiface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT);
+-		add_outiface(h, r, cs->fw6.ipv6.outiface, op);
+		add_iface(h, r, cs->fw6.ipv6.outiface, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw6.ipv6.proto != 0) {
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 413503ed86932..a23a2c8a8fa11 100644
+--- a/iptables/nft-shared.c
+++ b/iptables/nft-shared.c
+@@ -155,44 +155,29 @@ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg)
+ 	add_cmp_ptr(r, op, &val, sizeof(val), sreg);
+ }
+ 
+-void add_iniface(struct nft_handle *h, struct nftnl_rule *r,
+-		 char *iface, uint32_t op)
+void add_iface(struct nft_handle *h, struct nftnl_rule *r,
+	       char *iface, uint32_t key, uint32_t op)
+ {
+-	int iface_len;
+	int iface_len = strlen(iface);
+ 	uint8_t reg;
+ 
+-	iface_len = strlen(iface);
+ 
+-	add_meta(h, r, NFT_META_IIFNAME, &reg);
+ 	if (iface[iface_len - 1] == '+') {
+-		if (iface_len > 1)
+-			add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-		else if (op != NFT_CMP_EQ)
+-			add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D",
+-				    strlen("INVAL/D") + 1, reg);
+		if (iface_len > 1) {
+			iface_len -= 1;
+		} else if (op != NFT_CMP_EQ) {
+			op = NFT_CMP_EQ;
+			iface = "INVAL/D";
+			iface_len = strlen(iface) + 1;
+		} else {
+			return; /* -o + */
+		}
+ 	} else {
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+		iface_len += 1;
+ 	}
+-}
+-
+-void add_outiface(struct nft_handle *h, struct nftnl_rule *r,
+-		  char *iface, uint32_t op)
+-{
+-	int iface_len;
+-	uint8_t reg;
+ 
+-	iface_len = strlen(iface);
+-
+-	add_meta(h, r, NFT_META_OIFNAME, &reg);
+-	if (iface[iface_len - 1] == '+') {
+-		if (iface_len > 1)
+-			add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-		else if (op != NFT_CMP_EQ)
+-			add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D",
+-				    strlen("INVAL/D") + 1, reg);
+-	} else {
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+-	}
+	add_meta(h, r, key, &reg);
+	add_cmp_ptr(r, op, iface, iface_len, reg);
+ }
+ 
+ void add_addr(struct nft_handle *h, struct nftnl_rule *r,
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 9065e52f669e1..94cc295436a27 100644
+--- a/iptables/nft-shared.h
+++ b/iptables/nft-shared.h
+@@ -193,8 +193,8 @@ void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len, uint
+ void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op, uint8_t sreg);
+ void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op, uint8_t sreg);
+ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg);
+-void add_iniface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op);
+-void add_outiface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op);
+void add_iface(struct nft_handle *h, struct nftnl_rule *r,
+	       char *iface, uint32_t key, uint32_t op);
+ void add_addr(struct nft_handle *h, struct nftnl_rule *r, enum nft_payload_bases base, int offset,
+ 	      void *data, void *mask, size_t len, uint32_t op);
+ void add_proto(struct nft_handle *h, struct nftnl_rule *r, int offset, size_t len,
+-- 
+2.41.0
+
--- a/iptables.spec
+++ b/iptables.spec
@ -11,7 +11,7 @@ Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: https://www.netfilter.org/projects/iptables
 Version: 1.8.9
-Release: 4%{?dist}
+Release: 4%{?dist}.1
 Source: %{url}/files/%{name}-%{version}.tar.xz
 Source1: iptables.init
 Source2: iptables-config
@ -37,6 +37,35 @@ Patch014: 0014-nft-shared-Drop-unused-include.patch
 Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch
 Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch
 Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch
+Patch018: 0018-iptables-Fix-setting-of-ipv6-counters.patch
+Patch019: 0019-iptables-Fix-handling-of-non-existent-chains.patch
+Patch020: 0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch
+Patch021: 0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
+Patch022: 0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
+Patch023: 0023-nft-Special-casing-for-among-match-in-compare_matche.patch
+Patch024: 0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
+Patch025: 0025-tables-Reject-invalid-chain-names-when-renaming.patch
+Patch026: 0026-ebtables-Improve-invalid-chain-name-detection.patch
+Patch027: 0027-tests-shell-Fix-and-extend-chain-rename-test.patch
+Patch028: 0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch
+Patch029: 0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch
+Patch030: 0030-man-iptables.8-Fix-intra-page-reference.patch
+Patch031: 0031-man-iptables.8-Clarify-goto-description.patch
+Patch032: 0032-man-iptables-restore.8-Fix-modprobe-description.patch
+Patch033: 0033-man-iptables-restore.8-Consistently-document-w-optio.patch
+Patch034: 0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch
+Patch035: 0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch
+Patch036: 0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch
+Patch037: 0037-man-Trivial-Missing-space-after-comma.patch
+Patch038: 0038-man-iptables-save.8-Fix-modprobe-description.patch
+Patch039: 0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch
+Patch040: 0040-tests-iptables-test-Fix-command-segfault-reports.patch
+Patch041: 0041-nft-Create-builtin-chains-with-counters-enabled.patch
+Patch042: 0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch
+Patch043: 0043-doc-fix-example-of-xt_cpu.patch
+Patch044: 0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch
+Patch045: 0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch
+Patch046: 0046-nft-Fix-for-useless-meta-expressions-in-rule.patch

 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
@ -447,6 +476,9 @@ fi


 %changelog
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4.1
+- Backport fixes from upstream
+
 * Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
 - Backport fixes from upstream