iptables-1.8.9-4.1

- Backport fixes from upstream

.gitignore

@@ -13,7 +13,3 @@
 /iptables-1.8.7.tar.bz2
 /iptables-1.8.8.tar.bz2
 /iptables-1.8.9.tar.xz
-/iptables-1.8.10.tar.xz
-/iptables-1.8.10.tar.xz.sig
-/iptables-1.8.11.tar.xz
-/iptables-1.8.11.tar.xz.sig

0001-extensions-NAT-Fix-for-Werror-format-security.patch

@@ -0,0 +1,30 @@
+From ff8eacec604537d98eb912281fa0c5c6a83da717 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 12 Jan 2023 14:38:44 +0100
+Subject: [PATCH] extensions: NAT: Fix for -Werror=format-security
+
+Have to pass either a string literal or format string to xt_xlate_add().
+
+Fixes: f30c5edce0413 ("extensions: Merge SNAT, DNAT, REDIRECT and MASQUERADE")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ed4082a7405a5838c205a34c1559e289949200cc)
+---
+ extensions/libxt_NAT.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libxt_NAT.c b/extensions/libxt_NAT.c
+index da9f22012c5d6..2a6343986d54f 100644
+--- a/extensions/libxt_NAT.c
++++ b/extensions/libxt_NAT.c
+@@ -424,7 +424,7 @@ __NAT_xlate(struct xt_xlate *xl, const struct nf_nat_range2 *r,
+ 	if (r->flags & NF_NAT_RANGE_PROTO_OFFSET)
+ 		return 0;
+ 
+-	xt_xlate_add(xl, tgt);
++	xt_xlate_add(xl, "%s", tgt);
+ 	if (strlen(range_str))
+ 		xt_xlate_add(xl, " to %s", range_str);
+ 	if (r->flags & NF_NAT_RANGE_PROTO_RANDOM) {
+-- 
+2.40.0
+

0002-etc-Drop-xtables.conf.patch

@@ -0,0 +1,132 @@
+From 55f3f1743934efa33df1ecbe11b31362fc45b03c Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 17 Jan 2023 16:38:43 +0100
+Subject: [PATCH] etc: Drop xtables.conf
+
+The file is not used since the commit this one fixes. Also it wasn't
+installed until recently, when commit 3822a992bc277 ("Makefile: Fix for
+'make distcheck'") added it in the wrong spot in an attempt to reduce
+differences between tarballs generated by 'make tarball' and 'make
+dist'.
+
+While being at it, drop stale xtables_config_main() prototype from
+xtables-multi.h.
+
+Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728)
+---
+ Makefile.am              |  2 +-
+ etc/xtables.conf         | 74 ----------------------------------------
+ iptables/xtables-multi.h |  1 -
+ 3 files changed, 1 insertion(+), 76 deletions(-)
+ delete mode 100644 etc/xtables.conf
+
+diff --git a/Makefile.am b/Makefile.am
+index 451c3cb2d5887..299ab46d7b8e2 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -20,7 +20,7 @@ EXTRA_DIST	= autogen.sh iptables-test.py xlate-test.py
+ 
+ if ENABLE_NFTABLES
+ confdir		= $(sysconfdir)
+-dist_conf_DATA	= etc/ethertypes etc/xtables.conf
++dist_conf_DATA	= etc/ethertypes
+ endif
+ 
+ .PHONY: tarball
+diff --git a/etc/xtables.conf b/etc/xtables.conf
+deleted file mode 100644
+index 3c54ced043d82..0000000000000
+--- a/etc/xtables.conf
++++ /dev/null
+@@ -1,74 +0,0 @@
+-family ipv4 {
+-	table raw {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -300
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -300
+-	}
+-
+-	table mangle {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -150
+-		chain INPUT hook NF_INET_LOCAL_IN prio -150
+-		chain FORWARD hook NF_INET_FORWARD prio -150
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -150
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio -150
+-	}
+-
+-	table filter {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 0
+-		chain FORWARD hook NF_INET_FORWARD prio 0
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 0
+-	}
+-
+-	table nat {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -100
+-		chain INPUT hook NF_INET_LOCAL_IN prio 100
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -100
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio 100
+-	}
+-
+-	table security {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 50
+-		chain FORWARD hook NF_INET_FORWARD prio 50
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 50
+-	}
+-}
+-
+-family ipv6 {
+-	table raw {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -300
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -300
+-	}
+-
+-	table mangle {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -150
+-		chain INPUT hook NF_INET_LOCAL_IN prio -150
+-		chain FORWARD hook NF_INET_FORWARD prio -150
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -150
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio -150
+-	}
+-
+-	table filter {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 0
+-		chain FORWARD hook NF_INET_FORWARD prio 0
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 0
+-	}
+-
+-	table nat {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -100
+-		chain INPUT hook NF_INET_LOCAL_IN prio 100
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -100
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio 100
+-	}
+-
+-	table security {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 50
+-		chain FORWARD hook NF_INET_FORWARD prio 50
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 50
+-	}
+-}
+-
+-family arp {
+-	table filter {
+-		chain INPUT hook NF_ARP_IN prio 0
+-		chain OUTPUT hook NF_ARP_OUT prio 0
+-	}
+-}
+diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h
+index 94c24d5a22c7e..833c11a2ac914 100644
+--- a/iptables/xtables-multi.h
++++ b/iptables/xtables-multi.h
+@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **);
+ extern int xtables_eb_main(int, char **);
+ extern int xtables_eb_restore_main(int, char **);
+ extern int xtables_eb_save_main(int, char **);
+-extern int xtables_config_main(int, char **);
+ extern int xtables_monitor_main(int, char **);
+ 
+ extern struct xtables_globals arptables_globals;
+-- 
+2.40.0
+

0003-Proper-fix-for-unknown-argument-error-message.patch

@@ -0,0 +1,148 @@
+From 01c76718d85985625ef53fb6b554bd44742ae6ef Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 25 Jan 2023 01:51:43 +0100
+Subject: [PATCH] Proper fix for "unknown argument" error message
+
+While commit 1b8210f848631 kind of fixed the corner-case of invalid
+short-options packed with others, it broke error reporting for
+long-options. Revert it and deploy a proper solution:
+
+When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long
+sets the variable 'optopt' to the invalid character's value. Use it for
+reporting instead of optind if set.
+
+To distinguish between invalid options and missing option arguments,
+ebtables-translate optstring needs adjustment.
+
+Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b)
+---
+ .../testcases/iptables/0009-unknown-arg_0     | 31 +++++++++++++++++++
+ iptables/xshared.c                            |  9 ++++--
+ iptables/xtables-eb-translate.c               |  8 ++---
+ iptables/xtables-eb.c                         | 17 ++++++----
+ 4 files changed, 50 insertions(+), 15 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0
+
+diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0
+new file mode 100755
+index 0000000000000..ac6e743966196
+--- /dev/null
++++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0
+@@ -0,0 +1,31 @@
++#!/bin/bash
++
++rc=0
++
++check() {
++	local cmd="$1"
++	local msg="$2"
++
++	$XT_MULTI $cmd 2>&1 | grep -q "$msg" || {
++		echo "cmd: $XT_MULTI $1"
++		echo "exp: $msg"
++		echo "res: $($XT_MULTI $cmd 2>&1)"
++		rc=1
++	}
++}
++
++cmds="iptables ip6tables"
++[[ $XT_MULTI == *xtables-nft-multi ]] && {
++	cmds+=" ebtables"
++	cmds+=" iptables-translate"
++	cmds+=" ip6tables-translate"
++	cmds+=" ebtables-translate"
++}
++
++for cmd in $cmds; do
++	check "${cmd} --foo" 'unknown option "--foo"'
++	check "${cmd} -A" 'option "-A" requires an argument'
++	check "${cmd} -aL" 'unknown option "-a"'
++done
++
++exit $rc
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index f93529b11a319..ac51fac5ce9ed 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -192,9 +192,12 @@ static int command_default(struct iptables_command_state *cs,
+ 	if (cs->c == ':')
+ 		xtables_error(PARAMETER_PROBLEM, "option \"%s\" "
+ 		              "requires an argument", cs->argv[optind-1]);
+-	if (cs->c == '?')
+-		xtables_error(PARAMETER_PROBLEM, "unknown option "
+-			      "\"%s\"", cs->argv[optind-1]);
++	if (cs->c == '?') {
++		char optoptstr[3] = {'-', optopt, '\0'};
++
++		xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"",
++			      optopt ? optoptstr : cs->argv[optind - 1]);
++	}
+ 	xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg);
+ }
+ 
+diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c
+index 13b6b864a5f24..0c35272051752 100644
+--- a/iptables/xtables-eb-translate.c
++++ b/iptables/xtables-eb-translate.c
+@@ -201,7 +201,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char
+ 	printf("nft ");
+ 	/* Getopt saves the day */
+ 	while ((c = getopt_long(argc, argv,
+-	   "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
++	   "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
+ 		cs.c = c;
+ 		switch (c) {
+ 		case 'A': /* Add a rule */
+@@ -491,11 +491,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char
+ 			continue;
+ 		default:
+ 			ebt_check_inverse2(optarg, argc, argv);
+-
+-			if (ebt_command_default(&cs))
+-				xtables_error(PARAMETER_PROBLEM,
+-					      "Unknown argument: '%s'",
+-					      argv[optind - 1]);
++			ebt_command_default(&cs);
+ 
+ 			if (command != 'A' && command != 'I' &&
+ 			    command != 'D')
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 7214a767ffe96..412b5cccdc46a 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -640,7 +640,16 @@ int ebt_command_default(struct iptables_command_state *cs)
+ 			return 0;
+ 		}
+ 	}
+-	return 1;
++	if (cs->c == ':')
++		xtables_error(PARAMETER_PROBLEM, "option \"%s\" "
++		              "requires an argument", cs->argv[optind - 1]);
++	if (cs->c == '?') {
++		char optoptstr[3] = {'-', optopt, '\0'};
++
++		xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"",
++			      optopt ? optoptstr : cs->argv[optind - 1]);
++	}
++	xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg);
+ }
+ 
+ int nft_init_eb(struct nft_handle *h, const char *pname)
+@@ -1084,11 +1093,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 			continue;
+ 		default:
+ 			ebt_check_inverse2(optarg, argc, argv);
+-
+-			if (ebt_command_default(&cs))
+-				xtables_error(PARAMETER_PROBLEM,
+-					      "Unknown argument: '%s'",
+-					      argv[optind]);
++			ebt_command_default(&cs);
+ 
+ 			if (command != 'A' && command != 'I' &&
+ 			    command != 'D' && command != 'C' && command != 14)
+-- 
+2.40.0
+

0004-ebtables-Refuse-unselected-targets-options.patch

@@ -0,0 +1,232 @@
+From a53dfa149429c49789947e61c325f9a11e9a83d3 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 25 Jan 2023 02:01:56 +0100
+Subject: [PATCH] ebtables: Refuse unselected targets' options
+
+Unlike legacy, ebtables-nft would allow e.g.:
+
+| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be
+
+While the result is correct, it may mislead users into believing
+multiple targets are possible per rule. Better follow legacy's behaviour
+and reject target options unless they have been "enabled" by a previous
+'-j' option.
+
+To achieve this, one needs to distinguish targets from watchers also
+attached to 'xtables_targets' and otherwise behaving like regular
+matches. Introduce XTABLES_EXT_WATCHER to mark the two.
+
+The above works already, but error messages are misleading when using
+the now unsupported syntax since target options have been merged
+already. Solve this by not pre-loading the targets at all, code will
+just fall back to loading ad '-j' parsing time as iptables does.
+
+Note how this also fixes for 'counter' statement being in wrong position
+of ebtables-translate output.
+
+Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b)
+---
+ extensions/libebt_dnat.txlate                 | 12 ++++----
+ extensions/libebt_log.c                       |  1 +
+ extensions/libebt_mark.txlate                 | 16 +++++-----
+ extensions/libebt_nflog.c                     |  1 +
+ extensions/libebt_snat.txlate                 |  8 ++---
+ include/xtables.h                             |  1 +
+ .../ebtables/0002-ebtables-save-restore_0     |  4 +--
+ iptables/xtables-eb.c                         | 29 +++++++------------
+ 8 files changed, 33 insertions(+), 39 deletions(-)
+
+diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate
+index 9f305c76c954f..531a22aa3e14f 100644
+--- a/extensions/libebt_dnat.txlate
++++ b/extensions/libebt_dnat.txlate
+@@ -1,8 +1,8 @@
+-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff
+-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter'
++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff
++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept'
+ 
+-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT
+-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter'
++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT
++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept'
+ 
+-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE
+-nft 'add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter'
++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE
++nft 'add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue'
+diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c
+index 045062196d20d..9f8d158956802 100644
+--- a/extensions/libebt_log.c
++++ b/extensions/libebt_log.c
+@@ -197,6 +197,7 @@ static int brlog_xlate(struct xt_xlate *xl,
+ static struct xtables_target brlog_target = {
+ 	.name		= "log",
+ 	.revision	= 0,
++	.ext_flags	= XTABLES_EXT_WATCHER,
+ 	.version	= XTABLES_VERSION,
+ 	.family		= NFPROTO_BRIDGE,
+ 	.size		= XT_ALIGN(sizeof(struct ebt_log_info)),
+diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate
+index d006e8ac94008..4ace1a1f5cfde 100644
+--- a/extensions/libebt_mark.txlate
++++ b/extensions/libebt_mark.txlate
+@@ -1,11 +1,11 @@
+-ebtables-translate -A INPUT --mark-set 42
+-nft 'add rule bridge filter INPUT meta mark set 0x2a accept counter'
++ebtables-translate -A INPUT -j mark --mark-set 42
++nft 'add rule bridge filter INPUT counter meta mark set 0x2a accept'
+ 
+-ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN
+-nft 'add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter'
++ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN
++nft 'add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return'
+ 
+-ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT
+-nft 'add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter'
++ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT
++nft 'add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept'
+ 
+-ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP
+-nft 'add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter'
++ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP
++nft 'add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop'
+diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c
+index 115e15da45845..762d6d5d8bbe2 100644
+--- a/extensions/libebt_nflog.c
++++ b/extensions/libebt_nflog.c
+@@ -146,6 +146,7 @@ static int brnflog_xlate(struct xt_xlate *xl,
+ static struct xtables_target brnflog_watcher = {
+ 	.name		= "nflog",
+ 	.revision	= 0,
++	.ext_flags	= XTABLES_EXT_WATCHER,
+ 	.version	= XTABLES_VERSION,
+ 	.family		= NFPROTO_BRIDGE,
+ 	.size		= XT_ALIGN(sizeof(struct ebt_nflog_info)),
+diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate
+index 857a6052aed1a..37343d3a14754 100644
+--- a/extensions/libebt_snat.txlate
++++ b/extensions/libebt_snat.txlate
+@@ -1,5 +1,5 @@
+-ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff
+-nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter'
++ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff
++nft 'add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept'
+ 
+-ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE
+-nft 'add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter'
++ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE
++nft 'add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue'
+diff --git a/include/xtables.h b/include/xtables.h
+index 4ffc8ec5a17e9..087a1d600f9ae 100644
+--- a/include/xtables.h
++++ b/include/xtables.h
+@@ -203,6 +203,7 @@ struct xtables_lmap {
+ 
+ enum xtables_ext_flags {
+ 	XTABLES_EXT_ALIAS = 1 << 0,
++	XTABLES_EXT_WATCHER = 1 << 1,
+ };
+ 
+ struct xt_xlate;
+diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+index 1091a4e80bebe..b4f9728bb9b6f 100755
+--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT
+ 
+ $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT
+ $XT_MULTI ebtables -A foo --log
+-$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT
++$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT
+ $XT_MULTI ebtables -A foo --nflog
+ $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT
+ $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT
+@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo
+ $XT_MULTI ebtables -N bar
+ $XT_MULTI ebtables -P bar RETURN
+ 
+-$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT
++$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT
+ #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01
+ 
+ $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 412b5cccdc46a..3a73e79725489 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -468,14 +468,14 @@ static void ebt_load_match(const char *name)
+ 		xtables_error(OTHER_PROBLEM, "Can't alloc memory");
+ }
+ 
+-static void __ebt_load_watcher(const char *name, const char *typename)
++static void ebt_load_watcher(const char *name)
+ {
+ 	struct xtables_target *watcher;
+ 	size_t size;
+ 
+ 	watcher = xtables_find_target(name, XTF_TRY_LOAD);
+ 	if (!watcher) {
+-		fprintf(stderr, "Unable to load %s %s\n", name, typename);
++		fprintf(stderr, "Unable to load %s watcher\n", name);
+ 		return;
+ 	}
+ 
+@@ -496,16 +496,6 @@ static void __ebt_load_watcher(const char *name, const char *typename)
+ 		xtables_error(OTHER_PROBLEM, "Can't alloc memory");
+ }
+ 
+-static void ebt_load_watcher(const char *name)
+-{
+-	return __ebt_load_watcher(name, "watcher");
+-}
+-
+-static void ebt_load_target(const char *name)
+-{
+-	return __ebt_load_watcher(name, "target");
+-}
+-
+ void ebt_load_match_extensions(void)
+ {
+ 	opts = ebt_original_options;
+@@ -522,13 +512,6 @@ void ebt_load_match_extensions(void)
+ 
+ 	ebt_load_watcher("log");
+ 	ebt_load_watcher("nflog");
+-
+-	ebt_load_target("mark");
+-	ebt_load_target("dnat");
+-	ebt_load_target("snat");
+-	ebt_load_target("arpreply");
+-	ebt_load_target("redirect");
+-	ebt_load_target("standard");
+ }
+ 
+ void ebt_add_match(struct xtables_match *m,
+@@ -633,6 +616,9 @@ int ebt_command_default(struct iptables_command_state *cs)
+ 
+ 	/* Is it a watcher option? */
+ 	for (t = xtables_targets; t; t = t->next) {
++		if (!(t->ext_flags & XTABLES_EXT_WATCHER))
++			continue;
++
+ 		if (t->parse &&
+ 		    t->parse(cs->c - t->option_offset, cs->argv,
+ 			     ebt_invert, &t->tflags, NULL, &t->t)) {
+@@ -726,6 +712,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 	optind = 0;
+ 	opterr = false;
+ 
++	for (t = xtables_targets; t; t = t->next) {
++		t->tflags = 0;
++		t->used = 0;
++	}
++
+ 	/* Getopt saves the day */
+ 	while ((c = getopt_long(argc, argv, EBT_OPTSTRING,
+ 					opts, NULL)) != -1) {
+-- 
+2.40.0
+

0005-tests-xlate-Properly-split-input-in-replay-mode.patch

@@ -0,0 +1,31 @@
+From bb7f92a40360b49535dd3675f47cf989755a4978 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 18:48:33 +0100
+Subject: [PATCH] tests: xlate: Properly split input in replay mode
+
+Source command may contain quotes, using shlex.split() does the right
+thing there.
+
+Fixes: 7705b2daa3bdc ("tests: xlate: Use --check to verify replay")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 914350a4586d2817ca7c4919c53142562f27bdaf)
+---
+ xlate-test.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xlate-test.py b/xlate-test.py
+index 4cb1401b71677..217d2f0062682 100755
+--- a/xlate-test.py
++++ b/xlate-test.py
+@@ -64,7 +64,7 @@ xtables_nft_multi = 'xtables-nft-multi'
+     if sourceline.find(';') >= 0:
+         sourceline, searchline = sourceline.split(';')
+ 
+-    srcwords = sourceline.split()
++    srcwords = shlex.split(sourceline)
+ 
+     srccmd = srcwords[0]
+     ipt = srccmd.split('-')[0]
+-- 
+2.40.0
+

0006-extensions-libebt_redirect-Fix-target-translation.patch

@@ -0,0 +1,48 @@
+From 75d208e729b3256fdbbf31709215d30064389d47 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 31 Jan 2023 22:28:24 +0100
+Subject: [PATCH] extensions: libebt_redirect: Fix target translation
+
+While EBT_ACCEPT is the default verdict for ebtables targets, omitting
+it from translation implicitly converts it into 'continue'. Omit the
+non-default EBT_CONTINUE instead.
+
+Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6)
+---
+ extensions/libebt_redirect.c      | 2 +-
+ extensions/libebt_redirect.txlate | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+ create mode 100644 extensions/libebt_redirect.txlate
+
+diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c
+index 4d4c7a02cea89..389f3ccb53f60 100644
+--- a/extensions/libebt_redirect.c
++++ b/extensions/libebt_redirect.c
+@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl,
+ 	const struct ebt_redirect_info *red = (const void*)params->target->data;
+ 
+ 	xt_xlate_add(xl, "meta set pkttype host");
+-	if (red->target != EBT_ACCEPT)
++	if (red->target != EBT_CONTINUE)
+ 		xt_xlate_add(xl, " %s ", brredir_verdict(red->target));
+ 	return 1;
+ }
+diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate
+new file mode 100644
+index 0000000000000..f0dd5deaf6406
+--- /dev/null
++++ b/extensions/libebt_redirect.txlate
+@@ -0,0 +1,8 @@
++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect
++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept'
++
++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN
++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return'
++
++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE
++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host'
+-- 
+2.40.0
+

0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch

@@ -0,0 +1,48 @@
+From 345fb0551048b4b3c9f3f0a136c952a4ae5bf262 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 31 Jan 2023 23:32:50 +0100
+Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in
+ translation
+
+Meta key comes before 'set' in meta statement.
+
+Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d)
+---
+ extensions/libebt_redirect.c      | 2 +-
+ extensions/libebt_redirect.txlate | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c
+index 389f3ccb53f60..7821935e137aa 100644
+--- a/extensions/libebt_redirect.c
++++ b/extensions/libebt_redirect.c
+@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl,
+ {
+ 	const struct ebt_redirect_info *red = (const void*)params->target->data;
+ 
+-	xt_xlate_add(xl, "meta set pkttype host");
++	xt_xlate_add(xl, "meta pkttype set host");
+ 	if (red->target != EBT_CONTINUE)
+ 		xt_xlate_add(xl, " %s ", brredir_verdict(red->target));
+ 	return 1;
+diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate
+index f0dd5deaf6406..d073ec774c4fa 100644
+--- a/extensions/libebt_redirect.txlate
++++ b/extensions/libebt_redirect.txlate
+@@ -1,8 +1,8 @@
+ ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect
+-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept'
++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept'
+ 
+ ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN
+-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return'
++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return'
+ 
+ ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE
+-nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host'
++nft 'add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host'
+-- 
+2.40.0
+

0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch

@@ -0,0 +1,50 @@
+From 6177d53b1b5748d64eba68b42b173427815e454f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 18:58:36 +0100
+Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation
+
+Converting from TOS field match to DSCP one is irreversible, so replay
+testing is not possible. Use a raw payload expression to produce
+something that translates 1:1 back into an 'ip' match.
+
+Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145)
+---
+ extensions/libebt_ip.c      | 4 ++--
+ extensions/libebt_ip.txlate | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
+index fd87dae7e2c62..8b381aa10b5b7 100644
+--- a/extensions/libebt_ip.c
++++ b/extensions/libebt_ip.c
+@@ -442,10 +442,10 @@ static int brip_xlate(struct xt_xlate *xl,
+ 	brip_xlate_nh(xl, info, EBT_IP_DEST);
+ 
+ 	if (info->bitmask & EBT_IP_TOS) {
+-		xt_xlate_add(xl, "ip dscp ");
++		xt_xlate_add(xl, "@nh,8,8 ");
+ 		if (info->invflags & EBT_IP_TOS)
+ 			xt_xlate_add(xl, "!= ");
+-		xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */
++		xt_xlate_add(xl, "0x%02x ", info->tos);
+ 	}
+ 	if (info->bitmask & EBT_IP_PROTO) {
+ 		struct protoent *pe;
+diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
+index 75c1db246fb81..562e3157d7b92 100644
+--- a/extensions/libebt_ip.txlate
++++ b/extensions/libebt_ip.txlate
+@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
+ nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter'
+ 
+ ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
+-nft 'insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter'
++nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter'
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
+ nft 'add rule bridge filter FORWARD tcp dport 22 counter'
+-- 
+2.40.0
+

0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch

@@ -0,0 +1,85 @@
+From 1429ad5300d85ae9e3f6114f609afb1ac6808c71 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 17:37:40 +0100
+Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type
+
+On one hand, nft refuses th expression in bridge family if layer3
+protocol has not been assured by a previous match. On the other, ebt_ip
+kernel module will only match on IPv4 packets, so there might be a
+functional change in the translation versus the original.
+
+Instead of just always emitting an 'ether type' match, decide whether
+it's actually needed - explicit "ip <something>" payload matches (or
+icmp ones) cause implicit creation of a match on IPv4 by nft.
+
+Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70)
+---
+ extensions/libebt_ip.c      | 21 +++++++++++++++++++++
+ extensions/libebt_ip.txlate |  6 +++---
+ 2 files changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
+index 8b381aa10b5b7..68f34bff97deb 100644
+--- a/extensions/libebt_ip.c
++++ b/extensions/libebt_ip.c
+@@ -432,6 +432,24 @@ static void brip_xlate_nh(struct xt_xlate *xl,
+ 				  xtables_ipmask_to_numeric(maskp));
+ }
+ 
++static bool may_skip_ether_type_dep(uint8_t flags)
++{
++	/* these convert to "ip (s|d)addr" matches */
++	if (flags & (EBT_IP_SOURCE | EBT_IP_DEST))
++		return true;
++
++	/* icmp match triggers implicit ether type dependency in nft */
++	if (flags & EBT_IP_ICMP)
++		return true;
++
++	/* allow if "ip protocol" match is created by brip_xlate() */
++	if (flags & EBT_IP_PROTO &&
++	    !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)))
++		return true;
++
++	return false;
++}
++
+ static int brip_xlate(struct xt_xlate *xl,
+ 		      const struct xt_xlate_mt_params *params)
+ {
+@@ -441,6 +459,9 @@ static int brip_xlate(struct xt_xlate *xl,
+ 	brip_xlate_nh(xl, info, EBT_IP_SOURCE);
+ 	brip_xlate_nh(xl, info, EBT_IP_DEST);
+ 
++	if (!may_skip_ether_type_dep(info->bitmask))
++		xt_xlate_add(xl, "ether type ip ");
++
+ 	if (info->bitmask & EBT_IP_TOS) {
+ 		xt_xlate_add(xl, "@nh,8,8 ");
+ 		if (info->invflags & EBT_IP_TOS)
+diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
+index 562e3157d7b92..28996832225cb 100644
+--- a/extensions/libebt_ip.txlate
++++ b/extensions/libebt_ip.txlate
+@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
+ nft 'insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter'
+ 
+ ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
+-nft 'insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter'
++nft 'insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter'
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
+-nft 'add rule bridge filter FORWARD tcp dport 22 counter'
++nft 'add rule bridge filter FORWARD ether type ip tcp dport 22 counter'
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535
+-nft 'add rule bridge filter FORWARD udp sport 1024-65535 counter'
++nft 'add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter'
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto 253
+ nft 'add rule bridge filter FORWARD ip protocol 253 counter'
+-- 
+2.40.0
+

0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch

@@ -0,0 +1,36 @@
+From 94052918c2fd1508afa15a9a83965755d354d69b Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Tue, 21 Feb 2023 12:19:42 -0500
+Subject: [PATCH] xt_sctp: add the missing chunk types in sctp_help
+
+Add the missing chunk types in sctp_help(), so that the help cmd can
+display these chunk types as below:
+
+  # iptables -p sctp --help
+
+  chunktypes - ... I_DATA RE_CONFIG PAD ... I_FORWARD_TSN ALL NONE
+
+Fixes: 6b04d9c34e25 ("xt_sctp: support a couple of new chunk types")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit f7c8d896f3305471746a8690f73587a65854d8fa)
+---
+ extensions/libxt_sctp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
+index fe5f5621a033d..6e2b2745dcbd5 100644
+--- a/extensions/libxt_sctp.c
++++ b/extensions/libxt_sctp.c
+@@ -50,7 +50,7 @@ static void sctp_help(void)
+ " --dport ...\n" 
+ "[!] --chunk-types (all|any|none) (chunktype[:flags])+	match if all, any or none of\n"
+ "						        chunktypes are present\n"
+-"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK FORWARD_TSN ALL NONE\n");
++"chunktypes - DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE I_DATA RE_CONFIG PAD ASCONF ASCONF_ACK FORWARD_TSN I_FORWARD_TSN ALL NONE\n");
+ }
+ 
+ static const struct option sctp_opts[] = {
+-- 
+2.40.0
+

0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch

@@ -0,0 +1,101 @@
+From 3311bf0d0fefd845d8d1d01b178bcd6701473a43 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 22 Feb 2023 16:36:16 +0100
+Subject: [PATCH] include: Add missing linux/netfilter/xt_LOG.h
+
+When merging IP-version-specific LOG extensions, a dependency to that
+header was introduced without caching it. Fix this and drop the now
+unused ip{,6}t_LOG.h files.
+
+Reported-by: Thomas Devoogdt <thomas@devoogdt.com>
+Fixes: 87e4f1bf0b87b ("extensions: libip*t_LOG: Merge extensions")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 8030e5444681e16ac2f481ddad73e33fab376147)
+---
+ include/linux/netfilter/xt_LOG.h        | 20 ++++++++++++++++++++
+ include/linux/netfilter_ipv4/ipt_LOG.h  | 19 -------------------
+ include/linux/netfilter_ipv6/ip6t_LOG.h | 19 -------------------
+ 3 files changed, 20 insertions(+), 38 deletions(-)
+ create mode 100644 include/linux/netfilter/xt_LOG.h
+ delete mode 100644 include/linux/netfilter_ipv4/ipt_LOG.h
+ delete mode 100644 include/linux/netfilter_ipv6/ip6t_LOG.h
+
+diff --git a/include/linux/netfilter/xt_LOG.h b/include/linux/netfilter/xt_LOG.h
+new file mode 100644
+index 0000000000000..167d4ddd2476b
+--- /dev/null
++++ b/include/linux/netfilter/xt_LOG.h
+@@ -0,0 +1,20 @@
++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++#ifndef _XT_LOG_H
++#define _XT_LOG_H
++
++/* make sure not to change this without changing nf_log.h:NF_LOG_* (!) */
++#define XT_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
++#define XT_LOG_TCPOPT		0x02	/* Log TCP options */
++#define XT_LOG_IPOPT		0x04	/* Log IP options */
++#define XT_LOG_UID		0x08	/* Log UID owning local socket */
++#define XT_LOG_NFLOG		0x10	/* Unsupported, don't reuse */
++#define XT_LOG_MACDECODE	0x20	/* Decode MAC header */
++#define XT_LOG_MASK		0x2f
++
++struct xt_log_info {
++	unsigned char level;
++	unsigned char logflags;
++	char prefix[30];
++};
++
++#endif /* _XT_LOG_H */
+diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h
+deleted file mode 100644
+index dcdbadf9fd4a9..0000000000000
+--- a/include/linux/netfilter_ipv4/ipt_LOG.h
++++ /dev/null
+@@ -1,19 +0,0 @@
+-#ifndef _IPT_LOG_H
+-#define _IPT_LOG_H
+-
+-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
+-#define IPT_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
+-#define IPT_LOG_TCPOPT		0x02	/* Log TCP options */
+-#define IPT_LOG_IPOPT		0x04	/* Log IP options */
+-#define IPT_LOG_UID		0x08	/* Log UID owning local socket */
+-#define IPT_LOG_NFLOG		0x10	/* Unsupported, don't reuse */
+-#define IPT_LOG_MACDECODE	0x20	/* Decode MAC header */
+-#define IPT_LOG_MASK		0x2f
+-
+-struct ipt_log_info {
+-	unsigned char level;
+-	unsigned char logflags;
+-	char prefix[30];
+-};
+-
+-#endif /*_IPT_LOG_H*/
+diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h
+deleted file mode 100644
+index 9dd5579e02ec7..0000000000000
+--- a/include/linux/netfilter_ipv6/ip6t_LOG.h
++++ /dev/null
+@@ -1,19 +0,0 @@
+-#ifndef _IP6T_LOG_H
+-#define _IP6T_LOG_H
+-
+-/* make sure not to change this without changing netfilter.h:NF_LOG_* (!) */
+-#define IP6T_LOG_TCPSEQ		0x01	/* Log TCP sequence numbers */
+-#define IP6T_LOG_TCPOPT		0x02	/* Log TCP options */
+-#define IP6T_LOG_IPOPT		0x04	/* Log IP options */
+-#define IP6T_LOG_UID		0x08	/* Log UID owning local socket */
+-#define IP6T_LOG_NFLOG		0x10	/* Unsupported, don't use */
+-#define IP6T_LOG_MACDECODE	0x20	/* Decode MAC header */
+-#define IP6T_LOG_MASK		0x2f
+-
+-struct ip6t_log_info {
+-	unsigned char level;
+-	unsigned char logflags;
+-	char prefix[30];
+-};
+-
+-#endif /*_IPT_LOG_H*/
+-- 
+2.40.0
+

0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch

@@ -0,0 +1,67 @@
+From 1d37530ed4a9ece32ed94faa916845a883f8fd05 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 28 Feb 2023 18:09:25 +0100
+Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule
+
+Combining multiple corner-cases here:
+
+* Insert a rule before another new one which is not the first. Triggers
+  NFTNL_RULE_ID assignment of the latter.
+
+* Delete the referenced new rule in the same batch again. Causes
+  overwriting of the previously assigned RULE_ID.
+
+Consequently, iptables-nft-restore fails during *insert*, because the
+reference is dangling.
+
+Reported-by: Eric Garver <eric@garver.life>
+Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Tested-by: Eric Garver <eric@garver.life>
+(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4)
+---
+ iptables/nft.c                                   |  3 ++-
+ .../ipt-restore/0003-restore-ordering_0          | 16 ++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 63468cf3b1344..5896fd410ca78 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -2343,7 +2343,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r)
+ 
+ 	nftnl_rule_list_del(r);
+ 
+-	if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE))
++	if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) &&
++	    !nftnl_rule_get_u32(r, NFTNL_RULE_ID))
+ 		nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id);
+ 
+ 	obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r);
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
+index 3f1d229e915ff..5482b7ea17298 100755
+--- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
++++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
+@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
+ -A FORWARD -m comment --comment "rule 3" -j ACCEPT'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
++
++# test adding, referencing and deleting the same rule in a batch
++
++$XT_MULTI iptables-restore <<EOF
++*filter
++-A FORWARD -m comment --comment "first rule" -j ACCEPT
++-A FORWARD -m comment --comment "referenced rule" -j ACCEPT
++-I FORWARD 2 -m comment --comment "referencing rule" -j ACCEPT
++-D FORWARD -m comment --comment "referenced rule" -j ACCEPT
++COMMIT
++EOF
++
++EXPECT='-A FORWARD -m comment --comment "first rule" -j ACCEPT
++-A FORWARD -m comment --comment "referencing rule" -j ACCEPT'
++
++diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
+-- 
+2.40.0
+

0013-ip6tables-Fix-checking-existence-of-rule.patch

@@ -0,0 +1,33 @@
+From f6338ac2776094b3fc27227511de53b5f96be16d Mon Sep 17 00:00:00 2001
+From: Markus Boehme <markubo@amazon.com>
+Date: Mon, 3 Apr 2023 23:13:47 +0200
+Subject: [PATCH] ip6tables: Fix checking existence of rule
+
+Pass the proper entry size when creating a match mask for checking the
+existence of a rule. Failing to do so causes wrong results.
+
+Reported-by: Jonathan Caicedo <jonathan@jcaicedo.com>
+Fixes: eb2546a846776 ("xshared: Share make_delete_mask() between ip{,6}tables")
+Signed-off-by: Markus Boehme <markubo@amazon.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 78850e7dba64a949c440dbdbe557f59409c6db48)
+---
+ iptables/ip6tables.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
+index 345af4519bfe7..9afc32c1a21ed 100644
+--- a/iptables/ip6tables.c
++++ b/iptables/ip6tables.c
+@@ -331,7 +331,7 @@ check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
+ 	int ret = 1;
+ 	unsigned char *mask;
+ 
+-	mask = make_delete_mask(matches, target, sizeof(fw));
++	mask = make_delete_mask(matches, target, sizeof(*fw));
+ 	for (i = 0; i < nsaddrs; i++) {
+ 		fw->ipv6.src = saddrs[i];
+ 		fw->ipv6.smsk = smasks[i];
+-- 
+2.40.0
+

0014-nft-shared-Drop-unused-include.patch

@@ -0,0 +1,29 @@
+From 1bf20a3bd929060cb9afdd798292f0463243e26d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 29 Mar 2023 16:22:16 +0200
+Subject: [PATCH] nft-shared: Drop unused include
+
+Code does not refer to struct xt_comment_info anymore.
+
+Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427)
+---
+ iptables/nft-shared.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 4a7b5406892c4..4ba44a4aa4d17 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -22,7 +22,6 @@
+ #include <xtables.h>
+ 
+ #include <linux/netfilter/nf_log.h>
+-#include <linux/netfilter/xt_comment.h>
+ #include <linux/netfilter/xt_limit.h>
+ #include <linux/netfilter/xt_NFLOG.h>
+ #include <linux/netfilter/xt_mark.h>
+-- 
+2.40.0
+

0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch

@@ -0,0 +1,31 @@
+From 9a4b3bde58819e55a2d852800e87e66629a87081 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Apr 2023 14:33:43 +0200
+Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match
+
+The wrong bit was set in 'invflags', probably due to copy'n'paste from
+the previous case.
+
+Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08)
+---
+ iptables/nft-arp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 210f43d2cefbe..8fae5adc50216 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -244,7 +244,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
+ 		fw->arp.arhln = ar_hln;
+ 		fw->arp.arhln_mask = 0xff;
+ 		if (inv)
+-			fw->arp.invflags |= IPT_INV_ARPOP;
++			fw->arp.invflags |= IPT_INV_ARPHLN;
+ 		break;
+ 	case offsetof(struct arphdr, ar_pln):
+ 		get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv);
+-- 
+2.40.0
+

0016-arptables-Don-t-omit-standard-matches-if-inverted.patch

@@ -0,0 +1,42 @@
+From a900100d6d4be7c52e4cfd1ab06ce3ac626d71a1 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Apr 2023 14:37:47 +0200
+Subject: [PATCH] arptables: Don't omit standard matches if inverted
+
+Inverted --h-len and --h-type matches were omitted from output by
+accident if they matched on their standard value.
+
+Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e)
+---
+ iptables/nft-arp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 8fae5adc50216..df3ad430cf701 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -408,7 +408,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
+ 
+ after_devdst:
+ 
+-	if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
++	if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 ||
++	    fw->arp.invflags & IPT_INV_ARPHLN) {
+ 		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN
+ 			? "! " : "");
+ 		printf("--h-length %d", fw->arp.arhln);
+@@ -432,7 +433,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
+ 		sep = " ";
+ 	}
+ 
+-	if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
++	if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) ||
++	    fw->arp.invflags & IPT_INV_ARPHRD) {
+ 		uint16_t tmp = ntohs(fw->arp.arhrd);
+ 
+ 		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD
+-- 
+2.40.0
+

0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch

@@ -0,0 +1,211 @@
+From 174ef8164bc3b1f9454f77b3747f1591ea5b5a9f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Apr 2023 14:41:08 +0200
+Subject: [PATCH] xshared: Fix parsing of option arguments in same word
+
+When merging commandline parsers, a decision between 'argv[optind - 1]'
+and 'optarg' had to be made in some spots. While the implementation of
+check_inverse() required the former, use of the latter allows for the
+common syntax of '--opt=arg' or even '-oarg' as 'optarg' will point at
+the suffix while 'argv[optind - 1]' will just point at the following
+option.
+
+Fix the mess by making check_inverse() update optarg pointer if needed
+so calling code may refer to and always correct 'optarg'.
+
+Fixes: 0af80a91b0a98 ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1677
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 90a7a183a208b691810b8519cc57d3d9d3b7eb60)
+---
+ extensions/libarpt_standard.t |  2 ++
+ extensions/libxt_standard.t   |  3 ++
+ iptables/xshared.c            | 61 +++++++++++++++++------------------
+ 3 files changed, 35 insertions(+), 31 deletions(-)
+
+diff --git a/extensions/libarpt_standard.t b/extensions/libarpt_standard.t
+index e84a00b780488..007fa2b8335e8 100644
+--- a/extensions/libarpt_standard.t
++++ b/extensions/libarpt_standard.t
+@@ -12,3 +12,5 @@
+ -i lo --destination-mac 11:22:33:44:55:66;-i lo --dst-mac 11:22:33:44:55:66;OK
+ --source-mac Unicast;--src-mac 00:00:00:00:00:00/01:00:00:00:00:00;OK
+ ! --src-mac Multicast;! --src-mac 01:00:00:00:00:00/01:00:00:00:00:00;OK
++--src-mac=01:02:03:04:05:06 --dst-mac=07:08:09:0A:0B:0C --h-length=6 --opcode=Request --h-type=Ethernet --proto-type=ipv4;--src-mac 01:02:03:04:05:06 --dst-mac 07:08:09:0a:0b:0c --opcode 1 --proto-type 0x800;OK
++--src-mac ! 01:02:03:04:05:06 --dst-mac ! 07:08:09:0A:0B:0C --h-length ! 6 --opcode ! Request --h-type ! Ethernet --proto-type ! ipv4;! --src-mac 01:02:03:04:05:06 ! --dst-mac 07:08:09:0a:0b:0c ! --h-length 6 ! --opcode 1 ! --h-type 1 ! --proto-type 0x800;OK
+diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t
+index 56d6da2e5884e..6ed978e442b80 100644
+--- a/extensions/libxt_standard.t
++++ b/extensions/libxt_standard.t
+@@ -21,3 +21,6 @@
+ -s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK
+ -s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK
+ -s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK
++:FORWARD
++--protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK
++-ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index ac51fac5ce9ed..17aed04e02b09 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -1318,7 +1318,7 @@ static void check_empty_interface(struct xtables_args *args, const char *arg)
+ }
+ 
+ static void check_inverse(struct xtables_args *args, const char option[],
+-			  bool *invert, int *optidx, int argc)
++			  bool *invert, int argc, char **argv)
+ {
+ 	switch (args->family) {
+ 	case NFPROTO_ARP:
+@@ -1337,12 +1337,11 @@ static void check_inverse(struct xtables_args *args, const char option[],
+ 		xtables_error(PARAMETER_PROBLEM,
+ 			      "Multiple `!' flags not allowed");
+ 	*invert = true;
+-	if (optidx) {
+-		*optidx = *optidx + 1;
+-		if (argc && *optidx > argc)
+-			xtables_error(PARAMETER_PROBLEM,
+-				      "no argument following `!'");
+-	}
++	optind++;
++	if (optind > argc)
++		xtables_error(PARAMETER_PROBLEM, "no argument following `!'");
++
++	optarg = argv[optind - 1];
+ }
+ 
+ static const char *optstring_lookup(int family)
+@@ -1555,16 +1554,16 @@ void do_parse(int argc, char *argv[],
+ 			 * Option selection
+ 			 */
+ 		case 'p':
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_PROTOCOL,
+ 				   &args->invflags, invert);
+ 
+ 			/* Canonicalize into lower case */
+-			for (cs->protocol = argv[optind - 1];
++			for (cs->protocol = optarg;
+ 			     *cs->protocol; cs->protocol++)
+ 				*cs->protocol = tolower(*cs->protocol);
+ 
+-			cs->protocol = argv[optind - 1];
++			cs->protocol = optarg;
+ 			args->proto = xtables_parse_protocol(cs->protocol);
+ 
+ 			if (args->proto == 0 &&
+@@ -1578,17 +1577,17 @@ void do_parse(int argc, char *argv[],
+ 			break;
+ 
+ 		case 's':
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_SOURCE,
+ 				   &args->invflags, invert);
+-			args->shostnetworkmask = argv[optind - 1];
++			args->shostnetworkmask = optarg;
+ 			break;
+ 
+ 		case 'd':
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_DESTINATION,
+ 				   &args->invflags, invert);
+-			args->dhostnetworkmask = argv[optind - 1];
++			args->dhostnetworkmask = optarg;
+ 			break;
+ 
+ #ifdef IPT_F_GOTO
+@@ -1601,71 +1600,71 @@ void do_parse(int argc, char *argv[],
+ #endif
+ 
+ 		case 2:/* src-mac */
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_S_MAC, &args->invflags,
+ 				   invert);
+-			args->src_mac = argv[optind - 1];
++			args->src_mac = optarg;
+ 			break;
+ 
+ 		case 3:/* dst-mac */
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_D_MAC, &args->invflags,
+ 				   invert);
+-			args->dst_mac = argv[optind - 1];
++			args->dst_mac = optarg;
+ 			break;
+ 
+ 		case 'l':/* hardware length */
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_H_LENGTH, &args->invflags,
+ 				   invert);
+-			args->arp_hlen = argv[optind - 1];
++			args->arp_hlen = optarg;
+ 			break;
+ 
+ 		case 8: /* was never supported, not even in arptables-legacy */
+ 			xtables_error(PARAMETER_PROBLEM, "not supported");
+ 		case 4:/* opcode */
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_OPCODE, &args->invflags,
+ 				   invert);
+-			args->arp_opcode = argv[optind - 1];
++			args->arp_opcode = optarg;
+ 			break;
+ 
+ 		case 5:/* h-type */
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_H_TYPE, &args->invflags,
+ 				   invert);
+-			args->arp_htype = argv[optind - 1];
++			args->arp_htype = optarg;
+ 			break;
+ 
+ 		case 6:/* proto-type */
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_P_TYPE, &args->invflags,
+ 				   invert);
+-			args->arp_ptype = argv[optind - 1];
++			args->arp_ptype = optarg;
+ 			break;
+ 
+ 		case 'j':
+ 			set_option(&cs->options, OPT_JUMP, &args->invflags,
+ 				   invert);
+-			command_jump(cs, argv[optind - 1]);
++			command_jump(cs, optarg);
+ 			break;
+ 
+ 		case 'i':
+ 			check_empty_interface(args, optarg);
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_VIANAMEIN,
+ 				   &args->invflags, invert);
+-			xtables_parse_interface(argv[optind - 1],
++			xtables_parse_interface(optarg,
+ 						args->iniface,
+ 						args->iniface_mask);
+ 			break;
+ 
+ 		case 'o':
+ 			check_empty_interface(args, optarg);
+-			check_inverse(args, optarg, &invert, &optind, argc);
++			check_inverse(args, optarg, &invert, argc, argv);
+ 			set_option(&cs->options, OPT_VIANAMEOUT,
+ 				   &args->invflags, invert);
+-			xtables_parse_interface(argv[optind - 1],
++			xtables_parse_interface(optarg,
+ 						args->outiface,
+ 						args->outiface_mask);
+ 			break;
+-- 
+2.40.0
+

0018-iptables-Fix-setting-of-ipv6-counters.patch

@@ -0,0 +1,102 @@
+From 935dddbb219eb09a289507e609ff8e9b4429c1ea Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 12:44:54 +0200
+Subject: [PATCH] iptables: Fix setting of ipv6 counters
+
+When setting counters using ip6tables-nft -c X Y the X and Y values were
+not stored.
+
+This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but
+applied to the nft variant of ipv6 not the legacy.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647
+Fixes: 0391677c1a0b2 ("xtables: add IPv6 support")
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ed839159edf8bda8e9196f1056c4038c22d78bfd)
+---
+ iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 | 6 +++---
+ iptables/tests/shell/testcases/iptables/0003-list-rules_0  | 6 +++---
+ iptables/xshared.c                                         | 3 +++
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+index c98bdd6e501aa..09e39927ef390 100755
+--- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
++++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $XT_MULTI ip6tables -N foo
+-$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT
++$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
+ $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo
+ $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+ 
+@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
+ -P FORWARD ACCEPT -c 0 0
+ -P OUTPUT ACCEPT -c 0 0
+ -N foo
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S)
+@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
+ 
+ EXPECT='-P FORWARD ACCEPT -c 0 0
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD)
+diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+index d335d44257a49..d07bd151be76b 100755
+--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0
++++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $XT_MULTI iptables -N foo
+-$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT
++$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
+ $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo
+ $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+ 
+@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
+ -P FORWARD ACCEPT -c 0 0
+ -P OUTPUT ACCEPT -c 0 0
+ -N foo
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S)
+@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD)
+ 
+ EXPECT='-P FORWARD ACCEPT -c 0 0
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD)
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index 17aed04e02b09..71ee94d6f2f83 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -1992,6 +1992,9 @@ void ipv6_post_parse(int command, struct iptables_command_state *cs,
+ 	if (args->goto_set)
+ 		cs->fw6.ipv6.flags |= IP6T_F_GOTO;
+ 
++	/* nft-variants use cs->counters, legacy uses cs->fw6.counters */
++	cs->counters.pcnt = args->pcnt_cnt;
++	cs->counters.bcnt = args->bcnt_cnt;
+ 	cs->fw6.counters.pcnt = args->pcnt_cnt;
+ 	cs->fw6.counters.bcnt = args->bcnt_cnt;
+ 
+-- 
+2.41.0
+

0019-iptables-Fix-handling-of-non-existent-chains.patch

@@ -0,0 +1,53 @@
+From cd3a8274e9e904d227b81ae7158d6e82b1311bf8 Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 13:46:36 +0200
+Subject: [PATCH] iptables: Fix handling of non-existent chains
+
+Since 694612adf87 the "compatibility" check considers non-existent
+chains as "incompatible". This broke some scripts which used calls
+like `iptables -L CHAIN404` to test for chain existence and expect
+"No chain/target/match by that name." in the output.
+
+This patch changes the logic of `nft_is_table_compatible()` to
+report non-existent chains as "compatible" which restores the old
+behavior.
+
+Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 82ccfb488eeac5507471099b9b4e6d136cc06e3b)
+---
+ iptables/nft.c                                              | 2 +-
+ iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 5896fd410ca78..5e4cd76b05504 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3847,7 +3847,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
+ 	if (chain) {
+ 		struct nft_chain *c = nft_chain_find(h, table, chain);
+ 
+-		return c && !nft_is_chain_compatible(c, h);
++		return !c || !nft_is_chain_compatible(c, h);
+ 	}
+ 
+ 	return !nft_chain_foreach(h, table, nft_is_chain_compatible, h);
+diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+index 33c5f1f35d17f..234f3040516e1 100755
+--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
++++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar
+ cmd 0 -E foo bar
+ cmd 1 "$EEXIST_F" -E foo bar
+ cmd 1 "$ENOENT" -E foo bar2
++cmd 1 "$ENOENT" -L foo
+ cmd 0 -N foo2
+ cmd 1 "$EEXIST_F" -E foo2 bar
+ 
+-- 
+2.41.0
+

0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch

@@ -0,0 +1,42 @@
+From 90ca86dfed56510ebc52ab2924800eb28ce0d951 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 20:08:09 +0100
+Subject: [PATCH] ebtables: ip and ip6 matches depend on protocol match
+
+This is consistent with legacy ebtables, also avoids invalid
+combinations like '-p IPv6 --ip-source 1.2.3.4'.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 267a26363826553280a5928043df30a07cdc63bb)
+---
+ iptables/nft-bridge.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index 83cbe31559d4b..b9983b203f6d0 100644
+--- a/iptables/nft-bridge.c
++++ b/iptables/nft-bridge.c
+@@ -104,11 +104,18 @@ static int
+ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+ 		     struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+-	if (!strcmp(m->u.user.name, "802_3") &&
+-	    !(fw->bitmask & EBT_802_3))
++	if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3))
+ 		xtables_error(PARAMETER_PROBLEM,
+ 			      "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH");
+ 
++	if (!strcmp(m->u.user.name, "ip") && fw->ethproto != htons(ETH_P_IP))
++		xtables_error(PARAMETER_PROBLEM,
++			      "For IP filtering the protocol must be specified as IPv4.");
++
++	if (!strcmp(m->u.user.name, "ip6") && fw->ethproto != htons(ETH_P_IPV6))
++		xtables_error(PARAMETER_PROBLEM,
++			      "For IPv6 filtering the protocol must be specified as IPv6.");
++
+ 	return add_match(h, r, m);
+ }
+ 
+-- 
+2.41.0
+

0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch

@@ -0,0 +1,348 @@
+From a61cac5cdd4332cf84b9e2f554a1c8852d40dc0a Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 11 Jul 2023 22:06:44 +0200
+Subject: [PATCH] nft-bridge: pass context structure to ops->add() to improve
+ anonymous set support
+
+Add context structure to improve bridge among support which creates an
+anonymous set. This context structure specifies the command and it
+allows to optionally store a anonymous set.
+
+Use this context to generate native bytecode only if this is an
+add/insert/replace command.
+
+This fixes a dangling anonymous set that is created on rule removal.
+
+Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
+Reported-and-tested-by: Igor Raits <igor@gooddata.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 4e95200ded923f0eb5579c33b91176193c59dbe0)
+---
+ iptables/nft-arp.c    |  4 ++--
+ iptables/nft-bridge.c |  9 ++++----
+ iptables/nft-cmd.c    |  6 ++++-
+ iptables/nft-ipv4.c   |  6 ++---
+ iptables/nft-ipv6.c   |  6 ++---
+ iptables/nft-shared.h |  5 ++--
+ iptables/nft.c        | 54 ++++++++++++++++++++++++++++---------------
+ iptables/nft.h        |  9 +++++---
+ 8 files changed, 62 insertions(+), 37 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index df3ad430cf701..889387e4db592 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -40,8 +40,8 @@ static bool need_devaddr(struct arpt_devaddr_info *info)
+ 	return false;
+ }
+ 
+-static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r,
+-		       struct iptables_command_state *cs)
++static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
++		       struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	struct arpt_entry *fw = &cs->arp;
+ 	uint32_t op;
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index b9983b203f6d0..a41f411fbba14 100644
+--- a/iptables/nft-bridge.c
++++ b/iptables/nft-bridge.c
+@@ -102,7 +102,8 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
+ 
+ static int
+ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+-		     struct nftnl_rule *r, struct xt_entry_match *m)
++		     struct nft_rule_ctx *ctx, struct nftnl_rule *r,
++		     struct xt_entry_match *m)
+ {
+ 	if (!strcmp(m->u.user.name, "802_3") && !(fw->bitmask & EBT_802_3))
+ 		xtables_error(PARAMETER_PROBLEM,
+@@ -116,10 +117,10 @@ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+ 		xtables_error(PARAMETER_PROBLEM,
+ 			      "For IPv6 filtering the protocol must be specified as IPv6.");
+ 
+-	return add_match(h, r, m);
++	return add_match(h, ctx, r, m);
+ }
+ 
+-static int nft_bridge_add(struct nft_handle *h,
++static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 			  struct nftnl_rule *r,
+ 			  struct iptables_command_state *cs)
+ {
+@@ -181,7 +182,7 @@ static int nft_bridge_add(struct nft_handle *h,
+ 
+ 	for (iter = cs->match_list; iter; iter = iter->next) {
+ 		if (iter->ismatch) {
+-			if (nft_bridge_add_match(h, fw, r, iter->u.match->m))
++			if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m))
+ 				break;
+ 		} else {
+ 			if (add_target(r, iter->u.watcher->t))
+diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
+index f16ea0e6eaf8b..8cf8027e7465d 100644
+--- a/iptables/nft-cmd.c
++++ b/iptables/nft-cmd.c
+@@ -14,12 +14,16 @@
+ #include <xtables.h>
+ #include "nft.h"
+ #include "nft-cmd.h"
++#include <libnftnl/set.h>
+ 
+ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 			    const char *table, const char *chain,
+ 			    struct iptables_command_state *state,
+ 			    int rulenum, bool verbose)
+ {
++	struct nft_rule_ctx ctx = {
++		.command = command,
++	};
+ 	struct nftnl_rule *rule;
+ 	struct nft_cmd *cmd;
+ 
+@@ -33,7 +37,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 	cmd->verbose = verbose;
+ 
+ 	if (state) {
+-		rule = nft_rule_new(h, chain, table, state);
++		rule = nft_rule_new(h, &ctx, chain, table, state);
+ 		if (!rule) {
+ 			nft_cmd_free(cmd);
+ 			return NULL;
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index dcc4a8edfc87f..fb62103fd38d7 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -26,8 +26,8 @@
+ #include "nft.h"
+ #include "nft-shared.h"
+ 
+-static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r,
+-			struct iptables_command_state *cs)
++static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
++			struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	struct xtables_rule_match *matchp;
+ 	uint32_t op;
+@@ -81,7 +81,7 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r,
+ 	add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO);
+ 
+ 	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+-		ret = add_match(h, r, matchp->match->m);
++		ret = add_match(h, ctx, r, matchp->match->m);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index e98921856c75d..d36e06812e08d 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -25,8 +25,8 @@
+ #include "nft.h"
+ #include "nft-shared.h"
+ 
+-static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r,
+-			struct iptables_command_state *cs)
++static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
++			struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	struct xtables_rule_match *matchp;
+ 	uint32_t op;
+@@ -68,7 +68,7 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r,
+ 	add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
+ 
+ 	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+-		ret = add_match(h, r, matchp->match->m);
++		ret = add_match(h, ctx, r, matchp->match->m);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 07d39131cb0d6..9065e52f669e1 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -34,6 +34,7 @@
+ 			| FMT_NUMERIC | FMT_NOTABLE)
+ #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
+ 
++struct nft_rule_ctx;
+ struct xtables_args;
+ struct nft_handle;
+ struct xt_xlate;
+@@ -126,8 +127,8 @@ static inline struct nft_xt_ctx_reg *nft_xt_ctx_get_dreg(struct nft_xt_ctx *ctx,
+ }
+ 
+ struct nft_family_ops {
+-	int (*add)(struct nft_handle *h, struct nftnl_rule *r,
+-		   struct iptables_command_state *cs);
++	int (*add)(struct nft_handle *h, struct nft_rule_ctx *ctx,
++		   struct nftnl_rule *r, struct iptables_command_state *cs);
+ 	bool (*is_same)(const struct iptables_command_state *cs_a,
+ 			const struct iptables_command_state *cs_b);
+ 	void (*print_payload)(struct nftnl_expr *e,
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 5e4cd76b05504..8029d70a7fbae 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1141,7 +1141,8 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags)
+ #define NFT_DATATYPE_ETHERADDR	9
+ 
+ static int __add_nft_among(struct nft_handle *h, const char *table,
+-			   struct nftnl_rule *r, struct nft_among_pair *pairs,
++			   struct nft_rule_ctx *ctx, struct nftnl_rule *r,
++			   struct nft_among_pair *pairs,
+ 			   int cnt, bool dst, bool inv, bool ip)
+ {
+ 	uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN;
+@@ -1222,7 +1223,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 	return 0;
+ }
+ 
+-static int add_nft_among(struct nft_handle *h,
++static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 			 struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)m->data;
+@@ -1238,10 +1239,10 @@ static int add_nft_among(struct nft_handle *h,
+ 	}
+ 
+ 	if (data->src.cnt)
+-		__add_nft_among(h, table, r, data->pairs, data->src.cnt,
++		__add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt,
+ 				false, data->src.inv, data->src.ip);
+ 	if (data->dst.cnt)
+-		__add_nft_among(h, table, r, data->pairs + data->src.cnt,
++		__add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt,
+ 				data->dst.cnt, true, data->dst.inv,
+ 				data->dst.ip);
+ 	return 0;
+@@ -1449,22 +1450,30 @@ static int add_nft_mark(struct nft_handle *h, struct nftnl_rule *r,
+ 	return 0;
+ }
+ 
+-int add_match(struct nft_handle *h,
++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 	      struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nftnl_expr *expr;
+ 	int ret;
+ 
+-	if (!strcmp(m->u.user.name, "limit"))
+-		return add_nft_limit(r, m);
+-	else if (!strcmp(m->u.user.name, "among"))
+-		return add_nft_among(h, r, m);
+-	else if (!strcmp(m->u.user.name, "udp"))
+-		return add_nft_udp(h, r, m);
+-	else if (!strcmp(m->u.user.name, "tcp"))
+-		return add_nft_tcp(h, r, m);
+-	else if (!strcmp(m->u.user.name, "mark"))
+-		return add_nft_mark(h, r, m);
++	switch (ctx->command) {
++	case NFT_COMPAT_RULE_APPEND:
++	case NFT_COMPAT_RULE_INSERT:
++	case NFT_COMPAT_RULE_REPLACE:
++		if (!strcmp(m->u.user.name, "limit"))
++			return add_nft_limit(r, m);
++		else if (!strcmp(m->u.user.name, "among"))
++			return add_nft_among(h, ctx, r, m);
++		else if (!strcmp(m->u.user.name, "udp"))
++			return add_nft_udp(h, r, m);
++		else if (!strcmp(m->u.user.name, "tcp"))
++			return add_nft_tcp(h, r, m);
++		else if (!strcmp(m->u.user.name, "mark"))
++			return add_nft_mark(h, r, m);
++		break;
++	default:
++		break;
++	}
+ 
+ 	expr = nftnl_expr_alloc("match");
+ 	if (expr == NULL)
+@@ -1692,7 +1701,8 @@ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv)
+ }
+ 
+ struct nftnl_rule *
+-nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
++nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *ctx,
++	     const char *chain, const char *table,
+ 	     struct iptables_command_state *cs)
+ {
+ 	struct nftnl_rule *r;
+@@ -1705,7 +1715,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
+ 	nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table);
+ 	nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain);
+ 
+-	if (h->ops->add(h, r, cs) < 0)
++	if (h->ops->add(h, ctx, r, cs) < 0)
+ 		goto err;
+ 
+ 	return r;
+@@ -2865,6 +2875,9 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ {
+ 	struct iptables_command_state cs = {};
+ 	struct nftnl_rule *r, *new_rule;
++	struct nft_rule_ctx ctx = {
++		.command = NFT_COMPAT_RULE_APPEND,
++	};
+ 	struct nft_chain *c;
+ 	int ret = 0;
+ 
+@@ -2883,7 +2896,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ 
+ 	h->ops->rule_to_cs(h, r, &cs);
+ 	cs.counters.pcnt = cs.counters.bcnt = 0;
+-	new_rule = nft_rule_new(h, chain, table, &cs);
++	new_rule = nft_rule_new(h, &ctx, chain, table, &cs);
+ 	h->ops->clear_cs(&cs);
+ 
+ 	if (!new_rule)
+@@ -3261,6 +3274,9 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 		.eb.bitmask = EBT_NOPROTO,
+ 	};
+ 	struct nftnl_udata_buf *udata;
++	struct nft_rule_ctx ctx = {
++		.command	= NFT_COMPAT_RULE_APPEND,
++	};
+ 	struct nft_handle *h = data;
+ 	struct nftnl_rule *r;
+ 	const char *pname;
+@@ -3288,7 +3304,7 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 
+ 	command_jump(&cs, pname);
+ 
+-	r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
++	r = nft_rule_new(h, &ctx, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
+ 			 nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs);
+ 	ebt_cs_clean(&cs);
+ 
+diff --git a/iptables/nft.h b/iptables/nft.h
+index caff1fdeff92e..1c479fce3fc2e 100644
+--- a/iptables/nft.h
++++ b/iptables/nft.h
+@@ -171,9 +171,11 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h,
+ /*
+  * Operations with rule-set.
+  */
+-struct nftnl_rule;
++struct nft_rule_ctx {
++	int			command;
++};
+ 
+-struct nftnl_rule *nft_rule_new(struct nft_handle *h, const char *chain, const char *table, struct iptables_command_state *cs);
++struct nftnl_rule *nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *rule, const char *chain, const char *table, struct iptables_command_state *cs);
+ int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, struct nftnl_rule *ref, bool verbose);
+ int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, int rulenum, bool verbose);
+ int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, bool verbose);
+@@ -191,7 +193,8 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char *
+  */
+ int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes);
+ int add_verdict(struct nftnl_rule *r, int verdict);
+-int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match *m);
++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
++	      struct nftnl_rule *r, struct xt_entry_match *m);
+ int add_target(struct nftnl_rule *r, struct xt_entry_target *t);
+ int add_jumpto(struct nftnl_rule *r, const char *name, int verdict);
+ int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set);
+-- 
+2.41.0
+

0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch

@@ -0,0 +1,34 @@
+From 48f29413f7db0e3e889733705be368915a16a228 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 19 Jul 2023 14:58:11 +0200
+Subject: [PATCH] tests: shell: Sanitize nft-only/0009-needless-bitwise_0
+
+Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the
+non-debug ruleset listing's empty lines, causing the diff to fail. Catch
+this by exiting upon seeing the first table heading. For the sake of
+comparing bytecode, the actual ruleset listing is not interesting,
+anyway.
+
+Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2746726e03d9017d4c940a247590f8d5c5d5a73e)
+---
+ iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+index 41588a10863ec..34802cc26aad4 100755
+--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
++++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+@@ -340,7 +340,7 @@ bridge filter OUTPUT 10 9
+ # - lines with bytecode (starting with '  [')
+ # - empty lines (so printed diff is not a complete mess)
+ filter() {
+-	awk '/^(  \[|$)/{print}'
++	awk '/^table /{exit} /^(  \[|$)/{print}'
+ }
+ 
+ diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter)
+-- 
+2.41.0
+

0023-nft-Special-casing-for-among-match-in-compare_matche.patch

@@ -0,0 +1,46 @@
+From da02d12210c4be7bcc6a5c3141ef96d3c68f6e49 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 21 Jul 2023 13:14:36 +0200
+Subject: [PATCH] nft: Special casing for among match in compare_matches()
+
+When other extensions may have "garbage" appended to their data which
+should not be considered for match comparison, among match is the
+opposite in that it extends its data beyond the value in 'size' field.
+Add special casing to cover for this, avoiding false-positive rule
+comparison.
+
+Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 10583537004f7ecd4aa11f6c12b7ba73fb77fc11)
+---
+ iptables/nft-shared.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 4ba44a4aa4d17..413503ed86932 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -1505,6 +1505,7 @@ bool compare_matches(struct xtables_rule_match *mt1,
+ 	for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) {
+ 		struct xt_entry_match *m1 = mp1->match->m;
+ 		struct xt_entry_match *m2 = mp2->match->m;
++		size_t cmplen = mp1->match->userspacesize;
+ 
+ 		if (strcmp(m1->u.user.name, m2->u.user.name) != 0) {
+ 			DEBUGP("mismatching match name\n");
+@@ -1516,8 +1517,10 @@ bool compare_matches(struct xtables_rule_match *mt1,
+ 			return false;
+ 		}
+ 
+-		if (memcmp(m1->data, m2->data,
+-			   mp1->match->userspacesize) != 0) {
++		if (!strcmp(m1->u.user.name, "among"))
++			cmplen = m1->u.match_size - sizeof(*m1);
++
++		if (memcmp(m1->data, m2->data, cmplen) != 0) {
+ 			DEBUGP("mismatch match data\n");
+ 			return false;
+ 		}
+-- 
+2.41.0
+

0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch

@@ -0,0 +1,63 @@
+From 009e5643a6e6d4ee395d8956f418bbcef0f960a8 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 15 Jul 2023 01:35:39 +0200
+Subject: [PATCH] nft: Do not pass nft_rule_ctx to add_nft_among()
+
+It is not used, must be a left-over from an earlier version of the fixed
+commit.
+
+Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit bd71c11a95ab2b44794843fd8a3698039a7db211)
+---
+ iptables/nft.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 8029d70a7fbae..66b47d72e3ae8 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1141,8 +1141,7 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags)
+ #define NFT_DATATYPE_ETHERADDR	9
+ 
+ static int __add_nft_among(struct nft_handle *h, const char *table,
+-			   struct nft_rule_ctx *ctx, struct nftnl_rule *r,
+-			   struct nft_among_pair *pairs,
++			   struct nftnl_rule *r, struct nft_among_pair *pairs,
+ 			   int cnt, bool dst, bool inv, bool ip)
+ {
+ 	uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN;
+@@ -1223,7 +1222,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 	return 0;
+ }
+ 
+-static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
++static int add_nft_among(struct nft_handle *h,
+ 			 struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)m->data;
+@@ -1239,10 +1238,10 @@ static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 	}
+ 
+ 	if (data->src.cnt)
+-		__add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt,
++		__add_nft_among(h, table, r, data->pairs, data->src.cnt,
+ 				false, data->src.inv, data->src.ip);
+ 	if (data->dst.cnt)
+-		__add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt,
++		__add_nft_among(h, table, r, data->pairs + data->src.cnt,
+ 				data->dst.cnt, true, data->dst.inv,
+ 				data->dst.ip);
+ 	return 0;
+@@ -1463,7 +1462,7 @@ int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 		if (!strcmp(m->u.user.name, "limit"))
+ 			return add_nft_limit(r, m);
+ 		else if (!strcmp(m->u.user.name, "among"))
+-			return add_nft_among(h, ctx, r, m);
++			return add_nft_among(h, r, m);
+ 		else if (!strcmp(m->u.user.name, "udp"))
+ 			return add_nft_udp(h, r, m);
+ 		else if (!strcmp(m->u.user.name, "tcp"))
+-- 
+2.41.0
+

0025-tables-Reject-invalid-chain-names-when-renaming.patch

@@ -0,0 +1,31 @@
+From 2feb8fba886cb9586d6cdc1b5711cff49fe5cf5d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 21 Jul 2023 20:14:09 +0200
+Subject: [PATCH] *tables: Reject invalid chain names when renaming
+
+While given chain name was sanity checked with --new-chain command,
+--rename-chain command allowed to choose an invalid name. Keep things
+consistent by adding the missing check.
+
+Fixes: e6869a8f59d77 ("reorganized tree after kernel merge")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 344e9b260ba2bbbdd0c32f112273fd552d0b73f4)
+---
+ iptables/xshared.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index 71ee94d6f2f83..6812da501a288 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -1521,6 +1521,7 @@ void do_parse(int argc, char *argv[],
+ 					   "-%c requires old-chain-name and "
+ 					   "new-chain-name",
+ 					    cmd2char(CMD_RENAME_CHAIN));
++			assert_valid_chain_name(p->newname);
+ 			break;
+ 
+ 		case 'P':
+-- 
+2.41.0
+

0026-ebtables-Improve-invalid-chain-name-detection.patch

@@ -0,0 +1,94 @@
+From d841d7a1f438e56226cc26b2f8e8525d5aeaa5c6 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Jul 2023 13:50:11 +0200
+Subject: [PATCH] ebtables: Improve invalid chain name detection
+
+Fix several issues:
+
+- Most importantly, --new-chain command accepted any name. Introduce
+  ebt_assert_valid_chain_name() for use with both --new-chain and
+  --rename-chain.
+- Restrict maximum name length to what legacy ebtables allows - this is
+  a bit more than iptables-nft, subject to be unified.
+- Like iptables, legacy ebtables rejects names prefixed by '-' or '!'.
+- Use xs_has_arg() for consistency, keep the check for extra args for
+  now.
+
+Fixes: da871de2a6efb ("nft: bootstrap ebtables-compat")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 687d76937be799a405e63e58861f7e4a965dfa8d)
+---
+ iptables/xtables-eb.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 3a73e79725489..33f55aee32c8f 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -42,6 +42,10 @@
+ #include "nft.h"
+ #include "nft-bridge.h"
+ 
++/* from linux/netfilter_bridge/ebtables.h */
++#define EBT_TABLE_MAXNAMELEN 32
++#define EBT_CHAIN_MAXNAMELEN EBT_TABLE_MAXNAMELEN
++
+ /*
+  * From include/ebtables_u.h
+  */
+@@ -74,6 +78,26 @@ static int ebt_check_inverse2(const char option[], int argc, char **argv)
+ 	return ebt_invert;
+ }
+ 
++/* XXX: merge with assert_valid_chain_name()? */
++static void ebt_assert_valid_chain_name(const char *chainname)
++{
++	if (strlen(chainname) >= EBT_CHAIN_MAXNAMELEN)
++		xtables_error(PARAMETER_PROBLEM,
++			      "Chain name length can't exceed %d",
++			      EBT_CHAIN_MAXNAMELEN - 1);
++
++	if (*chainname == '-' || *chainname == '!')
++		xtables_error(PARAMETER_PROBLEM, "No chain name specified");
++
++	if (xtables_find_target(chainname, XTF_TRY_LOAD))
++		xtables_error(PARAMETER_PROBLEM,
++			      "Target with name %s exists", chainname);
++
++	if (strchr(chainname, ' ') != NULL)
++		xtables_error(PARAMETER_PROBLEM,
++			      "Use of ' ' not allowed in chain names");
++}
++
+ /*
+  * Glue code to use libxtables
+  */
+@@ -750,6 +774,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 			flags |= OPT_COMMAND;
+ 
+ 			if (c == 'N') {
++				ebt_assert_valid_chain_name(chain);
+ 				ret = nft_cmd_chain_user_add(h, chain, *table);
+ 				break;
+ 			} else if (c == 'X') {
+@@ -763,14 +788,12 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 			}
+ 
+ 			if (c == 'E') {
+-				if (optind >= argc)
++				if (!xs_has_arg(argc, argv))
+ 					xtables_error(PARAMETER_PROBLEM, "No new chain name specified");
+ 				else if (optind < argc - 1)
+ 					xtables_error(PARAMETER_PROBLEM, "No extra options allowed with -E");
+-				else if (strlen(argv[optind]) >= NFT_CHAIN_MAXNAMELEN)
+-					xtables_error(PARAMETER_PROBLEM, "Chain name length can't exceed %d"" characters", NFT_CHAIN_MAXNAMELEN - 1);
+-				else if (strchr(argv[optind], ' ') != NULL)
+-					xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
++
++				ebt_assert_valid_chain_name(argv[optind]);
+ 
+ 				errno = 0;
+ 				ret = nft_cmd_chain_user_rename(h, chain, *table,
+-- 
+2.41.0
+

0027-tests-shell-Fix-and-extend-chain-rename-test.patch

@@ -0,0 +1,87 @@
+From 9ca7dcde885b9dad98761273eecd3921d0064ed2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Jul 2023 13:58:46 +0200
+Subject: [PATCH] tests: shell: Fix and extend chain rename test
+
+The old version exited unintentionally before testing ip6tables. Replace
+it by a more complete variant testing for all tools, creating and
+renaming of,chains with various illegal names instead of just renaming
+to a clashing name.
+
+Fixes: ed9cfe1b48526 ("tests: add initial save/restore test cases")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 3bbf5269f25d7bc8cb6ecf2c44e6358579acc459)
+---
+ .../tests/shell/testcases/chain/0003rename_0  | 40 +++++++++++++++++++
+ .../tests/shell/testcases/chain/0003rename_1  | 12 ------
+ 2 files changed, 40 insertions(+), 12 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/chain/0003rename_0
+ delete mode 100755 iptables/tests/shell/testcases/chain/0003rename_1
+
+diff --git a/iptables/tests/shell/testcases/chain/0003rename_0 b/iptables/tests/shell/testcases/chain/0003rename_0
+new file mode 100755
+index 0000000000000..4cb2745bc2523
+--- /dev/null
++++ b/iptables/tests/shell/testcases/chain/0003rename_0
+@@ -0,0 +1,40 @@
++#!/bin/bash -x
++
++die() {
++	echo "E: $@"
++	exit 1
++}
++
++cmds="iptables ip6tables"
++[[ $XT_MULTI == *xtables-nft-multi ]] && cmds+=" arptables ebtables"
++
++declare -A invnames
++invnames["existing"]="c2"
++invnames["spaced"]="foo bar"
++invnames["dashed"]="-foo"
++invnames["negated"]="!foo"
++# XXX: ebtables-nft accepts 255 chars
++#invnames["overlong"]="thisisquitealongnameforachain"
++invnames["standard target"]="ACCEPT"
++invnames["extension target"]="DNAT"
++
++for cmd in $cmds; do
++	$XT_MULTI $cmd -N c1 || die "$cmd: can't add chain c1"
++	$XT_MULTI $cmd -N c2 || die "$cmd: can't add chain c2"
++	for key in "${!invnames[@]}"; do
++		val="${invnames[$key]}"
++		if [[ $key == "extension target" ]]; then
++			if [[ $cmd == "arptables" ]]; then
++				val="mangle"
++			elif [[ $cmd == "ebtables" ]]; then
++				val="dnat"
++			fi
++		fi
++		$XT_MULTI $cmd -N "$val" && \
++			die "$cmd: added chain with $key name"
++		$XT_MULTI $cmd -E c1 "$val" && \
++			die "$cmd: renamed to $key name"
++	done
++done
++
++exit 0
+diff --git a/iptables/tests/shell/testcases/chain/0003rename_1 b/iptables/tests/shell/testcases/chain/0003rename_1
+deleted file mode 100755
+index 975c8e196b9f5..0000000000000
+--- a/iptables/tests/shell/testcases/chain/0003rename_1
++++ /dev/null
+@@ -1,12 +0,0 @@
+-#!/bin/bash
+-
+-$XT_MULTI iptables -N c1 || exit 0
+-$XT_MULTI iptables -N c2 || exit 0
+-$XT_MULTI iptables -E c1 c2 || exit 1
+-
+-$XT_MULTI ip6tables -N c1 || exit 0
+-$XT_MULTI ip6tables -N c2 || exit 0
+-$XT_MULTI ip6tables -E c1 c2 || exit 1
+-
+-echo "E: Renamed with existing chain" >&2
+-exit 0
+-- 
+2.41.0
+

0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch

@@ -0,0 +1,52 @@
+From 2eb44e79329b713e4eb50f4816beaa6e6babe1da Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 1 Aug 2023 23:28:20 +0200
+Subject: [PATCH] extensions: libipt_icmp: Fix confusion between 255/255 and
+ any
+
+Per definition, ICMP type "any" is type 255 and the full range of codes
+(0-255). Save callback though ignored the actual code values, printing
+"any" for every type 255 match. This at least confuses users as they
+can't find their rule added as '--icmp-type 255/255' anymore.
+
+It is not entirely clear what the fixed commit was trying to establish,
+but the save output is certainly not correct (especially since print
+callback gets things right).
+
+Reported-by: Amelia Downs <adowns@vmware.com>
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1600
+Fixes: fc9237da4e845 ("Fix '-p icmp -m icmp' issue (Closes: #37)")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5b5430d627bbc227a2d51d4312c371f2015834c6)
+---
+ extensions/libipt_icmp.c | 3 ++-
+ extensions/libipt_icmp.t | 2 ++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
+index b0318aebc2c57..171b3b3949e54 100644
+--- a/extensions/libipt_icmp.c
++++ b/extensions/libipt_icmp.c
+@@ -108,7 +108,8 @@ static void icmp_save(const void *ip, const struct xt_entry_match *match)
+ 		printf(" !");
+ 
+ 	/* special hack for 'any' case */
+-	if (icmp->type == 0xFF) {
++	if (icmp->type == 0xFF &&
++	    icmp->code[0] == 0 && icmp->code[1] == 0xFF) {
+ 		printf(" --icmp-type any");
+ 	} else {
+ 		printf(" --icmp-type %u", icmp->type);
+diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t
+index f4ba65c27f032..ce4a33f9633b5 100644
+--- a/extensions/libipt_icmp.t
++++ b/extensions/libipt_icmp.t
+@@ -13,3 +13,5 @@
+ # we accept "iptables -I INPUT -p tcp -m tcp", why not this below?
+ # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp
+ # -p icmp -m icmp;=;OK
++-p icmp -m icmp --icmp-type 255/255;=;OK
++-p icmp -m icmp --icmp-type 255/0:255;-p icmp -m icmp --icmp-type any;OK
+-- 
+2.41.0
+

0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch

@@ -0,0 +1,39 @@
+From 329a8bb4d4b701b2903b182e8d8950dadbed4752 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 1 Aug 2023 23:42:24 +0200
+Subject: [PATCH] tests: libipt_icmp.t: Enable tests with numeric output
+
+Unrelated to the question whether numeric (save) output is desired or
+not, enable the tests and expect the known format.
+
+Using --list without --numeric prints the names, BTW.
+
+Fixes: 49d5b7277c7f2 ("extensions: libipt_icmp: add unit test")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 99d861c64cda5289e141b2084836663450f1eff0)
+---
+ extensions/libipt_icmp.t | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/extensions/libipt_icmp.t b/extensions/libipt_icmp.t
+index ce4a33f9633b5..4ea936217c09a 100644
+--- a/extensions/libipt_icmp.t
++++ b/extensions/libipt_icmp.t
+@@ -1,11 +1,8 @@
+ :INPUT,FORWARD,OUTPUT
+ -p icmp -m icmp --icmp-type any;=;OK
+-# output uses the number, better use the name?
+-# ERROR: cannot find: iptables -I INPUT -p icmp -m icmp --icmp-type echo-reply
+-# -p icmp -m icmp --icmp-type echo-reply;=;OK
+-# output uses the number, better use the name?
+-# ERROR: annot find: iptables -I INPUT -p icmp -m icmp --icmp-type destination-unreachable
+-# -p icmp -m icmp --icmp-type destination-unreachable;=;OK
++# XXX: output uses the number, better use the name?
++-p icmp -m icmp --icmp-type echo-reply;-p icmp -m icmp --icmp-type 0;OK
++-p icmp -m icmp --icmp-type destination-unreachable;-p icmp -m icmp --icmp-type 3;OK
+ # it does not acccept name/name, should we accept this?
+ # ERROR: cannot load: iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable
+ # -p icmp -m icmp --icmp-type destination-unreachable/network-unreachable;=;OK
+-- 
+2.41.0
+

0030-man-iptables.8-Fix-intra-page-reference.patch

@@ -0,0 +1,33 @@
+From ea90131706ccc3a806d9d0ee0bc196e64690f7e1 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 00:23:37 +0200
+Subject: [PATCH] man: iptables.8: Fix intra page reference
+
+When sections MATCH EXTENSIONS and TARGET EXTENSIONS were combined, the
+reference could have been updated to specify the exact title.
+
+Fixes: 4496801821c01 ("doc: deduplicate extension descriptions into a new manpage")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 3bda308b32847d08b2c27077fa3c02200b59cdca)
+---
+ iptables/iptables.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
+index f81c632f2be86..c336ddf6e4f95 100644
+--- a/iptables/iptables.8.in
++++ b/iptables/iptables.8.in
+@@ -307,8 +307,8 @@ false, evaluation will stop.
+ This specifies the target of the rule; i.e., what to do if the packet
+ matches it.  The target can be a user-defined chain (other than the
+ one this rule is in), one of the special builtin targets which decide
+-the fate of the packet immediately, or an extension (see \fBEXTENSIONS\fP
+-below).  If this
++the fate of the packet immediately, or an extension (see \fBMATCH AND TARGET
++EXTENSIONS\fP below).  If this
+ option is omitted in a rule (and \fB\-g\fP
+ is not used), then matching the rule will have no
+ effect on the packet's fate, but the counters on the rule will be
+-- 
+2.41.0
+

0031-man-iptables.8-Clarify-goto-description.patch

@@ -0,0 +1,32 @@
+From 4e13b0b775522b2da8951c01713c47f235af8110 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 00:28:03 +0200
+Subject: [PATCH] man: iptables.8: Clarify --goto description
+
+Text speaks about behaviour of RETURN target when used in chains
+redirected to using --goto instead of --jump, not the difference between
+--jump option and "return".
+
+Fixes: 17fc163babc34 ("add 'goto' support (Henrik Nordstrom <hno@marasystems.com>)")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 94c19939744dbbbc6ff0fedf6cdba661769fdc87)
+---
+ iptables/iptables.8.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
+index c336ddf6e4f95..2365380490d52 100644
+--- a/iptables/iptables.8.in
++++ b/iptables/iptables.8.in
+@@ -316,7 +316,7 @@ incremented.
+ .TP
+ \fB\-g\fP, \fB\-\-goto\fP \fIchain\fP
+ This specifies that the processing should continue in a user
+-specified chain. Unlike the \-\-jump option return will not continue
++specified chain. Unlike with the \-\-jump option, \fBRETURN\fP will not continue
+ processing in this chain but instead in the chain that called us via
+ \-\-jump.
+ .TP
+-- 
+2.41.0
+

0032-man-iptables-restore.8-Fix-modprobe-description.patch

@@ -0,0 +1,37 @@
+From 1a62df2225b0d087a417d04455fe1e10384837e0 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:27:11 +0200
+Subject: [PATCH] man: iptables-restore.8: Fix --modprobe description
+
+- Consistently use 'modprobe' as option argument name
+- Add a reference to modprobe man page
+- Put the path in italics, and the command in bold
+
+Fixes: 8c46901ff5785 ("doc: document iptables-restore's -M option")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 0f05f523ac02843ab7bbd09a96ba3fa384ae9523)
+---
+ iptables/iptables-restore.8.in | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index 20216842d8358..f95f00acd8d49 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -67,9 +67,10 @@ the program will exit if the lock cannot be obtained.  This option will
+ make the program wait (indefinitely or for optional \fIseconds\fP) until
+ the exclusive lock can be obtained.
+ .TP
+-\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe_program\fP
+-Specify the path to the modprobe program. By default, iptables-restore will
+-inspect /proc/sys/kernel/modprobe to determine the executable's path.
++\fB\-M\fP, \fB\-\-modprobe\fP \fImodprobe\fP
++Specify the path to the modprobe(8) program. By default,
++iptables-restore will inspect \fI/proc/sys/kernel/modprobe\fP to
++determine the executable's path.
+ .TP
+ \fB\-T\fP, \fB\-\-table\fP \fIname\fP
+ Restore only the named table even if the input stream contains other ones.
+-- 
+2.41.0
+

0033-man-iptables-restore.8-Consistently-document-w-optio.patch

@@ -0,0 +1,35 @@
+From 2b2c2310a61d17bf63845e7f70352342a072f08a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:33:26 +0200
+Subject: [PATCH] man: iptables-restore.8: Consistently document -w option
+
+Use the same name for the option's argument.
+
+Fixes: 65801d02a482b ("iptables-restore.8: document -w/-W options")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit e7bc6cc8aca993b743e83f20b2f579aed2f5d954)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index f95f00acd8d49..a63a344c0bd72 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -23,11 +23,11 @@ iptables-restore \(em Restore IP Tables
+ .P
+ ip6tables-restore \(em Restore IPv6 Tables
+ .SH SYNOPSIS
+-\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP]
++\fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .P
+-\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIsecs\fP]
++\fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .SH DESCRIPTION
+-- 
+2.41.0
+

0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch

@@ -0,0 +1,36 @@
+From 41257615e8d30c5969e3639d6ad5cd6f34f9143e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:34:51 +0200
+Subject: [PATCH] man: iptables-restore.8: Drop -W option from synopsis
+
+The description was dropped already, there is no benefit in still
+listing it.
+
+Fixes: 07e2107ef0cbc ("xshared: Implement xtables lock timeout using signals")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 193107df55541ced2e783bcce9b71b97f88a5398)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index a63a344c0bd72..bfd2fc355dd49 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -24,11 +24,11 @@ iptables-restore \(em Restore IP Tables
+ ip6tables-restore \(em Restore IPv6 Tables
+ .SH SYNOPSIS
+ \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
++[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .P
+ \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+-[\fB\-W\fP \fIusecs\fP] [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
++[\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fBfile\fP]
+ .SH DESCRIPTION
+ .PP
+-- 
+2.41.0
+

0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch

@@ -0,0 +1,35 @@
+From 97baff1f10262947c0feb6d6d14e67f1e7eb1bb0 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:37:09 +0200
+Subject: [PATCH] man: iptables-restore.8: Put 'file' in italics in synopsis
+
+The text has it this way already, be consistent.
+
+Fixes: 081d57839e91e ("iptables-restore.8: file to read from can be specified as argument")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b200f0870bc17046d6db64a1a65937ad5f263633)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index bfd2fc355dd49..ff8179091eeee 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -25,11 +25,11 @@ ip6tables-restore \(em Restore IPv6 Tables
+ .SH SYNOPSIS
+ \fBiptables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+-[\fBfile\fP]
++[\fIfile\fP]
+ .P
+ \fBip6tables\-restore\fP [\fB\-chntvV\fP] [\fB\-w\fP \fIseconds\fP]
+ [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+-[\fBfile\fP]
++[\fIfile\fP]
+ .SH DESCRIPTION
+ .PP
+ .B iptables-restore
+-- 
+2.41.0
+

0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch

@@ -0,0 +1,37 @@
+From 868d7b3a16741bfa7e0c89ee1c840e4a3e51e2b2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:40:17 +0200
+Subject: [PATCH] man: iptables-restore.8: Start paragraphs in upper-case
+
+Also add a missing full stop in one spot.
+
+Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 935a5cf8afa96daa1c688efd59b9025e3a78fba4)
+---
+ iptables/iptables-restore.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index ff8179091eeee..ce4520e626772 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -40,13 +40,13 @@ are used to restore IP and IPv6 Tables from data specified on STDIN or in
+ specify \fIfile\fP as an argument.
+ .TP
+ \fB\-c\fR, \fB\-\-counters\fR
+-restore the values of all packet and byte counters
++Restore the values of all packet and byte counters.
+ .TP
+ \fB\-h\fP, \fB\-\-help\fP
+ Print a short option summary.
+ .TP
+ \fB\-n\fR, \fB\-\-noflush\fR
+-don't flush the previous contents of the table. If not specified,
++Don't flush the previous contents of the table. If not specified,
+ both commands flush (delete) all previous contents of the respective table.
+ .TP
+ \fB\-t\fP, \fB\-\-test\fP
+-- 
+2.41.0
+

0037-man-Trivial-Missing-space-after-comma.patch

@@ -0,0 +1,42 @@
+From 1016392a3d59afcda3eae03efe87353a3706a331 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 01:48:14 +0200
+Subject: [PATCH] man: Trivial: Missing space after comma
+
+Fixes: 6a79d78986c02 ("iptables: mention iptables-apply(8) in manpages")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b0092a80656da7cf66f15ce906b17ab040ece12f)
+---
+ iptables/iptables-restore.8.in | 2 +-
+ iptables/iptables-save.8.in    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index ce4520e626772..aa816f794d6f3 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -82,7 +82,7 @@ from Rusty Russell.
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-restore.
+ .SH SEE ALSO
+-\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8)
++\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 7683fd3780f72..253907719acee 100644
+--- a/iptables/iptables-save.8.in
++++ b/iptables/iptables-save.8.in
+@@ -62,7 +62,7 @@ Rusty Russell <rusty@rustcorp.com.au>
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
+ .SH SEE ALSO
+-\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8)
++\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+-- 
+2.41.0
+

0038-man-iptables-save.8-Fix-modprobe-description.patch

@@ -0,0 +1,37 @@
+From 5e144f6fc73baafada7c34779ebaafbbd3ecf45b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 02:01:59 +0200
+Subject: [PATCH] man: iptables-save.8: Fix --modprobe description
+
+- Consistently use 'modprobe' as option argument name
+- Add a reference to modprobe man page
+- Put the path in italics and the command in bold
+
+Fixes: fbb5639c02218 ("iptables-save: module loading corrections")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit f1fd95ccefe483f0e3f2da593c6d4b671a7de522)
+---
+ iptables/iptables-save.8.in | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 253907719acee..4a2c90c2f5956 100644
+--- a/iptables/iptables-save.8.in
++++ b/iptables/iptables-save.8.in
+@@ -36,9 +36,10 @@ and
+ are used to dump the contents of IP or IPv6 Table in easily parseable format
+ either to STDOUT or to a specified file.
+ .TP
+-\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe_program\fP
+-Specify the path to the modprobe program. By default, iptables-save will
+-inspect /proc/sys/kernel/modprobe to determine the executable's path.
++\fB\-M\fR, \fB\-\-modprobe\fR \fImodprobe\fP
++Specify the path to the modprobe(8) program. By default,
++iptables-save will inspect \fI/proc/sys/kernel/modprobe\fP to determine
++the executable's path.
+ .TP
+ \fB\-f\fR, \fB\-\-file\fR \fIfilename\fP
+ Specify a filename to log the output to. If not specified, iptables-save
+-- 
+2.41.0
+

0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch

@@ -0,0 +1,34 @@
+From 13aa85e1a27f50f91d6cfe521cca55cf37f4ac48 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Aug 2023 02:06:00 +0200
+Subject: [PATCH] man: iptables-save.8: Start paragraphs in upper-case
+
+Also add a missing full stop.
+
+Fixes: 117341ada43dd ("Added iptbles-restore and iptables-save manpages")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 952186aa0342f6bf3c4614a609525338d057d8d9)
+---
+ iptables/iptables-save.8.in | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 4a2c90c2f5956..7c0d2552e8b97 100644
+--- a/iptables/iptables-save.8.in
++++ b/iptables/iptables-save.8.in
+@@ -46,10 +46,10 @@ Specify a filename to log the output to. If not specified, iptables-save
+ will log to STDOUT.
+ .TP
+ \fB\-c\fR, \fB\-\-counters\fR
+-include the current values of all packet and byte counters in the output
++Include the current values of all packet and byte counters in the output.
+ .TP
+ \fB\-t\fR, \fB\-\-table\fR \fItablename\fP
+-restrict output to only one table. If the kernel is configured with automatic
++Restrict output to only one table. If the kernel is configured with automatic
+ module loading, an attempt will be made to load the appropriate module for
+ that table if it is not already there.
+ .br
+-- 
+2.41.0
+

0040-tests-iptables-test-Fix-command-segfault-reports.patch

@@ -0,0 +1,52 @@
+From 9b0b0db6aa82c8433002880f73a7614bb453320d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 26 Jul 2023 19:43:20 +0200
+Subject: [PATCH] tests: iptables-test: Fix command segfault reports
+
+Logging produced a stack trace due to undefined variable 'cmd'.
+
+Fixes: 0e80cfea3762b ("tests: iptables-test: Implement fast test mode")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5412ccba55b2318160d32efec3b8aad162608af9)
+---
+ iptables-test.py | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index de1e1e95fda55..065c322a173ca 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -136,7 +136,7 @@ STDERR_IS_TTY = sys.stderr.isatty()
+     # check for segfaults
+     #
+     if proc.returncode == -11:
+-        reason = "iptables-save segfaults: " + cmd
++        reason = command + " segfaults!"
+         print_error(reason, filename, lineno)
+         delete_rule(iptables, rule, filename, lineno, netns)
+         return -1
+@@ -333,8 +333,11 @@ STDERR_IS_TTY = sys.stderr.isatty()
+     out, err = proc.communicate(input = restore_data)
+ 
+     if proc.returncode == -11:
+-        reason = iptables + "-restore segfaults: " + cmd
++        reason = iptables + "-restore segfaults!"
+         print_error(reason, filename, lineno)
++        msg = [iptables + "-restore segfault from:"]
++        msg.extend(["input: " + l for l in restore_data.split("\n")])
++        print("\n".join(msg), file=log_file)
+         return -1
+ 
+     if proc.returncode != 0:
+@@ -355,7 +358,7 @@ STDERR_IS_TTY = sys.stderr.isatty()
+     out, err = proc.communicate()
+ 
+     if proc.returncode == -11:
+-        reason = iptables + "-save segfaults: " + cmd
++        reason = iptables + "-save segfaults!"
+         print_error(reason, filename, lineno)
+         return -1
+ 
+-- 
+2.41.0
+

0041-nft-Create-builtin-chains-with-counters-enabled.patch

@@ -0,0 +1,63 @@
+From 85746b658b9eedafd5523b5501ce0f8b5f5bdcbf Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 10 Aug 2023 11:30:59 +0200
+Subject: [PATCH] nft: Create builtin chains with counters enabled
+
+The kernel enables policy counters for nftables chains only if
+NFTA_CHAIN_COUNTERS attribute is present. For this to be generated, one
+has to set NFTNL_CHAIN_PACKETS and NFTNL_CHAIN_BYTES attributes in the
+allocated nftnl_chain object.
+
+The above happened for base chains only with iptables-nft-restore if
+called with --counters flag. Since this is very unintuitive to users,
+fix the situation by adding counters to base chains in any case.
+
+Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 39a067bb3b1b4ffb50a925f66e7db56658c0dfa7)
+---
+ iptables/nft.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 66b47d72e3ae8..2b5a27922a06e 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -686,6 +686,9 @@ nft_chain_builtin_alloc(int family, const char *tname,
+ 
+ 	nftnl_chain_set_str(c, NFTNL_CHAIN_TYPE, chain->type);
+ 
++	nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
++	nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
++
+ 	return c;
+ }
+ 
+@@ -946,6 +949,7 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h,
+ 				       int policy,
+ 				       const struct xt_counters *counters)
+ {
++	static const struct xt_counters zero = {};
+ 	struct nftnl_chain *c;
+ 	const struct builtin_table *_t;
+ 	const struct builtin_chain *_c;
+@@ -970,12 +974,10 @@ static struct nftnl_chain *nft_chain_new(struct nft_handle *h,
+ 		return NULL;
+ 	}
+ 
+-	if (counters) {
+-		nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES,
+-					counters->bcnt);
+-		nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS,
+-					counters->pcnt);
+-	}
++	if (!counters)
++		counters = &zero;
++	nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, counters->bcnt);
++	nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, counters->pcnt);
+ 
+ 	return c;
+ }
+-- 
+2.41.0
+

0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch

@@ -0,0 +1,37 @@
+From 4cec9d5fec5c5bcc51b84e3ed9ba9619fe8b2909 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 3 Aug 2023 17:59:03 +0200
+Subject: [PATCH] Revert "libiptc: fix wrong maptype of base chain counters on
+ restore"
+
+This reverts commit 7c4d668c9c2ee007c82063b7fc784cbbf46b2ec4.
+
+The change can't be right: A simple rule append call will reset all
+built-in chains' counters. The old code works fine even given the
+mentioned "empty restore" use-case, at least if counters don't change on
+the fly in-kernel.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=912
+Fixes: 7c4d668c9c2ee ("libiptc: fix wrong maptype of base chain counters on restore")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 43f78733059ecd28d8567d8205cab5ed62d93458)
+---
+ libiptc/libiptc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c
+index f9b7779efdba5..29ff356f2324e 100644
+--- a/libiptc/libiptc.c
++++ b/libiptc/libiptc.c
+@@ -822,7 +822,7 @@ static int __iptcc_p_del_policy(struct xtc_handle *h, unsigned int num)
+ 
+ 		/* save counter and counter_map information */
+ 		h->chain_iterator_cur->counter_map.maptype =
+-						COUNTER_MAP_ZEROED;
++						COUNTER_MAP_NORMAL_MAP;
+ 		h->chain_iterator_cur->counter_map.mappos = num-1;
+ 		memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters,
+ 			sizeof(h->chain_iterator_cur->counters));
+-- 
+2.41.0
+

0043-doc-fix-example-of-xt_cpu.patch

@@ -0,0 +1,35 @@
+From 12e7024d3e8d245bb5645167f3aeb4c0187f75fd Mon Sep 17 00:00:00 2001
+From: Victor Julien <victor@inliniac.net>
+Date: Tue, 29 Aug 2023 14:59:32 +0200
+Subject: [PATCH] doc: fix example of xt_cpu
+
+REDIRECT uses --to-ports instead of --to-port.
+
+Fixes: 2d59208943a3 ("extension: add xt_cpu match")
+
+Signed-off-by: Victor Julien <victor@inliniac.net>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit 63e4a64e943be64a7e0486838071b981074e696d)
+---
+ extensions/libxt_cpu.man | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/extensions/libxt_cpu.man b/extensions/libxt_cpu.man
+index d9ea5c2faa20b..c89ef08afbfbb 100644
+--- a/extensions/libxt_cpu.man
++++ b/extensions/libxt_cpu.man
+@@ -7,9 +7,9 @@ multiqueue NICs to spread network traffic on different queues.
+ Example:
+ .PP
+ iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 0 
+-\-j REDIRECT \-\-to\-port 8080
++\-j REDIRECT \-\-to\-ports 8080
+ .PP
+ iptables \-t nat \-A PREROUTING \-p tcp \-\-dport 80 \-m cpu \-\-cpu 1 
+-\-j REDIRECT \-\-to\-port 8081
++\-j REDIRECT \-\-to\-ports 8081
+ .PP
+ Available since Linux 2.6.36.
+-- 
+2.41.0
+

0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch

@@ -0,0 +1,92 @@
+From 16822c25bf795b54b13ada62da762ee7e9c2b12f Mon Sep 17 00:00:00 2001
+From: Quentin Armitage <quentin@armitage.org.uk>
+Date: Sat, 23 Nov 2013 08:41:58 +0000
+Subject: [PATCH] extensions: Fix checking of conntrack --ctproto 0
+
+There are three issues in the code:
+1) the check (sinfo->invflags & XT_INV_PROTO) is using the wrong mask
+2) in conntrack_mt_parse it is testing (info->invert_flags &
+   XT_INV_PROTO) before the invert bit has been set.
+3) the sense of the error message is the wrong way round
+
+1) To get the error, ! -ctstatus XXX has to be specified, since
+   XT_INV_PROTO == XT_CONNTRACK_STATUS e.g.
+   | iptables -I CHAIN -m conntrack ! --ctstatus ASSURED --ctproto 0 ...
+
+3) Unlike --proto 0 (where 0 means all protocols), in the conntrack
+   match --ctproto 0 appears to mean protocol 0, which can never be.
+   Therefore --ctproto 0 could never match and ! --ctproto 0 will always
+   match. Both of these should be rejected, since the user clearly
+   cannot be intending what was specified.
+
+The attached patch resolves the issue, and also produces an error
+message if --ctproto 0 is specified (as well as ! --ctproto 0 ), since
+--ctproto 0 will never match, and ! --ctproto 0 will always match.
+
+[Phil: - Added Fixes: tag - it's a day 1 bug
+       - Copied patch description from Bugzilla
+       - Reorganized changes to reduce diff
+       - Added test cases]
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=874
+Fixes: 5054e85be3068 ("general conntrack match module userspace support files")
+Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2e704f6ddd6d056e360f3d9c11e8b6c56a20cf23)
+---
+ extensions/libxt_conntrack.c | 17 ++++++++---------
+ extensions/libxt_conntrack.t |  2 ++
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
+index 09548c297695f..ffbc7467bbf2e 100644
+--- a/extensions/libxt_conntrack.c
++++ b/extensions/libxt_conntrack.c
+@@ -346,14 +346,13 @@ static void conntrack_parse(struct xt_option_call *cb)
+ 			sinfo->invflags |= XT_CONNTRACK_STATE;
+ 		break;
+ 	case O_CTPROTO:
++		if (cb->val.protocol == 0)
++			xtables_error(PARAMETER_PROBLEM, cb->invert ?
++				      "condition would always match protocol" :
++				      "rule would never match protocol");
+ 		sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum = cb->val.protocol;
+ 		if (cb->invert)
+ 			sinfo->invflags |= XT_CONNTRACK_PROTO;
+-		if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0
+-		    && (sinfo->invflags & XT_INV_PROTO))
+-			xtables_error(PARAMETER_PROBLEM,
+-				   "rule would never match protocol");
+-
+ 		sinfo->flags |= XT_CONNTRACK_PROTO;
+ 		break;
+ 	case O_CTORIGSRC:
+@@ -411,11 +410,11 @@ static void conntrack_mt_parse(struct xt_option_call *cb, uint8_t rev)
+ 			info->invert_flags |= XT_CONNTRACK_STATE;
+ 		break;
+ 	case O_CTPROTO:
++		if (cb->val.protocol == 0)
++			xtables_error(PARAMETER_PROBLEM, cb->invert ?
++				      "conntrack: condition would always match protocol" :
++				      "conntrack: rule would never match protocol");
+ 		info->l4proto = cb->val.protocol;
+-		if (info->l4proto == 0 && (info->invert_flags & XT_INV_PROTO))
+-			xtables_error(PARAMETER_PROBLEM, "conntrack: rule would "
+-			           "never match protocol");
+-
+ 		info->match_flags |= XT_CONNTRACK_PROTO;
+ 		if (cb->invert)
+ 			info->invert_flags |= XT_CONNTRACK_PROTO;
+diff --git a/extensions/libxt_conntrack.t b/extensions/libxt_conntrack.t
+index db53147532afd..2b3c5de9cd3ab 100644
+--- a/extensions/libxt_conntrack.t
++++ b/extensions/libxt_conntrack.t
+@@ -25,3 +25,5 @@
+ -m conntrack --ctstatus EXPECTED;=;OK
+ -m conntrack --ctstatus SEEN_REPLY;=;OK
+ -m conntrack;;FAIL
++-m conntrack --ctproto 0;;FAIL
++-m conntrack ! --ctproto 0;;FAIL
+-- 
+2.41.0
+

0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch

@@ -0,0 +1,44 @@
+From 73f49fada3a73b321a0c01fc3014d7617180f1ed Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 1 Sep 2023 13:16:56 +0200
+Subject: [PATCH] tests: shell: Fix for ineffective 0007-mid-restore-flush_0
+
+The test did not catch non-zero exit status of the spawned coprocess. To
+make it happen, Drop the line killing it (it will exit anyway) and pass
+its PID to 'wait'.
+
+While being at it, put the sleep into the correct spot (otherwise the
+check for chain 'foo' existence fails as it runs too early) and make
+said chain existence check effective.
+
+Fixes: 4e3c11a6f5a94 ("nft: Fix for ruleset flush while restoring")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ea12b1d2b191f100a6fdb83af4681364e4dba12a)
+---
+ .../shell/testcases/nft-only/0007-mid-restore-flush_0  | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0 b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
+index 43880ffbc5851..981f007f205b9 100755
+--- a/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
++++ b/iptables/tests/shell/testcases/nft-only/0007-mid-restore-flush_0
+@@ -13,11 +13,11 @@ COMMIT
+ :foo [0:0]
+ EOF
+ 
+-$XT_MULTI iptables-save | grep -q ':foo'
++sleep 1
++$XT_MULTI iptables-save | grep -q ':foo' || exit 1
+ nft flush ruleset
+ 
+ echo "COMMIT" >&"${COPROC[1]}"
+-sleep 1
+-
+-[[ -n $COPROC_PID ]] && kill $COPROC_PID
+-wait
++# close the pipe to make iptables-restore exit if it didn't error out yet
++eval "exec ${COPROC[1]}>&-"
++wait $COPROC_PID
+-- 
+2.41.0
+

0046-nft-Fix-for-useless-meta-expressions-in-rule.patch

@@ -0,0 +1,277 @@
+From fea09f9273e279d0a18a9db368546897fe3b2edd Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 6 Sep 2023 16:32:47 +0200
+Subject: [PATCH] nft: Fix for useless meta expressions in rule
+
+A relict of legacy iptables' mandatory matching on interfaces and IP
+addresses is support for the '-i +' notation, basically a "match any
+input interface". Trying to make things better than its predecessor,
+iptables-nft boldly optimizes that nop away - not entirely though, the
+meta expression loading the interface name was left in place. While not
+a problem (apart from pointless overhead) in current HEAD, v1.8.7 would
+trip over this as a following cmp expression (for another match) was
+incorrectly linked to that stale meta expression, loading strange values
+into the respective interface name field.
+
+While being at it, merge and generalize the functions into a common one
+for use with ebtables' NFT_META_BRI_(I|O)IFNAME matches, too.
+
+Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1702
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 52ed0ac516db9f3a44f61dfd8b65d20631bfa95b)
+---
+ extensions/libebt_standard.t  |  4 ++++
+ extensions/libip6t_standard.t |  3 +++
+ extensions/libxt_standard.t   |  2 ++
+ iptables/nft-arp.c            |  4 ++--
+ iptables/nft-bridge.c         | 38 ++++-------------------------
+ iptables/nft-ipv4.c           |  4 ++--
+ iptables/nft-ipv6.c           |  4 ++--
+ iptables/nft-shared.c         | 45 ++++++++++++-----------------------
+ iptables/nft-shared.h         |  4 ++--
+ 9 files changed, 36 insertions(+), 72 deletions(-)
+
+diff --git a/extensions/libebt_standard.t b/extensions/libebt_standard.t
+index 97cb3baaf6d21..370a12f4a2cec 100644
+--- a/extensions/libebt_standard.t
++++ b/extensions/libebt_standard.t
+@@ -14,6 +14,10 @@
+ -o foobar;=;FAIL
+ --logical-in br0;=;OK
+ --logical-out br1;=;FAIL
++-i + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK
++-i + -p ip;-p IPv4;OK
++--logical-in + -d 00:0f:ee:d0:ba:be;-d 00:0f:ee:d0:ba:be;OK
++--logical-in + -p ip;-p IPv4;OK
+ :FORWARD
+ -i foobar;=;OK
+ -o foobar;=;OK
+diff --git a/extensions/libip6t_standard.t b/extensions/libip6t_standard.t
+index a528af10ea152..0c559cc5021f6 100644
+--- a/extensions/libip6t_standard.t
++++ b/extensions/libip6t_standard.t
+@@ -3,3 +3,6 @@
+ ! -d ::;! -d ::/128;OK
+ ! -s ::;! -s ::/128;OK
+ -s ::/64;=;OK
++:INPUT
++-i + -d c0::fe;-d c0::fe/128;OK
++-i + -p tcp;-p tcp;OK
+diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t
+index 6ed978e442b80..7c83cfa3ba232 100644
+--- a/extensions/libxt_standard.t
++++ b/extensions/libxt_standard.t
+@@ -24,3 +24,5 @@
+ :FORWARD
+ --protocol=tcp --source=1.2.3.4 --destination=5.6.7.8/32 --in-interface=eth0 --out-interface=eth1 --jump=ACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK
+ -ptcp -s1.2.3.4 -d5.6.7.8/32 -ieth0 -oeth1 -jACCEPT;-s 1.2.3.4/32 -d 5.6.7.8/32 -i eth0 -o eth1 -p tcp -j ACCEPT;OK
++-i + -d 1.2.3.4;-d 1.2.3.4/32;OK
++-i + -p tcp;-p tcp;OK
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 889387e4db592..54cddbc5f07cc 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -49,12 +49,12 @@ static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (fw->arp.iniface[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN);
+-		add_iniface(h, r, fw->arp.iniface, op);
++		add_iface(h, r, fw->arp.iniface, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (fw->arp.outiface[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT);
+-		add_outiface(h, r, fw->arp.outiface, op);
++		add_iface(h, r, fw->arp.outiface, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (fw->arp.arhrd != 0 ||
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index a41f411fbba14..9e349813ee5b3 100644
+--- a/iptables/nft-bridge.c
++++ b/iptables/nft-bridge.c
+@@ -65,36 +65,6 @@ static void ebt_print_mac_and_mask(const unsigned char *mac, const unsigned char
+ 		xtables_print_mac_and_mask(mac, mask);
+ }
+ 
+-static void add_logical_iniface(struct nft_handle *h, struct nftnl_rule *r,
+-				char *iface, uint32_t op)
+-{
+-	int iface_len;
+-	uint8_t reg;
+-
+-	iface_len = strlen(iface);
+-
+-	add_meta(h, r, NFT_META_BRI_IIFNAME, &reg);
+-	if (iface[iface_len - 1] == '+')
+-		add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-	else
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+-}
+-
+-static void add_logical_outiface(struct nft_handle *h, struct nftnl_rule *r,
+-				 char *iface, uint32_t op)
+-{
+-	int iface_len;
+-	uint8_t reg;
+-
+-	iface_len = strlen(iface);
+-
+-	add_meta(h, r, NFT_META_BRI_OIFNAME, &reg);
+-	if (iface[iface_len - 1] == '+')
+-		add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-	else
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+-}
+-
+ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
+ {
+ 	return add_action(r, cs, false);
+@@ -130,22 +100,22 @@ static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (fw->in[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_IIN);
+-		add_iniface(h, r, fw->in, op);
++		add_iface(h, r, fw->in, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (fw->out[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_IOUT);
+-		add_outiface(h, r, fw->out, op);
++		add_iface(h, r, fw->out, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (fw->logical_in[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALIN);
+-		add_logical_iniface(h, r, fw->logical_in, op);
++		add_iface(h, r, fw->logical_in, NFT_META_BRI_IIFNAME, op);
+ 	}
+ 
+ 	if (fw->logical_out[0] != '\0') {
+ 		op = nft_invflags2cmp(fw->invflags, EBT_ILOGICALOUT);
+-		add_logical_outiface(h, r, fw->logical_out, op);
++		add_iface(h, r, fw->logical_out, NFT_META_BRI_OIFNAME, op);
+ 	}
+ 
+ 	if (fw->bitmask & EBT_ISOURCE) {
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index fb62103fd38d7..8449407bd40ed 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -35,12 +35,12 @@ static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (cs->fw.ip.iniface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN);
+-		add_iniface(h, r, cs->fw.ip.iniface, op);
++		add_iface(h, r, cs->fw.ip.iniface, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw.ip.outiface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_OUT);
+-		add_outiface(h, r, cs->fw.ip.outiface, op);
++		add_iface(h, r, cs->fw.ip.outiface, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw.ip.proto != 0) {
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index d36e06812e08d..443815da77acf 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -34,12 +34,12 @@ static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 
+ 	if (cs->fw6.ipv6.iniface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_IN);
+-		add_iniface(h, r, cs->fw6.ipv6.iniface, op);
++		add_iface(h, r, cs->fw6.ipv6.iniface, NFT_META_IIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw6.ipv6.outiface[0] != '\0') {
+ 		op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_VIA_OUT);
+-		add_outiface(h, r, cs->fw6.ipv6.outiface, op);
++		add_iface(h, r, cs->fw6.ipv6.outiface, NFT_META_OIFNAME, op);
+ 	}
+ 
+ 	if (cs->fw6.ipv6.proto != 0) {
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 413503ed86932..a23a2c8a8fa11 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -155,44 +155,29 @@ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg)
+ 	add_cmp_ptr(r, op, &val, sizeof(val), sreg);
+ }
+ 
+-void add_iniface(struct nft_handle *h, struct nftnl_rule *r,
+-		 char *iface, uint32_t op)
++void add_iface(struct nft_handle *h, struct nftnl_rule *r,
++	       char *iface, uint32_t key, uint32_t op)
+ {
+-	int iface_len;
++	int iface_len = strlen(iface);
+ 	uint8_t reg;
+ 
+-	iface_len = strlen(iface);
+ 
+-	add_meta(h, r, NFT_META_IIFNAME, &reg);
+ 	if (iface[iface_len - 1] == '+') {
+-		if (iface_len > 1)
+-			add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-		else if (op != NFT_CMP_EQ)
+-			add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D",
+-				    strlen("INVAL/D") + 1, reg);
++		if (iface_len > 1) {
++			iface_len -= 1;
++		} else if (op != NFT_CMP_EQ) {
++			op = NFT_CMP_EQ;
++			iface = "INVAL/D";
++			iface_len = strlen(iface) + 1;
++		} else {
++			return; /* -o + */
++		}
+ 	} else {
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
++		iface_len += 1;
+ 	}
+-}
+-
+-void add_outiface(struct nft_handle *h, struct nftnl_rule *r,
+-		  char *iface, uint32_t op)
+-{
+-	int iface_len;
+-	uint8_t reg;
+ 
+-	iface_len = strlen(iface);
+-
+-	add_meta(h, r, NFT_META_OIFNAME, &reg);
+-	if (iface[iface_len - 1] == '+') {
+-		if (iface_len > 1)
+-			add_cmp_ptr(r, op, iface, iface_len - 1, reg);
+-		else if (op != NFT_CMP_EQ)
+-			add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D",
+-				    strlen("INVAL/D") + 1, reg);
+-	} else {
+-		add_cmp_ptr(r, op, iface, iface_len + 1, reg);
+-	}
++	add_meta(h, r, key, &reg);
++	add_cmp_ptr(r, op, iface, iface_len, reg);
+ }
+ 
+ void add_addr(struct nft_handle *h, struct nftnl_rule *r,
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 9065e52f669e1..94cc295436a27 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -193,8 +193,8 @@ void add_cmp_ptr(struct nftnl_rule *r, uint32_t op, void *data, size_t len, uint
+ void add_cmp_u8(struct nftnl_rule *r, uint8_t val, uint32_t op, uint8_t sreg);
+ void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op, uint8_t sreg);
+ void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op, uint8_t sreg);
+-void add_iniface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op);
+-void add_outiface(struct nft_handle *h, struct nftnl_rule *r, char *iface, uint32_t op);
++void add_iface(struct nft_handle *h, struct nftnl_rule *r,
++	       char *iface, uint32_t key, uint32_t op);
+ void add_addr(struct nft_handle *h, struct nftnl_rule *r, enum nft_payload_bases base, int offset,
+ 	      void *data, void *mask, size_t len, uint32_t op);
+ void add_proto(struct nft_handle *h, struct nftnl_rule *r, int offset, size_t len,
+-- 
+2.41.0
+

arptables.service

@@ -1,12 +0,0 @@
-[Unit]
-Description=Automates a packet filtering firewall with arptables
-After=network.target
-
-[Service]
-Type=oneshot
-ExecStart=/usr/libexec/arptables-helper start
-ExecStop=/usr/libexec/arptables-helper stop
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target

coreteam-gpg-key-0xD70D1A666ACF2B21.txt

@@ -1,64 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGcLlIQBEADH+pWx2d5XgY2JCOHTVaOpbNlNfp1k9Ul0W5zaZ7EFHIGSj06E
-o3+OM0eI6+d51PnqwRE+WbV4T3ooGnfgXN4fmKgq2TwkxlhKeFSzNGMuzzuoEwD+
-2cvSF9VIrwif1o9oa9KMNfKTY/qjuWZS0QWZ08thPAf/tWpoaA3gaqYQUshj5G3w
-nTMdYlHUj7wkZCMg63tDygAe/7fDT3zurKCMbFoyiyQkp7V1SLxZpvuyuyPH6HtQ
-P5xcbXsp5ots0BgN+BplMX89DrspxJXqi7AsTf4QnC78KbchMJJxLKZQS759dQHF
-qHUTb3YdlxXFou6Si5LiBzvmqBRFj6m/WV1a8mDy5fPDkOLoTCUFHLmgvYHPJdtK
-5EqNkwYAbSnZKe9aSeVa4XhaZqyyQb9vIsKyOnwdJ/l222J95qHQapZSLcRdqgQz
-ZgxuEdOHacEaJ1IJ21CE8EtJfFA5DMZtkZNIGF3OFlXhw7YxJoPgsodtlVspQsfX
-u2FGP9yg0fd4zLgHnotKqfJQ9ZjMB6bbJUd6Au9jv0SiM+kVGeVfyaaX7TDeQ3TT
-/e44uFvkHkbYFQPcqsTalxtre6v7pMG2iu2mbkhQOC7qbL5MKMSdA93w/lF7w20b
-cwyDavEoKk9vgDjSkVjaffvdy4cESa5JY4lM4ZmzoujnAZMwbzQeGcBtqQARAQAB
-tCxOZXRmaWx0ZXIgQ29yZSBUZWFtIDxjb3JldGVhbUBuZXRmaWx0ZXIub3JnPokC
-VAQTAQoAPhYhBIxfcUahdXpl4kIqlNcNGmZqzyshBQJnC5SEAhsDBQkHhM4ABQsJ
-CAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJENcNGmZqzyshRE4P/AknD3DAWuCT7x7L
-LFIUCkfl7WUou9zMQKy62JRK/+/lNyG1dkmvBu7XWLl/+IRv1uIb25I4xwaze6GF
-8yhZDNXZLhUjComr864fMEdKNdXInAClLRNY0InkFmHw/SizvwDld4PgsLzoS+qL
-5JY4FBlYEnd4wlIwH/w3gPycmdmQNVOjeWJhDrYKGLnjolpGRQPYRME4kjasWPbK
-AWG/lpINQEB1DgtK8e6kcbUA8wSU6MMEsJjPY0o7lr9NvPfRpPXq34LjoFUXk3Hi
-Bt8OuVVMo+wTmlZWkXdknFKS4IPVxUA53oJOVMFW8divmF/l676KBogSnczoX4vR
-VW8sgDEKqb0NicKWJ2Fou+/KueY5OXsO8aZrZtXOsXIAMberdrNDYhyTUSYF8mZF
-RdL6Jcm5GbQB/zOQElgzMwPQq5AD7SkziMzGOusWjqGmu9qphed/FimVbyRhMl5B
-uDvGHthhy1KlPkqVcddN6i3/Kd/AMqXAuWMZH9FXJkUUWe+VAyeNHfEuBtSK2rqE
-zf8TYGg5Gz+oNspWuqEyWUwoH7eQkRx2GIbwu2rwcIzrh8L0rsyu+6FNNHnQfnNq
-ytbE888dxKkXeJ5T09Pp/hPwkNM8X8ZLcTTsAknrvqLNp2As49dP6iJwysfYLf/v
-3Cyvz23JNeSQiTcC4YfKLs4LtCFkiQIzBBABCgAdFiEEN9lkrMBJgcdVAPub1V2X
-iooUIOQFAmcLlJ0ACgkQ1V2XiooUIOQGJRAAsz/jYoNkSAhzvrY1t/5kSaa3Hyqi
-wpaJNIb6YCNT9JFlEvfsIlikjK28I+LNqVrWoLZyX1np8h0AGfNUPo/rLzVXzqZ/
-UHZi5AjzXM6BVnR84LahFVVLISBtjt3DvY4xvl8cIh03ShJe/yAKIXZUbxXevtnj
-M0/5bLaLjlVf3KldR+gFjUaTT1nxfkQnzxbk2yKe+1tuQzFsYPLG9Elzyagb4QYm
-97CTxim3QcO0qWweoeusBqCkh7qD/ght76JrSnzq859XS//2jaq3A5ZsX5UJk5/E
-FkzL4zersQZwQE10BByBBJbxC8DzMuGeV+eTVVHKU81cEnzZFxfyOtQBD+oHBauW
-IC/v509TiH4qhZshJwcznsDZK1xAxxm3mryVtHbfSDSqzc5r/kNQt9mijD6wdsRb
-0yQy1P2xkk1zyvOw3BRI2NVXq6+642cp21tjsY136JT/3a6KwIlIIdzIUqejbLoF
-GgGZPJiQXthfmLpDgvduD6YgaSHyhtJesX3SIGvYBdCGT69blrB7lHazYRE/xKNu
-bhnVzsaWlOXg52ChAMzsAAi5DV1669xUqRgj7zJHUq72bItZWdAvDSTIrQB4z7u8
-QW+XZsveWM2sKjzpLZjQaxdS7dFvGepYY5liA01w7Bx2lU75ejgaWrm/hlaT//RD
-Al9IQzw14mOtm0e5Ag0EZwuUhAEQANmO+fv67llu3nOZh9mcTbKa0MTT6cNjpEVU
-3MDImbN7pKTc/P+s6TVYBYn1q1U0XTXQlfh2HGdrLebAOdWW0Wcz4Kj9oOlRHOAR
-yq3mRzb9hiCB89mJcw5xNIn83d5L/IJqONSaVLKnTwfwnTVaCJYuF5yIqDMOSXgS
-C3sbGLx/yEchAhQEWUG8nm9WTybFfq98mFrHEKRGsSgfCHq6KMNn9NuhW149ZK+K
-klPXZqFyDoRHdyivt9j9hfA0lr4t6sfXEfJedzjNO2f0Z8r2sQhmw3ykYDkzEF8I
-zkgiik1Ke4+TmpD/4uL/hfgbkoVxZV6gI3M9rqs5o1glAuSFjsrGyog1EkUXplST
-Qn4ea/vQ6t1iBkTb2r3qzhK+VL7GWlvZa9DGq8btNAiOjKKqa0+3zRTXyPJAdMQM
-X+FBAhmaHJoylArEHdzv5haB7rv0aGjKV4O1ifonSGE2pllmSDbTO3exIeslLgDh
-5GqVmQW30K5JvecKnb871c0utzRLHBF34HOYgRWBcl18DGD+SzXKj1//+4AatcAB
-woNJHTEh6N3/mD3fJyWkyMwLJzo1x43Pmm1DkzioO9VMSxG7ReaH9WRDty3R83gT
-njEI0CDkG7m0nXctrsDcmBCYMSnvriWVr7kNYQ9tSi9WUa8Cs0xCmy49fF+7ihIl
-yANR2aMrABEBAAGJAjwEGAEKACYWIQSMX3FGoXV6ZeJCKpTXDRpmas8rIQUCZwuU
-hAIbDAUJB4TOAAAKCRDXDRpmas8rIZPuD/4qYhAdmCtaicOjeuMI0EhKA0O0cnXv
-BRwKXKGISZ6bt/f5fify78NQ4VdQzcpsRk1VvaEHRF5H+qxCQJ8MdzKcYpolCphj
-ir1gE+zNP7gtzH4HOBzz3/q6GK5HmqwWth3X35ySrgrhnUZZX+plm9gRIRIqmijh
-hdDp/3/2FcskQzr9UvIQDB14TbbSVAsDx5cQUM5F1nS1AAJNSrebuEcBeeM0N1HP
-tqWmcJuAHtTlk+K5yk02cgbP9926vlty1uI46UyI4t/xOxmIY6gXlcSMbBnVmB0s
-E+sKJTE7QrDpRRNiseCNLZcr/TNp9lrFpaUXz/JwXc+c1VC8UmARk9NLHsfoGz5H
-fvhiUwl96wtvu1YKIev9nfVp1bb3/XeNAVJd+hNxOlkv68s3feutvv7vQR14E8cv
-CVTXK7aAZKkWJl2n8pPohsXs5vwrsG36oFSH98jehLtzLrpgtWj6N7U8SWhI9JlT
-EaIpEL/C1foVJeSZs8Tq1sqYaw81lovDFk8wuS1eFhWeEVodJQsfCPBgsQGZ46oZ
-gWz3AU3KrB4ruNxjkJJxfgKu39pHDrv3o5ZufAHoIAHRdPTPlcH1Wi/1LLgLqHVC
-9+i7N1ClsO1/VgtYmZwzxWxsEJOcE2+vOROoVzgMh5lGhCLh6/3VTL96hIjcMp4W
-oD8ElPP+m/v6iA==
-=70vD
------END PGP PUBLIC KEY BLOCK-----

ebtables-config

@@ -1,11 +0,0 @@
-# Save current firewall rules on stop.
-#   Value: yes|no,  default: no
-# Saves all firewall rules if firewall gets stopped
-# (e.g. on system shutdown).
-EBTABLES_SAVE_ON_STOP="no"
-
-# Save (and restore) rule counters.
-#   Value: yes|no,  default: no
-# Save rule counters when saving a kernel table to a file. If the
-# rule counters were saved, they will be restored when restoring the table.
-EBTABLES_SAVE_COUNTER="no"

ebtables-helper

@@ -1,102 +0,0 @@
-#!/bin/bash
-
-# compat for removed initscripts dependency
-
-success() {
-       echo "[  OK  ]"
-       return 0
-}
-
-failure() {
-       echo "[FAILED]"
-       return 1
-}
-
-# internal variables
-EBTABLES_CONFIG=/etc/sysconfig/ebtables-config
-EBTABLES_DATA=/etc/sysconfig/ebtables
-EBTABLES_TABLES="broute filter nat"
-VAR_SUBSYS_EBTABLES=/var/lock/subsys/ebtables
-
-# ebtables-config defaults
-EBTABLES_SAVE_ON_STOP="no"
-EBTABLES_SAVE_ON_RESTART="no"
-EBTABLES_SAVE_COUNTER="no"
-
-# load config if existing
-[ -f "$EBTABLES_CONFIG" ] && . "$EBTABLES_CONFIG"
-
-initialize() {
-	local ret=0
-	for table in $EBTABLES_TABLES; do
-		ebtables -t $table --init-table || ret=1
-	done
-	return $ret
-}
-
-sanitize_dump() {
-	local drop=false
-
-	export EBTABLES_TABLES
-
-	cat $1 | while read line; do
-		case $line in
-		\**)
-			drop=false
-			local table="${line#\*}"
-			local found=false
-			for t in $EBTABLES_TABLES; do
-				if [[ $t == $table ]]; then
-					found=true
-					break
-				fi
-			done
-			$found || drop=true
-			;;
-		esac
-		$drop || echo "$line"
-	done
-}
-
-start() {
-	if [ -f $EBTABLES_DATA ]; then
-		echo -n $"ebtables: loading ruleset from $EBTABLES_DATA: "
-		sanitize_dump $EBTABLES_DATA | ebtables-restore
-	else
-		echo -n $"ebtables: no stored ruleset, initializing empty tables: "
-		initialize
-	fi
-	local ret=$?
-	touch $VAR_SUBSYS_EBTABLES
-	return $ret
-}
-
-save() {
-	echo -n $"ebtables: saving active ruleset to $EBTABLES_DATA: "
-	export EBTABLES_SAVE_COUNTER
-	ebtables-save >$EBTABLES_DATA && success || failure
-}
-
-case $1 in
-	start)
-		[ -f "$VAR_SUBSYS_EBTABLES" ] && exit 0
-		start && success || failure
-		RETVAL=$?
-		;;
-	stop)
-		[ "x$EBTABLES_SAVE_ON_STOP" = "xyes" ] && save
-		echo -n $"ebtables: stopping firewall: "
-		initialize && success || failure
-		RETVAL=$?
-		rm -f $VAR_SUBSYS_EBTABLES
-		;;
-	save)
-		save
-		;;
-	*)
-		echo "usage: ${0##*/} {start|stop|save}" >&2
-		RETVAL=2
-		;;
-esac
-
-exit $RETVAL

ebtables.service

@@ -1,11 +0,0 @@
-[Unit]
-Description=Ethernet Bridge Filtering tables
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/libexec/ebtables-helper start
-ExecStop=/usr/libexec/ebtables-helper stop
-
-[Install]
-WantedBy=multi-user.target

iptables-1.8.11-command-options-fix.patch

@@ -1,27 +0,0 @@
-commit 192c3a6bc18f206895ec5e38812d648ccfe7e281
-Author: Phil Sutter <phil@nwl.cc>
-Date:   Wed Apr 23 12:36:13 2025 +0200
-
-    xshared: Accept an option if any given command allows it
-    
-    Fixed commit made option checking overly strict: Some commands may be
-    commbined (foremost --list and --zero), reject a given option only if it
-    is not allowed by any of the given commands.
-    
-    Reported-by: Adam Nielsen <a.nielsen@shikadi.net>
-    Fixes: 9c09d28102bb4 ("xshared: Simplify generic_opt_check()")
-    Signed-off-by: Phil Sutter <phil@nwl.cc>
-
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index cdfd11ab..fc61e0fd 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -980,7 +980,7 @@ static void generic_opt_check(struct xt_cmd_parse_ops *ops,
- 	 */
- 	for (i = 0, optval = 1; i < NUMBER_OF_OPT; optval = (1 << ++i)) {
- 		if ((options & optval) &&
--		    (options_v_commands[i] & command) != command)
-+		    !(options_v_commands[i] & command))
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "Illegal option `%s' with this command",
- 				      ops->option_name(optval));

iptables-1.8.11-fix-interface-comparisons.patch

@@ -1,172 +0,0 @@
-From 40406dbfaefbc204134452b2747bae4f6a122848 Mon Sep 17 00:00:00 2001
-From: Jeremy Sowden <jeremy@azazel.net>
-Date: Mon, 18 Nov 2024 13:56:50 +0000
-Subject: nft: fix interface comparisons in `-C` commands
-
-Commit 9ccae6397475 ("nft: Leave interface masks alone when parsing from
-kernel") removed code which explicitly set interface masks to all ones.  The
-result of this is that they are zero.  However, they are used to mask interfaces
-in `is_same_interfaces`.  Consequently, the masked values are alway zero, the
-comparisons are always true, and check commands which ought to fail succeed:
-
-  # iptables -N test
-  # iptables -A test -i lo \! -o lo -j REJECT
-  # iptables -v -L test
-  Chain test (0 references)
-   pkts bytes target     prot opt in     out     source               destination
-      0     0 REJECT     all  --  lo     !lo     anywhere             anywhere             reject-with icmp-port-unreachable
-  # iptables -v -C test -i abcdefgh \! -o abcdefgh -j REJECT
-  REJECT  all opt -- in lo out !lo  0.0.0.0/0  -> 0.0.0.0/0   reject-with icmp-port-unreachable
-
-Remove the mask parameters from `is_same_interfaces`.  Add a test-case.
-
-Fixes: 9ccae6397475 ("nft: Leave interface masks alone when parsing from kernel")
-Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
----
- iptables/nft-arp.c                                 | 10 ++----
- iptables/nft-ipv4.c                                |  4 +--
- iptables/nft-ipv6.c                                |  6 +---
- iptables/nft-shared.c                              | 36 +++++-----------------
- iptables/nft-shared.h                              |  6 +---
- .../testcases/nft-only/0020-compare-interfaces_0   |  9 ++++++
- 6 files changed, 22 insertions(+), 49 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 264864c3..c11d64c3 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -385,14 +385,8 @@ static bool nft_arp_is_same(const struct iptables_command_state *cs_a,
- 		return false;
- 	}
- 
--	return is_same_interfaces(a->arp.iniface,
--				  a->arp.outiface,
--				  (unsigned char *)a->arp.iniface_mask,
--				  (unsigned char *)a->arp.outiface_mask,
--				  b->arp.iniface,
--				  b->arp.outiface,
--				  (unsigned char *)b->arp.iniface_mask,
--				  (unsigned char *)b->arp.outiface_mask);
-+	return is_same_interfaces(a->arp.iniface, a->arp.outiface,
-+				  b->arp.iniface, b->arp.outiface);
- }
- 
- static void nft_arp_save_chain(const struct nftnl_chain *c, const char *policy)
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index 74092875..0c8bd291 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -113,9 +113,7 @@ static bool nft_ipv4_is_same(const struct iptables_command_state *a,
- 	}
- 
- 	return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
--				  a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
--				  b->fw.ip.iniface, b->fw.ip.outiface,
--				  b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
-+				  b->fw.ip.iniface, b->fw.ip.outiface);
- }
- 
- static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
-diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index b184f8af..4dbb2af2 100644
---- a/iptables/nft-ipv6.c
-+++ b/iptables/nft-ipv6.c
-@@ -99,11 +99,7 @@ static bool nft_ipv6_is_same(const struct iptables_command_state *a,
- 	}
- 
- 	return is_same_interfaces(a->fw6.ipv6.iniface, a->fw6.ipv6.outiface,
--				  a->fw6.ipv6.iniface_mask,
--				  a->fw6.ipv6.outiface_mask,
--				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface,
--				  b->fw6.ipv6.iniface_mask,
--				  b->fw6.ipv6.outiface_mask);
-+				  b->fw6.ipv6.iniface, b->fw6.ipv6.outiface);
- }
- 
- static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 6775578b..2c29e68f 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -220,36 +220,16 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r,
- }
- 
- bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
--			unsigned const char *a_iniface_mask,
--			unsigned const char *a_outiface_mask,
--			const char *b_iniface, const char *b_outiface,
--			unsigned const char *b_iniface_mask,
--			unsigned const char *b_outiface_mask)
-+			const char *b_iniface, const char *b_outiface)
- {
--	int i;
--
--	for (i = 0; i < IFNAMSIZ; i++) {
--		if (a_iniface_mask[i] != b_iniface_mask[i]) {
--			DEBUGP("different iniface mask %x, %x (%d)\n",
--			a_iniface_mask[i] & 0xff, b_iniface_mask[i] & 0xff, i);
--			return false;
--		}
--		if ((a_iniface[i] & a_iniface_mask[i])
--		    != (b_iniface[i] & b_iniface_mask[i])) {
--			DEBUGP("different iniface\n");
--			return false;
--		}
--		if (a_outiface_mask[i] != b_outiface_mask[i]) {
--			DEBUGP("different outiface mask\n");
--			return false;
--		}
--		if ((a_outiface[i] & a_outiface_mask[i])
--		    != (b_outiface[i] & b_outiface_mask[i])) {
--			DEBUGP("different outiface\n");
--			return false;
--		}
-+	if (strncmp(a_iniface, b_iniface, IFNAMSIZ)) {
-+		DEBUGP("different iniface\n");
-+		return false;
-+	}
-+	if (strncmp(a_outiface, b_outiface, IFNAMSIZ)) {
-+		DEBUGP("different outiface\n");
-+		return false;
- 	}
--
- 	return true;
- }
- 
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 51d1e460..b57aee1f 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -105,11 +105,7 @@ void add_l4proto(struct nft_handle *h, struct nftnl_rule *r, uint8_t proto, uint
- void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv);
- 
- bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
--			unsigned const char *a_iniface_mask,
--			unsigned const char *a_outiface_mask,
--			const char *b_iniface, const char *b_outiface,
--			unsigned const char *b_iniface_mask,
--			unsigned const char *b_outiface_mask);
-+			const char *b_iniface, const char *b_outiface);
- 
- void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
- void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
-diff --git a/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0 b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
-new file mode 100755
-index 00000000..278cd648
---- /dev/null
-+++ b/iptables/tests/shell/testcases/nft-only/0020-compare-interfaces_0
-@@ -0,0 +1,9 @@
-+#!/bin/bash
-+
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+
-+$XT_MULTI iptables -N test
-+$XT_MULTI iptables -A test -i lo \! -o lo -j REJECT
-+$XT_MULTI iptables -C test -i abcdefgh \! -o abcdefgh -j REJECT 2>/dev/null && exit 1
-+
-+exit 0
--- 
-cgit v1.2.3
-

iptables.spec

@@ -10,35 +10,70 @@
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: https://www.netfilter.org/projects/iptables
-Version: 1.8.11
-Release: 12%{?dist}
-Source0: %{url}/files/%{name}-%{version}.tar.xz
-source1: %{url}/files/%{name}-%{version}.tar.xz.sig
-Source2: coreteam-gpg-key-0xD70D1A666ACF2B21.txt
-Source3: iptables.init
-Source4: iptables-config
-Source5: iptables.service
-Source6: sysconfig_iptables
-Source7: sysconfig_ip6tables
-Source8: arptables-helper
-Source9: arptables.service
-Source10: ebtables.service
-Source11: ebtables-helper
-Source12: ebtables-config
-# Patch to fix -C handling, already upstream
-# https://git.netfilter.org/iptables/patch/?id=40406dbfaefbc204134452b2747bae4f6a122848
-Patch1: iptables-1.8.11-fix-interface-comparisons.patch
-# Patch to fix overly strict command option checking
-# https://git.netfilter.org/iptables/patch/?id=192c3a6bc18f206895ec5e38812d648ccfe7e281
-Patch2: iptables-1.8.11-command-options-fix.patch
+Version: 1.8.9
+Release: 4%{?dist}.1
+Source: %{url}/files/%{name}-%{version}.tar.xz
+Source1: iptables.init
+Source2: iptables-config
+Source3: iptables.service
+Source4: sysconfig_iptables
+Source5: sysconfig_ip6tables
+Source6: arptables-nft-helper
+
+Patch001: 0001-extensions-NAT-Fix-for-Werror-format-security.patch
+Patch002: 0002-etc-Drop-xtables.conf.patch
+Patch003: 0003-Proper-fix-for-unknown-argument-error-message.patch
+Patch004: 0004-ebtables-Refuse-unselected-targets-options.patch
+Patch005: 0005-tests-xlate-Properly-split-input-in-replay-mode.patch
+Patch006: 0006-extensions-libebt_redirect-Fix-target-translation.patch
+Patch007: 0007-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch
+Patch008: 0008-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch
+Patch009: 0009-extensions-libebt_ip-Translation-has-to-match-on-eth.patch
+Patch010: 0010-xt_sctp-add-the-missing-chunk-types-in-sctp_help.patch
+Patch011: 0011-include-Add-missing-linux-netfilter-xt_LOG.h.patch
+Patch012: 0012-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch
+Patch013: 0013-ip6tables-Fix-checking-existence-of-rule.patch
+Patch014: 0014-nft-shared-Drop-unused-include.patch
+Patch015: 0015-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch
+Patch016: 0016-arptables-Don-t-omit-standard-matches-if-inverted.patch
+Patch017: 0017-xshared-Fix-parsing-of-option-arguments-in-same-word.patch
+Patch018: 0018-iptables-Fix-setting-of-ipv6-counters.patch
+Patch019: 0019-iptables-Fix-handling-of-non-existent-chains.patch
+Patch020: 0020-ebtables-ip-and-ip6-matches-depend-on-protocol-match.patch
+Patch021: 0021-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
+Patch022: 0022-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
+Patch023: 0023-nft-Special-casing-for-among-match-in-compare_matche.patch
+Patch024: 0024-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
+Patch025: 0025-tables-Reject-invalid-chain-names-when-renaming.patch
+Patch026: 0026-ebtables-Improve-invalid-chain-name-detection.patch
+Patch027: 0027-tests-shell-Fix-and-extend-chain-rename-test.patch
+Patch028: 0028-extensions-libipt_icmp-Fix-confusion-between-255-255.patch
+Patch029: 0029-tests-libipt_icmp.t-Enable-tests-with-numeric-output.patch
+Patch030: 0030-man-iptables.8-Fix-intra-page-reference.patch
+Patch031: 0031-man-iptables.8-Clarify-goto-description.patch
+Patch032: 0032-man-iptables-restore.8-Fix-modprobe-description.patch
+Patch033: 0033-man-iptables-restore.8-Consistently-document-w-optio.patch
+Patch034: 0034-man-iptables-restore.8-Drop-W-option-from-synopsis.patch
+Patch035: 0035-man-iptables-restore.8-Put-file-in-italics-in-synops.patch
+Patch036: 0036-man-iptables-restore.8-Start-paragraphs-in-upper-cas.patch
+Patch037: 0037-man-Trivial-Missing-space-after-comma.patch
+Patch038: 0038-man-iptables-save.8-Fix-modprobe-description.patch
+Patch039: 0039-man-iptables-save.8-Start-paragraphs-in-upper-case.patch
+Patch040: 0040-tests-iptables-test-Fix-command-segfault-reports.patch
+Patch041: 0041-nft-Create-builtin-chains-with-counters-enabled.patch
+Patch042: 0042-Revert-libiptc-fix-wrong-maptype-of-base-chain-count.patch
+Patch043: 0043-doc-fix-example-of-xt_cpu.patch
+Patch044: 0044-extensions-Fix-checking-of-conntrack-ctproto-0.patch
+Patch045: 0045-tests-shell-Fix-for-ineffective-0007-mid-restore-flu.patch
+Patch046: 0046-nft-Fix-for-useless-meta-expressions-in-rule.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
-License: GPL-2.0-only AND Artistic-2.0 AND ISC
+License: GPLv2 and Artistic Licence 2.0 and ISC
 
 # libnetfilter_conntrack is needed for xt_connlabel
 BuildRequires: pkgconfig(libnetfilter_conntrack)
-# libnfnetlink-devel is required for nfnl_osf
+# libnfnetlink-devel is requires for nfnl_osf
 BuildRequires: pkgconfig(libnfnetlink)
 BuildRequires: libselinux-devel
 BuildRequires: kernel-headers
@@ -48,35 +83,40 @@ BuildRequires: bison
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: pkgconfig(libmnl) >= 1.0
-BuildRequires: pkgconfig(libnftnl) >= 1.2.6
+BuildRequires: pkgconfig(libnftnl) >= 1.1.6
 # libpcap-devel for nfbpf_compile
 BuildRequires: libpcap-devel
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
 BuildRequires: make
-BuildRequires: gnupg2
 
 %description
 The iptables utility controls the network packet filtering code in the
 Linux kernel. If you need to set up firewalls and/or IP masquerading,
 you should install this package.
 
+%package compat
+Summary: Temporary transitioning package
+Obsoletes: %{name} < 1.8.7-4
+Requires: %{name}-legacy = %{version}-%{release}
+Requires: %{name}-utils = %{version}-%{release}
+
+%description compat
+This package only exists to help transition iptables users to the new
+package split. It will be removed after one distribution release cycle, please
+do not reference it or depend on it in any way.
+
 %package legacy
 Summary: Legacy tools for managing Linux kernel packet filtering capabilities
 Requires: %{name}-legacy-libs%{?_isa} = %{version}-%{release}
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 Conflicts: setup < 2.10.4-1
-Conflicts: alternatives < 1.32-1
-Requires(post): /usr/sbin/update-alternatives
-Requires(postun): /usr/sbin/update-alternatives
+Requires(post): %{_sbindir}/update-alternatives
+Requires(postun): %{_sbindir}/update-alternatives
 %if 0%{?rhel} < 9
 Provides:	iptables
 %endif
-Provides:  %{name}-compat = %{version}-%{release}
-Obsoletes: %{name}-compat < 1.8.9-7
-
-%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description legacy
 The iptables utility controls the network packet filtering code in the
@@ -100,8 +140,9 @@ Summary: iptables legacy libraries
 %description legacy-libs
 iptables libraries.
 
-Please remember that libip*tc libraries do neither have a stable API nor a real
-so version. For more information about this, please have a look at
+Please remember that libip*tc libraries do neither have a stable API nor a real so version.
+
+For more information about this, please have a look at
 
   http://www.netfilter.org/documentation/FAQ/netfilter-faq-4.html#ss4.5
 
@@ -135,14 +176,6 @@ Requires: %{name}-utils = %{version}-%{release}
 Obsoletes: %{name} < 1.4.16.1
 # obsolete ipv6 sub package
 Obsoletes: %{name}-ipv6 < 1.4.11.1
-# Look at me, I'm the new arptables-services now!
-Conflicts: %{name}-nft < 1.8.11-5
-Obsoletes: arptables-services < 0.0.5-16
-Provides: arptables-services = %{version}-%{release}
-# Look at me, I'm the new ebtables-services now!
-# (With epoch to turn our version number higher value)
-Obsoletes: ebtables-services < 2.0.11-20
-Provides: ebtables-services = 1:%{version}-%{release}
 BuildArch: noarch
 
 %description services
@@ -165,25 +198,19 @@ a safer way to update iptables remotely.
 %package nft
 Summary: nftables compatibility for iptables, arptables and ebtables
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
-Requires(post): /usr/sbin/update-alternatives
-Requires(post): /usr/bin/readlink
-Requires(postun): /usr/sbin/update-alternatives
+Requires(post): %{_sbindir}/update-alternatives
+Requires(post): %{_bindir}/readlink
+Requires(postun): %{_sbindir}/update-alternatives
 Obsoletes: iptables-compat < 1.6.2-4
 Provides: arptables-helper
 Provides: iptables
 Provides: arptables
 Provides: ebtables
-# allowing old arptables-legacy will break when switching alternatives
-# due to the dropped arptables-helper symlink
-Conflicts: arptables-legacy < 0.0.5-16
-
-%sbin_merge_compat %{_prefix}/sbin/iptables
 
 %description nft
 nftables compatibility for iptables, arptables and ebtables.
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %autosetup -p1
 
 %build
@@ -206,24 +233,20 @@ rm -f %{buildroot}%{_libdir}/*.la
 
 # install init scripts and configuration files
 install -d -m 755 %{buildroot}%{script_path}
-install -c -m 755 %{SOURCE3} %{buildroot}%{script_path}/iptables.init
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE3} > ip6tables.init
+install -c -m 755 %{SOURCE1} %{buildroot}%{script_path}/iptables.init
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE1} > ip6tables.init
 install -c -m 755 ip6tables.init %{buildroot}%{script_path}/ip6tables.init
-install -p -m 755 %{SOURCE8} %{SOURCE11} %{buildroot}%{_libexecdir}/
 install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
-install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
-sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE4} > ip6tables-config
+install -c -m 600 %{SOURCE2} %{buildroot}%{_sysconfdir}/sysconfig/iptables-config
+sed -e 's;iptables;ip6tables;g' -e 's;IPTABLES;IP6TABLES;g' < %{SOURCE2} > ip6tables-config
 install -c -m 600 ip6tables-config %{buildroot}%{_sysconfdir}/sysconfig/ip6tables-config
-install -c -m 600 %{SOURCE6} %{buildroot}%{_sysconfdir}/sysconfig/iptables
-install -c -m 600 %{SOURCE7} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
-echo '# Configure prior to use' > %{buildroot}%{_sysconfdir}/sysconfig/arptables
-install -c -m 600 %{SOURCE12} %{buildroot}%{_sysconfdir}/sysconfig/
-touch %{buildroot}%{_sysconfdir}/sysconfig/ebtables
+install -c -m 600 %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/iptables
+install -c -m 600 %{SOURCE5} %{buildroot}%{_sysconfdir}/sysconfig/ip6tables
 
 # install systemd service files
 install -d -m 755 %{buildroot}/%{_unitdir}
-install -c -m 644 %{SOURCE5} %{SOURCE9} %{SOURCE10} %{buildroot}/%{_unitdir}
-sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE5} > ip6tables.service
+install -c -m 644 %{SOURCE3} %{buildroot}/%{_unitdir}
+sed -e 's;iptables;ip6tables;g' -e 's;IPv4;IPv6;g' -e 's;/usr/libexec/ip6tables;/usr/libexec/iptables;g' < %{SOURCE3} > ip6tables.service
 install -c -m 644 ip6tables.service %{buildroot}/%{_unitdir}
 
 # install legacy actions for service command
@@ -249,42 +272,38 @@ install -c -m 755 ip6tabes.panic-legacy %{buildroot}/%{legacy_actions}/ip6tables
 # Remove /etc/ethertypes (now part of setup)
 rm -f %{buildroot}%{_sysconfdir}/ethertypes
 
+install -p -D -m 755 %{SOURCE6} %{buildroot}%{_libexecdir}/
+touch %{buildroot}%{_libexecdir}/arptables-helper
+
 # prepare for alternatives
 touch %{buildroot}%{_mandir}/man8/arptables.8
 touch %{buildroot}%{_mandir}/man8/arptables-save.8
 touch %{buildroot}%{_mandir}/man8/arptables-restore.8
 touch %{buildroot}%{_mandir}/man8/ebtables.8
-rm %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
-touch %{buildroot}%{_sbindir}/{ip,ip6,arp,eb}tables{,-save,-restore}
+
+# Drop xtables.conf, it's not used
+rm -f %{buildroot}%{_sysconfdir}/xtables.conf
 
 # fix absolute symlink
-ln -sf --relative %{buildroot}%{_sbindir}/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
+rm -f %{buildroot}%{_bindir}/iptables-xml
+ln -s ../sbin/xtables-legacy-multi %{buildroot}%{_bindir}/iptables-xml
 
 %ldconfig_scriptlets
 
 %post legacy
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-update-alternatives --install \
+%{_sbindir}/update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--follower $pfx6 ip6tables $pfx6-legacy \
-	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
-	--follower $pfx-save iptables-save $pfx-legacy-save \
-	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
-# directory. Those symlinks will only be created if there is no symlink
-# or file already.
-for name in ip{,6}tables{,-save,-restore}; do
-    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
-done
-%endif
+	--slave $pfx6 ip6tables $pfx6-legacy \
+	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
+	--slave $pfx-save iptables-save $pfx-legacy-save \
+	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
 
 %postun legacy
 if [ $1 -eq 0 ]; then
-	update-alternatives --remove \
+	%{_sbindir}/update-alternatives --remove \
 		iptables %{_sbindir}/iptables-legacy
 fi
 
@@ -300,112 +319,97 @@ cp /var/lib/alternatives/iptables /var/tmp/alternatives.iptables.setup
 %triggerpostun legacy -- iptables > 1.8.0
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-update-alternatives --install \
+%{_sbindir}/update-alternatives --install \
 	$pfx iptables $pfx-legacy 10 \
-	--follower $pfx6 ip6tables $pfx6-legacy \
-	--follower $pfx-restore iptables-restore $pfx-legacy-restore \
-	--follower $pfx-save iptables-save $pfx-legacy-save \
-	--follower $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
-	--follower $pfx6-save ip6tables-save $pfx6-legacy-save
+	--slave $pfx6 ip6tables $pfx6-legacy \
+	--slave $pfx-restore iptables-restore $pfx-legacy-restore \
+	--slave $pfx-save iptables-save $pfx-legacy-save \
+	--slave $pfx6-restore ip6tables-restore $pfx6-legacy-restore \
+	--slave $pfx6-save ip6tables-save $pfx6-legacy-save
 alternatives --set iptables $(</var/tmp/alternatives.iptables.current)
 rm /var/tmp/alternatives.iptables.current
 mv /var/tmp/alternatives.iptables.setup /var/lib/alternatives/iptables
 
-%if "%{_sbindir}" == "%{_bindir}"
-# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
-# directory. Those symlinks will only be created if there is no symlink
-# or file already.
-for name in ip{,6}tables{,-save,-restore}; do
-    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
-done
-%endif
-
 %post services
-%systemd_post arptables.service ebtables.service
 %systemd_post iptables.service ip6tables.service
 
 %preun services
-%systemd_preun arptables.service ebtables.service
 %systemd_preun iptables.service ip6tables.service
 
 %postun services
 %?ldconfig
-%systemd_postun arptables.service ebtables.service
 %systemd_postun iptables.service ip6tables.service
 
 %post -e nft
 [[ %%{_excludedocs} == 1 ]] || do_man=true
 
-# remove non-symlinks in spots managed by alternatives
-# to cover for updates from not-yet-alternatived versions
-for pfx in %{_prefix}/sbin/{eb,arp}tables; do
-	for sfx in "" "-restore" "-save"; do
-		if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
-			rm -f $pfx$sfx
-		fi
-	done
-done
-for manpfx in %{_mandir}/man8/{eb,arp}tables; do
-	for sfx in {,-restore,-save}.8.gz; do
-		if [ "$(readlink -e $manpfx$sfx)" == $manpfx$sfx ]; then
-			rm -f $manpfx$sfx
-		fi
-	done
-done
-
 pfx=%{_sbindir}/iptables
 pfx6=%{_sbindir}/ip6tables
-update-alternatives --install \
+%{_sbindir}/update-alternatives --install \
 	$pfx iptables $pfx-nft 10 \
-	--follower $pfx6 ip6tables $pfx6-nft \
-	--follower $pfx-restore iptables-restore $pfx-nft-restore \
-	--follower $pfx-save iptables-save $pfx-nft-save \
-	--follower $pfx6-restore ip6tables-restore $pfx6-nft-restore \
-	--follower $pfx6-save ip6tables-save $pfx6-nft-save
+	--slave $pfx6 ip6tables $pfx6-nft \
+	--slave $pfx-restore iptables-restore $pfx-nft-restore \
+	--slave $pfx-save iptables-save $pfx-nft-save \
+	--slave $pfx6-restore ip6tables-restore $pfx6-nft-restore \
+	--slave $pfx6-save ip6tables-save $pfx6-nft-save
 
 pfx=%{_sbindir}/ebtables
 manpfx=%{_mandir}/man8/ebtables
-update-alternatives --install \
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+done
+if [ "$(readlink -e $manpfx.8.gz)" == $manpfx.8.gz ]; then
+	rm -f $manpfx.8.gz
+fi
+%{_sbindir}/update-alternatives --install \
 	$pfx ebtables $pfx-nft 10 \
-	--follower $pfx-save ebtables-save $pfx-nft-save \
-	--follower $pfx-restore ebtables-restore $pfx-nft-restore \
-	${do_man:+--follower $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
+	--slave $pfx-save ebtables-save $pfx-nft-save \
+	--slave $pfx-restore ebtables-restore $pfx-nft-restore \
+	${do_man:+--slave $manpfx.8.gz ebtables-man $manpfx-nft.8.gz}
 
 pfx=%{_sbindir}/arptables
 manpfx=%{_mandir}/man8/arptables
-update-alternatives --install \
-	$pfx arptables $pfx-nft 10 \
-	--follower $pfx-save arptables-save $pfx-nft-save \
-	--follower $pfx-restore arptables-restore $pfx-nft-restore \
-	${do_man:+--follower $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
-	${do_man:+--follower $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
-	${do_man:+--follower $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz}
-
-%if "%{_sbindir}" == "%{_bindir}"
-# Make sure that symlinks in /usr/sbin/ are not missing, if /usr/sbin is a
-# directory. Those symlinks will only be created if there is no symlink
-# or file already.
-for name in ip{,6}tables{,-save,-restore} ebtables{,-save,-restore} arptables{,-save,-restore}; do
-    test -h /usr/sbin || ln -s ../bin/$name /usr/sbin/$name 2>/dev/null || :
+lepfx=%{_libexecdir}/arptables
+for sfx in "" "-restore" "-save"; do
+	if [ "$(readlink -e $pfx$sfx)" == $pfx$sfx ]; then
+		rm -f $pfx$sfx
+	fi
+	if [ "$(readlink -e $manpfx$sfx.8.gz)" == $manpfx$sfx.8.gz ]; then
+		rm -f $manpfx$sfx.8.gz
+	fi
 done
-%endif
+if [ "$(readlink -e $lepfx-helper)" == $lepfx-helper ]; then
+	rm -f $lepfx-helper
+fi
+%{_sbindir}/update-alternatives --install \
+	$pfx arptables $pfx-nft 10 \
+	--slave $pfx-save arptables-save $pfx-nft-save \
+	--slave $pfx-restore arptables-restore $pfx-nft-restore \
+	${do_man:+--slave $manpfx.8.gz arptables-man $manpfx-nft.8.gz} \
+	${do_man:+--slave $manpfx-save.8.gz arptables-save-man $manpfx-nft-save.8.gz} \
+	${do_man:+--slave $manpfx-restore.8.gz arptables-restore-man $manpfx-nft-restore.8.gz} \
+	--slave $lepfx-helper arptables-helper $lepfx-nft-helper
 
 %postun nft
 if [ $1 -eq 0 ]; then
 	for cmd in iptables ebtables arptables; do
-		update-alternatives --remove $cmd %{_sbindir}/$cmd-nft
+		%{_sbindir}/update-alternatives --remove \
+			$cmd %{_sbindir}/$cmd-nft
 	done
 fi
 
+%files compat
+
 %files legacy
 %{_sbindir}/ip{,6}tables-legacy*
 %{_sbindir}/xtables-legacy-multi
 %{_bindir}/iptables-xml
 %{_mandir}/man1/iptables-xml*
 %{_mandir}/man8/xtables-legacy*
-%dir %{_datadir}/xtables
 %{_datadir}/xtables/iptables.xslt
-%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
 
 %files libs
 %license COPYING
@@ -434,13 +438,9 @@ fi
 %dir %{script_path}
 %{script_path}/ip{,6}tables.init
 %config(noreplace) %{_sysconfdir}/sysconfig/ip{,6}tables{,-config}
-%config(noreplace) %{_sysconfdir}/sysconfig/arptables
-%config(noreplace) %{_sysconfdir}/sysconfig/ebtables-config
-%ghost %{_sysconfdir}/sysconfig/ebtables
-%{_unitdir}/{arp,eb,ip,ip6}tables.service
+%{_unitdir}/ip{,6}tables.service
 %dir %{legacy_actions}/ip{,6}tables
 %{legacy_actions}/ip{,6}tables/{save,panic}
-%{_libexecdir}/{arp,eb}tables-helper
 
 %files utils
 %license COPYING
@@ -460,112 +460,25 @@ fi
 %{_sbindir}/xtables-nft-multi
 %{_sbindir}/xtables-monitor
 %{_sbindir}/ebtables-translate
-%{_sbindir}/arptables-translate
 %dir %{_libdir}/xtables
 %{_libdir}/xtables/lib{arp,eb}t*
+%{_libexecdir}/arptables-nft-helper
 %{_mandir}/man8/xtables-monitor*
 %{_mandir}/man8/xtables-translate*
 %{_mandir}/man8/*-nft*
 %{_mandir}/man8/ip{,6}tables{,-restore}-translate*
 %{_mandir}/man8/ebtables-translate*
-%{_mandir}/man8/arptables-translate*
-%ghost %attr(0755,root,root) %{_sbindir}/ip{,6}tables{,-save,-restore}
-%ghost %attr(0755,root,root) %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_sbindir}/ip{,6}tables{,-save,-restore}
+%ghost %{_sbindir}/{eb,arp}tables{,-save,-restore}
+%ghost %{_libexecdir}/arptables-helper
 %ghost %{_mandir}/man8/arptables{,-save,-restore}.8.gz
 %ghost %{_mandir}/man8/ebtables.8.gz
 
 
 %changelog
-* Tue Oct 28 2025 Paul Wouters <paul.wouters@aiven.io> - 1.8.11-12
-- Pull in upstream fix for too strict command option parsing
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.11-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 20 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-10
-- Fix for ghost files not present in iptables-nft RPM
-
-* Wed May 07 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-9
-- Reapply the change to keep symlinks managed by alternatives under /usr/bin,
-  this time with a scriptlet create symlinks if /usr/sbin is unmerged.
-
-* Sat May 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-8
-- Revert last release, it breaks alternatives symlinks
-
-* Fri Apr 25 2025 Zbigniew Jedrzejewski-Szmek  <zbyszek@in.waw.pl> - 1.8.11-7
-- Keep symlinks managed by alternatives under /usr/bin
-
-* Sun Apr 20 2025 Kevin Fenzi <kevin@scrye.com> - 1.8.11-6
-- Add patch to fix -C handling ( fixes rhbz#2360423 )
-
-* Thu Apr 03 2025 Phil Sutter <psutter@redhat.com> - 1.8.11-5
-- iptables-services to assimilate arptables- and ebtables-services
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org>
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Jan 14 2025 Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-3
-- Keep symlinks managed by alternatives under /usr/sbin
-
-* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.11-2
-- Rebuilt for the bin-sbin merge (2nd attempt)
-
-* Fri Nov 08 2024 Phil Sutter <psutter@redhat.com> - 1.8.11-1
-- new version
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-15
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Sat Jul 13 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-14
-- Add unmerged-sbin compat also for -legacy subpackage
-
-* Fri Jul 12 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-13
-- Bump release and add changelog entry
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.8.10-12
-- Rebuilt for the bin-sbin merge
-
-* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-11
-- Add missing build dependency
-
-* Fri Jul 05 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-10
-- Verify tarball GPG signature
-
-* Wed Jul 03 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-9
+* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4.1
 - Backport fixes from upstream
 
-* Tue May 21 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-8
-- Make iptables-legacy own %%{_datadir}/xtables
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jan 11 2024 Phil Sutter <psutter@redhat.com> - 1.8.10-5
-- Backport fixes from upstream
-- Fix flatpak build
-
-* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-4
-- The actual obsoletes fix
-
-* Tue Nov 07 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-3
-- Fix compat sub-package obsoletion
-
-* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-2
-- Obsolete dropped compat package
-
-* Tue Oct 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.10-1
-- New version 1.8.10
-- Drop compat sub-package
-
-* Tue Aug 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-6
-- Convert license to SPDX format
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.9-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
 * Wed May 24 2023 Phil Sutter <psutter@redhat.com> - 1.8.9-4
 - Backport fixes from upstream
 

sources

@@ -1,2 +1 @@
-SHA512 (iptables-1.8.11.tar.xz) = 4937020bf52d57a45b76e1eba125214a2f4531de52ff1d15185faeef8bea0cd90eb77f99f81baa573944aa122f350a7198cef41d70594e1b65514784addbcc40
-SHA512 (iptables-1.8.11.tar.xz.sig) = 8bde9436b6c6c9d97d9b1cadc417035c209e39b49111ea08fe35b714bbf94721ad0b8b2870791d3bf98154f64912109c6bdeb0ee33f954d0d3a8c3582a97f3f2
+SHA512 (iptables-1.8.9.tar.xz) = e367bf286135e39b7401e852de25c1ed06d44befdffd92ed1566eb2ae9704b48ac9196cb971f43c6c83c6ad4d910443d32064bcdf618cfcef6bcab113e31ff70

tests/RFE-Enable-the-missing-IPv6-SET-target/runtest.sh

@@ -29,10 +29,12 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 IPSET=testset6
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/RFE-iptables-add-C-option-to-iptables-in-RHEL6/runtest.sh

@@ -29,10 +29,12 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 TESTD=$PWD
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "source $TESTD/rules.in" 0 "read ruleset"

tests/TRACE-target-of-iptables-can-t-work-in/runtest.sh

@@ -29,6 +29,7 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 prepare_page() {
@@ -41,6 +42,7 @@ prepare_page() {
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel
         rlLogInfo $(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
@@ -119,14 +121,10 @@ rlJournalStart
         rlRun "ip -6 route restore < ip-route.save6" 0 "restore routing info ipv6"
         rlRun "iptables -t raw -F"
         rlRun "ip6tables -t raw -F"
-        if rlTestVersion "$(uname -r)" "<" "4.6"; then
-            rlRun "rmmod nf_log_ipv4"
-            rlRun "rmmod nf_log_ipv6"
-            rlRun "rmmod nf_log_common"
-            rlRun "rmmod nfnetlink_log" 0,1
-	else
-            rlLogInfo "new kernel detected: skipping unloading modules"
-	fi
+        rlRun "rmmod nf_log_ipv4"
+        rlRun "rmmod nf_log_ipv6"
+        rlRun "rmmod nf_log_common"
+        rlRun "rmmod nfnetlink_log" 0,1
         rlLogInfo "restoring services"
         for svc in $SERVICES; do
             rlServiceRestore $svc

tests/backport-iptables-add-libxt-cgroup-frontend/runtest.sh

@@ -29,6 +29,7 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 CGNUM="15"
 CGNAME="15"
 CGDIR="/sys/fs/cgroup/net_cls/$CGNAME"
@@ -40,6 +41,7 @@ SKIP6=false
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         # rlAssertRpm kernel-$(uname -r)
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"

tests/initscript-sanity/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd

tests/ip6tables-do-not-accept-dst-or-src-direction-on-ip6sets/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ip6tables-save > ip6tables.backup"

tests/ip6tables-service-does-not-allow-dhcpv6-client-by/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "cp /etc/sysconfig/ip6tables ."

tests/ip6tables-t-nat-A-POSTROUTING-OUTPUT-with-DROP/runtest.sh

@@ -29,10 +29,12 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 SERVICES="iptables ip6tables firewalld"
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         for svc in $SERVICES; do

tests/iptables-rule-deletion-fails-for-rules-that-use/runtest.sh

@@ -29,11 +29,13 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
 IPSET4="ipsetv4"
 IPSET6="ipsetv6"
 
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlRun "ipset create $IPSET4 hash:ip"

tests/iptables-save-cuts-space-before-j/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
         rlServiceStart iptables

tests/iptables-save-modprobe-option/runtest.sh

@@ -30,8 +30,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartTest
+        rlAssertRpm $PACKAGE
         rlRun "iptables-save -M /dev/null" 0 "iptables-save -M ... supported"
         rlRun "iptables-save --modprobe /dev/null" 0 "iptables-save --modprobe ... supported"
     rlPhaseEnd

tests/xtables-tools-locking-vulnerable-to-local-DoS/runtest.sh

@@ -29,8 +29,11 @@
 . /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
+PACKAGE="iptables"
+
 rlJournalStart
     rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
         rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
         rlRun "pushd $TmpDir"
     rlPhaseEnd