Add upstream patches

0001-Fix-typo-in-ipset-translate-man-page.patch

@@ -0,0 +1,31 @@
+From c74a420471fd693f89e0b0e19f93c88af22fb7de Mon Sep 17 00:00:00 2001
+From: "Bernhard M. Wiedemann" <bwiedemann@suse.de>
+Date: Wed, 29 Sep 2021 09:55:43 +0200
+Subject: [PATCH] Fix typo in ipset-translate man page
+
+originally reported in
+https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZIXKNQHSSCQ4ZLEGYYKLAXQ4PQ5EYFGZ/
+by Larry Len Rainey
+
+Signed-off-by: Bernhard M. Wiedemann <bwiedemann@suse.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ src/ipset-translate.8 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/ipset-translate.8 b/src/ipset-translate.8
+index bb4e737e1480..55ce2a99f2cf 100644
+--- a/src/ipset-translate.8
++++ b/src/ipset-translate.8
+@@ -33,7 +33,7 @@ to \fBnftables(8)\fP.
+ The only available command is:
+ 
+ .IP \[bu] 2
+-ipset-translate restores < file.ipt
++ipset-translate restore < file.ipt
+ 
+ .SH USAGE
+ The \fBipset-translate\fP tool reads an IP sets file in the syntax produced by
+-- 
+2.37.2
+

0002-Fix-IPv6-sets-nftables-translation.patch

@@ -0,0 +1,91 @@
+From be7f6099feb7b5d34715b06f9308877cdcdc404a Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 28 Feb 2022 19:52:57 +0100
+Subject: [PATCH] Fix IPv6 sets nftables translation
+
+The parser assumes the set is an IPv4 ipset because IPSET_OPT_FAMILY is
+not set.
+
+ # ipset-translate restore < ./ipset-mwan3_set_connected_ipv6.dump
+ add table inet global
+ add set inet global mwan3_connected_v6 { type ipv6_addr; flags interval; }
+ flush set inet global mwan3_connected_v6
+ ipset v7.15: Error in line 4: Syntax error: '64' is out of range 0-32
+
+Remove ipset_xlate_type_get(), call ipset_xlate_set_get() instead to
+obtain the set type and family.
+
+Reported-by: Florian Eckert <fe@dev.tdt.de>
+Fixes: 325af556cd3a ("add ipset to nftables translation infrastructure")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ lib/ipset.c             | 24 ++++++++++--------------
+ tests/xlate/xlate.t     |  2 ++
+ tests/xlate/xlate.t.nft |  2 ++
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/lib/ipset.c b/lib/ipset.c
+index 73e67db88e0d..50f86aee045b 100644
+--- a/lib/ipset.c
++++ b/lib/ipset.c
+@@ -949,18 +949,6 @@ ipset_xlate_set_get(struct ipset *ipset, const char *name)
+ 	return NULL;
+ }
+ 
+-static const struct ipset_type *ipset_xlate_type_get(struct ipset *ipset,
+-						     const char *name)
+-{
+-	const struct ipset_xlate_set *set;
+-
+-	set = ipset_xlate_set_get(ipset, name);
+-	if (!set)
+-		return NULL;
+-
+-	return set->type;
+-}
+-
+ static int
+ ipset_parser(struct ipset *ipset, int oargc, char *oargv[])
+ {
+@@ -1282,8 +1270,16 @@ ipset_parser(struct ipset *ipset, int oargc, char *oargv[])
+ 		if (!ipset->xlate) {
+ 			type = ipset_type_get(session, cmd);
+ 		} else {
+-			type = ipset_xlate_type_get(ipset, arg0);
+-			ipset_session_data_set(session, IPSET_OPT_TYPE, type);
++			const struct ipset_xlate_set *xlate_set;
++
++			xlate_set = ipset_xlate_set_get(ipset, arg0);
++			if (xlate_set) {
++				ipset_session_data_set(session, IPSET_OPT_TYPE,
++						       xlate_set->type);
++				ipset_session_data_set(session, IPSET_OPT_FAMILY,
++						       &xlate_set->family);
++				type = xlate_set->type;
++			}
+ 		}
+ 		if (type == NULL)
+ 			return ipset->standard_error(ipset, p);
+diff --git a/tests/xlate/xlate.t b/tests/xlate/xlate.t
+index b1e7d288e2a9..f09cb202bb6c 100644
+--- a/tests/xlate/xlate.t
++++ b/tests/xlate/xlate.t
+@@ -53,3 +53,5 @@ create bp1 bitmap:port range 1-1024
+ add bp1 22
+ create bim1 bitmap:ip,mac range 1.1.1.0/24
+ add bim1 1.1.1.1,aa:bb:cc:dd:ee:ff
++create hn6 hash:net family inet6
++add hn6 fe80::/64
+diff --git a/tests/xlate/xlate.t.nft b/tests/xlate/xlate.t.nft
+index 96eba3b0175e..0152a3081125 100644
+--- a/tests/xlate/xlate.t.nft
++++ b/tests/xlate/xlate.t.nft
+@@ -54,3 +54,5 @@ add set inet global bp1 { type inet_service; }
+ add element inet global bp1 { 22 }
+ add set inet global bim1 { type ipv4_addr . ether_addr; }
+ add element inet global bim1 { 1.1.1.1 . aa:bb:cc:dd:ee:ff }
++add set inet global hn6 { type ipv6_addr; flags interval; }
++add element inet global hn6 { fe80::/64 }
+-- 
+2.37.2
+

0003-ipset-translate-allow-invoking-with-a-path-name.patch

@@ -0,0 +1,46 @@
+From e1b60b2a93356c313cccb2abfdae4b58d530e02b Mon Sep 17 00:00:00 2001
+From: Quentin Armitage <quentin@armitage.org.uk>
+Date: Thu, 11 Aug 2022 17:52:18 +0100
+Subject: [PATCH] ipset-translate: allow invoking with a path name
+
+Executing /usr/sbin/ipset-translate results in the ipset functionality being run, rather than the ipset-translate functionality.
+
+ # ipset-translate destroy fred
+ This command is not supported, use `ipset-translate restore < file'
+
+ # /usr/sbin/ipset-translate destroy fred
+ ipset v7.15: The set with the given name does not exist
+
+use basename() to resolve the issue.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1626
+Signed-off-by: Quentin Armitage <quentin@armitage.org.uk>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+ src/ipset.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/ipset.c b/src/ipset.c
+index 6d42b60d2fe9..162f477d49cd 100644
+--- a/src/ipset.c
++++ b/src/ipset.c
+@@ -6,6 +6,7 @@
+  * it under the terms of the GNU General Public License version 2 as
+  * published by the Free Software Foundation.
+  */
++#define _GNU_SOURCE
+ #include <assert.h>			/* assert */
+ #include <stdio.h>			/* fprintf */
+ #include <stdlib.h>			/* exit */
+@@ -31,7 +32,7 @@ main(int argc, char *argv[])
+ 		exit(1);
+ 	}
+ 
+-	if (!strcmp(argv[0], "ipset-translate")) {
++	if (!strcmp(basename(argv[0]), "ipset-translate")) {
+ 		ret = ipset_xlate_argv(ipset, argc, argv);
+ 	} else {
+ 		ret = ipset_parse_argv(ipset, argc, argv);
+-- 
+2.37.2
+