From e9fab3a0391b06b7a8ab293ca58646e30840af12 Mon Sep 17 00:00:00 2001
From: eabdullin <eabdullin@almalinux.org>
Date: Tue, 17 Oct 2023 13:52:06 +0000
Subject: [PATCH] import CS iptables-1.8.5-10.el8

---
 .gitignore                                    |   3 +-
 .iptables.metadata                            |   3 +-
 ...iptables-apply-not-getting-installed.patch |  41 +
 ...apply-Use-mktemp-instead-of-tempfile.patch |  35 -
 ...ore-Fix-parser-feed-from-line-buffer.patch |  59 --
 ...ate-don-t-fail-if-help-was-requested.patch |  57 ++
 ...mat-security-fixes-in-libip-6-t_icmp.patch |  61 --
 ...e-Avoid-access-of-uninitialized-data.patch |  31 -
 ...anslate-Use-proper-clear_cs-function.patch |  30 +
 ...xtensions-time-Avoid-undefined-shift.patch |  31 -
 ...ler-warning-fixes-for-NO_SHARED_LIBS.patch |  55 +
 ...nsions-cluster-Avoid-undefined-shift.patch |  31 -
 ..._conntrack-provide-translation-for-D.patch |  63 ++
 ...-buffer-overrun-in-xtables_compatibl.patch |  32 -
 ...p-pointless-nft_xt_builtin_init-call.patch |  30 +
 ...and-name-in-ip6tables-error-message.patch} |  11 +-
 ...te-Guard-strcpy-call-in-xlate_ifname.patch |  40 -
 ...extensions-among-Check-call-to-fstat.patch |  41 -
 ...-Merge-and-extend-return-codes-test.patch} |  36 +-
 ...void-undefined-left-shift-in-xt_sctp.patch |  43 -
 ...monitor-Fix-ip6tables-rule-printing.patch} |   7 +-
 ...eck-consistency-with-NFT_CL_FAKE-too.patch |  39 +
 ...e-Fix-for-interface-name-corner-case.patch |  98 --
 ...broken-address-mask-match-detection.patch} |   7 +-
 ...0011-xtables-translate-Fix-for-iface.patch |  60 --
 ...pt_icmp-Fix-translation-of-type-any.patch} |   5 +-
 ...shell-Fix-skip-checks-with-host-mode.patch | 366 -------
 ...ure-extensions-register-in-revision.patch} |  15 +-
 ...tore-fix-for-noflush-and-empty-lines.patch |  78 --
 .../0014-iptables-test.py-Fix-host-mode.patch |  43 -
 ...lify-pending-extension-registration.patch} |  25 +-
 ...er-multiple-extensions-in-ascending.patch} |  11 +-
 SOURCES/0015-xtables-Review-nft_init.patch    | 274 -----
 ...d_chain-return-the-added-batch-obje.patch} |  46 +-
 ...e-Fix-nft_release_cache-under-stress.patch |  49 -
 ...eporting-for-refreshed-transactions.patch} |   9 +-
 ...-iptables-save-segfault-under-stress.patch |  84 --
 ...Support-mixed-MAC-and-MAC-IP-entries.patch | 127 ---
 ...or-concurrent-noflush-restore-calls.patch} |  43 +-
 ...ve-concurrent-noflush-restore-test-.patch} |   5 +-
 ...gn-effect-of-4-6-options-with-legacy.patch | 157 ---
 ...imize-class-based-IP-prefix-matches.patch} |  17 +-
 ...nd-6-support-from-xtables-save-resto.patch |  81 --
 ...Optimize-masked-MAC-address-matches.patch} |  19 +-
 ...-Fix-broken-conversion-to-nfnl_query.patch |  42 -
 ...0022-nfnl_osf-Improve-error-handling.patch |  80 --
 ...dd-test-for-bitwise-avoidance-fixes.patch} |   5 +-
 ...tables-Fix-for-broken-chain-renaming.patch |  61 ++
 ...he-Reset-genid-when-rebuilding-cache.patch |  37 -
 ...0024-nft-Fix-for-F-in-iptables-dumps.patch |  81 --
 ...024-xtables-arp-Don-t-use-ARPT_INV_.patch} |  20 +-
 ...025-tests-shell-Test-F-in-dump-files.patch |  37 -
 ...rge-some-command-option-related-code.patch | 517 ++++++++++
 ...st-for-fixed-extension-registration.patch} |   5 +-
 ...ions-dccp-Fix-for-DCCP-type-INVALID.patch} |   5 +-
 ...8-xtables-monitor-fix-rule-printing.patch} |   7 +-
 ...-monitor-fix-packet-family-protocol.patch} |   7 +-
 ...nft_rebuild_cache-respect-fake-cache.patch |  80 --
 ...-xtables-monitor-print-packet-first.patch} |   7 +-
 ...nitor.patch => 0031-xtables-monitor.patch} |   7 +-
 ...selective-chain-compatibility-checks.patch |  41 +
 SOURCES/0033-iptables-nft-fix-Z-option.patch  | 104 ++
 ...wise-expression-avoidance-detection.patch} |   7 +-
 ...ate-Fix-translation-of-odd-netmasks.patch} |   9 +-
 ..._conntrack-use-bitops-for-state-nega.patch | 129 +++
 ...7-Eliminate-inet_aton-and-inet_ntoa.patch} |   6 +-
 ...arp-Make-use-of-ipv4_addr_to_string.patch} |  14 +-
 ...nsions-SECMARK-Implement-revision-1.patch} |   4 +-
 ...to_name-from-xshared-in-more-places.patch} |  24 +-
 ...libxt_CT-add-translation-for-NOTRACK.patch |  66 --
 ...sions-sctp-Fix-nftables-translation.patch} |   4 +-
 ...s-sctp-Translate-chunk-types-option.patch} |   4 +-
 ...leftover-variable-in-xtables_numeric.patch |  33 +
 ...ons-libebt_ip6-Drop-unused-variables.patch |  49 +
 ...-Fix-memleak-in-xtopt_parse_hostmask.patch |  29 +
 ...memleak-in-error-path-of-nft_cmd_new.patch |  34 +
 ...-iptables-apply-Drop-unused-variable.patch |  29 +
 ...8-Adjust-for-missing-atomic-options.patch} |   4 +-
 ... => 0049-ebtables-Dump-atomic-waste.patch} |  10 +-
 ...ft-Fix-for-non-verbose-check-command.patch |  31 +
 ...ons-hashlimit-Fix-tests-with-HZ-100.patch} |   4 +-
 ...bles_malloc-in-mnl_err_list_node_add.patch |  31 +
 ...ns-hashlimit-Fix-tests-with-HZ-1000.patch} |   4 +-
 ...xshared-Merge-and-share-parse_chain.patch} |  33 +-
 ...red-Drop-unused-function-print_proto.patch |  58 ++
 .../0056-xshared-Make-load_proto-static.patch |  48 +
 ..._NFLOG-fix-nflog-prefix-Python-test-.patch |  40 +
 ..._NFLOG-remove-extra-space-when-savin.patch |  53 +
 ...-cache-Retry-if-kernel-returns-EINTR.patch |  77 --
 ...-Fix-response-to-unprivileged-users.patch} |  28 +-
 ...er-only-the-highest-revision-extens.patch} |  14 +-
 ...messages-for-unsupported-extensions.patch} |  12 +-
 ...0062-nft-Simplify-immediate-parsing.patch} |  24 +-
 ...0063-nft-Speed-up-immediate-parsing.patch} |  20 +-
 ...ables_chain_protos-lookup-over-getp.patch} |  14 +-
 ...or-warning-in-xtables_ipmask_to_nume.patch |  41 +
 ...rd-targets-as-chain-names-when-rest.patch} |  40 +-
 ...bles-Implement-notargets-hash-table.patch} |  38 +-
 ...rule-target-checks-by-announcing-ch.patch} |  20 +-
 ...e-context-register-for-bitwise-expre.patch |  31 +
 ...RK-Drop-extra-newline-at-end-of-help.patch |  29 +
 ...G-Document-log-macdecode-in-man-page.patch |  28 +
 ...ndling-for-extensions-without-rev-0.patch} |   8 +-
 ...-overhead-in-iptables-save-and-rest.patch} |   4 +-
 ...Drop-redundant-include-of-xtables-mu.patch |  33 +
 ...some-more-rules-to-0002-verbose-outp.patch |  55 +
 ...string-Do-not-print-default-to-value.patch |  39 +
 ...or-add-missing-spaces-in-printed-str.patch |  45 +
 ...supported-extension-warning-corner-.patch} |  18 +-
 ..._conntrack-remove-always-false-condi.patch |  61 ++
 ...break-among-match-with-concatenation.patch | 958 ++++++++++++++++++
 ...nft-shared-Introduce-__get_cmp_data.patch} |  22 +-
 ...h => 0082-ebtables-Support-p-Length.patch} |  23 +-
 ...-among-Remove-pointless-fall-through.patch |  36 +
 ...ng-Fix-for-use-with-ebtables-restore.patch |  57 ++
 ...t_stp-Eliminate-duplicate-space-in-o.patch |  34 +
 ...p6t_dst-Fix-output-for-empty-options.patch |  41 +
 ...POPTSTRIP-Do-not-print-empty-options.patch |  55 +
 ...t-Fix-syntax-support-for-restore-inp.patch |  29 +
 ...bebt_stp.t-Drop-duplicate-whitespace.patch |  29 +
 ...expected-output-for-ip6tables-dst-ma.patch |  45 +
 ...x-for-segfault-when-renaming-a-chain.patch |  67 ++
 ...ions-libebt_mark-Fix-xlate-test-case.patch |  57 ++
 ...ibebt_redirect-Fix-xlate-return-code.patch |  30 +
 ...s-libipt_ttl-Sanitize-xlate-callback.patch |  39 +
 ...tensions-CONNMARK-Fix-xlate-callback.patch |  88 ++
 ...-extensions-MARK-Sanitize-MARK_xlate.patch |  31 +
 ...PMSS-Use-xlate-callback-for-IPv6-too.patch |  29 +
 ...extensions-TOS-Fix-v1-xlate-callback.patch |  95 ++
 ...tensions-ecn-Sanitize-xlate-callback.patch |  30 +
 ...ns-libebt_mark-Fix-mark-target-xlate.patch |  31 +
 ..._conntrack-Drop-extra-whitespace-in-.patch |  57 ++
 ...s-restore-Free-handle-with-test-also.patch |  47 +
 ...les-xml-Free-allocated-chain-strings.patch |  42 +
 ...ug-memleak-in-nft_rule_zero_counters.patch |  51 +
 ...e-xtables_clear_iptables_command_sta.patch | 219 ++++
 ...y-clear-iptables_command_state-objec.patch |  75 ++
 ...107-libiptc-Eliminate-garbage-access.patch |  47 +
 ...es-Fix-MAC-address-match-translation.patch |  63 ++
 ...aring-ifname-matches-against-nft-gen.patch |  33 +
 .../0110-nft-Fix-match-generator-for-i.patch  |  52 +
 ...e-Fix-for-interfaces-with-asterisk-m.patch |  74 ++
 .../0112-Drop-libiptc-linux_stddef.h.patch    |  63 ++
 ...efile-xtables-version.h-is-generated.patch |  41 +
 ...les-Check-the-mandatory-ar_pln-match.patch |  44 +
 ...15-gitignore-Ignore-utils-nfsynproxy.patch |  24 +
 SOURCES/0116-etc-Drop-xtables.conf.patch      | 118 +++
 ...x-for-unknown-argument-error-message.patch | 163 +++
 ...es-Refuse-unselected-targets-options.patch | 239 +++++
 ...bebt_redirect-Fix-target-translation.patch |  53 +
 ...t_redirect-Fix-for-wrong-syntax-in-t.patch |  53 +
 ...t_ip-Do-not-use-ip-dscp-for-translat.patch |  55 +
 ...t_ip-Translation-has-to-match-on-eth.patch |  90 ++
 ...-for-deletion-of-new-referenced-rule.patch |  67 ++
 .../0124-nft-shared-Drop-unused-include.patch |  34 +
 ...rsing-of-inverted-arp-operation-matc.patch |  31 +
 ...-t-omit-standard-matches-if-inverted.patch |  42 +
 ...les-Check-the-mandatory-ar_pln-match.patch |  44 +
 ...K-Use-a-better-context-in-test-case.patch} |   6 +-
 ...ts-xlate-test-Print-errors-to-stderr.patch |  39 +
 ...test-Make-netns-spawning-more-robust.patch |  72 ++
 ...iptables-test-Print-errors-to-stderr.patch |  54 +
 ...ts-xlate-test-Exit-non-zero-on-error.patch |  91 ++
 ...iptables-test-Exit-non-zero-on-error.patch |  30 +
 ...tests-shell-Return-non-zero-on-error.patch |  26 +
 ...-print-with-color-escapes-only-when-.patch |  70 ++
 ...est-Fix-conditional-colors-on-stderr.patch |  64 ++
 ...te-format-of-registers-in-bitwise-pa.patch |  67 ++
 ...Fix-nft-only-0009-needless-bitwise_0.patch |  36 +
 ...tize-nft-only-0009-needless-bitwise_.patch |  34 +
 ...ptables-Fix-setting-of-ipv6-counters.patch | 107 ++
 ...-Fix-handling-of-non-existent-chains.patch |  53 +
 ...context-structure-to-ops-add-to-impr.patch | 339 +++++++
 ...ng-for-among-match-in-compare_matche.patch |  46 +
 ...t-pass-nft_rule_ctx-to-add_nft_among.patch |  67 ++
 ...t-fix-basechain-policy-configuration.patch |  82 ++
 SOURCES/iptables-test.stderr.expect           |  39 +
 SPECS/iptables.spec                           | 316 +++---
 178 files changed, 7533 insertions(+), 2829 deletions(-)
 create mode 100644 SOURCES/0001-build-resolve-iptables-apply-not-getting-installed.patch
 delete mode 100644 SOURCES/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
 delete mode 100644 SOURCES/0002-xtables-restore-Fix-parser-feed-from-line-buffer.patch
 create mode 100644 SOURCES/0002-xtables-translate-don-t-fail-if-help-was-requested.patch
 delete mode 100644 SOURCES/0003-extensions-format-security-fixes-in-libip-6-t_icmp.patch
 delete mode 100644 SOURCES/0003-xtables-restore-Avoid-access-of-uninitialized-data.patch
 create mode 100644 SOURCES/0003-xtables-translate-Use-proper-clear_cs-function.patch
 delete mode 100644 SOURCES/0004-extensions-time-Avoid-undefined-shift.patch
 create mode 100644 SOURCES/0004-libxtables-compiler-warning-fixes-for-NO_SHARED_LIBS.patch
 delete mode 100644 SOURCES/0005-extensions-cluster-Avoid-undefined-shift.patch
 create mode 100644 SOURCES/0005-extensions-libxt_conntrack-provide-translation-for-D.patch
 delete mode 100644 SOURCES/0006-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch
 create mode 100644 SOURCES/0006-nft-Drop-pointless-nft_xt_builtin_init-call.patch
 rename SOURCES/{0041-nft-Fix-command-name-in-ip6tables-error-message.patch => 0007-nft-Fix-command-name-in-ip6tables-error-message.patch} (84%)
 delete mode 100644 SOURCES/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch
 delete mode 100644 SOURCES/0008-extensions-among-Check-call-to-fstat.patch
 rename SOURCES/{0042-tests-shell-Merge-and-extend-return-codes-test.patch => 0008-tests-shell-Merge-and-extend-return-codes-test.patch} (89%)
 delete mode 100644 SOURCES/0009-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch
 rename SOURCES/{0044-xtables-monitor-Fix-ip6tables-rule-printing.patch => 0009-xtables-monitor-Fix-ip6tables-rule-printing.patch} (88%)
 create mode 100644 SOURCES/0010-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
 delete mode 100644 SOURCES/0010-xtables-translate-Fix-for-interface-name-corner-case.patch
 rename SOURCES/{0031-nft-Fix-for-broken-address-mask-match-detection.patch => 0011-nft-Fix-for-broken-address-mask-match-detection.patch} (92%)
 delete mode 100644 SOURCES/0011-xtables-translate-Fix-for-iface.patch
 rename SOURCES/{0039-extensions-libipt_icmp-Fix-translation-of-type-any.patch => 0012-extensions-libipt_icmp-Fix-translation-of-type-any.patch} (94%)
 delete mode 100644 SOURCES/0012-tests-shell-Fix-skip-checks-with-host-mode.patch
 rename SOURCES/{0035-libxtables-Make-sure-extensions-register-in-revision.patch => 0013-libxtables-Make-sure-extensions-register-in-revision.patch} (90%)
 delete mode 100644 SOURCES/0013-xtables-restore-fix-for-noflush-and-empty-lines.patch
 delete mode 100644 SOURCES/0014-iptables-test.py-Fix-host-mode.patch
 rename SOURCES/{0036-libxtables-Simplify-pending-extension-registration.patch => 0014-libxtables-Simplify-pending-extension-registration.patch} (91%)
 rename SOURCES/{0037-libxtables-Register-multiple-extensions-in-ascending.patch => 0015-libxtables-Register-multiple-extensions-in-ascending.patch} (82%)
 delete mode 100644 SOURCES/0015-xtables-Review-nft_init.patch
 rename SOURCES/{0026-nft-Make-batch_add_chain-return-the-added-batch-obje.patch => 0016-nft-Make-batch_add_chain-return-the-added-batch-obje.patch} (78%)
 delete mode 100644 SOURCES/0016-nft-cache-Fix-nft_release_cache-under-stress.patch
 rename SOURCES/{0027-nft-Fix-error-reporting-for-refreshed-transactions.patch => 0017-nft-Fix-error-reporting-for-refreshed-transactions.patch} (85%)
 delete mode 100644 SOURCES/0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch
 delete mode 100644 SOURCES/0018-ebtables-among-Support-mixed-MAC-and-MAC-IP-entries.patch
 rename SOURCES/{0028-nft-Fix-for-concurrent-noflush-restore-calls.patch => 0018-nft-Fix-for-concurrent-noflush-restore-calls.patch} (87%)
 rename SOURCES/{0029-tests-shell-Improve-concurrent-noflush-restore-test-.patch => 0019-tests-shell-Improve-concurrent-noflush-restore-test-.patch} (94%)
 delete mode 100644 SOURCES/0019-xtables-Align-effect-of-4-6-options-with-legacy.patch
 rename SOURCES/{0032-nft-Optimize-class-based-IP-prefix-matches.patch => 0020-nft-Optimize-class-based-IP-prefix-matches.patch} (91%)
 delete mode 100644 SOURCES/0020-xtables-Drop-4-and-6-support-from-xtables-save-resto.patch
 rename SOURCES/{0033-ebtables-Optimize-masked-MAC-address-matches.patch => 0021-ebtables-Optimize-masked-MAC-address-matches.patch} (95%)
 delete mode 100644 SOURCES/0021-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
 delete mode 100644 SOURCES/0022-nfnl_osf-Improve-error-handling.patch
 rename SOURCES/{0034-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch => 0022-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch} (98%)
 create mode 100644 SOURCES/0023-ebtables-Fix-for-broken-chain-renaming.patch
 delete mode 100644 SOURCES/0023-nft-cache-Reset-genid-when-rebuilding-cache.patch
 delete mode 100644 SOURCES/0024-nft-Fix-for-F-in-iptables-dumps.patch
 rename SOURCES/{0052-xtables-arp-Don-t-use-ARPT_INV_.patch => 0024-xtables-arp-Don-t-use-ARPT_INV_.patch} (94%)
 delete mode 100644 SOURCES/0025-tests-shell-Test-F-in-dump-files.patch
 create mode 100644 SOURCES/0025-xshared-Merge-some-command-option-related-code.patch
 rename SOURCES/{0038-tests-shell-Test-for-fixed-extension-registration.patch => 0026-tests-shell-Test-for-fixed-extension-registration.patch} (93%)
 rename SOURCES/{0043-extensions-dccp-Fix-for-DCCP-type-INVALID.patch => 0027-extensions-dccp-Fix-for-DCCP-type-INVALID.patch} (98%)
 rename SOURCES/{0045-xtables-monitor-fix-rule-printing.patch => 0028-xtables-monitor-fix-rule-printing.patch} (94%)
 rename SOURCES/{0046-xtables-monitor-fix-packet-family-protocol.patch => 0029-xtables-monitor-fix-packet-family-protocol.patch} (89%)
 delete mode 100644 SOURCES/0030-nft-cache-Make-nft_rebuild_cache-respect-fake-cache.patch
 rename SOURCES/{0047-xtables-monitor-print-packet-first.patch => 0030-xtables-monitor-print-packet-first.patch} (95%)
 rename SOURCES/{0048-xtables-monitor.patch => 0031-xtables-monitor.patch} (84%)
 create mode 100644 SOURCES/0032-nft-Fix-selective-chain-compatibility-checks.patch
 create mode 100644 SOURCES/0033-iptables-nft-fix-Z-option.patch
 rename SOURCES/{0049-nft-Fix-bitwise-expression-avoidance-detection.patch => 0034-nft-Fix-bitwise-expression-avoidance-detection.patch} (93%)
 rename SOURCES/{0050-xtables-translate-Fix-translation-of-odd-netmasks.patch => 0035-xtables-translate-Fix-translation-of-odd-netmasks.patch} (97%)
 create mode 100644 SOURCES/0036-extensions-libxt_conntrack-use-bitops-for-state-nega.patch
 rename SOURCES/{0051-Eliminate-inet_aton-and-inet_ntoa.patch => 0037-Eliminate-inet_aton-and-inet_ntoa.patch} (97%)
 rename SOURCES/{0053-nft-arp-Make-use-of-ipv4_addr_to_string.patch => 0038-nft-arp-Make-use-of-ipv4_addr_to_string.patch} (93%)
 rename SOURCES/{0054-extensions-SECMARK-Implement-revision-1.patch => 0039-extensions-SECMARK-Implement-revision-1.patch} (98%)
 rename SOURCES/{0070-Use-proto_to_name-from-xshared-in-more-places.patch => 0040-Use-proto_to_name-from-xshared-in-more-places.patch} (88%)
 delete mode 100644 SOURCES/0040-extensions-libxt_CT-add-translation-for-NOTRACK.patch
 rename SOURCES/{0055-extensions-sctp-Fix-nftables-translation.patch => 0041-extensions-sctp-Fix-nftables-translation.patch} (97%)
 rename SOURCES/{0056-extensions-sctp-Translate-chunk-types-option.patch => 0042-extensions-sctp-Translate-chunk-types-option.patch} (99%)
 create mode 100644 SOURCES/0043-libxtables-Drop-leftover-variable-in-xtables_numeric.patch
 create mode 100644 SOURCES/0044-extensions-libebt_ip6-Drop-unused-variables.patch
 create mode 100644 SOURCES/0045-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch
 create mode 100644 SOURCES/0046-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch
 create mode 100644 SOURCES/0047-iptables-apply-Drop-unused-variable.patch
 rename SOURCES/{0059-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch => 0048-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch} (98%)
 rename SOURCES/{0060-ebtables-Dump-atomic-waste.patch => 0049-ebtables-Dump-atomic-waste.patch} (93%)
 create mode 100644 SOURCES/0050-nft-Fix-for-non-verbose-check-command.patch
 rename SOURCES/{0061-extensions-hashlimit-Fix-tests-with-HZ-100.patch => 0051-extensions-hashlimit-Fix-tests-with-HZ-100.patch} (97%)
 create mode 100644 SOURCES/0052-nft-Use-xtables_malloc-in-mnl_err_list_node_add.patch
 rename SOURCES/{0062-extensions-hashlimit-Fix-tests-with-HZ-1000.patch => 0053-extensions-hashlimit-Fix-tests-with-HZ-1000.patch} (97%)
 rename SOURCES/{0066-xshared-Merge-and-share-parse_chain.patch => 0054-xshared-Merge-and-share-parse_chain.patch} (84%)
 create mode 100644 SOURCES/0055-nft-shared-Drop-unused-function-print_proto.patch
 create mode 100644 SOURCES/0056-xshared-Make-load_proto-static.patch
 create mode 100644 SOURCES/0057-extensions-libxt_NFLOG-fix-nflog-prefix-Python-test-.patch
 create mode 100644 SOURCES/0058-extensions-libxt_NFLOG-remove-extra-space-when-savin.patch
 delete mode 100644 SOURCES/0058-nft-cache-Retry-if-kernel-returns-EINTR.patch
 rename SOURCES/{0072-xshared-Fix-response-to-unprivileged-users.patch => 0059-xshared-Fix-response-to-unprivileged-users.patch} (81%)
 rename SOURCES/{0071-libxtables-Register-only-the-highest-revision-extens.patch => 0060-libxtables-Register-only-the-highest-revision-extens.patch} (84%)
 rename SOURCES/{0073-Improve-error-messages-for-unsupported-extensions.patch => 0061-Improve-error-messages-for-unsupported-extensions.patch} (90%)
 rename SOURCES/{0063-nft-Simplify-immediate-parsing.patch => 0062-nft-Simplify-immediate-parsing.patch} (91%)
 rename SOURCES/{0064-nft-Speed-up-immediate-parsing.patch => 0063-nft-Speed-up-immediate-parsing.patch} (84%)
 rename SOURCES/{0065-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch => 0064-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch} (90%)
 create mode 100644 SOURCES/0065-libxtables-Fix-for-warning-in-xtables_ipmask_to_nume.patch
 rename SOURCES/{0067-nft-Reject-standard-targets-as-chain-names-when-rest.patch => 0066-nft-Reject-standard-targets-as-chain-names-when-rest.patch} (73%)
 rename SOURCES/{0068-libxtables-Implement-notargets-hash-table.patch => 0067-libxtables-Implement-notargets-hash-table.patch} (78%)
 rename SOURCES/{0069-libxtables-Boost-rule-target-checks-by-announcing-ch.patch => 0068-libxtables-Boost-rule-target-checks-by-announcing-ch.patch} (82%)
 create mode 100644 SOURCES/0069-nft-shared-update-context-register-for-bitwise-expre.patch
 create mode 100644 SOURCES/0070-extensions-MARK-Drop-extra-newline-at-end-of-help.patch
 create mode 100644 SOURCES/0071-extensions-LOG-Document-log-macdecode-in-man-page.patch
 rename SOURCES/{0074-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch => 0072-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch} (92%)
 rename SOURCES/{0075-tests-shell-Check-overhead-in-iptables-save-and-rest.patch => 0073-tests-shell-Check-overhead-in-iptables-save-and-rest.patch} (96%)
 create mode 100644 SOURCES/0074-iptables-legacy-Drop-redundant-include-of-xtables-mu.patch
 create mode 100644 SOURCES/0075-tests-shell-Add-some-more-rules-to-0002-verbose-outp.patch
 create mode 100644 SOURCES/0076-extensions-string-Do-not-print-default-to-value.patch
 create mode 100644 SOURCES/0077-xtables-monitor-add-missing-spaces-in-printed-str.patch
 rename SOURCES/{0076-libxtables-Fix-unsupported-extension-warning-corner-.patch => 0078-libxtables-Fix-unsupported-extension-warning-corner-.patch} (84%)
 create mode 100644 SOURCES/0079-extensions-libxt_conntrack-remove-always-false-condi.patch
 create mode 100644 SOURCES/0080-nft-un-break-among-match-with-concatenation.patch
 rename SOURCES/{0077-nft-shared-Introduce-__get_cmp_data.patch => 0081-nft-shared-Introduce-__get_cmp_data.patch} (75%)
 rename SOURCES/{0078-ebtables-Support-p-Length.patch => 0082-ebtables-Support-p-Length.patch} (92%)
 create mode 100644 SOURCES/0083-extensions-among-Remove-pointless-fall-through.patch
 create mode 100644 SOURCES/0084-extensions-among-Fix-for-use-with-ebtables-restore.patch
 create mode 100644 SOURCES/0085-extensions-libebt_stp-Eliminate-duplicate-space-in-o.patch
 create mode 100644 SOURCES/0086-extensions-libip6t_dst-Fix-output-for-empty-options.patch
 create mode 100644 SOURCES/0087-extensions-TCPOPTSTRIP-Do-not-print-empty-options.patch
 create mode 100644 SOURCES/0088-tests-IDLETIMER.t-Fix-syntax-support-for-restore-inp.patch
 create mode 100644 SOURCES/0089-tests-libebt_stp.t-Drop-duplicate-whitespace.patch
 create mode 100644 SOURCES/0090-tests-shell-Fix-expected-output-for-ip6tables-dst-ma.patch
 create mode 100644 SOURCES/0091-libiptc-Fix-for-segfault-when-renaming-a-chain.patch
 create mode 100644 SOURCES/0092-extensions-libebt_mark-Fix-xlate-test-case.patch
 create mode 100644 SOURCES/0093-extensions-libebt_redirect-Fix-xlate-return-code.patch
 create mode 100644 SOURCES/0094-extensions-libipt_ttl-Sanitize-xlate-callback.patch
 create mode 100644 SOURCES/0095-extensions-CONNMARK-Fix-xlate-callback.patch
 create mode 100644 SOURCES/0096-extensions-MARK-Sanitize-MARK_xlate.patch
 create mode 100644 SOURCES/0097-extensions-TCPMSS-Use-xlate-callback-for-IPv6-too.patch
 create mode 100644 SOURCES/0098-extensions-TOS-Fix-v1-xlate-callback.patch
 create mode 100644 SOURCES/0099-extensions-ecn-Sanitize-xlate-callback.patch
 create mode 100644 SOURCES/0100-extensions-libebt_mark-Fix-mark-target-xlate.patch
 create mode 100644 SOURCES/0101-extensions-libxt_conntrack-Drop-extra-whitespace-in-.patch
 create mode 100644 SOURCES/0102-iptables-restore-Free-handle-with-test-also.patch
 create mode 100644 SOURCES/0103-iptables-xml-Free-allocated-chain-strings.patch
 create mode 100644 SOURCES/0104-nft-Plug-memleak-in-nft_rule_zero_counters.patch
 create mode 100644 SOURCES/0105-xtables-Introduce-xtables_clear_iptables_command_sta.patch
 create mode 100644 SOURCES/0106-iptables-Properly-clear-iptables_command_state-objec.patch
 create mode 100644 SOURCES/0107-libiptc-Eliminate-garbage-access.patch
 create mode 100644 SOURCES/0108-ebtables-Fix-MAC-address-match-translation.patch
 create mode 100644 SOURCES/0109-nft-Fix-for-comparing-ifname-matches-against-nft-gen.patch
 create mode 100644 SOURCES/0110-nft-Fix-match-generator-for-i.patch
 create mode 100644 SOURCES/0111-xtables-translate-Fix-for-interfaces-with-asterisk-m.patch
 create mode 100644 SOURCES/0112-Drop-libiptc-linux_stddef.h.patch
 create mode 100644 SOURCES/0113-include-Makefile-xtables-version.h-is-generated.patch
 create mode 100644 SOURCES/0114-arptables-Check-the-mandatory-ar_pln-match.patch
 create mode 100644 SOURCES/0115-gitignore-Ignore-utils-nfsynproxy.patch
 create mode 100644 SOURCES/0116-etc-Drop-xtables.conf.patch
 create mode 100644 SOURCES/0117-Proper-fix-for-unknown-argument-error-message.patch
 create mode 100644 SOURCES/0118-ebtables-Refuse-unselected-targets-options.patch
 create mode 100644 SOURCES/0119-extensions-libebt_redirect-Fix-target-translation.patch
 create mode 100644 SOURCES/0120-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch
 create mode 100644 SOURCES/0121-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch
 create mode 100644 SOURCES/0122-extensions-libebt_ip-Translation-has-to-match-on-eth.patch
 create mode 100644 SOURCES/0123-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch
 create mode 100644 SOURCES/0124-nft-shared-Drop-unused-include.patch
 create mode 100644 SOURCES/0125-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch
 create mode 100644 SOURCES/0126-arptables-Don-t-omit-standard-matches-if-inverted.patch
 create mode 100644 SOURCES/0127-Revert-arptables-Check-the-mandatory-ar_pln-match.patch
 rename SOURCES/{0057-extensions-SECMARK-Use-a-better-context-in-test-case.patch => 0128-extensions-SECMARK-Use-a-better-context-in-test-case.patch} (85%)
 create mode 100644 SOURCES/0129-tests-xlate-test-Print-errors-to-stderr.patch
 create mode 100644 SOURCES/0130-iptables-test-Make-netns-spawning-more-robust.patch
 create mode 100644 SOURCES/0131-tests-iptables-test-Print-errors-to-stderr.patch
 create mode 100644 SOURCES/0132-tests-xlate-test-Exit-non-zero-on-error.patch
 create mode 100644 SOURCES/0133-tests-iptables-test-Exit-non-zero-on-error.patch
 create mode 100644 SOURCES/0134-tests-shell-Return-non-zero-on-error.patch
 create mode 100644 SOURCES/0135-iptables-test.py-print-with-color-escapes-only-when-.patch
 create mode 100644 SOURCES/0136-tests-iptables-test-Fix-conditional-colors-on-stderr.patch
 create mode 100644 SOURCES/0137-tests-shell-update-format-of-registers-in-bitwise-pa.patch
 create mode 100644 SOURCES/0138-tests-shell-Fix-nft-only-0009-needless-bitwise_0.patch
 create mode 100644 SOURCES/0139-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
 create mode 100644 SOURCES/0140-iptables-Fix-setting-of-ipv6-counters.patch
 create mode 100644 SOURCES/0141-iptables-Fix-handling-of-non-existent-chains.patch
 create mode 100644 SOURCES/0142-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
 create mode 100644 SOURCES/0143-nft-Special-casing-for-among-match-in-compare_matche.patch
 create mode 100644 SOURCES/0144-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
 create mode 100644 SOURCES/0145-iptables-nft-fix-basechain-policy-configuration.patch
 create mode 100644 SOURCES/iptables-test.stderr.expect

diff --git a/.gitignore b/.gitignore
index e765dc8..0be74d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
-SOURCES/iptables-1.8.2.tar.bz2
-SOURCES/iptables-1.8.4.tar.bz2
+SOURCES/iptables-1.8.5.tar.bz2
diff --git a/.iptables.metadata b/.iptables.metadata
index b5d885b..dee2066 100644
--- a/.iptables.metadata
+++ b/.iptables.metadata
@@ -1,2 +1 @@
-215c4ef4c6cd29ef0dd265b4fa5ec51a4f930c92 SOURCES/iptables-1.8.2.tar.bz2
-cd5fe776fb2b0479b3234758fc333777caa1239b SOURCES/iptables-1.8.4.tar.bz2
+f177a58d0a71b00d68ef5792ae4676bcc0ad29e6 SOURCES/iptables-1.8.5.tar.bz2
diff --git a/SOURCES/0001-build-resolve-iptables-apply-not-getting-installed.patch b/SOURCES/0001-build-resolve-iptables-apply-not-getting-installed.patch
new file mode 100644
index 0000000..22ed228
--- /dev/null
+++ b/SOURCES/0001-build-resolve-iptables-apply-not-getting-installed.patch
@@ -0,0 +1,41 @@
+From 4806ba770a3aaadd0a3975ac1ea92dff3ea87ee4 Mon Sep 17 00:00:00 2001
+From: Jan Engelhardt <jengelh@inai.de>
+Date: Wed, 3 Jun 2020 15:38:48 +0200
+Subject: [PATCH] build: resolve iptables-apply not getting installed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ip6tables-apply gets installed but iptables-apply does not.
+That is wrong.
+
+» make install DESTDIR=$PWD/r
+» find r -name "*app*"
+r/usr/local/sbin/ip6tables-apply
+r/usr/local/share/man/man8/iptables-apply.8
+r/usr/local/share/man/man8/ip6tables-apply.8
+
+Fixes: v1.8.5~87
+Signed-off-by: Jan Engelhardt <jengelh@inai.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b)
+---
+ iptables/Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/Makefile.am b/iptables/Makefile.am
+index dc66b3cc09c08..2024dbf5cb88c 100644
+--- a/iptables/Makefile.am
++++ b/iptables/Makefile.am
+@@ -56,7 +56,7 @@ man_MANS         = iptables.8 iptables-restore.8 iptables-save.8 \
+                    ip6tables-save.8 iptables-extensions.8 \
+                    iptables-apply.8 ip6tables-apply.8
+ 
+-sbin_SCRIPT      = iptables-apply
++sbin_SCRIPTS     = iptables-apply
+ 
+ if ENABLE_NFTABLES
+ man_MANS	+= xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
+-- 
+2.40.0
+
diff --git a/SOURCES/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch b/SOURCES/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
deleted file mode 100644
index ef6490b..0000000
--- a/SOURCES/0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From a69b9119bde58b372acb1c3914ee90f2ed48afb8 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <psutter@redhat.com>
-Date: Mon, 17 Sep 2018 11:39:50 +0200
-Subject: [PATCH] iptables-apply: Use mktemp instead of tempfile
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/iptables-apply | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/iptables-apply b/iptables/iptables-apply
-index 819ca4a459c42..a685b6bbcd7dc 100755
---- a/iptables/iptables-apply
-+++ b/iptables/iptables-apply
-@@ -111,7 +111,7 @@ if [[ ! -r "$FILE" ]]; then
- 	exit 2
- fi
- 
--COMMANDS=(tempfile "$SAVE" "$RESTORE")
-+COMMANDS=(mktemp "$SAVE" "$RESTORE")
- 
- for cmd in "${COMMANDS[@]}"; do
- 	if ! command -v $cmd >/dev/null; then
-@@ -122,7 +122,7 @@ done
- 
- umask 0700
- 
--TMPFILE=$(tempfile -p iptap)
-+TMPFILE=$(mktemp)
- trap "rm -f $TMPFILE" EXIT HUP INT QUIT ILL TRAP ABRT BUS \
- 		      FPE USR1 SEGV USR2 PIPE ALRM TERM
- 
--- 
-2.24.0
-
diff --git a/SOURCES/0002-xtables-restore-Fix-parser-feed-from-line-buffer.patch b/SOURCES/0002-xtables-restore-Fix-parser-feed-from-line-buffer.patch
deleted file mode 100644
index 4910448..0000000
--- a/SOURCES/0002-xtables-restore-Fix-parser-feed-from-line-buffer.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 25af0fd3a7edd9a9aa5ed7ed63188456ee6389ef Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 4 Dec 2019 09:56:06 +0100
-Subject: [PATCH] xtables-restore: Fix parser feed from line buffer
-
-When called with --noflush, xtables-restore would trip over chain lines:
-Parser uses strtok() to separate chain name, policy and counters which
-inserts nul-chars into the source string. Therefore strlen() can't be
-used anymore to find end of line. Fix this by caching line length before
-calling xtables_restore_parse_line().
-
-Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit a103fbfadf4c17b8b12caa57eef72deaaa71a18c)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- .../testcases/ipt-restore/0010-noflush-new-chain_0     | 10 ++++++++++
- iptables/xtables-restore.c                             |  4 +++-
- 2 files changed, 13 insertions(+), 1 deletion(-)
- create mode 100755 iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
-
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0 b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
-new file mode 100755
-index 0000000000000..739e684a21183
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ipt-restore/0010-noflush-new-chain_0
-@@ -0,0 +1,10 @@
-+#!/bin/sh -e
-+
-+# assert input feed from buffer doesn't trip over
-+# added nul-chars from parsing chain line.
-+
-+$XT_MULTI iptables-restore --noflush <<EOF
-+*filter
-+:foobar - [0:0]
-+-A foobar -j ACCEPT
-+COMMIT
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index 2f0fe7d439d94..dd907e0b8ddd5 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -327,10 +327,12 @@ void xtables_restore_parse(struct nft_handle *h,
- 	line = 0;
- 	ptr = preload_buffer;
- 	while (*ptr) {
-+		size_t len = strlen(ptr);
-+
- 		h->error.lineno = ++line;
- 		DEBUGP("%s: buffered line %d: '%s'\n", __func__, line, ptr);
- 		xtables_restore_parse_line(h, p, &state, ptr);
--		ptr += strlen(ptr) + 1;
-+		ptr += len + 1;
- 	}
- 	if (*buffer) {
- 		h->error.lineno = ++line;
--- 
-2.24.0
-
diff --git a/SOURCES/0002-xtables-translate-don-t-fail-if-help-was-requested.patch b/SOURCES/0002-xtables-translate-don-t-fail-if-help-was-requested.patch
new file mode 100644
index 0000000..429ebc4
--- /dev/null
+++ b/SOURCES/0002-xtables-translate-don-t-fail-if-help-was-requested.patch
@@ -0,0 +1,57 @@
+From eaad1950f1952733c2770b29b593613cfe9af8a8 Mon Sep 17 00:00:00 2001
+From: Arturo Borrero Gonzalez <arturo@netfilter.org>
+Date: Tue, 16 Jun 2020 11:20:42 +0200
+Subject: [PATCH] xtables-translate: don't fail if help was requested
+
+If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle
+this case in do_command_xlate().
+
+Before this patch, you would see:
+
+ user@debian:~$ sudo iptables-translate -h
+ [..]
+ nft Unsupported command?
+ user@debian:~$ echo $?
+ 1
+
+After this patch:
+
+ user@debian:~$ sudo iptables-translate -h
+ [..]
+ user@debian:~$ echo $?
+ 0
+
+Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts")
+Acked-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
+(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069)
+---
+ iptables/xtables-translate.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index 5aa42496b5a48..363c8be15b3fa 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
+ 
+ 	cs.restore = restore;
+ 
+-	if (!restore)
++	if (!restore && p.command != CMD_NONE)
+ 		printf("nft ");
+ 
+ 	switch (p.command) {
+@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
+ 		break;
+ 	case CMD_SET_POLICY:
+ 		break;
++	case CMD_NONE:
++		ret = 1;
++		break;
+ 	default:
+ 		/* We should never reach this... */
+ 		printf("Unsupported command?\n");
+-- 
+2.40.0
+
diff --git a/SOURCES/0003-extensions-format-security-fixes-in-libip-6-t_icmp.patch b/SOURCES/0003-extensions-format-security-fixes-in-libip-6-t_icmp.patch
deleted file mode 100644
index cfefe78..0000000
--- a/SOURCES/0003-extensions-format-security-fixes-in-libip-6-t_icmp.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 7e63dd95957a264d15eefdda3ea9449a6c72eb86 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Adam=20Go=C5=82=C4=99biowski?= <adamg@pld-linux.org>
-Date: Wed, 14 Nov 2018 07:35:28 +0100
-Subject: [PATCH] extensions: format-security fixes in libip[6]t_icmp
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-introduced support for gcc feature to check format string against passed
-argument.  This commit adds missing bits to extenstions's libipt_icmp.c
-and libip6t_icmp6.c that were causing build to fail.
-
-Fixes: 61d6c3834de3 ("xtables: add 'printf' attribute to xlate_add")
-Signed-off-by: Adam Gołębiowski <adamg@pld-linux.org>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 907e429d7548157016cd51aba4adc5d0c7d9f816)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libip6t_icmp6.c | 4 ++--
- extensions/libipt_icmp.c   | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libip6t_icmp6.c b/extensions/libip6t_icmp6.c
-index 45a71875722c4..cc7bfaeb72fd7 100644
---- a/extensions/libip6t_icmp6.c
-+++ b/extensions/libip6t_icmp6.c
-@@ -230,7 +230,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 	type_name = icmp6_type_xlate(icmptype);
- 
- 	if (type_name) {
--		xt_xlate_add(xl, type_name);
-+		xt_xlate_add(xl, "%s", type_name);
- 	} else {
- 		for (i = 0; i < ARRAY_SIZE(icmpv6_codes); ++i)
- 			if (icmpv6_codes[i].type == icmptype &&
-@@ -239,7 +239,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 				break;
- 
- 		if (i != ARRAY_SIZE(icmpv6_codes))
--			xt_xlate_add(xl, icmpv6_codes[i].name);
-+			xt_xlate_add(xl, "%s", icmpv6_codes[i].name);
- 		else
- 			return 0;
- 	}
-diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
-index 5418997668d4c..e76257c54708c 100644
---- a/extensions/libipt_icmp.c
-+++ b/extensions/libipt_icmp.c
-@@ -236,7 +236,7 @@ static unsigned int type_xlate_print(struct xt_xlate *xl, unsigned int icmptype,
- 			if (icmp_codes[i].type == icmptype &&
- 			    icmp_codes[i].code_min == code_min &&
- 			    icmp_codes[i].code_max == code_max) {
--				xt_xlate_add(xl, icmp_codes[i].name);
-+				xt_xlate_add(xl, "%s", icmp_codes[i].name);
- 				return 1;
- 			}
- 	}
--- 
-2.21.0
-
diff --git a/SOURCES/0003-xtables-restore-Avoid-access-of-uninitialized-data.patch b/SOURCES/0003-xtables-restore-Avoid-access-of-uninitialized-data.patch
deleted file mode 100644
index 0af13d3..0000000
--- a/SOURCES/0003-xtables-restore-Avoid-access-of-uninitialized-data.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 5ee8338b9f1b5c02efca1a33185cf648cdf1aa20 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 Dec 2019 11:40:26 +0100
-Subject: [PATCH] xtables-restore: Avoid access of uninitialized data
-
-When flushing, 'buffer' is not written to prior to checking its first
-byte's value. Therefore it needs to be initialized upon declaration.
-
-Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
-(cherry picked from commit 48be21bf39f9af35d53af0e211cbd50dcfd12d08)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/xtables-restore.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index dd907e0b8ddd5..63cc15cee9621 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -281,7 +281,7 @@ void xtables_restore_parse(struct nft_handle *h,
- 			   const struct nft_xt_restore_parse *p)
- {
- 	struct nft_xt_restore_state state = {};
--	char preload_buffer[PREBUFSIZ] = {}, buffer[10240], *ptr;
-+	char preload_buffer[PREBUFSIZ] = {}, buffer[10240] = {}, *ptr;
- 
- 	if (!h->noflush) {
- 		nft_fake_cache(h);
--- 
-2.24.0
-
diff --git a/SOURCES/0003-xtables-translate-Use-proper-clear_cs-function.patch b/SOURCES/0003-xtables-translate-Use-proper-clear_cs-function.patch
new file mode 100644
index 0000000..a66c5d0
--- /dev/null
+++ b/SOURCES/0003-xtables-translate-Use-proper-clear_cs-function.patch
@@ -0,0 +1,30 @@
+From d9497b521e6f512f27bd1d4a88086f50418cb7b8 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 16 Jun 2020 13:06:26 +0200
+Subject: [PATCH] xtables-translate: Use proper clear_cs function
+
+Avoid memleaks by performing a full free of any allocated data in local
+iptables_command_state variable.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 63fa2b1cb98be66990912d7eb42eab5440437087)
+---
+ iptables/xtables-translate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index 363c8be15b3fa..575fb320dc408 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -319,7 +319,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
+ 		exit(1);
+ 	}
+ 
+-	xtables_rule_matches_free(&cs.matches);
++	nft_clear_iptables_command_state(&cs);
+ 
+ 	if (h->family == AF_INET) {
+ 		free(args.s.addr.v4);
+-- 
+2.40.0
+
diff --git a/SOURCES/0004-extensions-time-Avoid-undefined-shift.patch b/SOURCES/0004-extensions-time-Avoid-undefined-shift.patch
deleted file mode 100644
index ad67a3d..0000000
--- a/SOURCES/0004-extensions-time-Avoid-undefined-shift.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From bda4f46d1a474e5cc13712a0302adcf723e3cc5c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 Dec 2019 13:15:01 +0100
-Subject: [PATCH] extensions: time: Avoid undefined shift
-
-Value 1 is signed by default and left-shifting by 31 is undefined for
-those. Fix this by marking the value as unsigned.
-
-Fixes: ad326ef9f734a ("Add the libxt_time iptables match")
-(cherry picked from commit 98b221002960040bf3505811c06025b6b9b6984b)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libxt_time.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/extensions/libxt_time.c b/extensions/libxt_time.c
-index 5a8cc5de13031..d001f5b7f448f 100644
---- a/extensions/libxt_time.c
-+++ b/extensions/libxt_time.c
-@@ -330,7 +330,7 @@ static void time_print_monthdays(uint32_t mask, bool human_readable)
- 
- 	printf(" ");
- 	for (i = 1; i <= 31; ++i)
--		if (mask & (1 << i)) {
-+		if (mask & (1u << i)) {
- 			if (nbdays++ > 0)
- 				printf(",");
- 			printf("%u", i);
--- 
-2.24.0
-
diff --git a/SOURCES/0004-libxtables-compiler-warning-fixes-for-NO_SHARED_LIBS.patch b/SOURCES/0004-libxtables-compiler-warning-fixes-for-NO_SHARED_LIBS.patch
new file mode 100644
index 0000000..8948172
--- /dev/null
+++ b/SOURCES/0004-libxtables-compiler-warning-fixes-for-NO_SHARED_LIBS.patch
@@ -0,0 +1,55 @@
+From 94fcba7825b121cbb7d3ff73f4e80a798feccdee Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Tue, 23 Jun 2020 16:09:02 -0700
+Subject: [PATCH] libxtables: compiler warning fixes for NO_SHARED_LIBS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes two issues with NO_SHARED_LIBS:
+ - #include <dlfcn.h> is ifdef'ed out and thus dlclose()
+   triggers an undeclared function compiler warning
+ - dlreg_add() is unused and thus triggers an unused
+   function warning
+
+Test: builds without warnings
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 6cb8af1ff3951e47def7a16db39289dc9d9c61fe)
+---
+ libxtables/xtables.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/libxtables/xtables.c b/libxtables/xtables.c
+index 7fe42580f9b70..8907ba2069be7 100644
+--- a/libxtables/xtables.c
++++ b/libxtables/xtables.c
+@@ -206,6 +206,7 @@ struct xtables_target *xtables_targets;
+ static bool xtables_fully_register_pending_match(struct xtables_match *me);
+ static bool xtables_fully_register_pending_target(struct xtables_target *me);
+ 
++#ifndef NO_SHARED_LIBS
+ /* registry for loaded shared objects to close later */
+ struct dlreg {
+ 	struct dlreg *next;
+@@ -237,6 +238,7 @@ static void dlreg_free(void)
+ 		dlreg = next;
+ 	}
+ }
++#endif
+ 
+ void xtables_init(void)
+ {
+@@ -267,7 +269,9 @@ void xtables_init(void)
+ 
+ void xtables_fini(void)
+ {
++#ifndef NO_SHARED_LIBS
+ 	dlreg_free();
++#endif
+ }
+ 
+ void xtables_set_nfproto(uint8_t nfproto)
+-- 
+2.40.0
+
diff --git a/SOURCES/0005-extensions-cluster-Avoid-undefined-shift.patch b/SOURCES/0005-extensions-cluster-Avoid-undefined-shift.patch
deleted file mode 100644
index 576db90..0000000
--- a/SOURCES/0005-extensions-cluster-Avoid-undefined-shift.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 45aacdc1bbb3a889d9820c1fb587dc8df3cae763 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 Dec 2019 13:36:31 +0100
-Subject: [PATCH] extensions: cluster: Avoid undefined shift
-
-Value 1 is signed by default and left-shifting by 31 is undefined for
-those. Fix this by marking the value as unsigned.
-
-Fixes: 64a0e09894e52 ("extensions: libxt_cluster: Add translation to nft")
-(cherry picked from commit 28c16371cdad16707674450b59919e3d97185694)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libxt_cluster.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c
-index c9c35ee22e3df..d164bf6960166 100644
---- a/extensions/libxt_cluster.c
-+++ b/extensions/libxt_cluster.c
-@@ -156,7 +156,7 @@ static int cluster_xlate(struct xt_xlate *xl,
- 		xt_xlate_add(xl, "%s %u seed 0x%08x ", jhash_st,
- 				info->total_nodes, info->hash_seed);
- 		for (node = 0; node < 32; node++) {
--			if (info->node_mask & (1 << node)) {
-+			if (info->node_mask & (1u << node)) {
- 				if (needs_set == 0) {
- 					xt_xlate_add(xl, "{ ");
- 					needs_set = 1;
--- 
-2.24.0
-
diff --git a/SOURCES/0005-extensions-libxt_conntrack-provide-translation-for-D.patch b/SOURCES/0005-extensions-libxt_conntrack-provide-translation-for-D.patch
new file mode 100644
index 0000000..0131684
--- /dev/null
+++ b/SOURCES/0005-extensions-libxt_conntrack-provide-translation-for-D.patch
@@ -0,0 +1,63 @@
+From 0323122f6a3ef9ab2ded571685d3c64851c6df86 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Wed, 22 Jul 2020 13:04:34 +0200
+Subject: [PATCH] extensions: libxt_conntrack: provide translation for DNAT and
+ SNAT --ctstate
+
+iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
+nft add rule ip filter INPUT ct status dnat counter accept
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 26ec09bf6b9b674a7e3a65fc9c12599bd81dfe0f)
+---
+ extensions/libxt_conntrack.c      | 18 +++++++++++++-----
+ extensions/libxt_conntrack.txlate |  7 +++++++
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
+index 6f3503933e664..7734509c9af84 100644
+--- a/extensions/libxt_conntrack.c
++++ b/extensions/libxt_conntrack.c
+@@ -1249,11 +1249,19 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ 	}
+ 
+ 	if (sinfo->match_flags & XT_CONNTRACK_STATE) {
+-		xt_xlate_add(xl, "%sct state %s", space,
+-			     sinfo->invert_flags & XT_CONNTRACK_STATE ?
+-			     "!= " : "");
+-		state_xlate_print(xl, sinfo->state_mask);
+-		space = " ";
++		if ((sinfo->state_mask & XT_CONNTRACK_STATE_SNAT) ||
++		    (sinfo->state_mask & XT_CONNTRACK_STATE_DNAT)) {
++			xt_xlate_add(xl, "%sct status %s%s", space,
++				     sinfo->invert_flags & XT_CONNTRACK_STATUS ? "!=" : "",
++				     sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
++			space = " ";
++		} else {
++			xt_xlate_add(xl, "%sct state %s", space,
++				     sinfo->invert_flags & XT_CONNTRACK_STATE ?
++				     "!= " : "");
++			state_xlate_print(xl, sinfo->state_mask);
++			space = " ";
++		}
+ 	}
+ 
+ 	if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
+diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
+index 8a3d0181c71ef..d374f8a035f00 100644
+--- a/extensions/libxt_conntrack.txlate
++++ b/extensions/libxt_conntrack.txlate
+@@ -42,3 +42,10 @@ nft add rule ip filter INPUT ct direction original counter accept
+ 
+ iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW --ctproto tcp --ctorigsrc 192.168.0.1 --ctorigdst 192.168.0.1 --ctreplsrc 192.168.0.1 --ctrepldst 192.168.0.1 --ctorigsrcport 12 --ctorigdstport 14 --ctreplsrcport 16 --ctrepldstport 18 --ctexpire 10 --ctstatus SEEN_REPLY --ctdir ORIGINAL -j ACCEPT
+ nft add rule ip filter INPUT ct direction original ct original protocol 6 ct state new ct status seen-reply ct expiration 10 ct original saddr 192.168.0.1 ct original daddr 192.168.0.1 ct reply saddr 192.168.0.1 ct reply daddr 192.168.0.1 ct original proto-src 12 ct original proto-dst 14 ct reply proto-src 16 ct reply proto-dst 18 counter accept
++
++iptables-translate -t filter -A INPUT -m conntrack --ctstate SNAT -j ACCEPT
++nft add rule ip filter INPUT ct status snat counter accept
++
++iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
++nft add rule ip filter INPUT ct status dnat counter accept
++
+-- 
+2.40.0
+
diff --git a/SOURCES/0006-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch b/SOURCES/0006-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch
deleted file mode 100644
index 6b03afa..0000000
--- a/SOURCES/0006-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From d3641eaed9ad19b74f3bababb3db53af0004488b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 Dec 2019 13:57:18 +0100
-Subject: [PATCH] libxtables: Avoid buffer overrun in
- xtables_compatible_revision()
-
-The function is exported and accepts arbitrary strings as input. Calling
-strcpy() without length checks is not OK.
-
-(cherry picked from commit f7d3dbb82e7ed94ccbf10cf70a3c7b3f3aaef1a1)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- libxtables/xtables.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 895f6988eaf57..777c2b08e9896 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -856,7 +856,8 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt)
- 
- 	xtables_load_ko(xtables_modprobe_program, true);
- 
--	strcpy(rev.name, name);
-+	strncpy(rev.name, name, XT_EXTENSION_MAXNAMELEN - 1);
-+	rev.name[XT_EXTENSION_MAXNAMELEN - 1] = '\0';
- 	rev.revision = revision;
- 
- 	max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s);
--- 
-2.24.0
-
diff --git a/SOURCES/0006-nft-Drop-pointless-nft_xt_builtin_init-call.patch b/SOURCES/0006-nft-Drop-pointless-nft_xt_builtin_init-call.patch
new file mode 100644
index 0000000..eded898
--- /dev/null
+++ b/SOURCES/0006-nft-Drop-pointless-nft_xt_builtin_init-call.patch
@@ -0,0 +1,30 @@
+From 13abbdd7789da8616a903b5b8dc5ff69fb2af2c7 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 10 Jul 2020 21:12:34 +0200
+Subject: [PATCH] nft: Drop pointless nft_xt_builtin_init() call
+
+When renaming a chain, either everything is in place already or the
+command will bail anyway. So just drop this superfluous call.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 7a700c47fe121c65c550ab24de3284abbb1e82f8)
+---
+ iptables/nft.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 0c5a74fc232c6..e795d4ae6d241 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1934,8 +1934,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
+ 		return 0;
+ 	}
+ 
+-	nft_xt_builtin_init(h, table);
+-
+ 	/* Config load changed errno. Ensure genuine info for our callers. */
+ 	errno = 0;
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0041-nft-Fix-command-name-in-ip6tables-error-message.patch b/SOURCES/0007-nft-Fix-command-name-in-ip6tables-error-message.patch
similarity index 84%
rename from SOURCES/0041-nft-Fix-command-name-in-ip6tables-error-message.patch
rename to SOURCES/0007-nft-Fix-command-name-in-ip6tables-error-message.patch
index 3a57697..40b80f2 100644
--- a/SOURCES/0041-nft-Fix-command-name-in-ip6tables-error-message.patch
+++ b/SOURCES/0007-nft-Fix-command-name-in-ip6tables-error-message.patch
@@ -1,4 +1,4 @@
-From 6d8a390bd13bac294ff9de225a49fe9e4de2d6e5 Mon Sep 17 00:00:00 2001
+From a58c38e4c579f409669b5ab82d3b039528a129af Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 7 Aug 2020 13:48:28 +0200
 Subject: [PATCH] nft: Fix command name in ip6tables error message
@@ -12,17 +12,16 @@ one.
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
 (cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/xtables-standalone.c | 12 ++++--------
  1 file changed, 4 insertions(+), 8 deletions(-)
 
 diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
-index 022d5dd44abbf..b5b7ccaf4e660 100644
+index dd6fb7919d2e1..7b71db62f1ea6 100644
 --- a/iptables/xtables-standalone.c
 +++ b/iptables/xtables-standalone.c
-@@ -74,14 +74,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
- 	nft_fini(&h);
+@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
+ 	xtables_fini();
  
  	if (!ret) {
 -		if (errno == EINVAL) {
@@ -41,5 +40,5 @@ index 022d5dd44abbf..b5b7ccaf4e660 100644
  			exit(RESOURCE_PROBLEM);
  	}
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch b/SOURCES/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch
deleted file mode 100644
index 5ef2d9e..0000000
--- a/SOURCES/0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From 5fe54ca701a38e283faf840903e9ed20eba8a6f4 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 Dec 2019 16:01:29 +0100
-Subject: [PATCH] xtables-translate: Guard strcpy() call in xlate_ifname()
-
-The function potentially fed overlong strings to strcpy(). Given that
-everything needed to avoid this is there, reorder code a bit to prevent
-those inputs, too.
-
-Fixes: 0ddd663e9c167 ("iptables-translate: add in/out ifname wildcard match translation to nft")
-(cherry picked from commit 2861bdbbf062071487a49103513d129ce40e2652)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/xtables-translate.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index a42c60a3b64c6..77a186b905d73 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -32,14 +32,13 @@
- void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
- 		  bool invert)
- {
-+	int ifaclen = strlen(ifname);
- 	char iface[IFNAMSIZ];
--	int ifaclen;
- 
--	if (ifname[0] == '\0')
-+	if (ifaclen < 1 || ifaclen >= IFNAMSIZ)
- 		return;
- 
- 	strcpy(iface, ifname);
--	ifaclen = strlen(iface);
- 	if (iface[ifaclen - 1] == '+')
- 		iface[ifaclen - 1] = '*';
- 
--- 
-2.24.0
-
diff --git a/SOURCES/0008-extensions-among-Check-call-to-fstat.patch b/SOURCES/0008-extensions-among-Check-call-to-fstat.patch
deleted file mode 100644
index 8d6bd90..0000000
--- a/SOURCES/0008-extensions-among-Check-call-to-fstat.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 3a4d59e5cb35cf2395cfd8004dd16d45dd889e11 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 Dec 2019 16:35:51 +0100
-Subject: [PATCH] extensions: among: Check call to fstat()
-
-If this fails, a bogus length value may be passed to mmap().
-
-Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
-(cherry picked from commit 25b38bcbf2fdc019f438805c7d1ecd877af9c968)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libebt_among.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
-index 2e87db3bc06fa..715d559f432c2 100644
---- a/extensions/libebt_among.c
-+++ b/extensions/libebt_among.c
-@@ -6,6 +6,7 @@
-  * August, 2003
-  */
- 
-+#include <errno.h>
- #include <ctype.h>
- #include <fcntl.h>
- #include <getopt.h>
-@@ -137,7 +138,10 @@ static int bramong_parse(int c, char **argv, int invert,
- 		if ((fd = open(optarg, O_RDONLY)) == -1)
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "Couldn't open file '%s'", optarg);
--		fstat(fd, &stats);
-+		if (fstat(fd, &stats) < 0)
-+			xtables_error(PARAMETER_PROBLEM,
-+				      "fstat(%s) failed: '%s'",
-+				      optarg, strerror(errno));
- 		flen = stats.st_size;
- 		/* use mmap because the file will probably be big */
- 		optarg = mmap(0, flen, PROT_READ | PROT_WRITE,
--- 
-2.24.0
-
diff --git a/SOURCES/0042-tests-shell-Merge-and-extend-return-codes-test.patch b/SOURCES/0008-tests-shell-Merge-and-extend-return-codes-test.patch
similarity index 89%
rename from SOURCES/0042-tests-shell-Merge-and-extend-return-codes-test.patch
rename to SOURCES/0008-tests-shell-Merge-and-extend-return-codes-test.patch
index 93ce99a..166b335 100644
--- a/SOURCES/0042-tests-shell-Merge-and-extend-return-codes-test.patch
+++ b/SOURCES/0008-tests-shell-Merge-and-extend-return-codes-test.patch
@@ -1,4 +1,4 @@
-From c5f07a7d718f812f916686926567adbac6c1b125 Mon Sep 17 00:00:00 2001
+From 529dee8412eb216a2432e063136ede732edb9cc1 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Thu, 6 Aug 2020 18:52:34 +0200
 Subject: [PATCH] tests: shell: Merge and extend return codes test
@@ -11,26 +11,18 @@ are deliberately ignored.
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
 (cherry picked from commit cd3e83d1b04fd2683f0fb06e496ee5be08a96b4f)
-
-Conflicts:
-	iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
-	iptables/tests/shell/testcases/iptables/0004-return-codes_0
--> Missing upstream commit a7f1e208cdf9c ("nft: split parsing from
-   netlink commands") which added a few tests to both files.
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
- .../testcases/ip6tables/0004-return-codes_0   |  38 -------
- .../testcases/iptables/0004-return-codes_0    | 104 ++++++++++--------
- 2 files changed, 58 insertions(+), 84 deletions(-)
+ .../testcases/ip6tables/0004-return-codes_0   |  39 ------
+ .../testcases/iptables/0004-return-codes_0    | 113 ++++++++++--------
+ 2 files changed, 61 insertions(+), 91 deletions(-)
  delete mode 100755 iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
 
 diff --git a/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0 b/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
 deleted file mode 100755
-index f023b7915498e..0000000000000
+index c583b0ebd97c3..0000000000000
 --- a/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
 +++ /dev/null
-@@ -1,38 +0,0 @@
+@@ -1,39 +0,0 @@
 -#!/bin/sh
 -
 -# make sure error return codes are as expected useful cases
@@ -59,6 +51,7 @@ index f023b7915498e..0000000000000
 -# test rule adding
 -cmd 0 ip6tables -A INPUT -j ACCEPT
 -cmd 1 ip6tables -A noexist -j ACCEPT
+-cmd 2 ip6tables -I INPUT -j foobar
 -
 -# test rule checking
 -cmd 0 ip6tables -C INPUT -j ACCEPT
@@ -70,10 +63,10 @@ index f023b7915498e..0000000000000
 -
 -exit $global_rc
 diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
-index ce02e0bcb128b..67f1698945753 100755
+index f730bede1f612..dcd9dfd3c0806 100755
 --- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
 +++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
-@@ -13,69 +13,81 @@ cmd() { # (rc, msg, cmd, [args ...])
+@@ -13,75 +13,84 @@ cmd() { # (rc, msg, cmd, [args ...])
  		msg_exp="$1"; shift
  	}
  
@@ -149,12 +142,21 @@ index ce02e0bcb128b..67f1698945753 100755
  # test chain rename
 -cmd 0 iptables -E foo bar
 -cmd 1 "$EEXIST_F" iptables -E foo bar
+-cmd 1 "$ENOENT" iptables -E foo bar2
+-cmd 0 iptables -N foo2
+-cmd 1 "$EEXIST_F" iptables -E foo2 bar
 +cmd 0 -E foo bar
 +cmd 1 "$EEXIST_F" -E foo bar
++cmd 1 "$ENOENT" -E foo bar2
++cmd 0 -N foo2
++cmd 1 "$EEXIST_F" -E foo2 bar
  
  # test rule adding
 -cmd 0 iptables -A INPUT -j ACCEPT
 -cmd 1 "$ENOENT" iptables -A noexist -j ACCEPT
+-cmd 2 "" iptables -I INPUT -j foobar
+-cmd 2 "" iptables -R INPUT 1 -j foobar
+-cmd 2 "" iptables -D INPUT -j foobar
 +cmd 0 -A INPUT -j ACCEPT
 +cmd 1 "$ENOENT" -A noexist -j ACCEPT
 +# next three differ:
@@ -202,5 +204,5 @@ index ce02e0bcb128b..67f1698945753 100755
  
  exit $global_rc
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0009-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch b/SOURCES/0009-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch
deleted file mode 100644
index 1842162..0000000
--- a/SOURCES/0009-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From fe1ac5eaa8ae482c9112aed6b89f9f2e529f4516 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <psutter@redhat.com>
-Date: Tue, 10 Dec 2019 12:27:13 +0100
-Subject: [PATCH] uapi: netfilter: Avoid undefined left-shift in xt_sctp.h
-
-This is a backport of kernel commit 164166558aace ("netfilter: uapi:
-Avoid undefined left-shift in xt_sctp.h").
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- include/linux/netfilter/xt_sctp.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/include/linux/netfilter/xt_sctp.h b/include/linux/netfilter/xt_sctp.h
-index a501e6196905d..5b28525a2482a 100644
---- a/include/linux/netfilter/xt_sctp.h
-+++ b/include/linux/netfilter/xt_sctp.h
-@@ -40,19 +40,19 @@ struct xt_sctp_info {
- #define SCTP_CHUNKMAP_SET(chunkmap, type) 		\
- 	do { 						\
- 		(chunkmap)[type / bytes(__u32)] |= 	\
--			1 << (type % bytes(__u32));	\
-+			1u << (type % bytes(__u32));	\
- 	} while (0)
- 
- #define SCTP_CHUNKMAP_CLEAR(chunkmap, type)		 	\
- 	do {							\
- 		(chunkmap)[type / bytes(__u32)] &= 		\
--			~(1 << (type % bytes(__u32)));	\
-+			~(1u << (type % bytes(__u32)));	\
- 	} while (0)
- 
- #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) 			\
- ({								\
- 	((chunkmap)[type / bytes (__u32)] & 		\
--		(1 << (type % bytes (__u32)))) ? 1: 0;	\
-+		(1u << (type % bytes (__u32)))) ? 1: 0;	\
- })
- 
- #define SCTP_CHUNKMAP_RESET(chunkmap) \
--- 
-2.24.0
-
diff --git a/SOURCES/0044-xtables-monitor-Fix-ip6tables-rule-printing.patch b/SOURCES/0009-xtables-monitor-Fix-ip6tables-rule-printing.patch
similarity index 88%
rename from SOURCES/0044-xtables-monitor-Fix-ip6tables-rule-printing.patch
rename to SOURCES/0009-xtables-monitor-Fix-ip6tables-rule-printing.patch
index c0f14d7..42646cd 100644
--- a/SOURCES/0044-xtables-monitor-Fix-ip6tables-rule-printing.patch
+++ b/SOURCES/0009-xtables-monitor-Fix-ip6tables-rule-printing.patch
@@ -1,4 +1,4 @@
-From 538acaef0d8424bd61047e6f1b81e3bc8bd421ec Mon Sep 17 00:00:00 2001
+From fe5db6f78145aeac1b18d21c38c178b99cd7c04a Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 7 Aug 2020 16:42:07 +0200
 Subject: [PATCH] xtables-monitor: Fix ip6tables rule printing
@@ -15,13 +15,12 @@ Fix this by performing a family lookup each time rule_cb is called.
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
 (cherry picked from commit ca69b0290dc509d72118f0a054a5c740cb913875)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/xtables-monitor.c | 2 ++
  1 file changed, 2 insertions(+)
 
 diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index c2b31dbaa0795..92962a2a95f48 100644
+index 57def83e2eea0..4008cc00d4694 100644
 --- a/iptables/xtables-monitor.c
 +++ b/iptables/xtables-monitor.c
 @@ -93,6 +93,8 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
@@ -34,5 +33,5 @@ index c2b31dbaa0795..92962a2a95f48 100644
  		printf(" EVENT: ");
  	switch (family) {
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0010-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch b/SOURCES/0010-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
new file mode 100644
index 0000000..01ca6c6
--- /dev/null
+++ b/SOURCES/0010-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
@@ -0,0 +1,39 @@
+From 895077fbd8f11b717fd414a02d22dae99d94b390 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 29 Jul 2020 15:39:31 +0200
+Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
+
+Athough this cache level fetches table names only, it shouldn't skip the
+consistency check.
+
+Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
+---
+ iptables/nft-cache.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 638b18bc7e382..434cc10b82ce7 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -511,14 +511,14 @@ __nft_build_cache(struct nft_handle *h)
+ 	if (req->level >= NFT_CL_TABLES)
+ 		fetch_table_cache(h);
+ 	if (req->level == NFT_CL_FAKE)
+-		return;
++		goto genid_check;
+ 	if (req->level >= NFT_CL_CHAINS)
+ 		fetch_chain_cache(h, t, chains);
+ 	if (req->level >= NFT_CL_SETS)
+ 		fetch_set_cache(h, t, NULL);
+ 	if (req->level >= NFT_CL_RULES)
+ 		fetch_rule_cache(h, t);
+-
++genid_check:
+ 	mnl_genid_get(h, &genid_check);
+ 	if (h->nft_genid != genid_check) {
+ 		flush_cache(h, h->cache, NULL);
+-- 
+2.40.0
+
diff --git a/SOURCES/0010-xtables-translate-Fix-for-interface-name-corner-case.patch b/SOURCES/0010-xtables-translate-Fix-for-interface-name-corner-case.patch
deleted file mode 100644
index a1bc86c..0000000
--- a/SOURCES/0010-xtables-translate-Fix-for-interface-name-corner-case.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From da36213a48f6114ab998a5fb37bae61d2a02d5f6 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 6 Feb 2020 15:08:41 +0100
-Subject: [PATCH] xtables-translate: Fix for interface name corner-cases
-
-There are two special situations xlate_ifname() didn't cover for:
-
-* Interface name containing '*': This went unchanged, creating a command
-  nft wouldn't accept. Instead translate into '\*' which doesn't change
-  semantics.
-
-* Interface name being '+': Can't translate into nft wildcard character
-  as nft doesn't accept asterisk-only interface names. Instead decide
-  what to do based on 'invert' value: Skip match creation if false,
-  match against an invalid interface name if true.
-
-Also add a test to make sure future changes to this behaviour are
-noticed.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit e179e87a1179e272a9bdabb0220b17d61d099ee3)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/generic.txlate    | 12 ++++++++++++
- iptables/xtables-translate.c | 33 ++++++++++++++++++++++++++++-----
- 2 files changed, 40 insertions(+), 5 deletions(-)
-
-diff --git a/extensions/generic.txlate b/extensions/generic.txlate
-index b38fbd1fe113b..c92d082abea78 100644
---- a/extensions/generic.txlate
-+++ b/extensions/generic.txlate
-@@ -18,3 +18,15 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi
- 
- ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
- nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
-+
-+# asterisk is not special in iptables and it is even a valid interface name
-+iptables-translate -A FORWARD -i '*' -o 'eth*foo'
-+nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
-+
-+# skip for always matching interface names
-+iptables-translate -A FORWARD -i '+'
-+nft add rule ip filter FORWARD counter
-+
-+# match against invalid interface name to simulate never matching rule
-+iptables-translate -A FORWARD ! -i '+'
-+nft add rule ip filter FORWARD iifname "INVAL/D" counter
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index 77a186b905d73..c4e177c0d63ba 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -32,15 +32,38 @@
- void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
- 		  bool invert)
- {
--	int ifaclen = strlen(ifname);
--	char iface[IFNAMSIZ];
-+	int ifaclen = strlen(ifname), i, j;
-+	char iface[IFNAMSIZ * 2];
- 
- 	if (ifaclen < 1 || ifaclen >= IFNAMSIZ)
- 		return;
- 
--	strcpy(iface, ifname);
--	if (iface[ifaclen - 1] == '+')
--		iface[ifaclen - 1] = '*';
-+	for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
-+		switch (ifname[i]) {
-+		case '+':
-+			iface[j] = '*';
-+			break;
-+		case '*':
-+			iface[j++] = '\\';
-+			/* fall through */
-+		default:
-+			iface[j] = ifname[i];
-+			break;
-+		}
-+	}
-+
-+	if (ifaclen == 1 && ifname[0] == '+') {
-+		/* Nftables does not support wildcard only string. Workaround
-+		 * is easy, given that this will match always or never
-+		 * depending on 'invert' value. To match always, simply don't
-+		 * generate an expression. To match never, use an invalid
-+		 * interface name (kernel doesn't accept '/' in names) to match
-+		 * against. */
-+		if (!invert)
-+			return;
-+		strcpy(iface, "INVAL/D");
-+		invert = false;
-+	}
- 
- 	xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface);
- }
--- 
-2.24.1
-
diff --git a/SOURCES/0031-nft-Fix-for-broken-address-mask-match-detection.patch b/SOURCES/0011-nft-Fix-for-broken-address-mask-match-detection.patch
similarity index 92%
rename from SOURCES/0031-nft-Fix-for-broken-address-mask-match-detection.patch
rename to SOURCES/0011-nft-Fix-for-broken-address-mask-match-detection.patch
index 3f69e13..7a0fb26 100644
--- a/SOURCES/0031-nft-Fix-for-broken-address-mask-match-detection.patch
+++ b/SOURCES/0011-nft-Fix-for-broken-address-mask-match-detection.patch
@@ -1,4 +1,4 @@
-From 74a62264d4615ae7f76454e7ca406c46a62c7999 Mon Sep 17 00:00:00 2001
+From ba2da85b5a8940035f57dd395205c726c0c68ec7 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 28 Sep 2020 18:57:18 +0200
 Subject: [PATCH] nft: Fix for broken address mask match detection
@@ -37,13 +37,12 @@ Fix the cast, safe an extra op and gain 100% performance in ideal cases.
 Fixes: 56859380eb328 ("xtables-compat: avoid unneeded bitwise ops")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 72ed608bf1ea550ac13b5b880afc7ad3ffa0afd0)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft-shared.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 78e422781723f..f60f5df97fb86 100644
+index c5a8f3fcc051d..7741d23befc5a 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
 @@ -165,7 +165,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
@@ -56,5 +55,5 @@ index 78e422781723f..f60f5df97fb86 100644
  
  	add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0011-xtables-translate-Fix-for-iface.patch b/SOURCES/0011-xtables-translate-Fix-for-iface.patch
deleted file mode 100644
index 5971ec1..0000000
--- a/SOURCES/0011-xtables-translate-Fix-for-iface.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 1e1fda9ac0a809c64fd13b4fb759becac824809e Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 13 Feb 2020 14:01:50 +0100
-Subject: [PATCH] xtables-translate: Fix for iface++
-
-In legacy iptables, only the last plus sign remains special, any
-previous ones are taken literally. Therefore xtables-translate must not
-replace all of them with asterisk but just the last one.
-
-Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 94488d4eb912f5af4c88d148b39b38eb8a3c1f0b)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/generic.txlate    | 4 ++++
- iptables/xtables-translate.c | 6 +++---
- 2 files changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/generic.txlate b/extensions/generic.txlate
-index c92d082abea78..0e256c3727559 100644
---- a/extensions/generic.txlate
-+++ b/extensions/generic.txlate
-@@ -23,6 +23,10 @@ nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:
- iptables-translate -A FORWARD -i '*' -o 'eth*foo'
- nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
- 
-+# escape all asterisks but translate only the first plus character
-+iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
-+nft add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter
-+
- # skip for always matching interface names
- iptables-translate -A FORWARD -i '+'
- nft add rule ip filter FORWARD counter
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index c4e177c0d63ba..0f95855b41aa4 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -40,9 +40,6 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
- 
- 	for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
- 		switch (ifname[i]) {
--		case '+':
--			iface[j] = '*';
--			break;
- 		case '*':
- 			iface[j++] = '\\';
- 			/* fall through */
-@@ -65,6 +62,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
- 		invert = false;
- 	}
- 
-+	if (iface[j - 2] == '+')
-+		iface[j - 2] = '*';
-+
- 	xt_xlate_add(xl, "%s %s\"%s\" ", nftmeta, invert ? "!= " : "", iface);
- }
- 
--- 
-2.24.1
-
diff --git a/SOURCES/0039-extensions-libipt_icmp-Fix-translation-of-type-any.patch b/SOURCES/0012-extensions-libipt_icmp-Fix-translation-of-type-any.patch
similarity index 94%
rename from SOURCES/0039-extensions-libipt_icmp-Fix-translation-of-type-any.patch
rename to SOURCES/0012-extensions-libipt_icmp-Fix-translation-of-type-any.patch
index c1c430d..4a2cbe8 100644
--- a/SOURCES/0039-extensions-libipt_icmp-Fix-translation-of-type-any.patch
+++ b/SOURCES/0012-extensions-libipt_icmp-Fix-translation-of-type-any.patch
@@ -1,4 +1,4 @@
-From 6adcdca2aaf8cba6ee452c88f41ad8695bebdcfc Mon Sep 17 00:00:00 2001
+From e674863343bf3233d2d1cdd9e17adad5381796a9 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 6 Oct 2020 19:07:19 +0200
 Subject: [PATCH] extensions: libipt_icmp: Fix translation of type 'any'
@@ -14,7 +14,6 @@ Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Reviewed-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit ad4b17b98bbedf93d2182a4dc9a37e9cf3adfe1b)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  extensions/libipt_icmp.c      | 5 +++++
  extensions/libipt_icmp.txlate | 3 +++
@@ -48,5 +47,5 @@ index 434f8cc4eb1ae..a2aec8e26df75 100644
 +iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
 +nft add rule ip filter INPUT ip protocol icmp counter accept
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0012-tests-shell-Fix-skip-checks-with-host-mode.patch b/SOURCES/0012-tests-shell-Fix-skip-checks-with-host-mode.patch
deleted file mode 100644
index 4501a92..0000000
--- a/SOURCES/0012-tests-shell-Fix-skip-checks-with-host-mode.patch
+++ /dev/null
@@ -1,366 +0,0 @@
-From bbd2dd9ee6db7d11ab5b2b10a63b3dfd8b8acc9d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 12 Feb 2020 21:26:06 +0100
-Subject: [PATCH] tests: shell: Fix skip checks with --host mode
-
-When testing host binaries, XT_MULTI variable contains just the program
-name without path component which most skip checks didn't expect. Fix
-them, and while being at it also reduce indenting level in two scripts
-by moving the skip check up front with an early exit call.
-
-Fixes: 416898e335322 ("tests/shell: Support testing host binaries")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 2b2b7948c1960ba4680677664ff58477be869de6)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- .../arptables/0001-arptables-save-restore_0   |   2 +-
- .../0002-arptables-restore-defaults_0         |   2 +-
- .../arptables/0003-arptables-verbose-output_0 |   2 +-
- .../testcases/ebtables/0001-ebtables-basic_0  | 135 +++++++++---------
- .../ebtables/0002-ebtables-save-restore_0     |   2 +-
- .../ebtables/0003-ebtables-restore-defaults_0 |   2 +-
- .../testcases/ebtables/0004-save-counters_0   |   2 +-
- .../testcases/ebtables/0005-ifnamechecks_0    |   2 +-
- .../firewalld-restore/0001-firewalld_0        |   2 +-
- .../testcases/ipt-restore/0004-restore-race_0 |   2 +-
- .../shell/testcases/nft-only/0001compat_0     |  15 +-
- .../shell/testcases/nft-only/0002invflags_0   |   2 +-
- .../nft-only/0003delete-with-comment_0        |   2 +-
- 13 files changed, 88 insertions(+), 84 deletions(-)
-
-diff --git a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0 b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
-index bf04dc0a3e15a..e64e9142ee98b 100755
---- a/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
-+++ b/iptables/tests/shell/testcases/arptables/0001-arptables-save-restore_0
-@@ -4,7 +4,7 @@ set -e
- #set -x
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- # fill arptables manually
- 
-diff --git a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0 b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
-index 38d387f327ebb..afd0fcb460d85 100755
---- a/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
-+++ b/iptables/tests/shell/testcases/arptables/0002-arptables-restore-defaults_0
-@@ -3,7 +3,7 @@
- set -e
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- # arptables-restore reuses preloaded targets and matches, make sure defaults
- # apply to consecutive rules using the same target/match as a previous one
-diff --git a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0 b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
-index 10c5ec33ada2c..952cfa7898371 100755
---- a/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
-+++ b/iptables/tests/shell/testcases/arptables/0003-arptables-verbose-output_0
-@@ -4,7 +4,7 @@ set -e
- set -x
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- $XT_MULTI arptables -N foo
- 
-diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-index c7f24a383f698..0c1eb4ca66f52 100755
---- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-@@ -1,86 +1,89 @@
- #!/bin/sh
- 
-+case "$XT_MULTI" in
-+*xtables-nft-multi)
-+	;;
-+*)
-+	echo "skip $XT_MULTI"
-+	exit 0
-+	;;
-+esac
-+
- get_entries_count() { # (chain)
- 	$XT_MULTI ebtables -L $1 | sed -n 's/.*entries: \([0-9]*\).*/\1/p'
- }
- 
- set -x
--case "$XT_MULTI" in
--*/xtables-nft-multi)
--	for t in filter nat;do
--		$XT_MULTI ebtables -t $t -L || exit 1
--		$XT_MULTI ebtables -t $t -X || exit 1
--		$XT_MULTI ebtables -t $t -F || exit 1
--	done
--
--	for t in broute foobar ;do
--		$XT_MULTI ebtables -t $t -L &&
--		$XT_MULTI ebtables -t $t -X &&
--		$XT_MULTI ebtables -t $t -F
--		if [ $? -eq 0 ]; then
--			echo "Expect nonzero return for unsupported table"
--			exit 1
--		fi
--	done
- 
-+for t in filter nat;do
-+	$XT_MULTI ebtables -t $t -L || exit 1
-+	$XT_MULTI ebtables -t $t -X || exit 1
-+	$XT_MULTI ebtables -t $t -F || exit 1
-+done
- 
--	$XT_MULTI ebtables -t filter -N FOO || exit 1
--	$XT_MULTI ebtables -t filter -N FOO
-+for t in broute foobar ;do
-+	$XT_MULTI ebtables -t $t -L &&
-+	$XT_MULTI ebtables -t $t -X &&
-+	$XT_MULTI ebtables -t $t -F
- 	if [ $? -eq 0 ]; then
--		echo "Duplicate chain FOO"
--		$XT_MULTI ebtables -t filter -L
-+		echo "Expect nonzero return for unsupported table"
- 		exit 1
- 	fi
-+done
- 
--	entries=$(get_entries_count FOO)
--	if [ $entries -ne 0 ]; then
--		echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
--		$XT_MULTI ebtables -L
--		exit 1
--	fi
- 
--	$XT_MULTI ebtables -A FORWARD -j FOO
--	entries=$(get_entries_count FORWARD)
--	if [ $entries -ne 1 ]; then
--		echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
--		$XT_MULTI ebtables -L
--		exit 1
--	fi
-+$XT_MULTI ebtables -t filter -N FOO || exit 1
-+$XT_MULTI ebtables -t filter -N FOO
-+if [ $? -eq 0 ]; then
-+	echo "Duplicate chain FOO"
-+	$XT_MULTI ebtables -t filter -L
-+	exit 1
-+fi
- 
--	entries=$(get_entries_count FOO)
--	if [ $entries -ne 0 ]; then
--		echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
--		$XT_MULTI ebtables -L
--		exit 1
--	fi
-+entries=$(get_entries_count FOO)
-+if [ $entries -ne 0 ]; then
-+	echo "Unexpected entries count in empty unreferenced chain (expected 0, have $entries)"
-+	$XT_MULTI ebtables -L
-+	exit 1
-+fi
- 
--	$XT_MULTI ebtables -A FOO -j ACCEPT
--	entries=$(get_entries_count FOO)
--	if [ $entries -ne 1 ]; then
--		echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
--		$XT_MULTI ebtables -L
--		exit 1
--	fi
-+$XT_MULTI ebtables -A FORWARD -j FOO
-+entries=$(get_entries_count FORWARD)
-+if [ $entries -ne 1 ]; then
-+	echo "Unexpected entries count in FORWARD chain (expected 1, have $entries)"
-+	$XT_MULTI ebtables -L
-+	exit 1
-+fi
- 
--	$XT_MULTI ebtables -t filter -N BAR || exit 1
--	$XT_MULTI ebtables -t filter -N BAZ || exit 1
-+entries=$(get_entries_count FOO)
-+if [ $entries -ne 0 ]; then
-+	echo "Unexpected entries count in empty referenced chain (expected 0, have $entries)"
-+	$XT_MULTI ebtables -L
-+	exit 1
-+fi
- 
--	$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
--	$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
--	$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
-+$XT_MULTI ebtables -A FOO -j ACCEPT
-+entries=$(get_entries_count FOO)
-+if [ $entries -ne 1 ]; then
-+	echo "Unexpected entries count in non-empty referenced chain (expected 1, have $entries)"
-+	$XT_MULTI ebtables -L
-+	exit 1
-+fi
- 
--	$XT_MULTI ebtables -t filter -L BAZ || exit 1
--	$XT_MULTI ebtables -t filter -X BAZ || exit 1
--	$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
--	if [ $? -eq 0 ]; then
--		echo "Deleted chain -L BAZ ok, expected failure"
--		$XT_MULTI ebtables -t filter -L
--		exit 1
--	fi
-+$XT_MULTI ebtables -t filter -N BAR || exit 1
-+$XT_MULTI ebtables -t filter -N BAZ || exit 1
- 
--	$XT_MULTI ebtables -t $t -F || exit 0
--	;;
--*)
--	echo "skip $XT_MULTI"
--	;;
--esac
-+$XT_MULTI ebtables -t filter -L | grep -q FOO || exit 1
-+$XT_MULTI ebtables -t filter -L | grep -q BAR || exit 1
-+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
-+
-+$XT_MULTI ebtables -t filter -L BAZ || exit 1
-+$XT_MULTI ebtables -t filter -X BAZ || exit 1
-+$XT_MULTI ebtables -t filter -L BAZ | grep -q BAZ
-+if [ $? -eq 0 ]; then
-+	echo "Deleted chain -L BAZ ok, expected failure"
-+	$XT_MULTI ebtables -t filter -L
-+	exit 1
-+fi
-+
-+$XT_MULTI ebtables -t $t -F || exit 0
-diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
-index e18d46551509d..b84f63a7c3672 100755
---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
-+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
-@@ -4,7 +4,7 @@ set -e
- #set -x
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- # fill ebtables manually
- 
-diff --git a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0 b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
-index 62d224134456b..63891c1bb731a 100755
---- a/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
-+++ b/iptables/tests/shell/testcases/ebtables/0003-ebtables-restore-defaults_0
-@@ -3,7 +3,7 @@
- set -e
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- # ebtables-restore reuses preloaded targets and matches, make sure defaults
- # apply to consecutive rules using the same target/match as a previous one
-diff --git a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0 b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
-index 46966f433139a..d52db900604ef 100755
---- a/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
-+++ b/iptables/tests/shell/testcases/ebtables/0004-save-counters_0
-@@ -3,7 +3,7 @@
- set -e
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- $XT_MULTI ebtables --init-table
- $XT_MULTI ebtables -A FORWARD -i nodev123 -o nodev432 -j ACCEPT
-diff --git a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0 b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
-index 2163d364b318b..0b3acfd7613db 100755
---- a/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
-+++ b/iptables/tests/shell/testcases/ebtables/0005-ifnamechecks_0
-@@ -3,7 +3,7 @@
- set -e
- 
- # there is no legacy backend to test
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- EXPECT='*filter
- :INPUT ACCEPT
-diff --git a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0 b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
-index 8bf0c2c6c194e..0174b03f4ebc7 100755
---- a/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
-+++ b/iptables/tests/shell/testcases/firewalld-restore/0001-firewalld_0
-@@ -231,7 +231,7 @@ for table in nat mangle raw filter;do
- done
- 
- case "$XT_MULTI" in
--*/xtables-nft-multi)
-+*xtables-nft-multi)
- 	# nft-multi displays chain names in different order, work around this for now
- 	tmpfile2=$(mktemp)
- 	sort "$tmpfile" > "$tmpfile2"
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0 b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
-index 96a5e66d0ab81..9fc50615b8926 100755
---- a/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
-+++ b/iptables/tests/shell/testcases/ipt-restore/0004-restore-race_0
-@@ -86,7 +86,7 @@ if [ $LINES1 -ne $LINES2 ]; then
- fi
- 
- case "$XT_MULTI" in
--*/xtables-nft-multi)
-+*xtables-nft-multi)
- 	attempts=$((RANDOM%10))
- 	attempts=$((attempts+1))
- 	;;
-diff --git a/iptables/tests/shell/testcases/nft-only/0001compat_0 b/iptables/tests/shell/testcases/nft-only/0001compat_0
-index 4319ea5a6a797..a617c52f53695 100755
---- a/iptables/tests/shell/testcases/nft-only/0001compat_0
-+++ b/iptables/tests/shell/testcases/nft-only/0001compat_0
-@@ -5,17 +5,18 @@
- # xtables: avoid bogus 'is incompatible' warning
- 
- case "$XT_MULTI" in
--*/xtables-nft-multi)
--	nft -v >/dev/null || exit 0
--	nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42;  }' || exit 1
--	nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42;  }' || exit 1
--
--	$XT_MULTI iptables -L -t filter || exit 1
--	$XT_MULTI ip6tables -L -t filter || exit 1
-+*xtables-nft-multi)
- 	;;
- *)
- 	echo skip $XT_MULTI
-+	exit 0
- 	;;
- esac
- 
-+nft -v >/dev/null || exit 0
-+nft 'add table ip nft-test; add chain ip nft-test foobar { type filter hook forward priority 42;  }' || exit 1
-+nft 'add table ip6 nft-test; add chain ip6 nft-test foobar { type filter hook forward priority 42;  }' || exit 1
-+
-+$XT_MULTI iptables -L -t filter || exit 1
-+$XT_MULTI ip6tables -L -t filter || exit 1
- exit 0
-diff --git a/iptables/tests/shell/testcases/nft-only/0002invflags_0 b/iptables/tests/shell/testcases/nft-only/0002invflags_0
-index 406b6081a98a4..fe33874dde7f2 100755
---- a/iptables/tests/shell/testcases/nft-only/0002invflags_0
-+++ b/iptables/tests/shell/testcases/nft-only/0002invflags_0
-@@ -2,7 +2,7 @@
- 
- set -e
- 
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- $XT_MULTI iptables -A INPUT -p tcp --dport 53 ! -s 192.168.0.1 -j ACCEPT
- $XT_MULTI ip6tables -A INPUT -p tcp --dport 53 ! -s feed:babe::1 -j ACCEPT
-diff --git a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0 b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
-index 67af9fd897410..ccb009e469076 100755
---- a/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
-+++ b/iptables/tests/shell/testcases/nft-only/0003delete-with-comment_0
-@@ -2,7 +2,7 @@
- 
- set -e
- 
--[[ $XT_MULTI == */xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
- 
- comment1="foo bar"
- comment2="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
--- 
-2.24.1
-
diff --git a/SOURCES/0035-libxtables-Make-sure-extensions-register-in-revision.patch b/SOURCES/0013-libxtables-Make-sure-extensions-register-in-revision.patch
similarity index 90%
rename from SOURCES/0035-libxtables-Make-sure-extensions-register-in-revision.patch
rename to SOURCES/0013-libxtables-Make-sure-extensions-register-in-revision.patch
index 9ab85d2..de9e4b7 100644
--- a/SOURCES/0035-libxtables-Make-sure-extensions-register-in-revision.patch
+++ b/SOURCES/0013-libxtables-Make-sure-extensions-register-in-revision.patch
@@ -1,4 +1,4 @@
-From e6eede725bbd395fb8b385aec4d0a32ce99e842c Mon Sep 17 00:00:00 2001
+From 4616623e18cb1868960194cd7f695969c594a35b Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 21 Sep 2020 13:42:06 +0200
 Subject: [PATCH] libxtables: Make sure extensions register in revision order
@@ -13,16 +13,15 @@ eventually.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit b3ac87038f4e45141831d9ab485a2f627daba3f1)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  libxtables/xtables.c | 71 +++++++++++++++++++++++++++++++++++++++-----
  1 file changed, 64 insertions(+), 7 deletions(-)
 
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 777c2b08e9896..13139d7f8ad62 100644
+index 8907ba2069be7..de52e3e2bbc15 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -902,8 +902,14 @@ static void xtables_check_options(const char *name, const struct option *opt)
+@@ -948,8 +948,14 @@ static void xtables_check_options(const char *name, const struct option *opt)
  		}
  }
  
@@ -37,7 +36,7 @@ index 777c2b08e9896..13139d7f8ad62 100644
  	if (me->next) {
  		fprintf(stderr, "%s: match \"%s\" already registered\n",
  			xt_params->program_name, me->name);
-@@ -955,10 +961,34 @@ void xtables_register_match(struct xtables_match *me)
+@@ -1001,10 +1007,34 @@ void xtables_register_match(struct xtables_match *me)
  	if (me->extra_opts != NULL)
  		xtables_check_options(me->name, me->extra_opts);
  
@@ -76,7 +75,7 @@ index 777c2b08e9896..13139d7f8ad62 100644
  }
  
  /**
-@@ -1097,6 +1127,9 @@ void xtables_register_matches(struct xtables_match *match, unsigned int n)
+@@ -1143,6 +1173,9 @@ void xtables_register_matches(struct xtables_match *match, unsigned int n)
  
  void xtables_register_target(struct xtables_target *me)
  {
@@ -86,7 +85,7 @@ index 777c2b08e9896..13139d7f8ad62 100644
  	if (me->next) {
  		fprintf(stderr, "%s: target \"%s\" already registered\n",
  			xt_params->program_name, me->name);
-@@ -1152,9 +1185,33 @@ void xtables_register_target(struct xtables_target *me)
+@@ -1198,9 +1231,33 @@ void xtables_register_target(struct xtables_target *me)
  	if (me->family != afinfo->family && me->family != AF_UNSPEC)
  		return;
  
@@ -124,5 +123,5 @@ index 777c2b08e9896..13139d7f8ad62 100644
  
  static bool xtables_fully_register_pending_target(struct xtables_target *me)
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0013-xtables-restore-fix-for-noflush-and-empty-lines.patch b/SOURCES/0013-xtables-restore-fix-for-noflush-and-empty-lines.patch
deleted file mode 100644
index cb49b21..0000000
--- a/SOURCES/0013-xtables-restore-fix-for-noflush-and-empty-lines.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-From 5ea18ea8c0c99f2c71a5eaf32f4fbf6339ce8cc7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 11 Feb 2020 16:52:59 +0100
-Subject: [PATCH] xtables-restore: fix for --noflush and empty lines
-
-Lookahead buffer used for cache requirements estimate in restore
---noflush separates individual lines with nul-chars. Two consecutive
-nul-chars are interpreted as end of buffer and remaining buffer content
-is skipped.
-
-Sadly, reading an empty line (i.e., one containing a newline character
-only) caused double nul-chars to appear in buffer as well, leading to
-premature stop when reading cached lines from buffer.
-
-To fix that, make use of xtables_restore_parse_line() skipping empty
-lines without calling strtok() and just leave the newline character in
-place. A more intuitive approach, namely skipping empty lines while
-buffering, is deliberately not chosen as that would cause wrong values
-in 'line' variable.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1400
-Fixes: 09cb517949e69 ("xtables-restore: Improve performance of --noflush operation")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
-(cherry picked from commit 8e76391096f12212985c401ee83a67990aa27a29)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- .../ipt-restore/0011-noflush-empty-line_0        | 16 ++++++++++++++++
- iptables/xtables-restore.c                       |  8 +++++---
- 2 files changed, 21 insertions(+), 3 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
-
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0 b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
-new file mode 100755
-index 0000000000000..bea1a690bb624
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ipt-restore/0011-noflush-empty-line_0
-@@ -0,0 +1,16 @@
-+#!/bin/bash -e
-+
-+# make sure empty lines won't break --noflush
-+
-+cat <<EOF | $XT_MULTI iptables-restore --noflush
-+# just a comment followed by innocent empty line
-+
-+*filter
-+-A FORWARD -j ACCEPT
-+COMMIT
-+EOF
-+
-+EXPECT='Chain FORWARD (policy ACCEPT)
-+target     prot opt source               destination         
-+ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           '
-+diff -u <(echo "$EXPECT") <($XT_MULTI iptables -n -L FORWARD)
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index 63cc15cee9621..fb2ac8b5c12a3 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -293,11 +293,13 @@ void xtables_restore_parse(struct nft_handle *h,
- 		while (fgets(buffer, sizeof(buffer), p->in)) {
- 			size_t blen = strlen(buffer);
- 
--			/* drop trailing newline; xtables_restore_parse_line()
-+			/* Drop trailing newline; xtables_restore_parse_line()
- 			 * uses strtok() which replaces them by nul-characters,
- 			 * causing unpredictable string delimiting in
--			 * preload_buffer */
--			if (buffer[blen - 1] == '\n')
-+			 * preload_buffer.
-+			 * Unless this is an empty line which would fold into a
-+			 * spurious EoB indicator (double nul-char). */
-+			if (buffer[blen - 1] == '\n' && blen > 1)
- 				buffer[blen - 1] = '\0';
- 			else
- 				blen++;
--- 
-2.24.1
-
diff --git a/SOURCES/0014-iptables-test.py-Fix-host-mode.patch b/SOURCES/0014-iptables-test.py-Fix-host-mode.patch
deleted file mode 100644
index 0387700..0000000
--- a/SOURCES/0014-iptables-test.py-Fix-host-mode.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 40e7bc3055f9bc34ccb6327f1f32c2fc524fb693 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 18 Feb 2020 16:43:16 +0100
-Subject: [PATCH] iptables-test.py: Fix --host mode
-
-In some cases, the script still called repo binaries. Avoid this when in
---host mode to allow testing without the need to compile sources in
-beforehand.
-
-Fixes: 1b5d762c1865e ("iptables-test: Support testing host binaries")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit ba2af278e8836977a8cfb35c54dac60ca9b40000)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables-test.py | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/iptables-test.py b/iptables-test.py
-index fdb4e6a3644e4..e986d7a318218 100755
---- a/iptables-test.py
-+++ b/iptables-test.py
-@@ -119,8 +119,7 @@ def run_test(iptables, rule, rule_save, res, filename, lineno, netns):
-         elif splitted[0] == EBTABLES:
-             command = EBTABLES_SAVE
- 
--    path = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE
--    command = path + " " + command
-+    command = EXECUTEABLE + " " + command
- 
-     if netns:
-             command = "ip netns exec ____iptables-container-test " + command
-@@ -165,7 +164,7 @@ def execute_cmd(cmd, filename, lineno):
-     '''
-     global log_file
-     if cmd.startswith('iptables ') or cmd.startswith('ip6tables ') or cmd.startswith('ebtables ') or cmd.startswith('arptables '):
--        cmd = os.path.abspath(os.path.curdir) + "/iptables/" + EXECUTEABLE + " " + cmd
-+        cmd = EXECUTEABLE + " " + cmd
- 
-     print("command: {}".format(cmd), file=log_file)
-     ret = subprocess.call(cmd, shell=True, universal_newlines=True,
--- 
-2.25.1
-
diff --git a/SOURCES/0036-libxtables-Simplify-pending-extension-registration.patch b/SOURCES/0014-libxtables-Simplify-pending-extension-registration.patch
similarity index 91%
rename from SOURCES/0036-libxtables-Simplify-pending-extension-registration.patch
rename to SOURCES/0014-libxtables-Simplify-pending-extension-registration.patch
index 9b527a5..f35466b 100644
--- a/SOURCES/0036-libxtables-Simplify-pending-extension-registration.patch
+++ b/SOURCES/0014-libxtables-Simplify-pending-extension-registration.patch
@@ -1,4 +1,4 @@
-From 1a842fb1cfb3b36f3081aee37c5fdd4a897d77d5 Mon Sep 17 00:00:00 2001
+From 4b5e9e71fbad66aef1db079905cba2db032a7515 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 18 Sep 2020 18:48:14 +0200
 Subject: [PATCH] libxtables: Simplify pending extension registration
@@ -21,13 +21,12 @@ xtables_find_*().
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit a1eaaceb0460b338294e40bdd5bc5186320a478c)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  libxtables/xtables.c | 128 +++++++++++--------------------------------
  1 file changed, 33 insertions(+), 95 deletions(-)
 
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 13139d7f8ad62..409128333e0e6 100644
+index de52e3e2bbc15..10d4e70328500 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
 @@ -203,8 +203,10 @@ struct xtables_match *xtables_matches;
@@ -41,9 +40,9 @@ index 13139d7f8ad62..409128333e0e6 100644
 +static bool xtables_fully_register_pending_target(struct xtables_target *me,
 +						  struct xtables_target *prev);
  
- void xtables_init(void)
- {
-@@ -616,6 +618,7 @@ struct xtables_match *
+ #ifndef NO_SHARED_LIBS
+ /* registry for loaded shared objects to close later */
+@@ -662,6 +664,7 @@ struct xtables_match *
  xtables_find_match(const char *name, enum xtables_tryload tryload,
  		   struct xtables_rule_match **matches)
  {
@@ -51,7 +50,7 @@ index 13139d7f8ad62..409128333e0e6 100644
  	struct xtables_match **dptr;
  	struct xtables_match *ptr;
  	const char *icmp6 = "icmp6";
-@@ -637,8 +640,12 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
+@@ -683,8 +686,12 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
  		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
  			ptr = *dptr;
  			*dptr = (*dptr)->next;
@@ -65,7 +64,7 @@ index 13139d7f8ad62..409128333e0e6 100644
  			*dptr = ptr;
  		}
  		dptr = &((*dptr)->next);
-@@ -732,6 +739,7 @@ xtables_find_match_revision(const char *name, enum xtables_tryload tryload,
+@@ -778,6 +785,7 @@ xtables_find_match_revision(const char *name, enum xtables_tryload tryload,
  struct xtables_target *
  xtables_find_target(const char *name, enum xtables_tryload tryload)
  {
@@ -73,7 +72,7 @@ index 13139d7f8ad62..409128333e0e6 100644
  	struct xtables_target **dptr;
  	struct xtables_target *ptr;
  
-@@ -748,8 +756,12 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -794,8 +802,12 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
  			ptr = *dptr;
  			*dptr = (*dptr)->next;
@@ -87,7 +86,7 @@ index 13139d7f8ad62..409128333e0e6 100644
  			*dptr = ptr;
  		}
  		dptr = &((*dptr)->next);
-@@ -1052,64 +1064,27 @@ static int xtables_target_prefer(const struct xtables_target *a,
+@@ -1098,64 +1110,27 @@ static int xtables_target_prefer(const struct xtables_target *a,
  				 b->revision, b->family);
  }
  
@@ -160,7 +159,7 @@ index 13139d7f8ad62..409128333e0e6 100644
  	*i = me;
  
  	me->m = NULL;
-@@ -1214,11 +1189,11 @@ void xtables_register_target(struct xtables_target *me)
+@@ -1260,11 +1235,11 @@ void xtables_register_target(struct xtables_target *me)
  #endif
  }
  
@@ -175,7 +174,7 @@ index 13139d7f8ad62..409128333e0e6 100644
  
  	if (strcmp(me->name, "standard") != 0) {
  		/* See if new target can be used. */
-@@ -1227,54 +1202,17 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me)
+@@ -1273,54 +1248,17 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me)
  			return false;
  	}
  
@@ -237,5 +236,5 @@ index 13139d7f8ad62..409128333e0e6 100644
  
  	me->t = NULL;
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0037-libxtables-Register-multiple-extensions-in-ascending.patch b/SOURCES/0015-libxtables-Register-multiple-extensions-in-ascending.patch
similarity index 82%
rename from SOURCES/0037-libxtables-Register-multiple-extensions-in-ascending.patch
rename to SOURCES/0015-libxtables-Register-multiple-extensions-in-ascending.patch
index 1146305..0657227 100644
--- a/SOURCES/0037-libxtables-Register-multiple-extensions-in-ascending.patch
+++ b/SOURCES/0015-libxtables-Register-multiple-extensions-in-ascending.patch
@@ -1,4 +1,4 @@
-From cfcafd3638cdc06a8b4a1d267e58b5ad1e35922c Mon Sep 17 00:00:00 2001
+From 1ae06e3a2da1c21a75b55609b99d1ab3ef6cf709 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 22 Sep 2020 20:01:15 +0200
 Subject: [PATCH] libxtables: Register multiple extensions in ascending order
@@ -10,16 +10,15 @@ extensions' arrays, iterate over them from beginning to end.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit b5f1a3beac1d1f2b96c8be8ebec450f5ea758090)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  libxtables/xtables.c | 14 ++++++++------
  1 file changed, 8 insertions(+), 6 deletions(-)
 
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 409128333e0e6..28ffffedd8147 100644
+index 10d4e70328500..7152c6576cd63 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -1095,9 +1095,10 @@ static bool xtables_fully_register_pending_match(struct xtables_match *me,
+@@ -1141,9 +1141,10 @@ static bool xtables_fully_register_pending_match(struct xtables_match *me,
  
  void xtables_register_matches(struct xtables_match *match, unsigned int n)
  {
@@ -33,7 +32,7 @@ index 409128333e0e6..28ffffedd8147 100644
  }
  
  void xtables_register_target(struct xtables_target *me)
-@@ -1223,9 +1224,10 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me,
+@@ -1269,9 +1270,10 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me,
  
  void xtables_register_targets(struct xtables_target *target, unsigned int n)
  {
@@ -48,5 +47,5 @@ index 409128333e0e6..28ffffedd8147 100644
  
  /* receives a list of xtables_rule_match, release them */
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0015-xtables-Review-nft_init.patch b/SOURCES/0015-xtables-Review-nft_init.patch
deleted file mode 100644
index 2246b84..0000000
--- a/SOURCES/0015-xtables-Review-nft_init.patch
+++ /dev/null
@@ -1,274 +0,0 @@
-From 51f895d54af6e163e0290520e124e9413438ccf4 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 21 Feb 2020 14:55:52 +0100
-Subject: [PATCH] xtables: Review nft_init()
-
-Move common code into nft_init(), such as:
-
-* initial zeroing nft_handle fields
-* family ops lookup and assignment to 'ops' field
-* setting of 'family' field
-
-This requires minor adjustments in xtables_restore_main() so extra field
-initialization doesn't happen before nft_init() call.
-
-As a side-effect, this fixes segfaulting xtables-monitor binary when
-printing rules for trace event as in that code-path 'ops' field wasn't
-initialized.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit d0446ab11182f6ca2adc486a124895f09a220c6e)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft.c                |  9 ++++++++-
- iptables/nft.h                |  2 +-
- iptables/xtables-arp.c        |  9 +--------
- iptables/xtables-eb.c         |  9 +--------
- iptables/xtables-monitor.c    |  2 +-
- iptables/xtables-restore.c    | 14 +++++++-------
- iptables/xtables-save.c       |  9 ++-------
- iptables/xtables-standalone.c |  6 ++----
- iptables/xtables-translate.c  |  2 +-
- iptables/xtables.c            |  4 ----
- 10 files changed, 24 insertions(+), 42 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 3f2a62ae12c07..0287add3fb21f 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -789,8 +789,10 @@ int nft_restart(struct nft_handle *h)
- 	return 0;
- }
- 
--int nft_init(struct nft_handle *h, const struct builtin_table *t)
-+int nft_init(struct nft_handle *h, int family, const struct builtin_table *t)
- {
-+	memset(h, 0, sizeof(*h));
-+
- 	h->nl = mnl_socket_open(NETLINK_NETFILTER);
- 	if (h->nl == NULL)
- 		return -1;
-@@ -800,9 +802,14 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
- 		return -1;
- 	}
- 
-+	h->ops = nft_family_ops_lookup(family);
-+	if (!h->ops)
-+		xtables_error(PARAMETER_PROBLEM, "Unknown family");
-+
- 	h->portid = mnl_socket_get_portid(h->nl);
- 	h->tables = t;
- 	h->cache = &h->__cache[0];
-+	h->family = family;
- 
- 	INIT_LIST_HEAD(&h->obj_list);
- 	INIT_LIST_HEAD(&h->err_list);
-diff --git a/iptables/nft.h b/iptables/nft.h
-index 51b5660314c0c..5cf260a6d2cd3 100644
---- a/iptables/nft.h
-+++ b/iptables/nft.h
-@@ -80,7 +80,7 @@ extern const struct builtin_table xtables_bridge[NFT_TABLE_MAX];
- int mnl_talk(struct nft_handle *h, struct nlmsghdr *nlh,
- 	     int (*cb)(const struct nlmsghdr *nlh, void *data),
- 	     void *data);
--int nft_init(struct nft_handle *h, const struct builtin_table *t);
-+int nft_init(struct nft_handle *h, int family, const struct builtin_table *t);
- void nft_fini(struct nft_handle *h);
- int nft_restart(struct nft_handle *h);
- 
-diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
-index 9cfad76263d32..c8196f08baa59 100644
---- a/iptables/xtables-arp.c
-+++ b/iptables/xtables-arp.c
-@@ -500,17 +500,10 @@ int nft_init_arp(struct nft_handle *h, const char *pname)
- 	init_extensionsa();
- #endif
- 
--	memset(h, 0, sizeof(*h));
--	h->family = NFPROTO_ARP;
--
--	if (nft_init(h, xtables_arp) < 0)
-+	if (nft_init(h, NFPROTO_ARP, xtables_arp) < 0)
- 		xtables_error(OTHER_PROBLEM,
- 			      "Could not initialize nftables layer.");
- 
--	h->ops = nft_family_ops_lookup(h->family);
--	if (h->ops == NULL)
--		xtables_error(PARAMETER_PROBLEM, "Unknown family");
--
- 	return 0;
- }
- 
-diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index 15b971da3d425..c006bc95ac681 100644
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -739,16 +739,9 @@ int nft_init_eb(struct nft_handle *h, const char *pname)
- 	init_extensionsb();
- #endif
- 
--	memset(h, 0, sizeof(*h));
--
--	h->family = NFPROTO_BRIDGE;
--
--	if (nft_init(h, xtables_bridge) < 0)
-+	if (nft_init(h, NFPROTO_BRIDGE, xtables_bridge) < 0)
- 		xtables_error(OTHER_PROBLEM,
- 			      "Could not initialize nftables layer.");
--	h->ops = nft_family_ops_lookup(h->family);
--	if (!h->ops)
--		xtables_error(PARAMETER_PROBLEM, "Unknown family");
- 
- 	/* manually registering ebt matches, given the original ebtables parser
- 	 * don't use '-m matchname' and the match can't be loaded dynamically when
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index a5245d1422af9..c2b31dbaa0795 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -615,7 +615,7 @@ int xtables_monitor_main(int argc, char *argv[])
- 	init_extensions4();
- #endif
- 
--	if (nft_init(&h, xtables_ipv4)) {
-+	if (nft_init(&h, AF_INET, xtables_ipv4)) {
- 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
- 			xtables_globals.program_name,
- 			xtables_globals.program_version,
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index fb2ac8b5c12a3..11834c0ea98c5 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -360,15 +360,13 @@ static int
- xtables_restore_main(int family, const char *progname, int argc, char *argv[])
- {
- 	const struct builtin_table *tables;
--	struct nft_handle h = {
--		.family = family,
--		.restore = true,
--	};
--	int c;
- 	struct nft_xt_restore_parse p = {
- 		.commit = true,
- 		.cb = &restore_cb,
- 	};
-+	bool noflush = false;
-+	struct nft_handle h;
-+	int c;
- 
- 	line = 0;
- 
-@@ -402,7 +400,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
- 				print_usage(prog_name, PACKAGE_VERSION);
- 				exit(0);
- 			case 'n':
--				h.noflush = 1;
-+				noflush = true;
- 				break;
- 			case 'M':
- 				xtables_modprobe_program = optarg;
-@@ -464,13 +462,15 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
- 		return 1;
- 	}
- 
--	if (nft_init(&h, tables) < 0) {
-+	if (nft_init(&h, family, tables) < 0) {
- 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
- 				xtables_globals.program_name,
- 				xtables_globals.program_version,
- 				strerror(errno));
- 		exit(EXIT_FAILURE);
- 	}
-+	h.noflush = noflush;
-+	h.restore = true;
- 
- 	xtables_restore_parse(&h, &p);
- 
-diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
-index 3a52f8c3d8209..228282deaed07 100644
---- a/iptables/xtables-save.c
-+++ b/iptables/xtables-save.c
-@@ -139,10 +139,8 @@ xtables_save_main(int family, int argc, char *argv[],
- 	struct do_output_data d = {
- 		.format = FMT_NOCOUNTS,
- 	};
-+	struct nft_handle h;
- 	bool dump = false;
--	struct nft_handle h = {
--		.family	= family,
--	};
- 	FILE *file = NULL;
- 	int ret, c;
- 
-@@ -242,16 +240,13 @@ xtables_save_main(int family, int argc, char *argv[],
- 		return 1;
- 	}
- 
--	if (nft_init(&h, tables) < 0) {
-+	if (nft_init(&h, family, tables) < 0) {
- 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
- 				xtables_globals.program_name,
- 				xtables_globals.program_version,
- 				strerror(errno));
- 		exit(EXIT_FAILURE);
- 	}
--	h.ops = nft_family_ops_lookup(h.family);
--	if (!h.ops)
--		xtables_error(PARAMETER_PROBLEM, "Unknown family");
- 
- 	ret = do_output(&h, tablename, &d);
- 	nft_fini(&h);
-diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
-index 1a28c5480629f..022d5dd44abbf 100644
---- a/iptables/xtables-standalone.c
-+++ b/iptables/xtables-standalone.c
-@@ -44,9 +44,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
- {
- 	int ret;
- 	char *table = "filter";
--	struct nft_handle h = {
--		.family = family,
--	};
-+	struct nft_handle h;
- 
- 	xtables_globals.program_name = progname;
- 	ret = xtables_init_all(&xtables_globals, family);
-@@ -61,7 +59,7 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
- 	init_extensions4();
- #endif
- 
--	if (nft_init(&h, xtables_ipv4) < 0) {
-+	if (nft_init(&h, family, xtables_ipv4) < 0) {
- 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
- 				xtables_globals.program_name,
- 				xtables_globals.program_version,
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index 0f95855b41aa4..76ad7eb69eca9 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -480,7 +480,7 @@ static int xtables_xlate_main_common(struct nft_handle *h,
- 		return 1;
- 	}
- 
--	if (nft_init(h, tables) < 0) {
-+	if (nft_init(h, family, tables) < 0) {
- 		fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
- 				xtables_globals.program_name,
- 				xtables_globals.program_version,
-diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 8f9dc628d0029..4b24d15c46295 100644
---- a/iptables/xtables.c
-+++ b/iptables/xtables.c
-@@ -571,10 +571,6 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
- 	   demand-load a protocol. */
- 	opterr = 0;
- 
--	h->ops = nft_family_ops_lookup(h->family);
--	if (h->ops == NULL)
--		xtables_error(PARAMETER_PROBLEM, "Unknown family");
--
- 	opts = xt_params->orig_opts;
- 	while ((cs->c = getopt_long(argc, argv,
- 	   "-:A:C:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvw::W::nt:m:xc:g:46",
--- 
-2.26.2
-
diff --git a/SOURCES/0026-nft-Make-batch_add_chain-return-the-added-batch-obje.patch b/SOURCES/0016-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
similarity index 78%
rename from SOURCES/0026-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
rename to SOURCES/0016-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
index 4e077ad..72d9782 100644
--- a/SOURCES/0026-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
+++ b/SOURCES/0016-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
@@ -1,4 +1,4 @@
-From d1b516014e4883f30ee2faf264dd89a6d7940e2c Mon Sep 17 00:00:00 2001
+From 99bf566bfcabce101940b28a12f61c637ccfb489 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Sat, 3 Oct 2020 17:46:09 +0200
 Subject: [PATCH] nft: Make batch_add_chain() return the added batch object
@@ -11,22 +11,15 @@ While being at it, simplify a few callers and eliminate the need for a
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Reviewed-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit 0d77e64e8d9b8a3984b01a4951524dc40f61f4b6)
-
-Conflicts:
-	iptables/nft.c
--> Upstream changed good/bad return codes of nft_chain_restore()
-   function.
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft.c | 35 +++++++++++++++++------------------
  1 file changed, 17 insertions(+), 18 deletions(-)
 
 diff --git a/iptables/nft.c b/iptables/nft.c
-index e95e99f1d8d71..0efd18d57320f 100644
+index e795d4ae6d241..ec5f7457e4784 100644
 --- a/iptables/nft.c
 +++ b/iptables/nft.c
-@@ -398,10 +398,11 @@ batch_set_add(struct nft_handle *h, enum obj_update_type type,
+@@ -389,10 +389,11 @@ batch_set_add(struct nft_handle *h, enum obj_update_type type,
  	return batch_add(h, type, s);
  }
  
@@ -40,7 +33,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  }
  
  static struct obj_update *
-@@ -910,7 +911,6 @@ int nft_chain_set(struct nft_handle *h, const char *table,
+@@ -920,7 +921,6 @@ int nft_chain_set(struct nft_handle *h, const char *table,
  		  const struct xt_counters *counters)
  {
  	struct nftnl_chain *c = NULL;
@@ -48,7 +41,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  
  	nft_fn = nft_chain_set;
  
-@@ -924,10 +924,11 @@ int nft_chain_set(struct nft_handle *h, const char *table,
+@@ -934,10 +934,11 @@ int nft_chain_set(struct nft_handle *h, const char *table,
  	if (c == NULL)
  		return 0;
  
@@ -62,7 +55,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  }
  
  static int __add_match(struct nftnl_expr *e, struct xt_entry_match *m)
-@@ -1734,7 +1735,6 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
+@@ -1752,7 +1753,6 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
  {
  	struct nftnl_chain_list *list;
  	struct nftnl_chain *c;
@@ -70,7 +63,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  
  	nft_fn = nft_chain_user_add;
  
-@@ -1754,14 +1754,15 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
+@@ -1772,14 +1772,15 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
  	if (h->family == NFPROTO_BRIDGE)
  		nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
  
@@ -88,7 +81,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  }
  
  int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
-@@ -1769,7 +1770,6 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
+@@ -1787,7 +1788,6 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
  	struct nftnl_chain_list *list;
  	struct nftnl_chain *c;
  	bool created = false;
@@ -96,24 +89,25 @@ index e95e99f1d8d71..0efd18d57320f 100644
  
  	c = nft_chain_find(h, table, chain);
  	if (c) {
-@@ -1794,13 +1794,14 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
+@@ -1812,14 +1812,15 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
  	if (!created)
- 		return 0;
+ 		return 1;
  
 -	ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
 +	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
-+		return -1;
++		return 0;
  
  	list = nft_chain_list_get(h, table, chain);
  	if (list)
  		nftnl_chain_list_add(c, list);
  
--	return ret;
-+	return 0;
+ 	/* the core expects 1 for success and 0 for error */
+-	return ret == 0 ? 1 : 0;
++	return 1;
  }
  
  /* From linux/netlink.h */
-@@ -1818,7 +1819,6 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
+@@ -1837,7 +1838,6 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
  {
  	struct chain_user_del_data *d = data;
  	struct nft_handle *h = d->handle;
@@ -121,7 +115,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  
  	/* don't delete built-in chain */
  	if (nft_chain_builtin(c))
-@@ -1834,8 +1834,7 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
+@@ -1849,8 +1849,7 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
  
  	/* XXX This triggers a fast lookup from the kernel. */
  	nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
@@ -131,7 +125,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  		return -1;
  
  	nftnl_chain_list_del(c);
-@@ -1910,7 +1909,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
+@@ -1925,7 +1924,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
  {
  	struct nftnl_chain *c;
  	uint64_t handle;
@@ -139,7 +133,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  
  	nft_fn = nft_chain_user_rename;
  
-@@ -1941,10 +1939,11 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
+@@ -1954,10 +1952,11 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
  	nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, newname);
  	nftnl_chain_set_u64(c, NFTNL_CHAIN_HANDLE, handle);
  
@@ -153,7 +147,7 @@ index e95e99f1d8d71..0efd18d57320f 100644
  }
  
  bool nft_table_find(struct nft_handle *h, const char *tablename)
-@@ -3217,7 +3216,7 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
+@@ -3404,7 +3403,7 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
  		nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
  		nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
  		nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
@@ -163,5 +157,5 @@ index e95e99f1d8d71..0efd18d57320f 100644
  	}
  
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0016-nft-cache-Fix-nft_release_cache-under-stress.patch b/SOURCES/0016-nft-cache-Fix-nft_release_cache-under-stress.patch
deleted file mode 100644
index ff06e05..0000000
--- a/SOURCES/0016-nft-cache-Fix-nft_release_cache-under-stress.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 66b9f92ef41de90fc2b0359247c36bc6d128233d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 28 Feb 2020 20:32:13 +0100
-Subject: [PATCH] nft: cache: Fix nft_release_cache() under stress
-
-iptables-nft-restore calls nft_action(h, NFT_COMPAT_COMMIT) for each
-COMMIT line in input. When restoring a dump containing multiple large
-tables, chances are nft_rebuild_cache() has to run multiple times.
-
-If the above happens, consecutive table contents are added to __cache[1]
-which nft_rebuild_cache() then frees, so next commit attempt accesses
-invalid memory.
-
-Fix this by making nft_release_cache() (called after each successful
-commit) return things into pre-rebuild state again, but keeping the
-fresh cache copy.
-
-Fixes: f6ad231d698c7 ("nft: keep original cache in case of ERESTART")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c550c81fd373e5753103d20f7902171f0fa79807)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft-cache.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index 7345a27e2894b..6f21f2283e0fb 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -647,8 +647,14 @@ void nft_rebuild_cache(struct nft_handle *h)
- 
- void nft_release_cache(struct nft_handle *h)
- {
--	if (h->cache_index)
--		flush_cache(h, &h->__cache[0], NULL);
-+	if (!h->cache_index)
-+		return;
-+
-+	flush_cache(h, &h->__cache[0], NULL);
-+	memcpy(&h->__cache[0], &h->__cache[1], sizeof(h->__cache[0]));
-+	memset(&h->__cache[1], 0, sizeof(h->__cache[1]));
-+	h->cache_index = 0;
-+	h->cache = &h->__cache[0];
- }
- 
- struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
--- 
-2.25.1
-
diff --git a/SOURCES/0027-nft-Fix-error-reporting-for-refreshed-transactions.patch b/SOURCES/0017-nft-Fix-error-reporting-for-refreshed-transactions.patch
similarity index 85%
rename from SOURCES/0027-nft-Fix-error-reporting-for-refreshed-transactions.patch
rename to SOURCES/0017-nft-Fix-error-reporting-for-refreshed-transactions.patch
index c0a8f40..13425ce 100644
--- a/SOURCES/0027-nft-Fix-error-reporting-for-refreshed-transactions.patch
+++ b/SOURCES/0017-nft-Fix-error-reporting-for-refreshed-transactions.patch
@@ -1,4 +1,4 @@
-From 2dff9a669400644ec1e66d394b03d743eec2cd55 Mon Sep 17 00:00:00 2001
+From 8ab5e29f192187bc12a2064036cf406de60b2cd5 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 5 Oct 2020 15:54:35 +0200
 Subject: [PATCH] nft: Fix error reporting for refreshed transactions
@@ -15,16 +15,15 @@ Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Reviewed-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit e98b825a037807bf6c918eb66ee9682cc4c46183)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft.c | 5 +++--
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/iptables/nft.c b/iptables/nft.c
-index 0efd18d57320f..d661ac2cafda6 100644
+index ec5f7457e4784..d3eb0840a9fc0 100644
 --- a/iptables/nft.c
 +++ b/iptables/nft.c
-@@ -2767,9 +2767,10 @@ retry:
+@@ -2832,9 +2832,10 @@ static int nft_action(struct nft_handle *h, int action)
  	h->nft_genid++;
  
  	list_for_each_entry(n, &h->obj_list, head) {
@@ -38,5 +37,5 @@ index 0efd18d57320f..d661ac2cafda6 100644
  		n->seq = seq++;
  		switch (n->type) {
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch b/SOURCES/0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch
deleted file mode 100644
index accd32f..0000000
--- a/SOURCES/0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 38c94a9f5ea03deffe0a34056a0f83a4af4641bb Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 13 Mar 2020 13:02:12 +0100
-Subject: [PATCH] nft: cache: Fix iptables-save segfault under stress
-
-If kernel ruleset is constantly changing, code called by
-nft_is_table_compatible() may crash: For each item in table's chain
-list, nft_is_chain_compatible() is called. This in turn calls
-nft_build_cache() to fetch chain's rules. Though if kernel genid has changed
-meanwhile, cache is flushed and rebuilt from scratch, thereby freeing
-table's chain list - the foreach loop in nft_is_table_compatible() then
-operates on freed memory.
-
-A simple reproducer (may need a few calls):
-
-| RULESET='*filter
-| :INPUT ACCEPT [10517:1483527]
-| :FORWARD ACCEPT [0:0]
-| :OUTPUT ACCEPT [1714:105671]
-| COMMIT
-| '
-|
-| for ((i = 0; i < 100; i++)); do
-|         iptables-nft-restore <<< "$RULESET" &
-| done &
-| iptables-nft-save
-
-To fix the problem, basically revert commit ab1cd3b510fa5 ("nft: ensure
-cache consistency") so that __nft_build_cache() no longer flushes the
-cache. Instead just record kernel's genid when fetching for the first
-time. If kernel rule set changes until the changes are committed, the
-commit simply fails and local cache is being rebuilt.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 200bc399651499f502ac0de45f4d4aa4c9d37ab6)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft-cache.c | 16 ++--------------
- 1 file changed, 2 insertions(+), 14 deletions(-)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index 6f21f2283e0fb..07265b7795e4f 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -452,15 +452,11 @@ __nft_build_cache(struct nft_handle *h, enum nft_cache_level level,
- 		  const struct builtin_table *t, const char *set,
- 		  const char *chain)
- {
--	uint32_t genid_start, genid_stop;
--
- 	if (level <= h->cache_level)
- 		return;
--retry:
--	mnl_genid_get(h, &genid_start);
- 
--	if (h->cache_level && genid_start != h->nft_genid)
--		flush_chain_cache(h, NULL);
-+	if (!h->nft_genid)
-+		mnl_genid_get(h, &h->nft_genid);
- 
- 	switch (h->cache_level) {
- 	case NFT_CL_NONE:
-@@ -487,18 +483,10 @@ retry:
- 		break;
- 	}
- 
--	mnl_genid_get(h, &genid_stop);
--	if (genid_start != genid_stop) {
--		flush_chain_cache(h, NULL);
--		goto retry;
--	}
--
- 	if (!t && !chain)
- 		h->cache_level = level;
- 	else if (h->cache_level < NFT_CL_TABLES)
- 		h->cache_level = NFT_CL_TABLES;
--
--	h->nft_genid = genid_start;
- }
- 
- void nft_build_cache(struct nft_handle *h, struct nftnl_chain *c)
--- 
-2.25.1
-
diff --git a/SOURCES/0018-ebtables-among-Support-mixed-MAC-and-MAC-IP-entries.patch b/SOURCES/0018-ebtables-among-Support-mixed-MAC-and-MAC-IP-entries.patch
deleted file mode 100644
index 73d9987..0000000
--- a/SOURCES/0018-ebtables-among-Support-mixed-MAC-and-MAC-IP-entries.patch
+++ /dev/null
@@ -1,127 +0,0 @@
-From 654b2e2512630df07e3ea57f8d54e851e75b33f1 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 13 Feb 2020 17:49:53 +0100
-Subject: [PATCH] ebtables: among: Support mixed MAC and MAC/IP entries
-
-Powered by Stefano's support for concatenated ranges, a full among match
-replacement can be implemented. The trick is to add MAC-only elements as
-a concatenation of MAC and zero-length prefix, i.e. a range from
-0.0.0.0 till 255.255.255.255.
-
-Although not quite needed, detection of pure MAC-only matches is left in
-place. For those, no implicit 'meta protocol' match is added (which is
-required otherwise at least to keep nft output correct) and no concat
-type is used for the set.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c33bae9c6c7a49c8af16df846e6112fc4727e643)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libebt_among.c |  6 +-----
- extensions/libebt_among.t |  2 +-
- iptables/ebtables-nft.8   |  4 ----
- iptables/nft.c            | 20 +++++++++++++++++++-
- 4 files changed, 21 insertions(+), 11 deletions(-)
-
-diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
-index 715d559f432c2..2b9a1b6566684 100644
---- a/extensions/libebt_among.c
-+++ b/extensions/libebt_among.c
-@@ -63,10 +63,6 @@ parse_nft_among_pair(char *buf, struct nft_among_pair *pair, bool have_ip)
- 	char *sep = index(buf, '=');
- 	struct ether_addr *ether;
- 
--	if (have_ip ^ !!sep)
--		xtables_error(PARAMETER_PROBLEM,
--			      "among: Mixed MAC and MAC=IP not allowed.");
--
- 	if (sep) {
- 		*sep = '\0';
- 
-@@ -205,7 +201,7 @@ static void __bramong_print(struct nft_among_pair *pairs,
- 		isep = ",";
- 
- 		printf("%s", ether_ntoa(&pairs[i].ether));
--		if (have_ip)
-+		if (pairs[i].in.s_addr != INADDR_ANY)
- 			printf("=%s", inet_ntoa(pairs[i].in));
- 	}
- 	printf(" ");
-diff --git a/extensions/libebt_among.t b/extensions/libebt_among.t
-index 56b299161ff31..a02206f391cde 100644
---- a/extensions/libebt_among.t
-+++ b/extensions/libebt_among.t
-@@ -13,4 +13,4 @@
- --among-src;=;FAIL
- --among-src 00:11=10.0.0.1;=;FAIL
- --among-src de:ad:0:be:ee:ff=10.256.0.1;=;FAIL
----among-src de:ad:0:be:ee:ff,c0:ff:ee:0:ba:be=192.168.1.1;=;FAIL
-+--among-src c0:ff:ee:0:ba:be=192.168.1.1,de:ad:0:be:ee:ff;=;OK
-diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
-index a91f0c1aacb0f..1fa5ad9388cc0 100644
---- a/iptables/ebtables-nft.8
-+++ b/iptables/ebtables-nft.8
-@@ -551,10 +551,6 @@ Same as
- .BR "--among-src-file " "[!] \fIfile\fP"
- Same as
- .BR --among-src " but the list is read in from the specified file."
--.PP
--Note that in this implementation of ebtables, among lists uses must be
--internally homogeneous regarding whether IP addresses are present or not. Mixed
--use of MAC addresses and MAC/IP address pairs is not supported yet.
- .SS arp
- Specify (R)ARP fields. The protocol must be specified as
- .IR ARP " or " RARP .
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 0287add3fb21f..4930b6de534d8 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -1029,19 +1029,28 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
- 	};
- 	struct nftnl_expr *e;
- 	struct nftnl_set *s;
-+	uint32_t flags = 0;
- 	int idx = 0;
- 
- 	if (ip) {
- 		type = type << CONCAT_TYPE_BITS | NFT_DATATYPE_IPADDR;
- 		len += sizeof(struct in_addr) + NETLINK_ALIGN - 1;
- 		len &= ~(NETLINK_ALIGN - 1);
-+		flags = NFT_SET_INTERVAL;
- 	}
- 
--	s = add_anon_set(h, table, 0, type, len, cnt);
-+	s = add_anon_set(h, table, flags, type, len, cnt);
- 	if (!s)
- 		return -ENOMEM;
- 	set_id = nftnl_set_get_u32(s, NFTNL_SET_ID);
- 
-+	if (ip) {
-+		uint8_t field_len[2] = { ETH_ALEN, sizeof(struct in_addr) };
-+
-+		nftnl_set_set_data(s, NFTNL_SET_DESC_CONCAT,
-+				   field_len, sizeof(field_len));
-+	}
-+
- 	for (idx = 0; idx < cnt; idx++) {
- 		struct nftnl_set_elem *elem = nftnl_set_elem_alloc();
- 
-@@ -1049,6 +1058,15 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
- 			return -ENOMEM;
- 		nftnl_set_elem_set(elem, NFTNL_SET_ELEM_KEY,
- 				   &pairs[idx], len);
-+		if (ip) {
-+			struct in_addr tmp = pairs[idx].in;
-+
-+			if (tmp.s_addr == INADDR_ANY)
-+				pairs[idx].in.s_addr = INADDR_BROADCAST;
-+			nftnl_set_elem_set(elem, NFTNL_SET_ELEM_KEY_END,
-+					   &pairs[idx], len);
-+			pairs[idx].in = tmp;
-+		}
- 		nftnl_set_elem_add(s, elem);
- 	}
- 
--- 
-2.26.2
-
diff --git a/SOURCES/0028-nft-Fix-for-concurrent-noflush-restore-calls.patch b/SOURCES/0018-nft-Fix-for-concurrent-noflush-restore-calls.patch
similarity index 87%
rename from SOURCES/0028-nft-Fix-for-concurrent-noflush-restore-calls.patch
rename to SOURCES/0018-nft-Fix-for-concurrent-noflush-restore-calls.patch
index 98a7ebb..2045934 100644
--- a/SOURCES/0028-nft-Fix-for-concurrent-noflush-restore-calls.patch
+++ b/SOURCES/0018-nft-Fix-for-concurrent-noflush-restore-calls.patch
@@ -1,4 +1,4 @@
-From 575a1e5589f813af7e838c045863b510b4740353 Mon Sep 17 00:00:00 2001
+From 412c52e9ab9d5d1d1a1e5e09a122cca43895451a Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 5 Oct 2020 16:06:49 +0200
 Subject: [PATCH] nft: Fix for concurrent noflush restore calls
@@ -33,13 +33,6 @@ handle in that case.
 Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit dac904bdcd9a18aabafee7275ccf0c2bd53800f3)
-
-Conflicts:
-	iptables/nft.c
--> Upstream changed good/bad return codes of nft_chain_restore()
-   function.
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft.c                                | 58 ++++++++++---------
  .../ipt-restore/0016-concurrent-restores_0    | 53 +++++++++++++++++
@@ -47,10 +40,10 @@ Signed-off-by: Phil Sutter <psutter@redhat.com>
  create mode 100755 iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
 
 diff --git a/iptables/nft.c b/iptables/nft.c
-index d661ac2cafda6..dc5490c085364 100644
+index d3eb0840a9fc0..bdb633a82a655 100644
 --- a/iptables/nft.c
 +++ b/iptables/nft.c
-@@ -283,7 +283,6 @@ struct obj_update {
+@@ -265,7 +265,6 @@ struct obj_update {
  	struct list_head	head;
  	enum obj_update_type	type:8;
  	uint8_t			skip:1;
@@ -58,7 +51,7 @@ index d661ac2cafda6..dc5490c085364 100644
  	unsigned int		seq;
  	union {
  		struct nftnl_table	*table;
-@@ -1650,7 +1649,7 @@ int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format)
+@@ -1668,7 +1667,7 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h,
  
  static void
  __nft_rule_flush(struct nft_handle *h, const char *table,
@@ -67,7 +60,7 @@ index d661ac2cafda6..dc5490c085364 100644
  {
  	struct obj_update *obj;
  	struct nftnl_rule *r;
-@@ -1672,7 +1671,7 @@ __nft_rule_flush(struct nft_handle *h, const char *table,
+@@ -1690,7 +1689,7 @@ __nft_rule_flush(struct nft_handle *h, const char *table,
  		return;
  	}
  
@@ -76,7 +69,7 @@ index d661ac2cafda6..dc5490c085364 100644
  }
  
  int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
-@@ -1768,17 +1767,12 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
+@@ -1786,17 +1785,12 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
  int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
  {
  	struct nftnl_chain_list *list;
@@ -95,8 +88,8 @@ index d661ac2cafda6..dc5490c085364 100644
 +	if (!c) {
  		c = nftnl_chain_alloc();
  		if (!c)
- 			return -1;
-@@ -1786,20 +1780,26 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
+ 			return 0;
+@@ -1804,20 +1798,26 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
  		nftnl_chain_set_str(c, NFTNL_CHAIN_TABLE, table);
  		nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain);
  		created = true;
@@ -117,22 +110,22 @@ index d661ac2cafda6..dc5490c085364 100644
 +	}
  
 -	if (!created)
--		return 0;
+-		return 1;
 +	__nft_rule_flush(h, table, chain, false, created);
  
 -	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
 +	obj = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
 +	if (!obj)
- 		return -1;
+ 		return 0;
  
 -	list = nft_chain_list_get(h, table, chain);
 -	if (list)
 -		nftnl_chain_list_add(c, list);
 +	obj->skip = !created;
  
- 	return 0;
- }
-@@ -2693,11 +2693,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
+ 	/* the core expects 1 for success and 0 for error */
+ 	return 1;
+@@ -2751,11 +2751,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
  	h->error.lineno = 0;
  
  	list_for_each_entry_safe(n, tmp, &h->obj_list, head) {
@@ -144,7 +137,7 @@ index d661ac2cafda6..dc5490c085364 100644
  		switch (n->type) {
  		case NFT_COMPAT_TABLE_FLUSH:
  			tablename = nftnl_table_get_str(n->table, NFTNL_TABLE_NAME);
-@@ -2723,14 +2718,22 @@ static void nft_refresh_transaction(struct nft_handle *h)
+@@ -2781,14 +2776,22 @@ static void nft_refresh_transaction(struct nft_handle *h)
  
  			c = nft_chain_find(h, tablename, chainname);
  			if (c) {
@@ -170,14 +163,14 @@ index d661ac2cafda6..dc5490c085364 100644
  		case NFT_COMPAT_TABLE_ADD:
  		case NFT_COMPAT_CHAIN_ADD:
  		case NFT_COMPAT_CHAIN_ZERO:
-@@ -2742,7 +2745,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
+@@ -2800,7 +2803,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
  		case NFT_COMPAT_RULE_INSERT:
  		case NFT_COMPAT_RULE_REPLACE:
  		case NFT_COMPAT_RULE_DELETE:
 -		case NFT_COMPAT_RULE_FLUSH:
  		case NFT_COMPAT_SET_ADD:
- 			break;
- 		}
+ 		case NFT_COMPAT_RULE_LIST:
+ 		case NFT_COMPAT_RULE_CHECK:
 diff --git a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0 b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
 new file mode 100755
 index 0000000000000..53ec12fa368af
@@ -238,5 +231,5 @@ index 0000000000000..53ec12fa368af
 +	wait -n
 +done
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0029-tests-shell-Improve-concurrent-noflush-restore-test-.patch b/SOURCES/0019-tests-shell-Improve-concurrent-noflush-restore-test-.patch
similarity index 94%
rename from SOURCES/0029-tests-shell-Improve-concurrent-noflush-restore-test-.patch
rename to SOURCES/0019-tests-shell-Improve-concurrent-noflush-restore-test-.patch
index 6d5d040..7044aa3 100644
--- a/SOURCES/0029-tests-shell-Improve-concurrent-noflush-restore-test-.patch
+++ b/SOURCES/0019-tests-shell-Improve-concurrent-noflush-restore-test-.patch
@@ -1,4 +1,4 @@
-From 674cce10a34e90f2791a3d58789793eef29e8f8b Mon Sep 17 00:00:00 2001
+From bb80a77e8b0b2b557c4a2afd88446853e19236da Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 26 Oct 2020 17:25:03 +0100
 Subject: [PATCH] tests: shell: Improve concurrent noflush restore test a bit
@@ -13,7 +13,6 @@ test is trying to provoke.
 Fixes: dac904bdcd9a1 ("nft: Fix for concurrent noflush restore calls")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit ed8c8b9316451a4499eeb592d2cf7d782bbe4e9a)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  .../ipt-restore/0016-concurrent-restores_0         | 14 ++++++++++++++
  1 file changed, 14 insertions(+)
@@ -51,5 +50,5 @@ index 53ec12fa368af..aa746ab458a3c 100755
  	$XT_MULTI iptables-restore --noflush -w <<< "$RS2" &
  	wait -n
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0019-xtables-Align-effect-of-4-6-options-with-legacy.patch b/SOURCES/0019-xtables-Align-effect-of-4-6-options-with-legacy.patch
deleted file mode 100644
index fb77d66..0000000
--- a/SOURCES/0019-xtables-Align-effect-of-4-6-options-with-legacy.patch
+++ /dev/null
@@ -1,157 +0,0 @@
-From aa221d3a7ffc8e3245d9031173b306431ddfaf9f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 21 Feb 2020 13:18:32 +0100
-Subject: [PATCH] xtables: Align effect of -4/-6 options with legacy
-
-Legacy iptables doesn't accept -4 or -6 if they don't match the
-symlink's native family. The only exception to that is iptables-restore
-which simply ignores the lines introduced by non-matching options, which
-is useful to create combined dump files for feeding into both
-iptables-restore and ip6tables-restore.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 1639b8ba5105542c73e0e1c35e70f245dab89d81)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- .../shell/testcases/iptables/0006-46-args_0   | 88 +++++++++++++++++++
- iptables/xtables.c                            | 21 ++---
- 2 files changed, 96 insertions(+), 13 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/iptables/0006-46-args_0
-
-diff --git a/iptables/tests/shell/testcases/iptables/0006-46-args_0 b/iptables/tests/shell/testcases/iptables/0006-46-args_0
-new file mode 100755
-index 0000000000000..17a0a01829df5
---- /dev/null
-+++ b/iptables/tests/shell/testcases/iptables/0006-46-args_0
-@@ -0,0 +1,88 @@
-+#!/bin/bash
-+
-+RC=0
-+
-+$XT_MULTI iptables -6 -A FORWARD -j ACCEPT
-+rc=$?
-+if [[ $rc -ne 2 ]]; then
-+	echo "'iptables -6' returned $rc instead of 2"
-+	RC=1
-+fi
-+
-+$XT_MULTI ip6tables -4 -A FORWARD -j ACCEPT
-+rc=$?
-+if [[ $rc -ne 2 ]]; then
-+	echo "'ip6tables -4' returned $rc instead of 2"
-+	RC=1
-+fi
-+
-+RULESET='*filter
-+-4 -A FORWARD -d 10.0.0.1 -j ACCEPT
-+-6 -A FORWARD -d fec0:10::1 -j ACCEPT
-+COMMIT
-+'
-+EXPECT4='-P FORWARD ACCEPT
-+-A FORWARD -d 10.0.0.1/32 -j ACCEPT'
-+EXPECT6='-P FORWARD ACCEPT
-+-A FORWARD -d fec0:10::1/128 -j ACCEPT'
-+EXPECT_EMPTY='-P FORWARD ACCEPT'
-+
-+echo "$RULESET" | $XT_MULTI iptables-restore || {
-+	echo "iptables-restore failed!"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT4") <($XT_MULTI iptables -S FORWARD) || {
-+	echo "unexpected iptables ruleset"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI ip6tables -S FORWARD) || {
-+	echo "unexpected non-empty ip6tables ruleset"
-+	RC=1
-+}
-+
-+$XT_MULTI iptables -F FORWARD
-+
-+echo "$RULESET" | $XT_MULTI ip6tables-restore || {
-+	echo "ip6tables-restore failed!"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT6") <($XT_MULTI ip6tables -S FORWARD) || {
-+	echo "unexpected ip6tables ruleset"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI iptables -S FORWARD) || {
-+	echo "unexpected non-empty iptables ruleset"
-+	RC=1
-+}
-+
-+$XT_MULTI ip6tables -F FORWARD
-+
-+$XT_MULTI iptables -4 -A FORWARD -d 10.0.0.1 -j ACCEPT || {
-+	echo "iptables failed!"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT4") <($XT_MULTI iptables -S FORWARD) || {
-+	echo "unexpected iptables ruleset"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI ip6tables -S FORWARD) || {
-+	echo "unexpected non-empty ip6tables ruleset"
-+	RC=1
-+}
-+
-+$XT_MULTI iptables -F FORWARD
-+
-+$XT_MULTI ip6tables -6 -A FORWARD -d fec0:10::1 -j ACCEPT || {
-+	echo "ip6tables failed!"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT6") <($XT_MULTI ip6tables -S FORWARD) || {
-+	echo "unexpected ip6tables ruleset"
-+	RC=1
-+}
-+diff -u -Z <(echo -e "$EXPECT_EMPTY") <($XT_MULTI iptables -S FORWARD) || {
-+	echo "unexpected non-empty iptables ruleset"
-+	RC=1
-+}
-+
-+exit $RC
-diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 4b24d15c46295..8c2d21d42b7d2 100644
---- a/iptables/xtables.c
-+++ b/iptables/xtables.c
-@@ -913,27 +913,22 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
- 			break;
- 
- 		case '4':
-+			if (args->family == AF_INET)
-+				break;
-+
- 			if (p->restore && args->family == AF_INET6)
- 				return;
- 
--			if (args->family != AF_INET)
--				exit_tryhelp(2);
--
--			h->ops = nft_family_ops_lookup(args->family);
--			break;
-+			exit_tryhelp(2);
- 
- 		case '6':
-+			if (args->family == AF_INET6)
-+				break;
-+
- 			if (p->restore && args->family == AF_INET)
- 				return;
- 
--			args->family = AF_INET6;
--			xtables_set_nfproto(AF_INET6);
--
--			h->ops = nft_family_ops_lookup(args->family);
--			if (h->ops == NULL)
--				xtables_error(PARAMETER_PROBLEM,
--					      "Unknown family");
--			break;
-+			exit_tryhelp(2);
- 
- 		case 1: /* non option */
- 			if (optarg[0] == '!' && optarg[1] == '\0') {
--- 
-2.26.2
-
diff --git a/SOURCES/0032-nft-Optimize-class-based-IP-prefix-matches.patch b/SOURCES/0020-nft-Optimize-class-based-IP-prefix-matches.patch
similarity index 91%
rename from SOURCES/0032-nft-Optimize-class-based-IP-prefix-matches.patch
rename to SOURCES/0020-nft-Optimize-class-based-IP-prefix-matches.patch
index 80f79a2..43b98d6 100644
--- a/SOURCES/0032-nft-Optimize-class-based-IP-prefix-matches.patch
+++ b/SOURCES/0020-nft-Optimize-class-based-IP-prefix-matches.patch
@@ -1,4 +1,4 @@
-From 87a2128fcfd4c5b0847a8c611652ade8c54d8185 Mon Sep 17 00:00:00 2001
+From a48e8c5a7433c8f7d0f28ed321081b25f3b63a4a Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 2 Oct 2020 09:44:38 +0200
 Subject: [PATCH] nft: Optimize class-based IP prefix matches
@@ -8,7 +8,6 @@ prefix lengths.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 323259001d617ae359430a03ee3d3e7f107684e0)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft-arp.c    | 11 ++++++++---
  iptables/nft-ipv4.c   |  6 ++++--
@@ -18,7 +17,7 @@ Signed-off-by: Phil Sutter <psutter@redhat.com>
  5 files changed, 30 insertions(+), 11 deletions(-)
 
 diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index d4a86610ec217..ac400e484a4fa 100644
+index 67f4529d93652..952f0c6916e59 100644
 --- a/iptables/nft-arp.c
 +++ b/iptables/nft-arp.c
 @@ -303,7 +303,8 @@ static bool nft_arp_parse_devaddr(struct nft_xt_ctx *ctx,
@@ -54,7 +53,7 @@ index d4a86610ec217..ac400e484a4fa 100644
  
  			if (inv)
 diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index 70634f8fad84d..c84af2df90da7 100644
+index afdecf9711e64..ce702041af0f4 100644
 --- a/iptables/nft-ipv4.c
 +++ b/iptables/nft-ipv4.c
 @@ -199,7 +199,8 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
@@ -78,7 +77,7 @@ index 70634f8fad84d..c84af2df90da7 100644
  
  		if (inv)
 diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index d01491bfdb689..cfced245a781c 100644
+index 4008b7eab4f2a..c877ec6d10887 100644
 --- a/iptables/nft-ipv6.c
 +++ b/iptables/nft-ipv6.c
 @@ -146,7 +146,8 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
@@ -102,7 +101,7 @@ index d01491bfdb689..cfced245a781c 100644
  
  		if (inv)
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index f60f5df97fb86..b1237049d0a34 100644
+index 7741d23befc5a..545e9c60fa015 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
 @@ -166,16 +166,22 @@ void add_addr(struct nftnl_rule *r, int offset,
@@ -133,10 +132,10 @@ index f60f5df97fb86..b1237049d0a34 100644
  
  	add_cmp_ptr(r, op, data, len);
 diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index bee99a7dd0c93..c7f1e366b75ee 100644
+index 94437ffe7990c..811fb9a1ebe76 100644
 --- a/iptables/nft-shared.h
 +++ b/iptables/nft-shared.h
-@@ -252,4 +252,8 @@ void xtables_restore_parse(struct nft_handle *h,
+@@ -246,4 +246,8 @@ void xtables_restore_parse(struct nft_handle *h,
  			   const struct nft_xt_restore_parse *p);
  
  void nft_check_xt_legacy(int family, bool is_ipt_save);
@@ -146,5 +145,5 @@ index bee99a7dd0c93..c7f1e366b75ee 100644
 +
  #endif
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0020-xtables-Drop-4-and-6-support-from-xtables-save-resto.patch b/SOURCES/0020-xtables-Drop-4-and-6-support-from-xtables-save-resto.patch
deleted file mode 100644
index ccd6b5d..0000000
--- a/SOURCES/0020-xtables-Drop-4-and-6-support-from-xtables-save-resto.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From ea9d40744307d7c49808d8fabfc904d525081055 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 21 Feb 2020 13:29:05 +0100
-Subject: [PATCH] xtables: Drop -4 and -6 support from xtables-{save,restore}
-
-Legacy tools don't support those options, either.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 0f40a8bc49d3f7b815336199931a82f919f37c4e)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/xtables-restore.c |  9 +--------
- iptables/xtables-save.c    | 11 +----------
- 2 files changed, 2 insertions(+), 18 deletions(-)
-
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index 11834c0ea98c5..c472ac9bf651b 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -379,7 +379,7 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
- 		exit(1);
- 	}
- 
--	while ((c = getopt_long(argc, argv, "bcvVthnM:T:46wW", options, NULL)) != -1) {
-+	while ((c = getopt_long(argc, argv, "bcvVthnM:T:wW", options, NULL)) != -1) {
- 		switch (c) {
- 			case 'b':
- 				fprintf(stderr, "-b/--binary option is not implemented\n");
-@@ -408,13 +408,6 @@ xtables_restore_main(int family, const char *progname, int argc, char *argv[])
- 			case 'T':
- 				p.tablename = optarg;
- 				break;
--			case '4':
--				h.family = AF_INET;
--				break;
--			case '6':
--				h.family = AF_INET6;
--				xtables_set_nfproto(AF_INET6);
--				break;
- 			case 'w': /* fallthrough.  Ignored by xt-restore */
- 			case 'W':
- 				if (!optarg && xs_has_arg(argc, argv))
-diff --git a/iptables/xtables-save.c b/iptables/xtables-save.c
-index 228282deaed07..28f7490275ce5 100644
---- a/iptables/xtables-save.c
-+++ b/iptables/xtables-save.c
-@@ -32,7 +32,7 @@
- #define prog_name xtables_globals.program_name
- #define prog_vers xtables_globals.program_version
- 
--static const char *ipt_save_optstring = "bcdt:M:f:46V";
-+static const char *ipt_save_optstring = "bcdt:M:f:V";
- static const struct option ipt_save_options[] = {
- 	{.name = "counters", .has_arg = false, .val = 'c'},
- 	{.name = "version",  .has_arg = false, .val = 'V'},
-@@ -40,8 +40,6 @@ static const struct option ipt_save_options[] = {
- 	{.name = "table",    .has_arg = true,  .val = 't'},
- 	{.name = "modprobe", .has_arg = true,  .val = 'M'},
- 	{.name = "file",     .has_arg = true,  .val = 'f'},
--	{.name = "ipv4",     .has_arg = false, .val = '4'},
--	{.name = "ipv6",     .has_arg = false, .val = '6'},
- 	{NULL},
- };
- 
-@@ -187,13 +185,6 @@ xtables_save_main(int family, int argc, char *argv[],
- 		case 'd':
- 			dump = true;
- 			break;
--		case '4':
--			h.family = AF_INET;
--			break;
--		case '6':
--			h.family = AF_INET6;
--			xtables_set_nfproto(AF_INET6);
--			break;
- 		case 'V':
- 			printf("%s v%s (nf_tables)\n", prog_name, prog_vers);
- 			exit(0);
--- 
-2.26.2
-
diff --git a/SOURCES/0033-ebtables-Optimize-masked-MAC-address-matches.patch b/SOURCES/0021-ebtables-Optimize-masked-MAC-address-matches.patch
similarity index 95%
rename from SOURCES/0033-ebtables-Optimize-masked-MAC-address-matches.patch
rename to SOURCES/0021-ebtables-Optimize-masked-MAC-address-matches.patch
index f70a4fa..ed8b40c 100644
--- a/SOURCES/0033-ebtables-Optimize-masked-MAC-address-matches.patch
+++ b/SOURCES/0021-ebtables-Optimize-masked-MAC-address-matches.patch
@@ -1,4 +1,4 @@
-From 03a484b63c5a61678555bcaca68fa36dc81468c1 Mon Sep 17 00:00:00 2001
+From 06f53a3a19c829417c4083fdbbbeba14c92c7b04 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 30 Oct 2020 14:08:33 +0100
 Subject: [PATCH] ebtables: Optimize masked MAC address matches
@@ -11,7 +11,6 @@ value via parameter.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 274cb05edc58d6fa982a34c84b2f4cf6acc3e335)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft-arp.c    | 12 ++++++++----
  iptables/nft-bridge.c | 22 ++++++++++------------
@@ -22,7 +21,7 @@ Signed-off-by: Phil Sutter <psutter@redhat.com>
  6 files changed, 30 insertions(+), 24 deletions(-)
 
 diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index ac400e484a4fa..776b55949472b 100644
+index 952f0c6916e59..5dc38da831aa0 100644
 --- a/iptables/nft-arp.c
 +++ b/iptables/nft-arp.c
 @@ -178,7 +178,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
@@ -66,7 +65,7 @@ index ac400e484a4fa..776b55949472b 100644
  			 sizeof(struct in_addr), op);
  	}
 diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index 3f85cbbf5e4cf..2aa15e2d1e69d 100644
+index dbf11eb5e1fa8..c1a2c209cc1aa 100644
 --- a/iptables/nft-bridge.c
 +++ b/iptables/nft-bridge.c
 @@ -159,20 +159,16 @@ static int nft_bridge_add(struct nft_handle *h,
@@ -117,7 +116,7 @@ index 3f85cbbf5e4cf..2aa15e2d1e69d 100644
  		fw->bitmask |= EBT_ISOURCE;
  		break;
 diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index c84af2df90da7..5bd0710781533 100644
+index ce702041af0f4..fdc15c6f04066 100644
 --- a/iptables/nft-ipv4.c
 +++ b/iptables/nft-ipv4.c
 @@ -50,13 +50,15 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
@@ -139,7 +138,7 @@ index c84af2df90da7..5bd0710781533 100644
  			 sizeof(struct in_addr), op);
  	}
 diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index cfced245a781c..6ece631d85f59 100644
+index c877ec6d10887..130ad3e6e7c44 100644
 --- a/iptables/nft-ipv6.c
 +++ b/iptables/nft-ipv6.c
 @@ -51,7 +51,8 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
@@ -163,7 +162,7 @@ index cfced245a781c..6ece631d85f59 100644
  			 sizeof(struct in6_addr), op);
  	}
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index b1237049d0a34..2aae0a3a49dfe 100644
+index 545e9c60fa015..10553ab26823b 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
 @@ -20,7 +20,6 @@
@@ -193,7 +192,7 @@ index b1237049d0a34..2aae0a3a49dfe 100644
  	if (bitwise)
  		add_bitwise(r, mask, len);
 diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index c7f1e366b75ee..520a296fb530c 100644
+index 811fb9a1ebe76..6fc81d9ce08ef 100644
 --- a/iptables/nft-shared.h
 +++ b/iptables/nft-shared.h
 @@ -8,6 +8,7 @@
@@ -204,7 +203,7 @@ index c7f1e366b75ee..520a296fb530c 100644
  
  #include "xshared.h"
  
-@@ -124,7 +125,7 @@ void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op);
+@@ -121,7 +122,7 @@ void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op);
  void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op);
  void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op);
  void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op);
@@ -214,5 +213,5 @@ index c7f1e366b75ee..520a296fb530c 100644
  void add_proto(struct nftnl_rule *r, int offset, size_t len,
  	       uint8_t proto, uint32_t op);
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0021-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch b/SOURCES/0021-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
deleted file mode 100644
index 0ca025c..0000000
--- a/SOURCES/0021-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From b29b3a215b9cbec20ea633e6a861accfc48b59bb Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sat, 9 May 2020 13:36:49 +0200
-Subject: [PATCH] nfnl_osf: Fix broken conversion to nfnl_query()
-
-Due to missing NLM_F_ACK flag in request, nfnetlink code in kernel
-didn't create an own ACK message but left it upon subsystem to ACK or
-not. Since nfnetlink_osf doesn't ACK by itself, nfnl_query() got stuck
-waiting for a reply.
-
-Whoever did the conversion from deprecated nfnl_talk() obviously didn't
-even test basic functionality of the tool.
-
-Fixes: 52aa15098ebd6 ("nfnl_osf: Replace deprecated nfnl_talk() by nfnl_query()")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c8332553caf48132403895bae750b3cd09a2efd8)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- utils/nfnl_osf.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c
-index 15d531975e11d..922d90ac135b7 100644
---- a/utils/nfnl_osf.c
-+++ b/utils/nfnl_osf.c
-@@ -378,9 +378,11 @@ static int osf_load_line(char *buffer, int len, int del)
- 	memset(buf, 0, sizeof(buf));
- 
- 	if (del)
--		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE, NLM_F_REQUEST);
-+		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_REMOVE,
-+			      NLM_F_ACK | NLM_F_REQUEST);
- 	else
--		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD, NLM_F_REQUEST | NLM_F_CREATE);
-+		nfnl_fill_hdr(nfnlssh, nmh, 0, AF_UNSPEC, 0, OSF_MSG_ADD,
-+			      NLM_F_ACK | NLM_F_REQUEST | NLM_F_CREATE);
- 
- 	nfnl_addattr_l(nmh, sizeof(buf), OSF_ATTR_FINGER, &f, sizeof(struct xt_osf_user_finger));
- 
--- 
-2.26.2
-
diff --git a/SOURCES/0022-nfnl_osf-Improve-error-handling.patch b/SOURCES/0022-nfnl_osf-Improve-error-handling.patch
deleted file mode 100644
index df9cfd3..0000000
--- a/SOURCES/0022-nfnl_osf-Improve-error-handling.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From acc1fb93b3674f81c9d1daa0e4e855410d2568b0 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sat, 9 May 2020 13:42:56 +0200
-Subject: [PATCH] nfnl_osf: Improve error handling
-
-For some error cases, no log message was created - hence apart from the
-return code there was no indication of failing execution.
-
-If a line load fails, don't abort but continue with the remaining
-file contents. The current pf.os file in this repository serves as
-proof-of-concept:
-
-Lines 700 and 701: Duplicates of lines 698 and 699 because 'W*' and 'W0'
-parse into the same data.
-
-Line 704: Duplicate of line 702 because apart from 'W*' and 'W0', only
-the first three fields on right-hand side are sent to the kernel.
-
-When loading, these dups are ignored (they would bounce if NLM_F_EXCL
-was given). Upon deletion, they cause ENOENT response from kernel. In
-order to align duplicate-tolerance in both modes, just ignore that
-ENOENT.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 3e09bd1888575cfec136574d2b0e810ba33f1cfb)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- utils/nfnl_osf.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
-diff --git a/utils/nfnl_osf.c b/utils/nfnl_osf.c
-index 922d90ac135b7..8008e83d8af4b 100644
---- a/utils/nfnl_osf.c
-+++ b/utils/nfnl_osf.c
-@@ -392,7 +392,7 @@ static int osf_load_line(char *buffer, int len, int del)
- static int osf_load_entries(char *path, int del)
- {
- 	FILE *inf;
--	int err = 0;
-+	int err = 0, lineno = 0;
- 	char buf[1024];
- 
- 	inf = fopen(path, "r");
-@@ -402,7 +402,9 @@ static int osf_load_entries(char *path, int del)
- 	}
- 
- 	while(fgets(buf, sizeof(buf), inf)) {
--		int len;
-+		int len, rc;
-+
-+		lineno++;
- 
- 		if (buf[0] == '#' || buf[0] == '\n' || buf[0] == '\r')
- 			continue;
-@@ -414,9 +416,11 @@ static int osf_load_entries(char *path, int del)
- 
- 		buf[len] = '\0';
- 
--		err = osf_load_line(buf, len, del);
--		if (err)
--			break;
-+		rc = osf_load_line(buf, len, del);
-+		if (rc && (!del || errno != ENOENT)) {
-+			ulog_err("Failed to load line %d", lineno);
-+			err = rc;
-+		}
- 
- 		memset(buf, 0, sizeof(buf));
- 	}
-@@ -448,6 +452,7 @@ int main(int argc, char *argv[])
- 
- 	if (!fingerprints) {
- 		err = -ENOENT;
-+		ulog("Missing fingerprints file argument.\n");
- 		goto err_out_exit;
- 	}
- 
--- 
-2.26.2
-
diff --git a/SOURCES/0034-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch b/SOURCES/0022-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
similarity index 98%
rename from SOURCES/0034-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
rename to SOURCES/0022-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
index 281a9d4..ca2df0d 100644
--- a/SOURCES/0034-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
+++ b/SOURCES/0022-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
@@ -1,4 +1,4 @@
-From 6aef90100bebe2b00d4edffe59fb9c43643816de Mon Sep 17 00:00:00 2001
+From f07a5fdd6c2a5ffe962ba77b8bfa08673f3b9408 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 10 Nov 2020 14:50:46 +0100
 Subject: [PATCH] tests/shell: Add test for bitwise avoidance fixes
@@ -10,7 +10,6 @@ each situation.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 81a2e128512837b53e5b9ea501b6c8dc64eeca78)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  .../nft-only/0009-needless-bitwise_0          | 339 ++++++++++++++++++
  1 file changed, 339 insertions(+)
@@ -362,5 +361,5 @@ index 0000000000000..c5c6e706a1029
 +
 +diff -u -Z <(echo "$EXPECT") <(nft --debug=netlink list ruleset | awk '/^table/{exit} {print}')
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0023-ebtables-Fix-for-broken-chain-renaming.patch b/SOURCES/0023-ebtables-Fix-for-broken-chain-renaming.patch
new file mode 100644
index 0000000..697a336
--- /dev/null
+++ b/SOURCES/0023-ebtables-Fix-for-broken-chain-renaming.patch
@@ -0,0 +1,61 @@
+From d4e535422a9f4908b6d4b331b9e9cffe7ef161f3 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 17 Nov 2020 11:38:27 +0100
+Subject: [PATCH] ebtables: Fix for broken chain renaming
+
+Loading extensions pollutes 'errno' value, hence before using it to
+indicate failure it should be sanitized. This was done by the called
+function before the parsing/netlink split and not migrated by accident.
+Move it into calling code to clarify the connection.
+
+Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247)
+---
+ iptables/nft.c                                                | 3 ---
+ iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++
+ iptables/xtables-eb.c                                         | 1 +
+ 3 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index bdb633a82a655..bdf252198f155 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1932,9 +1932,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
+ 		return 0;
+ 	}
+ 
+-	/* Config load changed errno. Ensure genuine info for our callers. */
+-	errno = 0;
+-
+ 	/* Find the old chain to be renamed */
+ 	c = nft_chain_find(h, table, chain);
+ 	if (c == NULL) {
+diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
+index 0c1eb4ca66f52..6f11bd12593dd 100755
+--- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
++++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
+@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then
+ 	exit 1
+ fi
+ 
++$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1
++$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1
++$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
++
+ $XT_MULTI ebtables -t $t -F || exit 0
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 375a95d1d5c75..6df5839f07436 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 				else if (strchr(argv[optind], ' ') != NULL)
+ 					xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
+ 
++				errno = 0;
+ 				ret = nft_cmd_chain_user_rename(h, chain, *table,
+ 							    argv[optind]);
+ 				if (ret != 0 && errno == ENOENT)
+-- 
+2.40.0
+
diff --git a/SOURCES/0023-nft-cache-Reset-genid-when-rebuilding-cache.patch b/SOURCES/0023-nft-cache-Reset-genid-when-rebuilding-cache.patch
deleted file mode 100644
index 67f69ea..0000000
--- a/SOURCES/0023-nft-cache-Reset-genid-when-rebuilding-cache.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 3b98024d952d265d50078c5b7ad04c9c65373733 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <psutter@redhat.com>
-Date: Fri, 29 May 2020 19:33:22 +0200
-Subject: [PATCH] nft: cache: Reset genid when rebuilding cache
-
-This is required in order to avoid a cache rebuild loop if
-iptables-nft-restore is called with '--test' parameter and a dump
-containing more than a single table.
-
-If non-zero, __nft_build_cache() never updates genid and therefore the
-incorrect genid (caused by increment in nft_action()) is never
-corrected.
-
-This is a RHEL-only fix, upstream rewrote the whole cache logic which
-implicitly resolved this problem.
-
-Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress")
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft-cache.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index 07265b7795e4f..bc6e7f7eaebfb 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h)
- 	if (h->cache_level)
- 		__nft_flush_cache(h);
- 
-+	h->nft_genid = 0;
- 	h->cache_level = NFT_CL_NONE;
- 	__nft_build_cache(h, level, NULL, NULL, NULL);
- }
--- 
-2.26.2
-
diff --git a/SOURCES/0024-nft-Fix-for-F-in-iptables-dumps.patch b/SOURCES/0024-nft-Fix-for-F-in-iptables-dumps.patch
deleted file mode 100644
index cf2c571..0000000
--- a/SOURCES/0024-nft-Fix-for-F-in-iptables-dumps.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 8ae56bbaa4119bdcf1d6abc8b78f21490657983c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 24 Apr 2020 11:32:08 +0200
-Subject: [PATCH] nft: Fix for '-F' in iptables dumps
-
-When restoring a dump which contains an explicit flush command,
-previously added rules are removed from cache and the following commit
-will try to create netlink messages based on freed memory.
-
-Fix this by weeding any rule-based commands from obj_list if they
-address the same chain.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 5bd3ab5c778033877d44a0c619ef6f98f34516af)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft.c | 34 ++++++++++++++++++++++++++++++++++
- 1 file changed, 34 insertions(+)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 4930b6de534d8..e95e99f1d8d71 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -411,6 +411,38 @@ batch_rule_add(struct nft_handle *h, enum obj_update_type type,
- 	return batch_add(h, type, r);
- }
- 
-+static void batch_obj_del(struct nft_handle *h, struct obj_update *o);
-+
-+static void batch_chain_flush(struct nft_handle *h,
-+			      const char *table, const char *chain)
-+{
-+	struct obj_update *obj, *tmp;
-+
-+	list_for_each_entry_safe(obj, tmp, &h->obj_list, head) {
-+		struct nftnl_rule *r = obj->ptr;
-+
-+		switch (obj->type) {
-+		case NFT_COMPAT_RULE_APPEND:
-+		case NFT_COMPAT_RULE_INSERT:
-+		case NFT_COMPAT_RULE_REPLACE:
-+		case NFT_COMPAT_RULE_DELETE:
-+			break;
-+		default:
-+			continue;
-+		}
-+
-+		if (table &&
-+		    strcmp(table, nftnl_rule_get_str(r, NFTNL_RULE_TABLE)))
-+			continue;
-+
-+		if (chain &&
-+		    strcmp(chain, nftnl_rule_get_str(r, NFTNL_RULE_CHAIN)))
-+			continue;
-+
-+		batch_obj_del(h, obj);
-+	}
-+}
-+
- const struct builtin_table xtables_ipv4[NFT_TABLE_MAX] = {
- 	[NFT_TABLE_RAW] = {
- 		.name	= "raw",
-@@ -1671,6 +1703,7 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
- 	}
- 
- 	if (chain || !verbose) {
-+		batch_chain_flush(h, table, chain);
- 		__nft_rule_flush(h, table, chain, verbose, false);
- 		flush_rule_cache(h, table, c);
- 		return 1;
-@@ -1686,6 +1719,7 @@ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
- 	while (c != NULL) {
- 		chain = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
- 
-+		batch_chain_flush(h, table, chain);
- 		__nft_rule_flush(h, table, chain, verbose, false);
- 		flush_rule_cache(h, table, c);
- 		c = nftnl_chain_list_iter_next(iter);
--- 
-2.27.0
-
diff --git a/SOURCES/0052-xtables-arp-Don-t-use-ARPT_INV_.patch b/SOURCES/0024-xtables-arp-Don-t-use-ARPT_INV_.patch
similarity index 94%
rename from SOURCES/0052-xtables-arp-Don-t-use-ARPT_INV_.patch
rename to SOURCES/0024-xtables-arp-Don-t-use-ARPT_INV_.patch
index a24c2f8..9d2debc 100644
--- a/SOURCES/0052-xtables-arp-Don-t-use-ARPT_INV_.patch
+++ b/SOURCES/0024-xtables-arp-Don-t-use-ARPT_INV_.patch
@@ -1,4 +1,4 @@
-From a5d52efe21e0f0ba6447b48e1646bb7046cb09eb Mon Sep 17 00:00:00 2001
+From 38e8df1b4409387145c79fc358419d59b5ec3800 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 3 Nov 2020 12:21:29 +0100
 Subject: [PATCH] xtables-arp: Don't use ARPT_INV_*
@@ -22,7 +22,7 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  3 files changed, 53 insertions(+), 68 deletions(-)
 
 diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 776b55949472b..ec8147dd58c0d 100644
+index 5dc38da831aa0..c82ffdc95e300 100644
 --- a/iptables/nft-arp.c
 +++ b/iptables/nft-arp.c
 @@ -134,34 +134,34 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
@@ -262,7 +262,7 @@ index 776b55949472b..ec8147dd58c0d 100644
  			? "! " : "");
  		if (format & FMT_NUMERIC)
  			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
-@@ -515,7 +493,7 @@ after_devsrc:
+@@ -515,7 +493,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
  			break;
  	if (i == ARPT_DEV_ADDR_LEN_MAX)
  		goto after_devdst;
@@ -271,7 +271,7 @@ index 776b55949472b..ec8147dd58c0d 100644
  		? "! " : "");
  	printf("--dst-mac ");
  	xtables_print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
-@@ -525,7 +503,7 @@ after_devsrc:
+@@ -525,7 +503,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
  after_devdst:
  
  	if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
@@ -280,7 +280,7 @@ index 776b55949472b..ec8147dd58c0d 100644
  			? "! " : "");
  		printf("--h-length %d", fw->arp.arhln);
  		if (fw->arp.arhln_mask != 255)
-@@ -536,7 +514,7 @@ after_devdst:
+@@ -536,7 +514,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
  	if (fw->arp.arpop_mask != 0) {
  		int tmp = ntohs(fw->arp.arpop);
  
@@ -289,7 +289,7 @@ index 776b55949472b..ec8147dd58c0d 100644
  			? "! " : "");
  		if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
  			printf("--opcode %s", arp_opcodes[tmp-1]);
-@@ -551,7 +529,7 @@ after_devdst:
+@@ -551,7 +529,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
  	if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
  		uint16_t tmp = ntohs(fw->arp.arhrd);
  
@@ -298,7 +298,7 @@ index 776b55949472b..ec8147dd58c0d 100644
  			? "! " : "");
  		if (tmp == 1 && !(format & FMT_NUMERIC))
  			printf("--h-type %s", "Ethernet");
-@@ -565,7 +543,7 @@ after_devdst:
+@@ -565,7 +543,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
  	if (fw->arp.arpro_mask != 0) {
  		int tmp = ntohs(fw->arp.arpro);
  
@@ -324,7 +324,7 @@ index 3411fc3d7c7b3..0d93a31f563b1 100644
 +
  #endif
 diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
-index c8196f08baa59..3f96cb22c3ec0 100644
+index 8632774dfb705..3a35dcd107e19 100644
 --- a/iptables/xtables-arp.c
 +++ b/iptables/xtables-arp.c
 @@ -113,22 +113,22 @@ struct xtables_globals arptables_globals = {
@@ -360,7 +360,7 @@ index c8196f08baa59..3f96cb22c3ec0 100644
  };
  
  /***********************************************/
-@@ -903,7 +903,7 @@ int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
+@@ -901,7 +901,7 @@ int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
  					 &dmasks, &ndaddrs);
  
  	if ((nsaddrs > 1 || ndaddrs > 1) &&
@@ -370,5 +370,5 @@ index c8196f08baa59..3f96cb22c3ec0 100644
  				" source or destination IP addresses");
  
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0025-tests-shell-Test-F-in-dump-files.patch b/SOURCES/0025-tests-shell-Test-F-in-dump-files.patch
deleted file mode 100644
index 628a565..0000000
--- a/SOURCES/0025-tests-shell-Test-F-in-dump-files.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From dd98af599516806e2eb3e1186d0ad52ce7c6b4b5 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 21 Apr 2020 14:10:53 +0200
-Subject: [PATCH] tests: shell: Test -F in dump files
-
-While not really useful, iptables-nft-restore shouldn't segfault either.
-This tests the problem described in nfbz#1407.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit f2ace0cdf25a5911ac84015829d65d6050a5e82d)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- .../tests/shell/testcases/ipt-restore/0012-dash-F_0  | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
- create mode 100755 iptables/tests/shell/testcases/ipt-restore/0012-dash-F_0
-
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0012-dash-F_0 b/iptables/tests/shell/testcases/ipt-restore/0012-dash-F_0
-new file mode 100755
-index 0000000000000..fd82afa1bc8ce
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ipt-restore/0012-dash-F_0
-@@ -0,0 +1,12 @@
-+#!/bin/bash -e
-+
-+# make sure -F lines don't cause segfaults
-+
-+RULESET='*nat
-+-F PREROUTING
-+-A PREROUTING -j ACCEPT
-+-F PREROUTING
-+COMMIT'
-+
-+echo -e "$RULESET" | $XT_MULTI iptables-restore
-+echo -e "$RULESET" | $XT_MULTI iptables-restore -n
--- 
-2.27.0
-
diff --git a/SOURCES/0025-xshared-Merge-some-command-option-related-code.patch b/SOURCES/0025-xshared-Merge-some-command-option-related-code.patch
new file mode 100644
index 0000000..7284b65
--- /dev/null
+++ b/SOURCES/0025-xshared-Merge-some-command-option-related-code.patch
@@ -0,0 +1,517 @@
+From 003b063b1b40503bc996a4f88c1941c91a0c550b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 30 Oct 2020 12:42:57 +0100
+Subject: [PATCH] xshared: Merge some command option-related code
+
+Add OPT_FRAGMENT define into the enum of other OPT_* defines at the
+right position and adjust the arptables-specific ones that follow
+accordingly. Appropriately adjust inverse_for_options array in
+xtables-arp.c.
+
+Extend optflags from iptables.c by the arptables values for the sake of
+completeness, then move it to xshared.h along with NUMBER_OF_OPT
+definition. As a side-effect, this fixes for wrong ordering of entries
+in arptables' 'optflags' copy.
+
+Add arptables-specific bits to commands_v_options table (the speicific
+options are matches on ARP header fields, just treat them like '-s'
+option. This is also just a cosmetic change, arptables doesn't have a
+generic_opt_check() implementation and hence doesn't use such a table.
+
+With things potentially ready for common use, move commands_v_options
+table along with generic_opt_check() and opt2char() into xshared.c and
+drop the local (identical) implementations from iptables.c, ip6tables.c
+xtables.c and xtables-arp.c. While doing so, fix ordering of entries in
+that table: the row for CMD_ZERO_NUM was in the wrong position. Since
+all moved rows though are identical, this had no effect in practice.
+
+Fixes: d960a991350ca ("xtables-arp: Integrate OPT_* defines into xshared.h")
+Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 8bd4b4f79b5de483353a8c0d0962e71934b7bdd2)
+---
+ iptables/ip6tables.c   | 79 -----------------------------------------
+ iptables/iptables.c    | 80 ------------------------------------------
+ iptables/xshared.c     | 74 ++++++++++++++++++++++++++++++++++++++
+ iptables/xshared.h     | 20 +++++++----
+ iptables/xtables-arp.c | 14 +-------
+ iptables/xtables.c     | 80 ------------------------------------------
+ 6 files changed, 89 insertions(+), 258 deletions(-)
+
+diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
+index 576c2cf8b0d9f..c95355b091568 100644
+--- a/iptables/ip6tables.c
++++ b/iptables/ip6tables.c
+@@ -45,10 +45,6 @@
+ #include "ip6tables-multi.h"
+ #include "xshared.h"
+ 
+-#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
+-static const char optflags[]
+-= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c'};
+-
+ static const char unsupported_rev[] = " [unsupported revision]";
+ 
+ static struct option original_opts[] = {
+@@ -100,36 +96,6 @@ struct xtables_globals ip6tables_globals = {
+ 	.compat_rev = xtables_compatible_revision,
+ };
+ 
+-/* Table of legal combinations of commands and options.  If any of the
+- * given commands make an option legal, that option is legal (applies to
+- * CMD_LIST and CMD_ZERO only).
+- * Key:
+- *  +  compulsory
+- *  x  illegal
+- *     optional
+- */
+-
+-static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
+-/* Well, it's better than "Re: Linux vs FreeBSD" */
+-{
+-	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c */
+-/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
+-/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
+-/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
+-/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
+-/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x'},
+-/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' '},
+-/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x'},
+-/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
+-};
+-
+ static const unsigned int inverse_for_options[NUMBER_OF_OPT] =
+ {
+ /* -n */ 0,
+@@ -264,51 +230,6 @@ ip6tables_exit_error(enum xtables_exittype status, const char *msg, ...)
+ 	exit(status);
+ }
+ 
+-static void
+-generic_opt_check(int command, int options)
+-{
+-	int i, j, legal = 0;
+-
+-	/* Check that commands are valid with options.  Complicated by the
+-	 * fact that if an option is legal with *any* command given, it is
+-	 * legal overall (ie. -z and -l).
+-	 */
+-	for (i = 0; i < NUMBER_OF_OPT; i++) {
+-		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
+-
+-		for (j = 0; j < NUMBER_OF_CMD; j++) {
+-			if (!(command & (1<<j)))
+-				continue;
+-
+-			if (!(options & (1<<i))) {
+-				if (commands_v_options[j][i] == '+')
+-					xtables_error(PARAMETER_PROBLEM,
+-						   "You need to supply the `-%c' "
+-						   "option for this command\n",
+-						   optflags[i]);
+-			} else {
+-				if (commands_v_options[j][i] != 'x')
+-					legal = 1;
+-				else if (legal == 0)
+-					legal = -1;
+-			}
+-		}
+-		if (legal == -1)
+-			xtables_error(PARAMETER_PROBLEM,
+-				   "Illegal option `-%c' with this command\n",
+-				   optflags[i]);
+-	}
+-}
+-
+-static char
+-opt2char(int option)
+-{
+-	const char *ptr;
+-	for (ptr = optflags; option > 1; option >>= 1, ptr++);
+-
+-	return *ptr;
+-}
+-
+ /*
+  *	All functions starting with "parse" should succeed, otherwise
+  *	the program fails.
+diff --git a/iptables/iptables.c b/iptables/iptables.c
+index 88ef6cf666d4b..7d6183116d265 100644
+--- a/iptables/iptables.c
++++ b/iptables/iptables.c
+@@ -41,11 +41,6 @@
+ #include <fcntl.h>
+ #include "xshared.h"
+ 
+-#define OPT_FRAGMENT    0x00800U
+-#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
+-static const char optflags[]
+-= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};
+-
+ static const char unsupported_rev[] = " [unsupported revision]";
+ 
+ static struct option original_opts[] = {
+@@ -99,36 +94,6 @@ struct xtables_globals iptables_globals = {
+ 	.compat_rev = xtables_compatible_revision,
+ };
+ 
+-/* Table of legal combinations of commands and options.  If any of the
+- * given commands make an option legal, that option is legal (applies to
+- * CMD_LIST and CMD_ZERO only).
+- * Key:
+- *  +  compulsory
+- *  x  illegal
+- *     optional
+- */
+-
+-static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
+-/* Well, it's better than "Re: Linux vs FreeBSD" */
+-{
+-	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f */
+-/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
+-/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
+-/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
+-/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
+-/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},
+-/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},
+-/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
+-};
+-
+ static const int inverse_for_options[NUMBER_OF_OPT] =
+ {
+ /* -n */ 0,
+@@ -263,51 +228,6 @@ iptables_exit_error(enum xtables_exittype status, const char *msg, ...)
+ 	exit(status);
+ }
+ 
+-static void
+-generic_opt_check(int command, int options)
+-{
+-	int i, j, legal = 0;
+-
+-	/* Check that commands are valid with options.  Complicated by the
+-	 * fact that if an option is legal with *any* command given, it is
+-	 * legal overall (ie. -z and -l).
+-	 */
+-	for (i = 0; i < NUMBER_OF_OPT; i++) {
+-		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
+-
+-		for (j = 0; j < NUMBER_OF_CMD; j++) {
+-			if (!(command & (1<<j)))
+-				continue;
+-
+-			if (!(options & (1<<i))) {
+-				if (commands_v_options[j][i] == '+')
+-					xtables_error(PARAMETER_PROBLEM,
+-						   "You need to supply the `-%c' "
+-						   "option for this command\n",
+-						   optflags[i]);
+-			} else {
+-				if (commands_v_options[j][i] != 'x')
+-					legal = 1;
+-				else if (legal == 0)
+-					legal = -1;
+-			}
+-		}
+-		if (legal == -1)
+-			xtables_error(PARAMETER_PROBLEM,
+-				   "Illegal option `-%c' with this command\n",
+-				   optflags[i]);
+-	}
+-}
+-
+-static char
+-opt2char(int option)
+-{
+-	const char *ptr;
+-	for (ptr = optflags; option > 1; option >>= 1, ptr++);
+-
+-	return *ptr;
+-}
+-
+ /*
+  *	All functions starting with "parse" should succeed, otherwise
+  *	the program fails.
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index c1d1371a6d54a..fe37c30a085d6 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -774,3 +774,77 @@ int parse_rulenumber(const char *rule)
+ 
+ 	return rulenum;
+ }
++
++/* Table of legal combinations of commands and options.  If any of the
++ * given commands make an option legal, that option is legal (applies to
++ * CMD_LIST and CMD_ZERO only).
++ * Key:
++ *  +  compulsory
++ *  x  illegal
++ *     optional
++ */
++static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
++/* Well, it's better than "Re: Linux vs FreeBSD" */
++{
++	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f 2 3 l 4 5 6 */
++/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
++/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' ',' ',' ',' ',' ',' ',' '},
++/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
++/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
++/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x','x','x','x','x','x','x'},
++/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x','x','x','x','x','x','x'},
++/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
++/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' ',' ',' ',' ',' ',' ',' '},
++};
++
++void generic_opt_check(int command, int options)
++{
++	int i, j, legal = 0;
++
++	/* Check that commands are valid with options. Complicated by the
++	 * fact that if an option is legal with *any* command given, it is
++	 * legal overall (ie. -z and -l).
++	 */
++	for (i = 0; i < NUMBER_OF_OPT; i++) {
++		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
++
++		for (j = 0; j < NUMBER_OF_CMD; j++) {
++			if (!(command & (1<<j)))
++				continue;
++
++			if (!(options & (1<<i))) {
++				if (commands_v_options[j][i] == '+')
++					xtables_error(PARAMETER_PROBLEM,
++						   "You need to supply the `-%c' "
++						   "option for this command\n",
++						   optflags[i]);
++			} else {
++				if (commands_v_options[j][i] != 'x')
++					legal = 1;
++				else if (legal == 0)
++					legal = -1;
++			}
++		}
++		if (legal == -1)
++			xtables_error(PARAMETER_PROBLEM,
++				   "Illegal option `-%c' with this command\n",
++				   optflags[i]);
++	}
++}
++
++char opt2char(int option)
++{
++	const char *ptr;
++
++	for (ptr = optflags; option > 1; option >>= 1, ptr++)
++		;
++
++	return *ptr;
++}
+diff --git a/iptables/xshared.h b/iptables/xshared.h
+index c41bd054bf36f..9159b2b1f3768 100644
+--- a/iptables/xshared.h
++++ b/iptables/xshared.h
+@@ -30,15 +30,20 @@ enum {
+ 	OPT_VIANAMEOUT  = 1 << 8,
+ 	OPT_LINENUMBERS = 1 << 9,
+ 	OPT_COUNTERS    = 1 << 10,
++	OPT_FRAGMENT	= 1 << 11,
+ 	/* below are for arptables only */
+-	OPT_S_MAC	= 1 << 11,
+-	OPT_D_MAC	= 1 << 12,
+-	OPT_H_LENGTH	= 1 << 13,
+-	OPT_OPCODE	= 1 << 14,
+-	OPT_H_TYPE	= 1 << 15,
+-	OPT_P_TYPE	= 1 << 16,
++	OPT_S_MAC	= 1 << 12,
++	OPT_D_MAC	= 1 << 13,
++	OPT_H_LENGTH	= 1 << 14,
++	OPT_OPCODE	= 1 << 15,
++	OPT_H_TYPE	= 1 << 16,
++	OPT_P_TYPE	= 1 << 17,
+ };
+ 
++#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
++static const char optflags[]
++= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f', 2, 3, 'l', 4, 5, 6 };
++
+ enum {
+ 	CMD_NONE		= 0,
+ 	CMD_INSERT		= 1 << 0,
+@@ -216,4 +221,7 @@ void add_command(unsigned int *cmd, const int newcmd,
+ 		 const int othercmds, int invert);
+ int parse_rulenumber(const char *rule);
+ 
++void generic_opt_check(int command, int options);
++char opt2char(int option);
++
+ #endif /* IPTABLES_XSHARED_H */
+diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
+index 3a35dcd107e19..0695504892b74 100644
+--- a/iptables/xtables-arp.c
++++ b/iptables/xtables-arp.c
+@@ -53,10 +53,6 @@
+ #include "nft-arp.h"
+ #include <linux/netfilter_arp/arp_tables.h>
+ 
+-#define NUMBER_OF_OPT	16
+-static const char optflags[NUMBER_OF_OPT]
+-= { 'n', 's', 'd', 2, 3, 7, 8, 4, 5, 6, 'j', 'v', 'i', 'o', '0', 'c'};
+-
+ static struct option original_opts[] = {
+ 	{ "append", 1, 0, 'A' },
+ 	{ "delete", 1, 0,  'D' },
+@@ -123,6 +119,7 @@ static int inverse_for_options[] =
+ /* -o */ IPT_INV_VIA_OUT,
+ /*--line*/ 0,
+ /* -c */ 0,
++/* -f */ 0,
+ /* 2 */ IPT_INV_SRCDEVADDR,
+ /* 3 */ IPT_INV_TGTDEVADDR,
+ /* -l */ IPT_INV_ARPHLN,
+@@ -327,15 +324,6 @@ printhelp(void)
+ 	}
+ }
+ 
+-static char
+-opt2char(int option)
+-{
+-	const char *ptr;
+-	for (ptr = optflags; option > 1; option >>= 1, ptr++);
+-
+-	return *ptr;
+-}
+-
+ static int
+ check_inverse(const char option[], int *invert, int *optidx, int argc)
+ {
+diff --git a/iptables/xtables.c b/iptables/xtables.c
+index 9d2e441e0b773..9779bd83d53b3 100644
+--- a/iptables/xtables.c
++++ b/iptables/xtables.c
+@@ -43,11 +43,6 @@
+ #include "nft-shared.h"
+ #include "nft.h"
+ 
+-#define OPT_FRAGMENT	0x00800U
+-#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
+-static const char optflags[]
+-= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};
+-
+ static struct option original_opts[] = {
+ 	{.name = "append",	  .has_arg = 1, .val = 'A'},
+ 	{.name = "delete",	  .has_arg = 1, .val = 'D'},
+@@ -99,36 +94,6 @@ struct xtables_globals xtables_globals = {
+ 	.compat_rev = nft_compatible_revision,
+ };
+ 
+-/* Table of legal combinations of commands and options.  If any of the
+- * given commands make an option legal, that option is legal (applies to
+- * CMD_LIST and CMD_ZERO only).
+- * Key:
+- *  +  compulsory
+- *  x  illegal
+- *     optional
+- */
+-
+-static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
+-/* Well, it's better than "Re: Linux vs FreeBSD" */
+-{
+-	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f */
+-/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
+-/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
+-/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
+-/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
+-/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},
+-/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},
+-/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
+-/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
+-};
+-
+ static const int inverse_for_options[NUMBER_OF_OPT] =
+ {
+ /* -n */ 0,
+@@ -262,51 +227,6 @@ xtables_exit_error(enum xtables_exittype status, const char *msg, ...)
+ 	exit(status);
+ }
+ 
+-static void
+-generic_opt_check(int command, int options)
+-{
+-	int i, j, legal = 0;
+-
+-	/* Check that commands are valid with options.	Complicated by the
+-	 * fact that if an option is legal with *any* command given, it is
+-	 * legal overall (ie. -z and -l).
+-	 */
+-	for (i = 0; i < NUMBER_OF_OPT; i++) {
+-		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
+-
+-		for (j = 0; j < NUMBER_OF_CMD; j++) {
+-			if (!(command & (1<<j)))
+-				continue;
+-
+-			if (!(options & (1<<i))) {
+-				if (commands_v_options[j][i] == '+')
+-					xtables_error(PARAMETER_PROBLEM,
+-						   "You need to supply the `-%c' "
+-						   "option for this command\n",
+-						   optflags[i]);
+-			} else {
+-				if (commands_v_options[j][i] != 'x')
+-					legal = 1;
+-				else if (legal == 0)
+-					legal = -1;
+-			}
+-		}
+-		if (legal == -1)
+-			xtables_error(PARAMETER_PROBLEM,
+-				   "Illegal option `-%c' with this command\n",
+-				   optflags[i]);
+-	}
+-}
+-
+-static char
+-opt2char(int option)
+-{
+-	const char *ptr;
+-	for (ptr = optflags; option > 1; option >>= 1, ptr++);
+-
+-	return *ptr;
+-}
+-
+ /*
+  *	All functions starting with "parse" should succeed, otherwise
+  *	the program fails.
+-- 
+2.40.0
+
diff --git a/SOURCES/0038-tests-shell-Test-for-fixed-extension-registration.patch b/SOURCES/0026-tests-shell-Test-for-fixed-extension-registration.patch
similarity index 93%
rename from SOURCES/0038-tests-shell-Test-for-fixed-extension-registration.patch
rename to SOURCES/0026-tests-shell-Test-for-fixed-extension-registration.patch
index 7a5cca6..aa7621f 100644
--- a/SOURCES/0038-tests-shell-Test-for-fixed-extension-registration.patch
+++ b/SOURCES/0026-tests-shell-Test-for-fixed-extension-registration.patch
@@ -1,4 +1,4 @@
-From f5185f4efad409fc7ec4ae05267b642ee4103a6c Mon Sep 17 00:00:00 2001
+From 8d0f11ea353caa254b65b4fde240e5d3a8fe12a7 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 4 Dec 2020 17:44:51 +0100
 Subject: [PATCH] tests/shell: Test for fixed extension registration
@@ -11,7 +11,6 @@ effective.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 93d0c97e8b6713f51ba679e01a1338d4f9076e7c)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  .../0017-pointless-compat-checks_0            | 25 +++++++++++++++++++
  1 file changed, 25 insertions(+)
@@ -49,5 +48,5 @@ index 0000000000000..cf73de32df409
 +# patched only 12 but keep a certain margin for future changes
 +[[ $socketcount -lt 20 ]]
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0043-extensions-dccp-Fix-for-DCCP-type-INVALID.patch b/SOURCES/0027-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
similarity index 98%
rename from SOURCES/0043-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
rename to SOURCES/0027-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
index bf463a2..2fe9c6d 100644
--- a/SOURCES/0043-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
+++ b/SOURCES/0027-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
@@ -1,4 +1,4 @@
-From 98794894774a39927bc975921fc9e40f00db937b Mon Sep 17 00:00:00 2001
+From 8a10ad0e149cf1c6d0c34bd554a8e0a35cdf3e8d Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Wed, 2 Dec 2020 13:37:06 +0100
 Subject: [PATCH] extensions: dccp: Fix for DCCP type 'INVALID'
@@ -27,7 +27,6 @@ Fixes: e40b11d7ef827 ("add support for new 'dccp' protocol match")
 Fixes: c94a998724143 ("extensions: libxt_dccp: Add translation to nft")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 4bcbc8e11a2764f4537dc405962f83cd072cccfe)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  extensions/libxt_dccp.c      | 58 ++++++++++++++++++++++--------------
  extensions/libxt_dccp.txlate | 12 ++++++--
@@ -173,5 +172,5 @@ index b47dc65f5bc4f..ea853f6acf627 100644
 -nft add rule ip filter INPUT dccp sport 200 dport 100 counter
 +nft add rule ip filter INPUT dccp sport 200 dccp dport 100 counter
 -- 
-2.28.0
+2.40.0
 
diff --git a/SOURCES/0045-xtables-monitor-fix-rule-printing.patch b/SOURCES/0028-xtables-monitor-fix-rule-printing.patch
similarity index 94%
rename from SOURCES/0045-xtables-monitor-fix-rule-printing.patch
rename to SOURCES/0028-xtables-monitor-fix-rule-printing.patch
index c878ec2..4dc5cc8 100644
--- a/SOURCES/0045-xtables-monitor-fix-rule-printing.patch
+++ b/SOURCES/0028-xtables-monitor-fix-rule-printing.patch
@@ -1,4 +1,4 @@
-From 0b886ea23e8473e692bdf20ecf4985f44408a132 Mon Sep 17 00:00:00 2001
+From 524f17b1027cb3b6bd5484c644d4dc226d137d91 Mon Sep 17 00:00:00 2001
 From: Florian Westphal <fw@strlen.de>
 Date: Sat, 12 Dec 2020 16:15:32 +0100
 Subject: [PATCH] xtables-monitor: fix rule printing
@@ -12,13 +12,12 @@ output isn't a terminal.
 
 Signed-off-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit 07af4da52ab3002c9cb510863b4eb7aaca4fb43b)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/xtables-monitor.c | 32 +++++++++++++++-----------------
  1 file changed, 15 insertions(+), 17 deletions(-)
 
 diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 92962a2a95f48..43b9064c3d30e 100644
+index 4008cc00d4694..364e600e1b38a 100644
 --- a/iptables/xtables-monitor.c
 +++ b/iptables/xtables-monitor.c
 @@ -227,12 +227,12 @@ static void trace_print_rule(const struct nftnl_trace *nlt, struct cb_arg *args)
@@ -82,5 +81,5 @@ index 92962a2a95f48..43b9064c3d30e 100644
  }
  
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0046-xtables-monitor-fix-packet-family-protocol.patch b/SOURCES/0029-xtables-monitor-fix-packet-family-protocol.patch
similarity index 89%
rename from SOURCES/0046-xtables-monitor-fix-packet-family-protocol.patch
rename to SOURCES/0029-xtables-monitor-fix-packet-family-protocol.patch
index 67acb11..89b376b 100644
--- a/SOURCES/0046-xtables-monitor-fix-packet-family-protocol.patch
+++ b/SOURCES/0029-xtables-monitor-fix-packet-family-protocol.patch
@@ -1,4 +1,4 @@
-From d272e1225bf9b31ec0397bd86b39a54da49d5468 Mon Sep 17 00:00:00 2001
+From 7de2651bdbbabfc08ef040d2cb9867c8375e3984 Mon Sep 17 00:00:00 2001
 From: Florian Westphal <fw@strlen.de>
 Date: Sat, 12 Dec 2020 16:15:33 +0100
 Subject: [PATCH] xtables-monitor: fix packet family protocol
@@ -8,13 +8,12 @@ Print the table family instead.
 
 Signed-off-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit 946923b640afc2249cf98743ff60a97291108701)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/xtables-monitor.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 43b9064c3d30e..9fa1ca166a61e 100644
+index 364e600e1b38a..8850a12032d26 100644
 --- a/iptables/xtables-monitor.c
 +++ b/iptables/xtables-monitor.c
 @@ -273,14 +273,14 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
@@ -35,5 +34,5 @@ index 43b9064c3d30e..9fa1ca166a61e 100644
  	if (nftnl_trace_is_set(nlt, NFTNL_TRACE_NFPROTO)) {
  		nfproto = nftnl_trace_get_u32(nlt, NFTNL_TRACE_NFPROTO);
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0030-nft-cache-Make-nft_rebuild_cache-respect-fake-cache.patch b/SOURCES/0030-nft-cache-Make-nft_rebuild_cache-respect-fake-cache.patch
deleted file mode 100644
index e802197..0000000
--- a/SOURCES/0030-nft-cache-Make-nft_rebuild_cache-respect-fake-cache.patch
+++ /dev/null
@@ -1,80 +0,0 @@
-From 2c183a2457d8640aaee3a98fc8fea70bf64d46f2 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sat, 29 Feb 2020 02:08:26 +0100
-Subject: [PATCH] nft: cache: Make nft_rebuild_cache() respect fake cache
-
-If transaction needed a refresh in nft_action(), restore with flush
-would fetch a full cache instead of merely refreshing table list
-contained in "fake" cache.
-
-To fix this, nft_rebuild_cache() must distinguish between fake cache and
-full rule cache. Therefore introduce NFT_CL_FAKE to be distinguished
-from NFT_CL_RULES.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 40ad7793d1884f28767cf58c96e9d76ae0a18db1)
-
-RHEL-only fix: Make nft_rebuild_cache() check 'level' instead of
-'h->cache_level' as the latter may be reset by __nft_flush_cache().
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- iptables/nft-cache.c | 13 +++++++++----
- iptables/nft.h       |  3 ++-
- 2 files changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index bc6e7f7eaebfb..9623b463f0dd5 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -480,6 +480,7 @@ __nft_build_cache(struct nft_handle *h, enum nft_cache_level level,
- 			break;
- 		/* fall through */
- 	case NFT_CL_RULES:
-+	case NFT_CL_FAKE:
- 		break;
- 	}
- 
-@@ -516,7 +517,7 @@ void nft_fake_cache(struct nft_handle *h)
- 
- 		h->cache->table[type].chains = nftnl_chain_list_alloc();
- 	}
--	h->cache_level = NFT_CL_RULES;
-+	h->cache_level = NFT_CL_FAKE;
- 	mnl_genid_get(h, &h->nft_genid);
- }
- 
-@@ -629,9 +630,13 @@ void nft_rebuild_cache(struct nft_handle *h)
- 	if (h->cache_level)
- 		__nft_flush_cache(h);
- 
--	h->nft_genid = 0;
--	h->cache_level = NFT_CL_NONE;
--	__nft_build_cache(h, level, NULL, NULL, NULL);
-+	if (level == NFT_CL_FAKE) {
-+		nft_fake_cache(h);
-+	} else {
-+		h->nft_genid = 0;
-+		h->cache_level = NFT_CL_NONE;
-+		__nft_build_cache(h, level, NULL, NULL, NULL);
-+	}
- }
- 
- void nft_release_cache(struct nft_handle *h)
-diff --git a/iptables/nft.h b/iptables/nft.h
-index 5cf260a6d2cd3..2094b01455194 100644
---- a/iptables/nft.h
-+++ b/iptables/nft.h
-@@ -32,7 +32,8 @@ enum nft_cache_level {
- 	NFT_CL_TABLES,
- 	NFT_CL_CHAINS,
- 	NFT_CL_SETS,
--	NFT_CL_RULES
-+	NFT_CL_RULES,
-+	NFT_CL_FAKE	/* must be last entry */
- };
- 
- struct nft_cache {
--- 
-2.28.0
-
diff --git a/SOURCES/0047-xtables-monitor-print-packet-first.patch b/SOURCES/0030-xtables-monitor-print-packet-first.patch
similarity index 95%
rename from SOURCES/0047-xtables-monitor-print-packet-first.patch
rename to SOURCES/0030-xtables-monitor-print-packet-first.patch
index 30ffb03..411c260 100644
--- a/SOURCES/0047-xtables-monitor-print-packet-first.patch
+++ b/SOURCES/0030-xtables-monitor-print-packet-first.patch
@@ -1,4 +1,4 @@
-From 07f51d26e405b4a328813f35bc27015eb9324330 Mon Sep 17 00:00:00 2001
+From 46fffddb8ae11d3e46f55ca0bb356a2549671652 Mon Sep 17 00:00:00 2001
 From: Florian Westphal <fw@strlen.de>
 Date: Sat, 12 Dec 2020 16:15:34 +0100
 Subject: [PATCH] xtables-monitor: print packet first
@@ -12,13 +12,12 @@ After this patch, output is more consistent with nft monitor.
 
 Signed-off-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit 180ba723d0b305fab9287d3bc5f845a43d9eb793)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/xtables-monitor.c | 34 +++++++++++++++++++++++-----------
  1 file changed, 23 insertions(+), 11 deletions(-)
 
 diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 9fa1ca166a61e..23e828988bb8b 100644
+index 8850a12032d26..e6b6e76b9fdc9 100644
 --- a/iptables/xtables-monitor.c
 +++ b/iptables/xtables-monitor.c
 @@ -106,6 +106,7 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
@@ -98,5 +97,5 @@ index 9fa1ca166a61e..23e828988bb8b 100644
  	nftnl_trace_free(nlt);
  err:
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0048-xtables-monitor.patch b/SOURCES/0031-xtables-monitor.patch
similarity index 84%
rename from SOURCES/0048-xtables-monitor.patch
rename to SOURCES/0031-xtables-monitor.patch
index 128393b..39ae229 100644
--- a/SOURCES/0048-xtables-monitor.patch
+++ b/SOURCES/0031-xtables-monitor.patch
@@ -1,4 +1,4 @@
-From d64511250cf43ae11e18964cc0dccf9c2d6c3973 Mon Sep 17 00:00:00 2001
+From bc9b418dc22fb7d81bfded431c74ea84f62340bd Mon Sep 17 00:00:00 2001
 From: Florian Westphal <fw@strlen.de>
 Date: Mon, 14 Dec 2020 17:11:23 +0100
 Subject: [PATCH] xtables-monitor:
@@ -7,13 +7,12 @@ Subject: [PATCH] xtables-monitor:
 
 Signed-off-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit 98ed6f6fc6d97663a33de67afff60196052880b1)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/xtables-monitor.c | 3 +++
  1 file changed, 3 insertions(+)
 
 diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 23e828988bb8b..88033a59526d2 100644
+index e6b6e76b9fdc9..4b9809805fb5b 100644
 --- a/iptables/xtables-monitor.c
 +++ b/iptables/xtables-monitor.c
 @@ -306,6 +306,9 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
@@ -27,5 +26,5 @@ index 23e828988bb8b..88033a59526d2 100644
  			printf("LL=0x%x ", type);
  			for (i = 0 ; i < len; i++)
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0032-nft-Fix-selective-chain-compatibility-checks.patch b/SOURCES/0032-nft-Fix-selective-chain-compatibility-checks.patch
new file mode 100644
index 0000000..8a73ffb
--- /dev/null
+++ b/SOURCES/0032-nft-Fix-selective-chain-compatibility-checks.patch
@@ -0,0 +1,41 @@
+From 06bf588263f81b0d254d49b584b26445a788638d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 23 Sep 2020 19:13:45 +0200
+Subject: [PATCH] nft: Fix selective chain compatibility checks
+
+Since commit 80251bc2a56ed ("nft: remove cache build calls"), 'chain'
+parameter passed to nft_chain_list_get() is no longer effective.
+Before, it was used to fetch only that single chain from kernel when
+populating the cache. So the returned list of chains for which
+compatibility checks are done would contain only that single chain.
+
+Re-establish the single chain compat checking by introducing a dedicated
+code path to nft_is_chain_compatible() doing so.
+
+Fixes: 80251bc2a56ed ("nft: remove cache build calls")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 694612adf87fb614f16a2b678f32745d5c9d7876)
+---
+ iptables/nft.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index bdf252198f155..7f87d46dcc44c 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3575,6 +3575,12 @@ bool nft_is_table_compatible(struct nft_handle *h,
+ {
+ 	struct nftnl_chain_list *clist;
+ 
++	if (chain) {
++		struct nftnl_chain *c = nft_chain_find(h, table, chain);
++
++		return c && !nft_is_chain_compatible(c, h);
++	}
++
+ 	clist = nft_chain_list_get(h, table, chain);
+ 	if (clist == NULL)
+ 		return false;
+-- 
+2.40.0
+
diff --git a/SOURCES/0033-iptables-nft-fix-Z-option.patch b/SOURCES/0033-iptables-nft-fix-Z-option.patch
new file mode 100644
index 0000000..f9e434b
--- /dev/null
+++ b/SOURCES/0033-iptables-nft-fix-Z-option.patch
@@ -0,0 +1,104 @@
+From 4f52c310cf3854a64ef9a518c223e0581ec9a308 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Wed, 24 Feb 2021 11:08:02 +0100
+Subject: [PATCH] iptables-nft: fix -Z option
+
+it zeroes the rule counters, so it needs fully populated cache.
+Add a test case to cover this.
+
+Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Acked-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2)
+---
+ iptables/nft-cmd.c                            |  2 +-
+ .../testcases/iptables/0007-zero-counters_0   | 64 +++++++++++++++++++
+ 2 files changed, 65 insertions(+), 1 deletion(-)
+ create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0
+
+diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
+index 9c0901e78703a..ed53c061edc6f 100644
+--- a/iptables/nft-cmd.c
++++ b/iptables/nft-cmd.c
+@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain,
+ 	if (!cmd)
+ 		return 0;
+ 
+-	nft_cache_level_set(h, NFT_CL_CHAINS, cmd);
++	nft_cache_level_set(h, NFT_CL_RULES, cmd);
+ 
+ 	return 1;
+ }
+diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
+new file mode 100755
+index 0000000000000..36da1907e3b22
+--- /dev/null
++++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
+@@ -0,0 +1,64 @@
++#!/bin/bash
++
++RC=0
++COUNTR=$RANDOM$RANDOM
++
++$XT_MULTI iptables-restore -c <<EOF
++*filter
++:INPUT ACCEPT [1:23]
++:FOO - [0:0]
++[12:345] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
++[22:123] -A FOO -m comment --comment one
++[44:123] -A FOO -m comment --comment two
++COMMIT
++EOF
++EXPECT="*filter
++:INPUT ACCEPT [0:0]
++:FORWARD ACCEPT [0:0]
++:OUTPUT ACCEPT [0:0]
++:FOO - [0:0]
++[0:0] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
++[0:0] -A FOO -m comment --comment one
++[0:0] -A FOO -m comment --comment two
++COMMIT"
++
++COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
++if [ $COUNTER != "[12:345]" ]; then
++	echo "Counter $COUNTER is wrong, expected 12:345"
++	RC=1
++fi
++
++$XT_MULTI iptables -Z FOO
++COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
++if [ $COUNTER = "[0:0]" ]; then
++	echo "Counter $COUNTER is wrong, should not have been zeroed"
++	RC=1
++fi
++
++for c in one two; do
++	COUNTER=$($XT_MULTI iptables-save -c |grep "comment $c"| cut -f 1 -d " ")
++	if [ $COUNTER != "[0:0]" ]; then
++		echo "Counter $COUNTER is wrong, should have been zeroed at rule $c"
++		RC=1
++	fi
++done
++
++$XT_MULTI iptables -Z
++COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
++
++if [ $COUNTER != "[0:0]" ]; then
++	echo "Counter $COUNTER is wrong, expected 0:0 after -Z"
++	RC=1
++fi
++
++diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables-save -c | grep -v '^#')
++if [ $? -ne 0 ]; then
++	echo "Diff error: counters were not zeroed"
++	RC=1
++fi
++
++$XT_MULTI iptables -D INPUT -i lo -p icmp -m comment --comment "$COUNTR"
++$XT_MULTI iptables -D FOO -m comment --comment one
++$XT_MULTI iptables -D FOO -m comment --comment two
++$XT_MULTI iptables -X FOO
++exit $RC
+-- 
+2.40.0
+
diff --git a/SOURCES/0049-nft-Fix-bitwise-expression-avoidance-detection.patch b/SOURCES/0034-nft-Fix-bitwise-expression-avoidance-detection.patch
similarity index 93%
rename from SOURCES/0049-nft-Fix-bitwise-expression-avoidance-detection.patch
rename to SOURCES/0034-nft-Fix-bitwise-expression-avoidance-detection.patch
index 32ee3e9..d21175e 100644
--- a/SOURCES/0049-nft-Fix-bitwise-expression-avoidance-detection.patch
+++ b/SOURCES/0034-nft-Fix-bitwise-expression-avoidance-detection.patch
@@ -1,4 +1,4 @@
-From f2d177c3a7a6a7154aabfab6047c510e0cee428e Mon Sep 17 00:00:00 2001
+From 7b60fadf23fd4b712dd7522c06b6e7b4f3190fc6 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 19 Feb 2021 16:54:57 +0100
 Subject: [PATCH] nft: Fix bitwise expression avoidance detection
@@ -10,7 +10,6 @@ no stray bits in the designated host part.
 Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches")
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  iptables/nft-shared.c                         |  4 +++-
  .../testcases/ip6tables/0004-address-masks_0  | 24 +++++++++++++++++++
@@ -18,7 +17,7 @@ Signed-off-by: Phil Sutter <psutter@redhat.com>
  create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
 
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 2aae0a3a49dfe..7f757d38ecaec 100644
+index 10553ab26823b..c1664b50f9383 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
 @@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
@@ -70,5 +69,5 @@ index 0000000000000..7eb42f08da975
 +
 +diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0050-xtables-translate-Fix-translation-of-odd-netmasks.patch b/SOURCES/0035-xtables-translate-Fix-translation-of-odd-netmasks.patch
similarity index 97%
rename from SOURCES/0050-xtables-translate-Fix-translation-of-odd-netmasks.patch
rename to SOURCES/0035-xtables-translate-Fix-translation-of-odd-netmasks.patch
index b525e26..b8f3739 100644
--- a/SOURCES/0050-xtables-translate-Fix-translation-of-odd-netmasks.patch
+++ b/SOURCES/0035-xtables-translate-Fix-translation-of-odd-netmasks.patch
@@ -1,4 +1,4 @@
-From d8b7a38b12888dcd39c7678b00625369389de9ea Mon Sep 17 00:00:00 2001
+From 810da6ff3a0a0b9bdb608edc0b68fc5cedac97e0 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 2 Mar 2021 14:50:07 +0100
 Subject: [PATCH] xtables-translate: Fix translation of odd netmasks
@@ -10,7 +10,6 @@ print bitmask syntax for those cases.
 
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 46f9d3a9a61ee80fa94b7fa7b3b36045c92606ae)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  extensions/generic.txlate   | 48 +++++++++++++++++++++++++++++++++++++
  extensions/libxt_standard.t | 12 ++++++++++
@@ -98,7 +97,7 @@ index 4313f7b7bac9d..56d6da2e5884e 100644
 +-s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK
 +-s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK
 diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index 5bd0710781533..af5db31532540 100644
+index fdc15c6f04066..0d32a30010519 100644
 --- a/iptables/nft-ipv4.c
 +++ b/iptables/nft-ipv4.c
 @@ -383,6 +383,32 @@ static void nft_ipv4_post_parse(int command,
@@ -158,7 +157,7 @@ index 5bd0710781533..af5db31532540 100644
  	ret = xlate_matches(cs, xl);
  	if (!ret)
 diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index 6ece631d85f59..a5481b3f77ac5 100644
+index 130ad3e6e7c44..46008fc5e762a 100644
 --- a/iptables/nft-ipv6.c
 +++ b/iptables/nft-ipv6.c
 @@ -337,14 +337,27 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
@@ -193,5 +192,5 @@ index 6ece631d85f59..a5481b3f77ac5 100644
  
  static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0036-extensions-libxt_conntrack-use-bitops-for-state-nega.patch b/SOURCES/0036-extensions-libxt_conntrack-use-bitops-for-state-nega.patch
new file mode 100644
index 0000000..840f6da
--- /dev/null
+++ b/SOURCES/0036-extensions-libxt_conntrack-use-bitops-for-state-nega.patch
@@ -0,0 +1,129 @@
+From db7d25c14b8db7f7ea514e1f81acb82fafb3c9d7 Mon Sep 17 00:00:00 2001
+From: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
+Date: Thu, 1 Apr 2021 16:47:07 +0300
+Subject: [PATCH] extensions: libxt_conntrack: use bitops for state negation
+
+Currently, state_xlate_print function prints statemask as comma-separated sequence of enabled
+statemask flags. But if we have inverted conntrack ctstate condition then we have to use more
+complex expression because nft not supports syntax like "ct state != related,established".
+
+Reproducer:
+$ iptables -A INPUT -d 127.0.0.1/32 -p tcp -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP
+$ nft list ruleset
+...
+meta l4proto tcp ip daddr 127.0.0.1 ct state != related,established counter packets 0 bytes 0 drop
+...
+
+it will fail if we try to load this rule:
+$ nft -f nft_test
+../nft_test:6:97-97: Error: syntax error, unexpected comma, expecting newline or semicolon
+
+Cc: Florian Westphal <fw@strlen.de>
+Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit 18e334da7363ba186edb1700056e26ded27ca5ba)
+---
+ extensions/libxt_conntrack.c      | 38 ++++++++++++++++++++-----------
+ extensions/libxt_conntrack.txlate |  5 +++-
+ 2 files changed, 29 insertions(+), 14 deletions(-)
+
+diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
+index 7734509c9af84..91f9e4aa994f8 100644
+--- a/extensions/libxt_conntrack.c
++++ b/extensions/libxt_conntrack.c
+@@ -1148,30 +1148,43 @@ static void state_save(const void *ip, const struct xt_entry_match *match)
+ 	state_print_state(sinfo->statemask);
+ }
+ 
+-static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask)
++static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask, int inverted)
+ {
+ 	const char *sep = "";
++	int one_flag_set;
++
++	one_flag_set = !(statemask & (statemask - 1));
++
++	if (inverted && !one_flag_set)
++		xt_xlate_add(xl, "& (");
++	else if (inverted)
++		xt_xlate_add(xl, "& ");
+ 
+ 	if (statemask & XT_CONNTRACK_STATE_INVALID) {
+ 		xt_xlate_add(xl, "%s%s", sep, "invalid");
+-		sep = ",";
++		sep = inverted && !one_flag_set ? "|" : ",";
+ 	}
+ 	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_NEW)) {
+ 		xt_xlate_add(xl, "%s%s", sep, "new");
+-		sep = ",";
++		sep = inverted && !one_flag_set ? "|" : ",";
+ 	}
+ 	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_RELATED)) {
+ 		xt_xlate_add(xl, "%s%s", sep, "related");
+-		sep = ",";
++		sep = inverted && !one_flag_set ? "|" : ",";
+ 	}
+ 	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED)) {
+ 		xt_xlate_add(xl, "%s%s", sep, "established");
+-		sep = ",";
++		sep = inverted && !one_flag_set ? "|" : ",";
+ 	}
+ 	if (statemask & XT_CONNTRACK_STATE_UNTRACKED) {
+ 		xt_xlate_add(xl, "%s%s", sep, "untracked");
+-		sep = ",";
++		sep = inverted && !one_flag_set ? "|" : ",";
+ 	}
++
++	if (inverted && !one_flag_set)
++		xt_xlate_add(xl, ") == 0");
++	else if (inverted)
++		xt_xlate_add(xl, " == 0");
+ }
+ 
+ static int state_xlate(struct xt_xlate *xl,
+@@ -1180,9 +1193,9 @@ static int state_xlate(struct xt_xlate *xl,
+ 	const struct xt_conntrack_mtinfo3 *sinfo =
+ 		(const void *)params->match->data;
+ 
+-	xt_xlate_add(xl, "ct state %s", sinfo->invert_flags & XT_CONNTRACK_STATE ?
+-					"!= " : "");
+-	state_xlate_print(xl, sinfo->state_mask);
++	xt_xlate_add(xl, "ct state ");
++	state_xlate_print(xl, sinfo->state_mask,
++			  sinfo->invert_flags & XT_CONNTRACK_STATE);
+ 	xt_xlate_add(xl, " ");
+ 	return 1;
+ }
+@@ -1256,10 +1269,9 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ 				     sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
+ 			space = " ";
+ 		} else {
+-			xt_xlate_add(xl, "%sct state %s", space,
+-				     sinfo->invert_flags & XT_CONNTRACK_STATE ?
+-				     "!= " : "");
+-			state_xlate_print(xl, sinfo->state_mask);
++			xt_xlate_add(xl, "%sct state ", space);
++			state_xlate_print(xl, sinfo->state_mask,
++					  sinfo->invert_flags & XT_CONNTRACK_STATE);
+ 			space = " ";
+ 		}
+ 	}
+diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
+index d374f8a035f00..5ab85b177c396 100644
+--- a/extensions/libxt_conntrack.txlate
++++ b/extensions/libxt_conntrack.txlate
+@@ -2,7 +2,10 @@ iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW,RELATED -j ACCE
+ nft add rule ip filter INPUT ct state new,related counter accept
+ 
+ ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW,RELATED -j ACCEPT
+-nft add rule ip6 filter INPUT ct state != new,related counter accept
++nft add rule ip6 filter INPUT ct state & (new|related) == 0 counter accept
++
++ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW -j ACCEPT
++nft add rule ip6 filter INPUT ct state & new == 0 counter accept
+ 
+ iptables-translate -t filter -A INPUT -m conntrack --ctproto UDP -j ACCEPT
+ nft add rule ip filter INPUT ct original protocol 17 counter accept
+-- 
+2.40.0
+
diff --git a/SOURCES/0051-Eliminate-inet_aton-and-inet_ntoa.patch b/SOURCES/0037-Eliminate-inet_aton-and-inet_ntoa.patch
similarity index 97%
rename from SOURCES/0051-Eliminate-inet_aton-and-inet_ntoa.patch
rename to SOURCES/0037-Eliminate-inet_aton-and-inet_ntoa.patch
index 668cbce..6bd3b0e 100644
--- a/SOURCES/0051-Eliminate-inet_aton-and-inet_ntoa.patch
+++ b/SOURCES/0037-Eliminate-inet_aton-and-inet_ntoa.patch
@@ -1,4 +1,4 @@
-From 97b85789657bab340fd7aaaf6d41b8f698f9a5b1 Mon Sep 17 00:00:00 2001
+From ca4b90e5fc460fe522ceff2206ae5d32d32d2b40 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 27 Apr 2021 09:12:53 +0200
 Subject: [PATCH] Eliminate inet_aton() and inet_ntoa()
@@ -45,7 +45,7 @@ index 2b9a1b6566684..7eb898f984bba 100644
  	printf(" ");
  }
 diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index af5db31532540..d8c48ce8817b6 100644
+index 0d32a30010519..a5b835b1f681d 100644
 --- a/iptables/nft-ipv4.c
 +++ b/iptables/nft-ipv4.c
 @@ -136,7 +136,7 @@ static void get_frag(struct nft_xt_ctx *ctx, struct nftnl_expr *e, bool *inv)
@@ -116,5 +116,5 @@ index af5db31532540..d8c48ce8817b6 100644
  }
  
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0053-nft-arp-Make-use-of-ipv4_addr_to_string.patch b/SOURCES/0038-nft-arp-Make-use-of-ipv4_addr_to_string.patch
similarity index 93%
rename from SOURCES/0053-nft-arp-Make-use-of-ipv4_addr_to_string.patch
rename to SOURCES/0038-nft-arp-Make-use-of-ipv4_addr_to_string.patch
index 0b98179..52fe6ca 100644
--- a/SOURCES/0053-nft-arp-Make-use-of-ipv4_addr_to_string.patch
+++ b/SOURCES/0038-nft-arp-Make-use-of-ipv4_addr_to_string.patch
@@ -1,4 +1,4 @@
-From 201fd565a1ce44b4af11ce9f245b2fa77c026fed Mon Sep 17 00:00:00 2001
+From ab2ec9ca900843d6cb9fa839a9afe0ea968ce263 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 27 Apr 2021 10:02:34 +0200
 Subject: [PATCH] nft-arp: Make use of ipv4_addr_to_string()
@@ -15,7 +15,7 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  3 files changed, 14 insertions(+), 94 deletions(-)
 
 diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index ec8147dd58c0d..7c61c31a13c40 100644
+index c82ffdc95e300..2a9387a18dffe 100644
 --- a/iptables/nft-arp.c
 +++ b/iptables/nft-arp.c
 @@ -42,78 +42,6 @@ char *arp_opcodes[] =
@@ -146,10 +146,10 @@ index ec8147dd58c0d..7c61c31a13c40 100644
  	}
  
 diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 16c58914e59a5..e3c8072b5ca96 100644
+index fe37c30a085d6..3bcf24735c8fb 100644
 --- a/iptables/xshared.c
 +++ b/iptables/xshared.c
-@@ -546,9 +546,9 @@ void debug_print_argv(struct argv_store *store)
+@@ -545,9 +545,9 @@ void debug_print_argv(struct argv_store *store)
  }
  #endif
  
@@ -163,10 +163,10 @@ index 16c58914e59a5..e3c8072b5ca96 100644
  	static char buf[BUFSIZ];
  
 diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 490b19ade5106..e4015c00e2a35 100644
+index 9159b2b1f3768..1e86aba8b2375 100644
 --- a/iptables/xshared.h
 +++ b/iptables/xshared.h
-@@ -200,6 +200,9 @@ void debug_print_argv(struct argv_store *store);
+@@ -206,6 +206,9 @@ void debug_print_argv(struct argv_store *store);
  #  define debug_print_argv(...) /* nothing */
  #endif
  
@@ -177,5 +177,5 @@ index 490b19ade5106..e4015c00e2a35 100644
  void print_ipv6_addresses(const struct ip6t_entry *fw6, unsigned int format);
  
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0054-extensions-SECMARK-Implement-revision-1.patch b/SOURCES/0039-extensions-SECMARK-Implement-revision-1.patch
similarity index 98%
rename from SOURCES/0054-extensions-SECMARK-Implement-revision-1.patch
rename to SOURCES/0039-extensions-SECMARK-Implement-revision-1.patch
index b271812..e1f0868 100644
--- a/SOURCES/0054-extensions-SECMARK-Implement-revision-1.patch
+++ b/SOURCES/0039-extensions-SECMARK-Implement-revision-1.patch
@@ -1,4 +1,4 @@
-From 3bd3af273ccfa550ed50ad19d4bcd04a29b88f5b Mon Sep 17 00:00:00 2001
+From b16a9bc7fa224139763686d3ecc1741b891ac6ce Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Thu, 29 Apr 2021 15:28:59 +0200
 Subject: [PATCH] extensions: SECMARK: Implement revision 1
@@ -173,5 +173,5 @@ index 989092bd6274b..31760a286a854 100644
 +
  #endif /*_XT_SECMARK_H_target */
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0070-Use-proto_to_name-from-xshared-in-more-places.patch b/SOURCES/0040-Use-proto_to_name-from-xshared-in-more-places.patch
similarity index 88%
rename from SOURCES/0070-Use-proto_to_name-from-xshared-in-more-places.patch
rename to SOURCES/0040-Use-proto_to_name-from-xshared-in-more-places.patch
index 31e0d66..dba5b70 100644
--- a/SOURCES/0070-Use-proto_to_name-from-xshared-in-more-places.patch
+++ b/SOURCES/0040-Use-proto_to_name-from-xshared-in-more-places.patch
@@ -1,4 +1,4 @@
-From f8839b3651e0ffbb93b6ce4675809d60782a4396 Mon Sep 17 00:00:00 2001
+From adc559b69fc2b8d95a7c3bae96ca12faa0ba5d1d Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 17 Nov 2020 00:57:10 +0100
 Subject: [PATCH] Use proto_to_name() from xshared in more places
@@ -21,7 +21,7 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  6 files changed, 16 insertions(+), 38 deletions(-)
 
 diff --git a/include/xtables.h b/include/xtables.h
-index d77a73a4303a7..06982e720cbb8 100644
+index 5044dd08e86d3..a7b36979398ba 100644
 --- a/include/xtables.h
 +++ b/include/xtables.h
 @@ -395,7 +395,7 @@ struct xtables_rule_match {
@@ -34,10 +34,10 @@ index d77a73a4303a7..06982e720cbb8 100644
  
  enum xtables_tryload {
 diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index b96dc033e7ebb..4860682001360 100644
+index c95355b091568..ce01ce8c04af6 100644
 --- a/iptables/ip6tables.c
 +++ b/iptables/ip6tables.c
-@@ -849,28 +849,16 @@ print_iface(char letter, const char *iface, const unsigned char *mask,
+@@ -796,28 +796,16 @@ print_iface(char letter, const char *iface, const unsigned char *mask,
  	}
  }
  
@@ -72,10 +72,10 @@ index b96dc033e7ebb..4860682001360 100644
  }
  
 diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 6e2946f5660de..620429b5d4817 100644
+index 7d6183116d265..514238d924780 100644
 --- a/iptables/iptables.c
 +++ b/iptables/iptables.c
-@@ -819,23 +819,13 @@ list_entries(const xt_chainlabel chain, int rulenum, int verbose, int numeric,
+@@ -764,23 +764,13 @@ list_entries(const xt_chainlabel chain, int rulenum, int verbose, int numeric,
  static void print_proto(uint16_t proto, int invert)
  {
  	if (proto) {
@@ -105,10 +105,10 @@ index 6e2946f5660de..620429b5d4817 100644
  }
  
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index d73d0b6159be6..e3ba4ac34146f 100644
+index c1664b50f9383..4253b08196d29 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
-@@ -821,13 +821,13 @@ void save_rule_details(const struct iptables_command_state *cs,
+@@ -826,13 +826,13 @@ void save_rule_details(const struct iptables_command_state *cs,
  	}
  
  	if (proto > 0) {
@@ -126,7 +126,7 @@ index d73d0b6159be6..e3ba4ac34146f 100644
  			printf("-p %u ", proto);
  	}
 diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 0c232ca2ae8d5..7a55ed5d15715 100644
+index 3bcf24735c8fb..9a17a8fdf11cd 100644
 --- a/iptables/xshared.c
 +++ b/iptables/xshared.c
 @@ -48,7 +48,7 @@ void print_extension_helps(const struct xtables_target *t,
@@ -139,10 +139,10 @@ index 0c232ca2ae8d5..7a55ed5d15715 100644
  	unsigned int i;
  
 diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 095a574d85879..f3c7f28806619 100644
+index 1e86aba8b2375..7c881c56a25da 100644
 --- a/iptables/xshared.h
 +++ b/iptables/xshared.h
-@@ -146,7 +146,7 @@ enum {
+@@ -152,7 +152,7 @@ enum {
  
  extern void print_extension_helps(const struct xtables_target *,
  	const struct xtables_rule_match *);
@@ -152,5 +152,5 @@ index 095a574d85879..f3c7f28806619 100644
  	struct xtables_globals *);
  extern struct xtables_match *load_proto(struct iptables_command_state *);
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0040-extensions-libxt_CT-add-translation-for-NOTRACK.patch b/SOURCES/0040-extensions-libxt_CT-add-translation-for-NOTRACK.patch
deleted file mode 100644
index ca1316b..0000000
--- a/SOURCES/0040-extensions-libxt_CT-add-translation-for-NOTRACK.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 1695f552d3947299e54978bcd5bc1cdc3a5c14f7 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Wed, 15 Apr 2020 18:16:41 +0200
-Subject: [PATCH] extensions: libxt_CT: add translation for NOTRACK
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit f3d4a3ddbcfca15a00dd9758f481420038f6de10)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- extensions/libxt_CT.c           | 16 ++++++++++++++++
- extensions/libxt_NOTRACK.txlate |  2 ++
- 2 files changed, 18 insertions(+)
- create mode 100644 extensions/libxt_NOTRACK.txlate
-
-diff --git a/extensions/libxt_CT.c b/extensions/libxt_CT.c
-index 371b21766c56c..fbbbe2660e9fc 100644
---- a/extensions/libxt_CT.c
-+++ b/extensions/libxt_CT.c
-@@ -348,6 +348,20 @@ static void notrack_ct2_tg_init(struct xt_entry_target *target)
- 	info->flags = XT_CT_NOTRACK | XT_CT_NOTRACK_ALIAS;
- }
- 
-+static int xlate_ct1_tg(struct xt_xlate *xl,
-+			const struct xt_xlate_tg_params *params)
-+{
-+	struct xt_ct_target_info_v1 *info =
-+		(struct xt_ct_target_info_v1 *)params->target->data;
-+
-+	if (info->flags & XT_CT_NOTRACK)
-+		xt_xlate_add(xl, "notrack");
-+	else
-+		return 0;
-+
-+	return 1;
-+}
-+
- static struct xtables_target ct_target_reg[] = {
- 	{
- 		.family		= NFPROTO_UNSPEC,
-@@ -387,6 +401,7 @@ static struct xtables_target ct_target_reg[] = {
- 		.alias		= ct_print_name_alias,
- 		.x6_parse	= ct_parse_v1,
- 		.x6_options	= ct_opts_v1,
-+		.xlate		= xlate_ct1_tg,
- 	},
- 	{
- 		.family        = NFPROTO_UNSPEC,
-@@ -418,6 +433,7 @@ static struct xtables_target ct_target_reg[] = {
- 		.size          = XT_ALIGN(sizeof(struct xt_ct_target_info_v1)),
- 		.userspacesize = offsetof(struct xt_ct_target_info_v1, ct),
- 		.init          = notrack_ct2_tg_init,
-+		.xlate	       = xlate_ct1_tg,
- 	},
- 	{
- 		.family        = NFPROTO_UNSPEC,
-diff --git a/extensions/libxt_NOTRACK.txlate b/extensions/libxt_NOTRACK.txlate
-new file mode 100644
-index 0000000000000..9d35619d3dbdd
---- /dev/null
-+++ b/extensions/libxt_NOTRACK.txlate
-@@ -0,0 +1,2 @@
-+iptables-translate -A PREROUTING -t raw -j NOTRACK
-+nft add rule ip raw PREROUTING counter notrack
--- 
-2.28.0
-
diff --git a/SOURCES/0055-extensions-sctp-Fix-nftables-translation.patch b/SOURCES/0041-extensions-sctp-Fix-nftables-translation.patch
similarity index 97%
rename from SOURCES/0055-extensions-sctp-Fix-nftables-translation.patch
rename to SOURCES/0041-extensions-sctp-Fix-nftables-translation.patch
index 5253354..51b48cb 100644
--- a/SOURCES/0055-extensions-sctp-Fix-nftables-translation.patch
+++ b/SOURCES/0041-extensions-sctp-Fix-nftables-translation.patch
@@ -1,4 +1,4 @@
-From b675a15b70215deab520ef1a8e52edad9129328e Mon Sep 17 00:00:00 2001
+From 867ccfc5a9394b8a0957db9f2828befb7efabd7c Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 4 May 2021 16:03:24 +0200
 Subject: [PATCH] extensions: sctp: Fix nftables translation
@@ -76,5 +76,5 @@ index 72f4641ab021c..0d6c59e183675 100644
 -nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept
 +nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0056-extensions-sctp-Translate-chunk-types-option.patch b/SOURCES/0042-extensions-sctp-Translate-chunk-types-option.patch
similarity index 99%
rename from SOURCES/0056-extensions-sctp-Translate-chunk-types-option.patch
rename to SOURCES/0042-extensions-sctp-Translate-chunk-types-option.patch
index 9a23f2c..ea607d0 100644
--- a/SOURCES/0056-extensions-sctp-Translate-chunk-types-option.patch
+++ b/SOURCES/0042-extensions-sctp-Translate-chunk-types-option.patch
@@ -1,4 +1,4 @@
-From 48f38c4224f31d19176df83539501292fcc6092b Mon Sep 17 00:00:00 2001
+From 448d1ff5807a52ec34759a6dddd348c5f3e96704 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 4 May 2021 16:26:42 +0200
 Subject: [PATCH] extensions: sctp: Translate --chunk-types option
@@ -155,5 +155,5 @@ index 0d6c59e183675..bb817525db8d8 100644
 +iptables-translate -A INPUT -p sctp --chunk-types only SHUTDOWN_COMPLETE -j ACCEPT
 +nft add rule ip filter INPUT sctp chunk data missing sctp chunk init missing sctp chunk init-ack missing sctp chunk sack missing sctp chunk heartbeat missing sctp chunk heartbeat-ack missing sctp chunk abort missing sctp chunk shutdown missing sctp chunk shutdown-ack missing sctp chunk error missing sctp chunk cookie-echo missing sctp chunk cookie-ack missing sctp chunk ecne missing sctp chunk cwr missing sctp chunk shutdown-complete exists sctp chunk asconf missing sctp chunk asconf-ack missing sctp chunk forward-tsn missing counter accept
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0043-libxtables-Drop-leftover-variable-in-xtables_numeric.patch b/SOURCES/0043-libxtables-Drop-leftover-variable-in-xtables_numeric.patch
new file mode 100644
index 0000000..945e366
--- /dev/null
+++ b/SOURCES/0043-libxtables-Drop-leftover-variable-in-xtables_numeric.patch
@@ -0,0 +1,33 @@
+From e9dd197e783556dcb514ec624c4f6efeb782e7c7 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 13 Nov 2020 21:04:39 +0100
+Subject: [PATCH] libxtables: Drop leftover variable in
+ xtables_numeric_to_ip6addr()
+
+Variable 'err' was only used in removed debug code, so drop it as well.
+
+Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc)
+---
+ libxtables/xtables.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/libxtables/xtables.c b/libxtables/xtables.c
+index 7152c6576cd63..7f40b6f1b327b 100644
+--- a/libxtables/xtables.c
++++ b/libxtables/xtables.c
+@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp)
+ struct in6_addr *xtables_numeric_to_ip6addr(const char *num)
+ {
+ 	static struct in6_addr ap;
+-	int err;
+ 
+-	if ((err = inet_pton(AF_INET6, num, &ap)) == 1)
++	if (inet_pton(AF_INET6, num, &ap) == 1)
+ 		return &ap;
+ 
+ 	return NULL;
+-- 
+2.40.0
+
diff --git a/SOURCES/0044-extensions-libebt_ip6-Drop-unused-variables.patch b/SOURCES/0044-extensions-libebt_ip6-Drop-unused-variables.patch
new file mode 100644
index 0000000..f52bc58
--- /dev/null
+++ b/SOURCES/0044-extensions-libebt_ip6-Drop-unused-variables.patch
@@ -0,0 +1,49 @@
+From 89bd91cfdf6f81971324dca1b0df7c6c5537a2ab Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 13 Nov 2020 21:13:50 +0100
+Subject: [PATCH] extensions: libebt_ip6: Drop unused variables
+
+They are being assigned to but never read.
+
+Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc)
+---
+ extensions/libebt_ip6.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c
+index b8a5a5d8c3a92..301bed9aadefd 100644
+--- a/extensions/libebt_ip6.c
++++ b/extensions/libebt_ip6.c
+@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match)
+ static struct in6_addr *numeric_to_addr(const char *num)
+ {
+ 	static struct in6_addr ap;
+-	int err;
+ 
+-	if ((err=inet_pton(AF_INET6, num, &ap)) == 1)
++	if (inet_pton(AF_INET6, num, &ap) == 1)
+ 		return &ap;
+ 	return (struct in6_addr *)NULL;
+ }
+@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i
+ 	char buf[256];
+ 	char *p;
+ 	int i;
+-	int err;
+ 
+ 	strncpy(buf, address, sizeof(buf) - 1);
+ 	/* first the mask */
+@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i
+ 	if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any)))
+ 		strcpy(buf, "::");
+ 
+-	if ((err=inet_pton(AF_INET6, buf, addr)) < 1) {
++	if (inet_pton(AF_INET6, buf, addr) < 1) {
+ 		xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf);
+ 		return;
+ 	}
+-- 
+2.40.0
+
diff --git a/SOURCES/0045-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch b/SOURCES/0045-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch
new file mode 100644
index 0000000..912703b
--- /dev/null
+++ b/SOURCES/0045-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch
@@ -0,0 +1,29 @@
+From e672c567d978bf99652a8c3681e105d5a212552f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Jun 2021 11:04:30 +0200
+Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask()
+
+The allocated hostmask duplicate needs to be freed again.
+
+Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e)
+---
+ libxtables/xtoptions.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
+index d329f2ff7979e..0dcdf607f4678 100644
+--- a/libxtables/xtoptions.c
++++ b/libxtables/xtoptions.c
+@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb)
+ 	cb->arg = p;
+ 	xtopt_parse_plenmask(cb);
+ 	cb->arg = orig_arg;
++	free(work);
+ }
+ 
+ static void xtopt_parse_ethermac(struct xt_option_call *cb)
+-- 
+2.40.0
+
diff --git a/SOURCES/0046-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch b/SOURCES/0046-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch
new file mode 100644
index 0000000..07314fc
--- /dev/null
+++ b/SOURCES/0046-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch
@@ -0,0 +1,34 @@
+From bee29f2820cafde1e04ebef049bc4c40c4dbbe18 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Jun 2021 11:55:20 +0200
+Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new()
+
+If rule allocation fails, free the allocated 'cmd' before returning to
+caller.
+
+Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3)
+---
+ iptables/nft-cmd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
+index ed53c061edc6f..fd038503d87e1 100644
+--- a/iptables/nft-cmd.c
++++ b/iptables/nft-cmd.c
+@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 
+ 	if (state) {
+ 		rule = nft_rule_new(h, chain, table, state);
+-		if (!rule)
++		if (!rule) {
++			nft_cmd_free(cmd);
+ 			return NULL;
++		}
+ 
+ 		cmd->obj.rule = rule;
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0047-iptables-apply-Drop-unused-variable.patch b/SOURCES/0047-iptables-apply-Drop-unused-variable.patch
new file mode 100644
index 0000000..514647e
--- /dev/null
+++ b/SOURCES/0047-iptables-apply-Drop-unused-variable.patch
@@ -0,0 +1,29 @@
+From 2f80e6d896590f42c932de32ae8c3d597cbf940b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 2 Jun 2021 12:50:57 +0200
+Subject: [PATCH] iptables-apply: Drop unused variable
+
+It was assigned to but never read.
+
+Fixes: b45b4e3903414 ("iptables-apply: script and manpage update")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764)
+---
+ iptables/iptables-apply | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/iptables/iptables-apply b/iptables/iptables-apply
+index 4683b1b402d08..3a7df5e3cbc1f 100755
+--- a/iptables/iptables-apply
++++ b/iptables/iptables-apply
+@@ -231,7 +231,6 @@ case "$MODE" in
+ 		"$RUNCMD" &
+ 		CMD_PID=$!
+ 		( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) &
+-		CMDTIMEOUT_PID=$!
+ 		if ! wait "$CMD_PID"; then
+ 			echo "failed."
+ 			echo "Error: unknown error running command: $RUNCMD" >&2
+-- 
+2.40.0
+
diff --git a/SOURCES/0059-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch b/SOURCES/0048-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
similarity index 98%
rename from SOURCES/0059-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
rename to SOURCES/0048-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
index 51e3fd2..01a2704 100644
--- a/SOURCES/0059-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
+++ b/SOURCES/0048-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
@@ -1,4 +1,4 @@
-From 947e9c06a863c47e91a46d2cce90c677a90e4d09 Mon Sep 17 00:00:00 2001
+From 9a617399d5e0776b43f093b9d63d10f72e882fee Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Wed, 28 Jul 2021 17:53:53 +0200
 Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options
@@ -126,5 +126,5 @@ index 1fa5ad9388cc0..08e9766f2cc74 100644
  .BR xtables-nft "(8), " iptables "(8), " ip (8)
  .PP
 -- 
-2.33.0
+2.40.0
 
diff --git a/SOURCES/0060-ebtables-Dump-atomic-waste.patch b/SOURCES/0049-ebtables-Dump-atomic-waste.patch
similarity index 93%
rename from SOURCES/0060-ebtables-Dump-atomic-waste.patch
rename to SOURCES/0049-ebtables-Dump-atomic-waste.patch
index 4fd9fb7..4e4b1c5 100644
--- a/SOURCES/0060-ebtables-Dump-atomic-waste.patch
+++ b/SOURCES/0049-ebtables-Dump-atomic-waste.patch
@@ -1,4 +1,4 @@
-From c1eaf1738533eeec3dc1bdc2285dbf28c68d5042 Mon Sep 17 00:00:00 2001
+From ec0a69df9ac073b1a6e951c08c049fec47a12b5c Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 30 Jul 2021 12:25:10 +0200
 Subject: [PATCH] ebtables: Dump atomic waste
@@ -17,7 +17,7 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  1 file changed, 53 deletions(-)
 
 diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index c006bc95ac681..b836616ed0259 100644
+index 6df5839f07436..d07adad2d73c3 100644
 --- a/iptables/xtables-eb.c
 +++ b/iptables/xtables-eb.c
 @@ -262,10 +262,6 @@ struct option ebt_original_options[] =
@@ -42,7 +42,7 @@ index c006bc95ac681..b836616ed0259 100644
  "Options:\n"
  "--proto  -p [!] proto         : protocol hexadecimal, by name or LENGTH\n"
  "--src    -s [!] address[/mask]: source mac address\n"
-@@ -1116,54 +1108,9 @@ print_zero:
+@@ -1135,54 +1127,9 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
  					       "Use --Lmac2 with -L");
  			flags |= LIST_MAC2;
  			break;
@@ -67,7 +67,7 @@ index c006bc95ac681..b836616ed0259 100644
 -		/*case 7 :*/ /* atomic-init */
 -		/*case 10:*/ /* atomic-save */
  		case 11: /* init-table */
- 			nft_table_flush(h, *table);
+ 			nft_cmd_table_flush(h, *table);
  			return 1;
 -		/*
 -			replace->command = c;
@@ -98,5 +98,5 @@ index c006bc95ac681..b836616ed0259 100644
  			break;
  		case 1 :
 -- 
-2.33.0
+2.40.0
 
diff --git a/SOURCES/0050-nft-Fix-for-non-verbose-check-command.patch b/SOURCES/0050-nft-Fix-for-non-verbose-check-command.patch
new file mode 100644
index 0000000..4f56750
--- /dev/null
+++ b/SOURCES/0050-nft-Fix-for-non-verbose-check-command.patch
@@ -0,0 +1,31 @@
+From 59c41217b2acc9409ba50a76a40aaa994c83f454 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 3 Aug 2021 10:55:20 +0200
+Subject: [PATCH] nft: Fix for non-verbose check command
+
+Check command was unconditionally verbose since v1.8.5. Make it respect
+--verbose option again.
+
+Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 57d1422dbbc41c36ed2e9f6c67aa040c65a429a0)
+---
+ iptables/nft.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 7f87d46dcc44c..f8534c6cd56fb 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3160,7 +3160,7 @@ static int nft_prepare(struct nft_handle *h)
+ 		case NFT_COMPAT_RULE_CHECK:
+ 			assert_chain_exists(h, cmd->table, cmd->jumpto);
+ 			ret = nft_rule_check(h, cmd->chain, cmd->table,
+-					     cmd->obj.rule, cmd->rulenum);
++					     cmd->obj.rule, cmd->verbose);
+ 			break;
+ 		case NFT_COMPAT_RULE_ZERO:
+ 			ret = nft_rule_zero_counters(h, cmd->chain, cmd->table,
+-- 
+2.40.0
+
diff --git a/SOURCES/0061-extensions-hashlimit-Fix-tests-with-HZ-100.patch b/SOURCES/0051-extensions-hashlimit-Fix-tests-with-HZ-100.patch
similarity index 97%
rename from SOURCES/0061-extensions-hashlimit-Fix-tests-with-HZ-100.patch
rename to SOURCES/0051-extensions-hashlimit-Fix-tests-with-HZ-100.patch
index b52c8b0..df411da 100644
--- a/SOURCES/0061-extensions-hashlimit-Fix-tests-with-HZ-100.patch
+++ b/SOURCES/0051-extensions-hashlimit-Fix-tests-with-HZ-100.patch
@@ -1,4 +1,4 @@
-From ec4a91ac53e4dba210daa9bb3af9e09532c86b06 Mon Sep 17 00:00:00 2001
+From 07cfafd077bbd247bf75c0a3399569af58a63915 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 9 Aug 2021 18:48:58 +0200
 Subject: [PATCH] extensions: hashlimit: Fix tests with HZ=100
@@ -37,5 +37,5 @@ index ccd0d1e6a2a1a..8369933786f68 100644
  -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
  -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode dstip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
 -- 
-2.33.0
+2.40.0
 
diff --git a/SOURCES/0052-nft-Use-xtables_malloc-in-mnl_err_list_node_add.patch b/SOURCES/0052-nft-Use-xtables_malloc-in-mnl_err_list_node_add.patch
new file mode 100644
index 0000000..7b4e6db
--- /dev/null
+++ b/SOURCES/0052-nft-Use-xtables_malloc-in-mnl_err_list_node_add.patch
@@ -0,0 +1,31 @@
+From 71f9eda379a3d70b5b2cd9327e41ba5446c618e1 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 31 Aug 2021 12:26:20 +0200
+Subject: [PATCH] nft: Use xtables_malloc() in mnl_err_list_node_add()
+
+The function called malloc() without checking for memory allocation
+failure. Simply replace the call by xtables_malloc() to fix that.
+
+Fixes: 4e2020952d6f9 ("xtables: use libnftnl batch API")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ca11c7b7036b5821c17b8d08dc2a29f55b461a93)
+---
+ iptables/nft.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index f8534c6cd56fb..ba59cfb8c47af 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -143,7 +143,7 @@ struct mnl_err {
+ static void mnl_err_list_node_add(struct list_head *err_list, int error,
+ 				  int seqnum)
+ {
+-	struct mnl_err *err = malloc(sizeof(struct mnl_err));
++	struct mnl_err *err = xtables_malloc(sizeof(struct mnl_err));
+ 
+ 	err->seqnum = seqnum;
+ 	err->err = error;
+-- 
+2.40.0
+
diff --git a/SOURCES/0062-extensions-hashlimit-Fix-tests-with-HZ-1000.patch b/SOURCES/0053-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
similarity index 97%
rename from SOURCES/0062-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
rename to SOURCES/0053-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
index 81b2c3a..48f4983 100644
--- a/SOURCES/0062-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
+++ b/SOURCES/0053-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
@@ -1,4 +1,4 @@
-From 41660ba1faea8b7ebd71e94c70ef175a75ab91cc Mon Sep 17 00:00:00 2001
+From c51304d536c3f91b58dc24b14131de157d741a9f Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Mon, 8 Nov 2021 17:03:21 +0100
 Subject: [PATCH] extensions: hashlimit: Fix tests with HZ=1000
@@ -43,5 +43,5 @@ index 8369933786f68..206d92935f2e2 100644
  -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
  -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode dstip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
 -- 
-2.33.0
+2.40.0
 
diff --git a/SOURCES/0066-xshared-Merge-and-share-parse_chain.patch b/SOURCES/0054-xshared-Merge-and-share-parse_chain.patch
similarity index 84%
rename from SOURCES/0066-xshared-Merge-and-share-parse_chain.patch
rename to SOURCES/0054-xshared-Merge-and-share-parse_chain.patch
index 2d6b216..86b2fb2 100644
--- a/SOURCES/0066-xshared-Merge-and-share-parse_chain.patch
+++ b/SOURCES/0054-xshared-Merge-and-share-parse_chain.patch
@@ -1,4 +1,4 @@
-From 767c668628296fb3236aeeea1699ce06e66e5270 Mon Sep 17 00:00:00 2001
+From 655e919be08b6ca9b5529f16c659ee93572b867d Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 5 Apr 2019 13:21:19 +0200
 Subject: [PATCH] xshared: Merge and share parse_chain()
@@ -12,8 +12,8 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
 Conflicts:
 	iptables/ip6tables.c
 	iptables/xshared.c
--> Context changes due to missing commit 9dc50b5b8e441
-   ("xshared: Merge invflags handling code")
+-> Context change due to missing commit 9dc50b5b8e441
+   ("xshared: Merge invflags handling code").
 ---
  iptables/ip6tables.c | 26 --------------------------
  iptables/iptables.c  | 25 -------------------------
@@ -23,10 +23,10 @@ Conflicts:
  5 files changed, 26 insertions(+), 59 deletions(-)
 
 diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index 576c2cf8b0d9f..614d1e249c06d 100644
+index ce01ce8c04af6..6db91c807bcea 100644
 --- a/iptables/ip6tables.c
 +++ b/iptables/ip6tables.c
-@@ -327,32 +327,6 @@ static int is_exthdr(uint16_t proto)
+@@ -248,32 +248,6 @@ static int is_exthdr(uint16_t proto)
  		proto == IPPROTO_DSTOPTS);
  }
  
@@ -60,10 +60,10 @@ index 576c2cf8b0d9f..614d1e249c06d 100644
  set_option(unsigned int *options, unsigned int option, uint8_t *invflg,
  	   int invert)
 diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 88ef6cf666d4b..3b395981cc8ea 100644
+index 514238d924780..a33416a887ed4 100644
 --- a/iptables/iptables.c
 +++ b/iptables/iptables.c
-@@ -319,31 +319,6 @@ opt2char(int option)
+@@ -239,31 +239,6 @@ iptables_exit_error(enum xtables_exittype status, const char *msg, ...)
  
  /* Christophe Burki wants `-p 6' to imply `-m tcp'.  */
  
@@ -96,12 +96,12 @@ index 88ef6cf666d4b..3b395981cc8ea 100644
  static void
  set_option(unsigned int *options, unsigned int option, uint8_t *invflg,
 diff --git a/iptables/xshared.c b/iptables/xshared.c
-index dcc995a9cabe6..de8326b6c7b05 100644
+index 9a17a8fdf11cd..5ae158908b109 100644
 --- a/iptables/xshared.c
 +++ b/iptables/xshared.c
-@@ -775,3 +775,27 @@ int parse_rulenumber(const char *rule)
+@@ -848,3 +848,27 @@ char opt2char(int option)
  
- 	return rulenum;
+ 	return *ptr;
  }
 +
 +void parse_chain(const char *chainname)
@@ -128,21 +128,22 @@ index dcc995a9cabe6..de8326b6c7b05 100644
 +				      "Invalid chain name `%s'", chainname);
 +}
 diff --git a/iptables/xshared.h b/iptables/xshared.h
-index e4015c00e2a35..f5d2f8d0a2bc5 100644
+index 7c881c56a25da..10f6e0b5a0e98 100644
 --- a/iptables/xshared.h
 +++ b/iptables/xshared.h
-@@ -217,5 +217,6 @@ char cmd2char(int option);
+@@ -223,6 +223,7 @@ char cmd2char(int option);
  void add_command(unsigned int *cmd, const int newcmd,
  		 const int othercmds, int invert);
  int parse_rulenumber(const char *rule);
 +void parse_chain(const char *chainname);
  
- #endif /* IPTABLES_XSHARED_H */
+ void generic_opt_check(int command, int options);
+ char opt2char(int option);
 diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 8c2d21d42b7d2..3ea293ee7c411 100644
+index 9779bd83d53b3..54f887f80497e 100644
 --- a/iptables/xtables.c
 +++ b/iptables/xtables.c
-@@ -668,14 +668,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
+@@ -587,14 +587,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
  			break;
  
  		case 'N':
@@ -159,5 +160,5 @@ index 8c2d21d42b7d2..3ea293ee7c411 100644
  				    cs->invert);
  			p->chain = optarg;
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0055-nft-shared-Drop-unused-function-print_proto.patch b/SOURCES/0055-nft-shared-Drop-unused-function-print_proto.patch
new file mode 100644
index 0000000..5c808ac
--- /dev/null
+++ b/SOURCES/0055-nft-shared-Drop-unused-function-print_proto.patch
@@ -0,0 +1,58 @@
+From e004e9e1d0e7ef4d9756d9f01feef8efef02300b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 6 Nov 2021 01:09:37 +0100
+Subject: [PATCH] nft-shared: Drop unused function print_proto()
+
+The last users vanished back in 2013. There is identical code in
+save_rule_details(), but with only a single user there's not much point
+in keeping the function.
+
+Fixes: cdc78b1d6bd7b ("nft: convert rule into a command state structure")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit cf14b92bc1a3f5040437234dffe5cf6aa59711a5)
+---
+ iptables/nft-shared.c | 15 ---------------
+ iptables/nft-shared.h |  1 -
+ 2 files changed, 16 deletions(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 4253b08196d29..f270f610a8f67 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -373,21 +373,6 @@ static void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+ 		ctx->h->ops->parse_match(match, ctx->cs);
+ }
+ 
+-void print_proto(uint16_t proto, int invert)
+-{
+-	const struct protoent *pent = getprotobynumber(proto);
+-
+-	if (invert)
+-		printf("! ");
+-
+-	if (pent) {
+-		printf("-p %s ", pent->p_name);
+-		return;
+-	}
+-
+-	printf("-p %u ", proto);
+-}
+-
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv)
+ {
+ 	uint32_t len;
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 6fc81d9ce08ef..519118a2daf6c 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -139,7 +139,6 @@ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+ int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
+ 		unsigned char *iniface_mask, char *outiface,
+ 		unsigned char *outiface_mask, uint8_t *invflags);
+-void print_proto(uint16_t proto, int invert);
+ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+ void nft_rule_to_iptables_command_state(struct nft_handle *h,
+ 					const struct nftnl_rule *r,
+-- 
+2.40.0
+
diff --git a/SOURCES/0056-xshared-Make-load_proto-static.patch b/SOURCES/0056-xshared-Make-load_proto-static.patch
new file mode 100644
index 0000000..6a58c34
--- /dev/null
+++ b/SOURCES/0056-xshared-Make-load_proto-static.patch
@@ -0,0 +1,48 @@
+From 9b1dc489369e19ffd78a69de31f4ac653070eaf8 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 6 Nov 2021 01:32:47 +0100
+Subject: [PATCH] xshared: Make load_proto() static
+
+The last outside users vanished ten years ago.
+
+Fixes: 449cdd6bcc8d1 ("src: combine default_command functions")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 7213561d9d7a17c4db29c867b2607241941dae5a)
+
+Conflicts:
+	iptables/xshared.h
+-> Context change due to missing commit 3664249f52030
+   ("xshared: Eliminate iptables_command_state->invert").
+---
+ iptables/xshared.c | 2 +-
+ iptables/xshared.h | 1 -
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index 5ae158908b109..26e938309eab3 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -106,7 +106,7 @@ static bool should_load_proto(struct iptables_command_state *cs)
+ 	return !cs->proto_used;
+ }
+ 
+-struct xtables_match *load_proto(struct iptables_command_state *cs)
++static struct xtables_match *load_proto(struct iptables_command_state *cs)
+ {
+ 	if (!should_load_proto(cs))
+ 		return NULL;
+diff --git a/iptables/xshared.h b/iptables/xshared.h
+index 10f6e0b5a0e98..d80c8beee1894 100644
+--- a/iptables/xshared.h
++++ b/iptables/xshared.h
+@@ -155,7 +155,6 @@ extern void print_extension_helps(const struct xtables_target *,
+ extern const char *proto_to_name(uint16_t, int);
+ extern int command_default(struct iptables_command_state *,
+ 	struct xtables_globals *);
+-extern struct xtables_match *load_proto(struct iptables_command_state *);
+ extern int subcmd_main(int, char **, const struct subcommand *);
+ extern void xs_init_target(struct xtables_target *);
+ extern void xs_init_match(struct xtables_match *);
+-- 
+2.40.0
+
diff --git a/SOURCES/0057-extensions-libxt_NFLOG-fix-nflog-prefix-Python-test-.patch b/SOURCES/0057-extensions-libxt_NFLOG-fix-nflog-prefix-Python-test-.patch
new file mode 100644
index 0000000..0d2994b
--- /dev/null
+++ b/SOURCES/0057-extensions-libxt_NFLOG-fix-nflog-prefix-Python-test-.patch
@@ -0,0 +1,40 @@
+From 4572ecb1f222ec63f0d5669d0924d2cf1e879290 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Fri, 1 Oct 2021 18:41:39 +0100
+Subject: [PATCH] extensions: libxt_NFLOG: fix `--nflog-prefix` Python
+ test-cases
+
+The `iptables-save` includes an extra space between `--nflog-prefix` and
+the prefix.
+
+The maximum length of prefixes includes the trailing NUL character.
+
+NFLOG silently truncates prefixes which exceed the maximum length.
+
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit f0d02998883d2efcb316cd6f524e2f7b3c4d055b)
+---
+ extensions/libxt_NFLOG.t | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/extensions/libxt_NFLOG.t b/extensions/libxt_NFLOG.t
+index 933fa22160e59..69b0255a891b1 100644
+--- a/extensions/libxt_NFLOG.t
++++ b/extensions/libxt_NFLOG.t
+@@ -12,10 +12,8 @@
+ -j NFLOG --nflog-size 4294967295;=;OK
+ -j NFLOG --nflog-size 4294967296;;FAIL
+ -j NFLOG --nflog-size -1;;FAIL
+-# ERROR: cannot find: iptables -I INPUT -j NFLOG --nflog-prefix  xxxxxx [...]
+-# -j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
+-# ERROR: should fail: iptables -A INPUT -j NFLOG --nflog-prefix  xxxxxxx [...]
+-#  -j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;;FAIL
++-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
++-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;OK
+ -j NFLOG --nflog-threshold 1;=;OK
+ # ERROR: line 13 (should fail: iptables -A INPUT -j NFLOG --nflog-threshold 0
+ # -j NFLOG --nflog-threshold 0;;FAIL
+-- 
+2.40.0
+
diff --git a/SOURCES/0058-extensions-libxt_NFLOG-remove-extra-space-when-savin.patch b/SOURCES/0058-extensions-libxt_NFLOG-remove-extra-space-when-savin.patch
new file mode 100644
index 0000000..5bb97c9
--- /dev/null
+++ b/SOURCES/0058-extensions-libxt_NFLOG-remove-extra-space-when-savin.patch
@@ -0,0 +1,53 @@
+From c83d8cec2a2c70776ca569699983f0cf3e11fb99 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Fri, 1 Oct 2021 18:41:40 +0100
+Subject: [PATCH] extensions: libxt_NFLOG: remove extra space when saving
+ targets with prefixes
+
+When printing out NFLOG targets an extra space was inserted between
+`--nflog-prefix` and the prefix itself:
+
+  $ sudo /usr/sbin/iptables -A INPUT -j NFLOG --nflog-prefix test
+  $ sudo /usr/sbin/iptables-save | grep NFLOG
+  -A INPUT -j NFLOG --nflog-prefix  test
+                                  ^^
+Fixes: 73866357e4a7 ("iptables: do not print trailing whitespaces")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit 05286bab77a6e0f9502e8fb99e1c53ed15663f3f)
+---
+ extensions/libxt_NFLOG.c | 2 +-
+ extensions/libxt_NFLOG.t | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libxt_NFLOG.c b/extensions/libxt_NFLOG.c
+index 02a1b4aa35a3b..80c0263510f1e 100644
+--- a/extensions/libxt_NFLOG.c
++++ b/extensions/libxt_NFLOG.c
+@@ -78,7 +78,7 @@ static void NFLOG_check(struct xt_fcheck_call *cb)
+ static void nflog_print(const struct xt_nflog_info *info, char *prefix)
+ {
+ 	if (info->prefix[0] != '\0') {
+-		printf(" %snflog-prefix ", prefix);
++		printf(" %snflog-prefix", prefix);
+ 		xtables_save_string(info->prefix);
+ 	}
+ 	if (info->group)
+diff --git a/extensions/libxt_NFLOG.t b/extensions/libxt_NFLOG.t
+index 69b0255a891b1..bc529b19fc3ff 100644
+--- a/extensions/libxt_NFLOG.t
++++ b/extensions/libxt_NFLOG.t
+@@ -12,8 +12,8 @@
+ -j NFLOG --nflog-size 4294967295;=;OK
+ -j NFLOG --nflog-size 4294967296;;FAIL
+ -j NFLOG --nflog-size -1;;FAIL
+--j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
+--j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;OK
++-j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
++-j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;-j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;OK
+ -j NFLOG --nflog-threshold 1;=;OK
+ # ERROR: line 13 (should fail: iptables -A INPUT -j NFLOG --nflog-threshold 0
+ # -j NFLOG --nflog-threshold 0;;FAIL
+-- 
+2.40.0
+
diff --git a/SOURCES/0058-nft-cache-Retry-if-kernel-returns-EINTR.patch b/SOURCES/0058-nft-cache-Retry-if-kernel-returns-EINTR.patch
deleted file mode 100644
index 09af587..0000000
--- a/SOURCES/0058-nft-cache-Retry-if-kernel-returns-EINTR.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-From 681cb811e4cb8c5f22fd0fae60a3533289657705 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <psutter@redhat.com>
-Date: Wed, 4 Aug 2021 17:14:05 +0200
-Subject: [PATCH] nft: cache: Retry if kernel returns EINTR
-
-In case of parallel ruleset updates, recvfrom() calls may return EINTR.
-Due to the fact that cache fetches may get triggered while iterating
-over cache elements, __nft_build_cache must not restart based on
-comparing before and after generation ID like upstream does. Instead,
-just retry the recvfrom() calls until they either succeed or return a
-different error than EINTR.
----
- iptables/nft-cache.c | 18 ++++++++++++++----
- 1 file changed, 14 insertions(+), 4 deletions(-)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index 9623b463f0dd5..699dc66a95cd1 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -98,9 +98,12 @@ static int fetch_table_cache(struct nft_handle *h)
- 	nlh = nftnl_rule_nlmsg_build_hdr(buf, NFT_MSG_GETTABLE, h->family,
- 					NLM_F_DUMP, h->seq);
- 
-+retry:
- 	ret = mnl_talk(h, nlh, nftnl_table_list_cb, list);
--	if (ret < 0 && errno == EINTR)
-+	if (ret < 0 && errno == EINTR) {
- 		assert(nft_restart(h) >= 0);
-+		goto retry;
-+	}
- 
- 	h->cache->tables = list;
- 
-@@ -275,10 +278,11 @@ static int fetch_set_cache(struct nft_handle *h,
- 						NLM_F_DUMP, h->seq);
- 	}
- 
-+retry:
- 	ret = mnl_talk(h, nlh, nftnl_set_list_cb, &d);
- 	if (ret < 0 && errno == EINTR) {
- 		assert(nft_restart(h) >= 0);
--		return ret;
-+		goto retry;
- 	}
- 
- 	if (t && set) {
-@@ -355,9 +359,12 @@ static int fetch_chain_cache(struct nft_handle *h,
- 						  h->seq);
- 	}
- 
-+retry:
- 	ret = mnl_talk(h, nlh, nftnl_chain_list_cb, &d);
--	if (ret < 0 && errno == EINTR)
-+	if (ret < 0 && errno == EINTR) {
- 		assert(nft_restart(h) >= 0);
-+		goto retry;
-+	}
- 
- 	return ret;
- }
-@@ -404,9 +411,12 @@ static int nft_rule_list_update(struct nftnl_chain *c, void *data)
- 					NLM_F_DUMP, h->seq);
- 	nftnl_rule_nlmsg_build_payload(nlh, rule);
- 
-+retry:
- 	ret = mnl_talk(h, nlh, nftnl_rule_list_cb, c);
--	if (ret < 0 && errno == EINTR)
-+	if (ret < 0 && errno == EINTR) {
- 		assert(nft_restart(h) >= 0);
-+		goto retry;
-+	}
- 
- 	nftnl_rule_free(rule);
- 
--- 
-2.32.0
-
diff --git a/SOURCES/0072-xshared-Fix-response-to-unprivileged-users.patch b/SOURCES/0059-xshared-Fix-response-to-unprivileged-users.patch
similarity index 81%
rename from SOURCES/0072-xshared-Fix-response-to-unprivileged-users.patch
rename to SOURCES/0059-xshared-Fix-response-to-unprivileged-users.patch
index abe0780..04dd27f 100644
--- a/SOURCES/0072-xshared-Fix-response-to-unprivileged-users.patch
+++ b/SOURCES/0059-xshared-Fix-response-to-unprivileged-users.patch
@@ -1,4 +1,4 @@
-From 6d1b02218a591ff95053b22c1ed802355e44878d Mon Sep 17 00:00:00 2001
+From 84d19c668db246556fac766cff8652ea6f3a4076 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 18 Jan 2022 22:39:08 +0100
 Subject: [PATCH] xshared: Fix response to unprivileged users
@@ -25,18 +25,20 @@ Reviewed-by: Florian Westphal <fw@strlen.de>
 
 Conflicts:
 	iptables/xshared.c
--> Some chunks not applied as not necessary in RHEL8.
+-> Adjusted to missing commit 62c3c93d4b0f5
+   ("xshared: Move do_parse to shared space").
 ---
  iptables/nft.c                                |  5 ++
  .../testcases/iptables/0008-unprivileged_0    | 60 +++++++++++++++++++
- 2 files changed, 65 insertions(+)
+ iptables/xtables.c                            |  3 +-
+ 3 files changed, 66 insertions(+), 2 deletions(-)
  create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0
 
 diff --git a/iptables/nft.c b/iptables/nft.c
-index dc5490c085364..c5cc6f83bf573 100644
+index ba59cfb8c47af..da9d24f5c86e2 100644
 --- a/iptables/nft.c
 +++ b/iptables/nft.c
-@@ -3110,6 +3110,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
+@@ -3294,6 +3294,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
  err:
  	mnl_socket_close(nl);
  
@@ -114,6 +116,20 @@ index 0000000000000..43e3bc8721dbd
 +let "rc+=$?"
 +
 +exit $rc
+diff --git a/iptables/xtables.c b/iptables/xtables.c
+index 54f887f80497e..7ef1702a0cd50 100644
+--- a/iptables/xtables.c
++++ b/iptables/xtables.c
+@@ -637,8 +637,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
+ 					XTF_TRY_LOAD, &cs->matches);
+ 
+ 			printhelp(cs->matches);
+-			p->command = CMD_NONE;
+-			return;
++			exit(0);
+ 
+ 			/*
+ 			 * Option selection
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0071-libxtables-Register-only-the-highest-revision-extens.patch b/SOURCES/0060-libxtables-Register-only-the-highest-revision-extens.patch
similarity index 84%
rename from SOURCES/0071-libxtables-Register-only-the-highest-revision-extens.patch
rename to SOURCES/0060-libxtables-Register-only-the-highest-revision-extens.patch
index cf381ec..e69372a 100644
--- a/SOURCES/0071-libxtables-Register-only-the-highest-revision-extens.patch
+++ b/SOURCES/0060-libxtables-Register-only-the-highest-revision-extens.patch
@@ -1,4 +1,4 @@
-From afcbce6924dfe05af4b41bf46b21794f4a4d8302 Mon Sep 17 00:00:00 2001
+From da4e3255df89367a3fcf0625df2f161724ef591c Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 11 Feb 2022 17:39:24 +0100
 Subject: [PATCH] libxtables: Register only the highest revision extension
@@ -18,10 +18,10 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  1 file changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 4aee74acb6816..57ad0330a454c 100644
+index 7f40b6f1b327b..3f7b9768897ac 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -701,6 +701,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
+@@ -668,6 +668,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
  	struct xtables_match **dptr;
  	struct xtables_match *ptr;
  	const char *icmp6 = "icmp6";
@@ -29,7 +29,7 @@ index 4aee74acb6816..57ad0330a454c 100644
  
  	if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)
  		xtables_error(PARAMETER_PROBLEM,
-@@ -719,7 +720,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
+@@ -686,7 +687,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
  		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
  			ptr = *dptr;
  			*dptr = (*dptr)->next;
@@ -40,7 +40,7 @@ index 4aee74acb6816..57ad0330a454c 100644
  				prev = ptr;
  				continue;
  			} else if (prev) {
-@@ -821,6 +824,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -788,6 +791,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  	struct xtables_target *prev = NULL;
  	struct xtables_target **dptr;
  	struct xtables_target *ptr;
@@ -48,7 +48,7 @@ index 4aee74acb6816..57ad0330a454c 100644
  
  	/* Standard target? */
  	if (strcmp(name, "") == 0
-@@ -839,7 +843,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -802,7 +806,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
  			ptr = *dptr;
  			*dptr = (*dptr)->next;
@@ -60,5 +60,5 @@ index 4aee74acb6816..57ad0330a454c 100644
  				continue;
  			} else if (prev) {
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0073-Improve-error-messages-for-unsupported-extensions.patch b/SOURCES/0061-Improve-error-messages-for-unsupported-extensions.patch
similarity index 90%
rename from SOURCES/0073-Improve-error-messages-for-unsupported-extensions.patch
rename to SOURCES/0061-Improve-error-messages-for-unsupported-extensions.patch
index 0fc7856..13b22c2 100644
--- a/SOURCES/0073-Improve-error-messages-for-unsupported-extensions.patch
+++ b/SOURCES/0061-Improve-error-messages-for-unsupported-extensions.patch
@@ -1,4 +1,4 @@
-From 4243bd97f3c703a75e795fdc6dd2273a7c74e85c Mon Sep 17 00:00:00 2001
+From 8da52ae6b1eabcbce070e25342c9b5b6f84cbf7f Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 11 Feb 2022 17:47:22 +0100
 Subject: [PATCH] Improve error messages for unsupported extensions
@@ -38,10 +38,10 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  2 files changed, 15 insertions(+), 4 deletions(-)
 
 diff --git a/iptables/nft.c b/iptables/nft.c
-index c5cc6f83bf573..9643abf2d0085 100644
+index da9d24f5c86e2..2393940d7f64a 100644
 --- a/iptables/nft.c
 +++ b/iptables/nft.c
-@@ -3110,10 +3110,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
+@@ -3294,10 +3294,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
  err:
  	mnl_socket_close(nl);
  
@@ -62,10 +62,10 @@ index c5cc6f83bf573..9643abf2d0085 100644
  	return ret < 0 ? 0 : 1;
  }
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 57ad0330a454c..a5c8d7e2c17ef 100644
+index 3f7b9768897ac..6ded6cc720ea8 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -968,7 +968,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt)
+@@ -929,7 +929,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt)
  		/* Definitely don't support this? */
  		if (errno == ENOENT || errno == EPROTONOSUPPORT) {
  			close(sockfd);
@@ -80,5 +80,5 @@ index 57ad0330a454c..a5c8d7e2c17ef 100644
  			close(sockfd);
  			/* Assume only revision 0 support (old kernel) */
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0063-nft-Simplify-immediate-parsing.patch b/SOURCES/0062-nft-Simplify-immediate-parsing.patch
similarity index 91%
rename from SOURCES/0063-nft-Simplify-immediate-parsing.patch
rename to SOURCES/0062-nft-Simplify-immediate-parsing.patch
index 4123f4b..fff8e1e 100644
--- a/SOURCES/0063-nft-Simplify-immediate-parsing.patch
+++ b/SOURCES/0062-nft-Simplify-immediate-parsing.patch
@@ -1,4 +1,4 @@
-From c65bd8b3c23f0fe5f824274467740a2d350dcb9c Mon Sep 17 00:00:00 2001
+From 4f6e933bd26243e2e3c644544d609ada04d46873 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 1 Mar 2022 18:59:31 +0100
 Subject: [PATCH] nft: Simplify immediate parsing
@@ -21,7 +21,7 @@ Acked-by: Florian Westphal <fw@strlen.de>
  6 files changed, 14 insertions(+), 47 deletions(-)
 
 diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 7c61c31a13c40..0c37a762cd418 100644
+index 2a9387a18dffe..d55e06572b283 100644
 --- a/iptables/nft-arp.c
 +++ b/iptables/nft-arp.c
 @@ -182,14 +182,6 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
@@ -39,7 +39,7 @@ index 7c61c31a13c40..0c37a762cd418 100644
  static void parse_mask_ipv4(struct nft_xt_ctx *ctx, struct in_addr *mask)
  {
  	mask->s_addr = ctx->bitwise.mask[0];
-@@ -575,7 +567,6 @@ struct nft_family_ops nft_family_ops_arp = {
+@@ -552,7 +544,6 @@ struct nft_family_ops nft_family_ops_arp = {
  	.print_payload		= NULL,
  	.parse_meta		= nft_arp_parse_meta,
  	.parse_payload		= nft_arp_parse_payload,
@@ -48,7 +48,7 @@ index 7c61c31a13c40..0c37a762cd418 100644
  	.print_rule		= nft_arp_print_rule,
  	.save_rule		= nft_arp_save_rule,
 diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index 2aa15e2d1e69d..e00a19e843d93 100644
+index c1a2c209cc1aa..94febc9890674 100644
 --- a/iptables/nft-bridge.c
 +++ b/iptables/nft-bridge.c
 @@ -284,14 +284,6 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
@@ -66,7 +66,7 @@ index 2aa15e2d1e69d..e00a19e843d93 100644
  /* return 0 if saddr, 1 if daddr, -1 on error */
  static int
  lookup_check_ether_payload(uint32_t base, uint32_t offset, uint32_t len)
-@@ -948,7 +940,6 @@ struct nft_family_ops nft_family_ops_bridge = {
+@@ -922,7 +914,6 @@ struct nft_family_ops nft_family_ops_bridge = {
  	.print_payload		= NULL,
  	.parse_meta		= nft_bridge_parse_meta,
  	.parse_payload		= nft_bridge_parse_payload,
@@ -75,7 +75,7 @@ index 2aa15e2d1e69d..e00a19e843d93 100644
  	.parse_match		= nft_bridge_parse_match,
  	.parse_target		= nft_bridge_parse_target,
 diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index d8c48ce8817b6..c826ac153139f 100644
+index a5b835b1f681d..76c76b67100ca 100644
 --- a/iptables/nft-ipv4.c
 +++ b/iptables/nft-ipv4.c
 @@ -241,15 +241,9 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
@@ -106,7 +106,7 @@ index d8c48ce8817b6..c826ac153139f 100644
  	.print_rule		= nft_ipv4_print_rule,
  	.save_rule		= nft_ipv4_save_rule,
 diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index a5481b3f77ac5..127bc96379968 100644
+index 46008fc5e762a..fac0f16cfe815 100644
 --- a/iptables/nft-ipv6.c
 +++ b/iptables/nft-ipv6.c
 @@ -180,15 +180,9 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
@@ -137,10 +137,10 @@ index a5481b3f77ac5..127bc96379968 100644
  	.print_rule		= nft_ipv6_print_rule,
  	.save_rule		= nft_ipv6_save_rule,
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 7f757d38ecaec..172cf2054a33c 100644
+index f270f610a8f67..894407f7d9b57 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
-@@ -510,9 +510,7 @@ static void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters
+@@ -495,9 +495,7 @@ static void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters
  static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
  {
  	const char *chain = nftnl_expr_get_str(e, NFTNL_EXPR_IMM_CHAIN);
@@ -151,7 +151,7 @@ index 7f757d38ecaec..172cf2054a33c 100644
  	int verdict;
  
  	if (nftnl_expr_is_set(e, NFTNL_EXPR_IMM_DATA)) {
-@@ -535,23 +533,22 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+@@ -520,23 +518,22 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
  	/* Standard target? */
  	switch(verdict) {
  	case NF_ACCEPT:
@@ -182,7 +182,7 @@ index 7f757d38ecaec..172cf2054a33c 100644
  
  static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
 diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 520a296fb530c..29f7056714235 100644
+index 519118a2daf6c..2c5f2cfc012d5 100644
 --- a/iptables/nft-shared.h
 +++ b/iptables/nft-shared.h
 @@ -89,7 +89,7 @@ struct nft_family_ops {
@@ -195,5 +195,5 @@ index 520a296fb530c..29f7056714235 100644
  	void (*print_table_header)(const char *tablename);
  	void (*print_header)(unsigned int format, const char *chain,
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0064-nft-Speed-up-immediate-parsing.patch b/SOURCES/0063-nft-Speed-up-immediate-parsing.patch
similarity index 84%
rename from SOURCES/0064-nft-Speed-up-immediate-parsing.patch
rename to SOURCES/0063-nft-Speed-up-immediate-parsing.patch
index 8eba9ef..1af0583 100644
--- a/SOURCES/0064-nft-Speed-up-immediate-parsing.patch
+++ b/SOURCES/0063-nft-Speed-up-immediate-parsing.patch
@@ -1,4 +1,4 @@
-From 5d6c1effe324d1a2401a4315895fe72c7255a14d Mon Sep 17 00:00:00 2001
+From 1a3d13b637e71f1f207eda17f816c58a9425971e Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 1 Mar 2022 19:46:21 +0100
 Subject: [PATCH] nft: Speed up immediate parsing
@@ -32,10 +32,10 @@ Acked-by: Florian Westphal <fw@strlen.de>
  2 files changed, 19 insertions(+), 19 deletions(-)
 
 diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index e00a19e843d93..3fd03fb8de4ff 100644
+index 94febc9890674..9cc6f87b28fe0 100644
 --- a/iptables/nft-bridge.c
 +++ b/iptables/nft-bridge.c
-@@ -530,6 +530,7 @@ static void nft_bridge_parse_target(struct xtables_target *t, void *data)
+@@ -539,6 +539,7 @@ static void nft_bridge_parse_target(struct xtables_target *t, void *data)
  	}
  
  	cs->target = t;
@@ -44,10 +44,10 @@ index e00a19e843d93..3fd03fb8de4ff 100644
  
  static void nft_rule_to_ebtables_command_state(struct nft_handle *h,
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 172cf2054a33c..d73d0b6159be6 100644
+index 894407f7d9b57..6c643a8c06aaa 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
-@@ -511,6 +511,8 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+@@ -496,6 +496,8 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
  {
  	const char *chain = nftnl_expr_get_str(e, NFTNL_EXPR_IMM_CHAIN);
  	struct iptables_command_state *cs = ctx->cs;
@@ -56,7 +56,7 @@ index 172cf2054a33c..d73d0b6159be6 100644
  	int verdict;
  
  	if (nftnl_expr_is_set(e, NFTNL_EXPR_IMM_DATA)) {
-@@ -547,8 +549,21 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+@@ -532,8 +534,21 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
  		/* fall through */
  	case NFT_JUMP:
  		cs->jumpto = chain;
@@ -79,7 +79,7 @@ index 172cf2054a33c..d73d0b6159be6 100644
  }
  
  static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
-@@ -676,25 +691,8 @@ void nft_rule_to_iptables_command_state(struct nft_handle *h,
+@@ -661,25 +676,8 @@ void nft_rule_to_iptables_command_state(struct nft_handle *h,
  		}
  	}
  
@@ -106,14 +106,14 @@ index 172cf2054a33c..d73d0b6159be6 100644
  }
  
  void nft_clear_iptables_command_state(struct iptables_command_state *cs)
-@@ -991,6 +989,7 @@ void nft_ipv46_parse_target(struct xtables_target *t, void *data)
+@@ -968,6 +966,7 @@ void nft_ipv46_parse_target(struct xtables_target *t, void *data)
  	struct iptables_command_state *cs = data;
  
  	cs->target = t;
 +	cs->jumpto = t->name;
  }
  
- bool nft_ipv46_rule_find(struct nft_handle *h, struct nftnl_rule *r, void *data)
+ void nft_check_xt_legacy(int family, bool is_ipt_save)
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0065-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch b/SOURCES/0064-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
similarity index 90%
rename from SOURCES/0065-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
rename to SOURCES/0064-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
index 9d2bd59..519887d 100644
--- a/SOURCES/0065-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
+++ b/SOURCES/0064-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
@@ -1,4 +1,4 @@
-From daca1bc21c6fca067d861792c97357d7561a0564 Mon Sep 17 00:00:00 2001
+From 38ddff6cd616cf9d6869bcf8fa3c01e186446cb4 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 1 Mar 2022 23:05:29 +0100
 Subject: [PATCH] xshared: Prefer xtables_chain_protos lookup over getprotoent
@@ -30,10 +30,10 @@ Acked-by: Florian Westphal <fw@strlen.de>
  2 files changed, 10 insertions(+), 17 deletions(-)
 
 diff --git a/iptables/xshared.c b/iptables/xshared.c
-index e3c8072b5ca96..dcc995a9cabe6 100644
+index 26e938309eab3..f7581967efc28 100644
 --- a/iptables/xshared.c
 +++ b/iptables/xshared.c
-@@ -52,16 +52,16 @@ proto_to_name(uint8_t proto, int nolookup)
+@@ -52,16 +52,16 @@ proto_to_name(uint16_t proto, int nolookup)
  {
  	unsigned int i;
  
@@ -55,10 +55,10 @@ index e3c8072b5ca96..dcc995a9cabe6 100644
  }
  
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 28ffffedd8147..58dd69440253d 100644
+index 6ded6cc720ea8..cb380ad61ccb5 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -2021,10 +2021,11 @@ const struct xtables_pprot xtables_chain_protos[] = {
+@@ -2077,10 +2077,11 @@ const struct xtables_pprot xtables_chain_protos[] = {
  	{"udp",       IPPROTO_UDP},
  	{"udplite",   IPPROTO_UDPLITE},
  	{"icmp",      IPPROTO_ICMP},
@@ -71,7 +71,7 @@ index 28ffffedd8147..58dd69440253d 100644
  	{"ipv6-mh",   IPPROTO_MH},
  	{"mh",        IPPROTO_MH},
  	{"all",       0},
-@@ -2040,23 +2041,15 @@ xtables_parse_protocol(const char *s)
+@@ -2096,23 +2097,15 @@ xtables_parse_protocol(const char *s)
  	if (xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX))
  		return proto;
  
@@ -100,5 +100,5 @@ index 28ffffedd8147..58dd69440253d 100644
  		"unknown protocol \"%s\" specified", s);
  	return -1;
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0065-libxtables-Fix-for-warning-in-xtables_ipmask_to_nume.patch b/SOURCES/0065-libxtables-Fix-for-warning-in-xtables_ipmask_to_nume.patch
new file mode 100644
index 0000000..dc8f89f
--- /dev/null
+++ b/SOURCES/0065-libxtables-Fix-for-warning-in-xtables_ipmask_to_nume.patch
@@ -0,0 +1,41 @@
+From f6915482a365373c5892752f87086740b84fe2d3 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 15 Mar 2022 12:17:25 +0100
+Subject: [PATCH] libxtables: Fix for warning in xtables_ipmask_to_numeric
+
+Gcc complains:
+
+| xtables.c: In function 'xtables_ipmask_to_numeric':
+| xtables.c:1491:34: warning: '__builtin___sprintf_chk' may write a terminating nul past the end of the destination [-Wformat-overflow=]
+|  1491 |                 sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask));
+|       |                                  ^
+
+Indeed, xtables_ipaddr_to_numeric() returns a pointer to a 20 byte
+buffer and xtables_ipmask_to_numeric() writes its content into a buffer
+of same size at offset 1. Yet length of returned string is deterministic
+as it is an IPv4 address. So shrink it to the minimum of 16 bytes which
+eliminates the warning as well.
+
+Fixes: a96166c24eaac ("libxtables: add xtables_ip[6]mask_to_cidr")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 0c8e253595bd80e4ddd73230d079e33cd5420b32)
+---
+ libxtables/xtables.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libxtables/xtables.c b/libxtables/xtables.c
+index cb380ad61ccb5..2e6c68292f16a 100644
+--- a/libxtables/xtables.c
++++ b/libxtables/xtables.c
+@@ -1389,7 +1389,7 @@ void xtables_param_act(unsigned int status, const char *p1, ...)
+ 
+ const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp)
+ {
+-	static char buf[20];
++	static char buf[16];
+ 	const unsigned char *bytep = (const void *)&addrp->s_addr;
+ 
+ 	sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]);
+-- 
+2.40.0
+
diff --git a/SOURCES/0067-nft-Reject-standard-targets-as-chain-names-when-rest.patch b/SOURCES/0066-nft-Reject-standard-targets-as-chain-names-when-rest.patch
similarity index 73%
rename from SOURCES/0067-nft-Reject-standard-targets-as-chain-names-when-rest.patch
rename to SOURCES/0066-nft-Reject-standard-targets-as-chain-names-when-rest.patch
index a26a9c0..9155bdc 100644
--- a/SOURCES/0067-nft-Reject-standard-targets-as-chain-names-when-rest.patch
+++ b/SOURCES/0066-nft-Reject-standard-targets-as-chain-names-when-rest.patch
@@ -1,4 +1,4 @@
-From 257c18bf4fbcc7e5f4fb3c9cadab699986a9bd41 Mon Sep 17 00:00:00 2001
+From 0a2bf490dde3b55fd2607976aa07a853a18e15f7 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Wed, 16 Mar 2022 17:14:07 +0100
 Subject: [PATCH] nft: Reject standard targets as chain names when restoring
@@ -17,7 +17,12 @@ Reviewed-by: Florian Westphal <fw@strlen.de>
 
 Conflicts:
 	iptables/xshared.c
--> Parts manually applied due to unmerged do_parse() function.
+-> Context change due to missing commit 9dc50b5b8e441
+   ("xshared: Merge invflags handling code").
+-> Adjust to missing commits 62c3c93d4b0f5
+   ("xshared: Move do_parse to shared space"), 9baf3bf0e77da
+   ("iptables: Use xtables' do_parse() function") and 5c2c2eea2fff3
+   ("ip6tables: Use the shared do_parse, too").
 ---
  iptables/ip6tables.c       | 2 +-
  iptables/iptables.c        | 2 +-
@@ -28,10 +33,10 @@ Conflicts:
  6 files changed, 6 insertions(+), 9 deletions(-)
 
 diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index 614d1e249c06d..b96dc033e7ebb 100644
+index 6db91c807bcea..897f30d5ef4b0 100644
 --- a/iptables/ip6tables.c
 +++ b/iptables/ip6tables.c
-@@ -1247,7 +1247,7 @@ int do_command6(int argc, char *argv[], char **table,
+@@ -1156,7 +1156,7 @@ int do_command6(int argc, char *argv[], char **table,
  			break;
  
  		case 'N':
@@ -41,10 +46,10 @@ index 614d1e249c06d..b96dc033e7ebb 100644
  				    cs.invert);
  			chain = optarg;
 diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 3b395981cc8ea..6e2946f5660de 100644
+index a33416a887ed4..9964d14ed8195 100644
 --- a/iptables/iptables.c
 +++ b/iptables/iptables.c
-@@ -1243,7 +1243,7 @@ int do_command4(int argc, char *argv[], char **table,
+@@ -1153,7 +1153,7 @@ int do_command4(int argc, char *argv[], char **table,
  			break;
  
  		case 'N':
@@ -54,11 +59,11 @@ index 3b395981cc8ea..6e2946f5660de 100644
  				    cs.invert);
  			chain = optarg;
 diff --git a/iptables/xshared.c b/iptables/xshared.c
-index de8326b6c7b05..0c232ca2ae8d5 100644
+index f7581967efc28..b052b849b2069 100644
 --- a/iptables/xshared.c
 +++ b/iptables/xshared.c
-@@ -776,7 +776,7 @@ int parse_rulenumber(const char *rule)
- 	return rulenum;
+@@ -849,7 +849,7 @@ char opt2char(int option)
+ 	return *ptr;
  }
  
 -void parse_chain(const char *chainname)
@@ -67,22 +72,23 @@ index de8326b6c7b05..0c232ca2ae8d5 100644
  	const char *ptr;
  
 diff --git a/iptables/xshared.h b/iptables/xshared.h
-index f5d2f8d0a2bc5..095a574d85879 100644
+index d80c8beee1894..c512f20afd33a 100644
 --- a/iptables/xshared.h
 +++ b/iptables/xshared.h
-@@ -217,6 +217,6 @@ char cmd2char(int option);
+@@ -222,7 +222,7 @@ char cmd2char(int option);
  void add_command(unsigned int *cmd, const int newcmd,
  		 const int othercmds, int invert);
  int parse_rulenumber(const char *rule);
 -void parse_chain(const char *chainname);
 +void assert_valid_chain_name(const char *chainname);
  
- #endif /* IPTABLES_XSHARED_H */
+ void generic_opt_check(int command, int options);
+ char opt2char(int option);
 diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index c472ac9bf651b..a078da32045dc 100644
+index a3bb4f00e79c6..5d0e44843b285 100644
 --- a/iptables/xtables-restore.c
 +++ b/iptables/xtables-restore.c
-@@ -150,10 +150,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
+@@ -156,10 +156,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
  				   "%s: line %u chain name invalid\n",
  				   xt_params->program_name, line);
  
@@ -95,10 +101,10 @@ index c472ac9bf651b..a078da32045dc 100644
  		policy = strtok(NULL, " \t\n");
  		DEBUGP("line %u, policy '%s'\n", line, policy);
 diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 3ea293ee7c411..9006962472c58 100644
+index 7ef1702a0cd50..3c7b3fc45b6f6 100644
 --- a/iptables/xtables.c
 +++ b/iptables/xtables.c
-@@ -668,7 +668,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
+@@ -587,7 +587,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
  			break;
  
  		case 'N':
@@ -108,5 +114,5 @@ index 3ea293ee7c411..9006962472c58 100644
  				    cs->invert);
  			p->chain = optarg;
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0068-libxtables-Implement-notargets-hash-table.patch b/SOURCES/0067-libxtables-Implement-notargets-hash-table.patch
similarity index 78%
rename from SOURCES/0068-libxtables-Implement-notargets-hash-table.patch
rename to SOURCES/0067-libxtables-Implement-notargets-hash-table.patch
index 082886c..bce7ffc 100644
--- a/SOURCES/0068-libxtables-Implement-notargets-hash-table.patch
+++ b/SOURCES/0067-libxtables-Implement-notargets-hash-table.patch
@@ -1,4 +1,4 @@
-From 3e8e2f0a6590a3b1eeb989e364fe4b5638be108f Mon Sep 17 00:00:00 2001
+From 064d7af6927b7b47d13d7fa7ad815f99d83d5006 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 15 Dec 2020 15:40:56 +0100
 Subject: [PATCH] libxtables: Implement notargets hash table
@@ -10,17 +10,12 @@ the failed lookups into a hashtable for later.
 Signed-off-by: Phil Sutter <phil@nwl.cc>
 Acked-by: Florian Westphal <fw@strlen.de>
 (cherry picked from commit f58b0d7406451afbb4b9b6c7888990c964fa7c79)
-
-Conflicts:
-	libxtables/xtables.c
--> Context changes and missing xtables_fini() due to missing commit
-   7db4333dc0b6c ("libxtables: Introduce xtables_fini()")
 ---
- libxtables/xtables.c | 79 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 79 insertions(+)
+ libxtables/xtables.c | 75 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
 
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 58dd69440253d..1e1c218df7441 100644
+index 2e6c68292f16a..b2b3eddf78dbc 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
 @@ -48,6 +48,7 @@
@@ -31,9 +26,9 @@ index 58dd69440253d..1e1c218df7441 100644
  
  #ifndef NO_SHARED_LIBS
  #include <dlfcn.h>
-@@ -208,6 +209,71 @@ static bool xtables_fully_register_pending_match(struct xtables_match *me,
- static bool xtables_fully_register_pending_target(struct xtables_target *me,
- 						  struct xtables_target *prev);
+@@ -242,6 +243,71 @@ static void dlreg_free(void)
+ }
+ #endif
  
 +struct notarget {
 +	struct hlist_node node;
@@ -103,21 +98,24 @@ index 58dd69440253d..1e1c218df7441 100644
  void xtables_init(void)
  {
  	xtables_libdir = getenv("XTABLES_LIBDIR");
-@@ -233,6 +299,13 @@ void xtables_init(void)
+@@ -267,6 +333,8 @@ void xtables_init(void)
  		return;
  	}
  	xtables_libdir = XTABLES_LIBDIR;
 +
 +	notargets_hlist_init();
-+}
-+
-+void xtables_fini(void)
-+{
+ }
+ 
+ void xtables_fini(void)
+@@ -274,6 +342,7 @@ void xtables_fini(void)
+ #ifndef NO_SHARED_LIBS
+ 	dlreg_free();
+ #endif
 +	notargets_hlist_free();
  }
  
  void xtables_set_nfproto(uint8_t nfproto)
-@@ -750,6 +823,10 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -800,6 +869,10 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  	    || strcmp(name, XTC_LABEL_QUEUE) == 0
  	    || strcmp(name, XTC_LABEL_RETURN) == 0)
  		name = "standard";
@@ -128,7 +126,7 @@ index 58dd69440253d..1e1c218df7441 100644
  
  	/* Trigger delayed initialization */
  	for (dptr = &xtables_pending_targets; *dptr; ) {
-@@ -813,6 +890,8 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -865,6 +938,8 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  
  	if (ptr)
  		ptr->used = 1;
@@ -138,5 +136,5 @@ index 58dd69440253d..1e1c218df7441 100644
  	return ptr;
  }
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0069-libxtables-Boost-rule-target-checks-by-announcing-ch.patch b/SOURCES/0068-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
similarity index 82%
rename from SOURCES/0069-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
rename to SOURCES/0068-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
index 7116ad2..dc5e7bc 100644
--- a/SOURCES/0069-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
+++ b/SOURCES/0068-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
@@ -1,4 +1,4 @@
-From 86bf4207cb744c38807fb5c42c5921fc9964a2af Mon Sep 17 00:00:00 2001
+From 2fb92babbf460de158cc435f66c46f0642763193 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Fri, 4 Mar 2022 12:50:01 +0100
 Subject: [PATCH] libxtables: Boost rule target checks by announcing chain
@@ -27,10 +27,10 @@ Acked-by: Florian Westphal <fw@strlen.de>
  4 files changed, 11 insertions(+)
 
 diff --git a/include/xtables.h b/include/xtables.h
-index 4aa084a1a2a30..d77a73a4303a7 100644
+index a7b36979398ba..3c0d0f78e8d1a 100644
 --- a/include/xtables.h
 +++ b/include/xtables.h
-@@ -632,6 +632,9 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
+@@ -633,6 +633,9 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
  const char *xt_xlate_get_comment(struct xt_xlate *xl);
  const char *xt_xlate_get(struct xt_xlate *xl);
  
@@ -41,10 +41,10 @@ index 4aa084a1a2a30..d77a73a4303a7 100644
  
  /* Shipped modules rely on this... */
 diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
-index b0a51d491c508..339abaa32a055 100644
+index cc2c2b8b10086..a34d95015c93c 100644
 --- a/iptables/iptables-restore.c
 +++ b/iptables/iptables-restore.c
-@@ -309,6 +309,7 @@ ip46tables_restore_main(const struct iptables_restore_cb *cb,
+@@ -311,6 +311,7 @@ ip46tables_restore_main(const struct iptables_restore_cb *cb,
  						cb->ops->strerror(errno));
  			}
  
@@ -53,10 +53,10 @@ index b0a51d491c508..339abaa32a055 100644
  
  		} else if (in_table) {
 diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index a078da32045dc..41e7cb7661464 100644
+index 5d0e44843b285..b3c8dbaa7e2cc 100644
 --- a/iptables/xtables-restore.c
 +++ b/iptables/xtables-restore.c
-@@ -150,6 +150,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
+@@ -156,6 +156,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
  				   "%s: line %u chain name invalid\n",
  				   xt_params->program_name, line);
  
@@ -65,10 +65,10 @@ index a078da32045dc..41e7cb7661464 100644
  
  		policy = strtok(NULL, " \t\n");
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 1e1c218df7441..4aee74acb6816 100644
+index b2b3eddf78dbc..803551053c15f 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -274,6 +274,12 @@ static void notargets_hlist_insert(const char *name)
+@@ -308,6 +308,12 @@ static void notargets_hlist_insert(const char *name)
  	hlist_add_head(&cur->node, &notargets[djb_hash(name) % NOTARGET_HSIZE]);
  }
  
@@ -82,5 +82,5 @@ index 1e1c218df7441..4aee74acb6816 100644
  {
  	xtables_libdir = getenv("XTABLES_LIBDIR");
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0069-nft-shared-update-context-register-for-bitwise-expre.patch b/SOURCES/0069-nft-shared-update-context-register-for-bitwise-expre.patch
new file mode 100644
index 0000000..d9b7fe9
--- /dev/null
+++ b/SOURCES/0069-nft-shared-update-context-register-for-bitwise-expre.patch
@@ -0,0 +1,31 @@
+From ef0405f9267dc23f51bb2b84e63e31ba484f3196 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 21 Apr 2022 16:53:33 +0200
+Subject: [PATCH] nft-shared: update context register for bitwise expression
+
+Update the destination register, otherwise nft_parse_cmp() gives up on
+interpreting the cmp expression when bitwise sreg != dreg.
+
+Fixes: 2c4a34c30cb4 ("iptables-compat: fix address prefix")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 4c70c42fe8d937a2ca2709daa9efe96275d194da)
+---
+ iptables/nft-shared.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 6c643a8c06aaa..2b934ffc17756 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -459,6 +459,8 @@ static void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+ 	if (ctx->reg && reg != ctx->reg)
+ 		return;
+ 
++	reg = nftnl_expr_get_u32(e, NFTNL_EXPR_BITWISE_DREG);
++	ctx->reg = reg;
+ 	data = nftnl_expr_get(e, NFTNL_EXPR_BITWISE_XOR, &len);
+ 	memcpy(ctx->bitwise.xor, data, len);
+ 	data = nftnl_expr_get(e, NFTNL_EXPR_BITWISE_MASK, &len);
+-- 
+2.40.0
+
diff --git a/SOURCES/0070-extensions-MARK-Drop-extra-newline-at-end-of-help.patch b/SOURCES/0070-extensions-MARK-Drop-extra-newline-at-end-of-help.patch
new file mode 100644
index 0000000..f1fb0e9
--- /dev/null
+++ b/SOURCES/0070-extensions-MARK-Drop-extra-newline-at-end-of-help.patch
@@ -0,0 +1,29 @@
+From 1f7fa039057778f229c5190d816551bf75955d5a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 5 May 2022 18:00:14 +0200
+Subject: [PATCH] extensions: MARK: Drop extra newline at end of help
+
+Fixes: f4b737fb0c52a ("libxt_MARK r2")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit adbfec0b3e3275ea5e7c933b630756cf01a4f8c6)
+---
+ extensions/libxt_MARK.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
+index b765af6c35304..1536563d0f4c7 100644
+--- a/extensions/libxt_MARK.c
++++ b/extensions/libxt_MARK.c
+@@ -77,8 +77,7 @@ static void mark_tg_help(void)
+ "  --set-mark value[/mask]   Clear bits in mask and OR value into nfmark\n"
+ "  --and-mark bits           Binary AND the nfmark with bits\n"
+ "  --or-mark bits            Binary OR the nfmark with bits\n"
+-"  --xor-mark bits           Binary XOR the nfmark with bits\n"
+-"\n");
++"  --xor-mark bits           Binary XOR the nfmark with bits\n");
+ }
+ 
+ static void MARK_parse_v0(struct xt_option_call *cb)
+-- 
+2.40.0
+
diff --git a/SOURCES/0071-extensions-LOG-Document-log-macdecode-in-man-page.patch b/SOURCES/0071-extensions-LOG-Document-log-macdecode-in-man-page.patch
new file mode 100644
index 0000000..2e09a68
--- /dev/null
+++ b/SOURCES/0071-extensions-LOG-Document-log-macdecode-in-man-page.patch
@@ -0,0 +1,28 @@
+From 32ae030336b73b57ebe0f5e74ea17e09834f3870 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 24 Mar 2022 11:06:24 +0100
+Subject: [PATCH] extensions: LOG: Document --log-macdecode in man page
+
+Help text already contains it, so no update needed there.
+
+Fixes: 127647892c7ca ("extensions: libipt_LOG/libip6t_LOG: support macdecode option")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ce9195c6e2fa6c6daa3c34b94353a539237b3809)
+---
+ extensions/libxt_LOG.man | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/extensions/libxt_LOG.man b/extensions/libxt_LOG.man
+index 354edf4cc2916..1d5071ba720b9 100644
+--- a/extensions/libxt_LOG.man
++++ b/extensions/libxt_LOG.man
+@@ -30,3 +30,6 @@ Log options from the IP/IPv6 packet header.
+ .TP
+ \fB\-\-log\-uid\fP
+ Log the userid of the process which generated the packet.
++.TP
++\fB\-\-log\-macdecode\fP
++Log MAC addresses and protocol.
+-- 
+2.40.0
+
diff --git a/SOURCES/0074-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch b/SOURCES/0072-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
similarity index 92%
rename from SOURCES/0074-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
rename to SOURCES/0072-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
index 9551eaf..2d4c4ce 100644
--- a/SOURCES/0074-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
+++ b/SOURCES/0072-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
@@ -1,4 +1,4 @@
-From 3696c4af80496a0dd5a3637e4be11754e2cdc99e Mon Sep 17 00:00:00 2001
+From 26dc3496694dc71c95164b6885c7422196802c6d Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Wed, 4 May 2022 11:19:16 +0200
 Subject: [PATCH] nft: Fix EPERM handling for extensions without rev 0
@@ -17,10 +17,10 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  2 files changed, 13 insertions(+), 4 deletions(-)
 
 diff --git a/iptables/nft.c b/iptables/nft.c
-index 9643abf2d0085..9839e8c683708 100644
+index 2393940d7f64a..c130369f78348 100644
 --- a/iptables/nft.c
 +++ b/iptables/nft.c
-@@ -3110,15 +3110,18 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
+@@ -3294,15 +3294,18 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
  err:
  	mnl_socket_close(nl);
  
@@ -61,5 +61,5 @@ index 43e3bc8721dbd..983531fef4720 100755
  let "rc+=$?"
  grep_or_rc "tcp match options:" <<< "$out"
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0075-tests-shell-Check-overhead-in-iptables-save-and-rest.patch b/SOURCES/0073-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
similarity index 96%
rename from SOURCES/0075-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
rename to SOURCES/0073-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
index 8f44318..29add61 100644
--- a/SOURCES/0075-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
+++ b/SOURCES/0073-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
@@ -1,4 +1,4 @@
-From 4d61a3ea7bc6cbef8d4ea021e4998137cfca1453 Mon Sep 17 00:00:00 2001
+From a40839b6c6d5d9742a5316ed3b4bd13516537ee1 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Thu, 2 Jun 2022 13:44:45 +0200
 Subject: [PATCH] tests: shell: Check overhead in iptables-save and -restore
@@ -57,5 +57,5 @@ index 0000000000000..b86d71f209471
 +
 +exit 0
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0074-iptables-legacy-Drop-redundant-include-of-xtables-mu.patch b/SOURCES/0074-iptables-legacy-Drop-redundant-include-of-xtables-mu.patch
new file mode 100644
index 0000000..4822d68
--- /dev/null
+++ b/SOURCES/0074-iptables-legacy-Drop-redundant-include-of-xtables-mu.patch
@@ -0,0 +1,33 @@
+From 88416b4ac4fabde5098f2ff22dc634e5e6f6da51 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 1 Jun 2022 19:29:28 +0200
+Subject: [PATCH] iptables-legacy: Drop redundant include of xtables-multi.h
+
+The header is included unconditionally first, so no point in doing it a
+second time of ENABLE_NFTABLES is defined.
+
+Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ef5d0c68261611d72ccecb3ae05c24448fbc91f5)
+---
+ iptables/xtables-legacy-multi.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/iptables/xtables-legacy-multi.c b/iptables/xtables-legacy-multi.c
+index 3b7905ff76b13..2c71931551b5c 100644
+--- a/iptables/xtables-legacy-multi.c
++++ b/iptables/xtables-legacy-multi.c
+@@ -14,10 +14,6 @@
+ #include "ip6tables-multi.h"
+ #endif
+ 
+-#ifdef ENABLE_NFTABLES
+-#include "xtables-multi.h"
+-#endif
+-
+ static const struct subcommand multi_subcommands[] = {
+ #ifdef ENABLE_IPV4
+ 	{"iptables",            iptables_main},
+-- 
+2.40.0
+
diff --git a/SOURCES/0075-tests-shell-Add-some-more-rules-to-0002-verbose-outp.patch b/SOURCES/0075-tests-shell-Add-some-more-rules-to-0002-verbose-outp.patch
new file mode 100644
index 0000000..88cf7b4
--- /dev/null
+++ b/SOURCES/0075-tests-shell-Add-some-more-rules-to-0002-verbose-outp.patch
@@ -0,0 +1,55 @@
+From 9fb89d10d071076c3178749b4237c669db93aa39 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 20 May 2021 11:40:18 +0200
+Subject: [PATCH] tests: shell: Add some more rules to 0002-verbose-output_0
+
+This increases coverage of function print_match() from 0 to 86.6%.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit a219f8d407ee22d69bf74478b6c7331c602b28c6)
+---
+ .../testcases/ip6tables/0002-verbose-output_0     | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0 b/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
+index 7b0e64686c6b6..7624cbab655ad 100755
+--- a/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
++++ b/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
+@@ -9,12 +9,24 @@ RULE1='-i eth2 -o eth3 -s feed:babe::1 -d feed:babe::2 -j ACCEPT'
+ VOUT1='ACCEPT  all opt    in eth2 out eth3  feed:babe::1  -> feed:babe::2'
+ RULE2='-i eth2 -o eth3 -s feed:babe::4 -d feed:babe::5 -j ACCEPT'
+ VOUT2='ACCEPT  all opt    in eth2 out eth3  feed:babe::4  -> feed:babe::5'
++RULE3='-p icmpv6 -m icmp6 --icmpv6-type no-route'
++VOUT3='  ipv6-icmp opt    in * out *  ::/0  -> ::/0   ipv6-icmptype 1 code 0'
++RULE4='-m dst --dst-len 42 -m rt --rt-type 23'
++VOUT4='  all opt    in * out *  ::/0  -> ::/0   dst length:42  rt type:23'
++RULE5='-m frag --fragid 1337 -j LOG'
++VOUT5='LOG  all opt    in * out *  ::/0  -> ::/0   frag id:1337 LOG flags 0 level 4'
+ 
+ diff -u -Z <(echo -e "$VOUT1") <($XT_MULTI ip6tables -v -A FORWARD $RULE1)
+ diff -u -Z <(echo -e "$VOUT2") <($XT_MULTI ip6tables -v -I FORWARD 2 $RULE2)
++diff -u -Z <(echo -e "$VOUT3") <($XT_MULTI ip6tables -v -A FORWARD $RULE3)
++diff -u -Z <(echo -e "$VOUT4") <($XT_MULTI ip6tables -v -A FORWARD $RULE4)
++diff -u -Z <(echo -e "$VOUT5") <($XT_MULTI ip6tables -v -A FORWARD $RULE5)
+ 
+ diff -u -Z <(echo -e "$VOUT1") <($XT_MULTI ip6tables -v -C FORWARD $RULE1)
+ diff -u -Z <(echo -e "$VOUT2") <($XT_MULTI ip6tables -v -C FORWARD $RULE2)
++diff -u -Z <(echo -e "$VOUT3") <($XT_MULTI ip6tables -v -C FORWARD $RULE3)
++diff -u -Z <(echo -e "$VOUT4") <($XT_MULTI ip6tables -v -C FORWARD $RULE4)
++diff -u -Z <(echo -e "$VOUT5") <($XT_MULTI ip6tables -v -C FORWARD $RULE5)
+ 
+ EXPECT='Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
+  pkts bytes target     prot opt in     out     source               destination
+@@ -23,6 +35,9 @@ Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
+  pkts bytes target     prot opt in     out     source               destination
+     0     0 ACCEPT     all      eth2   eth3    feed:babe::1         feed:babe::2
+     0     0 ACCEPT     all      eth2   eth3    feed:babe::4         feed:babe::5
++    0     0            ipv6-icmp    *      *       ::/0                 ::/0                 ipv6-icmptype 1 code 0
++    0     0            all      *      *       ::/0                 ::/0                 dst length:42  rt type:23
++    0     0 LOG        all      *      *       ::/0                 ::/0                 frag id:1337 LOG flags 0 level 4
+ 
+ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
+  pkts bytes target     prot opt in     out     source               destination'
+-- 
+2.40.0
+
diff --git a/SOURCES/0076-extensions-string-Do-not-print-default-to-value.patch b/SOURCES/0076-extensions-string-Do-not-print-default-to-value.patch
new file mode 100644
index 0000000..c2ce8fd
--- /dev/null
+++ b/SOURCES/0076-extensions-string-Do-not-print-default-to-value.patch
@@ -0,0 +1,39 @@
+From 30c3d8d215c63b7d9244f853c94958a6194153b7 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 8 Jun 2022 13:28:10 +0200
+Subject: [PATCH] extensions: string: Do not print default --to value
+
+Default value is UINT16_MAX, not 0. Fix the conditional printing.
+
+Fixes: c6fbf41cdd157 ("update string match to reflect new kernel implementation (Pablo Neira)")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 1bfb1d916e467e2bcbc44ce1a50a2be5c12b7ef8)
+---
+ extensions/libxt_string.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/extensions/libxt_string.c b/extensions/libxt_string.c
+index 7c6366cbbf1b3..f6496f6403498 100644
+--- a/extensions/libxt_string.c
++++ b/extensions/libxt_string.c
+@@ -269,7 +269,7 @@ string_print(const void *ip, const struct xt_entry_match *match, int numeric)
+ 	printf(" ALGO name %s", info->algo);
+ 	if (info->from_offset != 0)
+ 		printf(" FROM %u", info->from_offset);
+-	if (info->to_offset != 0)
++	if (info->to_offset != UINT16_MAX)
+ 		printf(" TO %u", info->to_offset);
+ 	if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
+ 		printf(" ICASE");
+@@ -293,7 +293,7 @@ static void string_save(const void *ip, const struct xt_entry_match *match)
+ 	printf(" --algo %s", info->algo);
+ 	if (info->from_offset != 0)
+ 		printf(" --from %u", info->from_offset);
+-	if (info->to_offset != 0)
++	if (info->to_offset != UINT16_MAX)
+ 		printf(" --to %u", info->to_offset);
+ 	if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
+ 		printf(" --icase");
+-- 
+2.40.0
+
diff --git a/SOURCES/0077-xtables-monitor-add-missing-spaces-in-printed-str.patch b/SOURCES/0077-xtables-monitor-add-missing-spaces-in-printed-str.patch
new file mode 100644
index 0000000..bf05e59
--- /dev/null
+++ b/SOURCES/0077-xtables-monitor-add-missing-spaces-in-printed-str.patch
@@ -0,0 +1,45 @@
+From 40096cbbdd59f0bd431395f69bd30ade35ec1427 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Anton=20Luka=20=C5=A0ijanec?= <anton@sijanec.eu>
+Date: Wed, 22 Jun 2022 21:56:47 +0200
+Subject: [PATCH] xtables-monitor: add missing spaces in printed str
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+when printing the ID and OPTs in iptables/xtables-monitor.c, a space is
+missing after the string, thereby concatenating the number with the next
+item in the printed PACKET line.
+
+Fixes: d26c538b9a549 ("xtables: add xtables-monitor")
+Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 6c12201b5ff08d9e1524477ff63bb8810198d638)
+---
+ iptables/xtables-monitor.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index 4b9809805fb5b..89c739d5aacd1 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -340,7 +340,7 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
+ 			inet_ntop(AF_INET, &iph->daddr, addrbuf, sizeof(addrbuf));
+ 			printf("DST=%s ", addrbuf);
+ 
+-			printf("LEN=%d TOS=0x%x TTL=%d ID=%d", ntohs(iph->tot_len), iph->tos, iph->ttl, ntohs(iph->id));
++			printf("LEN=%d TOS=0x%x TTL=%d ID=%d ", ntohs(iph->tot_len), iph->tos, iph->ttl, ntohs(iph->id));
+ 			if (iph->frag_off & htons(0x8000))
+ 				printf("CE ");
+ 			if (iph->frag_off & htons(IP_DF))
+@@ -363,7 +363,7 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
+ 				printf("OPT (");
+ 				for (i = 0; i < optsize; i++)
+ 					printf("%02X", op[i]);
+-				printf(")");
++				printf(") ");
+ 			}
+ 			break;
+ 		}
+-- 
+2.40.0
+
diff --git a/SOURCES/0076-libxtables-Fix-unsupported-extension-warning-corner-.patch b/SOURCES/0078-libxtables-Fix-unsupported-extension-warning-corner-.patch
similarity index 84%
rename from SOURCES/0076-libxtables-Fix-unsupported-extension-warning-corner-.patch
rename to SOURCES/0078-libxtables-Fix-unsupported-extension-warning-corner-.patch
index a70af46..de434d5 100644
--- a/SOURCES/0076-libxtables-Fix-unsupported-extension-warning-corner-.patch
+++ b/SOURCES/0078-libxtables-Fix-unsupported-extension-warning-corner-.patch
@@ -1,4 +1,4 @@
-From f70e667bbc14c1dbf96b8732704aea294e4dcaa7 Mon Sep 17 00:00:00 2001
+From a9527fc387066ed774bdce38598d21eb8e52d899 Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Thu, 30 Jun 2022 18:04:39 +0200
 Subject: [PATCH] libxtables: Fix unsupported extension warning corner case
@@ -27,10 +27,10 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
  1 file changed, 14 insertions(+)
 
 diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index a5c8d7e2c17ef..89547fb3ab947 100644
+index 803551053c15f..598e43988e1a3 100644
 --- a/libxtables/xtables.c
 +++ b/libxtables/xtables.c
-@@ -702,6 +702,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
+@@ -744,6 +744,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
  	struct xtables_match *ptr;
  	const char *icmp6 = "icmp6";
  	bool found = false;
@@ -38,7 +38,7 @@ index a5c8d7e2c17ef..89547fb3ab947 100644
  
  	if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)
  		xtables_error(PARAMETER_PROBLEM,
-@@ -720,6 +721,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
+@@ -762,6 +763,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
  		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
  			ptr = *dptr;
  			*dptr = (*dptr)->next;
@@ -46,7 +46,7 @@ index a5c8d7e2c17ef..89547fb3ab947 100644
  			if (!found &&
  			    xtables_fully_register_pending_match(ptr, prev)) {
  				found = true;
-@@ -733,6 +735,11 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
+@@ -775,6 +777,11 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
  		dptr = &((*dptr)->next);
  	}
  
@@ -58,7 +58,7 @@ index a5c8d7e2c17ef..89547fb3ab947 100644
  	for (ptr = xtables_matches; ptr; ptr = ptr->next) {
  		if (extension_cmp(name, ptr->name, ptr->family)) {
  			struct xtables_match *clone;
-@@ -825,6 +832,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -867,6 +874,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  	struct xtables_target **dptr;
  	struct xtables_target *ptr;
  	bool found = false;
@@ -66,7 +66,7 @@ index a5c8d7e2c17ef..89547fb3ab947 100644
  
  	/* Standard target? */
  	if (strcmp(name, "") == 0
-@@ -843,6 +851,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -885,6 +893,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
  			ptr = *dptr;
  			*dptr = (*dptr)->next;
@@ -74,7 +74,7 @@ index a5c8d7e2c17ef..89547fb3ab947 100644
  			if (!found &&
  			    xtables_fully_register_pending_target(ptr, prev)) {
  				found = true;
-@@ -856,6 +865,11 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
+@@ -898,6 +907,11 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
  		dptr = &((*dptr)->next);
  	}
  
@@ -87,5 +87,5 @@ index a5c8d7e2c17ef..89547fb3ab947 100644
  		if (extension_cmp(name, ptr->name, ptr->family)) {
  			struct xtables_target *clone;
 -- 
-2.34.1
+2.40.0
 
diff --git a/SOURCES/0079-extensions-libxt_conntrack-remove-always-false-condi.patch b/SOURCES/0079-extensions-libxt_conntrack-remove-always-false-condi.patch
new file mode 100644
index 0000000..8e7ffba
--- /dev/null
+++ b/SOURCES/0079-extensions-libxt_conntrack-remove-always-false-condi.patch
@@ -0,0 +1,61 @@
+From f41e10de4d82377b01e0db057bde3e68159f7531 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Sat, 23 Jul 2022 20:25:49 +0200
+Subject: [PATCH] extensions: libxt_conntrack: remove always-false conditionals
+
+libxt_conntrack.c:1292: warning: the comparison will always evaluate as
+false for the address of origsrc_addr will never be NULL [-Waddress]
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit e88085ac41b4c962e1d85dcc8dc6fa0d1f80dc12)
+---
+ extensions/libxt_conntrack.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
+index 91f9e4aa994f8..6ab5c99133d3c 100644
+--- a/extensions/libxt_conntrack.c
++++ b/extensions/libxt_conntrack.c
+@@ -1297,9 +1297,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ 	}
+ 
+ 	if (sinfo->match_flags & XT_CONNTRACK_ORIGSRC) {
+-		if (&sinfo->origsrc_addr == 0L)
+-			return 0;
+-
+ 		xt_xlate_add(xl, "%sct original saddr %s", space,
+ 			     sinfo->invert_flags & XT_CONNTRACK_ORIGSRC ?
+ 			     "!= " : "");
+@@ -1309,9 +1306,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ 	}
+ 
+ 	if (sinfo->match_flags & XT_CONNTRACK_ORIGDST) {
+-		if (&sinfo->origdst_addr == 0L)
+-			return 0;
+-
+ 		xt_xlate_add(xl, "%sct original daddr %s", space,
+ 			     sinfo->invert_flags & XT_CONNTRACK_ORIGDST ?
+ 			     "!= " : "");
+@@ -1321,9 +1315,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ 	}
+ 
+ 	if (sinfo->match_flags & XT_CONNTRACK_REPLSRC) {
+-		if (&sinfo->replsrc_addr == 0L)
+-			return 0;
+-
+ 		xt_xlate_add(xl, "%sct reply saddr %s", space,
+ 			     sinfo->invert_flags & XT_CONNTRACK_REPLSRC ?
+ 			     "!= " : "");
+@@ -1333,9 +1324,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ 	}
+ 
+ 	if (sinfo->match_flags & XT_CONNTRACK_REPLDST) {
+-		if (&sinfo->repldst_addr == 0L)
+-			return 0;
+-
+ 		xt_xlate_add(xl, "%sct reply daddr %s", space,
+ 			     sinfo->invert_flags & XT_CONNTRACK_REPLDST ?
+ 			     "!= " : "");
+-- 
+2.40.0
+
diff --git a/SOURCES/0080-nft-un-break-among-match-with-concatenation.patch b/SOURCES/0080-nft-un-break-among-match-with-concatenation.patch
new file mode 100644
index 0000000..40c3d66
--- /dev/null
+++ b/SOURCES/0080-nft-un-break-among-match-with-concatenation.patch
@@ -0,0 +1,958 @@
+From 2fd494ffd99924931206c93d5c6d2806df1718ef Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Thu, 22 Sep 2022 13:33:50 +0200
+Subject: [PATCH] nft: un-break among match with concatenation
+
+The kernel commit 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags")
+breaks ebtables-nft 'among' emulation, it sets NFTA_SET_ELEM_KEY_END but
+doesn't set the CONCAT flag.
+
+Update uapi header and also set CONCAT.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+(cherry picked from commit 32efb4ffc33ae874b3f26f3380e2184ad6ceb26f)
+---
+ include/linux/netfilter/nf_tables.h | 483 +++++++++++++++++++++++++++-
+ iptables/nft.c                      |   2 +-
+ 2 files changed, 476 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
+index 66dceee0ae307..e94d1fa554cb2 100644
+--- a/include/linux/netfilter/nf_tables.h
++++ b/include/linux/netfilter/nf_tables.h
+@@ -8,6 +8,7 @@
+ #define NFT_SET_MAXNAMELEN	NFT_NAME_MAXLEN
+ #define NFT_OBJ_MAXNAMELEN	NFT_NAME_MAXLEN
+ #define NFT_USERDATA_MAXLEN	256
++#define NFT_OSF_MAXGENRELEN	16
+ 
+ /**
+  * enum nft_registers - nf_tables registers
+@@ -47,6 +48,7 @@ enum nft_registers {
+ 
+ #define NFT_REG_SIZE	16
+ #define NFT_REG32_SIZE	4
++#define NFT_REG32_COUNT	(NFT_REG32_15 - NFT_REG32_00 + 1)
+ 
+ /**
+  * enum nft_verdicts - nf_tables internal verdicts
+@@ -131,7 +133,7 @@ enum nf_tables_msg_types {
+  * @NFTA_LIST_ELEM: list element (NLA_NESTED)
+  */
+ enum nft_list_attributes {
+-	NFTA_LIST_UNPEC,
++	NFTA_LIST_UNSPEC,
+ 	NFTA_LIST_ELEM,
+ 	__NFTA_LIST_MAX
+ };
+@@ -143,12 +145,14 @@ enum nft_list_attributes {
+  * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
+  * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
+  * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
++ * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
+  */
+ enum nft_hook_attributes {
+ 	NFTA_HOOK_UNSPEC,
+ 	NFTA_HOOK_HOOKNUM,
+ 	NFTA_HOOK_PRIORITY,
+ 	NFTA_HOOK_DEV,
++	NFTA_HOOK_DEVS,
+ 	__NFTA_HOOK_MAX
+ };
+ #define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)
+@@ -160,7 +164,10 @@ enum nft_hook_attributes {
+  */
+ enum nft_table_flags {
+ 	NFT_TABLE_F_DORMANT	= 0x1,
++	NFT_TABLE_F_OWNER	= 0x2,
+ };
++#define NFT_TABLE_F_MASK	(NFT_TABLE_F_DORMANT | \
++				 NFT_TABLE_F_OWNER)
+ 
+ /**
+  * enum nft_table_attributes - nf_tables table netlink attributes
+@@ -168,6 +175,8 @@ enum nft_table_flags {
+  * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
+  * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
+  * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
++ * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
++ * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
+  */
+ enum nft_table_attributes {
+ 	NFTA_TABLE_UNSPEC,
+@@ -176,10 +185,21 @@ enum nft_table_attributes {
+ 	NFTA_TABLE_USE,
+ 	NFTA_TABLE_HANDLE,
+ 	NFTA_TABLE_PAD,
++	NFTA_TABLE_USERDATA,
++	NFTA_TABLE_OWNER,
+ 	__NFTA_TABLE_MAX
+ };
+ #define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
+ 
++enum nft_chain_flags {
++	NFT_CHAIN_BASE		= (1 << 0),
++	NFT_CHAIN_HW_OFFLOAD	= (1 << 1),
++	NFT_CHAIN_BINDING	= (1 << 2),
++};
++#define NFT_CHAIN_FLAGS		(NFT_CHAIN_BASE		| \
++				 NFT_CHAIN_HW_OFFLOAD	| \
++				 NFT_CHAIN_BINDING)
++
+ /**
+  * enum nft_chain_attributes - nf_tables chain netlink attributes
+  *
+@@ -191,6 +211,9 @@ enum nft_table_attributes {
+  * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
+  * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
+  * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
++ * @NFTA_CHAIN_FLAGS: chain flags
++ * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
++ * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
+  */
+ enum nft_chain_attributes {
+ 	NFTA_CHAIN_UNSPEC,
+@@ -203,6 +226,9 @@ enum nft_chain_attributes {
+ 	NFTA_CHAIN_TYPE,
+ 	NFTA_CHAIN_COUNTERS,
+ 	NFTA_CHAIN_PAD,
++	NFTA_CHAIN_FLAGS,
++	NFTA_CHAIN_ID,
++	NFTA_CHAIN_USERDATA,
+ 	__NFTA_CHAIN_MAX
+ };
+ #define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)
+@@ -218,6 +244,7 @@ enum nft_chain_attributes {
+  * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
+  * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
+  * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
++ * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
+  */
+ enum nft_rule_attributes {
+ 	NFTA_RULE_UNSPEC,
+@@ -230,6 +257,8 @@ enum nft_rule_attributes {
+ 	NFTA_RULE_USERDATA,
+ 	NFTA_RULE_PAD,
+ 	NFTA_RULE_ID,
++	NFTA_RULE_POSITION_ID,
++	NFTA_RULE_CHAIN_ID,
+ 	__NFTA_RULE_MAX
+ };
+ #define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)
+@@ -266,8 +295,10 @@ enum nft_rule_compat_attributes {
+  * @NFT_SET_INTERVAL: set contains intervals
+  * @NFT_SET_MAP: set is used as a dictionary
+  * @NFT_SET_TIMEOUT: set uses timeouts
+- * @NFT_SET_EVAL: set contains expressions for evaluation
++ * @NFT_SET_EVAL: set can be updated from the evaluation path
+  * @NFT_SET_OBJECT: set contains stateful objects
++ * @NFT_SET_CONCAT: set contains a concatenation
++ * @NFT_SET_EXPR: set contains expressions
+  */
+ enum nft_set_flags {
+ 	NFT_SET_ANONYMOUS		= 0x1,
+@@ -277,6 +308,8 @@ enum nft_set_flags {
+ 	NFT_SET_TIMEOUT			= 0x10,
+ 	NFT_SET_EVAL			= 0x20,
+ 	NFT_SET_OBJECT			= 0x40,
++	NFT_SET_CONCAT			= 0x80,
++	NFT_SET_EXPR			= 0x100,
+ };
+ 
+ /**
+@@ -294,14 +327,28 @@ enum nft_set_policies {
+  * enum nft_set_desc_attributes - set element description
+  *
+  * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
++ * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
+  */
+ enum nft_set_desc_attributes {
+ 	NFTA_SET_DESC_UNSPEC,
+ 	NFTA_SET_DESC_SIZE,
++	NFTA_SET_DESC_CONCAT,
+ 	__NFTA_SET_DESC_MAX
+ };
+ #define NFTA_SET_DESC_MAX	(__NFTA_SET_DESC_MAX - 1)
+ 
++/**
++ * enum nft_set_field_attributes - attributes of concatenated fields
++ *
++ * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
++ */
++enum nft_set_field_attributes {
++	NFTA_SET_FIELD_UNSPEC,
++	NFTA_SET_FIELD_LEN,
++	__NFTA_SET_FIELD_MAX
++};
++#define NFTA_SET_FIELD_MAX	(__NFTA_SET_FIELD_MAX - 1)
++
+ /**
+  * enum nft_set_attributes - nf_tables set netlink attributes
+  *
+@@ -320,6 +367,8 @@ enum nft_set_desc_attributes {
+  * @NFTA_SET_USERDATA: user data (NLA_BINARY)
+  * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
+  * @NFTA_SET_HANDLE: set handle (NLA_U64)
++ * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
++ * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
+  */
+ enum nft_set_attributes {
+ 	NFTA_SET_UNSPEC,
+@@ -339,6 +388,8 @@ enum nft_set_attributes {
+ 	NFTA_SET_PAD,
+ 	NFTA_SET_OBJ_TYPE,
+ 	NFTA_SET_HANDLE,
++	NFTA_SET_EXPR,
++	NFTA_SET_EXPRESSIONS,
+ 	__NFTA_SET_MAX
+ };
+ #define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
+@@ -347,9 +398,11 @@ enum nft_set_attributes {
+  * enum nft_set_elem_flags - nf_tables set element flags
+  *
+  * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
++ * @NFT_SET_ELEM_CATCHALL: special catch-all element
+  */
+ enum nft_set_elem_flags {
+ 	NFT_SET_ELEM_INTERVAL_END	= 0x1,
++	NFT_SET_ELEM_CATCHALL		= 0x2,
+ };
+ 
+ /**
+@@ -363,6 +416,8 @@ enum nft_set_elem_flags {
+  * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
+  * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
+  * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
++ * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
++ * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
+  */
+ enum nft_set_elem_attributes {
+ 	NFTA_SET_ELEM_UNSPEC,
+@@ -375,6 +430,8 @@ enum nft_set_elem_attributes {
+ 	NFTA_SET_ELEM_EXPR,
+ 	NFTA_SET_ELEM_PAD,
+ 	NFTA_SET_ELEM_OBJREF,
++	NFTA_SET_ELEM_KEY_END,
++	NFTA_SET_ELEM_EXPRESSIONS,
+ 	__NFTA_SET_ELEM_MAX
+ };
+ #define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)
+@@ -440,11 +497,13 @@ enum nft_data_attributes {
+  *
+  * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
+  * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
++ * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
+  */
+ enum nft_verdict_attributes {
+ 	NFTA_VERDICT_UNSPEC,
+ 	NFTA_VERDICT_CODE,
+ 	NFTA_VERDICT_CHAIN,
++	NFTA_VERDICT_CHAIN_ID,
+ 	__NFTA_VERDICT_MAX
+ };
+ #define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)
+@@ -477,6 +536,20 @@ enum nft_immediate_attributes {
+ };
+ #define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)
+ 
++/**
++ * enum nft_bitwise_ops - nf_tables bitwise operations
++ *
++ * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
++ *                    XOR boolean operations
++ * @NFT_BITWISE_LSHIFT: left-shift operation
++ * @NFT_BITWISE_RSHIFT: right-shift operation
++ */
++enum nft_bitwise_ops {
++	NFT_BITWISE_BOOL,
++	NFT_BITWISE_LSHIFT,
++	NFT_BITWISE_RSHIFT,
++};
++
+ /**
+  * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
+  *
+@@ -485,16 +558,20 @@ enum nft_immediate_attributes {
+  * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
+  * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
+  * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
++ * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
++ * @NFTA_BITWISE_DATA: argument for non-boolean operations
++ *                     (NLA_NESTED: nft_data_attributes)
+  *
+- * The bitwise expression performs the following operation:
++ * The bitwise expression supports boolean and shift operations.  It implements
++ * the boolean operations by performing the following operation:
+  *
+  * dreg = (sreg & mask) ^ xor
+  *
+- * which allow to express all bitwise operations:
++ * with these mask and xor values:
+  *
+  * 		mask	xor
+  * NOT:		1	1
+- * OR:		0	x
++ * OR:		~x	x
+  * XOR:		1	x
+  * AND:		x	0
+  */
+@@ -505,6 +582,8 @@ enum nft_bitwise_attributes {
+ 	NFTA_BITWISE_LEN,
+ 	NFTA_BITWISE_MASK,
+ 	NFTA_BITWISE_XOR,
++	NFTA_BITWISE_OP,
++	NFTA_BITWISE_DATA,
+ 	__NFTA_BITWISE_MAX
+ };
+ #define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
+@@ -631,10 +710,12 @@ enum nft_lookup_attributes {
+ enum nft_dynset_ops {
+ 	NFT_DYNSET_OP_ADD,
+ 	NFT_DYNSET_OP_UPDATE,
++	NFT_DYNSET_OP_DELETE,
+ };
+ 
+ enum nft_dynset_flags {
+ 	NFT_DYNSET_F_INV	= (1 << 0),
++	NFT_DYNSET_F_EXPR	= (1 << 1),
+ };
+ 
+ /**
+@@ -648,6 +729,7 @@ enum nft_dynset_flags {
+  * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
+  * @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
+  * @NFTA_DYNSET_FLAGS: flags (NLA_U32)
++ * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
+  */
+ enum nft_dynset_attributes {
+ 	NFTA_DYNSET_UNSPEC,
+@@ -660,6 +742,7 @@ enum nft_dynset_attributes {
+ 	NFTA_DYNSET_EXPR,
+ 	NFTA_DYNSET_PAD,
+ 	NFTA_DYNSET_FLAGS,
++	NFTA_DYNSET_EXPRESSIONS,
+ 	__NFTA_DYNSET_MAX,
+ };
+ #define NFTA_DYNSET_MAX		(__NFTA_DYNSET_MAX - 1)
+@@ -682,10 +765,12 @@ enum nft_payload_bases {
+  *
+  * @NFT_PAYLOAD_CSUM_NONE: no checksumming
+  * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
++ * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
+  */
+ enum nft_payload_csum_types {
+ 	NFT_PAYLOAD_CSUM_NONE,
+ 	NFT_PAYLOAD_CSUM_INET,
++	NFT_PAYLOAD_CSUM_SCTP,
+ };
+ 
+ enum nft_payload_csum_flags {
+@@ -727,10 +812,14 @@ enum nft_exthdr_flags {
+  *
+  * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
+  * @NFT_EXTHDR_OP_TCP: match against tcp options
++ * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
++ * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
+  */
+ enum nft_exthdr_op {
+ 	NFT_EXTHDR_OP_IPV6,
+ 	NFT_EXTHDR_OP_TCPOPT,
++	NFT_EXTHDR_OP_IPV4,
++	NFT_EXTHDR_OP_SCTP,
+ 	__NFT_EXTHDR_OP_MAX
+ };
+ #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
+@@ -788,6 +877,15 @@ enum nft_exthdr_attributes {
+  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
+  * @NFT_META_PRANDOM: a 32bit pseudo-random number
+  * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
++ * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
++ * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
++ * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
++ * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
++ * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
++ * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
++ * @NFT_META_TIME_HOUR: hour of day (in seconds)
++ * @NFT_META_SDIF: slave device interface index
++ * @NFT_META_SDIFNAME: slave device interface name
+  */
+ enum nft_meta_keys {
+ 	NFT_META_LEN,
+@@ -816,6 +914,15 @@ enum nft_meta_keys {
+ 	NFT_META_CGROUP,
+ 	NFT_META_PRANDOM,
+ 	NFT_META_SECPATH,
++	NFT_META_IIFKIND,
++	NFT_META_OIFKIND,
++	NFT_META_BRI_IIFPVID,
++	NFT_META_BRI_IIFVPROTO,
++	NFT_META_TIME_NS,
++	NFT_META_TIME_DAY,
++	NFT_META_TIME_HOUR,
++	NFT_META_SDIF,
++	NFT_META_SDIFNAME,
+ };
+ 
+ /**
+@@ -825,13 +932,17 @@ enum nft_meta_keys {
+  * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
+  * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
+  * @NFT_RT_TCPMSS: fetch current path tcp mss
++ * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
+  */
+ enum nft_rt_keys {
+ 	NFT_RT_CLASSID,
+ 	NFT_RT_NEXTHOP4,
+ 	NFT_RT_NEXTHOP6,
+ 	NFT_RT_TCPMSS,
++	NFT_RT_XFRM,
++	__NFT_RT_MAX
+ };
++#define NFT_RT_MAX		(__NFT_RT_MAX - 1)
+ 
+ /**
+  * enum nft_hash_types - nf_tables hash expression types
+@@ -854,6 +965,8 @@ enum nft_hash_types {
+  * @NFTA_HASH_SEED: seed value (NLA_U32)
+  * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
+  * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
++ * @NFTA_HASH_SET_NAME: name of the map to lookup (NLA_STRING)
++ * @NFTA_HASH_SET_ID: id of the map (NLA_U32)
+  */
+ enum nft_hash_attributes {
+ 	NFTA_HASH_UNSPEC,
+@@ -864,6 +977,8 @@ enum nft_hash_attributes {
+ 	NFTA_HASH_SEED,
+ 	NFTA_HASH_OFFSET,
+ 	NFTA_HASH_TYPE,
++	NFTA_HASH_SET_NAME,	/* deprecated */
++	NFTA_HASH_SET_ID,	/* deprecated */
+ 	__NFTA_HASH_MAX,
+ };
+ #define NFTA_HASH_MAX	(__NFTA_HASH_MAX - 1)
+@@ -898,6 +1013,39 @@ enum nft_rt_attributes {
+ };
+ #define NFTA_RT_MAX		(__NFTA_RT_MAX - 1)
+ 
++/**
++ * enum nft_socket_attributes - nf_tables socket expression netlink attributes
++ *
++ * @NFTA_SOCKET_KEY: socket key to match
++ * @NFTA_SOCKET_DREG: destination register
++ * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
++ */
++enum nft_socket_attributes {
++	NFTA_SOCKET_UNSPEC,
++	NFTA_SOCKET_KEY,
++	NFTA_SOCKET_DREG,
++	NFTA_SOCKET_LEVEL,
++	__NFTA_SOCKET_MAX
++};
++#define NFTA_SOCKET_MAX		(__NFTA_SOCKET_MAX - 1)
++
++/*
++ * enum nft_socket_keys - nf_tables socket expression keys
++ *
++ * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
++ * @NFT_SOCKET_MARK: Value of the socket mark
++ * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
++ * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
++ */
++enum nft_socket_keys {
++	NFT_SOCKET_TRANSPARENT,
++	NFT_SOCKET_MARK,
++	NFT_SOCKET_WILDCARD,
++	NFT_SOCKET_CGROUPV2,
++	__NFT_SOCKET_MAX
++};
++#define NFT_SOCKET_MAX	(__NFT_SOCKET_MAX - 1)
++
+ /**
+  * enum nft_ct_keys - nf_tables ct expression keys
+  *
+@@ -909,8 +1057,8 @@ enum nft_rt_attributes {
+  * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
+  * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
+  * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
+- * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
+- * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
++ * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address, deprecated)
++ * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address, deprecated)
+  * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
+  * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
+  * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
+@@ -920,6 +1068,11 @@ enum nft_rt_attributes {
+  * @NFT_CT_AVGPKT: conntrack average bytes per packet
+  * @NFT_CT_ZONE: conntrack zone
+  * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
++ * @NFT_CT_SRC_IP: conntrack layer 3 protocol source (IPv4 address)
++ * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address)
++ * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)
++ * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)
++ * @NFT_CT_ID: conntrack id
+  */
+ enum nft_ct_keys {
+ 	NFT_CT_STATE,
+@@ -941,7 +1094,14 @@ enum nft_ct_keys {
+ 	NFT_CT_AVGPKT,
+ 	NFT_CT_ZONE,
+ 	NFT_CT_EVENTMASK,
++	NFT_CT_SRC_IP,
++	NFT_CT_DST_IP,
++	NFT_CT_SRC_IP6,
++	NFT_CT_DST_IP6,
++	NFT_CT_ID,
++	__NFT_CT_MAX
+ };
++#define NFT_CT_MAX		(__NFT_CT_MAX - 1)
+ 
+ /**
+  * enum nft_ct_attributes - nf_tables ct expression netlink attributes
+@@ -1002,6 +1162,24 @@ enum nft_limit_attributes {
+ };
+ #define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)
+ 
++enum nft_connlimit_flags {
++	NFT_CONNLIMIT_F_INV	= (1 << 0),
++};
++
++/**
++ * enum nft_connlimit_attributes - nf_tables connlimit expression netlink attributes
++ *
++ * @NFTA_CONNLIMIT_COUNT: number of connections (NLA_U32)
++ * @NFTA_CONNLIMIT_FLAGS: flags (NLA_U32: enum nft_connlimit_flags)
++ */
++enum nft_connlimit_attributes {
++	NFTA_CONNLIMIT_UNSPEC,
++	NFTA_CONNLIMIT_COUNT,
++	NFTA_CONNLIMIT_FLAGS,
++	__NFTA_CONNLIMIT_MAX
++};
++#define NFTA_CONNLIMIT_MAX	(__NFTA_CONNLIMIT_MAX - 1)
++
+ /**
+  * enum nft_counter_attributes - nf_tables counter expression netlink attributes
+  *
+@@ -1017,6 +1195,21 @@ enum nft_counter_attributes {
+ };
+ #define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)
+ 
++/**
++ * enum nft_last_attributes - nf_tables last expression netlink attributes
++ *
++ * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
++ * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
++ */
++enum nft_last_attributes {
++	NFTA_LAST_UNSPEC,
++	NFTA_LAST_SET,
++	NFTA_LAST_MSECS,
++	NFTA_LAST_PAD,
++	__NFTA_LAST_MAX
++};
++#define NFTA_LAST_MAX	(__NFTA_LAST_MAX - 1)
++
+ /**
+  * enum nft_log_attributes - nf_tables log expression netlink attributes
+  *
+@@ -1039,6 +1232,33 @@ enum nft_log_attributes {
+ };
+ #define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)
+ 
++/**
++ * enum nft_log_level - nf_tables log levels
++ *
++ * @NFT_LOGLEVEL_EMERG: system is unusable
++ * @NFT_LOGLEVEL_ALERT: action must be taken immediately
++ * @NFT_LOGLEVEL_CRIT: critical conditions
++ * @NFT_LOGLEVEL_ERR: error conditions
++ * @NFT_LOGLEVEL_WARNING: warning conditions
++ * @NFT_LOGLEVEL_NOTICE: normal but significant condition
++ * @NFT_LOGLEVEL_INFO: informational
++ * @NFT_LOGLEVEL_DEBUG: debug-level messages
++ * @NFT_LOGLEVEL_AUDIT: enabling audit logging
++ */
++enum nft_log_level {
++	NFT_LOGLEVEL_EMERG,
++	NFT_LOGLEVEL_ALERT,
++	NFT_LOGLEVEL_CRIT,
++	NFT_LOGLEVEL_ERR,
++	NFT_LOGLEVEL_WARNING,
++	NFT_LOGLEVEL_NOTICE,
++	NFT_LOGLEVEL_INFO,
++	NFT_LOGLEVEL_DEBUG,
++	NFT_LOGLEVEL_AUDIT,
++	__NFT_LOGLEVEL_MAX
++};
++#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
++
+ /**
+  * enum nft_queue_attributes - nf_tables queue expression netlink attributes
+  *
+@@ -1083,6 +1303,21 @@ enum nft_quota_attributes {
+ };
+ #define NFTA_QUOTA_MAX		(__NFTA_QUOTA_MAX - 1)
+ 
++/**
++ * enum nft_secmark_attributes - nf_tables secmark object netlink attributes
++ *
++ * @NFTA_SECMARK_CTX: security context (NLA_STRING)
++ */
++enum nft_secmark_attributes {
++	NFTA_SECMARK_UNSPEC,
++	NFTA_SECMARK_CTX,
++	__NFTA_SECMARK_MAX,
++};
++#define NFTA_SECMARK_MAX	(__NFTA_SECMARK_MAX - 1)
++
++/* Max security context length */
++#define NFT_SECMARK_CTX_MAXLEN		256
++
+ /**
+  * enum nft_reject_types - nf_tables reject expression reject types
+  *
+@@ -1164,6 +1399,22 @@ enum nft_nat_attributes {
+ };
+ #define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)
+ 
++/**
++ * enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
++ *
++ * NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
++ * NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
++ * NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
++ */
++enum nft_tproxy_attributes {
++	NFTA_TPROXY_UNSPEC,
++	NFTA_TPROXY_FAMILY,
++	NFTA_TPROXY_REG_ADDR,
++	NFTA_TPROXY_REG_PORT,
++	__NFTA_TPROXY_MAX
++};
++#define NFTA_TPROXY_MAX		(__NFTA_TPROXY_MAX - 1)
++
+ /**
+  * enum nft_masq_attributes - nf_tables masquerade expression attributes
+  *
+@@ -1214,10 +1465,14 @@ enum nft_dup_attributes {
+  * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
+  *
+  * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
++ * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register)
++ * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto)
+  */
+ enum nft_fwd_attributes {
+ 	NFTA_FWD_UNSPEC,
+ 	NFTA_FWD_SREG_DEV,
++	NFTA_FWD_SREG_ADDR,
++	NFTA_FWD_NFPROTO,
+ 	__NFTA_FWD_MAX
+ };
+ #define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)
+@@ -1302,12 +1557,38 @@ enum nft_ct_helper_attributes {
+ };
+ #define NFTA_CT_HELPER_MAX	(__NFTA_CT_HELPER_MAX - 1)
+ 
++enum nft_ct_timeout_timeout_attributes {
++	NFTA_CT_TIMEOUT_UNSPEC,
++	NFTA_CT_TIMEOUT_L3PROTO,
++	NFTA_CT_TIMEOUT_L4PROTO,
++	NFTA_CT_TIMEOUT_DATA,
++	__NFTA_CT_TIMEOUT_MAX,
++};
++#define NFTA_CT_TIMEOUT_MAX	(__NFTA_CT_TIMEOUT_MAX - 1)
++
++enum nft_ct_expectation_attributes {
++	NFTA_CT_EXPECT_UNSPEC,
++	NFTA_CT_EXPECT_L3PROTO,
++	NFTA_CT_EXPECT_L4PROTO,
++	NFTA_CT_EXPECT_DPORT,
++	NFTA_CT_EXPECT_TIMEOUT,
++	NFTA_CT_EXPECT_SIZE,
++	__NFTA_CT_EXPECT_MAX,
++};
++#define NFTA_CT_EXPECT_MAX	(__NFTA_CT_EXPECT_MAX - 1)
++
+ #define NFT_OBJECT_UNSPEC	0
+ #define NFT_OBJECT_COUNTER	1
+ #define NFT_OBJECT_QUOTA	2
+ #define NFT_OBJECT_CT_HELPER	3
+ #define NFT_OBJECT_LIMIT	4
+-#define __NFT_OBJECT_MAX	5
++#define NFT_OBJECT_CONNLIMIT	5
++#define NFT_OBJECT_TUNNEL	6
++#define NFT_OBJECT_CT_TIMEOUT	7
++#define NFT_OBJECT_SECMARK	8
++#define NFT_OBJECT_CT_EXPECT	9
++#define NFT_OBJECT_SYNPROXY	10
++#define __NFT_OBJECT_MAX	11
+ #define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
+ 
+ /**
+@@ -1319,6 +1600,7 @@ enum nft_ct_helper_attributes {
+  * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
+  * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
+  * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
++ * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
+  */
+ enum nft_object_attributes {
+ 	NFTA_OBJ_UNSPEC,
+@@ -1329,10 +1611,24 @@ enum nft_object_attributes {
+ 	NFTA_OBJ_USE,
+ 	NFTA_OBJ_HANDLE,
+ 	NFTA_OBJ_PAD,
++	NFTA_OBJ_USERDATA,
+ 	__NFTA_OBJ_MAX
+ };
+ #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
+ 
++/**
++ * enum nft_flowtable_flags - nf_tables flowtable flags
++ *
++ * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
++ * @NFT_FLOWTABLE_COUNTER: enable flow counters
++ */
++enum nft_flowtable_flags {
++	NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
++	NFT_FLOWTABLE_COUNTER		= 0x2,
++	NFT_FLOWTABLE_MASK		= (NFT_FLOWTABLE_HW_OFFLOAD |
++					   NFT_FLOWTABLE_COUNTER)
++};
++
+ /**
+  * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
+  *
+@@ -1341,6 +1637,7 @@ enum nft_object_attributes {
+  * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
+  * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
+  * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
++ * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
+  */
+ enum nft_flowtable_attributes {
+ 	NFTA_FLOWTABLE_UNSPEC,
+@@ -1350,6 +1647,7 @@ enum nft_flowtable_attributes {
+ 	NFTA_FLOWTABLE_USE,
+ 	NFTA_FLOWTABLE_HANDLE,
+ 	NFTA_FLOWTABLE_PAD,
++	NFTA_FLOWTABLE_FLAGS,
+ 	__NFTA_FLOWTABLE_MAX
+ };
+ #define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
+@@ -1370,6 +1668,42 @@ enum nft_flowtable_hook_attributes {
+ };
+ #define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
+ 
++/**
++ * enum nft_osf_attributes - nftables osf expression netlink attributes
++ *
++ * @NFTA_OSF_DREG: destination register (NLA_U32: nft_registers)
++ * @NFTA_OSF_TTL: Value of the TTL osf option (NLA_U8)
++ * @NFTA_OSF_FLAGS: flags (NLA_U32)
++ */
++enum nft_osf_attributes {
++	NFTA_OSF_UNSPEC,
++	NFTA_OSF_DREG,
++	NFTA_OSF_TTL,
++	NFTA_OSF_FLAGS,
++	__NFTA_OSF_MAX,
++};
++#define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1)
++
++enum nft_osf_flags {
++	NFT_OSF_F_VERSION = (1 << 0),
++};
++
++/**
++ * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
++ *
++ * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
++ * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
++ * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
++ */
++enum nft_synproxy_attributes {
++	NFTA_SYNPROXY_UNSPEC,
++	NFTA_SYNPROXY_MSS,
++	NFTA_SYNPROXY_WSCALE,
++	NFTA_SYNPROXY_FLAGS,
++	__NFTA_SYNPROXY_MAX,
++};
++#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
++
+ /**
+  * enum nft_device_attributes - nf_tables device netlink attributes
+  *
+@@ -1382,6 +1716,35 @@ enum nft_devices_attributes {
+ };
+ #define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)
+ 
++/*
++ * enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
++ *
++ * @NFTA_XFRM_DREG: destination register (NLA_U32)
++ * @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
++ * @NFTA_XFRM_DIR: direction (NLA_U8)
++ * @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
++ */
++enum nft_xfrm_attributes {
++	NFTA_XFRM_UNSPEC,
++	NFTA_XFRM_DREG,
++	NFTA_XFRM_KEY,
++	NFTA_XFRM_DIR,
++	NFTA_XFRM_SPNUM,
++	__NFTA_XFRM_MAX
++};
++#define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
++
++enum nft_xfrm_keys {
++	NFT_XFRM_KEY_UNSPEC,
++	NFT_XFRM_KEY_DADDR_IP4,
++	NFT_XFRM_KEY_DADDR_IP6,
++	NFT_XFRM_KEY_SADDR_IP4,
++	NFT_XFRM_KEY_SADDR_IP6,
++	NFT_XFRM_KEY_REQID,
++	NFT_XFRM_KEY_SPI,
++	__NFT_XFRM_KEY_MAX,
++};
++#define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
+ 
+ /**
+  * enum nft_trace_attributes - nf_tables trace netlink attributes
+@@ -1442,6 +1805,8 @@ enum nft_trace_types {
+  * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
+  * @NFTA_NG_TYPE: operation type (NLA_U32)
+  * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
++ * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
++ * @NFTA_NG_SET_ID: id of the map (NLA_U32)
+  */
+ enum nft_ng_attributes {
+ 	NFTA_NG_UNSPEC,
+@@ -1449,6 +1814,8 @@ enum nft_ng_attributes {
+ 	NFTA_NG_MODULUS,
+ 	NFTA_NG_TYPE,
+ 	NFTA_NG_OFFSET,
++	NFTA_NG_SET_NAME,	/* deprecated */
++	NFTA_NG_SET_ID,		/* deprecated */
+ 	__NFTA_NG_MAX
+ };
+ #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
+@@ -1460,4 +1827,104 @@ enum nft_ng_types {
+ };
+ #define NFT_NG_MAX	(__NFT_NG_MAX - 1)
+ 
++enum nft_tunnel_key_ip_attributes {
++	NFTA_TUNNEL_KEY_IP_UNSPEC,
++	NFTA_TUNNEL_KEY_IP_SRC,
++	NFTA_TUNNEL_KEY_IP_DST,
++	__NFTA_TUNNEL_KEY_IP_MAX
++};
++#define NFTA_TUNNEL_KEY_IP_MAX	(__NFTA_TUNNEL_KEY_IP_MAX - 1)
++
++enum nft_tunnel_ip6_attributes {
++	NFTA_TUNNEL_KEY_IP6_UNSPEC,
++	NFTA_TUNNEL_KEY_IP6_SRC,
++	NFTA_TUNNEL_KEY_IP6_DST,
++	NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
++	__NFTA_TUNNEL_KEY_IP6_MAX
++};
++#define NFTA_TUNNEL_KEY_IP6_MAX	(__NFTA_TUNNEL_KEY_IP6_MAX - 1)
++
++enum nft_tunnel_opts_attributes {
++	NFTA_TUNNEL_KEY_OPTS_UNSPEC,
++	NFTA_TUNNEL_KEY_OPTS_VXLAN,
++	NFTA_TUNNEL_KEY_OPTS_ERSPAN,
++	NFTA_TUNNEL_KEY_OPTS_GENEVE,
++	__NFTA_TUNNEL_KEY_OPTS_MAX
++};
++#define NFTA_TUNNEL_KEY_OPTS_MAX	(__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
++
++enum nft_tunnel_opts_vxlan_attributes {
++	NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
++	NFTA_TUNNEL_KEY_VXLAN_GBP,
++	__NFTA_TUNNEL_KEY_VXLAN_MAX
++};
++#define NFTA_TUNNEL_KEY_VXLAN_MAX	(__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
++
++enum nft_tunnel_opts_erspan_attributes {
++	NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
++	NFTA_TUNNEL_KEY_ERSPAN_VERSION,
++	NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
++	NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
++	NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
++	__NFTA_TUNNEL_KEY_ERSPAN_MAX
++};
++#define NFTA_TUNNEL_KEY_ERSPAN_MAX	(__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
++
++enum nft_tunnel_opts_geneve_attributes {
++	NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
++	NFTA_TUNNEL_KEY_GENEVE_CLASS,
++	NFTA_TUNNEL_KEY_GENEVE_TYPE,
++	NFTA_TUNNEL_KEY_GENEVE_DATA,
++	__NFTA_TUNNEL_KEY_GENEVE_MAX
++};
++#define NFTA_TUNNEL_KEY_GENEVE_MAX	(__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
++
++enum nft_tunnel_flags {
++	NFT_TUNNEL_F_ZERO_CSUM_TX	= (1 << 0),
++	NFT_TUNNEL_F_DONT_FRAGMENT	= (1 << 1),
++	NFT_TUNNEL_F_SEQ_NUMBER		= (1 << 2),
++};
++#define NFT_TUNNEL_F_MASK	(NFT_TUNNEL_F_ZERO_CSUM_TX | \
++				 NFT_TUNNEL_F_DONT_FRAGMENT | \
++				 NFT_TUNNEL_F_SEQ_NUMBER)
++
++enum nft_tunnel_key_attributes {
++	NFTA_TUNNEL_KEY_UNSPEC,
++	NFTA_TUNNEL_KEY_ID,
++	NFTA_TUNNEL_KEY_IP,
++	NFTA_TUNNEL_KEY_IP6,
++	NFTA_TUNNEL_KEY_FLAGS,
++	NFTA_TUNNEL_KEY_TOS,
++	NFTA_TUNNEL_KEY_TTL,
++	NFTA_TUNNEL_KEY_SPORT,
++	NFTA_TUNNEL_KEY_DPORT,
++	NFTA_TUNNEL_KEY_OPTS,
++	__NFTA_TUNNEL_KEY_MAX
++};
++#define NFTA_TUNNEL_KEY_MAX	(__NFTA_TUNNEL_KEY_MAX - 1)
++
++enum nft_tunnel_keys {
++	NFT_TUNNEL_PATH,
++	NFT_TUNNEL_ID,
++	__NFT_TUNNEL_MAX
++};
++#define NFT_TUNNEL_MAX	(__NFT_TUNNEL_MAX - 1)
++
++enum nft_tunnel_mode {
++	NFT_TUNNEL_MODE_NONE,
++	NFT_TUNNEL_MODE_RX,
++	NFT_TUNNEL_MODE_TX,
++	__NFT_TUNNEL_MODE_MAX
++};
++#define NFT_TUNNEL_MODE_MAX	(__NFT_TUNNEL_MODE_MAX - 1)
++
++enum nft_tunnel_attributes {
++	NFTA_TUNNEL_UNSPEC,
++	NFTA_TUNNEL_KEY,
++	NFTA_TUNNEL_DREG,
++	NFTA_TUNNEL_MODE,
++	__NFTA_TUNNEL_MAX
++};
++#define NFTA_TUNNEL_MAX	(__NFTA_TUNNEL_MAX - 1)
++
+ #endif /* _LINUX_NF_TABLES_H */
+diff --git a/iptables/nft.c b/iptables/nft.c
+index c130369f78348..0ec7679d25289 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1086,7 +1086,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 		type = type << CONCAT_TYPE_BITS | NFT_DATATYPE_IPADDR;
+ 		len += sizeof(struct in_addr) + NETLINK_ALIGN - 1;
+ 		len &= ~(NETLINK_ALIGN - 1);
+-		flags = NFT_SET_INTERVAL;
++		flags = NFT_SET_INTERVAL | NFT_SET_CONCAT;
+ 	}
+ 
+ 	s = add_anon_set(h, table, flags, type, len, cnt);
+-- 
+2.40.0
+
diff --git a/SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch b/SOURCES/0081-nft-shared-Introduce-__get_cmp_data.patch
similarity index 75%
rename from SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch
rename to SOURCES/0081-nft-shared-Introduce-__get_cmp_data.patch
index 06b125e..1cb11d2 100644
--- a/SOURCES/0077-nft-shared-Introduce-__get_cmp_data.patch
+++ b/SOURCES/0081-nft-shared-Introduce-__get_cmp_data.patch
@@ -1,4 +1,4 @@
-From c76e3088d700ce416a2ff109168ce124ec1cebf7 Mon Sep 17 00:00:00 2001
+From 116427bbf1365e2d284e7410a125205a983c0b1b Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 27 Sep 2022 23:15:37 +0200
 Subject: [PATCH] nft-shared: Introduce __get_cmp_data()
@@ -10,22 +10,20 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
 (cherry picked from commit 8dc22798bf813ce92aaac58a6fe8749fe3fc18dc)
 
 Conflicts:
-	iptables/nft-shared.c
 	iptables/nft-shared.h
-- Context changes due to missing commits
-  cf14b92bc1a3f ("nft-shared: Drop unused function print_proto()") and
-  aa92ec96078d0 ("nft: pass struct nft_xt_ctx to parse_meta()")
+-> Context change due to missing commit aa92ec96078d0
+   ("nft: pass struct nft_xt_ctx to parse_meta()").
 ---
  iptables/nft-shared.c | 17 ++++++++++-------
  iptables/nft-shared.h |  1 +
  2 files changed, 11 insertions(+), 7 deletions(-)
 
 diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index e3ba4ac34146f..af6d33ce6120b 100644
+index 2b934ffc17756..cb1c2d61f52c1 100644
 --- a/iptables/nft-shared.c
 +++ b/iptables/nft-shared.c
-@@ -388,17 +388,20 @@ void print_proto(uint16_t proto, int invert)
- 	printf("-p %u ", proto);
+@@ -373,17 +373,20 @@ static void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
+ 		ctx->h->ops->parse_match(match, ctx->cs);
  }
  
 -void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv)
@@ -53,17 +51,17 @@ index e3ba4ac34146f..af6d33ce6120b 100644
  
  static void nft_meta_set_to_target(struct nft_xt_ctx *ctx)
 diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 29f7056714235..e01381b83c47a 100644
+index 2c5f2cfc012d5..3531631bd8acd 100644
 --- a/iptables/nft-shared.h
 +++ b/iptables/nft-shared.h
-@@ -143,6 +143,7 @@ int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
+@@ -139,6 +139,7 @@ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
+ int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
  		unsigned char *iniface_mask, char *outiface,
  		unsigned char *outiface_mask, uint8_t *invflags);
- void print_proto(uint16_t proto, int invert);
 +void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
  void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
  void nft_rule_to_iptables_command_state(struct nft_handle *h,
  					const struct nftnl_rule *r,
 -- 
-2.38.0
+2.40.0
 
diff --git a/SOURCES/0078-ebtables-Support-p-Length.patch b/SOURCES/0082-ebtables-Support-p-Length.patch
similarity index 92%
rename from SOURCES/0078-ebtables-Support-p-Length.patch
rename to SOURCES/0082-ebtables-Support-p-Length.patch
index 7b23249..55b2a9a 100644
--- a/SOURCES/0078-ebtables-Support-p-Length.patch
+++ b/SOURCES/0082-ebtables-Support-p-Length.patch
@@ -1,4 +1,4 @@
-From a6504e3aec5cfa910f96c51319c93cd2761df9e4 Mon Sep 17 00:00:00 2001
+From 07007c27ceebffcb6e3223768fa876c907b0d55d Mon Sep 17 00:00:00 2001
 From: Phil Sutter <phil@nwl.cc>
 Date: Tue, 27 Sep 2022 23:19:34 +0200
 Subject: [PATCH] ebtables: Support '-p Length'
@@ -22,10 +22,11 @@ Signed-off-by: Phil Sutter <phil@nwl.cc>
 
 Conflicts:
 	iptables/nft-bridge.c
-- Adjusted to missing commit 7e38890c6b4fb
-  ("nft: prepare for dynamic register allocation")
-- Context change due to missing commit 0c0cd4340ed88
-  ("nft: Don't pass command state opaque to family ops callbacks")
+-> Adjusted to missing commit 7e38890c6b4fb
+   ("nft: prepare for dynamic register allocation").
+-> Context change due to missing commits 0c0cd4340ed88
+   ("nft: Don't pass command state opaque to family ops callbacks") and
+   b5881e7f22d42 ("nft: Change whitespace printing in save_rule callback").
 ---
  extensions/generic.txlate                     |  6 +++
  extensions/libebt_802_3.t                     |  6 ++-
@@ -63,7 +64,7 @@ index ddfb2f0a72baf..a138f35d2c756 100644
 +-p Length --802_3-sap ! 0x0a -j CONTINUE;=;OK
 +-p Length --802_3-type 0x000a -j RETURN;=;OK
 diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index 3fd03fb8de4ff..176304e9f2f23 100644
+index 9cc6f87b28fe0..fbed1616253a6 100644
 --- a/iptables/nft-bridge.c
 +++ b/iptables/nft-bridge.c
 @@ -129,6 +129,18 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
@@ -138,7 +139,7 @@ index 3fd03fb8de4ff..176304e9f2f23 100644
  		if (inv)
  			fw->invflags |= EBT_IPROTO;
  		fw->bitmask &= ~EBT_NOPROTO;
-@@ -611,7 +638,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
+@@ -620,7 +647,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
  		printf("! ");
  
  	if (bitmask & EBT_802_3) {
@@ -147,7 +148,7 @@ index 3fd03fb8de4ff..176304e9f2f23 100644
  		return;
  	}
  
-@@ -626,7 +653,7 @@ static void nft_bridge_save_rule(const void *data, unsigned int format)
+@@ -635,7 +662,7 @@ static void nft_bridge_save_rule(const void *data, unsigned int format)
  {
  	const struct iptables_command_state *cs = data;
  
@@ -156,7 +157,7 @@ index 3fd03fb8de4ff..176304e9f2f23 100644
  		print_protocol(cs->eb.ethproto, cs->eb.invflags & EBT_IPROTO,
  			       cs->eb.bitmask);
  	if (cs->eb.bitmask & EBT_ISOURCE)
-@@ -892,7 +919,10 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
+@@ -866,7 +893,10 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
  	xlate_ifname(xl, "meta obrname", cs->eb.logical_out,
  		     cs->eb.invflags & EBT_ILOGICALOUT);
  
@@ -168,7 +169,7 @@ index 3fd03fb8de4ff..176304e9f2f23 100644
  		const char *implicit = NULL;
  
  		switch (ntohs(cs->eb.ethproto)) {
-@@ -915,9 +945,6 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
+@@ -889,9 +919,6 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
  				     ntohs(cs->eb.ethproto));
  	}
  
@@ -223,5 +224,5 @@ index b84f63a7c3672..a4fc31548e323 100755
  -A foo --pkttype-type multicast --limit 100/sec --limit-burst 5 -j ACCEPT
  *nat
 -- 
-2.38.0
+2.40.0
 
diff --git a/SOURCES/0083-extensions-among-Remove-pointless-fall-through.patch b/SOURCES/0083-extensions-among-Remove-pointless-fall-through.patch
new file mode 100644
index 0000000..b591a9b
--- /dev/null
+++ b/SOURCES/0083-extensions-among-Remove-pointless-fall-through.patch
@@ -0,0 +1,36 @@
+From bf73dcb492c75cc03aeb945b749a49a529090ae3 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 29 Sep 2022 19:11:55 +0200
+Subject: [PATCH] extensions: among: Remove pointless fall through
+
+This seems to be a leftover from an earlier version of the switch().
+This fall through is never effective as the next case's code will never
+apply. So just break instead.
+
+Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit eafe731a50058ed59305ee4ab1ea2d63d6c4e86e)
+---
+ extensions/libebt_among.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
+index 7eb898f984bba..c607a775539d3 100644
+--- a/extensions/libebt_among.c
++++ b/extensions/libebt_among.c
+@@ -152,10 +152,9 @@ static int bramong_parse(int c, char **argv, int invert,
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "File should only contain one line");
+ 		optarg[flen-1] = '\0';
+-		/* fall through */
++		break;
+ 	case AMONG_DST:
+-		if (c == AMONG_DST)
+-			dst = true;
++		dst = true;
+ 		/* fall through */
+ 	case AMONG_SRC:
+ 		break;
+-- 
+2.40.0
+
diff --git a/SOURCES/0084-extensions-among-Fix-for-use-with-ebtables-restore.patch b/SOURCES/0084-extensions-among-Fix-for-use-with-ebtables-restore.patch
new file mode 100644
index 0000000..aa10447
--- /dev/null
+++ b/SOURCES/0084-extensions-among-Fix-for-use-with-ebtables-restore.patch
@@ -0,0 +1,57 @@
+From 6a7b38bdb0253cfac68893ff7704f1f9cbfe891a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 30 Sep 2022 17:51:55 +0200
+Subject: [PATCH] extensions: among: Fix for use with ebtables-restore
+
+When restoring multiple rules which use among match, new size may be
+smaller than the old one which caused invalid writes by the memcpy()
+call. Expect this and realloc the match only if it needs to grow. Also
+use realloc instead of freeing and allocating from scratch.
+
+Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit fca04aa7a53252464c289997e71de10189971da6)
+---
+ extensions/libebt_among.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
+index c607a775539d3..1eab201984408 100644
+--- a/extensions/libebt_among.c
++++ b/extensions/libebt_among.c
+@@ -119,7 +119,6 @@ static int bramong_parse(int c, char **argv, int invert,
+ 		 struct xt_entry_match **match)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)(*match)->data;
+-	struct xt_entry_match *new_match;
+ 	bool have_ip, dst = false;
+ 	size_t new_size, cnt;
+ 	struct stat stats;
+@@ -170,18 +169,17 @@ static int bramong_parse(int c, char **argv, int invert,
+ 	new_size *= sizeof(struct nft_among_pair);
+ 	new_size += XT_ALIGN(sizeof(struct xt_entry_match)) +
+ 			sizeof(struct nft_among_data);
+-	new_match = xtables_calloc(1, new_size);
+-	memcpy(new_match, *match, (*match)->u.match_size);
+-	new_match->u.match_size = new_size;
+ 
+-	data = (struct nft_among_data *)new_match->data;
++	if (new_size > (*match)->u.match_size) {
++		*match = xtables_realloc(*match, new_size);
++		(*match)->u.match_size = new_size;
++		data = (struct nft_among_data *)(*match)->data;
++	}
++
+ 	have_ip = nft_among_pairs_have_ip(optarg);
+ 	poff = nft_among_prepare_data(data, dst, cnt, invert, have_ip);
+ 	parse_nft_among_pairs(data->pairs + poff, optarg, cnt, have_ip);
+ 
+-	free(*match);
+-	*match = new_match;
+-
+ 	if (c == AMONG_DST_F || c == AMONG_SRC_F) {
+ 		munmap(argv, flen);
+ 		close(fd);
+-- 
+2.40.0
+
diff --git a/SOURCES/0085-extensions-libebt_stp-Eliminate-duplicate-space-in-o.patch b/SOURCES/0085-extensions-libebt_stp-Eliminate-duplicate-space-in-o.patch
new file mode 100644
index 0000000..6e15bd3
--- /dev/null
+++ b/SOURCES/0085-extensions-libebt_stp-Eliminate-duplicate-space-in-o.patch
@@ -0,0 +1,34 @@
+From 67ce94bf558361cf45a72957d0d563dc2742a0c2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 1 Oct 2022 00:15:35 +0200
+Subject: [PATCH] extensions: libebt_stp: Eliminate duplicate space in output
+
+No need for print_range() to print a trailing whitespace, caller does
+this already.
+
+Fixes: fd8d7d7e5d911 ("ebtables-nft: add stp match")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 262dff31a998ef8e2507bbfd9349d761769888da)
+---
+ extensions/libebt_stp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/extensions/libebt_stp.c b/extensions/libebt_stp.c
+index 06cf93b8d8449..9270bf822a711 100644
+--- a/extensions/libebt_stp.c
++++ b/extensions/libebt_stp.c
+@@ -145,9 +145,9 @@ static int parse_range(const char *portstring, void *lower, void *upper,
+ static void print_range(unsigned int l, unsigned int u)
+ {
+ 	if (l == u)
+-		printf("%u ", l);
++		printf("%u", l);
+ 	else
+-		printf("%u:%u ", l, u);
++		printf("%u:%u", l, u);
+ }
+ 
+ static int brstp_get_mac_and_mask(const char *from, unsigned char *to, unsigned char *mask)
+-- 
+2.40.0
+
diff --git a/SOURCES/0086-extensions-libip6t_dst-Fix-output-for-empty-options.patch b/SOURCES/0086-extensions-libip6t_dst-Fix-output-for-empty-options.patch
new file mode 100644
index 0000000..d4dfa81
--- /dev/null
+++ b/SOURCES/0086-extensions-libip6t_dst-Fix-output-for-empty-options.patch
@@ -0,0 +1,41 @@
+From bea48d4a3323ce41973674e2edd64b990f8a849e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 1 Oct 2022 00:17:50 +0200
+Subject: [PATCH] extensions: libip6t_dst: Fix output for empty options
+
+If no --dst-opts were given, print_options() would print just a
+whitespace.
+
+Fixes: 73866357e4a7a ("iptables: do not print trailing whitespaces")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 11e06cbb3a87739a3d958ba4c2f08fea7b100a68)
+---
+ extensions/libip6t_dst.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libip6t_dst.c b/extensions/libip6t_dst.c
+index fe7e3403468ce..ba8cd66b13182 100644
+--- a/extensions/libip6t_dst.c
++++ b/extensions/libip6t_dst.c
+@@ -127,15 +127,15 @@ static void
+ print_options(unsigned int optsnr, uint16_t *optsp)
+ {
+ 	unsigned int i;
++	char sep = ' ';
+ 
+-	printf(" ");
+ 	for(i = 0; i < optsnr; i++) {
+-		printf("%d", (optsp[i] & 0xFF00) >> 8);
++		printf("%c%d", sep, (optsp[i] & 0xFF00) >> 8);
+ 
+ 		if ((optsp[i] & 0x00FF) != 0x00FF)
+ 			printf(":%d", (optsp[i] & 0x00FF));
+ 
+-		printf("%c", (i != optsnr - 1) ? ',' : ' ');
++		sep = ',';
+ 	}
+ }
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0087-extensions-TCPOPTSTRIP-Do-not-print-empty-options.patch b/SOURCES/0087-extensions-TCPOPTSTRIP-Do-not-print-empty-options.patch
new file mode 100644
index 0000000..5a86109
--- /dev/null
+++ b/SOURCES/0087-extensions-TCPOPTSTRIP-Do-not-print-empty-options.patch
@@ -0,0 +1,55 @@
+From 6e857353e3ce7231fc852c6187df0c6dd81767ba Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 1 Oct 2022 00:36:50 +0200
+Subject: [PATCH] extensions: TCPOPTSTRIP: Do not print empty options
+
+No point in printing anything if none of the bits are set.
+
+Fixes: aef4c1e727563 ("libxt_TCPOPTSTRIP")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit dba32a76aacf84181a9bd3ba1e301e59ab49d370)
+---
+ extensions/libxt_TCPOPTSTRIP.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/extensions/libxt_TCPOPTSTRIP.c b/extensions/libxt_TCPOPTSTRIP.c
+index 6ea3489224602..ff873f98b3aaa 100644
+--- a/extensions/libxt_TCPOPTSTRIP.c
++++ b/extensions/libxt_TCPOPTSTRIP.c
+@@ -142,6 +142,13 @@ tcpoptstrip_print_list(const struct xt_tcpoptstrip_target_info *info,
+ 	}
+ }
+ 
++static bool tcpoptstrip_empty(const struct xt_tcpoptstrip_target_info *info)
++{
++	static const struct xt_tcpoptstrip_target_info empty = {};
++
++	return memcmp(info, &empty, sizeof(empty)) == 0;
++}
++
+ static void
+ tcpoptstrip_tg_print(const void *ip, const struct xt_entry_target *target,
+                      int numeric)
+@@ -149,6 +156,9 @@ tcpoptstrip_tg_print(const void *ip, const struct xt_entry_target *target,
+ 	const struct xt_tcpoptstrip_target_info *info =
+ 		(const void *)target->data;
+ 
++	if (tcpoptstrip_empty(info))
++		return;
++
+ 	printf(" TCPOPTSTRIP options ");
+ 	tcpoptstrip_print_list(info, numeric);
+ }
+@@ -159,6 +169,9 @@ tcpoptstrip_tg_save(const void *ip, const struct xt_entry_target *target)
+ 	const struct xt_tcpoptstrip_target_info *info =
+ 		(const void *)target->data;
+ 
++	if (tcpoptstrip_empty(info))
++		return;
++
+ 	printf(" --strip-options ");
+ 	tcpoptstrip_print_list(info, true);
+ }
+-- 
+2.40.0
+
diff --git a/SOURCES/0088-tests-IDLETIMER.t-Fix-syntax-support-for-restore-inp.patch b/SOURCES/0088-tests-IDLETIMER.t-Fix-syntax-support-for-restore-inp.patch
new file mode 100644
index 0000000..afd6e5d
--- /dev/null
+++ b/SOURCES/0088-tests-IDLETIMER.t-Fix-syntax-support-for-restore-inp.patch
@@ -0,0 +1,29 @@
+From f180adb86f7004c959cea29eee855a1bc489dcc9 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 30 Sep 2022 18:06:10 +0200
+Subject: [PATCH] tests: IDLETIMER.t: Fix syntax, support for restore input
+
+Expected output was wrong in the last OK test, probably defeating rule
+search check. Also use a different label, otherwise the kernel will
+reject the second idletimer with same label but different type if both
+rules are added at once.
+
+Fixes: 85b9ec8615428 ("extensions: IDLETIMER: Add alarm timer option")
+(cherry picked from commit de043bbf2b78cad83a639e27c75263aa478e8cc4)
+---
+ extensions/libxt_IDLETIMER.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libxt_IDLETIMER.t b/extensions/libxt_IDLETIMER.t
+index e8f306d2462c7..3345d5bef9e38 100644
+--- a/extensions/libxt_IDLETIMER.t
++++ b/extensions/libxt_IDLETIMER.t
+@@ -2,4 +2,4 @@
+ -j IDLETIMER --timeout;;FAIL
+ -j IDLETIMER --timeout 42;;FAIL
+ -j IDLETIMER --timeout 42 --label foo;=;OK
+--j IDLETIMER --timeout 42 --label foo --alarm;;OK
++-j IDLETIMER --timeout 42 --label bar --alarm;=;OK
+-- 
+2.40.0
+
diff --git a/SOURCES/0089-tests-libebt_stp.t-Drop-duplicate-whitespace.patch b/SOURCES/0089-tests-libebt_stp.t-Drop-duplicate-whitespace.patch
new file mode 100644
index 0000000..9b185e9
--- /dev/null
+++ b/SOURCES/0089-tests-libebt_stp.t-Drop-duplicate-whitespace.patch
@@ -0,0 +1,29 @@
+From 8b8249ce6128e0b9f909535e63629c10920af4ec Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 5 Oct 2022 20:29:36 +0200
+Subject: [PATCH] tests: libebt_stp.t: Drop duplicate whitespace
+
+Code was fixed but the testcase adjustment slipped through.
+
+Fixes: 262dff31a998e ("extensions: libebt_stp: Eliminate duplicate space in output")
+(cherry picked from commit dafb31980c4469fd28964b9703d3c77433cc7d21)
+---
+ extensions/libebt_stp.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libebt_stp.t b/extensions/libebt_stp.t
+index 0c6b77b91454b..17d6c1c0978e3 100644
+--- a/extensions/libebt_stp.t
++++ b/extensions/libebt_stp.t
+@@ -1,7 +1,7 @@
+ :INPUT,FORWARD,OUTPUT
+ --stp-type 1;=;OK
+ --stp-flags 0x1;--stp-flags topology-change -j CONTINUE;OK
+---stp-root-prio 1  -j ACCEPT;=;OK
++--stp-root-prio 1 -j ACCEPT;=;OK
+ --stp-root-addr 0d:ea:d0:0b:ee:f0;=;OK
+ --stp-root-cost 1;=;OK
+ --stp-sender-prio 1;=;OK
+-- 
+2.40.0
+
diff --git a/SOURCES/0090-tests-shell-Fix-expected-output-for-ip6tables-dst-ma.patch b/SOURCES/0090-tests-shell-Fix-expected-output-for-ip6tables-dst-ma.patch
new file mode 100644
index 0000000..6676f78
--- /dev/null
+++ b/SOURCES/0090-tests-shell-Fix-expected-output-for-ip6tables-dst-ma.patch
@@ -0,0 +1,45 @@
+From 3bf8687623a0a7b15ce9621f0da6f3361d5753df Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 6 Oct 2022 02:08:10 +0200
+Subject: [PATCH] tests: shell: Fix expected output for ip6tables dst match
+
+Forgot to update the shell testsuites when fixing for duplicate
+whitespace in output.
+
+Fixes: 11e06cbb3a877 ("extensions: libip6t_dst: Fix output for empty options")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit d89cc773618ddbdedd1ae967a8e686adbaf501f6)
+
+Conflicts:
+	iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
+-> Adjusted to missing commit 68e09d49ef26c
+   ("tests: shell: Fix testcases for changed ip6tables opts output").
+---
+ .../tests/shell/testcases/ip6tables/0002-verbose-output_0     | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0 b/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
+index 7624cbab655ad..65f755b627bb0 100755
+--- a/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
++++ b/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
+@@ -12,7 +12,7 @@ VOUT2='ACCEPT  all opt    in eth2 out eth3  feed:babe::4  -> feed:babe::5'
+ RULE3='-p icmpv6 -m icmp6 --icmpv6-type no-route'
+ VOUT3='  ipv6-icmp opt    in * out *  ::/0  -> ::/0   ipv6-icmptype 1 code 0'
+ RULE4='-m dst --dst-len 42 -m rt --rt-type 23'
+-VOUT4='  all opt    in * out *  ::/0  -> ::/0   dst length:42  rt type:23'
++VOUT4='  all opt    in * out *  ::/0  -> ::/0   dst length:42 rt type:23'
+ RULE5='-m frag --fragid 1337 -j LOG'
+ VOUT5='LOG  all opt    in * out *  ::/0  -> ::/0   frag id:1337 LOG flags 0 level 4'
+ 
+@@ -36,7 +36,7 @@ Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
+     0     0 ACCEPT     all      eth2   eth3    feed:babe::1         feed:babe::2
+     0     0 ACCEPT     all      eth2   eth3    feed:babe::4         feed:babe::5
+     0     0            ipv6-icmp    *      *       ::/0                 ::/0                 ipv6-icmptype 1 code 0
+-    0     0            all      *      *       ::/0                 ::/0                 dst length:42  rt type:23
++    0     0            all      *      *       ::/0                 ::/0                 dst length:42 rt type:23
+     0     0 LOG        all      *      *       ::/0                 ::/0                 frag id:1337 LOG flags 0 level 4
+ 
+ Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
+-- 
+2.40.0
+
diff --git a/SOURCES/0091-libiptc-Fix-for-segfault-when-renaming-a-chain.patch b/SOURCES/0091-libiptc-Fix-for-segfault-when-renaming-a-chain.patch
new file mode 100644
index 0000000..72d9629
--- /dev/null
+++ b/SOURCES/0091-libiptc-Fix-for-segfault-when-renaming-a-chain.patch
@@ -0,0 +1,67 @@
+From a6c758229e79375efcbf4b30a68cd8c24b48e88f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 7 Oct 2022 18:29:07 +0200
+Subject: [PATCH] libiptc: Fix for segfault when renaming a chain
+
+This is an odd bug: If the number of chains is right and one renames the
+last one in the list, libiptc dereferences a NULL pointer. Add fix and
+test case for it.
+
+Fixes: 64ff47cde38e4 ("libiptc: fix chain rename bug in libiptc")
+Reported-by: Julien Castets <castets.j@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 97bf4e68fc0794adba3243fd96f40f4568e7216f)
+---
+ .../testcases/chain/0006rename-segfault_0     | 19 +++++++++++++++++++
+ libiptc/libiptc.c                             |  9 +++++++++
+ 2 files changed, 28 insertions(+)
+ create mode 100755 iptables/tests/shell/testcases/chain/0006rename-segfault_0
+
+diff --git a/iptables/tests/shell/testcases/chain/0006rename-segfault_0 b/iptables/tests/shell/testcases/chain/0006rename-segfault_0
+new file mode 100755
+index 0000000000000..c10a8006b56b4
+--- /dev/null
++++ b/iptables/tests/shell/testcases/chain/0006rename-segfault_0
+@@ -0,0 +1,19 @@
++#!/bin/bash
++#
++# Cover for a bug in libiptc:
++# - the chain 'node-98-tmp' is the last in the list sorted by name
++# - there are 81 chains in total, so three chain index buckets
++# - the last index bucket contains only the 'node-98-tmp' chain
++# => rename temporarily removes it from the bucket, leaving a NULL bucket
++#    behind which is dereferenced later when inserting the chain again with new
++#    name again
++
++(
++	echo "*filter"
++	for chain in node-1 node-10 node-101 node-102 node-104 node-107 node-11 node-12 node-13 node-14 node-15 node-16 node-17 node-18 node-19 node-2 node-20 node-21 node-22 node-23 node-25 node-26 node-27 node-28 node-29 node-3 node-30 node-31 node-32 node-33 node-34 node-36 node-37 node-39 node-4 node-40 node-41 node-42 node-43 node-44 node-45 node-46 node-47 node-48 node-49 node-5 node-50 node-51 node-53 node-54 node-55 node-56 node-57 node-58 node-59 node-6 node-60 node-61 node-62 node-63 node-64 node-65 node-66 node-68 node-69 node-7 node-70 node-71 node-74 node-75 node-76 node-8 node-80 node-81 node-86 node-89 node-9 node-92 node-93 node-95 node-98-tmp; do
++		echo ":$chain - [0:0]"
++	done
++	echo "COMMIT"
++) | $XT_MULTI iptables-restore
++$XT_MULTI iptables -E node-98-tmp node-98
++exit $?
+diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c
+index 5888201525213..56bb75e5c3bef 100644
+--- a/libiptc/libiptc.c
++++ b/libiptc/libiptc.c
+@@ -606,6 +606,15 @@ static int iptcc_chain_index_delete_chain(struct chain_head *c, struct xtc_handl
+ 
+ 	if (index_ptr == &c->list) { /* Chain used as index ptr */
+ 
++		/* If this is the last chain in the list, its index bucket just
++		 * became empty. Adjust the size to avoid a NULL-pointer deref
++		 * later.
++		 */
++		if (next == &h->chains) {
++			h->chain_index_sz--;
++			return 0;
++		}
++
+ 		/* See if its possible to avoid a rebuild, by shifting
+ 		 * to next pointer.  Its possible if the next pointer
+ 		 * is located in the same index bucket.
+-- 
+2.40.0
+
diff --git a/SOURCES/0092-extensions-libebt_mark-Fix-xlate-test-case.patch b/SOURCES/0092-extensions-libebt_mark-Fix-xlate-test-case.patch
new file mode 100644
index 0000000..e8a87ba
--- /dev/null
+++ b/SOURCES/0092-extensions-libebt_mark-Fix-xlate-test-case.patch
@@ -0,0 +1,57 @@
+From 6f275ecd5b0654a865d8230c1955baeeed4dae5d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 11 Mar 2022 18:28:49 +0100
+Subject: [PATCH] extensions: libebt_mark: Fix xlate test case
+
+The false suffix effectively disabled this test file, but it also has
+problems: Apart from brmark_xlate() printing 'meta mark' instead of just
+'mark', target is printed in the wrong position (like with any other
+target-possessing extension.
+
+Fixes: e67c08880961f ("ebtables-translate: add initial test cases")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit bc5f9d05dbf7d0a6c5256c63c492273c93ad3434)
+---
+ extensions/libebt_mark.txlate | 11 +++++++++++
+ extensions/libebt_mark.xlate  | 11 -----------
+ 2 files changed, 11 insertions(+), 11 deletions(-)
+ create mode 100644 extensions/libebt_mark.txlate
+ delete mode 100644 extensions/libebt_mark.xlate
+
+diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate
+new file mode 100644
+index 0000000000000..7529302d9a444
+--- /dev/null
++++ b/extensions/libebt_mark.txlate
+@@ -0,0 +1,11 @@
++ebtables-translate -A INPUT --mark-set 42
++nft add rule bridge filter INPUT meta mark set 0x2a accept counter
++
++ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN
++nft add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter
++
++ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT
++nft add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter
++
++ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP
++nft add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter
+diff --git a/extensions/libebt_mark.xlate b/extensions/libebt_mark.xlate
+deleted file mode 100644
+index e0982a1e8ebd7..0000000000000
+--- a/extensions/libebt_mark.xlate
++++ /dev/null
+@@ -1,11 +0,0 @@
+-ebtables-translate -A INPUT --mark-set 42
+-nft add rule bridge filter INPUT mark set 0x2a counter
+-
+-ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN
+-nft add rule bridge filter INPUT mark set mark or 0x2a counter return
+-
+-ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT
+-nft add rule bridge filter INPUT mark set mark and 0x2a counter accept
+-
+-ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP
+-nft add rule bridge filter INPUT mark set mark xor 0x2a counter drop
+-- 
+2.40.0
+
diff --git a/SOURCES/0093-extensions-libebt_redirect-Fix-xlate-return-code.patch b/SOURCES/0093-extensions-libebt_redirect-Fix-xlate-return-code.patch
new file mode 100644
index 0000000..0bb86ce
--- /dev/null
+++ b/SOURCES/0093-extensions-libebt_redirect-Fix-xlate-return-code.patch
@@ -0,0 +1,30 @@
+From fd19d22db18ac084f45d739416df1f81a4e31c82 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 16 Nov 2022 13:03:05 +0100
+Subject: [PATCH] extensions: libebt_redirect: Fix xlate return code
+
+The callback is supposed to return 1 on success, not 0.
+
+Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 8543b6f2f4a3a15a5ece7dd1b320b477ce36a8d5)
+---
+ extensions/libebt_redirect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c
+index 6e653997ee99e..4d4c7a02cea89 100644
+--- a/extensions/libebt_redirect.c
++++ b/extensions/libebt_redirect.c
+@@ -86,7 +86,7 @@ static int brredir_xlate(struct xt_xlate *xl,
+ 	xt_xlate_add(xl, "meta set pkttype host");
+ 	if (red->target != EBT_ACCEPT)
+ 		xt_xlate_add(xl, " %s ", brredir_verdict(red->target));
+-	return 0;
++	return 1;
+ }
+ 
+ static struct xtables_target brredirect_target = {
+-- 
+2.40.0
+
diff --git a/SOURCES/0094-extensions-libipt_ttl-Sanitize-xlate-callback.patch b/SOURCES/0094-extensions-libipt_ttl-Sanitize-xlate-callback.patch
new file mode 100644
index 0000000..e8ddd78
--- /dev/null
+++ b/SOURCES/0094-extensions-libipt_ttl-Sanitize-xlate-callback.patch
@@ -0,0 +1,39 @@
+From 64788807be19d744bb9c57943e74fe6775a8c05f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 16 Nov 2022 13:09:16 +0100
+Subject: [PATCH] extensions: libipt_ttl: Sanitize xlate callback
+
+Catch unexpected values in info->mode, also fix indenting.
+
+Fixes: 1b320a1a1dc1f ("extensions: libipt_ttl: Add translation to nft")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 800bed28b2b7bbd931166c7426640ae619f03342)
+---
+ extensions/libipt_ttl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/extensions/libipt_ttl.c b/extensions/libipt_ttl.c
+index 6bdd219618091..86ba554ef92a8 100644
+--- a/extensions/libipt_ttl.c
++++ b/extensions/libipt_ttl.c
+@@ -106,7 +106,7 @@ static int ttl_xlate(struct xt_xlate *xl,
+ 	const struct ipt_ttl_info *info =
+ 		(struct ipt_ttl_info *) params->match->data;
+ 
+-		switch (info->mode) {
++	switch (info->mode) {
+ 		case IPT_TTL_EQ:
+ 			xt_xlate_add(xl, "ip ttl");
+ 			break;
+@@ -121,7 +121,7 @@ static int ttl_xlate(struct xt_xlate *xl,
+ 			break;
+ 		default:
+ 			/* Should not happen. */
+-			break;
++			return 0;
+ 	}
+ 
+ 	xt_xlate_add(xl, " %u", info->ttl);
+-- 
+2.40.0
+
diff --git a/SOURCES/0095-extensions-CONNMARK-Fix-xlate-callback.patch b/SOURCES/0095-extensions-CONNMARK-Fix-xlate-callback.patch
new file mode 100644
index 0000000..6916c05
--- /dev/null
+++ b/SOURCES/0095-extensions-CONNMARK-Fix-xlate-callback.patch
@@ -0,0 +1,88 @@
+From f6763e2336fb4eed696fc715375e3ea5a6855b20 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 17 Nov 2022 15:30:11 +0100
+Subject: [PATCH] extensions: CONNMARK: Fix xlate callback
+
+Bail out if nfmask != ctmask with XT_CONNMARK_SAVE and
+XT_CONNMARK_RESTORE. Looks like this needs a similar implementation to
+the one for XT_CONNMARK_SET.
+
+Fix shift mark translation: xt_connmark_shift_ops does not contain
+useful strings for nftables. Also add needed braces around the term
+being shifted.
+
+Fixes: db7b4e0de960c ("extensions: libxt_CONNMARK: Support bit-shifting for --restore,set and save-mark")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit e6747f6b1098b2bc7dfd482f287b3f90b351f164)
+---
+ extensions/libxt_CONNMARK.c      | 15 ++++++++++-----
+ extensions/libxt_CONNMARK.txlate |  3 +++
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/extensions/libxt_CONNMARK.c b/extensions/libxt_CONNMARK.c
+index 21e1091386294..a6568c99b6c4d 100644
+--- a/extensions/libxt_CONNMARK.c
++++ b/extensions/libxt_CONNMARK.c
+@@ -595,11 +595,11 @@ static int connmark_tg_xlate_v2(struct xt_xlate *xl,
+ {
+ 	const struct xt_connmark_tginfo2 *info =
+ 		(const void *)params->target->data;
+-	const char *shift_op = xt_connmark_shift_ops[info->shift_dir];
++	const char *braces = info->shift_bits ? "( " : "";
+ 
+ 	switch (info->mode) {
+ 	case XT_CONNMARK_SET:
+-		xt_xlate_add(xl, "ct mark set ");
++		xt_xlate_add(xl, "ct mark set %s", braces);
+ 		if (info->ctmask == 0xFFFFFFFFU)
+ 			xt_xlate_add(xl, "0x%x ", info->ctmark);
+ 		else if (info->ctmark == 0)
+@@ -615,26 +615,31 @@ static int connmark_tg_xlate_v2(struct xt_xlate *xl,
+ 				     info->ctmark, ~info->ctmask);
+ 		break;
+ 	case XT_CONNMARK_SAVE:
+-		xt_xlate_add(xl, "ct mark set mark");
++		xt_xlate_add(xl, "ct mark set %smark", braces);
+ 		if (!(info->nfmask == UINT32_MAX &&
+ 		    info->ctmask == UINT32_MAX)) {
+ 			if (info->nfmask == info->ctmask)
+ 				xt_xlate_add(xl, " and 0x%x", info->nfmask);
++			else
++				return 0;
+ 		}
+ 		break;
+ 	case XT_CONNMARK_RESTORE:
+-		xt_xlate_add(xl, "meta mark set ct mark");
++		xt_xlate_add(xl, "meta mark set %sct mark", braces);
+ 		if (!(info->nfmask == UINT32_MAX &&
+ 		    info->ctmask == UINT32_MAX)) {
+ 			if (info->nfmask == info->ctmask)
+ 				xt_xlate_add(xl, " and 0x%x", info->nfmask);
++			else
++				return 0;
+ 		}
+ 		break;
+ 	}
+ 
+ 	if (info->mode <= XT_CONNMARK_RESTORE &&
+ 	    info->shift_bits != 0) {
+-		xt_xlate_add(xl, " %s %u", shift_op, info->shift_bits);
++		xt_xlate_add(xl, " ) %s %u",
++			     info->shift_dir ? ">>" : "<<", info->shift_bits);
+ 	}
+ 
+ 	return 1;
+diff --git a/extensions/libxt_CONNMARK.txlate b/extensions/libxt_CONNMARK.txlate
+index ce40ae5ea65e0..99627c2b05d45 100644
+--- a/extensions/libxt_CONNMARK.txlate
++++ b/extensions/libxt_CONNMARK.txlate
+@@ -18,3 +18,6 @@ nft add rule ip mangle PREROUTING counter ct mark set mark
+ 
+ iptables-translate -t mangle -A PREROUTING -j CONNMARK --restore-mark
+ nft add rule ip mangle PREROUTING counter meta mark set ct mark
++
++iptables-translate -t mangle -A PREROUTING  -j CONNMARK --set-mark 0x23/0x42 --right-shift-mark 5
++nft add rule ip mangle PREROUTING counter ct mark set ( ct mark xor 0x23 and 0xffffff9c ) >> 5
+-- 
+2.40.0
+
diff --git a/SOURCES/0096-extensions-MARK-Sanitize-MARK_xlate.patch b/SOURCES/0096-extensions-MARK-Sanitize-MARK_xlate.patch
new file mode 100644
index 0000000..645e8ad
--- /dev/null
+++ b/SOURCES/0096-extensions-MARK-Sanitize-MARK_xlate.patch
@@ -0,0 +1,31 @@
+From ce7198e207384f91d510b50e64305de3e05c2c61 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 17 Nov 2022 16:01:11 +0100
+Subject: [PATCH] extensions: MARK: Sanitize MARK_xlate()
+
+Since markinfo->mode might contain unexpected values, add a default case
+returning zero.
+
+Fixes: afefc7a134ca0 ("extensions: libxt_MARK: Add translation for revision 1 to nft")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit c4fc6440a6f39606e38744bfc827852bb68829f4)
+---
+ extensions/libxt_MARK.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
+index 1536563d0f4c7..100f6a38996ac 100644
+--- a/extensions/libxt_MARK.c
++++ b/extensions/libxt_MARK.c
+@@ -366,6 +366,8 @@ static int MARK_xlate(struct xt_xlate *xl,
+ 	case XT_MARK_OR:
+ 		xt_xlate_add(xl, "mark or 0x%x ", (uint32_t)markinfo->mark);
+ 		break;
++	default:
++		return 0;
+ 	}
+ 
+ 	return 1;
+-- 
+2.40.0
+
diff --git a/SOURCES/0097-extensions-TCPMSS-Use-xlate-callback-for-IPv6-too.patch b/SOURCES/0097-extensions-TCPMSS-Use-xlate-callback-for-IPv6-too.patch
new file mode 100644
index 0000000..b68e2d1
--- /dev/null
+++ b/SOURCES/0097-extensions-TCPMSS-Use-xlate-callback-for-IPv6-too.patch
@@ -0,0 +1,29 @@
+From 6069123a02f5ff736e8d06adc5d5f3f11173febf Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 17 Nov 2022 16:06:46 +0100
+Subject: [PATCH] extensions: TCPMSS: Use xlate callback for IPv6, too
+
+Data structures are identical and the translation is layer3-agnostic.
+
+Fixes: bebce197adb42 ("iptables: iptables-compat translation for TCPMSS")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit e05d9af176cb2a62c1bd24fa1d82b12a8ad00221)
+---
+ extensions/libxt_TCPMSS.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/extensions/libxt_TCPMSS.c b/extensions/libxt_TCPMSS.c
+index 0d9b200ebc72f..251a5532a838b 100644
+--- a/extensions/libxt_TCPMSS.c
++++ b/extensions/libxt_TCPMSS.c
+@@ -131,6 +131,7 @@ static struct xtables_target tcpmss_tg_reg[] = {
+ 		.x6_parse      = TCPMSS_parse,
+ 		.x6_fcheck     = TCPMSS_check,
+ 		.x6_options    = TCPMSS6_opts,
++		.xlate         = TCPMSS_xlate,
+ 	},
+ };
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0098-extensions-TOS-Fix-v1-xlate-callback.patch b/SOURCES/0098-extensions-TOS-Fix-v1-xlate-callback.patch
new file mode 100644
index 0000000..0b35525
--- /dev/null
+++ b/SOURCES/0098-extensions-TOS-Fix-v1-xlate-callback.patch
@@ -0,0 +1,95 @@
+From 383c33a62877379b44ec58032cc707a43b662481 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 17 Nov 2022 16:10:14 +0100
+Subject: [PATCH] extensions: TOS: Fix v1 xlate callback
+
+Translation entirely ignored tos_mask field.
+
+Fixes: b669e18489709 ("extensions: libxt_TOS: Add translation to nft")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 161fb8ad126d8f330c8f59a4a1b5885d26477664)
+---
+ extensions/libxt_TOS.c      | 33 +++++++++++++++++++++++----------
+ extensions/libxt_TOS.txlate |  9 ++++++---
+ 2 files changed, 29 insertions(+), 13 deletions(-)
+
+diff --git a/extensions/libxt_TOS.c b/extensions/libxt_TOS.c
+index b66fa329f4150..4fc849bd2468b 100644
+--- a/extensions/libxt_TOS.c
++++ b/extensions/libxt_TOS.c
+@@ -183,28 +183,41 @@ static void tos_tg_save(const void *ip, const struct xt_entry_target *target)
+ 	printf(" --set-tos 0x%02x/0x%02x", info->tos_value, info->tos_mask);
+ }
+ 
++static int __tos_xlate(struct xt_xlate *xl, const char *ip,
++		       uint8_t tos, uint8_t tosmask)
++{
++	xt_xlate_add(xl, "%s dscp set ", ip);
++	if ((tosmask & 0x3f) == 0x3f)
++		xt_xlate_add(xl, "0x%02x", tos >> 2);
++	else if (!tos)
++		xt_xlate_add(xl, "%s dscp and 0x%02x",
++			     ip, (uint8_t)~tosmask >> 2);
++	else if (tos == tosmask)
++		xt_xlate_add(xl, "%s dscp or 0x%02x", ip, tos >> 2);
++	else if (!tosmask)
++		xt_xlate_add(xl, "%s dscp xor 0x%02x", ip, tos >> 2);
++	else
++		xt_xlate_add(xl, "%s dscp and 0x%02x xor 0x%02x",
++			     ip, (uint8_t)~tosmask >> 2, tos >> 2);
++	return 1;
++}
++
+ static int tos_xlate(struct xt_xlate *xl,
+ 		     const struct xt_xlate_tg_params *params)
+ {
+ 	const struct ipt_tos_target_info *info =
+ 			(struct ipt_tos_target_info *) params->target->data;
+-	uint8_t dscp = info->tos >> 2;
+-
+-	xt_xlate_add(xl, "ip dscp set 0x%02x", dscp);
+ 
+-	return 1;
++	return __tos_xlate(xl, "ip", info->tos, UINT8_MAX);
+ }
+ 
+ static int tos_xlate6(struct xt_xlate *xl,
+ 		     const struct xt_xlate_tg_params *params)
+ {
+-	const struct ipt_tos_target_info *info =
+-			(struct ipt_tos_target_info *) params->target->data;
+-	uint8_t dscp = info->tos >> 2;
++	const struct xt_tos_target_info *info =
++			(struct xt_tos_target_info *)params->target->data;
+ 
+-	xt_xlate_add(xl, "ip6 dscp set 0x%02x", dscp);
+-
+-	return 1;
++	return __tos_xlate(xl, "ip6", info->tos_value, info->tos_mask);
+ }
+ 
+ static struct xtables_target tos_tg_reg[] = {
+diff --git a/extensions/libxt_TOS.txlate b/extensions/libxt_TOS.txlate
+index 0952310edc4ac..9c12674299359 100644
+--- a/extensions/libxt_TOS.txlate
++++ b/extensions/libxt_TOS.txlate
+@@ -14,10 +14,13 @@ ip6tables-translate -A INPUT -j TOS --set-tos Normal-Service
+ nft add rule ip6 filter INPUT counter ip6 dscp set 0x00
+ 
+ ip6tables-translate -A INPUT -j TOS --and-tos 0x12
+-nft add rule ip6 filter INPUT counter ip6 dscp set 0x00
++nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp and 0x04
+ 
+ ip6tables-translate -A INPUT -j TOS --or-tos 0x12
+-nft add rule ip6 filter INPUT counter ip6 dscp set 0x04
++nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp or 0x04
+ 
+ ip6tables-translate -A INPUT -j TOS --xor-tos 0x12
+-nft add rule ip6 filter INPUT counter ip6 dscp set 0x04
++nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp xor 0x04
++
++ip6tables-translate -A INPUT -j TOS --set-tos 0x12/0x34
++nft add rule ip6 filter INPUT counter ip6 dscp set ip6 dscp and 0x32 xor 0x04
+-- 
+2.40.0
+
diff --git a/SOURCES/0099-extensions-ecn-Sanitize-xlate-callback.patch b/SOURCES/0099-extensions-ecn-Sanitize-xlate-callback.patch
new file mode 100644
index 0000000..f66a33b
--- /dev/null
+++ b/SOURCES/0099-extensions-ecn-Sanitize-xlate-callback.patch
@@ -0,0 +1,30 @@
+From ae3975e65d0f524d4d44c61407078bd11b10493e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 17 Nov 2022 16:37:02 +0100
+Subject: [PATCH] extensions: ecn: Sanitize xlate callback
+
+Catch unexpected values in einfo->ip_ect.
+
+Fixes: ca42442093d3d ("iptables: extensions: libxt_ecn: Add translation to nft")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 424ef98918d31377a305cdf1626e1c1f69ab6df1)
+---
+ extensions/libxt_ecn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/extensions/libxt_ecn.c b/extensions/libxt_ecn.c
+index ad3c7a0307a0d..83a4acfab7da7 100644
+--- a/extensions/libxt_ecn.c
++++ b/extensions/libxt_ecn.c
+@@ -156,6 +156,8 @@ static int ecn_xlate(struct xt_xlate *xl,
+ 		case 3:
+ 			xt_xlate_add(xl, "ce");
+ 			break;
++		default:
++			return 0;
+ 		}
+ 	}
+ 	return 1;
+-- 
+2.40.0
+
diff --git a/SOURCES/0100-extensions-libebt_mark-Fix-mark-target-xlate.patch b/SOURCES/0100-extensions-libebt_mark-Fix-mark-target-xlate.patch
new file mode 100644
index 0000000..c0247c8
--- /dev/null
+++ b/SOURCES/0100-extensions-libebt_mark-Fix-mark-target-xlate.patch
@@ -0,0 +1,31 @@
+From 5d3cf36df7d10011493f9d170be9077b734c52ad Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 23 Nov 2022 03:35:34 +0100
+Subject: [PATCH] extensions: libebt_mark: Fix mark target xlate
+
+Target value is constructed setting all non-target bits to one instead
+of zero.
+
+Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit c6d7a1dd72a21e7f8f117eedb61bff5b94ef5f0c)
+---
+ extensions/libebt_mark.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/extensions/libebt_mark.c b/extensions/libebt_mark.c
+index 423c5c9133d0d..40e49618e0215 100644
+--- a/extensions/libebt_mark.c
++++ b/extensions/libebt_mark.c
+@@ -201,7 +201,7 @@ static int brmark_xlate(struct xt_xlate *xl,
+ 		return 0;
+ 	}
+ 
+-	tmp = info->target & EBT_VERDICT_BITS;
++	tmp = info->target | ~EBT_VERDICT_BITS;
+ 	xt_xlate_add(xl, "0x%lx %s ", info->mark, brmark_verdict(tmp));
+ 	return 1;
+ }
+-- 
+2.40.0
+
diff --git a/SOURCES/0101-extensions-libxt_conntrack-Drop-extra-whitespace-in-.patch b/SOURCES/0101-extensions-libxt_conntrack-Drop-extra-whitespace-in-.patch
new file mode 100644
index 0000000..0c44c09
--- /dev/null
+++ b/SOURCES/0101-extensions-libxt_conntrack-Drop-extra-whitespace-in-.patch
@@ -0,0 +1,57 @@
+From 082a131316f145e29f77a1761294d343b8df320b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Nov 2022 04:35:35 +0100
+Subject: [PATCH] extensions: libxt_conntrack: Drop extra whitespace in xlate
+
+No point in having this. Interestingly, other test cases even made up
+for it.
+
+Fixes: 0afd957f6bc03 ("extensions: libxt_state: add translation to nft")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 116848ea1e5d8d02fd766356a642bd81574e2723)
+
+Conflicts:
+	extensions/libxt_hashlimit.txlate
+-> Adjusted to missing commit 023dd2c515be6
+   ("libxtables: xt_xlate_add() to take care of spacing").
+---
+ extensions/libxt_SYNPROXY.txlate  | 2 +-
+ extensions/libxt_conntrack.c      | 1 -
+ extensions/libxt_hashlimit.txlate | 4 ++--
+ 3 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/extensions/libxt_SYNPROXY.txlate b/extensions/libxt_SYNPROXY.txlate
+index b3de2b2a8c9dc..a2a3b6c522fe7 100644
+--- a/extensions/libxt_SYNPROXY.txlate
++++ b/extensions/libxt_SYNPROXY.txlate
+@@ -1,2 +1,2 @@
+ iptables-translate -t mangle -A INPUT -i iifname -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
+-nft add rule ip mangle INPUT iifname "iifname" tcp dport 80 ct state invalid,untracked  counter synproxy sack-perm timestamp wscale 7 mss 1460
++nft add rule ip mangle INPUT iifname "iifname" tcp dport 80 ct state invalid,untracked counter synproxy sack-perm timestamp wscale 7 mss 1460
+diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
+index 6ab5c99133d3c..6dfd942dcd5ab 100644
+--- a/extensions/libxt_conntrack.c
++++ b/extensions/libxt_conntrack.c
+@@ -1196,7 +1196,6 @@ static int state_xlate(struct xt_xlate *xl,
+ 	xt_xlate_add(xl, "ct state ");
+ 	state_xlate_print(xl, sinfo->state_mask,
+ 			  sinfo->invert_flags & XT_CONNTRACK_STATE);
+-	xt_xlate_add(xl, " ");
+ 	return 1;
+ }
+ 
+diff --git a/extensions/libxt_hashlimit.txlate b/extensions/libxt_hashlimit.txlate
+index 6c8d07f113d26..2fb6969befb4b 100644
+--- a/extensions/libxt_hashlimit.txlate
++++ b/extensions/libxt_hashlimit.txlate
+@@ -1,5 +1,5 @@
+ iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-above 20kb/s --hashlimit-burst 1mb --hashlimit-mode dstip --hashlimit-name https --hashlimit-dstmask 24 -m state --state NEW -j DROP
+-nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new  counter drop
++nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr and 255.255.255.0 timeout 60s limit rate over 20 kbytes/second burst 1 mbytes} ct state new counter drop
+ 
+ iptables-translate -A OUTPUT -m tcp -p tcp --dport 443 -m hashlimit --hashlimit-upto 300 --hashlimit-burst 15 --hashlimit-mode srcip,dstip --hashlimit-name https --hashlimit-htable-expire 300000 -m state --state NEW -j DROP
+-nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new  counter drop
++nft add rule ip filter OUTPUT tcp dport 443 meter https { ip daddr . ip saddr timeout 300s limit rate 300/second burst 15 packets} ct state new counter drop
+-- 
+2.40.0
+
diff --git a/SOURCES/0102-iptables-restore-Free-handle-with-test-also.patch b/SOURCES/0102-iptables-restore-Free-handle-with-test-also.patch
new file mode 100644
index 0000000..ee4f2d5
--- /dev/null
+++ b/SOURCES/0102-iptables-restore-Free-handle-with-test-also.patch
@@ -0,0 +1,47 @@
+From a1d05d4c6ac02bed334c55f611bff08decff89e6 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Nov 2022 19:24:38 +0100
+Subject: [PATCH] iptables-restore: Free handle with --test also
+
+When running 'iptables-restore -t', valgrind reports:
+
+1,496 (160 direct, 1,336 indirect) bytes in 1 blocks are definitely lost in loss record 4 of 4
+   at 0x48417E5: malloc (vg_replace_malloc.c:381)
+   by 0x4857A46: alloc_handle (libiptc.c:1279)
+   by 0x4857A46: iptc_init (libiptc.c:1342)
+   by 0x1167CE: create_handle (iptables-restore.c:72)
+   by 0x1167CE: ip46tables_restore_main (iptables-restore.c:229)
+   by 0x116DAE: iptables_restore_main (iptables-restore.c:388)
+   by 0x49A2349: (below main) (in /lib64/libc.so.6)
+
+Free the handle pointer before parsing the next table.
+
+Fixes: 1c9015b2cb483 ("libiptc: remove indirections")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 18880dbde615449d00a3e38f3713a19d4566258e)
+---
+ iptables/iptables-restore.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
+index a34d95015c93c..3b821467db355 100644
+--- a/iptables/iptables-restore.c
++++ b/iptables/iptables-restore.c
+@@ -187,12 +187,12 @@ ip46tables_restore_main(const struct iptables_restore_cb *cb,
+ 			if (!testing) {
+ 				DEBUGP("Calling commit\n");
+ 				ret = cb->ops->commit(handle);
+-				cb->ops->free(handle);
+-				handle = NULL;
+ 			} else {
+ 				DEBUGP("Not calling commit, testing\n");
+ 				ret = 1;
+ 			}
++			cb->ops->free(handle);
++			handle = NULL;
+ 
+ 			/* Done with the current table, release the lock. */
+ 			if (lock >= 0) {
+-- 
+2.40.0
+
diff --git a/SOURCES/0103-iptables-xml-Free-allocated-chain-strings.patch b/SOURCES/0103-iptables-xml-Free-allocated-chain-strings.patch
new file mode 100644
index 0000000..712a6ae
--- /dev/null
+++ b/SOURCES/0103-iptables-xml-Free-allocated-chain-strings.patch
@@ -0,0 +1,42 @@
+From 0abbd8f611f379d14cac3dc3d84a2255ef78ee45 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Nov 2022 19:30:09 +0100
+Subject: [PATCH] iptables-xml: Free allocated chain strings
+
+Freeing only if 'created' is non-zero is wrong - the data was still
+allocated. In fact, the field is supposed to prevent only the call to
+openChain().
+
+Fixes: 8d3eccb19a9c6 ("Add iptables-xml tool (Amin Azez <azez@ufomechanic.net>)")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 73da7fb74c1089391dac0aca70e13e5f5999ace7)
+---
+ iptables/iptables-xml.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/iptables/iptables-xml.c b/iptables/iptables-xml.c
+index 98d03dda98d2b..815d24e13b300 100644
+--- a/iptables/iptables-xml.c
++++ b/iptables/iptables-xml.c
+@@ -225,13 +225,13 @@ finishChains(void)
+ {
+ 	int c;
+ 
+-	for (c = 0; c < nextChain; c++)
+-		if (!chains[c].created) {
++	for (c = 0; c < nextChain; c++) {
++		if (!chains[c].created)
+ 			openChain(chains[c].chain, chains[c].policy,
+ 				  &(chains[c].count), '/');
+-			free(chains[c].chain);
+-			free(chains[c].policy);
+-		}
++		free(chains[c].chain);
++		free(chains[c].policy);
++	}
+ 	nextChain = 0;
+ }
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0104-nft-Plug-memleak-in-nft_rule_zero_counters.patch b/SOURCES/0104-nft-Plug-memleak-in-nft_rule_zero_counters.patch
new file mode 100644
index 0000000..b1cbedf
--- /dev/null
+++ b/SOURCES/0104-nft-Plug-memleak-in-nft_rule_zero_counters.patch
@@ -0,0 +1,51 @@
+From bf06d5a6df59cb5e87fe5e909431da5697a965e3 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Nov 2022 21:21:22 +0100
+Subject: [PATCH] nft: Plug memleak in nft_rule_zero_counters()
+
+When zeroing a specific rule, valgrind reports:
+
+40 bytes in 1 blocks are definitely lost in loss record 1 of 1
+   at 0x484659F: calloc (vg_replace_malloc.c:1328)
+   by 0x48DE128: xtables_calloc (xtables.c:434)
+   by 0x11C7C6: nft_parse_immediate (nft-shared.c:1071)
+   by 0x11C7C6: nft_rule_to_iptables_command_state (nft-shared.c:1236)
+   by 0x119AF5: nft_rule_zero_counters (nft.c:2877)
+   by 0x11A3CA: nft_prepare (nft.c:3445)
+   by 0x11A7A8: nft_commit (nft.c:3479)
+   by 0x114258: xtables_main.isra.0 (xtables-standalone.c:94)
+   by 0x1142D9: xtables_ip6_main (xtables-standalone.c:118)
+   by 0x49F2349: (below main) (in /lib64/libc.so.6)
+
+Have to free the matches/target in populated iptables_command_state object
+again. While being at it, call the proper family_ops callbacks since this is
+family-agnostic code.
+
+Fixes: a69cc575295ee ("xtables: allow to reset the counters of an existing rule")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit aa0c54030300441e9fd66c7016d0090f6736d449)
+---
+ iptables/nft.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 0ec7679d25289..b70e9237a04ab 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -2614,10 +2614,11 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ 		goto error;
+ 	}
+ 
+-	nft_rule_to_iptables_command_state(h, r, &cs);
+-
++	h->ops->rule_to_cs(h, r, &cs);
+ 	cs.counters.pcnt = cs.counters.bcnt = 0;
+ 	new_rule = nft_rule_new(h, chain, table, &cs);
++	h->ops->clear_cs(&cs);
++
+ 	if (!new_rule)
+ 		return 1;
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0105-xtables-Introduce-xtables_clear_iptables_command_sta.patch b/SOURCES/0105-xtables-Introduce-xtables_clear_iptables_command_sta.patch
new file mode 100644
index 0000000..7d726a4
--- /dev/null
+++ b/SOURCES/0105-xtables-Introduce-xtables_clear_iptables_command_sta.patch
@@ -0,0 +1,219 @@
+From 4d1c89af40811d5527ab5c2b629245076d970542 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Nov 2022 21:42:20 +0100
+Subject: [PATCH] xtables: Introduce xtables_clear_iptables_command_state()
+
+This is nft_clear_iptables_command_state() but in a location reachable
+by legacy iptables, too.
+
+Changes callers in non-family-specific code to use clear_cs callback
+instead of directly calling it - ebtables still has a custom variant.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 365647ef056828bc3cb56efef12114951fcb730d)
+
+Conflicts:
+	iptables/nft-arp.c
+	iptables/nft-shared.c
+	iptables/nft-shared.h
+	iptables/xshared.c
+-> Context change due to missing commits cfdda18044d81
+   ("nft-shared: Introduce init_cs family ops callback") and
+   62c3c93d4b0f5 ("xshared: Move do_parse to shared space").
+-> Adjust to missing commit 0af80a91b0a98
+   ("nft: Merge xtables-arp-standalone.c into xtables-standalone.c").
+
+(cherry picked from commit 42792a2949749794487519575119ee1083975a76)
+---
+ iptables/nft-arp.c           |  4 ++--
+ iptables/nft-ipv4.c          |  4 ++--
+ iptables/nft-ipv6.c          |  4 ++--
+ iptables/nft-shared.c        | 14 --------------
+ iptables/nft-shared.h        |  1 -
+ iptables/xshared.c           | 17 +++++++++++++++++
+ iptables/xshared.h           |  2 ++
+ iptables/xtables-arp.c       |  2 +-
+ iptables/xtables-translate.c |  2 +-
+ iptables/xtables.c           |  2 +-
+ 10 files changed, 28 insertions(+), 24 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index d55e06572b283..b90f53990fd4f 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -501,7 +501,7 @@ nft_arp_print_rule(struct nft_handle *h, struct nftnl_rule *r,
+ 	if (!(format & FMT_NONEWLINE))
+ 		fputc('\n', stdout);
+ 
+-	nft_clear_iptables_command_state(&cs);
++	xtables_clear_iptables_command_state(&cs);
+ }
+ 
+ static bool nft_arp_is_same(const void *data_a,
+@@ -550,6 +550,6 @@ struct nft_family_ops nft_family_ops_arp = {
+ 	.save_chain		= nft_arp_save_chain,
+ 	.post_parse		= NULL,
+ 	.rule_to_cs		= nft_rule_to_iptables_command_state,
+-	.clear_cs		= nft_clear_iptables_command_state,
++	.clear_cs		= xtables_clear_iptables_command_state,
+ 	.parse_target		= nft_ipv46_parse_target,
+ };
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index 76c76b67100ca..a70e9ece248fe 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -286,7 +286,7 @@ static void nft_ipv4_print_rule(struct nft_handle *h, struct nftnl_rule *r,
+ 	if (!(format & FMT_NONEWLINE))
+ 		fputc('\n', stdout);
+ 
+-	nft_clear_iptables_command_state(&cs);
++	xtables_clear_iptables_command_state(&cs);
+ }
+ 
+ static void save_ipv4_addr(char letter, const struct in_addr *addr,
+@@ -476,6 +476,6 @@ struct nft_family_ops nft_family_ops_ipv4 = {
+ 	.post_parse		= nft_ipv4_post_parse,
+ 	.parse_target		= nft_ipv46_parse_target,
+ 	.rule_to_cs		= nft_rule_to_iptables_command_state,
+-	.clear_cs		= nft_clear_iptables_command_state,
++	.clear_cs		= xtables_clear_iptables_command_state,
+ 	.xlate			= nft_ipv4_xlate,
+ };
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index fac0f16cfe815..1f73bbcb8771f 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -215,7 +215,7 @@ static void nft_ipv6_print_rule(struct nft_handle *h, struct nftnl_rule *r,
+ 	if (!(format & FMT_NONEWLINE))
+ 		fputc('\n', stdout);
+ 
+-	nft_clear_iptables_command_state(&cs);
++	xtables_clear_iptables_command_state(&cs);
+ }
+ 
+ static void save_ipv6_addr(char letter, const struct in6_addr *addr,
+@@ -418,6 +418,6 @@ struct nft_family_ops nft_family_ops_ipv6 = {
+ 	.post_parse		= nft_ipv6_post_parse,
+ 	.parse_target		= nft_ipv46_parse_target,
+ 	.rule_to_cs		= nft_rule_to_iptables_command_state,
+-	.clear_cs		= nft_clear_iptables_command_state,
++	.clear_cs		= xtables_clear_iptables_command_state,
+ 	.xlate			= nft_ipv6_xlate,
+ };
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index cb1c2d61f52c1..075ad620250dc 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -685,20 +685,6 @@ void nft_rule_to_iptables_command_state(struct nft_handle *h,
+ 		cs->jumpto = "";
+ }
+ 
+-void nft_clear_iptables_command_state(struct iptables_command_state *cs)
+-{
+-	xtables_rule_matches_free(&cs->matches);
+-	if (cs->target) {
+-		free(cs->target->t);
+-		cs->target->t = NULL;
+-
+-		if (cs->target == cs->target->next) {
+-			free(cs->target);
+-			cs->target = NULL;
+-		}
+-	}
+-}
+-
+ void print_header(unsigned int format, const char *chain, const char *pol,
+ 		  const struct xt_counters *counters, bool basechain,
+ 		  uint32_t refs, uint32_t entries)
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index 3531631bd8acd..e3c1b202b8638 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -144,7 +144,6 @@ void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
+ void nft_rule_to_iptables_command_state(struct nft_handle *h,
+ 					const struct nftnl_rule *r,
+ 					struct iptables_command_state *cs);
+-void nft_clear_iptables_command_state(struct iptables_command_state *cs);
+ void print_header(unsigned int format, const char *chain, const char *pol,
+ 		  const struct xt_counters *counters, bool basechain,
+ 		  uint32_t refs, uint32_t entries);
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index b052b849b2069..8de4fe4945279 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -872,3 +872,20 @@ void assert_valid_chain_name(const char *chainname)
+ 			xtables_error(PARAMETER_PROBLEM,
+ 				      "Invalid chain name `%s'", chainname);
+ }
++
++void xtables_clear_iptables_command_state(struct iptables_command_state *cs)
++{
++	xtables_rule_matches_free(&cs->matches);
++	if (cs->target) {
++		free(cs->target->t);
++		cs->target->t = NULL;
++
++		free(cs->target->udata);
++		cs->target->udata = NULL;
++
++		if (cs->target == cs->target->next) {
++			free(cs->target);
++			cs->target = NULL;
++		}
++	}
++}
+diff --git a/iptables/xshared.h b/iptables/xshared.h
+index c512f20afd33a..e8fd82894f48e 100644
+--- a/iptables/xshared.h
++++ b/iptables/xshared.h
+@@ -139,6 +139,8 @@ struct iptables_command_state {
+ 	bool restore;
+ };
+ 
++void xtables_clear_iptables_command_state(struct iptables_command_state *cs);
++
+ typedef int (*mainfunc_t)(int, char **);
+ 
+ struct subcommand {
+diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
+index 0695504892b74..617b4ae41857f 100644
+--- a/iptables/xtables-arp.c
++++ b/iptables/xtables-arp.c
+@@ -1007,7 +1007,7 @@ int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
+ 	free(daddrs);
+ 	free(dmasks);
+ 
+-	nft_clear_iptables_command_state(&cs);
++	xtables_clear_iptables_command_state(&cs);
+ 	xtables_free_opts(1);
+ 
+ /*	if (verbose > 1)
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index 575fb320dc408..aeae33c38512a 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -319,7 +319,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
+ 		exit(1);
+ 	}
+ 
+-	nft_clear_iptables_command_state(&cs);
++	h->ops->clear_cs(&cs);
+ 
+ 	if (h->family == AF_INET) {
+ 		free(args.s.addr.v4);
+diff --git a/iptables/xtables.c b/iptables/xtables.c
+index 3c7b3fc45b6f6..250dacffdf49d 100644
+--- a/iptables/xtables.c
++++ b/iptables/xtables.c
+@@ -1051,7 +1051,7 @@ int do_commandx(struct nft_handle *h, int argc, char *argv[], char **table,
+ 
+ 	*table = p.table;
+ 
+-	nft_clear_iptables_command_state(&cs);
++	h->ops->clear_cs(&cs);
+ 
+ 	if (h->family == AF_INET) {
+ 		free(args.s.addr.v4);
+-- 
+2.40.0
+
diff --git a/SOURCES/0106-iptables-Properly-clear-iptables_command_state-objec.patch b/SOURCES/0106-iptables-Properly-clear-iptables_command_state-objec.patch
new file mode 100644
index 0000000..ae9b25d
--- /dev/null
+++ b/SOURCES/0106-iptables-Properly-clear-iptables_command_state-objec.patch
@@ -0,0 +1,75 @@
+From d5391d8f96dffaaaf665233f0c2349455e2fc848 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 25 Nov 2022 21:44:39 +0100
+Subject: [PATCH] iptables: Properly clear iptables_command_state object
+
+When adding a rule with a target which defines a udata_size, valgrind
+prints:
+
+8 bytes in 1 blocks are definitely lost in loss record 1 of 1
+   at 0x484659F: calloc (vg_replace_malloc.c:1328)
+   by 0x486B128: xtables_calloc (xtables.c:434)
+   by 0x1128B4: xs_init_target (xshared.c:238)
+   by 0x113CD3: command_jump (xshared.c:877)
+   by 0x114969: do_parse (xshared.c:1644)
+   by 0x10EEB9: do_command4 (iptables.c:691)
+   by 0x10E45B: iptables_main (iptables-standalone.c:59)
+   by 0x49A2349: (below main) (in /lib64/libc.so.6)
+
+It is not sufficient to free cs.target->t, so call
+xtables_clear_iptables_command_state() which takes care of all the
+details.
+
+Fixes: 2dba676b68ef8 ("extensions: support for per-extension instance "global" variable space")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 8bee0db39f7553589c2cec58cc92ed2eafd2eb57)
+---
+ iptables/ip6tables.c | 3 +--
+ iptables/iptables.c  | 3 +--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
+index 897f30d5ef4b0..a0b7d4302a976 100644
+--- a/iptables/ip6tables.c
++++ b/iptables/ip6tables.c
+@@ -1559,7 +1559,6 @@ int do_command6(int argc, char *argv[], char **table,
+ 			xtables_find_target(cs.jumpto, XTF_LOAD_MUST_SUCCEED);
+ 		} else {
+ 			e = generate_entry(&cs.fw6, cs.matches, cs.target->t);
+-			free(cs.target->t);
+ 		}
+ 	}
+ 
+@@ -1658,7 +1657,7 @@ int do_command6(int argc, char *argv[], char **table,
+ 	if (verbose > 1)
+ 		dump_entries6(*handle);
+ 
+-	xtables_rule_matches_free(&cs.matches);
++	xtables_clear_iptables_command_state(&cs);
+ 
+ 	if (e != NULL) {
+ 		free(e);
+diff --git a/iptables/iptables.c b/iptables/iptables.c
+index 9964d14ed8195..b519fb59cc071 100644
+--- a/iptables/iptables.c
++++ b/iptables/iptables.c
+@@ -1552,7 +1552,6 @@ int do_command4(int argc, char *argv[], char **table,
+ 			xtables_find_target(cs.jumpto, XTF_LOAD_MUST_SUCCEED);
+ 		} else {
+ 			e = generate_entry(&cs.fw, cs.matches, cs.target->t);
+-			free(cs.target->t);
+ 		}
+ 	}
+ 
+@@ -1651,7 +1650,7 @@ int do_command4(int argc, char *argv[], char **table,
+ 	if (verbose > 1)
+ 		dump_entries(*handle);
+ 
+-	xtables_rule_matches_free(&cs.matches);
++	xtables_clear_iptables_command_state(&cs);
+ 
+ 	if (e != NULL) {
+ 		free(e);
+-- 
+2.40.0
+
diff --git a/SOURCES/0107-libiptc-Eliminate-garbage-access.patch b/SOURCES/0107-libiptc-Eliminate-garbage-access.patch
new file mode 100644
index 0000000..25c5a16
--- /dev/null
+++ b/SOURCES/0107-libiptc-Eliminate-garbage-access.patch
@@ -0,0 +1,47 @@
+From f946cee2f81140677b89d3da334f1b3b709d1109 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 30 Nov 2022 20:03:30 +0100
+Subject: [PATCH] libiptc: Eliminate garbage access
+
+When adding a rule, valgrind prints:
+
+Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s)
+   at 0x4A8165A: setsockopt (in /lib64/libc.so.6)
+   by 0x4857A48: iptc_commit (libiptc.c:2676)
+   by 0x10E4BB: iptables_main (iptables-standalone.c:61)
+   by 0x49A3349: (below main) (in /lib64/libc.so.6)
+ Address 0x4b63788 is 40 bytes inside a block of size 1,448 alloc'd
+   at 0x484659F: calloc (vg_replace_malloc.c:1328)
+   by 0x4857654: iptc_commit (libiptc.c:2564)
+   by 0x10E4BB: iptables_main (iptables-standalone.c:61)
+   by 0x49A3349: (below main) (in /lib64/libc.so.6)
+
+This is because repl->counters is not initialized upon allocation. Since
+the field is an array, make use of calloc() which implicitly does the
+initialization.
+
+Fixes: e37c0dc100c51 ("Revert the recent addition of memset()'s to TC_COMMIT. One of them is bogus and the other one needs more investigation to why valgrind is complaining.")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 39a2aa8cbfc99f4a75dfc0786a80ced90952ab29)
+---
+ libiptc/libiptc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c
+index 56bb75e5c3bef..157fbc4b72ebc 100644
+--- a/libiptc/libiptc.c
++++ b/libiptc/libiptc.c
+@@ -2554,8 +2554,8 @@ TC_COMMIT(struct xtc_handle *handle)
+ 			+ sizeof(STRUCT_COUNTERS) * new_number;
+ 
+ 	/* These are the old counters we will get from kernel */
+-	repl->counters = malloc(sizeof(STRUCT_COUNTERS)
+-				* handle->info.num_entries);
++	repl->counters = calloc(handle->info.num_entries,
++				sizeof(STRUCT_COUNTERS));
+ 	if (!repl->counters) {
+ 		errno = ENOMEM;
+ 		goto out_free_repl;
+-- 
+2.40.0
+
diff --git a/SOURCES/0108-ebtables-Fix-MAC-address-match-translation.patch b/SOURCES/0108-ebtables-Fix-MAC-address-match-translation.patch
new file mode 100644
index 0000000..0c12ed8
--- /dev/null
+++ b/SOURCES/0108-ebtables-Fix-MAC-address-match-translation.patch
@@ -0,0 +1,63 @@
+From 37e59c5df0e7cdd9f7e4673248abd92cc02d569c Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 1 Dec 2022 13:03:49 +0100
+Subject: [PATCH] ebtables: Fix MAC address match translation
+
+If a mask was present, ebtables-translate would emit illegal syntax.
+
+Fixes: 5e2b473a64bc7 ("xtables-compat: extend generic tests for masks and wildcards")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 39589b3edb7c0ea3e64777c7f4cdbf45be55ce53)
+
+Conflicts:
+	extensions/generic.txlate
+-> Adjusted to missing commit 09d63e818ae0d
+   ("extensions: change expected output for new format")
+-> Adjust to missing commit 023dd2c515be6
+   ("libxtables: xt_xlate_add() to take care of spacing").
+---
+ extensions/generic.txlate | 2 +-
+ iptables/nft-bridge.c     | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/extensions/generic.txlate b/extensions/generic.txlate
+index 6779d6f86dec8..44b84e3b23515 100644
+--- a/extensions/generic.txlate
++++ b/extensions/generic.txlate
+@@ -65,7 +65,7 @@ ebtables-translate -A FORWARD ! -i iname --logical-in ilogname -o out+ --logical
+ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oifname "out*" meta obrname "lout*" ether daddr 01:02:03:04:de:af counter
+ 
+ ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
+-nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
++nft insert rule bridge filter INPUT ether type 0x800 ether daddr and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
+ 
+ ebtables-translate -I INPUT -p Length
+ nft insert rule bridge filter INPUT ether type < 0x0600 counter
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index fbed1616253a6..48bcda61cfb9c 100644
+--- a/iptables/nft-bridge.c
++++ b/iptables/nft-bridge.c
+@@ -863,17 +863,17 @@ static void nft_bridge_xlate_mac(struct xt_xlate *xl, const char *type, bool inv
+ 
+ 	xt_xlate_add(xl, "ether %s %s", type, invert ? "!= " : "");
+ 
+-	xlate_mac(xl, mac);
+-
+ 	if (memcmp(mask, one_msk, ETH_ALEN)) {
+ 		int i;
+-		xt_xlate_add(xl, " and ");
++		xt_xlate_add(xl, "and ");
+ 
+ 		xlate_mac(xl, mask);
+ 
+ 		xt_xlate_add(xl, " == %02x", mac[0] & mask[0]);
+ 		for (i=1; i < ETH_ALEN; i++)
+ 			xt_xlate_add(xl, ":%02x", mac[i] & mask[i]);
++	} else {
++		xlate_mac(xl, mac);
+ 	}
+ 
+ 	xt_xlate_add(xl, " ");
+-- 
+2.40.0
+
diff --git a/SOURCES/0109-nft-Fix-for-comparing-ifname-matches-against-nft-gen.patch b/SOURCES/0109-nft-Fix-for-comparing-ifname-matches-against-nft-gen.patch
new file mode 100644
index 0000000..6736899
--- /dev/null
+++ b/SOURCES/0109-nft-Fix-for-comparing-ifname-matches-against-nft-gen.patch
@@ -0,0 +1,33 @@
+From 169d4dd39aeeb9108810e95b6eb176b50701ff7e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 1 Dec 2022 13:09:48 +0100
+Subject: [PATCH] nft: Fix for comparing ifname matches against nft-generated
+ ones
+
+Since nft adds the interface name as fixed-size string of 16 bytes,
+filling a mask based on the length value will not match the mask nft
+set.
+
+Fixes: 652b98e793711 ("xtables-compat: fix wildcard detection")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit f200aca7ff7b6a0edbe9024f0543b3f58111c50e)
+---
+ iptables/nft-shared.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 075ad620250dc..14b04b24085a0 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -243,7 +243,7 @@ static void parse_ifname(const char *name, unsigned int len, char *dst, unsigned
+ 	memcpy(dst, name, len);
+ 	if (name[len - 1] == '\0') {
+ 		if (mask)
+-			memset(mask, 0xff, len);
++			memset(mask, 0xff, strlen(name) + 1);
+ 		return;
+ 	}
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0110-nft-Fix-match-generator-for-i.patch b/SOURCES/0110-nft-Fix-match-generator-for-i.patch
new file mode 100644
index 0000000..d86455d
--- /dev/null
+++ b/SOURCES/0110-nft-Fix-match-generator-for-i.patch
@@ -0,0 +1,52 @@
+From 7eb8f16deca37f85b2988204368051a4556b6228 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 1 Dec 2022 15:08:01 +0100
+Subject: [PATCH] nft: Fix match generator for '! -i +'
+
+It's actually nonsense since it will never match, but iptables accepts
+it and the resulting nftables rule must behave identically. Reuse the
+solution implemented into xtables-translate (by commit e179e87a1179e)
+and turn the above match into 'iifname INVAL/D'.
+
+The commit this fixes merely ignored the fact that "any interface" match
+might be inverted.
+
+Fixes: 0a8635183edd0 ("xtables-compat: ignore '+' interface name")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5baa4279264bb4ab93c6e80b4887f2bd29691446)
+
+Conflicts:
+	iptables/nft-shared.c
+-> Adjusted to missing commit 7e38890c6b4fb
+   ("nft: prepare for dynamic register allocation").
+---
+ iptables/nft-shared.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 14b04b24085a0..8e005ed3b5818 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -143,6 +143,9 @@ void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op)
+ 	if (iface[iface_len - 1] == '+') {
+ 		if (iface_len > 1)
+ 			add_cmp_ptr(r, op, iface, iface_len - 1);
++		else if (op != NFT_CMP_EQ)
++			add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D",
++				    strlen("INVAL/D") + 1);
+ 	} else
+ 		add_cmp_ptr(r, op, iface, iface_len + 1);
+ }
+@@ -157,6 +160,9 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
+ 	if (iface[iface_len - 1] == '+') {
+ 		if (iface_len > 1)
+ 			add_cmp_ptr(r, op, iface, iface_len - 1);
++		else if (op != NFT_CMP_EQ)
++			add_cmp_ptr(r, NFT_CMP_EQ, "INVAL/D",
++				    strlen("INVAL/D") + 1);
+ 	} else
+ 		add_cmp_ptr(r, op, iface, iface_len + 1);
+ }
+-- 
+2.40.0
+
diff --git a/SOURCES/0111-xtables-translate-Fix-for-interfaces-with-asterisk-m.patch b/SOURCES/0111-xtables-translate-Fix-for-interfaces-with-asterisk-m.patch
new file mode 100644
index 0000000..a80d175
--- /dev/null
+++ b/SOURCES/0111-xtables-translate-Fix-for-interfaces-with-asterisk-m.patch
@@ -0,0 +1,74 @@
+From 0d08235024c951cf0f563562cbeaee82d8c7321c Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 1 Dec 2022 15:16:43 +0100
+Subject: [PATCH] xtables-translate: Fix for interfaces with asterisk
+ mid-string
+
+For nft, asterisk is special at end of the interface name only. Escaping
+it mid-string makes the escape char part of the interface name, so avoid
+this.
+
+In the test case, also drop the ticks around interface names in
+*-translate command - since there's no shell involved which would eat
+them, they become part of the interface name.
+
+Fixes: e179e87a1179e ("xtables-translate: Fix for interface name corner-cases")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ba1c0fe89eb56f8bf25f9165f2e5dc366ea0118c)
+
+Conflicts:
+	extensions/generic.txlate
+-> Adjusted to missing commit 09d63e818ae0d
+   ("extensions: change expected output for new format").
+---
+ extensions/generic.txlate    | 14 +++++++-------
+ iptables/xtables-translate.c |  4 +++-
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/extensions/generic.txlate b/extensions/generic.txlate
+index 44b84e3b23515..0316c1dd3cc2b 100644
+--- a/extensions/generic.txlate
++++ b/extensions/generic.txlate
+@@ -74,17 +74,17 @@ ebtables-translate -I INPUT -p ! Length
+ nft insert rule bridge filter INPUT ether type >= 0x0600 counter
+ 
+ # asterisk is not special in iptables and it is even a valid interface name
+-iptables-translate -A FORWARD -i '*' -o 'eth*foo'
+-nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
++iptables-translate -A FORWARD -i * -o eth*foo
++nft add rule ip filter FORWARD iifname "\*" oifname "eth*foo" counter
+ 
+-# escape all asterisks but translate only the first plus character
+-iptables-translate -A FORWARD -i 'eth*foo*+' -o 'eth++'
+-nft add rule ip filter FORWARD iifname "eth\*foo\**" oifname "eth+*" counter
++# escape only suffix asterisk and translate only the last plus character
++iptables-translate -A FORWARD -i eth*foo*+ -o eth++
++nft add rule ip filter FORWARD iifname "eth*foo**" oifname "eth+*" counter
+ 
+ # skip for always matching interface names
+-iptables-translate -A FORWARD -i '+'
++iptables-translate -A FORWARD -i +
+ nft add rule ip filter FORWARD counter
+ 
+ # match against invalid interface name to simulate never matching rule
+-iptables-translate -A FORWARD ! -i '+'
++iptables-translate -A FORWARD ! -i +
+ nft add rule ip filter FORWARD iifname "INVAL/D" counter
+diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
+index aeae33c38512a..5f5e314dc33d0 100644
+--- a/iptables/xtables-translate.c
++++ b/iptables/xtables-translate.c
+@@ -41,7 +41,9 @@ void xlate_ifname(struct xt_xlate *xl, const char *nftmeta, const char *ifname,
+ 	for (i = 0, j = 0; i < ifaclen + 1; i++, j++) {
+ 		switch (ifname[i]) {
+ 		case '*':
+-			iface[j++] = '\\';
++			/* asterisk is non-special mid-string */
++			if (i == ifaclen - 1)
++				iface[j++] = '\\';
+ 			/* fall through */
+ 		default:
+ 			iface[j] = ifname[i];
+-- 
+2.40.0
+
diff --git a/SOURCES/0112-Drop-libiptc-linux_stddef.h.patch b/SOURCES/0112-Drop-libiptc-linux_stddef.h.patch
new file mode 100644
index 0000000..22ec05f
--- /dev/null
+++ b/SOURCES/0112-Drop-libiptc-linux_stddef.h.patch
@@ -0,0 +1,63 @@
+From f22984ed9aec54dad7fa5c1953f8d088ec56c002 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 3 Dec 2022 22:45:59 +0100
+Subject: [PATCH] Drop libiptc/linux_stddef.h
+
+This header was never included anywhere.
+
+Fixes: aae69bed01982 ("complete libiptc rewrite.  Time to load 10k rules goes down from 2.20 minutes to 1.255 seconds (!).  Might still contain bugs, use with caution.")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 53153775b08f830b940d04efbc7b38bc40aaa4b3)
+---
+ libiptc/linux_stddef.h | 39 ---------------------------------------
+ 1 file changed, 39 deletions(-)
+ delete mode 100644 libiptc/linux_stddef.h
+
+diff --git a/libiptc/linux_stddef.h b/libiptc/linux_stddef.h
+deleted file mode 100644
+index 56416f104ecfc..0000000000000
+--- a/libiptc/linux_stddef.h
++++ /dev/null
+@@ -1,39 +0,0 @@
+-#ifndef _LINUX_STDDEF_H
+-#define _LINUX_STDDEF_H
+-
+-#undef NULL
+-#if defined(__cplusplus)
+-#define NULL 0
+-#else
+-#define NULL ((void *)0)
+-#endif
+-
+-#undef offsetof
+-#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+-
+-
+-/**
+- * container_of - cast a member of a structure out to the containing structure
+- *
+- * @ptr:	the pointer to the member.
+- * @type:	the type of the container struct this is embedded in.
+- * @member:	the name of the member within the struct.
+- *
+- */
+-#define container_of(ptr, type, member) ({			\
+-        const typeof( ((type *)0)->member ) *__mptr = (ptr);	\
+-        (type *)( (char *)__mptr - offsetof(type,member) );})
+-
+-/*
+- * Check at compile time that something is of a particular type.
+- * Always evaluates to 1 so you may use it easily in comparisons.
+- */
+-#define typecheck(type,x) \
+-({	type __dummy; \
+-	typeof(x) __dummy2; \
+-	(void)(&__dummy == &__dummy2); \
+-	1; \
+-})
+-
+-
+-#endif
+-- 
+2.40.0
+
diff --git a/SOURCES/0113-include-Makefile-xtables-version.h-is-generated.patch b/SOURCES/0113-include-Makefile-xtables-version.h-is-generated.patch
new file mode 100644
index 0000000..411ad1b
--- /dev/null
+++ b/SOURCES/0113-include-Makefile-xtables-version.h-is-generated.patch
@@ -0,0 +1,41 @@
+From 8e9fbe24942ce70909e7f8d672972af949155e8e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 7 Dec 2022 17:23:12 +0100
+Subject: [PATCH] include/Makefile: xtables-version.h is generated
+
+List it in nodist_include_HEADERS so it is installed but not
+distributed - configure generates it from xtables-version.h.in.
+
+While being at it, list xtables.h in plain include_HEADERS. It doesn't
+sit in a sub-dir, so the nobase prefix does not make a difference.
+
+Fixes: df60a301bf24c ("build: separate AC variable replacements from xtables.h")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 19f03b7a2a21f22a53b6b0d2f542062986e2f807)
+---
+ include/Makefile.am | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/Makefile.am b/include/Makefile.am
+index e69512092253a..36e0f347aa6be 100644
+--- a/include/Makefile.am
++++ b/include/Makefile.am
+@@ -1,12 +1,12 @@
+ # -*- Makefile -*-
+ 
+-include_HEADERS =
+-nobase_include_HEADERS = xtables.h xtables-version.h
++include_HEADERS = xtables.h
++nodist_include_HEADERS = xtables-version.h
+ 
+ if ENABLE_LIBIPQ
+ include_HEADERS += libipq/libipq.h
+ endif
+ 
+-nobase_include_HEADERS += \
++nobase_include_HEADERS = \
+ 	libiptc/ipt_kernel_headers.h libiptc/libiptc.h \
+ 	libiptc/libip6tc.h libiptc/libxtc.h libiptc/xtcshared.h
+-- 
+2.40.0
+
diff --git a/SOURCES/0114-arptables-Check-the-mandatory-ar_pln-match.patch b/SOURCES/0114-arptables-Check-the-mandatory-ar_pln-match.patch
new file mode 100644
index 0000000..4a69ac9
--- /dev/null
+++ b/SOURCES/0114-arptables-Check-the-mandatory-ar_pln-match.patch
@@ -0,0 +1,44 @@
+From 918e196100fae784b836c04f0a4b07230be9a4ac Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 15 Dec 2022 16:06:11 +0100
+Subject: [PATCH] arptables: Check the mandatory ar_pln match
+
+This match is added by nft_arp_add() to every rule with same value, so
+when parsing just check it is as expected and otherwise ignore it. This
+allows to treat matches on all other offsets/lengths as error.
+
+Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit f2c5e52863ea48838e9b9246ed94419053673b88)
+---
+ iptables/nft-arp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index b90f53990fd4f..398face687fbf 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -219,7 +219,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
+ 	struct arpt_entry *fw = &cs->arp;
+ 	struct in_addr addr;
+ 	uint16_t ar_hrd, ar_pro, ar_op;
+-	uint8_t ar_hln;
++	uint8_t ar_hln, ar_pln;
+ 	bool inv;
+ 
+ 	switch (ctx->payload.offset) {
+@@ -251,6 +251,11 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
+ 		if (inv)
+ 			fw->arp.invflags |= IPT_INV_ARPOP;
+ 		break;
++	case offsetof(struct arphdr, ar_pln):
++		get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv);
++		if (ar_pln != 4 || inv)
++			ctx->errmsg = "unexpected ARP protocol length match";
++		break;
+ 	default:
+ 		if (ctx->payload.offset == sizeof(struct arphdr)) {
+ 			if (nft_arp_parse_devaddr(ctx, e, &fw->arp.src_devaddr))
+-- 
+2.40.0
+
diff --git a/SOURCES/0115-gitignore-Ignore-utils-nfsynproxy.patch b/SOURCES/0115-gitignore-Ignore-utils-nfsynproxy.patch
new file mode 100644
index 0000000..bd68923
--- /dev/null
+++ b/SOURCES/0115-gitignore-Ignore-utils-nfsynproxy.patch
@@ -0,0 +1,24 @@
+From 441541709e8e994c487d91cf8a7761232dc1bd5e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 22 Dec 2022 17:23:49 +0100
+Subject: [PATCH] gitignore: Ignore utils/nfsynproxy
+
+Fixes: 9e6928f037823 ("utils: add nfsynproxy tool")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 567f6ba105302f57ccb6789dbcfc9e1e2657809a)
+---
+ utils/.gitignore | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/utils/.gitignore b/utils/.gitignore
+index 6300812b1701b..e508bb3270c4f 100644
+--- a/utils/.gitignore
++++ b/utils/.gitignore
+@@ -2,3 +2,4 @@
+ /nfnl_osf.8
+ /nfbpf_compile
+ /nfbpf_compile.8
++/nfsynproxy
+-- 
+2.40.0
+
diff --git a/SOURCES/0116-etc-Drop-xtables.conf.patch b/SOURCES/0116-etc-Drop-xtables.conf.patch
new file mode 100644
index 0000000..e29e96a
--- /dev/null
+++ b/SOURCES/0116-etc-Drop-xtables.conf.patch
@@ -0,0 +1,118 @@
+From 3795aaa59056509193150ccd1357dd2230eff6fe Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 17 Jan 2023 16:38:43 +0100
+Subject: [PATCH] etc: Drop xtables.conf
+
+The file is not used since the commit this one fixes. Also it wasn't
+installed until recently, when commit 3822a992bc277 ("Makefile: Fix for
+'make distcheck'") added it in the wrong spot in an attempt to reduce
+differences between tarballs generated by 'make tarball' and 'make
+dist'.
+
+While being at it, drop stale xtables_config_main() prototype from
+xtables-multi.h.
+
+Fixes: 06fd5e46d46f7 ("xtables: Drop support for /etc/xtables.conf")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ca8fb6c21b298b3d96db2bfbf9c74d393bdd4728)
+---
+ etc/xtables.conf         | 74 ----------------------------------------
+ iptables/xtables-multi.h |  1 -
+ 2 files changed, 75 deletions(-)
+ delete mode 100644 etc/xtables.conf
+
+diff --git a/etc/xtables.conf b/etc/xtables.conf
+deleted file mode 100644
+index 3c54ced043d82..0000000000000
+--- a/etc/xtables.conf
++++ /dev/null
+@@ -1,74 +0,0 @@
+-family ipv4 {
+-	table raw {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -300
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -300
+-	}
+-
+-	table mangle {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -150
+-		chain INPUT hook NF_INET_LOCAL_IN prio -150
+-		chain FORWARD hook NF_INET_FORWARD prio -150
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -150
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio -150
+-	}
+-
+-	table filter {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 0
+-		chain FORWARD hook NF_INET_FORWARD prio 0
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 0
+-	}
+-
+-	table nat {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -100
+-		chain INPUT hook NF_INET_LOCAL_IN prio 100
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -100
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio 100
+-	}
+-
+-	table security {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 50
+-		chain FORWARD hook NF_INET_FORWARD prio 50
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 50
+-	}
+-}
+-
+-family ipv6 {
+-	table raw {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -300
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -300
+-	}
+-
+-	table mangle {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -150
+-		chain INPUT hook NF_INET_LOCAL_IN prio -150
+-		chain FORWARD hook NF_INET_FORWARD prio -150
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -150
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio -150
+-	}
+-
+-	table filter {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 0
+-		chain FORWARD hook NF_INET_FORWARD prio 0
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 0
+-	}
+-
+-	table nat {
+-		chain PREROUTING hook NF_INET_PRE_ROUTING prio -100
+-		chain INPUT hook NF_INET_LOCAL_IN prio 100
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio -100
+-		chain POSTROUTING hook NF_INET_POST_ROUTING prio 100
+-	}
+-
+-	table security {
+-		chain INPUT hook NF_INET_LOCAL_IN prio 50
+-		chain FORWARD hook NF_INET_FORWARD prio 50
+-		chain OUTPUT hook NF_INET_LOCAL_OUT prio 50
+-	}
+-}
+-
+-family arp {
+-	table filter {
+-		chain INPUT hook NF_ARP_IN prio 0
+-		chain OUTPUT hook NF_ARP_OUT prio 0
+-	}
+-}
+diff --git a/iptables/xtables-multi.h b/iptables/xtables-multi.h
+index 0fedb430e1a28..fe14efc48cb13 100644
+--- a/iptables/xtables-multi.h
++++ b/iptables/xtables-multi.h
+@@ -20,7 +20,6 @@ extern int xtables_arp_save_main(int, char **);
+ extern int xtables_eb_main(int, char **);
+ extern int xtables_eb_restore_main(int, char **);
+ extern int xtables_eb_save_main(int, char **);
+-extern int xtables_config_main(int, char **);
+ extern int xtables_monitor_main(int, char **);
+ #endif
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0117-Proper-fix-for-unknown-argument-error-message.patch b/SOURCES/0117-Proper-fix-for-unknown-argument-error-message.patch
new file mode 100644
index 0000000..4dc2073
--- /dev/null
+++ b/SOURCES/0117-Proper-fix-for-unknown-argument-error-message.patch
@@ -0,0 +1,163 @@
+From 72a17e09b38f9f8496d8e8f1a615b3759cfc905c Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 25 Jan 2023 01:51:43 +0100
+Subject: [PATCH] Proper fix for "unknown argument" error message
+
+While commit 1b8210f848631 kind of fixed the corner-case of invalid
+short-options packed with others, it broke error reporting for
+long-options. Revert it and deploy a proper solution:
+
+When passing an invalid short-option, e.g. 'iptables -vaL', getopt_long
+sets the variable 'optopt' to the invalid character's value. Use it for
+reporting instead of optind if set.
+
+To distinguish between invalid options and missing option arguments,
+ebtables-translate optstring needs adjustment.
+
+Fixes: 1b8210f848631 ("ebtables: Fix error message for invalid parameters")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit d6eb6a9fd3878ce4fa01f8d4127f1735988bd07b)
+
+Conflicts:
+	iptables/xtables-eb.c
+-> Adjust to missing commits 65b150ae382a8
+   ("xshared: Store optstring in xtables_globals") and fd64a5871b671
+   ("libxtables: Drop xtables_globals 'optstring' field").
+---
+ .../testcases/iptables/0009-unknown-arg_0     | 31 +++++++++++++++++++
+ iptables/xshared.c                            |  9 ++++--
+ iptables/xtables-eb-translate.c               |  8 ++---
+ iptables/xtables-eb.c                         | 19 +++++++-----
+ 4 files changed, 51 insertions(+), 16 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/iptables/0009-unknown-arg_0
+
+diff --git a/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0 b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0
+new file mode 100755
+index 0000000000000..ac6e743966196
+--- /dev/null
++++ b/iptables/tests/shell/testcases/iptables/0009-unknown-arg_0
+@@ -0,0 +1,31 @@
++#!/bin/bash
++
++rc=0
++
++check() {
++	local cmd="$1"
++	local msg="$2"
++
++	$XT_MULTI $cmd 2>&1 | grep -q "$msg" || {
++		echo "cmd: $XT_MULTI $1"
++		echo "exp: $msg"
++		echo "res: $($XT_MULTI $cmd 2>&1)"
++		rc=1
++	}
++}
++
++cmds="iptables ip6tables"
++[[ $XT_MULTI == *xtables-nft-multi ]] && {
++	cmds+=" ebtables"
++	cmds+=" iptables-translate"
++	cmds+=" ip6tables-translate"
++	cmds+=" ebtables-translate"
++}
++
++for cmd in $cmds; do
++	check "${cmd} --foo" 'unknown option "--foo"'
++	check "${cmd} -A" 'option "-A" requires an argument'
++	check "${cmd} -aL" 'unknown option "-a"'
++done
++
++exit $rc
+diff --git a/iptables/xshared.c b/iptables/xshared.c
+index 8de4fe4945279..0bd56604d14b6 100644
+--- a/iptables/xshared.c
++++ b/iptables/xshared.c
+@@ -177,9 +177,12 @@ int command_default(struct iptables_command_state *cs,
+ 	if (cs->c == ':')
+ 		xtables_error(PARAMETER_PROBLEM, "option \"%s\" "
+ 		              "requires an argument", cs->argv[optind-1]);
+-	if (cs->c == '?')
+-		xtables_error(PARAMETER_PROBLEM, "unknown option "
+-			      "\"%s\"", cs->argv[optind-1]);
++	if (cs->c == '?') {
++		char optoptstr[3] = {'-', optopt, '\0'};
++
++		xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"",
++			      optopt ? optoptstr : cs->argv[optind - 1]);
++	}
+ 	xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg);
+ }
+ 
+diff --git a/iptables/xtables-eb-translate.c b/iptables/xtables-eb-translate.c
+index 96b2730fa97ed..efdddb20edfca 100644
+--- a/iptables/xtables-eb-translate.c
++++ b/iptables/xtables-eb-translate.c
+@@ -218,7 +218,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char
+ 	printf("nft ");
+ 	/* Getopt saves the day */
+ 	while ((c = getopt_long(argc, argv,
+-	   "-A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
++	   "-:A:D:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
+ 		cs.c = c;
+ 		cs.invert = ebt_invert;
+ 		switch (c) {
+@@ -505,11 +505,7 @@ static int do_commandeb_xlate(struct nft_handle *h, int argc, char *argv[], char
+ 			continue;
+ 		default:
+ 			ebt_check_inverse2(optarg, argc, argv);
+-
+-			if (ebt_command_default(&cs))
+-				xtables_error(PARAMETER_PROBLEM,
+-					      "Unknown argument: '%s'",
+-					      argv[optind - 1]);
++			ebt_command_default(&cs);
+ 
+ 			if (command != 'A' && command != 'I' &&
+ 			    command != 'D')
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index d07adad2d73c3..b7f9b3d9c511f 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -714,7 +714,16 @@ int ebt_command_default(struct iptables_command_state *cs)
+ 			return 0;
+ 		}
+ 	}
+-	return 1;
++	if (cs->c == ':')
++		xtables_error(PARAMETER_PROBLEM, "option \"%s\" "
++		              "requires an argument", cs->argv[optind - 1]);
++	if (cs->c == '?') {
++		char optoptstr[3] = {'-', optopt, '\0'};
++
++		xtables_error(PARAMETER_PROBLEM, "unknown option \"%s\"",
++			      optopt ? optoptstr : cs->argv[optind - 1]);
++	}
++	xtables_error(PARAMETER_PROBLEM, "Unknown arg \"%s\"", optarg);
+ }
+ 
+ int nft_init_eb(struct nft_handle *h, const char *pname)
+@@ -792,7 +801,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 
+ 	/* Getopt saves the day */
+ 	while ((c = getopt_long(argc, argv,
+-	   "-A:D:C:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
++	   "-:A:D:C:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
+ 		cs.c = c;
+ 		cs.invert = ebt_invert;
+ 		switch (c) {
+@@ -1143,11 +1152,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 			continue;
+ 		default:
+ 			ebt_check_inverse2(optarg, argc, argv);
+-
+-			if (ebt_command_default(&cs))
+-				xtables_error(PARAMETER_PROBLEM,
+-					      "Unknown argument: '%s'",
+-					      argv[optind]);
++			ebt_command_default(&cs);
+ 
+ 			if (command != 'A' && command != 'I' &&
+ 			    command != 'D' && command != 'C')
+-- 
+2.40.0
+
diff --git a/SOURCES/0118-ebtables-Refuse-unselected-targets-options.patch b/SOURCES/0118-ebtables-Refuse-unselected-targets-options.patch
new file mode 100644
index 0000000..02aa647
--- /dev/null
+++ b/SOURCES/0118-ebtables-Refuse-unselected-targets-options.patch
@@ -0,0 +1,239 @@
+From 715c128634fc2ff0c7702db8f79783226a0c2fac Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 25 Jan 2023 02:01:56 +0100
+Subject: [PATCH] ebtables: Refuse unselected targets' options
+
+Unlike legacy, ebtables-nft would allow e.g.:
+
+| -t nat -A PREROUTING --to-dst fe:ed:00:00:ba:be
+
+While the result is correct, it may mislead users into believing
+multiple targets are possible per rule. Better follow legacy's behaviour
+and reject target options unless they have been "enabled" by a previous
+'-j' option.
+
+To achieve this, one needs to distinguish targets from watchers also
+attached to 'xtables_targets' and otherwise behaving like regular
+matches. Introduce XTABLES_EXT_WATCHER to mark the two.
+
+The above works already, but error messages are misleading when using
+the now unsupported syntax since target options have been merged
+already. Solve this by not pre-loading the targets at all, code will
+just fall back to loading ad '-j' parsing time as iptables does.
+
+Note how this also fixes for 'counter' statement being in wrong position
+of ebtables-translate output.
+
+Fixes: fe97f60e5d2a9 ("ebtables-compat: add watchers support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 27d37863a486352511dac385bde8f3d20526be5b)
+
+Conflicts:
+	extensions/libebt_dnat.txlate
+	extensions/libebt_mark.txlate
+	extensions/libebt_snat.txlate
+-> Adjusted to missing commit 09d63e818ae0d
+   ("extensions: change expected output for new format").
+---
+ extensions/libebt_dnat.txlate                 | 12 ++++----
+ extensions/libebt_log.c                       |  1 +
+ extensions/libebt_mark.txlate                 | 16 +++++-----
+ extensions/libebt_nflog.c                     |  1 +
+ extensions/libebt_snat.txlate                 |  8 ++---
+ include/xtables.h                             |  1 +
+ .../ebtables/0002-ebtables-save-restore_0     |  4 +--
+ iptables/xtables-eb.c                         | 29 +++++++------------
+ 8 files changed, 33 insertions(+), 39 deletions(-)
+
+diff --git a/extensions/libebt_dnat.txlate b/extensions/libebt_dnat.txlate
+index 2652dd55b2644..d99396a513b8d 100644
+--- a/extensions/libebt_dnat.txlate
++++ b/extensions/libebt_dnat.txlate
+@@ -1,8 +1,8 @@
+-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff
+-nft add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter
++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff
++nft add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept
+ 
+-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT
+-nft add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff accept counter
++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target ACCEPT
++nft add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff accept
+ 
+-ebtables-translate -t nat -A PREROUTING -i someport --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE
+-nft add rule bridge nat PREROUTING iifname "someport" ether daddr set de:ad:0:be:ee:ff continue counter
++ebtables-translate -t nat -A PREROUTING -i someport -j dnat --to-dst de:ad:00:be:ee:ff --dnat-target CONTINUE
++nft add rule bridge nat PREROUTING iifname "someport" counter ether daddr set de:ad:0:be:ee:ff continue
+diff --git a/extensions/libebt_log.c b/extensions/libebt_log.c
+index 8858cf0e22c00..9f95bf77d9288 100644
+--- a/extensions/libebt_log.c
++++ b/extensions/libebt_log.c
+@@ -198,6 +198,7 @@ static int brlog_xlate(struct xt_xlate *xl,
+ static struct xtables_target brlog_target = {
+ 	.name		= "log",
+ 	.revision	= 0,
++	.ext_flags	= XTABLES_EXT_WATCHER,
+ 	.version	= XTABLES_VERSION,
+ 	.family		= NFPROTO_BRIDGE,
+ 	.size		= XT_ALIGN(sizeof(struct ebt_log_info)),
+diff --git a/extensions/libebt_mark.txlate b/extensions/libebt_mark.txlate
+index 7529302d9a444..9695139655055 100644
+--- a/extensions/libebt_mark.txlate
++++ b/extensions/libebt_mark.txlate
+@@ -1,11 +1,11 @@
+-ebtables-translate -A INPUT --mark-set 42
+-nft add rule bridge filter INPUT meta mark set 0x2a accept counter
++ebtables-translate -A INPUT -j mark --mark-set 42
++nft add rule bridge filter INPUT counter meta mark set 0x2a accept
+ 
+-ebtables-translate -A INPUT --mark-or 42 --mark-target RETURN
+-nft add rule bridge filter INPUT meta mark set meta mark or 0x2a return counter
++ebtables-translate -A INPUT -j mark --mark-or 42 --mark-target RETURN
++nft add rule bridge filter INPUT counter meta mark set meta mark or 0x2a return
+ 
+-ebtables-translate -A INPUT --mark-and 42 --mark-target ACCEPT
+-nft add rule bridge filter INPUT meta mark set meta mark and 0x2a accept counter
++ebtables-translate -A INPUT -j mark --mark-and 42 --mark-target ACCEPT
++nft add rule bridge filter INPUT counter meta mark set meta mark and 0x2a accept
+ 
+-ebtables-translate -A INPUT --mark-xor 42 --mark-target DROP
+-nft add rule bridge filter INPUT meta mark set meta mark xor 0x2a drop counter
++ebtables-translate -A INPUT -j mark --mark-xor 42 --mark-target DROP
++nft add rule bridge filter INPUT counter meta mark set meta mark xor 0x2a drop
+diff --git a/extensions/libebt_nflog.c b/extensions/libebt_nflog.c
+index 9801f358c81b1..23c9eed51d8e9 100644
+--- a/extensions/libebt_nflog.c
++++ b/extensions/libebt_nflog.c
+@@ -150,6 +150,7 @@ static int brnflog_xlate(struct xt_xlate *xl,
+ static struct xtables_target brnflog_watcher = {
+ 	.name		= "nflog",
+ 	.revision	= 0,
++	.ext_flags	= XTABLES_EXT_WATCHER,
+ 	.version	= XTABLES_VERSION,
+ 	.family		= NFPROTO_BRIDGE,
+ 	.size		= XT_ALIGN(sizeof(struct ebt_nflog_info)),
+diff --git a/extensions/libebt_snat.txlate b/extensions/libebt_snat.txlate
+index 0d84602466c23..6b2250647daf3 100644
+--- a/extensions/libebt_snat.txlate
++++ b/extensions/libebt_snat.txlate
+@@ -1,5 +1,5 @@
+-ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ --to-source de:ad:00:be:ee:ff
+-nft add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 ether saddr set de:ad:0:be:ee:ff accept counter
++ebtables-translate -t nat -A POSTROUTING -s 0:0:0:0:0:0 -o someport+ -j snat --to-source de:ad:00:be:ee:ff
++nft add rule bridge nat POSTROUTING oifname "someport*" ether saddr 00:00:00:00:00:00 counter ether saddr set de:ad:0:be:ee:ff accept
+ 
+-ebtables-translate -t nat -A POSTROUTING -o someport --to-src de:ad:00:be:ee:ff --snat-target CONTINUE
+-nft add rule bridge nat POSTROUTING oifname "someport" ether saddr set de:ad:0:be:ee:ff continue counter
++ebtables-translate -t nat -A POSTROUTING -o someport -j snat --to-src de:ad:00:be:ee:ff --snat-target CONTINUE
++nft add rule bridge nat POSTROUTING oifname "someport" counter ether saddr set de:ad:0:be:ee:ff continue
+diff --git a/include/xtables.h b/include/xtables.h
+index 3c0d0f78e8d1a..58ad4270bcaaa 100644
+--- a/include/xtables.h
++++ b/include/xtables.h
+@@ -203,6 +203,7 @@ struct xtables_lmap {
+ 
+ enum xtables_ext_flags {
+ 	XTABLES_EXT_ALIAS = 1 << 0,
++	XTABLES_EXT_WATCHER = 1 << 1,
+ };
+ 
+ struct xt_xlate;
+diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+index a4fc31548e323..05ac5bda66ff8 100755
+--- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
++++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
+@@ -38,7 +38,7 @@ $XT_MULTI ebtables -A foo -p IPv6 --ip6-proto tcp -j ACCEPT
+ 
+ $XT_MULTI ebtables -A foo --limit 100 --limit-burst 42 -j ACCEPT
+ $XT_MULTI ebtables -A foo --log
+-$XT_MULTI ebtables -A foo --mark-set 0x23 --mark-target ACCEPT
++$XT_MULTI ebtables -A foo -j mark --mark-set 0x23 --mark-target ACCEPT
+ $XT_MULTI ebtables -A foo --nflog
+ $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT
+ $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT
+@@ -53,7 +53,7 @@ $XT_MULTI ebtables -A FORWARD -j foo
+ $XT_MULTI ebtables -N bar
+ $XT_MULTI ebtables -P bar RETURN
+ 
+-$XT_MULTI ebtables -t nat -A PREROUTING --redirect-target ACCEPT
++$XT_MULTI ebtables -t nat -A PREROUTING -j redirect --redirect-target ACCEPT
+ #$XT_MULTI ebtables -t nat -A PREROUTING --to-src fe:ed:ba:be:00:01
+ 
+ $XT_MULTI ebtables -t nat -A OUTPUT -j ACCEPT
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index b7f9b3d9c511f..a3d659fb35e27 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -536,14 +536,14 @@ static void ebt_load_match(const char *name)
+ 		xtables_error(OTHER_PROBLEM, "Can't alloc memory");
+ }
+ 
+-static void __ebt_load_watcher(const char *name, const char *typename)
++static void ebt_load_watcher(const char *name)
+ {
+ 	struct xtables_target *watcher;
+ 	size_t size;
+ 
+ 	watcher = xtables_find_target(name, XTF_TRY_LOAD);
+ 	if (!watcher) {
+-		fprintf(stderr, "Unable to load %s %s\n", name, typename);
++		fprintf(stderr, "Unable to load %s watcher\n", name);
+ 		return;
+ 	}
+ 
+@@ -564,16 +564,6 @@ static void __ebt_load_watcher(const char *name, const char *typename)
+ 		xtables_error(OTHER_PROBLEM, "Can't alloc memory");
+ }
+ 
+-static void ebt_load_watcher(const char *name)
+-{
+-	return __ebt_load_watcher(name, "watcher");
+-}
+-
+-static void ebt_load_target(const char *name)
+-{
+-	return __ebt_load_watcher(name, "target");
+-}
+-
+ void ebt_load_match_extensions(void)
+ {
+ 	opts = ebt_original_options;
+@@ -590,13 +580,6 @@ void ebt_load_match_extensions(void)
+ 
+ 	ebt_load_watcher("log");
+ 	ebt_load_watcher("nflog");
+-
+-	ebt_load_target("mark");
+-	ebt_load_target("dnat");
+-	ebt_load_target("snat");
+-	ebt_load_target("arpreply");
+-	ebt_load_target("redirect");
+-	ebt_load_target("standard");
+ }
+ 
+ void ebt_add_match(struct xtables_match *m,
+@@ -707,6 +690,9 @@ int ebt_command_default(struct iptables_command_state *cs)
+ 
+ 	/* Is it a watcher option? */
+ 	for (t = xtables_targets; t; t = t->next) {
++		if (!(t->ext_flags & XTABLES_EXT_WATCHER))
++			continue;
++
+ 		if (t->parse &&
+ 		    t->parse(cs->c - t->option_offset, cs->argv,
+ 			     ebt_invert, &t->tflags, NULL, &t->t)) {
+@@ -799,6 +785,11 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
+ 	optind = 0;
+ 	opterr = false;
+ 
++	for (t = xtables_targets; t; t = t->next) {
++		t->tflags = 0;
++		t->used = 0;
++	}
++
+ 	/* Getopt saves the day */
+ 	while ((c = getopt_long(argc, argv,
+ 	   "-:A:D:C:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
+-- 
+2.40.0
+
diff --git a/SOURCES/0119-extensions-libebt_redirect-Fix-target-translation.patch b/SOURCES/0119-extensions-libebt_redirect-Fix-target-translation.patch
new file mode 100644
index 0000000..57ff7f9
--- /dev/null
+++ b/SOURCES/0119-extensions-libebt_redirect-Fix-target-translation.patch
@@ -0,0 +1,53 @@
+From 514ebcf9229744a18f58b431f6eb004b00e5abaf Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 31 Jan 2023 22:28:24 +0100
+Subject: [PATCH] extensions: libebt_redirect: Fix target translation
+
+While EBT_ACCEPT is the default verdict for ebtables targets, omitting
+it from translation implicitly converts it into 'continue'. Omit the
+non-default EBT_CONTINUE instead.
+
+Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit bb6b243c481f90f7dc4a0bd89187ee2bb823f1f6)
+
+Conflicts:
+	extensions/libebt_redirect.txlate
+-> Adjusted to missing commit 83604e7f7327b
+   ("xlate: get rid of escape_quotes").
+---
+ extensions/libebt_redirect.c      | 2 +-
+ extensions/libebt_redirect.txlate | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+ create mode 100644 extensions/libebt_redirect.txlate
+
+diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c
+index 4d4c7a02cea89..389f3ccb53f60 100644
+--- a/extensions/libebt_redirect.c
++++ b/extensions/libebt_redirect.c
+@@ -84,7 +84,7 @@ static int brredir_xlate(struct xt_xlate *xl,
+ 	const struct ebt_redirect_info *red = (const void*)params->target->data;
+ 
+ 	xt_xlate_add(xl, "meta set pkttype host");
+-	if (red->target != EBT_ACCEPT)
++	if (red->target != EBT_CONTINUE)
+ 		xt_xlate_add(xl, " %s ", brredir_verdict(red->target));
+ 	return 1;
+ }
+diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate
+new file mode 100644
+index 0000000000000..e750d438a790d
+--- /dev/null
++++ b/extensions/libebt_redirect.txlate
+@@ -0,0 +1,8 @@
++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect
++nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept
++
++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN
++nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return
++
++ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE
++nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host
+-- 
+2.40.0
+
diff --git a/SOURCES/0120-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch b/SOURCES/0120-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch
new file mode 100644
index 0000000..fd06a2d
--- /dev/null
+++ b/SOURCES/0120-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch
@@ -0,0 +1,53 @@
+From 96678b34102c5af97dcd4fde35472a77b47e71b4 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 31 Jan 2023 23:32:50 +0100
+Subject: [PATCH] extensions: libebt_redirect: Fix for wrong syntax in
+ translation
+
+Meta key comes before 'set' in meta statement.
+
+Fixes: 24ce7465056ae ("ebtables-compat: add redirect match extension")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 6d1263002c2a9fc6dfa59c764dee767a084d428d)
+
+Conflicts:
+	extensions/libebt_redirect.txlate
+-> Adjust to missing commit 83604e7f7327b
+   ("xlate: get rid of escape_quotes").
+---
+ extensions/libebt_redirect.c      | 2 +-
+ extensions/libebt_redirect.txlate | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/extensions/libebt_redirect.c b/extensions/libebt_redirect.c
+index 389f3ccb53f60..7821935e137aa 100644
+--- a/extensions/libebt_redirect.c
++++ b/extensions/libebt_redirect.c
+@@ -83,7 +83,7 @@ static int brredir_xlate(struct xt_xlate *xl,
+ {
+ 	const struct ebt_redirect_info *red = (const void*)params->target->data;
+ 
+-	xt_xlate_add(xl, "meta set pkttype host");
++	xt_xlate_add(xl, "meta pkttype set host");
+ 	if (red->target != EBT_CONTINUE)
+ 		xt_xlate_add(xl, " %s ", brredir_verdict(red->target));
+ 	return 1;
+diff --git a/extensions/libebt_redirect.txlate b/extensions/libebt_redirect.txlate
+index e750d438a790d..921e303f47037 100644
+--- a/extensions/libebt_redirect.txlate
++++ b/extensions/libebt_redirect.txlate
+@@ -1,8 +1,8 @@
+ ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect
+-nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host accept
++nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host accept
+ 
+ ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target RETURN
+-nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host return
++nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host return
+ 
+ ebtables-translate -t nat -A PREROUTING -d de:ad:00:00:be:ef -j redirect --redirect-target CONTINUE
+-nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta set pkttype host
++nft add rule bridge nat PREROUTING ether daddr de:ad:00:00:be:ef counter meta pkttype set host
+-- 
+2.40.0
+
diff --git a/SOURCES/0121-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch b/SOURCES/0121-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch
new file mode 100644
index 0000000..50c03cb
--- /dev/null
+++ b/SOURCES/0121-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch
@@ -0,0 +1,55 @@
+From bcf59827f2a6ab966c3719f1c02fdd67f3780f82 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 18:58:36 +0100
+Subject: [PATCH] extensions: libebt_ip: Do not use 'ip dscp' for translation
+
+Converting from TOS field match to DSCP one is irreversible, so replay
+testing is not possible. Use a raw payload expression to produce
+something that translates 1:1 back into an 'ip' match.
+
+Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 744c56bda974caaa274318d2825b3e43b55bf145)
+
+Conflicts:
+	extensions/libebt_ip.txlate
+-> Adjust to missing commit 09d63e818ae0d
+   ("extensions: change expected output for new format").
+---
+ extensions/libebt_ip.c      | 4 ++--
+ extensions/libebt_ip.txlate | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
+index acb9bfcdbbd9f..7b6fa4a2139d4 100644
+--- a/extensions/libebt_ip.c
++++ b/extensions/libebt_ip.c
+@@ -677,10 +677,10 @@ static int brip_xlate(struct xt_xlate *xl,
+ 	brip_xlate_nh(xl, info, EBT_IP_DEST);
+ 
+ 	if (info->bitmask & EBT_IP_TOS) {
+-		xt_xlate_add(xl, "ip dscp ");
++		xt_xlate_add(xl, "@nh,8,8 ");
+ 		if (info->invflags & EBT_IP_TOS)
+ 			xt_xlate_add(xl, "!= ");
+-		xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */
++		xt_xlate_add(xl, "0x%02x ", info->tos);
+ 	}
+ 	if (info->bitmask & EBT_IP_PROTO) {
+ 		struct protoent *pe;
+diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
+index b5882c342b047..5c766e1b743ea 100644
+--- a/extensions/libebt_ip.txlate
++++ b/extensions/libebt_ip.txlate
+@@ -5,7 +5,7 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
+ nft insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter
+ 
+ ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
+-nft insert rule bridge filter OUTPUT oifname "eth0" ip dscp 0x3f counter
++nft insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
+ nft add rule bridge filter FORWARD tcp dport 22 counter
+-- 
+2.40.0
+
diff --git a/SOURCES/0122-extensions-libebt_ip-Translation-has-to-match-on-eth.patch b/SOURCES/0122-extensions-libebt_ip-Translation-has-to-match-on-eth.patch
new file mode 100644
index 0000000..e396ce2
--- /dev/null
+++ b/SOURCES/0122-extensions-libebt_ip-Translation-has-to-match-on-eth.patch
@@ -0,0 +1,90 @@
+From 3b42685aeedbb81f7dc6af0e1eb35200236449d2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 3 Feb 2023 17:37:40 +0100
+Subject: [PATCH] extensions: libebt_ip: Translation has to match on ether type
+
+On one hand, nft refuses th expression in bridge family if layer3
+protocol has not been assured by a previous match. On the other, ebt_ip
+kernel module will only match on IPv4 packets, so there might be a
+functional change in the translation versus the original.
+
+Instead of just always emitting an 'ether type' match, decide whether
+it's actually needed - explicit "ip <something>" payload matches (or
+icmp ones) cause implicit creation of a match on IPv4 by nft.
+
+Fixes: 03ecffe6c2cc0 ("ebtables-compat: add initial translations")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b860e658200af8fdeced2896a1a6c2f0f0692b70)
+
+Conflicts:
+	extensions/libebt_ip.txlate
+-> Adjusted to missing commit 09d63e818ae0d
+   ("extensions: change expected output for new format").
+---
+ extensions/libebt_ip.c      | 21 +++++++++++++++++++++
+ extensions/libebt_ip.txlate |  6 +++---
+ 2 files changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/extensions/libebt_ip.c b/extensions/libebt_ip.c
+index 7b6fa4a2139d4..81500828fe74c 100644
+--- a/extensions/libebt_ip.c
++++ b/extensions/libebt_ip.c
+@@ -667,6 +667,24 @@ static void brip_xlate_nh(struct xt_xlate *xl,
+ 				  xtables_ipmask_to_numeric(maskp));
+ }
+ 
++static bool may_skip_ether_type_dep(uint8_t flags)
++{
++	/* these convert to "ip (s|d)addr" matches */
++	if (flags & (EBT_IP_SOURCE | EBT_IP_DEST))
++		return true;
++
++	/* icmp match triggers implicit ether type dependency in nft */
++	if (flags & EBT_IP_ICMP)
++		return true;
++
++	/* allow if "ip protocol" match is created by brip_xlate() */
++	if (flags & EBT_IP_PROTO &&
++	    !(flags & (EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)))
++		return true;
++
++	return false;
++}
++
+ static int brip_xlate(struct xt_xlate *xl,
+ 		      const struct xt_xlate_mt_params *params)
+ {
+@@ -676,6 +694,9 @@ static int brip_xlate(struct xt_xlate *xl,
+ 	brip_xlate_nh(xl, info, EBT_IP_SOURCE);
+ 	brip_xlate_nh(xl, info, EBT_IP_DEST);
+ 
++	if (!may_skip_ether_type_dep(info->bitmask))
++		xt_xlate_add(xl, "ether type ip ");
++
+ 	if (info->bitmask & EBT_IP_TOS) {
+ 		xt_xlate_add(xl, "@nh,8,8 ");
+ 		if (info->invflags & EBT_IP_TOS)
+diff --git a/extensions/libebt_ip.txlate b/extensions/libebt_ip.txlate
+index 5c766e1b743ea..cc42d2dbacf65 100644
+--- a/extensions/libebt_ip.txlate
++++ b/extensions/libebt_ip.txlate
+@@ -5,13 +5,13 @@ ebtables-translate -I FORWARD -p ip --ip-dst 10.0.0.1
+ nft insert rule bridge filter FORWARD ip daddr 10.0.0.1 counter
+ 
+ ebtables-translate -I OUTPUT 3 -p ip -o eth0 --ip-tos 0xff
+-nft insert rule bridge filter OUTPUT oifname "eth0" @nh,8,8 0xff counter
++nft insert rule bridge filter OUTPUT oifname "eth0" ether type ip @nh,8,8 0xff counter
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto tcp --ip-dport 22
+-nft add rule bridge filter FORWARD tcp dport 22 counter
++nft add rule bridge filter FORWARD ether type ip tcp dport 22 counter
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto udp --ip-sport 1024:65535
+-nft add rule bridge filter FORWARD udp sport 1024-65535 counter
++nft add rule bridge filter FORWARD ether type ip udp sport 1024-65535 counter
+ 
+ ebtables-translate -A FORWARD -p ip --ip-proto 253
+ nft add rule bridge filter FORWARD ip protocol 253 counter
+-- 
+2.40.0
+
diff --git a/SOURCES/0123-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch b/SOURCES/0123-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch
new file mode 100644
index 0000000..94f2eb5
--- /dev/null
+++ b/SOURCES/0123-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch
@@ -0,0 +1,67 @@
+From 4ef8d59919d8693b8aaeff5d470e6d9eb254ebca Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Tue, 28 Feb 2023 18:09:25 +0100
+Subject: [PATCH] nft-restore: Fix for deletion of new, referenced rule
+
+Combining multiple corner-cases here:
+
+* Insert a rule before another new one which is not the first. Triggers
+  NFTNL_RULE_ID assignment of the latter.
+
+* Delete the referenced new rule in the same batch again. Causes
+  overwriting of the previously assigned RULE_ID.
+
+Consequently, iptables-nft-restore fails during *insert*, because the
+reference is dangling.
+
+Reported-by: Eric Garver <eric@garver.life>
+Fixes: 760b35b46e4cc ("nft: Fix for add and delete of same rule in single batch")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Tested-by: Eric Garver <eric@garver.life>
+(cherry picked from commit 5fd85822bd12a02f1a921243f605fc6238d705b4)
+---
+ iptables/nft.c                                   |  3 ++-
+ .../ipt-restore/0003-restore-ordering_0          | 16 ++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index b70e9237a04ab..9a56b1fbffcbc 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -2104,7 +2104,8 @@ static int __nft_rule_del(struct nft_handle *h, struct nftnl_rule *r)
+ 
+ 	nftnl_rule_list_del(r);
+ 
+-	if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE))
++	if (!nftnl_rule_get_u64(r, NFTNL_RULE_HANDLE) &&
++	    !nftnl_rule_get_u32(r, NFTNL_RULE_ID))
+ 		nftnl_rule_set_u32(r, NFTNL_RULE_ID, ++h->rule_id);
+ 
+ 	obj = batch_rule_add(h, NFT_COMPAT_RULE_DELETE, r);
+diff --git a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0 b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
+index 3f1d229e915ff..5482b7ea17298 100755
+--- a/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
++++ b/iptables/tests/shell/testcases/ipt-restore/0003-restore-ordering_0
+@@ -123,3 +123,19 @@ EXPECT='-A FORWARD -m comment --comment "rule 1" -j ACCEPT
+ -A FORWARD -m comment --comment "rule 3" -j ACCEPT'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
++
++# test adding, referencing and deleting the same rule in a batch
++
++$XT_MULTI iptables-restore <<EOF
++*filter
++-A FORWARD -m comment --comment "first rule" -j ACCEPT
++-A FORWARD -m comment --comment "referenced rule" -j ACCEPT
++-I FORWARD 2 -m comment --comment "referencing rule" -j ACCEPT
++-D FORWARD -m comment --comment "referenced rule" -j ACCEPT
++COMMIT
++EOF
++
++EXPECT='-A FORWARD -m comment --comment "first rule" -j ACCEPT
++-A FORWARD -m comment --comment "referencing rule" -j ACCEPT'
++
++diff -u -Z <(echo -e "$EXPECT") <(ipt_show)
+-- 
+2.40.0
+
diff --git a/SOURCES/0124-nft-shared-Drop-unused-include.patch b/SOURCES/0124-nft-shared-Drop-unused-include.patch
new file mode 100644
index 0000000..524140e
--- /dev/null
+++ b/SOURCES/0124-nft-shared-Drop-unused-include.patch
@@ -0,0 +1,34 @@
+From 47f8d18fa955ca7c786534622e900cd4d19cfcaf Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 29 Mar 2023 16:22:16 +0200
+Subject: [PATCH] nft-shared: Drop unused include
+
+Code does not refer to struct xt_comment_info anymore.
+
+Fixes: 3bb497c61d743 ("xtables: Fix for deleting rules with comment")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 465470184950d9035dcd1101c1f413f8a2051427)
+
+Conflicts:
+	iptables/nft-shared.c
+-> Context change due to missing commit 62ad29e9b778f
+   ("extensions: libxt_NFLOG: don't truncate log prefix on print/save").
+---
+ iptables/nft-shared.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index 8e005ed3b5818..ed093c07d7617 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -20,7 +20,6 @@
+ 
+ #include <xtables.h>
+ 
+-#include <linux/netfilter/xt_comment.h>
+ #include <linux/netfilter/xt_limit.h>
+ 
+ #include <libmnl/libmnl.h>
+-- 
+2.40.0
+
diff --git a/SOURCES/0125-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch b/SOURCES/0125-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch
new file mode 100644
index 0000000..a97feda
--- /dev/null
+++ b/SOURCES/0125-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch
@@ -0,0 +1,31 @@
+From 4f87be23b73378c42f7d555c527666d83650de46 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Apr 2023 14:33:43 +0200
+Subject: [PATCH] arptables: Fix parsing of inverted 'arp operation' match
+
+The wrong bit was set in 'invflags', probably due to copy'n'paste from
+the previous case.
+
+Fixes: 84909d171585d ("xtables: bootstrap ARP compatibility layer for nftables")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 092e4b022152addc94524e2ba0cb608dac1a3a08)
+---
+ iptables/nft-arp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index 398face687fbf..ab1108dd69685 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -249,7 +249,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
+ 		fw->arp.arhln = ar_hln;
+ 		fw->arp.arhln_mask = 0xff;
+ 		if (inv)
+-			fw->arp.invflags |= IPT_INV_ARPOP;
++			fw->arp.invflags |= IPT_INV_ARPHLN;
+ 		break;
+ 	case offsetof(struct arphdr, ar_pln):
+ 		get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv);
+-- 
+2.40.0
+
diff --git a/SOURCES/0126-arptables-Don-t-omit-standard-matches-if-inverted.patch b/SOURCES/0126-arptables-Don-t-omit-standard-matches-if-inverted.patch
new file mode 100644
index 0000000..9591d2e
--- /dev/null
+++ b/SOURCES/0126-arptables-Don-t-omit-standard-matches-if-inverted.patch
@@ -0,0 +1,42 @@
+From 9e746a513d5e26f724f992f742f549f7e82f0148 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 28 Apr 2023 14:37:47 +0200
+Subject: [PATCH] arptables: Don't omit standard matches if inverted
+
+Inverted --h-len and --h-type matches were omitted from output by
+accident if they matched on their standard value.
+
+Fixes: 84331e3ed3f8e ("arptables-nft: Don't print default h-len/h-type values")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 79f93b0943fa0e46ba29bb476362634509eb594e)
+---
+ iptables/nft-arp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index ab1108dd69685..f1cf46476ec83 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -416,7 +416,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
+ 
+ after_devdst:
+ 
+-	if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
++	if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6 ||
++	    fw->arp.invflags & IPT_INV_ARPHLN) {
+ 		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN
+ 			? "! " : "");
+ 		printf("--h-length %d", fw->arp.arhln);
+@@ -440,7 +441,8 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
+ 		sep = " ";
+ 	}
+ 
+-	if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
++	if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1) ||
++	    fw->arp.invflags & IPT_INV_ARPHRD) {
+ 		uint16_t tmp = ntohs(fw->arp.arhrd);
+ 
+ 		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD
+-- 
+2.40.0
+
diff --git a/SOURCES/0127-Revert-arptables-Check-the-mandatory-ar_pln-match.patch b/SOURCES/0127-Revert-arptables-Check-the-mandatory-ar_pln-match.patch
new file mode 100644
index 0000000..7f0227e
--- /dev/null
+++ b/SOURCES/0127-Revert-arptables-Check-the-mandatory-ar_pln-match.patch
@@ -0,0 +1,44 @@
+From ffbc5cf87e89345ad5c4aac0ae41d3cca7502db9 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Tue, 9 May 2023 16:33:12 +0200
+Subject: [PATCH] Revert "arptables: Check the mandatory ar_pln match"
+
+This reverts commit 8d33fdea9f7883f403a9d3ef5b5d13887b7a5303.
+
+Due to the missing parser error checking and reporting added by commit
+f315af1cf8871 ("nft: track each register individually"), the added check
+is ineffective.
+
+(cherry picked from commit eb7dd6487edb14c20b60efd485e45eb014fcf41a)
+---
+ iptables/nft-arp.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index f1cf46476ec83..fa1676e7fd878 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -219,7 +219,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
+ 	struct arpt_entry *fw = &cs->arp;
+ 	struct in_addr addr;
+ 	uint16_t ar_hrd, ar_pro, ar_op;
+-	uint8_t ar_hln, ar_pln;
++	uint8_t ar_hln;
+ 	bool inv;
+ 
+ 	switch (ctx->payload.offset) {
+@@ -251,11 +251,6 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
+ 		if (inv)
+ 			fw->arp.invflags |= IPT_INV_ARPHLN;
+ 		break;
+-	case offsetof(struct arphdr, ar_pln):
+-		get_cmp_data(e, &ar_pln, sizeof(ar_pln), &inv);
+-		if (ar_pln != 4 || inv)
+-			ctx->errmsg = "unexpected ARP protocol length match";
+-		break;
+ 	default:
+ 		if (ctx->payload.offset == sizeof(struct arphdr)) {
+ 			if (nft_arp_parse_devaddr(ctx, e, &fw->arp.src_devaddr))
+-- 
+2.40.0
+
diff --git a/SOURCES/0057-extensions-SECMARK-Use-a-better-context-in-test-case.patch b/SOURCES/0128-extensions-SECMARK-Use-a-better-context-in-test-case.patch
similarity index 85%
rename from SOURCES/0057-extensions-SECMARK-Use-a-better-context-in-test-case.patch
rename to SOURCES/0128-extensions-SECMARK-Use-a-better-context-in-test-case.patch
index 6498fa6..89394e3 100644
--- a/SOURCES/0057-extensions-SECMARK-Use-a-better-context-in-test-case.patch
+++ b/SOURCES/0128-extensions-SECMARK-Use-a-better-context-in-test-case.patch
@@ -1,4 +1,4 @@
-From 2a45c01c4d3892871b3d3d6b67d10cb62abc561e Mon Sep 17 00:00:00 2001
+From f24ad92bea508ba2e037a4d2e57770371554e47f Mon Sep 17 00:00:00 2001
 From: Phil Sutter <psutter@redhat.com>
 Date: Fri, 16 Jul 2021 21:51:49 +0200
 Subject: [PATCH] extensions: SECMARK: Use a better context in test case
@@ -7,6 +7,8 @@ RHEL SELinux policies don't allow setting
 system_u:object_r:firewalld_exec_t:s0 context. Use one instead which has
 'packet_type' attribute (identified via
 'seinfo -xt | grep packet_type').
+
+(cherry picked from commit 0f730df43caa68e03380111b40e357141ccce709)
 ---
  extensions/libxt_SECMARK.t | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
@@ -22,5 +24,5 @@ index 39d4c09348bf4..295e7a7244902 100644
 +-j SECMARK --selctx system_u:object_r:ssh_server_packet_t:s0;=;OK
  -j SECMARK;;FAIL
 -- 
-2.31.1
+2.40.0
 
diff --git a/SOURCES/0129-tests-xlate-test-Print-errors-to-stderr.patch b/SOURCES/0129-tests-xlate-test-Print-errors-to-stderr.patch
new file mode 100644
index 0000000..60a3785
--- /dev/null
+++ b/SOURCES/0129-tests-xlate-test-Print-errors-to-stderr.patch
@@ -0,0 +1,39 @@
+From 80c0fef76c5b3f78b1261f8c15b10d58382a5c3f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 12 Aug 2021 15:12:30 +0200
+Subject: [PATCH] tests: xlate-test: Print errors to stderr
+
+Return code is always zero, so grepping for output on stderr is a
+simple way to detect testsuite failures.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 5166c4451fb837e7d5dbb54a7d7cbf2f0c2469cc)
+---
+ xlate-test.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xlate-test.py b/xlate-test.py
+index 4c014f9bd269a..50e9893e956aa 100755
+--- a/xlate-test.py
++++ b/xlate-test.py
+@@ -65,7 +65,7 @@ xtables_nft_multi = 'xtables-nft-multi'
+     if (passed == tests) and not args.test:
+         print(name + ": " + green("OK"))
+     if not test_passed:
+-        print("\n".join(result))
++        print("\n".join(result), file=sys.stderr)
+     if args.test:
+         print("1 test file, %d tests, %d tests passed, %d tests failed, %d errors" % (tests, passed, failed, errors))
+     else:
+@@ -101,7 +101,7 @@ xtables_nft_multi = 'xtables-nft-multi'
+             with open(args.test, "r") as payload:
+                 run_test(args.test, payload)
+         except IOError:
+-            print(red("Error: ") + "test file does not exist")
++            print(red("Error: ") + "test file does not exist", file=sys.stderr)
+     else:
+         load_test_files()
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0130-iptables-test-Make-netns-spawning-more-robust.patch b/SOURCES/0130-iptables-test-Make-netns-spawning-more-robust.patch
new file mode 100644
index 0000000..3989580
--- /dev/null
+++ b/SOURCES/0130-iptables-test-Make-netns-spawning-more-robust.patch
@@ -0,0 +1,72 @@
+From 8d25120581dfdac4585b471d0d0ed36ecf75c817 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 11 Aug 2021 14:46:22 +0200
+Subject: [PATCH] iptables-test: Make netns spawning more robust
+
+On systems without unshare Python module, try to call unshare binary
+with oneself as parameters.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 7ae14dc1a938fc158aaa1761b4fba57c5f1ab7a0)
+---
+ iptables-test.py | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index 6b6eb611a7290..ffe5b1f7da972 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -304,6 +304,31 @@ log_file = None
+ 
+     print('\n'.join(missing))
+ 
++def spawn_netns():
++    # prefer unshare module
++    try:
++        import unshare
++        unshare.unshare(unshare.CLONE_NEWNET)
++        return True
++    except:
++        pass
++
++    # sledgehammer style:
++    # - call ourselves prefixed by 'unshare -n' if found
++    # - pass extra --no-netns parameter to avoid another recursion
++    try:
++        import shutil
++
++        unshare = shutil.which("unshare")
++        if unshare is None:
++            return False
++
++        sys.argv.append("--no-netns")
++        os.execv(unshare, [unshare, "-n", sys.executable] + sys.argv)
++    except:
++        pass
++
++    return False
+ 
+ #
+ # main
+@@ -323,6 +348,8 @@ log_file = None
+                         help='Test iptables-over-nftables')
+     parser.add_argument('-N', '--netns', action='store_true',
+                         help='Test netnamespace path')
++    parser.add_argument('--no-netns', action='store_true',
++                        help='Do not run testsuite in own network namespace')
+     args = parser.parse_args()
+ 
+     #
+@@ -341,6 +368,9 @@ log_file = None
+         print("You need to be root to run this, sorry")
+         return
+ 
++    if not args.netns and not args.no_netns and not spawn_netns():
++        print("Cannot run in own namespace, connectivity might break")
++
+     if not args.host:
+         os.putenv("XTABLES_LIBDIR", os.path.abspath(EXTENSIONS_PATH))
+         os.putenv("PATH", "%s/iptables:%s" % (os.path.abspath(os.path.curdir),
+-- 
+2.40.0
+
diff --git a/SOURCES/0131-tests-iptables-test-Print-errors-to-stderr.patch b/SOURCES/0131-tests-iptables-test-Print-errors-to-stderr.patch
new file mode 100644
index 0000000..4665596
--- /dev/null
+++ b/SOURCES/0131-tests-iptables-test-Print-errors-to-stderr.patch
@@ -0,0 +1,54 @@
+From 814f6498d2487e57840ec93e5a206e39731044d8 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Thu, 12 Aug 2021 19:14:13 +0200
+Subject: [PATCH] tests: iptables-test: Print errors to stderr
+
+No big deal, just pass the extra parameter to the four error print
+calls.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit a8da71864d467c4371dc24cd763fa2c1dfb6cfbb)
+---
+ iptables-test.py | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index ffe5b1f7da972..06b9937bbf0e5 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -47,7 +47,7 @@ log_file = None
+     Prints an error with nice colors, indicating file and line number.
+     '''
+     print(filename + ": " + Colors.RED + "ERROR" +
+-        Colors.ENDC + ": line %d (%s)" % (lineno, reason))
++        Colors.ENDC + ": line %d (%s)" % (lineno, reason), file=sys.stderr)
+ 
+ 
+ def delete_rule(iptables, rule, filename, lineno):
+@@ -365,11 +365,12 @@ log_file = None
+         EXECUTEABLE = "xtables-nft-multi"
+ 
+     if os.getuid() != 0:
+-        print("You need to be root to run this, sorry")
++        print("You need to be root to run this, sorry", file=sys.stderr)
+         return
+ 
+     if not args.netns and not args.no_netns and not spawn_netns():
+-        print("Cannot run in own namespace, connectivity might break")
++        print("Cannot run in own namespace, connectivity might break",
++              file=sys.stderr)
+ 
+     if not args.host:
+         os.putenv("XTABLES_LIBDIR", os.path.abspath(EXTENSIONS_PATH))
+@@ -385,7 +386,7 @@ log_file = None
+     try:
+         log_file = open(LOGFILE, 'w')
+     except IOError:
+-        print("Couldn't open log file %s" % LOGFILE)
++        print("Couldn't open log file %s" % LOGFILE, file=sys.stderr)
+         return
+ 
+     if args.filename:
+-- 
+2.40.0
+
diff --git a/SOURCES/0132-tests-xlate-test-Exit-non-zero-on-error.patch b/SOURCES/0132-tests-xlate-test-Exit-non-zero-on-error.patch
new file mode 100644
index 0000000..01ece03
--- /dev/null
+++ b/SOURCES/0132-tests-xlate-test-Exit-non-zero-on-error.patch
@@ -0,0 +1,91 @@
+From d5b7963f7ae493ba797bb23188f3db5ed27b7a74 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Mon, 6 Sep 2021 13:07:43 +0200
+Subject: [PATCH] tests: xlate-test: Exit non-zero on error
+
+If a test fails, return a non-zero exit code. To do so, propagate the
+pass/fail statistics up to main() for evaluation. While being at it,
+move the statistics printing into there as well and get rid of that
+redundant assignment to 'test_passed'.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit c057939d80cc6219a137784c195e14ee1bc62a58)
+---
+ xlate-test.py | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/xlate-test.py b/xlate-test.py
+index 50e9893e956aa..7299dc747295f 100755
+--- a/xlate-test.py
++++ b/xlate-test.py
+@@ -54,7 +54,6 @@ xtables_nft_multi = 'xtables-nft-multi'
+                     result.append(magenta("src: ") + line.rstrip(" \n"))
+                     result.append(magenta("exp: ") + expected)
+                     result.append(magenta("res: ") + translation + "\n")
+-                    test_passed = False
+                 else:
+                     passed += 1
+             else:
+@@ -66,10 +65,7 @@ xtables_nft_multi = 'xtables-nft-multi'
+         print(name + ": " + green("OK"))
+     if not test_passed:
+         print("\n".join(result), file=sys.stderr)
+-    if args.test:
+-        print("1 test file, %d tests, %d tests passed, %d tests failed, %d errors" % (tests, passed, failed, errors))
+-    else:
+-        return tests, passed, failed, errors
++    return tests, passed, failed, errors
+ 
+ 
+ def load_test_files():
+@@ -83,10 +79,9 @@ xtables_nft_multi = 'xtables-nft-multi'
+                 total_passed += passed
+                 total_failed += failed
+                 total_error += errors
++    return (test_files, total_tests, total_passed, total_failed, total_error)
+ 
+ 
+-    print("%d test files, %d tests, %d tests passed, %d tests failed, %d errors" % (test_files, total_tests, total_passed, total_failed, total_error))
+-
+ def main():
+     global xtables_nft_multi
+     if not args.host:
+@@ -94,16 +89,27 @@ xtables_nft_multi = 'xtables-nft-multi'
+         xtables_nft_multi = os.path.abspath(os.path.curdir) \
+                             + '/iptables/' + xtables_nft_multi
+ 
++    files = tests = passed = failed = errors = 0
+     if args.test:
+         if not args.test.endswith(".txlate"):
+             args.test += ".txlate"
+         try:
+             with open(args.test, "r") as payload:
+-                run_test(args.test, payload)
++                files = 1
++                tests, passed, failed, errors = run_test(args.test, payload)
+         except IOError:
+             print(red("Error: ") + "test file does not exist", file=sys.stderr)
++            return -1
++    else:
++        files, tests, passed, failed, errors = load_test_files()
++
++    if files > 1:
++        file_word = "files"
+     else:
+-        load_test_files()
++        file_word = "file"
++    print("%d test %s, %d tests, %d tests passed, %d tests failed, %d errors"
++            % (files, file_word, tests, passed, failed, errors))
++    return passed - tests
+ 
+ 
+ parser = argparse.ArgumentParser()
+@@ -111,4 +117,4 @@ parser.add_argument('-H', '--host', action='store_true',
+                     help='Run tests against installed binaries')
+ parser.add_argument("test", nargs="?", help="run only the specified test file")
+ args = parser.parse_args()
+-main()
++sys.exit(main())
+-- 
+2.40.0
+
diff --git a/SOURCES/0133-tests-iptables-test-Exit-non-zero-on-error.patch b/SOURCES/0133-tests-iptables-test-Exit-non-zero-on-error.patch
new file mode 100644
index 0000000..bd679c9
--- /dev/null
+++ b/SOURCES/0133-tests-iptables-test-Exit-non-zero-on-error.patch
@@ -0,0 +1,30 @@
+From ccbf512feab4e8fc4bb4e2c0ee7747f2624edc3e Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Mon, 6 Sep 2021 13:49:34 +0200
+Subject: [PATCH] tests: iptables-test: Exit non-zero on error
+
+If any test fails, return a non-zero exit code.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 7559af835d8f58375f797f895e1a5410027127d9)
+---
+ iptables-test.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index 06b9937bbf0e5..0d21f975305db 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -405,7 +405,8 @@ log_file = None
+             test_files += 1
+ 
+     print("%d test files, %d unit tests, %d passed" % (test_files, tests, passed))
++    return passed - tests
+ 
+ 
+ if __name__ == '__main__':
+-    main()
++    sys.exit(main())
+-- 
+2.40.0
+
diff --git a/SOURCES/0134-tests-shell-Return-non-zero-on-error.patch b/SOURCES/0134-tests-shell-Return-non-zero-on-error.patch
new file mode 100644
index 0000000..6460a07
--- /dev/null
+++ b/SOURCES/0134-tests-shell-Return-non-zero-on-error.patch
@@ -0,0 +1,26 @@
+From b8b02934ad125df53b34af7840be34d5500e1114 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Mon, 6 Sep 2021 17:28:30 +0200
+Subject: [PATCH] tests: shell: Return non-zero on error
+
+If any test fails, return a non-zero exit code.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 481626bb4e9c51477ec99dde0727e3af69d2380f)
+---
+ iptables/tests/shell/run-tests.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/tests/shell/run-tests.sh b/iptables/tests/shell/run-tests.sh
+index 2125e2cb119bb..fbb17bedc5478 100755
+--- a/iptables/tests/shell/run-tests.sh
++++ b/iptables/tests/shell/run-tests.sh
+@@ -176,4 +176,4 @@ failed=$((legacy_fail+failed))
+ 
+ msg_info "combined results: [OK] $ok [FAILED] $failed [TOTAL] $((ok+failed))"
+ 
+-exit 0
++exit -$failed
+-- 
+2.40.0
+
diff --git a/SOURCES/0135-iptables-test.py-print-with-color-escapes-only-when-.patch b/SOURCES/0135-iptables-test.py-print-with-color-escapes-only-when-.patch
new file mode 100644
index 0000000..0c333ba
--- /dev/null
+++ b/SOURCES/0135-iptables-test.py-print-with-color-escapes-only-when-.patch
@@ -0,0 +1,70 @@
+From aace6f5ac84d738f6b5f0ed1d56b3713b0435cc4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20N=C4=9Bmec?= <snemec@redhat.com>
+Date: Thu, 2 Sep 2021 13:33:07 +0200
+Subject: [PATCH] iptables-test.py: print with color escapes only when stdout
+ isatty
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When the output doesn't go to a terminal (typical case: log files),
+the escape sequences are just noise.
+
+Signed-off-by: Štěpán Němec <snemec@redhat.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit b714d45dc4c2423d4df4cbf7ccf238ec441675ef)
+---
+ iptables-test.py | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index 0d21f975305db..fb9503b6fffb4 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -32,22 +32,25 @@ EXTENSIONS_PATH = "extensions"
+ LOGFILE="/tmp/iptables-test.log"
+ log_file = None
+ 
++STDOUT_IS_TTY = sys.stdout.isatty()
+ 
+-class Colors:
+-    HEADER = '\033[95m'
+-    BLUE = '\033[94m'
+-    GREEN = '\033[92m'
+-    YELLOW = '\033[93m'
+-    RED = '\033[91m'
+-    ENDC = '\033[0m'
++def maybe_colored(color, text):
++    terminal_sequences = {
++        'green': '\033[92m',
++        'red': '\033[91m',
++    }
++
++    return (
++        terminal_sequences[color] + text + '\033[0m' if STDOUT_IS_TTY else text
++    )
+ 
+ 
+ def print_error(reason, filename=None, lineno=None):
+     '''
+     Prints an error with nice colors, indicating file and line number.
+     '''
+-    print(filename + ": " + Colors.RED + "ERROR" +
+-        Colors.ENDC + ": line %d (%s)" % (lineno, reason), file=sys.stderr)
++    print(filename + ": " + maybe_colored('red', "ERROR") +
++        ": line %d (%s)" % (lineno, reason), file=sys.stderr)
+ 
+ 
+ def delete_rule(iptables, rule, filename, lineno):
+@@ -282,7 +285,7 @@ log_file = None
+     if netns:
+         execute_cmd("ip netns del ____iptables-container-test", filename, 0)
+     if total_test_passed:
+-        print(filename + ": " + Colors.GREEN + "OK" + Colors.ENDC)
++        print(filename + ": " + maybe_colored('green', "OK"))
+ 
+     f.close()
+     return tests, passed
+-- 
+2.40.0
+
diff --git a/SOURCES/0136-tests-iptables-test-Fix-conditional-colors-on-stderr.patch b/SOURCES/0136-tests-iptables-test-Fix-conditional-colors-on-stderr.patch
new file mode 100644
index 0000000..0e08ade
--- /dev/null
+++ b/SOURCES/0136-tests-iptables-test-Fix-conditional-colors-on-stderr.patch
@@ -0,0 +1,64 @@
+From 50470c652e32b3bc2025d45e4d39b47c0aba8e23 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 15 Sep 2021 17:47:15 +0200
+Subject: [PATCH] tests: iptables-test: Fix conditional colors on stderr
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Štěpán's patch to make colored output depend on whether output is a TTY
+clashed with my change to print errors to stderr instead of stdout.
+
+Fix this by telling maybe_colored() if it should print colors or not as
+only caller knows where output is sent to.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2ed6dc7557b8c4a70bfd81684a72737312d7bd4b)
+---
+ iptables-test.py | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/iptables-test.py b/iptables-test.py
+index fb9503b6fffb4..d54ed428ddefb 100755
+--- a/iptables-test.py
++++ b/iptables-test.py
+@@ -33,15 +33,16 @@ LOGFILE="/tmp/iptables-test.log"
+ log_file = None
+ 
+ STDOUT_IS_TTY = sys.stdout.isatty()
++STDERR_IS_TTY = sys.stderr.isatty()
+ 
+-def maybe_colored(color, text):
++def maybe_colored(color, text, isatty):
+     terminal_sequences = {
+         'green': '\033[92m',
+         'red': '\033[91m',
+     }
+ 
+     return (
+-        terminal_sequences[color] + text + '\033[0m' if STDOUT_IS_TTY else text
++        terminal_sequences[color] + text + '\033[0m' if isatty else text
+     )
+ 
+ 
+@@ -49,7 +50,7 @@ STDOUT_IS_TTY = sys.stdout.isatty()
+     '''
+     Prints an error with nice colors, indicating file and line number.
+     '''
+-    print(filename + ": " + maybe_colored('red', "ERROR") +
++    print(filename + ": " + maybe_colored('red', "ERROR", STDERR_IS_TTY) +
+         ": line %d (%s)" % (lineno, reason), file=sys.stderr)
+ 
+ 
+@@ -285,7 +286,7 @@ STDOUT_IS_TTY = sys.stdout.isatty()
+     if netns:
+         execute_cmd("ip netns del ____iptables-container-test", filename, 0)
+     if total_test_passed:
+-        print(filename + ": " + maybe_colored('green', "OK"))
++        print(filename + ": " + maybe_colored('green', "OK", STDOUT_IS_TTY))
+ 
+     f.close()
+     return tests, passed
+-- 
+2.40.0
+
diff --git a/SOURCES/0137-tests-shell-update-format-of-registers-in-bitwise-pa.patch b/SOURCES/0137-tests-shell-update-format-of-registers-in-bitwise-pa.patch
new file mode 100644
index 0000000..aec50b1
--- /dev/null
+++ b/SOURCES/0137-tests-shell-update-format-of-registers-in-bitwise-pa.patch
@@ -0,0 +1,67 @@
+From 71f3a4741df9db345679f32f5829ce3c4b83031d Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Mon, 16 Nov 2020 10:37:41 +0100
+Subject: [PATCH] tests: shell: update format of registers in bitwise payloads.
+
+libnftnl has been changed to bring the format of registers in bitwise
+dumps in line with those in other types of expression.  Update the
+expected output of Python test-cases.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 83ee6e179829461572be6583ce6e83f68e636eb6)
+---
+ .../shell/testcases/nft-only/0009-needless-bitwise_0   | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+index c5c6e706a1029..41d765e537312 100755
+--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
++++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+@@ -64,7 +64,7 @@ ip filter OUTPUT 5 4
+ 
+ ip filter OUTPUT 6 5
+   [ payload load 4b @ network header + 16 => reg 1 ]
+-  [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]
++  [ bitwise reg 1 = ( reg 1 & 0xfcffffff ) ^ 0x00000000 ]
+   [ cmp eq reg 1 0x0002010a ]
+   [ counter pkts 0 bytes 0 ]
+ 
+@@ -98,7 +98,7 @@ ip6 filter OUTPUT 5 4
+ 
+ ip6 filter OUTPUT 6 5
+   [ payload load 16b @ network header + 24 => reg 1 ]
+-  [ bitwise reg 1 = (reg=1 & 0xffffffff 0xffffffff 0xffffffff 0xf0ffffff ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]
++  [ bitwise reg 1 = ( reg 1 & 0xffffffff 0xffffffff 0xffffffff 0xf0ffffff ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]
+   [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]
+   [ counter pkts 0 bytes 0 ]
+ 
+@@ -175,7 +175,7 @@ arp filter OUTPUT 5 4
+   [ payload load 1b @ network header + 5 => reg 1 ]
+   [ cmp eq reg 1 0x00000004 ]
+   [ payload load 4b @ network header + 24 => reg 1 ]
+-  [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]
++  [ bitwise reg 1 = ( reg 1 & 0xfcffffff ) ^ 0x00000000 ]
+   [ cmp eq reg 1 0x0002010a ]
+   [ counter pkts 0 bytes 0 ]
+ 
+@@ -240,7 +240,7 @@ arp filter OUTPUT 11 10
+   [ payload load 1b @ network header + 5 => reg 1 ]
+   [ cmp eq reg 1 0x00000004 ]
+   [ payload load 6b @ network header + 18 => reg 1 ]
+-  [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
++  [ bitwise reg 1 = ( reg 1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
+   [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]
+   [ counter pkts 0 bytes 0 ]
+ 
+@@ -306,7 +306,7 @@ bridge filter OUTPUT 4
+ 
+ bridge filter OUTPUT 5 4
+   [ payload load 6b @ link header + 0 => reg 1 ]
+-  [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
++  [ bitwise reg 1 = ( reg 1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
+   [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]
+   [ counter pkts 0 bytes 0 ]
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0138-tests-shell-Fix-nft-only-0009-needless-bitwise_0.patch b/SOURCES/0138-tests-shell-Fix-nft-only-0009-needless-bitwise_0.patch
new file mode 100644
index 0000000..ca0423d
--- /dev/null
+++ b/SOURCES/0138-tests-shell-Fix-nft-only-0009-needless-bitwise_0.patch
@@ -0,0 +1,36 @@
+From f31607eafcbf8b4aca4f51bbd6dac33817a1498d Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 15 Jan 2021 21:58:48 +0100
+Subject: [PATCH] tests/shell: Fix nft-only/0009-needless-bitwise_0
+
+For whatever reason, stored expected output contains false handles. To
+overcome this, filter the rule data lines from both expected and stored
+output before comparing.
+
+Fixes: 81a2e12851283 ("tests/shell: Add test for bitwise avoidance fixes")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 0f7ea0390b33654c9a91015966f518b98356e786)
+---
+ .../shell/testcases/nft-only/0009-needless-bitwise_0     | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+index 41d765e537312..41588a10863ec 100755
+--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
++++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+@@ -336,4 +336,11 @@ bridge filter OUTPUT 10 9
+   [ counter pkts 0 bytes 0 ]
+ "
+ 
+-diff -u -Z <(echo "$EXPECT") <(nft --debug=netlink list ruleset | awk '/^table/{exit} {print}')
++# print nothing but:
++# - lines with bytecode (starting with '  [')
++# - empty lines (so printed diff is not a complete mess)
++filter() {
++	awk '/^(  \[|$)/{print}'
++}
++
++diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter)
+-- 
+2.40.0
+
diff --git a/SOURCES/0139-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch b/SOURCES/0139-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
new file mode 100644
index 0000000..0b6ac32
--- /dev/null
+++ b/SOURCES/0139-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
@@ -0,0 +1,34 @@
+From e34d23b5a95801b93550a451b0da0b28221acfd5 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 19 Jul 2023 14:58:11 +0200
+Subject: [PATCH] tests: shell: Sanitize nft-only/0009-needless-bitwise_0
+
+Some versions of awk (gawk-4.2.1-4.el8 in particular) also print the
+non-debug ruleset listing's empty lines, causing the diff to fail. Catch
+this by exiting upon seeing the first table heading. For the sake of
+comparing bytecode, the actual ruleset listing is not interesting,
+anyway.
+
+Fixes: 0f7ea0390b336 ("tests/shell: Fix nft-only/0009-needless-bitwise_0")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 2746726e03d9017d4c940a247590f8d5c5d5a73e)
+---
+ iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+index 41588a10863ec..34802cc26aad4 100755
+--- a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
++++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
+@@ -340,7 +340,7 @@ bridge filter OUTPUT 10 9
+ # - lines with bytecode (starting with '  [')
+ # - empty lines (so printed diff is not a complete mess)
+ filter() {
+-	awk '/^(  \[|$)/{print}'
++	awk '/^table /{exit} /^(  \[|$)/{print}'
+ }
+ 
+ diff -u -Z <(filter <<< "$EXPECT") <(nft --debug=netlink list ruleset | filter)
+-- 
+2.40.0
+
diff --git a/SOURCES/0140-iptables-Fix-setting-of-ipv6-counters.patch b/SOURCES/0140-iptables-Fix-setting-of-ipv6-counters.patch
new file mode 100644
index 0000000..52e16f9
--- /dev/null
+++ b/SOURCES/0140-iptables-Fix-setting-of-ipv6-counters.patch
@@ -0,0 +1,107 @@
+From 87cf690d64630c1c32986480036c594795224ee7 Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 12:44:54 +0200
+Subject: [PATCH] iptables: Fix setting of ipv6 counters
+
+When setting counters using ip6tables-nft -c X Y the X and Y values were
+not stored.
+
+This is a fix based on 9baf3bf0e77dab6ca4b167554ec0e57b65d0af01 but
+applied to the nft variant of ipv6 not the legacy.
+
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1647
+Fixes: 0391677c1a0b2 ("xtables: add IPv6 support")
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit ed839159edf8bda8e9196f1056c4038c22d78bfd)
+
+Conflicts:
+	iptables/xshared.c
+-> Applied to iptables/nft-ipv6.c due to missing commit e4f5185d8f29a
+   ("nft: Move proto_parse and post_parse callbacks to xshared")
+---
+ iptables/nft-ipv6.c                                        | 3 +++
+ iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 | 6 +++---
+ iptables/tests/shell/testcases/iptables/0003-list-rules_0  | 6 +++---
+ 3 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index 1f73bbcb8771f..69d9bc41314fc 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -298,6 +298,9 @@ static void nft_ipv6_post_parse(int command, struct iptables_command_state *cs,
+ 	if (args->goto_set)
+ 		cs->fw6.ipv6.flags |= IP6T_F_GOTO;
+ 
++	/* nft-variants use cs->counters, legacy uses cs->fw6.counters */
++	cs->counters.pcnt = args->pcnt_cnt;
++	cs->counters.bcnt = args->bcnt_cnt;
+ 	cs->fw6.counters.pcnt = args->pcnt_cnt;
+ 	cs->fw6.counters.bcnt = args->bcnt_cnt;
+ 
+diff --git a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0 b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+index c98bdd6e501aa..09e39927ef390 100755
+--- a/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
++++ b/iptables/tests/shell/testcases/ip6tables/0003-list-rules_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $XT_MULTI ip6tables -N foo
+-$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT
++$XT_MULTI ip6tables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
+ $XT_MULTI ip6tables -A FORWARD -i eth42 -o eth23 -g foo
+ $XT_MULTI ip6tables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+ 
+@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
+ -P FORWARD ACCEPT -c 0 0
+ -P OUTPUT ACCEPT -c 0 0
+ -N foo
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S)
+@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
+ 
+ EXPECT='-P FORWARD ACCEPT -c 0 0
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -v -S FORWARD)
+diff --git a/iptables/tests/shell/testcases/iptables/0003-list-rules_0 b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+index d335d44257a49..d07bd151be76b 100755
+--- a/iptables/tests/shell/testcases/iptables/0003-list-rules_0
++++ b/iptables/tests/shell/testcases/iptables/0003-list-rules_0
+@@ -3,7 +3,7 @@
+ set -e
+ 
+ $XT_MULTI iptables -N foo
+-$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT
++$XT_MULTI iptables -A FORWARD -i eth23 -o eth42 -j ACCEPT -c 23 42
+ $XT_MULTI iptables -A FORWARD -i eth42 -o eth23 -g foo
+ $XT_MULTI iptables -t nat -A OUTPUT -o eth123 -m mark --mark 0x42 -j ACCEPT
+ 
+@@ -20,7 +20,7 @@ EXPECT='-P INPUT ACCEPT -c 0 0
+ -P FORWARD ACCEPT -c 0 0
+ -P OUTPUT ACCEPT -c 0 0
+ -N foo
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S)
+@@ -32,7 +32,7 @@ EXPECT='-P FORWARD ACCEPT
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -S FORWARD)
+ 
+ EXPECT='-P FORWARD ACCEPT -c 0 0
+--A FORWARD -i eth23 -o eth42 -c 0 0 -j ACCEPT
++-A FORWARD -i eth23 -o eth42 -c 23 42 -j ACCEPT
+ -A FORWARD -i eth42 -o eth23 -c 0 0 -g foo'
+ 
+ diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables -v -S FORWARD)
+-- 
+2.40.0
+
diff --git a/SOURCES/0141-iptables-Fix-handling-of-non-existent-chains.patch b/SOURCES/0141-iptables-Fix-handling-of-non-existent-chains.patch
new file mode 100644
index 0000000..ff1840c
--- /dev/null
+++ b/SOURCES/0141-iptables-Fix-handling-of-non-existent-chains.patch
@@ -0,0 +1,53 @@
+From 66f7b6b160c53d142ebf5a0b4464ead198f2d7a7 Mon Sep 17 00:00:00 2001
+From: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Date: Mon, 19 Jun 2023 13:46:36 +0200
+Subject: [PATCH] iptables: Fix handling of non-existent chains
+
+Since 694612adf87 the "compatibility" check considers non-existent
+chains as "incompatible". This broke some scripts which used calls
+like `iptables -L CHAIN404` to test for chain existence and expect
+"No chain/target/match by that name." in the output.
+
+This patch changes the logic of `nft_is_table_compatible()` to
+report non-existent chains as "compatible" which restores the old
+behavior.
+
+Fixes: 694612adf87 ("nft: Fix selective chain compatibility checks")
+Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1648
+Signed-off-by: Jacek Tomasiak <jtomasiak@arista.com>
+Signed-off-by: Jacek Tomasiak <jacek.tomasiak@gmail.com>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 82ccfb488eeac5507471099b9b4e6d136cc06e3b)
+---
+ iptables/nft.c                                              | 2 +-
+ iptables/tests/shell/testcases/iptables/0004-return-codes_0 | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 9a56b1fbffcbc..7349904896228 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3594,7 +3594,7 @@ bool nft_is_table_compatible(struct nft_handle *h,
+ 	if (chain) {
+ 		struct nftnl_chain *c = nft_chain_find(h, table, chain);
+ 
+-		return c && !nft_is_chain_compatible(c, h);
++		return !c || !nft_is_chain_compatible(c, h);
+ 	}
+ 
+ 	clist = nft_chain_list_get(h, table, chain);
+diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+index dcd9dfd3c0806..10e8c1f284080 100755
+--- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
++++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
+@@ -58,6 +58,7 @@ cmd 1 "$ENOENT" -Z bar
+ cmd 0 -E foo bar
+ cmd 1 "$EEXIST_F" -E foo bar
+ cmd 1 "$ENOENT" -E foo bar2
++cmd 1 "$ENOENT" -L foo
+ cmd 0 -N foo2
+ cmd 1 "$EEXIST_F" -E foo2 bar
+ 
+-- 
+2.40.0
+
diff --git a/SOURCES/0142-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch b/SOURCES/0142-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
new file mode 100644
index 0000000..0118964
--- /dev/null
+++ b/SOURCES/0142-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
@@ -0,0 +1,339 @@
+From 83ad886f653aa21e8c12903272ce8e7a863f56b3 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 11 Jul 2023 22:06:44 +0200
+Subject: [PATCH] nft-bridge: pass context structure to ops->add() to improve
+ anonymous set support
+
+Add context structure to improve bridge among support which creates an
+anonymous set. This context structure specifies the command and it
+allows to optionally store a anonymous set.
+
+Use this context to generate native bytecode only if this is an
+add/insert/replace command.
+
+This fixes a dangling anonymous set that is created on rule removal.
+
+Fixes: 26753888720d ("nft: bridge: Rudimental among extension support")
+Reported-and-tested-by: Igor Raits <igor@gooddata.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 4e95200ded923f0eb5579c33b91176193c59dbe0)
+
+Conflicts:
+	iptables/nft-arp.c
+	iptables/nft-bridge.c
+	iptables/nft-ipv4.c
+	iptables/nft-ipv6.c
+	iptables/nft-shared.h
+	iptables/nft.c
+	iptables/nft.h
+-> Manually applied, too many conflicts.
+---
+ iptables/nft-arp.c    |  3 ++-
+ iptables/nft-bridge.c |  9 +++++----
+ iptables/nft-cmd.c    |  6 +++++-
+ iptables/nft-ipv4.c   |  5 +++--
+ iptables/nft-ipv6.c   |  5 +++--
+ iptables/nft-shared.h |  4 +++-
+ iptables/nft.c        | 42 +++++++++++++++++++++++++++++-------------
+ iptables/nft.h        |  9 ++++++---
+ 8 files changed, 56 insertions(+), 27 deletions(-)
+
+diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
+index fa1676e7fd878..2b6bda617e32c 100644
+--- a/iptables/nft-arp.c
++++ b/iptables/nft-arp.c
+@@ -54,7 +54,8 @@ static bool need_devaddr(struct arpt_devaddr_info *info)
+ 	return false;
+ }
+ 
+-static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
++static int nft_arp_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
++		       struct nftnl_rule *r, void *data)
+ {
+ 	struct iptables_command_state *cs = data;
+ 	struct arpt_entry *fw = &cs->arp;
+diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
+index 48bcda61cfb9c..11422a187097c 100644
+--- a/iptables/nft-bridge.c
++++ b/iptables/nft-bridge.c
+@@ -131,17 +131,18 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
+ 
+ static int
+ nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
+-		     struct nftnl_rule *r, struct xt_entry_match *m)
++		     struct nft_rule_ctx *ctx, struct nftnl_rule *r,
++		     struct xt_entry_match *m)
+ {
+ 	if (!strcmp(m->u.user.name, "802_3") &&
+ 	    !(fw->bitmask & EBT_802_3))
+ 		xtables_error(PARAMETER_PROBLEM,
+ 			      "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH");
+ 
+-	return add_match(h, r, m);
++	return add_match(h, ctx, r, m);
+ }
+ 
+-static int nft_bridge_add(struct nft_handle *h,
++static int nft_bridge_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 			  struct nftnl_rule *r, void *data)
+ {
+ 	struct iptables_command_state *cs = data;
+@@ -202,7 +203,7 @@ static int nft_bridge_add(struct nft_handle *h,
+ 
+ 	for (iter = cs->match_list; iter; iter = iter->next) {
+ 		if (iter->ismatch) {
+-			if (nft_bridge_add_match(h, fw, r, iter->u.match->m))
++			if (nft_bridge_add_match(h, fw, ctx, r, iter->u.match->m))
+ 				break;
+ 		} else {
+ 			if (add_target(r, iter->u.watcher->t))
+diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
+index fd038503d87e1..9d1c082ef62d0 100644
+--- a/iptables/nft-cmd.c
++++ b/iptables/nft-cmd.c
+@@ -13,12 +13,16 @@
+ #include <string.h>
+ #include "nft.h"
+ #include "nft-cmd.h"
++#include <libnftnl/set.h>
+ 
+ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 			    const char *table, const char *chain,
+ 			    struct iptables_command_state *state,
+ 			    int rulenum, bool verbose)
+ {
++	struct nft_rule_ctx ctx = {
++		.command = command,
++	};
+ 	struct nftnl_rule *rule;
+ 	struct nft_cmd *cmd;
+ 
+@@ -34,7 +38,7 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
+ 	cmd->verbose = verbose;
+ 
+ 	if (state) {
+-		rule = nft_rule_new(h, chain, table, state);
++		rule = nft_rule_new(h, &ctx, chain, table, state);
+ 		if (!rule) {
+ 			nft_cmd_free(cmd);
+ 			return NULL;
+diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
+index a70e9ece248fe..e06d086bbf82a 100644
+--- a/iptables/nft-ipv4.c
++++ b/iptables/nft-ipv4.c
+@@ -26,7 +26,8 @@
+ #include "nft.h"
+ #include "nft-shared.h"
+ 
+-static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
++static int nft_ipv4_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
++			struct nftnl_rule *r, void *data)
+ {
+ 	struct iptables_command_state *cs = data;
+ 	struct xtables_rule_match *matchp;
+@@ -79,7 +80,7 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
+ 	add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO);
+ 
+ 	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+-		ret = add_match(h, r, matchp->match->m);
++		ret = add_match(h, ctx, r, matchp->match->m);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
+index 69d9bc41314fc..7c8e8b82cf521 100644
+--- a/iptables/nft-ipv6.c
++++ b/iptables/nft-ipv6.c
+@@ -25,7 +25,8 @@
+ #include "nft.h"
+ #include "nft-shared.h"
+ 
+-static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
++static int nft_ipv6_add(struct nft_handle *h, struct nft_rule_ctx *ctx,
++			struct nftnl_rule *r, void *data)
+ {
+ 	struct iptables_command_state *cs = data;
+ 	struct xtables_rule_match *matchp;
+@@ -68,7 +69,7 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
+ 	add_compat(r, cs->fw6.ipv6.proto, cs->fw6.ipv6.invflags & XT_INV_PROTO);
+ 
+ 	for (matchp = cs->matches; matchp; matchp = matchp->next) {
+-		ret = add_match(h, r, matchp->match->m);
++		ret = add_match(h, ctx, r, matchp->match->m);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
+index e3c1b202b8638..c29ad12e9151a 100644
+--- a/iptables/nft-shared.h
++++ b/iptables/nft-shared.h
+@@ -35,6 +35,7 @@
+ 			| FMT_NUMERIC | FMT_NOTABLE)
+ #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
+ 
++struct nft_rule_ctx;
+ struct xtables_args;
+ struct nft_handle;
+ struct xt_xlate;
+@@ -74,7 +75,8 @@ struct nft_xt_ctx {
+ };
+ 
+ struct nft_family_ops {
+-	int (*add)(struct nft_handle *h, struct nftnl_rule *r, void *data);
++	int (*add)(struct nft_handle *h, struct nft_rule_ctx *ctx,
++		   struct nftnl_rule *r, void *data);
+ 	bool (*is_same)(const void *data_a,
+ 			const void *data_b);
+ 	void (*print_payload)(struct nftnl_expr *e,
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 7349904896228..936204a432621 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1064,7 +1064,8 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags)
+ #define NFT_DATATYPE_ETHERADDR	9
+ 
+ static int __add_nft_among(struct nft_handle *h, const char *table,
+-			   struct nftnl_rule *r, struct nft_among_pair *pairs,
++			   struct nft_rule_ctx *ctx, struct nftnl_rule *r,
++			   struct nft_among_pair *pairs,
+ 			   int cnt, bool dst, bool inv, bool ip)
+ {
+ 	uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN;
+@@ -1142,7 +1143,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 	return 0;
+ }
+ 
+-static int add_nft_among(struct nft_handle *h,
++static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 			 struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)m->data;
+@@ -1157,25 +1158,33 @@ static int add_nft_among(struct nft_handle *h,
+ 	}
+ 
+ 	if (data->src.cnt)
+-		__add_nft_among(h, table, r, data->pairs, data->src.cnt,
++		__add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt,
+ 				false, data->src.inv, data->src.ip);
+ 	if (data->dst.cnt)
+-		__add_nft_among(h, table, r, data->pairs + data->src.cnt,
++		__add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt,
+ 				data->dst.cnt, true, data->dst.inv,
+ 				data->dst.ip);
+ 	return 0;
+ }
+ 
+-int add_match(struct nft_handle *h,
++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 	      struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nftnl_expr *expr;
+ 	int ret;
+ 
+-	if (!strcmp(m->u.user.name, "limit"))
+-		return add_nft_limit(r, m);
+-	else if (!strcmp(m->u.user.name, "among"))
+-		return add_nft_among(h, r, m);
++	switch (ctx->command) {
++	case NFT_COMPAT_RULE_APPEND:
++	case NFT_COMPAT_RULE_INSERT:
++	case NFT_COMPAT_RULE_REPLACE:
++		if (!strcmp(m->u.user.name, "limit"))
++			return add_nft_limit(r, m);
++		else if (!strcmp(m->u.user.name, "among"))
++			return add_nft_among(h, ctx, r, m);
++		break;
++	default:
++		break;
++	}
+ 
+ 	expr = nftnl_expr_alloc("match");
+ 	if (expr == NULL)
+@@ -1378,7 +1387,8 @@ void add_compat(struct nftnl_rule *r, uint32_t proto, bool inv)
+ }
+ 
+ struct nftnl_rule *
+-nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
++nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *ctx,
++	     const char *chain, const char *table,
+ 	     void *data)
+ {
+ 	struct nftnl_rule *r;
+@@ -1391,7 +1401,7 @@ nft_rule_new(struct nft_handle *h, const char *chain, const char *table,
+ 	nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table);
+ 	nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain);
+ 
+-	if (h->ops->add(h, r, data) < 0)
++	if (h->ops->add(h, ctx, r, data) < 0)
+ 		goto err;
+ 
+ 	return r;
+@@ -2599,6 +2609,9 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ {
+ 	struct iptables_command_state cs = {};
+ 	struct nftnl_rule *r, *new_rule;
++	struct nft_rule_ctx ctx = {
++		.command = NFT_COMPAT_RULE_APPEND,
++	};
+ 	struct nftnl_chain *c;
+ 	int ret = 0;
+ 
+@@ -2617,7 +2630,7 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain,
+ 
+ 	h->ops->rule_to_cs(h, r, &cs);
+ 	cs.counters.pcnt = cs.counters.bcnt = 0;
+-	new_rule = nft_rule_new(h, chain, table, &cs);
++	new_rule = nft_rule_new(h, &ctx, chain, table, &cs);
+ 	h->ops->clear_cs(&cs);
+ 
+ 	if (!new_rule)
+@@ -2981,6 +2994,9 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 		.eb.bitmask = EBT_NOPROTO,
+ 	};
+ 	struct nftnl_udata_buf *udata;
++	struct nft_rule_ctx ctx = {
++		.command	= NFT_COMPAT_RULE_APPEND,
++	};
+ 	struct nft_handle *h = data;
+ 	struct nftnl_rule *r;
+ 	const char *pname;
+@@ -3008,7 +3024,7 @@ static int ebt_add_policy_rule(struct nftnl_chain *c, void *data)
+ 
+ 	command_jump(&cs, pname);
+ 
+-	r = nft_rule_new(h, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
++	r = nft_rule_new(h, &ctx, nftnl_chain_get_str(c, NFTNL_CHAIN_NAME),
+ 			 nftnl_chain_get_str(c, NFTNL_CHAIN_TABLE), &cs);
+ 	ebt_cs_clean(&cs);
+ 
+diff --git a/iptables/nft.h b/iptables/nft.h
+index bd783231156b7..7baceaa44f698 100644
+--- a/iptables/nft.h
++++ b/iptables/nft.h
+@@ -165,9 +165,11 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h,
+ /*
+  * Operations with rule-set.
+  */
+-struct nftnl_rule;
++struct nft_rule_ctx {
++	int			command;
++};
+ 
+-struct nftnl_rule *nft_rule_new(struct nft_handle *h, const char *chain, const char *table, void *data);
++struct nftnl_rule *nft_rule_new(struct nft_handle *h, struct nft_rule_ctx *rule, const char *chain, const char *table, void *data);
+ int nft_rule_append(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, struct nftnl_rule *ref, bool verbose);
+ int nft_rule_insert(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, int rulenum, bool verbose);
+ int nft_rule_check(struct nft_handle *h, const char *chain, const char *table, struct nftnl_rule *r, bool verbose);
+@@ -185,7 +187,8 @@ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char *
+  */
+ int add_counters(struct nftnl_rule *r, uint64_t packets, uint64_t bytes);
+ int add_verdict(struct nftnl_rule *r, int verdict);
+-int add_match(struct nft_handle *h, struct nftnl_rule *r, struct xt_entry_match *m);
++int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
++	      struct nftnl_rule *r, struct xt_entry_match *m);
+ int add_target(struct nftnl_rule *r, struct xt_entry_target *t);
+ int add_jumpto(struct nftnl_rule *r, const char *name, int verdict);
+ int add_action(struct nftnl_rule *r, struct iptables_command_state *cs, bool goto_set);
+-- 
+2.40.0
+
diff --git a/SOURCES/0143-nft-Special-casing-for-among-match-in-compare_matche.patch b/SOURCES/0143-nft-Special-casing-for-among-match-in-compare_matche.patch
new file mode 100644
index 0000000..7f5f353
--- /dev/null
+++ b/SOURCES/0143-nft-Special-casing-for-among-match-in-compare_matche.patch
@@ -0,0 +1,46 @@
+From 1dcbf8ed6849543fcaffb8af0d50e08e27232ce2 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Fri, 21 Jul 2023 13:14:36 +0200
+Subject: [PATCH] nft: Special casing for among match in compare_matches()
+
+When other extensions may have "garbage" appended to their data which
+should not be considered for match comparison, among match is the
+opposite in that it extends its data beyond the value in 'size' field.
+Add special casing to cover for this, avoiding false-positive rule
+comparison.
+
+Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit 10583537004f7ecd4aa11f6c12b7ba73fb77fc11)
+---
+ iptables/nft-shared.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
+index ed093c07d7617..0b5745f7e82f4 100644
+--- a/iptables/nft-shared.c
++++ b/iptables/nft-shared.c
+@@ -911,6 +911,7 @@ bool compare_matches(struct xtables_rule_match *mt1,
+ 	for (mp1 = mt1, mp2 = mt2; mp1 && mp2; mp1 = mp1->next, mp2 = mp2->next) {
+ 		struct xt_entry_match *m1 = mp1->match->m;
+ 		struct xt_entry_match *m2 = mp2->match->m;
++		size_t cmplen = mp1->match->userspacesize;
+ 
+ 		if (strcmp(m1->u.user.name, m2->u.user.name) != 0) {
+ 			DEBUGP("mismatching match name\n");
+@@ -922,8 +923,10 @@ bool compare_matches(struct xtables_rule_match *mt1,
+ 			return false;
+ 		}
+ 
+-		if (memcmp(m1->data, m2->data,
+-			   mp1->match->userspacesize) != 0) {
++		if (!strcmp(m1->u.user.name, "among"))
++			cmplen = m1->u.match_size - sizeof(*m1);
++
++		if (memcmp(m1->data, m2->data, cmplen) != 0) {
+ 			DEBUGP("mismatch match data\n");
+ 			return false;
+ 		}
+-- 
+2.40.0
+
diff --git a/SOURCES/0144-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch b/SOURCES/0144-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
new file mode 100644
index 0000000..8ca59c4
--- /dev/null
+++ b/SOURCES/0144-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
@@ -0,0 +1,67 @@
+From 4cde53b041a39a0fe9a1c2701b00216f34510f7b Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Sat, 15 Jul 2023 01:35:39 +0200
+Subject: [PATCH] nft: Do not pass nft_rule_ctx to add_nft_among()
+
+It is not used, must be a left-over from an earlier version of the fixed
+commit.
+
+Fixes: 4e95200ded923 ("nft-bridge: pass context structure to ops->add() to improve anonymous set support")
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+(cherry picked from commit bd71c11a95ab2b44794843fd8a3698039a7db211)
+
+Conflicts:
+	iptables/nft.c
+-> Context conflict due to missing other native expression conversions.
+---
+ iptables/nft.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 936204a432621..c3b819f1934a8 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1064,8 +1064,7 @@ gen_lookup(uint32_t sreg, const char *set_name, uint32_t set_id, uint32_t flags)
+ #define NFT_DATATYPE_ETHERADDR	9
+ 
+ static int __add_nft_among(struct nft_handle *h, const char *table,
+-			   struct nft_rule_ctx *ctx, struct nftnl_rule *r,
+-			   struct nft_among_pair *pairs,
++			   struct nftnl_rule *r, struct nft_among_pair *pairs,
+ 			   int cnt, bool dst, bool inv, bool ip)
+ {
+ 	uint32_t set_id, type = NFT_DATATYPE_ETHERADDR, len = ETH_ALEN;
+@@ -1143,7 +1142,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
+ 	return 0;
+ }
+ 
+-static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
++static int add_nft_among(struct nft_handle *h,
+ 			 struct nftnl_rule *r, struct xt_entry_match *m)
+ {
+ 	struct nft_among_data *data = (struct nft_among_data *)m->data;
+@@ -1158,10 +1157,10 @@ static int add_nft_among(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 	}
+ 
+ 	if (data->src.cnt)
+-		__add_nft_among(h, table, ctx, r, data->pairs, data->src.cnt,
++		__add_nft_among(h, table, r, data->pairs, data->src.cnt,
+ 				false, data->src.inv, data->src.ip);
+ 	if (data->dst.cnt)
+-		__add_nft_among(h, table, ctx, r, data->pairs + data->src.cnt,
++		__add_nft_among(h, table, r, data->pairs + data->src.cnt,
+ 				data->dst.cnt, true, data->dst.inv,
+ 				data->dst.ip);
+ 	return 0;
+@@ -1180,7 +1179,7 @@ int add_match(struct nft_handle *h, struct nft_rule_ctx *ctx,
+ 		if (!strcmp(m->u.user.name, "limit"))
+ 			return add_nft_limit(r, m);
+ 		else if (!strcmp(m->u.user.name, "among"))
+-			return add_nft_among(h, ctx, r, m);
++			return add_nft_among(h, r, m);
+ 		break;
+ 	default:
+ 		break;
+-- 
+2.40.0
+
diff --git a/SOURCES/0145-iptables-nft-fix-basechain-policy-configuration.patch b/SOURCES/0145-iptables-nft-fix-basechain-policy-configuration.patch
new file mode 100644
index 0000000..4650ca5
--- /dev/null
+++ b/SOURCES/0145-iptables-nft-fix-basechain-policy-configuration.patch
@@ -0,0 +1,82 @@
+From c5533b1a742253bf5c5ad3ae766ef3348f65f923 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Fri, 2 Oct 2020 13:44:36 +0200
+Subject: [PATCH 145/145] iptables-nft: fix basechain policy configuration
+
+Previous to this patch, the basechain policy could not be properly
+configured if it wasn't explictly set when loading the ruleset, leading
+to iptables-nft-restore (and ip6tables-nft-restore) trying to send an
+invalid ruleset to the kernel.
+
+Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 0bd7a8eaf3582159490ab355b1217a4e42ed021f)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c                                |  6 +++-
+ .../nft-only/0008-basechain-policy_0          | 29 +++++++++++++++++++
+ 2 files changed, 34 insertions(+), 1 deletion(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0008-basechain-policy_0
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index c3b819f1934a8..6096647bc472d 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -685,7 +685,9 @@ nft_chain_builtin_alloc(const struct builtin_table *table,
+ 	nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain->name);
+ 	nftnl_chain_set_u32(c, NFTNL_CHAIN_HOOKNUM, chain->hook);
+ 	nftnl_chain_set_u32(c, NFTNL_CHAIN_PRIO, chain->prio);
+-	nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, policy);
++	if (policy >= 0)
++		nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, policy);
++
+ 	nftnl_chain_set_str(c, NFTNL_CHAIN_TYPE, chain->type);
+ 
+ 	return c;
+@@ -927,6 +929,8 @@ int nft_chain_set(struct nft_handle *h, const char *table,
+ 		c = nft_chain_new(h, table, chain, NF_DROP, counters);
+ 	else if (strcmp(policy, "ACCEPT") == 0)
+ 		c = nft_chain_new(h, table, chain, NF_ACCEPT, counters);
++	else if (strcmp(policy, "-") == 0)
++		c = nft_chain_new(h, table, chain, -1, counters);
+ 	else
+ 		errno = EINVAL;
+ 
+diff --git a/iptables/tests/shell/testcases/nft-only/0008-basechain-policy_0 b/iptables/tests/shell/testcases/nft-only/0008-basechain-policy_0
+new file mode 100755
+index 0000000000000..a81e9badc43a5
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0008-basechain-policy_0
+@@ -0,0 +1,29 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++set -e
++
++$XT_MULTI iptables -t raw -P OUTPUT DROP
++
++# make sure iptables-nft-restore can correctly handle basechain policies when
++# they aren't set with --noflush
++#
++$XT_MULTI iptables-restore --noflush <<EOF
++*raw
++:OUTPUT - [0:0]
++:PREROUTING - [0:0]
++:neutron-linuxbri-OUTPUT - [0:0]
++:neutron-linuxbri-PREROUTING - [0:0]
++-I OUTPUT 1 -j neutron-linuxbri-OUTPUT
++-I PREROUTING 1 -j neutron-linuxbri-PREROUTING
++-I neutron-linuxbri-PREROUTING 1 -m physdev --physdev-in brq7425e328-56 -j CT --zone 4097
++-I neutron-linuxbri-PREROUTING 2 -i brq7425e328-56 -j CT --zone 4097
++-I neutron-linuxbri-PREROUTING 3 -m physdev --physdev-in tap7f101a28-1d -j CT --zone 4097
++
++COMMIT
++EOF
++
++$XT_MULTI iptables-save | grep -C2 raw | grep OUTPUT | grep DROP
++if [ $? -ne 0 ]; then
++	exit 1
++fi
+-- 
+2.41.0
+
diff --git a/SOURCES/iptables-test.stderr.expect b/SOURCES/iptables-test.stderr.expect
new file mode 100644
index 0000000..5a09a93
--- /dev/null
+++ b/SOURCES/iptables-test.stderr.expect
@@ -0,0 +1,39 @@
+extensions/libip6t_srh.t: ERROR: line 2 (cannot load: ip6tables -A INPUT -m srh --srh-next-hdr 17)
+extensions/libip6t_srh.t: ERROR: line 3 (cannot load: ip6tables -A INPUT -m srh --srh-hdr-len-eq 8)
+extensions/libip6t_srh.t: ERROR: line 4 (cannot load: ip6tables -A INPUT -m srh --srh-hdr-len-gt 8)
+extensions/libip6t_srh.t: ERROR: line 5 (cannot load: ip6tables -A INPUT -m srh --srh-hdr-len-lt 8)
+extensions/libip6t_srh.t: ERROR: line 6 (cannot load: ip6tables -A INPUT -m srh --srh-segs-left-eq 1)
+extensions/libip6t_srh.t: ERROR: line 7 (cannot load: ip6tables -A INPUT -m srh --srh-segs-left-gt 1)
+extensions/libip6t_srh.t: ERROR: line 8 (cannot load: ip6tables -A INPUT -m srh --srh-segs-left-lt 1)
+extensions/libip6t_srh.t: ERROR: line 9 (cannot load: ip6tables -A INPUT -m srh --srh-last-entry-eq 4)
+extensions/libip6t_srh.t: ERROR: line 10 (cannot load: ip6tables -A INPUT -m srh --srh-last-entry-gt 4)
+extensions/libip6t_srh.t: ERROR: line 11 (cannot load: ip6tables -A INPUT -m srh --srh-last-entry-lt 4)
+extensions/libip6t_srh.t: ERROR: line 12 (cannot load: ip6tables -A INPUT -m srh --srh-tag 0)
+extensions/libip6t_srh.t: ERROR: line 13 (cannot load: ip6tables -A INPUT -m srh ! --srh-next-hdr 17)
+extensions/libip6t_srh.t: ERROR: line 14 (cannot load: ip6tables -A INPUT -m srh ! --srh-hdr-len-eq 8)
+extensions/libip6t_srh.t: ERROR: line 15 (cannot load: ip6tables -A INPUT -m srh ! --srh-hdr-len-gt 8)
+extensions/libip6t_srh.t: ERROR: line 16 (cannot load: ip6tables -A INPUT -m srh ! --srh-hdr-len-lt 8)
+extensions/libip6t_srh.t: ERROR: line 17 (cannot load: ip6tables -A INPUT -m srh ! --srh-segs-left-eq 1)
+extensions/libip6t_srh.t: ERROR: line 18 (cannot load: ip6tables -A INPUT -m srh ! --srh-segs-left-gt 1)
+extensions/libip6t_srh.t: ERROR: line 19 (cannot load: ip6tables -A INPUT -m srh ! --srh-segs-left-lt 1)
+extensions/libip6t_srh.t: ERROR: line 20 (cannot load: ip6tables -A INPUT -m srh ! --srh-last-entry-eq 4)
+extensions/libip6t_srh.t: ERROR: line 21 (cannot load: ip6tables -A INPUT -m srh ! --srh-last-entry-gt 4)
+extensions/libip6t_srh.t: ERROR: line 22 (cannot load: ip6tables -A INPUT -m srh ! --srh-last-entry-lt 4)
+extensions/libip6t_srh.t: ERROR: line 23 (cannot load: ip6tables -A INPUT -m srh ! --srh-tag 0)
+extensions/libip6t_srh.t: ERROR: line 24 (cannot load: ip6tables -A INPUT -m srh --srh-next-hdr 17 --srh-segs-left-eq 1 --srh-last-entry-eq 4 --srh-tag 0)
+extensions/libip6t_srh.t: ERROR: line 25 (cannot load: ip6tables -A INPUT -m srh ! --srh-next-hdr 17 ! --srh-segs-left-eq 0 --srh-tag 0)
+extensions/libip6t_srh.t: ERROR: line 26 (cannot load: ip6tables -A INPUT -m srh --srh-psid a::/64 --srh-nsid b::/128 --srh-lsid c::/0)
+extensions/libip6t_srh.t: ERROR: line 27 (cannot load: ip6tables -A INPUT -m srh ! --srh-psid a::/64 ! --srh-nsid b::/128 ! --srh-lsid c::/0)
+extensions/libip6t_srh.t: ERROR: line 28 (cannot load: ip6tables -A INPUT -m srh)
+extensions/libipt_CLUSTERIP.t: ERROR: line 3 (cannot load: iptables -A INPUT -d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 1 --hash-init 1)
+extensions/libipt_CLUSTERIP.t: ERROR: line 4 (cannot load: iptables -A INPUT -d 10.31.3.236/32 -i lo -j CLUSTERIP --new --hashmode sourceip --clustermac 01:AA:7B:47:F7:D7 --total-nodes 2 --local-node 2 --hash-init 1)
+extensions/libxt_IDLETIMER.t: ERROR: line 5 (cannot load: iptables -A INPUT -j IDLETIMER --timeout 42 --label bar --alarm)
+extensions/libxt_LED.t: ERROR: line 3 (cannot load: iptables -A INPUT -j LED --led-trigger-id "foo")
+extensions/libxt_LED.t: ERROR: line 4 (cannot load: iptables -A INPUT -j LED --led-trigger-id "foo" --led-delay 42 --led-always-blink)
+extensions/libxt_TCPMSS.t: ERROR: line 4 (should fail: iptables -A FORWARD -t mangle -p tcp -j TCPMSS --set-mss 42)
+extensions/libxt_ipcomp.t: ERROR: line 2 (cannot load: iptables -A INPUT -p ipcomp -m ipcomp --ipcompspi 18 -j DROP)
+extensions/libxt_ipcomp.t: ERROR: line 3 (cannot load: iptables -A INPUT -p ipcomp -m ipcomp ! --ipcompspi 18 -j ACCEPT)
+extensions/libxt_time.t: ERROR: line 2 (cannot load: iptables -A INPUT -m time --timestart 01:02:03 --timestop 04:05:06 --monthdays 1,2,3,4,5 --weekdays Mon,Fri,Sun --datestart 2001-02-03T04:05:06 --datestop 2012-09-08T09:06:05 --kerneltz)
+extensions/libxt_time.t: ERROR: line 3 (cannot load: iptables -A INPUT -m time --timestart 01:02:03 --timestop 04:05:06 --monthdays 1,2,3,4,5 --weekdays Mon,Fri,Sun --datestart 2001-02-03T04:05:06 --datestop 2012-09-08T09:06:05)
+extensions/libxt_time.t: ERROR: line 4 (cannot load: iptables -A INPUT -m time --timestart 02:00:00 --timestop 03:00:00 --datestart 1970-01-01T02:00:00 --datestop 1970-01-01T03:00:00)
+extensions/libxt_u32.t: ERROR: line 2 (cannot load: iptables -A INPUT -m u32 --u32 "0x0=0x0&&0x0=0x1")
diff --git a/SPECS/iptables.spec b/SPECS/iptables.spec
index beaf5cb..479f5dd 100644
--- a/SPECS/iptables.spec
+++ b/SPECS/iptables.spec
@@ -4,20 +4,13 @@
 # service legacy actions (RHBZ#748134)
 %global legacy_actions %{_libexecdir}/initscripts/legacy-actions
 
-# boostrap mode to assist in libip{4,6}tc SONAME bump
-%global bootstrap 1
-
-%if 0%{?bootstrap}
-%global version_old 1.8.2
-%global iptc_so_ver_old 0
-%endif
 %global iptc_so_ver 2
 
 Name: iptables
 Summary: Tools for managing Linux kernel packet filtering capabilities
 URL: http://www.netfilter.org/projects/iptables
-Version: 1.8.4
-Release: 24%{?dist}
+Version: 1.8.5
+Release: 10%{?dist}
 Source: %{url}/files/%{name}-%{version}.tar.bz2
 Source1: iptables.init
 Source2: iptables-config
@@ -29,89 +22,153 @@ Source7: arptables-helper
 Source8: ebtables.systemd
 Source9: ebtables.service
 Source10: ebtables-config
-%if 0%{?bootstrap}
-Source11: %{url}/files/%{name}-%{version_old}.tar.bz2
-Source12: 0003-extensions-format-security-fixes-in-libip-6-t_icmp.patch
-%endif
+Source11: iptables-test.stderr.expect
 
-Patch01: 0001-iptables-apply-Use-mktemp-instead-of-tempfile.patch
-Patch02: 0002-xtables-restore-Fix-parser-feed-from-line-buffer.patch
-Patch03: 0003-xtables-restore-Avoid-access-of-uninitialized-data.patch
-Patch04: 0004-extensions-time-Avoid-undefined-shift.patch
-Patch05: 0005-extensions-cluster-Avoid-undefined-shift.patch
-Patch06: 0006-libxtables-Avoid-buffer-overrun-in-xtables_compatibl.patch
-Patch07: 0007-xtables-translate-Guard-strcpy-call-in-xlate_ifname.patch
-Patch08: 0008-extensions-among-Check-call-to-fstat.patch
-Patch09: 0009-uapi-netfilter-Avoid-undefined-left-shift-in-xt_sctp.patch
-Patch10: 0010-xtables-translate-Fix-for-interface-name-corner-case.patch
-Patch11: 0011-xtables-translate-Fix-for-iface.patch
-Patch12: 0012-tests-shell-Fix-skip-checks-with-host-mode.patch
-Patch13: 0013-xtables-restore-fix-for-noflush-and-empty-lines.patch
-Patch14: 0014-iptables-test.py-Fix-host-mode.patch
-Patch15: 0015-xtables-Review-nft_init.patch
-Patch16: 0016-nft-cache-Fix-nft_release_cache-under-stress.patch
-Patch17: 0017-nft-cache-Fix-iptables-save-segfault-under-stress.patch
-Patch18: 0018-ebtables-among-Support-mixed-MAC-and-MAC-IP-entries.patch
-Patch19: 0019-xtables-Align-effect-of-4-6-options-with-legacy.patch
-Patch20: 0020-xtables-Drop-4-and-6-support-from-xtables-save-resto.patch
-Patch21: 0021-nfnl_osf-Fix-broken-conversion-to-nfnl_query.patch
-Patch22: 0022-nfnl_osf-Improve-error-handling.patch
-Patch23: 0023-nft-cache-Reset-genid-when-rebuilding-cache.patch
-Patch24: 0024-nft-Fix-for-F-in-iptables-dumps.patch
-Patch25: 0025-tests-shell-Test-F-in-dump-files.patch
-Patch26: 0026-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
-Patch27: 0027-nft-Fix-error-reporting-for-refreshed-transactions.patch
-Patch28: 0028-nft-Fix-for-concurrent-noflush-restore-calls.patch
-Patch29: 0029-tests-shell-Improve-concurrent-noflush-restore-test-.patch
-Patch30: 0030-nft-cache-Make-nft_rebuild_cache-respect-fake-cache.patch
-Patch31: 0031-nft-Fix-for-broken-address-mask-match-detection.patch
-Patch32: 0032-nft-Optimize-class-based-IP-prefix-matches.patch
-Patch33: 0033-ebtables-Optimize-masked-MAC-address-matches.patch
-Patch34: 0034-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
-Patch35: 0035-libxtables-Make-sure-extensions-register-in-revision.patch
-Patch36: 0036-libxtables-Simplify-pending-extension-registration.patch
-Patch37: 0037-libxtables-Register-multiple-extensions-in-ascending.patch
-Patch38: 0038-tests-shell-Test-for-fixed-extension-registration.patch
-Patch39: 0039-extensions-libipt_icmp-Fix-translation-of-type-any.patch
-Patch40: 0040-extensions-libxt_CT-add-translation-for-NOTRACK.patch
-Patch41: 0041-nft-Fix-command-name-in-ip6tables-error-message.patch
-Patch42: 0042-tests-shell-Merge-and-extend-return-codes-test.patch
-Patch43: 0043-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
-Patch44: 0044-xtables-monitor-Fix-ip6tables-rule-printing.patch
-Patch45: 0045-xtables-monitor-fix-rule-printing.patch
-Patch46: 0046-xtables-monitor-fix-packet-family-protocol.patch
-Patch47: 0047-xtables-monitor-print-packet-first.patch
-Patch48: 0048-xtables-monitor.patch
-Patch49: 0049-nft-Fix-bitwise-expression-avoidance-detection.patch
-Patch50: 0050-xtables-translate-Fix-translation-of-odd-netmasks.patch
-Patch51: 0051-Eliminate-inet_aton-and-inet_ntoa.patch
-Patch52: 0052-xtables-arp-Don-t-use-ARPT_INV_.patch
-Patch53: 0053-nft-arp-Make-use-of-ipv4_addr_to_string.patch
-Patch54: 0054-extensions-SECMARK-Implement-revision-1.patch
-Patch55: 0055-extensions-sctp-Fix-nftables-translation.patch
-Patch56: 0056-extensions-sctp-Translate-chunk-types-option.patch
-Patch57: 0057-extensions-SECMARK-Use-a-better-context-in-test-case.patch
-Patch58: 0058-nft-cache-Retry-if-kernel-returns-EINTR.patch
-Patch59: 0059-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
-Patch60: 0060-ebtables-Dump-atomic-waste.patch
-Patch61: 0061-extensions-hashlimit-Fix-tests-with-HZ-100.patch
-Patch62: 0062-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
-Patch63: 0063-nft-Simplify-immediate-parsing.patch
-Patch64: 0064-nft-Speed-up-immediate-parsing.patch
-Patch65: 0065-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
-Patch66: 0066-xshared-Merge-and-share-parse_chain.patch
-Patch67: 0067-nft-Reject-standard-targets-as-chain-names-when-rest.patch
-Patch68: 0068-libxtables-Implement-notargets-hash-table.patch
-Patch69: 0069-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
-Patch70: 0070-Use-proto_to_name-from-xshared-in-more-places.patch
-Patch71: 0071-libxtables-Register-only-the-highest-revision-extens.patch
-Patch72: 0072-xshared-Fix-response-to-unprivileged-users.patch
-Patch73: 0073-Improve-error-messages-for-unsupported-extensions.patch
-Patch74: 0074-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
-Patch75: 0075-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
-Patch76: 0076-libxtables-Fix-unsupported-extension-warning-corner-.patch
-Patch77: 0077-nft-shared-Introduce-__get_cmp_data.patch
-Patch78: 0078-ebtables-Support-p-Length.patch
+Patch001: 0001-build-resolve-iptables-apply-not-getting-installed.patch
+Patch002: 0002-xtables-translate-don-t-fail-if-help-was-requested.patch
+Patch003: 0003-xtables-translate-Use-proper-clear_cs-function.patch
+Patch004: 0004-libxtables-compiler-warning-fixes-for-NO_SHARED_LIBS.patch
+Patch005: 0005-extensions-libxt_conntrack-provide-translation-for-D.patch
+Patch006: 0006-nft-Drop-pointless-nft_xt_builtin_init-call.patch
+Patch007: 0007-nft-Fix-command-name-in-ip6tables-error-message.patch
+Patch008: 0008-tests-shell-Merge-and-extend-return-codes-test.patch
+Patch009: 0009-xtables-monitor-Fix-ip6tables-rule-printing.patch
+Patch010: 0010-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch
+Patch011: 0011-nft-Fix-for-broken-address-mask-match-detection.patch
+Patch012: 0012-extensions-libipt_icmp-Fix-translation-of-type-any.patch
+Patch013: 0013-libxtables-Make-sure-extensions-register-in-revision.patch
+Patch014: 0014-libxtables-Simplify-pending-extension-registration.patch
+Patch015: 0015-libxtables-Register-multiple-extensions-in-ascending.patch
+Patch016: 0016-nft-Make-batch_add_chain-return-the-added-batch-obje.patch
+Patch017: 0017-nft-Fix-error-reporting-for-refreshed-transactions.patch
+Patch018: 0018-nft-Fix-for-concurrent-noflush-restore-calls.patch
+Patch019: 0019-tests-shell-Improve-concurrent-noflush-restore-test-.patch
+Patch020: 0020-nft-Optimize-class-based-IP-prefix-matches.patch
+Patch021: 0021-ebtables-Optimize-masked-MAC-address-matches.patch
+Patch022: 0022-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch
+Patch023: 0023-ebtables-Fix-for-broken-chain-renaming.patch
+Patch024: 0024-xtables-arp-Don-t-use-ARPT_INV_.patch
+Patch025: 0025-xshared-Merge-some-command-option-related-code.patch
+Patch026: 0026-tests-shell-Test-for-fixed-extension-registration.patch
+Patch027: 0027-extensions-dccp-Fix-for-DCCP-type-INVALID.patch
+Patch028: 0028-xtables-monitor-fix-rule-printing.patch
+Patch029: 0029-xtables-monitor-fix-packet-family-protocol.patch
+Patch030: 0030-xtables-monitor-print-packet-first.patch
+Patch031: 0031-xtables-monitor.patch
+Patch032: 0032-nft-Fix-selective-chain-compatibility-checks.patch
+Patch033: 0033-iptables-nft-fix-Z-option.patch
+Patch034: 0034-nft-Fix-bitwise-expression-avoidance-detection.patch
+Patch035: 0035-xtables-translate-Fix-translation-of-odd-netmasks.patch
+Patch036: 0036-extensions-libxt_conntrack-use-bitops-for-state-nega.patch
+Patch037: 0037-Eliminate-inet_aton-and-inet_ntoa.patch
+Patch038: 0038-nft-arp-Make-use-of-ipv4_addr_to_string.patch
+Patch039: 0039-extensions-SECMARK-Implement-revision-1.patch
+Patch040: 0040-Use-proto_to_name-from-xshared-in-more-places.patch
+Patch041: 0041-extensions-sctp-Fix-nftables-translation.patch
+Patch042: 0042-extensions-sctp-Translate-chunk-types-option.patch
+Patch043: 0043-libxtables-Drop-leftover-variable-in-xtables_numeric.patch
+Patch044: 0044-extensions-libebt_ip6-Drop-unused-variables.patch
+Patch045: 0045-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch
+Patch046: 0046-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch
+Patch047: 0047-iptables-apply-Drop-unused-variable.patch
+Patch048: 0048-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch
+Patch049: 0049-ebtables-Dump-atomic-waste.patch
+Patch050: 0050-nft-Fix-for-non-verbose-check-command.patch
+Patch051: 0051-extensions-hashlimit-Fix-tests-with-HZ-100.patch
+Patch052: 0052-nft-Use-xtables_malloc-in-mnl_err_list_node_add.patch
+Patch053: 0053-extensions-hashlimit-Fix-tests-with-HZ-1000.patch
+Patch054: 0054-xshared-Merge-and-share-parse_chain.patch
+Patch055: 0055-nft-shared-Drop-unused-function-print_proto.patch
+Patch056: 0056-xshared-Make-load_proto-static.patch
+Patch057: 0057-extensions-libxt_NFLOG-fix-nflog-prefix-Python-test-.patch
+Patch058: 0058-extensions-libxt_NFLOG-remove-extra-space-when-savin.patch
+Patch059: 0059-xshared-Fix-response-to-unprivileged-users.patch
+Patch060: 0060-libxtables-Register-only-the-highest-revision-extens.patch
+Patch061: 0061-Improve-error-messages-for-unsupported-extensions.patch
+Patch062: 0062-nft-Simplify-immediate-parsing.patch
+Patch063: 0063-nft-Speed-up-immediate-parsing.patch
+Patch064: 0064-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch
+Patch065: 0065-libxtables-Fix-for-warning-in-xtables_ipmask_to_nume.patch
+Patch066: 0066-nft-Reject-standard-targets-as-chain-names-when-rest.patch
+Patch067: 0067-libxtables-Implement-notargets-hash-table.patch
+Patch068: 0068-libxtables-Boost-rule-target-checks-by-announcing-ch.patch
+Patch069: 0069-nft-shared-update-context-register-for-bitwise-expre.patch
+Patch070: 0070-extensions-MARK-Drop-extra-newline-at-end-of-help.patch
+Patch071: 0071-extensions-LOG-Document-log-macdecode-in-man-page.patch
+Patch072: 0072-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch
+Patch073: 0073-tests-shell-Check-overhead-in-iptables-save-and-rest.patch
+Patch074: 0074-iptables-legacy-Drop-redundant-include-of-xtables-mu.patch
+Patch075: 0075-tests-shell-Add-some-more-rules-to-0002-verbose-outp.patch
+Patch076: 0076-extensions-string-Do-not-print-default-to-value.patch
+Patch077: 0077-xtables-monitor-add-missing-spaces-in-printed-str.patch
+Patch078: 0078-libxtables-Fix-unsupported-extension-warning-corner-.patch
+Patch079: 0079-extensions-libxt_conntrack-remove-always-false-condi.patch
+Patch080: 0080-nft-un-break-among-match-with-concatenation.patch
+Patch081: 0081-nft-shared-Introduce-__get_cmp_data.patch
+Patch082: 0082-ebtables-Support-p-Length.patch
+Patch083: 0083-extensions-among-Remove-pointless-fall-through.patch
+Patch084: 0084-extensions-among-Fix-for-use-with-ebtables-restore.patch
+Patch085: 0085-extensions-libebt_stp-Eliminate-duplicate-space-in-o.patch
+Patch086: 0086-extensions-libip6t_dst-Fix-output-for-empty-options.patch
+Patch087: 0087-extensions-TCPOPTSTRIP-Do-not-print-empty-options.patch
+Patch088: 0088-tests-IDLETIMER.t-Fix-syntax-support-for-restore-inp.patch
+Patch089: 0089-tests-libebt_stp.t-Drop-duplicate-whitespace.patch
+Patch090: 0090-tests-shell-Fix-expected-output-for-ip6tables-dst-ma.patch
+Patch091: 0091-libiptc-Fix-for-segfault-when-renaming-a-chain.patch
+Patch092: 0092-extensions-libebt_mark-Fix-xlate-test-case.patch
+Patch093: 0093-extensions-libebt_redirect-Fix-xlate-return-code.patch
+Patch094: 0094-extensions-libipt_ttl-Sanitize-xlate-callback.patch
+Patch095: 0095-extensions-CONNMARK-Fix-xlate-callback.patch
+Patch096: 0096-extensions-MARK-Sanitize-MARK_xlate.patch
+Patch097: 0097-extensions-TCPMSS-Use-xlate-callback-for-IPv6-too.patch
+Patch098: 0098-extensions-TOS-Fix-v1-xlate-callback.patch
+Patch099: 0099-extensions-ecn-Sanitize-xlate-callback.patch
+Patch100: 0100-extensions-libebt_mark-Fix-mark-target-xlate.patch
+Patch101: 0101-extensions-libxt_conntrack-Drop-extra-whitespace-in-.patch
+Patch102: 0102-iptables-restore-Free-handle-with-test-also.patch
+Patch103: 0103-iptables-xml-Free-allocated-chain-strings.patch
+Patch104: 0104-nft-Plug-memleak-in-nft_rule_zero_counters.patch
+Patch105: 0105-xtables-Introduce-xtables_clear_iptables_command_sta.patch
+Patch106: 0106-iptables-Properly-clear-iptables_command_state-objec.patch
+Patch107: 0107-libiptc-Eliminate-garbage-access.patch
+Patch108: 0108-ebtables-Fix-MAC-address-match-translation.patch
+Patch109: 0109-nft-Fix-for-comparing-ifname-matches-against-nft-gen.patch
+Patch110: 0110-nft-Fix-match-generator-for-i.patch
+Patch111: 0111-xtables-translate-Fix-for-interfaces-with-asterisk-m.patch
+Patch112: 0112-Drop-libiptc-linux_stddef.h.patch
+Patch113: 0113-include-Makefile-xtables-version.h-is-generated.patch
+Patch114: 0114-arptables-Check-the-mandatory-ar_pln-match.patch
+Patch115: 0115-gitignore-Ignore-utils-nfsynproxy.patch
+Patch116: 0116-etc-Drop-xtables.conf.patch
+Patch117: 0117-Proper-fix-for-unknown-argument-error-message.patch
+Patch118: 0118-ebtables-Refuse-unselected-targets-options.patch
+Patch119: 0119-extensions-libebt_redirect-Fix-target-translation.patch
+Patch120: 0120-extensions-libebt_redirect-Fix-for-wrong-syntax-in-t.patch
+Patch121: 0121-extensions-libebt_ip-Do-not-use-ip-dscp-for-translat.patch
+Patch122: 0122-extensions-libebt_ip-Translation-has-to-match-on-eth.patch
+Patch123: 0123-nft-restore-Fix-for-deletion-of-new-referenced-rule.patch
+Patch124: 0124-nft-shared-Drop-unused-include.patch
+Patch125: 0125-arptables-Fix-parsing-of-inverted-arp-operation-matc.patch
+Patch126: 0126-arptables-Don-t-omit-standard-matches-if-inverted.patch
+Patch127: 0127-Revert-arptables-Check-the-mandatory-ar_pln-match.patch
+Patch128: 0128-extensions-SECMARK-Use-a-better-context-in-test-case.patch
+Patch129: 0129-tests-xlate-test-Print-errors-to-stderr.patch
+Patch130: 0130-iptables-test-Make-netns-spawning-more-robust.patch
+Patch131: 0131-tests-iptables-test-Print-errors-to-stderr.patch
+Patch132: 0132-tests-xlate-test-Exit-non-zero-on-error.patch
+Patch133: 0133-tests-iptables-test-Exit-non-zero-on-error.patch
+Patch134: 0134-tests-shell-Return-non-zero-on-error.patch
+Patch135: 0135-iptables-test.py-print-with-color-escapes-only-when-.patch
+Patch136: 0136-tests-iptables-test-Fix-conditional-colors-on-stderr.patch
+Patch137: 0137-tests-shell-update-format-of-registers-in-bitwise-pa.patch
+Patch138: 0138-tests-shell-Fix-nft-only-0009-needless-bitwise_0.patch
+Patch139: 0139-tests-shell-Sanitize-nft-only-0009-needless-bitwise_.patch
+Patch140: 0140-iptables-Fix-setting-of-ipv6-counters.patch
+Patch141: 0141-iptables-Fix-handling-of-non-existent-chains.patch
+Patch142: 0142-nft-bridge-pass-context-structure-to-ops-add-to-impr.patch
+Patch143: 0143-nft-Special-casing-for-among-match-in-compare_matche.patch
+Patch144: 0144-nft-Do-not-pass-nft_rule_ctx-to-add_nft_among.patch
+Patch145: 0145-iptables-nft-fix-basechain-policy-configuration.patch
 
 # pf.os: ISC license
 # iptables-apply: Artistic Licence 2.0
@@ -129,7 +186,7 @@ BuildRequires: bison
 BuildRequires: flex
 BuildRequires: gcc
 BuildRequires: pkgconfig(libmnl) >= 1.0
-BuildRequires: pkgconfig(libnftnl) >= 1.1.5-1
+BuildRequires: pkgconfig(libnftnl) >= 1.1.6
 # libpcap-devel for nfbpf_compile
 BuildRequires: libpcap-devel
 BuildRequires:  autoconf
@@ -242,14 +299,7 @@ replacement of the legacy tool.
 
 %prep
 %autosetup -p1
-
-%if 0%{?bootstrap}
-%{__mkdir} -p bootstrap_ver
-pushd bootstrap_ver
-%{__tar} --strip-components=1 -xf %{SOURCE11}
-%{__patch} -p1 <%{SOURCE12}
-popd
-%endif
+cp %{SOURCE11} .
 
 %build
 ./autogen.sh
@@ -264,31 +314,7 @@ rm -f include/linux/types.h
 
 make %{?_smp_mflags} V=1
 
-%if 0%{?bootstrap}
-pushd bootstrap_ver
-./autogen.sh
-CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing " \
-%configure --enable-devel --enable-bpf-compiler --with-kernel=/usr --with-kbuild=/usr --with-ksource=/usr
-
-# do not use rpath
-sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
-sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
-
-rm -f include/linux/types.h
-
-make %{?_smp_mflags} V=1
-popd
-%endif
-
 %install
-%if 0%{?bootstrap}
-%make_install -C bootstrap_ver
-find %{buildroot} -xtype f -not \
-	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
-find %{buildroot} -type l -not \
-	-name 'libip*tc.so.%{iptc_so_ver_old}*' -delete -print
-%endif
-
 make install DESTDIR=%{buildroot} 
 # remove la file(s)
 rm -f %{buildroot}/%{_libdir}/*.la
@@ -440,6 +466,7 @@ done
 %{_sbindir}/iptables-save
 %{_sbindir}/iptables-translate
 %{_sbindir}/ip6tables
+%{_sbindir}/ip6tables-apply
 %{_sbindir}/ip6tables-restore
 %{_sbindir}/ip6tables-restore-translate
 %{_sbindir}/ip6tables-save
@@ -448,10 +475,7 @@ done
 %{_sbindir}/xtables-nft-multi
 %doc %{_mandir}/man8/iptables*
 %doc %{_mandir}/man8/ip6tables*
-%doc %{_mandir}/man8/xtables-monitor*
-%doc %{_mandir}/man8/xtables-nft*
-%doc %{_mandir}/man8/*tables-translate*
-%doc %{_mandir}/man8/*tables-restore-translate*
+%doc %{_mandir}/man8/xtables-*
 %dir %{_libdir}/xtables
 %{_libdir}/xtables/libarpt*
 %{_libdir}/xtables/libebt*
@@ -461,9 +485,6 @@ done
 
 %files libs
 %{_libdir}/libip*tc.so.%{iptc_so_ver}*
-%if 0%{?bootstrap}
-%{_libdir}/libip*tc.so.%{iptc_so_ver_old}*
-%endif
 %{_libdir}/libxtables.so.12*
 
 %files devel
@@ -520,6 +541,39 @@ done
 %doc %{_mandir}/man8/ebtables*.8*
 
 %changelog
+* Fri Sep 08 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-10
+- Bump NVR to fix for wrong build tag
+
+* Wed Sep 06 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-9
+- iptables-nft: fix basechain policy configuration
+
+* Fri Jul 28 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-8
+- Update fixes from upstream once more
+
+* Wed Jul 19 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-7
+- Fix shell test-case for older gawk version
+
+* Tue Jul 18 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-6
+- Fix shell testcase for rebased libnftnl package
+
+* Tue Jul 18 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-5
+- Missed to copy expected results file to destination.
+
+* Sat Jul 15 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-4
+- Bump release for CI.
+
+* Tue Jul 04 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-3
+- Add expected test results
+- Prepare testsuites for expected results
+
+* Wed Jun 28 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-2
+- libnftnl package was rebased, depending on 1.1.6 is fine
+
+* Wed May 10 2023 Phil Sutter <psutter@redhat.com> - 1.8.5-1
+- Rebase to version 1.8.5 plus upstream-indicated fixes
+- Fix for duplicate files in RPM due to imprecise globbing
+- Drop bootstrap code again
+
 * Wed Nov 23 2022 Phil Sutter <psutter@redhat.com> - 1.8.4-24
 - ebtables: Support '-p Length'
 - nft-shared: Introduce __get_cmp_data()