.gitignore

@@ -1 +1 @@
-SOURCES/iptables-1.8.5.tar.bz2
+SOURCES/iptables-1.8.10.tar.xz

.iptables.metadata

@@ -1 +1 @@
-f177a58d0a71b00d68ef5792ae4676bcc0ad29e6 SOURCES/iptables-1.8.5.tar.bz2
+ddbebf81eacbf900dc6dd4ed409353930397e0c2 SOURCES/iptables-1.8.10.tar.xz

SOURCES/0001-build-resolve-iptables-apply-not-getting-installed.patch

@@ -1,41 +0,0 @@
-From 4806ba770a3aaadd0a3975ac1ea92dff3ea87ee4 Mon Sep 17 00:00:00 2001
-From: Jan Engelhardt <jengelh@inai.de>
-Date: Wed, 3 Jun 2020 15:38:48 +0200
-Subject: [PATCH] build: resolve iptables-apply not getting installed
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-ip6tables-apply gets installed but iptables-apply does not.
-That is wrong.
-
-» make install DESTDIR=$PWD/r
-» find r -name "*app*"
-r/usr/local/sbin/ip6tables-apply
-r/usr/local/share/man/man8/iptables-apply.8
-r/usr/local/share/man/man8/ip6tables-apply.8
-
-Fixes: v1.8.5~87
-Signed-off-by: Jan Engelhardt <jengelh@inai.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit d4ed0c741fc789bb09d977d74d30875fdd50d08b)
----
- iptables/Makefile.am | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/Makefile.am b/iptables/Makefile.am
-index dc66b3cc09c08..2024dbf5cb88c 100644
---- a/iptables/Makefile.am
-+++ b/iptables/Makefile.am
-@@ -56,7 +56,7 @@ man_MANS         = iptables.8 iptables-restore.8 iptables-save.8 \
-                    ip6tables-save.8 iptables-extensions.8 \
-                    iptables-apply.8 ip6tables-apply.8
- 
--sbin_SCRIPT      = iptables-apply
-+sbin_SCRIPTS     = iptables-apply
- 
- if ENABLE_NFTABLES
- man_MANS	+= xtables-nft.8 xtables-translate.8 xtables-legacy.8 \
--- 
-2.40.0
-

SOURCES/0001-doc-Add-deprecation-notices-to-all-relevant-man-page.patch

@@ -0,0 +1,336 @@
+From 2abc07c47189b26fce16f4751a96f747fa53fc0f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Thu, 17 Jun 2021 18:44:28 +0200
+Subject: [PATCH] doc: Add deprecation notices to all relevant man pages
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1945151
+Upstream Status: RHEL-only
+
+This is RHEL9 trying to friendly kick people towards nftables.
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/arptables-nft-restore.8       | 13 ++++++++++++-
+ iptables/arptables-nft-save.8          | 14 +++++++++++++-
+ iptables/arptables-nft.8               | 19 ++++++++++++++++++-
+ iptables/ebtables-nft.8                | 15 ++++++++++++++-
+ iptables/iptables-apply.8.in           | 14 +++++++++++++-
+ iptables/iptables-extensions.8.tmpl.in | 14 ++++++++++++++
+ iptables/iptables-restore.8.in         | 17 ++++++++++++++++-
+ iptables/iptables-save.8.in            | 15 ++++++++++++++-
+ iptables/iptables.8.in                 | 17 +++++++++++++++++
+ iptables/xtables-monitor.8.in          | 11 +++++++++++
+ 10 files changed, 142 insertions(+), 7 deletions(-)
+
+diff --git a/iptables/arptables-nft-restore.8 b/iptables/arptables-nft-restore.8
+index 09d9082..b1bf029 100644
+--- a/iptables/arptables-nft-restore.8
++++ b/iptables/arptables-nft-restore.8
+@@ -24,6 +24,17 @@ arptables-restore \- Restore ARP Tables (nft-based)
+ .SH SYNOPSIS
+ \fBarptables\-restore
+ .SH DESCRIPTION
++This tool is
++.B deprecated
++in Red Hat Enterprise Linux. It is maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
+ .PP
+ .B arptables-restore
+ is used to restore ARP Tables from data specified on STDIN or
+@@ -35,5 +46,5 @@ flushes (deletes) all previous contents of the respective ARP Table.
+ .SH AUTHOR
+ Jesper Dangaard Brouer <brouer@redhat.com>
+ .SH SEE ALSO
+-\fBarptables\-save\fP(8), \fBarptables\fP(8)
++\fBarptables\-save\fP(8), \fBarptables\fP(8), \fBnft\fP(8)
+ .PP
+diff --git a/iptables/arptables-nft-save.8 b/iptables/arptables-nft-save.8
+index 905e598..49bb0f6 100644
+--- a/iptables/arptables-nft-save.8
++++ b/iptables/arptables-nft-save.8
+@@ -27,6 +27,18 @@ arptables-save \- dump arptables rules to stdout (nft-based)
+ \fBarptables\-save\fP [\fB\-V\fP]
+ .SH DESCRIPTION
+ .PP
++This tool is
++.B deprecated
++in Red Hat Enterprise Linux. It is maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
++.PP
+ .B arptables-save
+ is used to dump the contents of an ARP Table in easily parseable format
+ to STDOUT. Use I/O-redirection provided by your shell to write to a file.
+@@ -43,5 +55,5 @@ Print version information and exit.
+ .SH AUTHOR
+ Jesper Dangaard Brouer <brouer@redhat.com>
+ .SH SEE ALSO
+-\fBarptables\-restore\fP(8), \fBarptables\fP(8)
++\fBarptables\-restore\fP(8), \fBarptables\fP(8), \fBnft\fP(8)
+ .PP
+diff --git a/iptables/arptables-nft.8 b/iptables/arptables-nft.8
+index ea31e08..ec5b993 100644
+--- a/iptables/arptables-nft.8
++++ b/iptables/arptables-nft.8
+@@ -39,6 +39,19 @@ arptables \- ARP table administration (nft-based)
+ .BR "arptables " [ "-t table" ] " -P chain target " [ options ]
+ 
+ .SH DESCRIPTION
++.PP
++This tool is
++.B deprecated
++in Red Hat Enterprise Linux. It is maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
++.PP
+ .B arptables
+ is a user space tool, it is used to set up and maintain the
+ tables of ARP rules in the Linux kernel. These rules inspect
+@@ -340,9 +353,13 @@ bridges, the same may be achieved using
+ chain in
+ .BR ebtables .
+ 
++This tool is deprecated in Red Hat Enterprise Linux. It is maintenance only and
++will not receive new features. New setups should use \fBnft\fP(8). Existing
++setups should migrate to \fBnft\fP(8) when possible.
++
+ .SH MAILINGLISTS
+ .BR "" "See " http://netfilter.org/mailinglists.html
+ .SH SEE ALSO
+-.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip (8)
++.BR xtables-nft "(8), " iptables "(8), " ebtables "(8), " ip "(8), " nft (8)
+ .PP
+ .BR "" "See " https://wiki.nftables.org
+diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
+index 0304b50..cfd617a 100644
+--- a/iptables/ebtables-nft.8
++++ b/iptables/ebtables-nft.8
+@@ -46,6 +46,19 @@ ebtables \- Ethernet bridge frame table administration (nft-based)
+ .br
+ 
+ .SH DESCRIPTION
++.PP
++This tool is
++.B deprecated
++in Red Hat Enterprise Linux. It is maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
++.PP
+ .B ebtables
+ is an application program used to set up and maintain the
+ tables of rules (inside the Linux kernel) that inspect
+@@ -1083,6 +1096,6 @@ has not been implemented, although
+ might replace them entirely given the inherent atomicity of nftables.
+ Finally, this list is probably not complete.
+ .SH SEE ALSO
+-.BR xtables-nft "(8), " iptables "(8), " ip (8)
++.BR xtables-nft "(8), " iptables "(8), " ip "(8), " nft (8)
+ .PP
+ .BR "" "See " https://wiki.nftables.org
+diff --git a/iptables/iptables-apply.8.in b/iptables/iptables-apply.8.in
+index f0ed4e5..7f99a21 100644
+--- a/iptables/iptables-apply.8.in
++++ b/iptables/iptables-apply.8.in
+@@ -11,6 +11,18 @@ iptables-apply \- a safer way to update iptables remotely
+ \fBiptables\-apply\fP [\-\fBhV\fP] [\fB-t\fP \fItimeout\fP] [\fB-w\fP \fIsavefile\fP] {[\fIrulesfile]|-c [runcmd]}\fP
+ .SH "DESCRIPTION"
+ .PP
++This tool is
++.B deprecated
++in Red Hat Enterprise Linux. It is maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
++.PP
+ iptables\-apply will try to apply a new rulesfile (as output by
+ iptables-save, read by iptables-restore) or run a command to configure
+ iptables and then prompt the user whether the changes are okay. If the
+@@ -47,7 +59,7 @@ Display usage information.
+ Display version information.
+ .SH "SEE ALSO"
+ .PP
+-\fBiptables-restore\fP(8), \fBiptables-save\fP(8), \fBiptables\fR(8).
++\fBiptables-restore\fP(8), \fBiptables-save\fP(8), \fBiptables\fR(8), \fBnft\fP(8).
+ .SH LEGALESE
+ .PP
+ Original iptables-apply - Copyright 2006 Martin F. Krafft <madduck@madduck.net>.
+diff --git a/iptables/iptables-extensions.8.tmpl.in b/iptables/iptables-extensions.8.tmpl.in
+index 99d89a1..73d40bb 100644
+--- a/iptables/iptables-extensions.8.tmpl.in
++++ b/iptables/iptables-extensions.8.tmpl.in
+@@ -7,6 +7,20 @@ iptables-extensions \(em list of extensions in the standard iptables distributio
+ .PP
+ \fBiptables\fP [\fB\-m\fP \fIname\fP [\fImodule-options\fP...]]
+ [\fB\-j\fP \fItarget-name\fP [\fItarget-options\fP...]
++.SH DESCRIPTION
++These tools are
++.B deprecated
++in Red Hat Enterprise Linux. They are maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details. There is also
++.BR iptables\-translate (8)/ ip6tables\-translate (8)
++to help with the migration.
+ .SH MATCH EXTENSIONS
+ iptables can use extended packet matching modules
+ with the \fB\-m\fP or \fB\-\-match\fP
+diff --git a/iptables/iptables-restore.8.in b/iptables/iptables-restore.8.in
+index aa816f7..353d4dc 100644
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -31,6 +31,19 @@ ip6tables-restore \(em Restore IPv6 Tables
+ [\fB\-M\fP \fImodprobe\fP] [\fB\-T\fP \fIname\fP]
+ [\fIfile\fP]
+ .SH DESCRIPTION
++These tools are
++.B deprecated
++in Red Hat Enterprise Linux. They are maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details. There is also
++.BR iptables\-restore\-translate (8)/ ip6tables\-restore\-translate (8)
++to help with the migration.
+ .PP
+ .B iptables-restore
+ and
+@@ -82,7 +95,9 @@ from Rusty Russell.
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-restore.
+ .SH SEE ALSO
+-\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8)
++\fBiptables\-apply\fP(8), \fBiptables\-save\fP(8), \fBiptables\fP(8),
++\fBnft\fP(8), \fBiptables\-restore\-translate\fP(8),
++\fBip6tables\-restore\-translate\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+diff --git a/iptables/iptables-save.8.in b/iptables/iptables-save.8.in
+index 65c1f28..d47be27 100644
+--- a/iptables/iptables-save.8.in
++++ b/iptables/iptables-save.8.in
+@@ -30,6 +30,18 @@ ip6tables-save \(em dump iptables rules
+ [\fB\-t\fP \fItable\fP] [\fB\-f\fP \fIfilename\fP]
+ .SH DESCRIPTION
+ .PP
++These tools are
++.B deprecated
++in Red Hat Enterprise Linux. They are maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
++.PP
+ .B iptables-save
+ and
+ .B ip6tables-save
+@@ -66,7 +78,8 @@ Rusty Russell <rusty@rustcorp.com.au>
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
+ .SH SEE ALSO
+-\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8)
++\fBiptables\-apply\fP(8), \fBiptables\-restore\fP(8), \fBiptables\fP(8),
++\fBnft\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+diff --git a/iptables/iptables.8.in b/iptables/iptables.8.in
+index ecaa555..4c4a15a 100644
+--- a/iptables/iptables.8.in
++++ b/iptables/iptables.8.in
+@@ -55,6 +55,20 @@ match = \fB\-m\fP \fImatchname\fP [\fIper-match-options\fP]
+ .PP
+ target = \fB\-j\fP \fItargetname\fP [\fIper\-target\-options\fP]
+ .SH DESCRIPTION
++These tools are
++.B deprecated
++in Red Hat Enterprise Linux. They are maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details. There is also
++.BR iptables\-translate (8)/ ip6tables\-translate (8)
++to help with the migration.
++.PP
+ \fBIptables\fP and \fBip6tables\fP are used to set up, maintain, and inspect the
+ tables of IPv4 and IPv6 packet
+ filter rules in the Linux kernel.  Several different tables
+@@ -455,6 +469,9 @@ There are several other changes in iptables.
+ \fBiptables\-save\fP(8),
+ \fBiptables\-restore\fP(8),
+ \fBiptables\-extensions\fP(8),
++\fBnft\fP(8),
++\fBiptables\-translate\fP(8),
++\fBip6tables\-translate\fP(8)
+ .PP
+ The packet-filtering-HOWTO details iptables usage for
+ packet filtering, the NAT-HOWTO details NAT,
+diff --git a/iptables/xtables-monitor.8.in b/iptables/xtables-monitor.8.in
+index a7f22c0..e21d7ff 100644
+--- a/iptables/xtables-monitor.8.in
++++ b/iptables/xtables-monitor.8.in
+@@ -6,6 +6,17 @@ xtables-monitor \(em show changes to rule set and trace-events
+ .PP
+ \
+ .SH DESCRIPTION
++This tool is
++.B deprecated
++in Red Hat Enterprise Linux. It is maintenance only and will not receive new
++features. New setups should use
++.BR nft (8).
++Existing setups should migrate to
++.BR nft (8)
++when possible. See
++.UR https://red.ht/nft_your_tables
++.UE
++for details.
+ .PP
+ .B xtables-monitor
+ is used to monitor changes to the ruleset or to show rule evaluation events

SOURCES/0002-extensions-SECMARK-Use-a-better-context-in-test-case.patch

@@ -1,20 +1,23 @@
-From f24ad92bea508ba2e037a4d2e57770371554e47f Mon Sep 17 00:00:00 2001
+From 4388fad6c3874a3861907734f9a6368cfd0a731c Mon Sep 17 00:00:00 2001
 From: Phil Sutter <psutter@redhat.com>
 Date: Fri, 16 Jul 2021 21:51:49 +0200
 Subject: [PATCH] extensions: SECMARK: Use a better context in test case
 
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2047558
+Upstream Status: RHEL-only
+
 RHEL SELinux policies don't allow setting
 system_u:object_r:firewalld_exec_t:s0 context. Use one instead which has
 'packet_type' attribute (identified via
 'seinfo -xt | grep packet_type').
 
-(cherry picked from commit 0f730df43caa68e03380111b40e357141ccce709)
+Signed-off-by: Phil Sutter <psutter@redhat.com>
 ---
  extensions/libxt_SECMARK.t | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/extensions/libxt_SECMARK.t b/extensions/libxt_SECMARK.t
-index 39d4c09348bf4..295e7a7244902 100644
+index 39d4c09..295e7a7 100644
 --- a/extensions/libxt_SECMARK.t
 +++ b/extensions/libxt_SECMARK.t
 @@ -1,4 +1,4 @@
@@ -23,6 +26,3 @@ index 39d4c09348bf4..295e7a7244902 100644
 --j SECMARK --selctx system_u:object_r:firewalld_exec_t:s0;=;OK
 +-j SECMARK --selctx system_u:object_r:ssh_server_packet_t:s0;=;OK
  -j SECMARK;;FAIL
--- 
-2.40.0
-

SOURCES/0002-xtables-translate-don-t-fail-if-help-was-requested.patch

@@ -1,57 +0,0 @@
-From eaad1950f1952733c2770b29b593613cfe9af8a8 Mon Sep 17 00:00:00 2001
-From: Arturo Borrero Gonzalez <arturo@netfilter.org>
-Date: Tue, 16 Jun 2020 11:20:42 +0200
-Subject: [PATCH] xtables-translate: don't fail if help was requested
-
-If the user called `iptables-translate -h` then we have CMD_NONE and we should gracefully handle
-this case in do_command_xlate().
-
-Before this patch, you would see:
-
- user@debian:~$ sudo iptables-translate -h
- [..]
- nft Unsupported command?
- user@debian:~$ echo $?
- 1
-
-After this patch:
-
- user@debian:~$ sudo iptables-translate -h
- [..]
- user@debian:~$ echo $?
- 0
-
-Fixes: d4409d449c10fa ("nft: Don't exit early after printing help texts")
-Acked-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
-(cherry picked from commit 2757c0b5e5fbbf569695469b331453cecefdf069)
----
- iptables/xtables-translate.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index 5aa42496b5a48..363c8be15b3fa 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -249,7 +249,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
- 
- 	cs.restore = restore;
- 
--	if (!restore)
-+	if (!restore && p.command != CMD_NONE)
- 		printf("nft ");
- 
- 	switch (p.command) {
-@@ -310,6 +310,9 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
- 		break;
- 	case CMD_SET_POLICY:
- 		break;
-+	case CMD_NONE:
-+		ret = 1;
-+		break;
- 	default:
- 		/* We should never reach this... */
- 		printf("Unsupported command?\n");
--- 
-2.40.0
-

SOURCES/0003-ebtables-Fix-corner-case-noflush-restore-bug.patch

@@ -0,0 +1,73 @@
+From 7a8231504928a4ad7a2229d0f8a27d9734159647 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Tue, 7 Nov 2023 23:44:55 +0100
+Subject: [PATCH] ebtables: Fix corner-case noflush restore bug
+
+JIRA: https://issues.redhat.com/browse/RHEL-14147
+Upstream Status: iptables commit c1083acea70787eea3f7929fd04718434bb05ba8
+
+commit c1083acea70787eea3f7929fd04718434bb05ba8
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Tue Nov 7 19:12:14 2023 +0100
+
+    ebtables: Fix corner-case noflush restore bug
+
+    Report came from firwalld, but this is actually rather hard to trigger.
+    Since a regular chain line prevents it, typical dump/restore use-cases
+    are unaffected.
+
+    Fixes: 73611d5582e72 ("ebtables-nft: add broute table emulation")
+    Cc: Eric Garver <eric@garver.life>
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../testcases/ebtables/0009-broute-bug_0      | 25 +++++++++++++++++++
+ iptables/xtables-eb.c                         |  2 ++
+ 2 files changed, 27 insertions(+)
+ create mode 100755 iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
+
+diff --git a/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0 b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
+new file mode 100755
+index 0000000..0def0ac
+--- /dev/null
++++ b/iptables/tests/shell/testcases/ebtables/0009-broute-bug_0
+@@ -0,0 +1,25 @@
++#!/bin/sh
++#
++# Missing BROUTING-awareness in ebt_get_current_chain() caused an odd caching bug when restoring:
++# - with --noflush
++# - a second table after the broute one
++# - A policy command but no chain line for BROUTING chain
++
++set -e
++
++case "$XT_MULTI" in
++*xtables-nft-multi)
++	;;
++*)
++	echo "skip $XT_MULTI"
++	exit 0
++	;;
++esac
++
++$XT_MULTI ebtables-restore --noflush <<EOF
++*broute
++-P BROUTING ACCEPT
++*nat
++-P PREROUTING ACCEPT
++COMMIT
++EOF
+diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
+index 08eec79..a8ad57c 100644
+--- a/iptables/xtables-eb.c
++++ b/iptables/xtables-eb.c
+@@ -169,6 +169,8 @@ int ebt_get_current_chain(const char *chain)
+ 		return NF_BR_LOCAL_OUT;
+ 	else if (strcmp(chain, "POSTROUTING") == 0)
+ 		return NF_BR_POST_ROUTING;
++	else if (strcmp(chain, "BROUTING") == 0)
++		return NF_BR_BROUTING;
+ 
+ 	/* placeholder for user defined chain */
+ 	return NF_BR_NUMHOOKS;

SOURCES/0003-xtables-translate-Use-proper-clear_cs-function.patch

@@ -1,30 +0,0 @@
-From d9497b521e6f512f27bd1d4a88086f50418cb7b8 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 16 Jun 2020 13:06:26 +0200
-Subject: [PATCH] xtables-translate: Use proper clear_cs function
-
-Avoid memleaks by performing a full free of any allocated data in local
-iptables_command_state variable.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 63fa2b1cb98be66990912d7eb42eab5440437087)
----
- iptables/xtables-translate.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/xtables-translate.c b/iptables/xtables-translate.c
-index 363c8be15b3fa..575fb320dc408 100644
---- a/iptables/xtables-translate.c
-+++ b/iptables/xtables-translate.c
-@@ -319,7 +319,7 @@ static int do_command_xlate(struct nft_handle *h, int argc, char *argv[],
- 		exit(1);
- 	}
- 
--	xtables_rule_matches_free(&cs.matches);
-+	nft_clear_iptables_command_state(&cs);
- 
- 	if (h->family == AF_INET) {
- 		free(args.s.addr.v4);
--- 
-2.40.0
-

SOURCES/0004-libxtables-compiler-warning-fixes-for-NO_SHARED_LIBS.patch

@@ -1,55 +0,0 @@
-From 94fcba7825b121cbb7d3ff73f4e80a798feccdee Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
-Date: Tue, 23 Jun 2020 16:09:02 -0700
-Subject: [PATCH] libxtables: compiler warning fixes for NO_SHARED_LIBS
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixes two issues with NO_SHARED_LIBS:
- - #include <dlfcn.h> is ifdef'ed out and thus dlclose()
-   triggers an undeclared function compiler warning
- - dlreg_add() is unused and thus triggers an unused
-   function warning
-
-Test: builds without warnings
-Signed-off-by: Maciej Żenczykowski <maze@google.com>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 6cb8af1ff3951e47def7a16db39289dc9d9c61fe)
----
- libxtables/xtables.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 7fe42580f9b70..8907ba2069be7 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -206,6 +206,7 @@ struct xtables_target *xtables_targets;
- static bool xtables_fully_register_pending_match(struct xtables_match *me);
- static bool xtables_fully_register_pending_target(struct xtables_target *me);
- 
-+#ifndef NO_SHARED_LIBS
- /* registry for loaded shared objects to close later */
- struct dlreg {
- 	struct dlreg *next;
-@@ -237,6 +238,7 @@ static void dlreg_free(void)
- 		dlreg = next;
- 	}
- }
-+#endif
- 
- void xtables_init(void)
- {
-@@ -267,7 +269,9 @@ void xtables_init(void)
- 
- void xtables_fini(void)
- {
-+#ifndef NO_SHARED_LIBS
- 	dlreg_free();
-+#endif
- }
- 
- void xtables_set_nfproto(uint8_t nfproto)
--- 
-2.40.0
-

SOURCES/0004-nft-Fix-for-broken-recover_rule_compat.patch

@@ -0,0 +1,99 @@
+From 4c883007ecf15b5fe18a71688a4383686e7c0026 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 22 May 2024 18:26:58 +0200
+Subject: [PATCH] nft: Fix for broken recover_rule_compat()
+
+JIRA: https://issues.redhat.com/browse/RHEL-26619
+Upstream Status: iptables commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305
+
+commit bb1a7a5b297aa271f7f59abbcb891cd94d7fb305
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Tue Feb 27 18:47:39 2024 +0100
+
+    nft: Fix for broken recover_rule_compat()
+
+    When IPv4 rule generator was changed to emit payload instead of
+    meta expressions for l4proto matches, the code reinserting
+    NFTNL_RULE_COMPAT_* attributes into rules being reused for counter
+    zeroing was broken by accident.
+
+    Make rule compat recovery aware of the alternative match, basically
+    reinstating the effect of commit 7a373f6683afb ("nft: Fix -Z for rules
+    with NFTA_RULE_COMPAT") but add a test case this time to make sure
+    things stay intact.
+
+    Fixes: 69278f9602b43 ("nft: use payload matching for layer 4 protocol")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c                                | 27 ++++++++++++++++---
+ .../nft-only/0011-zero-needs-compat_0         | 12 +++++++++
+ 2 files changed, 35 insertions(+), 4 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 97fd4f4..c4caf29 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3679,6 +3679,27 @@ const char *nft_strerror(int err)
+ 	return strerror(err);
+ }
+ 
++static int l4proto_expr_get_dreg(struct nftnl_expr *e, uint32_t *dregp)
++{
++	const char *name = nftnl_expr_get_str(e, NFTNL_EXPR_NAME);
++	uint32_t poff = offsetof(struct iphdr, protocol);
++	uint32_t pbase = NFT_PAYLOAD_NETWORK_HEADER;
++
++	if (!strcmp(name, "payload") &&
++	    nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_BASE) == pbase &&
++	    nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_OFFSET) == poff &&
++	    nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_LEN) == sizeof(uint8_t)) {
++		*dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_PAYLOAD_DREG);
++		return 0;
++	}
++	if (!strcmp(name, "meta") &&
++	    nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) == NFT_META_L4PROTO) {
++		*dregp = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG);
++		return 0;
++	}
++	return -1;
++}
++
+ static int recover_rule_compat(struct nftnl_rule *r)
+ {
+ 	struct nftnl_expr_iter *iter;
+@@ -3695,12 +3716,10 @@ next_expr:
+ 	if (!e)
+ 		goto out;
+ 
+-	if (strcmp("meta", nftnl_expr_get_str(e, NFTNL_EXPR_NAME)) ||
+-	    nftnl_expr_get_u32(e, NFTNL_EXPR_META_KEY) != NFT_META_L4PROTO)
++	/* may be 'ip protocol' or 'meta l4proto' with identical RHS */
++	if (l4proto_expr_get_dreg(e, &reg) < 0)
+ 		goto next_expr;
+ 
+-	reg = nftnl_expr_get_u32(e, NFTNL_EXPR_META_DREG);
+-
+ 	e = nftnl_expr_iter_next(iter);
+ 	if (!e)
+ 		goto out;
+diff --git a/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0 b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0
+new file mode 100755
+index 0000000..e276a95
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0011-zero-needs-compat_0
+@@ -0,0 +1,12 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++
++set -e
++
++rule="-p tcp -m tcp --dport 27374 -c 23 42 -j TPROXY --on-port 50080"
++for cmd in iptables ip6tables; do
++	$XT_MULTI $cmd -t mangle -A PREROUTING $rule
++	$XT_MULTI $cmd -t mangle -Z
++	$XT_MULTI $cmd -t mangle -v -S | grep -q -- "${rule/23 42/0 0}"
++done

SOURCES/0005-extensions-libxt_conntrack-provide-translation-for-D.patch

@@ -1,63 +0,0 @@
-From 0323122f6a3ef9ab2ded571685d3c64851c6df86 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Wed, 22 Jul 2020 13:04:34 +0200
-Subject: [PATCH] extensions: libxt_conntrack: provide translation for DNAT and
- SNAT --ctstate
-
-iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
-nft add rule ip filter INPUT ct status dnat counter accept
-
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 26ec09bf6b9b674a7e3a65fc9c12599bd81dfe0f)
----
- extensions/libxt_conntrack.c      | 18 +++++++++++++-----
- extensions/libxt_conntrack.txlate |  7 +++++++
- 2 files changed, 20 insertions(+), 5 deletions(-)
-
-diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
-index 6f3503933e664..7734509c9af84 100644
---- a/extensions/libxt_conntrack.c
-+++ b/extensions/libxt_conntrack.c
-@@ -1249,11 +1249,19 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
- 	}
- 
- 	if (sinfo->match_flags & XT_CONNTRACK_STATE) {
--		xt_xlate_add(xl, "%sct state %s", space,
--			     sinfo->invert_flags & XT_CONNTRACK_STATE ?
--			     "!= " : "");
--		state_xlate_print(xl, sinfo->state_mask);
--		space = " ";
-+		if ((sinfo->state_mask & XT_CONNTRACK_STATE_SNAT) ||
-+		    (sinfo->state_mask & XT_CONNTRACK_STATE_DNAT)) {
-+			xt_xlate_add(xl, "%sct status %s%s", space,
-+				     sinfo->invert_flags & XT_CONNTRACK_STATUS ? "!=" : "",
-+				     sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
-+			space = " ";
-+		} else {
-+			xt_xlate_add(xl, "%sct state %s", space,
-+				     sinfo->invert_flags & XT_CONNTRACK_STATE ?
-+				     "!= " : "");
-+			state_xlate_print(xl, sinfo->state_mask);
-+			space = " ";
-+		}
- 	}
- 
- 	if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
-diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
-index 8a3d0181c71ef..d374f8a035f00 100644
---- a/extensions/libxt_conntrack.txlate
-+++ b/extensions/libxt_conntrack.txlate
-@@ -42,3 +42,10 @@ nft add rule ip filter INPUT ct direction original counter accept
- 
- iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW --ctproto tcp --ctorigsrc 192.168.0.1 --ctorigdst 192.168.0.1 --ctreplsrc 192.168.0.1 --ctrepldst 192.168.0.1 --ctorigsrcport 12 --ctorigdstport 14 --ctreplsrcport 16 --ctrepldstport 18 --ctexpire 10 --ctstatus SEEN_REPLY --ctdir ORIGINAL -j ACCEPT
- nft add rule ip filter INPUT ct direction original ct original protocol 6 ct state new ct status seen-reply ct expiration 10 ct original saddr 192.168.0.1 ct original daddr 192.168.0.1 ct reply saddr 192.168.0.1 ct reply daddr 192.168.0.1 ct original proto-src 12 ct original proto-dst 14 ct reply proto-src 16 ct reply proto-dst 18 counter accept
-+
-+iptables-translate -t filter -A INPUT -m conntrack --ctstate SNAT -j ACCEPT
-+nft add rule ip filter INPUT ct status snat counter accept
-+
-+iptables-translate -t filter -A INPUT -m conntrack --ctstate DNAT -j ACCEPT
-+nft add rule ip filter INPUT ct status dnat counter accept
-+
--- 
-2.40.0
-

SOURCES/0005-extensions-libxt_sctp-Add-an-extra-assert.patch

@@ -0,0 +1,43 @@
+From 6e4197dee5ff051f2daf1327faf1683fe350264f Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 12 Jun 2024 22:49:48 +0200
+Subject: [PATCH] extensions: libxt_sctp: Add an extra assert()
+
+JIRA: https://issues.redhat.com/browse/RHEL-40928
+Upstream Status: iptables commit 0234117d24609070f08ef36a11795c3c8e4c19bf
+
+commit 0234117d24609070f08ef36a11795c3c8e4c19bf
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri May 17 15:20:05 2024 +0200
+
+    extensions: libxt_sctp: Add an extra assert()
+
+    The code is sane, but this keeps popping up in static code analyzers.
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ extensions/libxt_sctp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
+index 6e2b274..e8312f0 100644
+--- a/extensions/libxt_sctp.c
++++ b/extensions/libxt_sctp.c
+@@ -7,6 +7,7 @@
+  * libipt_ecn.c borrowed heavily from libipt_dscp.c
+  *
+  */
++#include <assert.h>
+ #include <stdbool.h>
+ #include <stdio.h>
+ #include <string.h>
+@@ -354,6 +355,7 @@ print_chunk_flags(uint32_t chunknum, uint8_t chunk_flags, uint8_t chunk_flags_ma
+ 
+ 	for (i = 7; i >= 0; i--) {
+ 		if (chunk_flags_mask & (1 << i)) {
++			assert(chunknum < ARRAY_SIZE(sctp_chunk_names));
+ 			if (chunk_flags & (1 << i)) {
+ 				printf("%c", sctp_chunk_names[chunknum].valid_flags[7-i]);
+ 			} else {

SOURCES/0006-nft-Drop-pointless-nft_xt_builtin_init-call.patch

@@ -1,30 +0,0 @@
-From 13abbdd7789da8616a903b5b8dc5ff69fb2af2c7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 10 Jul 2020 21:12:34 +0200
-Subject: [PATCH] nft: Drop pointless nft_xt_builtin_init() call
-
-When renaming a chain, either everything is in place already or the
-command will bail anyway. So just drop this superfluous call.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 7a700c47fe121c65c550ab24de3284abbb1e82f8)
----
- iptables/nft.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 0c5a74fc232c6..e795d4ae6d241 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -1934,8 +1934,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
- 		return 0;
- 	}
- 
--	nft_xt_builtin_init(h, table);
--
- 	/* Config load changed errno. Ensure genuine info for our callers. */
- 	errno = 0;
- 
--- 
-2.40.0
-

SOURCES/0006-nft-Fix-for-zeroing-non-existent-builtin-chains.patch

@@ -0,0 +1,122 @@
+From 312ff073e117d6207c3ba304ca01532e723d6e54 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:23:33 +0200
+Subject: [PATCH] nft: Fix for zeroing non-existent builtin chains
+
+JIRA: https://issues.redhat.com/browse/RHEL-49497
+Upstream Status: iptables commit f462975fb8049b9b565cb35cc98302331dbd1548
+
+commit f462975fb8049b9b565cb35cc98302331dbd1548
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Tue Jul 16 21:07:31 2024 +0200
+
+    nft: Fix for zeroing non-existent builtin chains
+
+    Trying to zero a specific rule in an entirely empty ruleset caused an
+    error:
+
+    | # nft flush ruleset
+    | # iptables-nft -Z INPUT
+    | iptables v1.8.10 (nf_tables):  CHAIN_ZERO failed (No such file or directory): chain INPUT
+
+    To fix this, start by faking any non-existing builtin chains so verbose
+    mode prints all the would-be-flushed chains. Later set 'skip' flag if
+    given chain is a fake one (indicated by missing HANDLE attribute).
+    Finally cover for concurrent ruleset updates by checking whether the
+    chain exists.
+
+    This bug seems to exist for a long time already, Fixes tag identified
+    via git-bisect. This patch won't apply to such old trees though, but
+    calling nft_xt_builtin_init() from nft_chain_zero_counters() should work
+    there.
+
+    Fixes: a6ce0c65d3a39 ("xtables: Optimize nft_chain_zero_counters()")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c                                | 22 +++++++++++++++++--
+ .../nft-only/0013-zero-non-existent_0         | 17 ++++++++++++++
+ 2 files changed, 37 insertions(+), 2 deletions(-)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0013-zero-non-existent_0
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index c4caf29..82eab48 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3109,9 +3109,21 @@ static void nft_refresh_transaction(struct nft_handle *h)
+ 				break;
+ 			n->skip = !nft_may_delete_chain(n->chain);
+ 			break;
++		case NFT_COMPAT_CHAIN_ZERO:
++			tablename = nftnl_chain_get_str(n->chain, NFTNL_CHAIN_TABLE);
++			if (!tablename)
++				continue;
++
++			chainname = nftnl_chain_get_str(n->chain, NFTNL_CHAIN_NAME);
++			if (!chainname)
++				continue;
++
++			n->skip = nftnl_chain_is_set(n->chain,
++						     NFTNL_CHAIN_HOOKNUM) &&
++				  !nft_chain_find(h, tablename, chainname);
++			break;
+ 		case NFT_COMPAT_TABLE_ADD:
+ 		case NFT_COMPAT_CHAIN_ADD:
+-		case NFT_COMPAT_CHAIN_ZERO:
+ 		case NFT_COMPAT_CHAIN_USER_FLUSH:
+ 		case NFT_COMPAT_CHAIN_UPDATE:
+ 		case NFT_COMPAT_CHAIN_RENAME:
+@@ -3748,6 +3760,7 @@ static int __nft_chain_zero_counters(struct nft_chain *nc, void *data)
+ 	struct nft_handle *h = d->handle;
+ 	struct nftnl_rule_iter *iter;
+ 	struct nftnl_rule *r;
++	struct obj_update *o;
+ 
+ 	if (d->verbose)
+ 		fprintf(stdout, "Zeroing chain `%s'\n",
+@@ -3758,8 +3771,11 @@ static int __nft_chain_zero_counters(struct nft_chain *nc, void *data)
+ 		nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
+ 		nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
+ 		nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
+-		if (!batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c))
++		o = batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c);
++		if (!o)
+ 			return -1;
++		/* may skip if it is a fake entry */
++		o->skip = !nftnl_chain_is_set(c, NFTNL_CHAIN_HANDLE);
+ 	}
+ 
+ 	iter = nftnl_rule_iter_create(c);
+@@ -3823,6 +3839,8 @@ int nft_chain_zero_counters(struct nft_handle *h, const char *chain,
+ 	struct nft_chain *c;
+ 	int ret = 0;
+ 
++	nft_xt_fake_builtin_chains(h, table, chain);
++
+ 	if (chain) {
+ 		c = nft_chain_find(h, table, chain);
+ 		if (!c) {
+diff --git a/iptables/tests/shell/testcases/nft-only/0013-zero-non-existent_0 b/iptables/tests/shell/testcases/nft-only/0013-zero-non-existent_0
+new file mode 100755
+index 0000000..bbf1af7
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0013-zero-non-existent_0
+@@ -0,0 +1,17 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++nft --version >/dev/null 2>&1 || { echo "skip nft"; exit 0; }
++
++set -e
++
++nft flush ruleset
++$XT_MULTI iptables -Z INPUT
++
++EXP="Zeroing chain \`INPUT'"
++diff -u <(echo "$EXP") <($XT_MULTI iptables -v -Z INPUT)
++
++EXP="Zeroing chain \`INPUT'
++Zeroing chain \`FORWARD'
++Zeroing chain \`OUTPUT'"
++diff -u <(echo "$EXP") <($XT_MULTI iptables -v -Z)

SOURCES/0007-nft-Fix-command-name-in-ip6tables-error-message.patch

@@ -1,44 +0,0 @@
-From a58c38e4c579f409669b5ab82d3b039528a129af Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 7 Aug 2020 13:48:28 +0200
-Subject: [PATCH] nft: Fix command name in ip6tables error message
-
-Upon errors, ip6tables-nft would prefix its error messages with
-'iptables:' instead of 'ip6tables:'. Turns out the command name was
-hard-coded, use 'progname' variable instead.
-While being at it, merge the two mostly identical fprintf() calls into
-one.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 3be40dcfb5af1438b6abdbda45a1e3b59c104e13)
----
- iptables/xtables-standalone.c | 12 ++++--------
- 1 file changed, 4 insertions(+), 8 deletions(-)
-
-diff --git a/iptables/xtables-standalone.c b/iptables/xtables-standalone.c
-index dd6fb7919d2e1..7b71db62f1ea6 100644
---- a/iptables/xtables-standalone.c
-+++ b/iptables/xtables-standalone.c
-@@ -75,14 +75,10 @@ xtables_main(int family, const char *progname, int argc, char *argv[])
- 	xtables_fini();
- 
- 	if (!ret) {
--		if (errno == EINVAL) {
--			fprintf(stderr, "iptables: %s. "
--					"Run `dmesg' for more information.\n",
--				nft_strerror(errno));
--		} else {
--			fprintf(stderr, "iptables: %s.\n",
--				nft_strerror(errno));
--		}
-+		fprintf(stderr, "%s: %s.%s\n", progname, nft_strerror(errno),
-+			(errno == EINVAL ?
-+			 " Run `dmesg' for more information." : ""));
-+
- 		if (errno == EAGAIN)
- 			exit(RESOURCE_PROBLEM);
- 	}
--- 
-2.40.0
-

SOURCES/0007-nft-cache-Annotate-faked-base-chains-as-such.patch

@@ -0,0 +1,193 @@
+From 82ad0504599d894e62dff2e062cb4d6093ce12a5 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:23:33 +0200
+Subject: [PATCH] nft: cache: Annotate faked base chains as such
+
+JIRA: https://issues.redhat.com/browse/RHEL-49497
+Upstream Status: iptables commit f65d1e9a216468d5287fa05894a08e29c0fc8278
+
+commit f65d1e9a216468d5287fa05894a08e29c0fc8278
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Sat Jul 27 19:13:40 2024 +0200
+
+    nft: cache: Annotate faked base chains as such
+
+    To avoid pointless kernel ruleset modifications without too many
+    workarounds in user space, code sometimes adds "fake" base chains to
+    cache. Yet these fake entries happen to prevent base chain creation for
+    a following command which actually requires them. Fix this by annotating
+    the fake entries as such so *_builtin_init() functions may convert them
+    into real ones.
+
+    Fixes: fd4b9bf08b9eb ("nft: Avoid pointless table/chain creation")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft-cache.c |  6 +++---
+ iptables/nft-cache.h |  2 +-
+ iptables/nft-chain.c |  3 ++-
+ iptables/nft-chain.h |  3 ++-
+ iptables/nft.c       | 31 ++++++++++++++++++++-----------
+ 5 files changed, 28 insertions(+), 17 deletions(-)
+
+diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
+index 91d2967..da2d4d7 100644
+--- a/iptables/nft-cache.c
++++ b/iptables/nft-cache.c
+@@ -244,10 +244,10 @@ nft_cache_add_base_chain(struct nft_handle *h, const struct builtin_table *t,
+ }
+ 
+ int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t,
+-			struct nftnl_chain *c)
++			struct nftnl_chain *c, bool fake)
+ {
+ 	const char *cname = nftnl_chain_get_str(c, NFTNL_CHAIN_NAME);
+-	struct nft_chain *nc = nft_chain_alloc(c);
++	struct nft_chain *nc = nft_chain_alloc(c, fake);
+ 	int ret;
+ 
+ 	if (nftnl_chain_is_set(c, NFTNL_CHAIN_HOOKNUM)) {
+@@ -349,7 +349,7 @@ static int nftnl_chain_list_cb(const struct nlmsghdr *nlh, void *data)
+ 		goto out;
+ 	}
+ 
+-	nft_cache_add_chain(h, t, c);
++	nft_cache_add_chain(h, t, c, false);
+ 	return MNL_CB_OK;
+ out:
+ 	nftnl_chain_free(c);
+diff --git a/iptables/nft-cache.h b/iptables/nft-cache.h
+index 29ec6b5..e9f5755 100644
+--- a/iptables/nft-cache.h
++++ b/iptables/nft-cache.h
+@@ -17,7 +17,7 @@ int flush_rule_cache(struct nft_handle *h, const char *table,
+ 		     struct nft_chain *c);
+ void nft_cache_build(struct nft_handle *h);
+ int nft_cache_add_chain(struct nft_handle *h, const struct builtin_table *t,
+-			struct nftnl_chain *c);
++			struct nftnl_chain *c, bool fake);
+ int nft_cache_sort_chains(struct nft_handle *h, const char *table);
+ 
+ struct nft_chain *
+diff --git a/iptables/nft-chain.c b/iptables/nft-chain.c
+index e954170..c24e6c9 100644
+--- a/iptables/nft-chain.c
++++ b/iptables/nft-chain.c
+@@ -12,12 +12,13 @@
+ 
+ #include "nft-chain.h"
+ 
+-struct nft_chain *nft_chain_alloc(struct nftnl_chain *nftnl)
++struct nft_chain *nft_chain_alloc(struct nftnl_chain *nftnl, bool fake)
+ {
+ 	struct nft_chain *c = xtables_malloc(sizeof(*c));
+ 
+ 	INIT_LIST_HEAD(&c->head);
+ 	c->nftnl = nftnl;
++	c->fake = fake;
+ 
+ 	return c;
+ }
+diff --git a/iptables/nft-chain.h b/iptables/nft-chain.h
+index 9adf173..166504c 100644
+--- a/iptables/nft-chain.h
++++ b/iptables/nft-chain.h
+@@ -11,6 +11,7 @@ struct nft_chain {
+ 	struct hlist_node	hnode;
+ 	struct nft_chain	**base_slot;
+ 	struct nftnl_chain	*nftnl;
++	bool			fake;
+ };
+ 
+ #define CHAIN_NAME_HSIZE	512
+@@ -20,7 +21,7 @@ struct nft_chain_list {
+ 	struct hlist_head	names[CHAIN_NAME_HSIZE];
+ };
+ 
+-struct nft_chain *nft_chain_alloc(struct nftnl_chain *nftnl);
++struct nft_chain *nft_chain_alloc(struct nftnl_chain *nftnl, bool fake);
+ void nft_chain_free(struct nft_chain *c);
+ 
+ struct nft_chain_list *nft_chain_list_alloc(void);
+diff --git a/iptables/nft.c b/iptables/nft.c
+index 82eab48..aa4b3f2 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -720,7 +720,7 @@ static void nft_chain_builtin_add(struct nft_handle *h,
+ 
+ 	if (!fake)
+ 		batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, c);
+-	nft_cache_add_chain(h, table, c);
++	nft_cache_add_chain(h, table, c, fake);
+ }
+ 
+ /* find if built-in table already exists */
+@@ -764,14 +764,19 @@ nft_chain_builtin_find(const struct builtin_table *t, const char *chain)
+ static void nft_chain_builtin_init(struct nft_handle *h,
+ 				   const struct builtin_table *table)
+ {
++	struct nft_chain *c;
+ 	int i;
+ 
+ 	/* Initialize built-in chains if they don't exist yet */
+ 	for (i=0; i < NF_INET_NUMHOOKS && table->chains[i].name != NULL; i++) {
+-		if (nft_chain_find(h, table->name, table->chains[i].name))
+-			continue;
+-
+-		nft_chain_builtin_add(h, table, &table->chains[i], false);
++		c = nft_chain_find(h, table->name, table->chains[i].name);
++		if (!c) {
++			nft_chain_builtin_add(h, table,
++					      &table->chains[i], false);
++		} else if (c->fake) {
++			batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, c->nftnl);
++			c->fake = false;
++		}
+ 	}
+ }
+ 
+@@ -798,6 +803,7 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table,
+ {
+ 	const struct builtin_table *t;
+ 	const struct builtin_chain *c;
++	struct nft_chain *nc;
+ 
+ 	if (!h->cache_init)
+ 		return 0;
+@@ -818,10 +824,13 @@ static int nft_xt_builtin_init(struct nft_handle *h, const char *table,
+ 	if (!c)
+ 		return -1;
+ 
+-	if (h->cache->table[t->type].base_chains[c->hook])
+-		return 0;
+-
+-	nft_chain_builtin_add(h, t, c, false);
++	nc = h->cache->table[t->type].base_chains[c->hook];
++	if (!nc) {
++		nft_chain_builtin_add(h, t, c, false);
++	} else if (nc->fake) {
++		batch_chain_add(h, NFT_COMPAT_CHAIN_ADD, nc->nftnl);
++		nc->fake = false;
++	}
+ 	return 0;
+ }
+ 
+@@ -2092,7 +2101,7 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
+ 	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
+ 		return 0;
+ 
+-	nft_cache_add_chain(h, t, c);
++	nft_cache_add_chain(h, t, c, false);
+ 
+ 	/* the core expects 1 for success and 0 for error */
+ 	return 1;
+@@ -2119,7 +2128,7 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
+ 		nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain);
+ 		created = true;
+ 
+-		nft_cache_add_chain(h, t, c);
++		nft_cache_add_chain(h, t, c, false);
+ 	} else {
+ 		c = nc->nftnl;
+ 

SOURCES/0008-nft-Fix-for-zeroing-existent-builtin-chains.patch

@@ -0,0 +1,46 @@
+From 5766ffbf98583fcc50f3607850d63bb0e87d4abe Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:23:33 +0200
+Subject: [PATCH] nft: Fix for zeroing existent builtin chains
+
+JIRA: https://issues.redhat.com/browse/RHEL-49497
+Upstream Status: iptables commit 6a2aeda7585e07c0fcccb0c788299ab5a6a85881
+
+commit 6a2aeda7585e07c0fcccb0c788299ab5a6a85881
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Sat Jul 27 16:04:31 2024 +0200
+
+    nft: Fix for zeroing existent builtin chains
+
+    Previous attempt at fixing for non-existent chains actually broke
+    functionality by adding a check for NFTNL_CHAIN_HANDLE right after
+    unsetting the attribute.
+
+    The approach was flawed for another reason, too: Base chains added in
+    the same batch (cf. iptables-restore) have no handle either but zeroing
+    them may still be sensible.
+
+    Instead, make use of the new fake chain annotation which identifies
+    fakes more reliably.
+
+    Fixes: f462975fb8049 ("nft: Fix for zeroing non-existent builtin chains")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index aa4b3f2..ad4c866 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -3784,7 +3784,7 @@ static int __nft_chain_zero_counters(struct nft_chain *nc, void *data)
+ 		if (!o)
+ 			return -1;
+ 		/* may skip if it is a fake entry */
+-		o->skip = !nftnl_chain_is_set(c, NFTNL_CHAIN_HANDLE);
++		o->skip = nc->fake;
+ 	}
+ 
+ 	iter = nftnl_rule_iter_create(c);

SOURCES/0008-tests-shell-Merge-and-extend-return-codes-test.patch

@@ -1,208 +0,0 @@
-From 529dee8412eb216a2432e063136ede732edb9cc1 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 6 Aug 2020 18:52:34 +0200
-Subject: [PATCH] tests: shell: Merge and extend return codes test
-
-Merge scripts for iptables and ip6tables, they were widely identical.
-Also extend the test by one check (removing a non-existent rule with
-valid chain and target) and quote the error messages where differences
-are deliberately ignored.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit cd3e83d1b04fd2683f0fb06e496ee5be08a96b4f)
----
- .../testcases/ip6tables/0004-return-codes_0   |  39 ------
- .../testcases/iptables/0004-return-codes_0    | 113 ++++++++++--------
- 2 files changed, 61 insertions(+), 91 deletions(-)
- delete mode 100755 iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
-
-diff --git a/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0 b/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
-deleted file mode 100755
-index c583b0ebd97c3..0000000000000
---- a/iptables/tests/shell/testcases/ip6tables/0004-return-codes_0
-+++ /dev/null
-@@ -1,39 +0,0 @@
--#!/bin/sh
--
--# make sure error return codes are as expected useful cases
--# (e.g. commands to check ruleset state)
--
--global_rc=0
--
--cmd() { # (rc, cmd, [args ...])
--	rc_exp=$1; shift
--
--	$XT_MULTI "$@"
--	rc=$?
--
--	[ $rc -eq $rc_exp ] || {
--		echo "---> expected $rc_exp, got $rc for command '$@'"
--		global_rc=1
--	}
--}
--
--# test chain creation
--cmd 0 ip6tables -N foo
--cmd 1 ip6tables -N foo
--# iptables-nft allows this - bug or feature?
--#cmd 2 ip6tables -N "invalid name"
--
--# test rule adding
--cmd 0 ip6tables -A INPUT -j ACCEPT
--cmd 1 ip6tables -A noexist -j ACCEPT
--cmd 2 ip6tables -I INPUT -j foobar
--
--# test rule checking
--cmd 0 ip6tables -C INPUT -j ACCEPT
--cmd 1 ip6tables -C FORWARD -j ACCEPT
--cmd 1 ip6tables -C nonexist -j ACCEPT
--cmd 2 ip6tables -C INPUT -j foobar
--cmd 2 ip6tables -C INPUT -m foobar -j ACCEPT
--cmd 3 ip6tables -t foobar -C INPUT -j ACCEPT
--
--exit $global_rc
-diff --git a/iptables/tests/shell/testcases/iptables/0004-return-codes_0 b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
-index f730bede1f612..dcd9dfd3c0806 100755
---- a/iptables/tests/shell/testcases/iptables/0004-return-codes_0
-+++ b/iptables/tests/shell/testcases/iptables/0004-return-codes_0
-@@ -13,75 +13,84 @@ cmd() { # (rc, msg, cmd, [args ...])
- 		msg_exp="$1"; shift
- 	}
- 
--	msg="$($XT_MULTI "$@" 2>&1 >/dev/null)"
--	rc=$?
-+	for ipt in iptables ip6tables; do
-+		msg="$($XT_MULTI $ipt "$@" 2>&1 >/dev/null)"
-+		rc=$?
- 
--	[ $rc -eq $rc_exp ] || {
--		echo "---> expected return code $rc_exp, got $rc for command '$@'"
--		global_rc=1
--	}
-+		[ $rc -eq $rc_exp ] || {
-+			echo "---> expected return code $rc_exp, got $rc for command '$ipt $@'"
-+			global_rc=1
-+		}
- 
--	[ -n "$msg_exp" ] || return
--	grep -q "$msg_exp" <<< $msg || {
--		echo "---> expected error message '$msg_exp', got '$msg' for command '$@'"
--		global_rc=1
--	}
-+		[ -n "$msg_exp" ] || continue
-+		msg_exp_full="${ipt}$msg_exp"
-+		grep -q "$msg_exp_full" <<< $msg || {
-+			echo "---> expected error message '$msg_exp_full', got '$msg' for command '$ipt $@'"
-+			global_rc=1
-+		}
-+	done
- }
- 
--EEXIST_F="File exists."
--EEXIST="Chain already exists."
--ENOENT="No chain/target/match by that name."
--E2BIG_I="Index of insertion too big."
--E2BIG_D="Index of deletion too big."
--E2BIG_R="Index of replacement too big."
--EBADRULE="Bad rule (does a matching rule exist in that chain?)."
--ENOTGT="Couldn't load target \`foobar':No such file or directory"
--ENOMTH="Couldn't load match \`foobar':No such file or directory"
--ENOTBL="can't initialize iptables table \`foobar': Table does not exist"
-+EEXIST_F=": File exists."
-+EEXIST=": Chain already exists."
-+ENOENT=": No chain/target/match by that name."
-+E2BIG_I=": Index of insertion too big."
-+E2BIG_D=": Index of deletion too big."
-+E2BIG_R=": Index of replacement too big."
-+EBADRULE=": Bad rule (does a matching rule exist in that chain?)."
-+#ENOTGT=" v[0-9\.]* [^ ]*: Couldn't load target \`foobar':No such file or directory"
-+ENOMTH=" v[0-9\.]* [^ ]*: Couldn't load match \`foobar':No such file or directory"
-+ENOTBL=": can't initialize iptables table \`foobar': Table does not exist"
- 
- # test chain creation
--cmd 0 iptables -N foo
--cmd 1 "$EEXIST" iptables -N foo
-+cmd 0 -N foo
-+cmd 1 "$EEXIST" -N foo
- # iptables-nft allows this - bug or feature?
--#cmd 2 iptables -N "invalid name"
-+#cmd 2 -N "invalid name"
- 
- # test chain flushing/zeroing
--cmd 0 iptables -F foo
--cmd 0 iptables -Z foo
--cmd 1 "$ENOENT" iptables -F bar
--cmd 1 "$ENOENT" iptables -Z bar
-+cmd 0 -F foo
-+cmd 0 -Z foo
-+cmd 1 "$ENOENT" -F bar
-+cmd 1 "$ENOENT" -Z bar
- 
- # test chain rename
--cmd 0 iptables -E foo bar
--cmd 1 "$EEXIST_F" iptables -E foo bar
--cmd 1 "$ENOENT" iptables -E foo bar2
--cmd 0 iptables -N foo2
--cmd 1 "$EEXIST_F" iptables -E foo2 bar
-+cmd 0 -E foo bar
-+cmd 1 "$EEXIST_F" -E foo bar
-+cmd 1 "$ENOENT" -E foo bar2
-+cmd 0 -N foo2
-+cmd 1 "$EEXIST_F" -E foo2 bar
- 
- # test rule adding
--cmd 0 iptables -A INPUT -j ACCEPT
--cmd 1 "$ENOENT" iptables -A noexist -j ACCEPT
--cmd 2 "" iptables -I INPUT -j foobar
--cmd 2 "" iptables -R INPUT 1 -j foobar
--cmd 2 "" iptables -D INPUT -j foobar
-+cmd 0 -A INPUT -j ACCEPT
-+cmd 1 "$ENOENT" -A noexist -j ACCEPT
-+# next three differ:
-+# legacy: Couldn't load target `foobar':No such file or directory
-+# nft:    Chain 'foobar' does not exist
-+cmd 2 "" -I INPUT -j foobar
-+cmd 2 "" -R INPUT 1 -j foobar
-+cmd 2 "" -D INPUT -j foobar
-+cmd 1 "$EBADRULE" -D INPUT -p tcp --dport 22 -j ACCEPT
- 
- # test rulenum commands
--cmd 1 "$E2BIG_I" iptables -I INPUT 23 -j ACCEPT
--cmd 1 "$E2BIG_D" iptables -D INPUT 23
--cmd 1 "$E2BIG_R" iptables -R INPUT 23 -j ACCEPT
--cmd 1 "$ENOENT" iptables -I nonexist 23 -j ACCEPT
--cmd 1 "$ENOENT" iptables -D nonexist 23
--cmd 1 "$ENOENT" iptables -R nonexist 23 -j ACCEPT
-+cmd 1 "$E2BIG_I" -I INPUT 23 -j ACCEPT
-+cmd 1 "$E2BIG_D" -D INPUT 23
-+cmd 1 "$E2BIG_R" -R INPUT 23 -j ACCEPT
-+cmd 1 "$ENOENT" -I nonexist 23 -j ACCEPT
-+cmd 1 "$ENOENT" -D nonexist 23
-+cmd 1 "$ENOENT" -R nonexist 23 -j ACCEPT
- 
- # test rule checking
--cmd 0 iptables -C INPUT -j ACCEPT
--cmd 1 "$EBADRULE" iptables -C FORWARD -j ACCEPT
--cmd 1 "$BADRULE" iptables -C nonexist -j ACCEPT
--cmd 2 "$ENOMTH" iptables -C INPUT -m foobar -j ACCEPT
-+cmd 0 -C INPUT -j ACCEPT
-+cmd 1 "$EBADRULE" -C FORWARD -j ACCEPT
-+cmd 1 "$BADRULE" -C nonexist -j ACCEPT
-+cmd 2 "$ENOMTH" -C INPUT -m foobar -j ACCEPT
- # messages of those don't match, but iptables-nft ones are actually nicer.
--#cmd 2 "$ENOTGT" iptables -C INPUT -j foobar
--#cmd 3 "$ENOTBL" iptables -t foobar -C INPUT -j ACCEPT
--cmd 2 "" iptables -C INPUT -j foobar
--cmd 3 "" iptables -t foobar -C INPUT -j ACCEPT
-+# legacy: Couldn't load target `foobar':No such file or directory
-+# nft:    Chain 'foobar' does not exist
-+cmd 2 "" -C INPUT -j foobar
-+# legacy: can't initialize ip6tables table `foobar': Table does not exist (do you need to insmod?)
-+# nft:    table 'foobar' does not exist
-+cmd 3 "" -t foobar -C INPUT -j ACCEPT
- 
- exit $global_rc
--- 
-2.40.0
-

SOURCES/0009-xtables-monitor-Fix-ip6tables-rule-printing.patch

@@ -1,37 +0,0 @@
-From fe5db6f78145aeac1b18d21c38c178b99cd7c04a Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 7 Aug 2020 16:42:07 +0200
-Subject: [PATCH] xtables-monitor: Fix ip6tables rule printing
-
-When printing an ip6tables rule event, false family ops are used as they
-are initially looked up for AF_INET and reused no matter the current
-rule's family. In practice, this means that nft_rule_print_save() calls
-the wrong rule_to_cs, save_rule and clear_cs callbacks. Therefore, if a
-rule specifies a source or destination address, the address is not
-printed.
-
-Fix this by performing a family lookup each time rule_cb is called.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit ca69b0290dc509d72118f0a054a5c740cb913875)
----
- iptables/xtables-monitor.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 57def83e2eea0..4008cc00d4694 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -93,6 +93,8 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
- 	if (arg->nfproto && arg->nfproto != family)
- 		goto err_free;
- 
-+	arg->h->ops = nft_family_ops_lookup(family);
-+
- 	if (arg->is_event)
- 		printf(" EVENT: ");
- 	switch (family) {
--- 
-2.40.0
-

SOURCES/0009-xtables-monitor-Proper-re-init-for-rule-s-family.patch

@@ -0,0 +1,51 @@
+From 78cc3761b83a08b6782dfa52887fbd8c9c28bf61 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:11 +0200
+Subject: [PATCH] xtables-monitor: Proper re-init for rule's family
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit a5e7f9d14ee404544e2751232e69f993b16e7396
+
+commit a5e7f9d14ee404544e2751232e69f993b16e7396
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 12:49:22 2024 +0200
+
+    xtables-monitor: Proper re-init for rule's family
+
+    When not running for a specific family only (via -4/-6 flags),
+    xtables-monitor potentially sees events/traces for all families. To
+    correctly parse rules when printing for NEWRULE, DELRULE or TRACE
+    messages, nft_handle has to be reinitialized for the rule's family.
+
+    It is not sufficient to reset nft_handle::ops: Some expression parsers
+    rely upon nft_handle::family to be properly set, too (cf. references to
+    'ctx->h->family in nft-ruleparse.c). Adjusting the 'afinfo' pointer
+    provided by libxtables is even more crucial, as e.g. do_parse() in
+    xshared.c relies upon it for the proper optstring.
+
+    This is actually a day-1 bug in xtables-monitor which surfaced due to
+    commit 9075c3aa983d9 ("nft: Increase rule parser strictness"). Therefore
+    make this fix the commit it is following-up.
+
+    Fixes: ca69b0290dc50 ("xtables-monitor: Fix ip6tables rule printing")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-monitor.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index cf2729d..cf92355 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -92,7 +92,9 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
+ 	if (arg->nfproto && arg->nfproto != family)
+ 		goto err_free;
+ 
++	xtables_set_nfproto(family);
+ 	arg->h->ops = nft_family_ops_lookup(family);
++	arg->h->family = family;
+ 
+ 	if (arg->is_event)
+ 		printf(" EVENT: ");

SOURCES/0010-nft-cache-Check-consistency-with-NFT_CL_FAKE-too.patch

@@ -1,39 +0,0 @@
-From 895077fbd8f11b717fd414a02d22dae99d94b390 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 29 Jul 2020 15:39:31 +0200
-Subject: [PATCH] nft: cache: Check consistency with NFT_CL_FAKE, too
-
-Athough this cache level fetches table names only, it shouldn't skip the
-consistency check.
-
-Fixes: f42bfb344af82 ("nft: cache: Re-establish cache consistency check")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit b531365ce32f386d91c6a0bbc80ec4076e4babdd)
----
- iptables/nft-cache.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
-index 638b18bc7e382..434cc10b82ce7 100644
---- a/iptables/nft-cache.c
-+++ b/iptables/nft-cache.c
-@@ -511,14 +511,14 @@ __nft_build_cache(struct nft_handle *h)
- 	if (req->level >= NFT_CL_TABLES)
- 		fetch_table_cache(h);
- 	if (req->level == NFT_CL_FAKE)
--		return;
-+		goto genid_check;
- 	if (req->level >= NFT_CL_CHAINS)
- 		fetch_chain_cache(h, t, chains);
- 	if (req->level >= NFT_CL_SETS)
- 		fetch_set_cache(h, t, NULL);
- 	if (req->level >= NFT_CL_RULES)
- 		fetch_rule_cache(h, t);
--
-+genid_check:
- 	mnl_genid_get(h, &genid_check);
- 	if (h->nft_genid != genid_check) {
- 		flush_cache(h, h->cache, NULL);
--- 
-2.40.0
-

SOURCES/0010-xtables-monitor-Flush-stdout-after-all-lines-of-outp.patch

@@ -0,0 +1,46 @@
+From b40d2d0b3381c68a0f0e5d040d2f632191112dcb Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:11 +0200
+Subject: [PATCH] xtables-monitor: Flush stdout after all lines of output
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit 69da16a7790048a176a44530eb57e4b60184ce6e
+
+commit 69da16a7790048a176a44530eb57e4b60184ce6e
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 13:03:18 2024 +0200
+
+    xtables-monitor: Flush stdout after all lines of output
+
+    Writing an xtables-monitor testsuite is pretty much impossible without
+    this due to unreliable output flushing. Just move the fflush() call from
+    trace_cb() to its caller so monitor events benefit from it as well.
+
+    Fixes: 07af4da52ab30 ("xtables-monitor: fix rule printing")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-monitor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index cf92355..90d1cc5 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -544,7 +544,6 @@ static int trace_cb(const struct nlmsghdr *nlh, struct cb_arg *arg)
+ err_free:
+ 	nftnl_trace_free(nlt);
+ err:
+-	fflush(stdout);
+ 	return MNL_CB_OK;
+ }
+ 
+@@ -576,6 +575,7 @@ static int monitor_cb(const struct nlmsghdr *nlh, void *data)
+ 		break;
+ 	}
+ 
++	fflush(stdout);
+ 	return ret;
+ }
+ 

SOURCES/0011-nft-Fix-for-broken-address-mask-match-detection.patch

@@ -1,59 +0,0 @@
-From ba2da85b5a8940035f57dd395205c726c0c68ec7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 28 Sep 2020 18:57:18 +0200
-Subject: [PATCH] nft: Fix for broken address mask match detection
-
-Trying to decide whether a bitwise expression is needed to match parts
-of a source or destination address only, add_addr() checks if all bytes
-in 'mask' are 0xff or not. The check is apparently broken though as each
-byte in 'mask' is cast to a signed char before comparing against 0xff,
-therefore the bitwise is always added:
-
-| # ./bad/iptables-nft -A foo -s 10.0.0.1 -j ACCEPT
-| # ./good/iptables-nft -A foo -s 10.0.0.2 -j ACCEPT
-| # nft --debug=netlink list chain ip filter foo
-| ip filter foo 5
-|   [ payload load 4b @ network header + 12 => reg 1 ]
-|   [ bitwise reg 1 = (reg=1 & 0xffffffff ) ^ 0x00000000 ]
-|   [ cmp eq reg 1 0x0100000a ]
-|   [ counter pkts 0 bytes 0 ]
-|   [ immediate reg 0 accept ]
-|
-| ip filter foo 6 5
-|   [ payload load 4b @ network header + 12 => reg 1 ]
-|   [ cmp eq reg 1 0x0200000a ]
-|   [ counter pkts 0 bytes 0 ]
-|   [ immediate reg 0 accept ]
-|
-| table ip filter {
-| 	chain foo {
-| 		ip saddr 10.0.0.1 counter packets 0 bytes 0 accept
-| 		ip saddr 10.0.0.2 counter packets 0 bytes 0 accept
-| 	}
-| }
-
-Fix the cast, safe an extra op and gain 100% performance in ideal cases.
-
-Fixes: 56859380eb328 ("xtables-compat: avoid unneeded bitwise ops")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 72ed608bf1ea550ac13b5b880afc7ad3ffa0afd0)
----
- iptables/nft-shared.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index c5a8f3fcc051d..7741d23befc5a 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -165,7 +165,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
- void add_addr(struct nftnl_rule *r, int offset,
- 	      void *data, void *mask, size_t len, uint32_t op)
- {
--	const char *m = mask;
-+	const unsigned char *m = mask;
- 	int i;
- 
- 	add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
--- 
-2.40.0
-

SOURCES/0011-xtables-monitor-Align-builtin-chain-and-table-output.patch

@@ -0,0 +1,37 @@
+From 8a3ce49b4400b6027367d7b7b11cc8c694c17961 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:11 +0200
+Subject: [PATCH] xtables-monitor: Align builtin chain and table output
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit 90fb6635c8b7d1ad22108d838105c01c17a5de44
+
+commit 90fb6635c8b7d1ad22108d838105c01c17a5de44
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 13:37:12 2024 +0200
+
+    xtables-monitor: Align builtin chain and table output
+
+    Drop the leading hash sign and add "NEW/DEL chain" annotation.
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-monitor.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index 90d1cc5..e136e9b 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -153,7 +153,8 @@ static int chain_cb(const struct nlmsghdr *nlh, void *data)
+ 		break;
+ 	default:
+ 		nftnl_chain_snprintf(buf, sizeof(buf), c, NFTNL_OUTPUT_DEFAULT, 0);
+-		printf("# nft: %s\n", buf);
++		printf("nft: %s chain: %s\n",
++		       type == NFT_MSG_NEWCHAIN ? "NEW" : "DEL", buf);
+ 		goto err_free;
+ 	}
+ 

SOURCES/0012-extensions-libipt_icmp-Fix-translation-of-type-any.patch

@@ -1,51 +0,0 @@
-From e674863343bf3233d2d1cdd9e17adad5381796a9 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 6 Oct 2020 19:07:19 +0200
-Subject: [PATCH] extensions: libipt_icmp: Fix translation of type 'any'
-
-By itself, '-m icmp --icmp-type any' is a noop, it matches any icmp
-types. Yet nft_ipv4_xlate() does not emit an 'ip protocol' match if
-there's an extension with same name present in the rule. Luckily, legacy
-iptables demands icmp match to be prepended by '-p icmp', so we can
-assume this is present and just emit the 'ip protocol' match from icmp
-xlate callback.
-
-Fixes: aa158ca0fda65 ("extensions: libipt_icmp: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Reviewed-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit ad4b17b98bbedf93d2182a4dc9a37e9cf3adfe1b)
----
- extensions/libipt_icmp.c      | 5 +++++
- extensions/libipt_icmp.txlate | 3 +++
- 2 files changed, 8 insertions(+)
-
-diff --git a/extensions/libipt_icmp.c b/extensions/libipt_icmp.c
-index e76257c54708c..e5e236613f39f 100644
---- a/extensions/libipt_icmp.c
-+++ b/extensions/libipt_icmp.c
-@@ -256,6 +256,11 @@ static int icmp_xlate(struct xt_xlate *xl,
- 		if (!type_xlate_print(xl, info->type, info->code[0],
- 				      info->code[1]))
- 			return 0;
-+	} else {
-+		/* '-m icmp --icmp-type any' is a noop by itself,
-+		 * but it eats a (mandatory) previous '-p icmp' so
-+		 * emit it here */
-+		xt_xlate_add(xl, "ip protocol icmp");
- 	}
- 	return 1;
- }
-diff --git a/extensions/libipt_icmp.txlate b/extensions/libipt_icmp.txlate
-index 434f8cc4eb1ae..a2aec8e26df75 100644
---- a/extensions/libipt_icmp.txlate
-+++ b/extensions/libipt_icmp.txlate
-@@ -6,3 +6,6 @@ nft add rule ip filter INPUT icmp type destination-unreachable counter accept
- 
- iptables-translate -t filter -A INPUT -m icmp ! --icmp-type 3 -j ACCEPT
- nft add rule ip filter INPUT icmp type != destination-unreachable counter accept
-+
-+iptables-translate -t filter -A INPUT -m icmp --icmp-type any -j ACCEPT
-+nft add rule ip filter INPUT ip protocol icmp counter accept
--- 
-2.40.0
-

SOURCES/0012-xtables-monitor-Support-arptables-chain-events.patch

@@ -0,0 +1,38 @@
+From 3ca04d4228f6f1e1d604cd4810e79a19c4ab5400 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:11 +0200
+Subject: [PATCH] xtables-monitor: Support arptables chain events
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit de18b0da0312b81698c1dee76b1a36c47aed52d7
+
+commit de18b0da0312b81698c1dee76b1a36c47aed52d7
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 15:48:49 2024 +0200
+
+    xtables-monitor: Support arptables chain events
+
+    Print arptables NEWCHAIN/DELCHAIN events just like for iptables, using
+    the '-0' prefix rule callback already uses.
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/xtables-monitor.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index e136e9b..714a2df 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -151,6 +151,9 @@ static int chain_cb(const struct nlmsghdr *nlh, void *data)
+ 	case NFPROTO_IPV6:
+ 		family = 6;
+ 		break;
++	case NFPROTO_ARP:
++		family = 0;
++		break;
+ 	default:
+ 		nftnl_chain_snprintf(buf, sizeof(buf), c, NFTNL_OUTPUT_DEFAULT, 0);
+ 		printf("nft: %s chain: %s\n",

SOURCES/0013-libxtables-Make-sure-extensions-register-in-revision.patch

@@ -1,127 +0,0 @@
-From 4616623e18cb1868960194cd7f695969c594a35b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 21 Sep 2020 13:42:06 +0200
-Subject: [PATCH] libxtables: Make sure extensions register in revision order
-
-Insert extensions into pending lists in ordered fashion: Group by
-extension name (and, for matches, family) and order groups by descending
-revision number.
-
-This allows to simplify the later full registration considerably. Since
-that involves kernel compatibility checks, the extra cycles here pay off
-eventually.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit b3ac87038f4e45141831d9ab485a2f627daba3f1)
----
- libxtables/xtables.c | 71 +++++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 64 insertions(+), 7 deletions(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 8907ba2069be7..de52e3e2bbc15 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -948,8 +948,14 @@ static void xtables_check_options(const char *name, const struct option *opt)
- 		}
- }
- 
-+static int xtables_match_prefer(const struct xtables_match *a,
-+				const struct xtables_match *b);
-+
- void xtables_register_match(struct xtables_match *me)
- {
-+	struct xtables_match **pos;
-+	bool seen_myself = false;
-+
- 	if (me->next) {
- 		fprintf(stderr, "%s: match \"%s\" already registered\n",
- 			xt_params->program_name, me->name);
-@@ -1001,10 +1007,34 @@ void xtables_register_match(struct xtables_match *me)
- 	if (me->extra_opts != NULL)
- 		xtables_check_options(me->name, me->extra_opts);
- 
--
--	/* place on linked list of matches pending full registration */
--	me->next = xtables_pending_matches;
--	xtables_pending_matches = me;
-+	/* order into linked list of matches pending full registration */
-+	for (pos = &xtables_pending_matches; *pos; pos = &(*pos)->next) {
-+		/* group by name and family */
-+		if (strcmp(me->name, (*pos)->name) ||
-+		    me->family != (*pos)->family) {
-+			if (seen_myself)
-+				break; /* end of own group, append to it */
-+			continue;
-+		}
-+		/* found own group */
-+		seen_myself = true;
-+		if (xtables_match_prefer(me, *pos) >= 0)
-+			break; /* put preferred items first in group */
-+	}
-+	/* if own group was not found, prepend item */
-+	if (!*pos && !seen_myself)
-+		pos = &xtables_pending_matches;
-+
-+	me->next = *pos;
-+	*pos = me;
-+#ifdef DEBUG
-+	printf("%s: inserted match %s (family %d, revision %d):\n",
-+			__func__, me->name, me->family, me->revision);
-+	for (pos = &xtables_pending_matches; *pos; pos = &(*pos)->next) {
-+		printf("%s:\tmatch %s (family %d, revision %d)\n", __func__,
-+		       (*pos)->name, (*pos)->family, (*pos)->revision);
-+	}
-+#endif
- }
- 
- /**
-@@ -1143,6 +1173,9 @@ void xtables_register_matches(struct xtables_match *match, unsigned int n)
- 
- void xtables_register_target(struct xtables_target *me)
- {
-+	struct xtables_target **pos;
-+	bool seen_myself = false;
-+
- 	if (me->next) {
- 		fprintf(stderr, "%s: target \"%s\" already registered\n",
- 			xt_params->program_name, me->name);
-@@ -1198,9 +1231,33 @@ void xtables_register_target(struct xtables_target *me)
- 	if (me->family != afinfo->family && me->family != AF_UNSPEC)
- 		return;
- 
--	/* place on linked list of targets pending full registration */
--	me->next = xtables_pending_targets;
--	xtables_pending_targets = me;
-+	/* order into linked list of targets pending full registration */
-+	for (pos = &xtables_pending_targets; *pos; pos = &(*pos)->next) {
-+		/* group by name */
-+		if (!extension_cmp(me->name, (*pos)->name, (*pos)->family)) {
-+			if (seen_myself)
-+				break; /* end of own group, append to it */
-+			continue;
-+		}
-+		/* found own group */
-+		seen_myself = true;
-+		if (xtables_target_prefer(me, *pos) >= 0)
-+			break; /* put preferred items first in group */
-+	}
-+	/* if own group was not found, prepend item */
-+	if (!*pos && !seen_myself)
-+		pos = &xtables_pending_targets;
-+
-+	me->next = *pos;
-+	*pos = me;
-+#ifdef DEBUG
-+	printf("%s: inserted target %s (family %d, revision %d):\n",
-+			__func__, me->name, me->family, me->revision);
-+	for (pos = &xtables_pending_targets; *pos; pos = &(*pos)->next) {
-+		printf("%s:\ttarget %s (family %d, revision %d)\n", __func__,
-+		       (*pos)->name, (*pos)->family, (*pos)->revision);
-+	}
-+#endif
- }
- 
- static bool xtables_fully_register_pending_target(struct xtables_target *me)
--- 
-2.40.0
-

SOURCES/0013-tests-shell-New-xtables-monitor-test.patch

@@ -0,0 +1,179 @@
+From ba52fc13241a72ad26b7ea0cd38a1e8ded693961 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:11 +0200
+Subject: [PATCH] tests: shell: New xtables-monitor test
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit 876a71bf7ad573dea998ca61a03fd35f2b04557b
+
+commit 876a71bf7ad573dea998ca61a03fd35f2b04557b
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 13:10:08 2024 +0200
+
+    tests: shell: New xtables-monitor test
+
+    Only events monitoring for now.
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../testcases/nft-only/0012-xtables-monitor_0 | 149 ++++++++++++++++++
+ 1 file changed, 149 insertions(+)
+ create mode 100755 iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0 b/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+new file mode 100755
+index 0000000..7b028ba
+--- /dev/null
++++ b/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+@@ -0,0 +1,149 @@
++#!/bin/bash
++
++[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
++
++log=$(mktemp)
++trap "rm -f $log" EXIT
++echo "logging into file $log"
++rc=0
++
++# Filter monitor output:
++# - NEWGEN event is moot:
++#   - GENID/PID are arbitrary,
++#   - NAME always "xtables-nft-mul"
++# - handle is arbitrary as well
++logfilter() { # (logfile)
++	grep -v '^NEWGEN:' "$1" | sed -e 's/handle [0-9]\+/handle 0/'
++}
++
++# Compare monitor output for given command against content of the global $EXP
++monitorcheck() { # (cmd ...)
++	$XT_MULTI xtables-monitor -e >"$log"&
++	monpid=$!
++	sleep 0.5
++
++	$XT_MULTI "$@" || {
++		echo "Error: command failed: $@"
++		let "rc++"
++		kill $monpid
++		wait
++		return
++	}
++	sleep 0.5
++	kill $monpid
++	wait
++	diffout=$(diff -u <(echo "$EXP") <(logfilter "$log")) || {
++		echo "Fail: unexpected result for command: '$@':"
++		grep -v '^\(---\|+++\|@@\)' <<< "$diffout"
++		let "rc++"
++	}
++}
++
++EXP="\
++ EVENT: nft: NEW table: table filter ip flags 0 use 1 handle 0
++ EVENT: nft: NEW chain: ip filter FORWARD use 1 type filter hook forward prio 0 policy accept packets 0 bytes 0 flags 1
++ EVENT: -4 -t filter -A FORWARD -j ACCEPT"
++monitorcheck iptables -A FORWARD -j ACCEPT
++
++EXP="\
++ EVENT: nft: NEW table: table filter ip6 flags 0 use 1 handle 0
++ EVENT: nft: NEW chain: ip6 filter FORWARD use 1 type filter hook forward prio 0 policy accept packets 0 bytes 0 flags 1
++ EVENT: -6 -t filter -A FORWARD -j ACCEPT"
++monitorcheck ip6tables -A FORWARD -j ACCEPT
++
++# FIXME
++EXP="\
++ EVENT: nft: NEW table: table filter bridge flags 0 use 1 handle 0
++ EVENT: nft: NEW chain: bridge filter FORWARD use 1 type filter hook forward prio -200 policy accept packets 0 bytes 0 flags 1
++ EVENT: "
++monitorcheck ebtables -A FORWARD -j ACCEPT
++
++EXP="\
++ EVENT: nft: NEW table: table filter arp flags 0 use 1 handle 0
++ EVENT: nft: NEW chain: arp filter INPUT use 1 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1
++ EVENT: -0 -t filter -A INPUT -j ACCEPT"
++monitorcheck arptables -A INPUT -j ACCEPT
++
++EXP=" EVENT: -4 -t filter -N foo"
++monitorcheck iptables -N foo
++
++EXP=" EVENT: -6 -t filter -N foo"
++monitorcheck ip6tables -N foo
++
++# FIXME
++EXP="\
++ EVENT: nft: NEW chain: bridge filter foo use 1
++ EVENT: "
++monitorcheck ebtables -N foo
++
++EXP=" EVENT: -0 -t filter -N foo"
++monitorcheck arptables -N foo
++
++# meta l4proto matches require proper nft_handle:family value
++EXP=" EVENT: -4 -t filter -A FORWARD -i eth1 -o eth2 -p tcp -m tcp --dport 22 -j ACCEPT"
++monitorcheck iptables -A FORWARD -i eth1 -o eth2 -p tcp --dport 22 -j ACCEPT
++
++EXP=" EVENT: -6 -t filter -A FORWARD -i eth1 -o eth2 -p udp -m udp --sport 1337 -j ACCEPT"
++monitorcheck ip6tables -A FORWARD -i eth1 -o eth2 -p udp --sport 1337 -j ACCEPT
++
++# FIXME
++EXP=" EVENT: "
++monitorcheck ebtables -A FORWARD -i eth1 -o eth2 -p ip --ip-protocol udp --ip-source-port 1337 -j ACCEPT
++
++EXP=" EVENT: -0 -t filter -A INPUT -j ACCEPT -i eth1 -s 1.2.3.4 --src-mac 01:02:03:04:05:06"
++monitorcheck arptables -A INPUT -i eth1 -s 1.2.3.4 --src-mac 01:02:03:04:05:06 -j ACCEPT
++
++EXP=" EVENT: -4 -t filter -D FORWARD -i eth1 -o eth2 -p tcp -m tcp --dport 22 -j ACCEPT"
++monitorcheck iptables -D FORWARD -i eth1 -o eth2 -p tcp --dport 22 -j ACCEPT
++
++EXP=" EVENT: -6 -t filter -D FORWARD -i eth1 -o eth2 -p udp -m udp --sport 1337 -j ACCEPT"
++monitorcheck ip6tables -D FORWARD -i eth1 -o eth2 -p udp --sport 1337 -j ACCEPT
++
++# FIXME
++EXP=" EVENT: "
++monitorcheck ebtables -D FORWARD -i eth1 -o eth2 -p ip --ip-protocol udp --ip-source-port 1337 -j ACCEPT
++
++EXP=" EVENT: -0 -t filter -D INPUT -j ACCEPT -i eth1 -s 1.2.3.4 --src-mac 01:02:03:04:05:06"
++monitorcheck arptables -D INPUT -i eth1 -s 1.2.3.4 --src-mac 01:02:03:04:05:06 -j ACCEPT
++
++EXP=" EVENT: -4 -t filter -X foo"
++monitorcheck iptables -X foo
++
++EXP=" EVENT: -6 -t filter -X foo"
++monitorcheck ip6tables -X foo
++
++# FIXME
++EXP="\
++ EVENT: 
++ EVENT: nft: DEL chain: bridge filter foo use 0"
++monitorcheck ebtables -X foo
++
++EXP=" EVENT: -0 -t filter -X foo"
++monitorcheck arptables -X foo
++
++EXP=" EVENT: -4 -t filter -D FORWARD -j ACCEPT"
++monitorcheck iptables -F FORWARD
++
++EXP=" EVENT: -6 -t filter -D FORWARD -j ACCEPT"
++monitorcheck ip6tables -F FORWARD
++
++# FIXME
++EXP=" EVENT: "
++monitorcheck ebtables -F FORWARD
++
++EXP=" EVENT: -0 -t filter -D INPUT -j ACCEPT"
++monitorcheck arptables -F INPUT
++
++EXP=" EVENT: nft: DEL chain: ip filter FORWARD use 0 type filter hook forward prio 0 policy accept packets 0 bytes 0 flags 1"
++monitorcheck iptables -X FORWARD
++
++EXP=" EVENT: nft: DEL chain: ip6 filter FORWARD use 0 type filter hook forward prio 0 policy accept packets 0 bytes 0 flags 1"
++monitorcheck ip6tables -X FORWARD
++
++EXP=" EVENT: nft: DEL chain: bridge filter FORWARD use 0 type filter hook forward prio -200 policy accept packets 0 bytes 0 flags 1"
++monitorcheck ebtables -X FORWARD
++
++EXP=" EVENT: nft: DEL chain: arp filter INPUT use 0 type filter hook input prio 0 policy accept packets 0 bytes 0 flags 1"
++monitorcheck arptables -X INPUT
++
++exit $rc

SOURCES/0014-libxtables-Simplify-pending-extension-registration.patch

@@ -1,240 +0,0 @@
-From 4b5e9e71fbad66aef1db079905cba2db032a7515 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 18 Sep 2020 18:48:14 +0200
-Subject: [PATCH] libxtables: Simplify pending extension registration
-
-Assuming that pending extensions are sorted by first name and family,
-then descending revision, the decision where to insert a newly
-registered extension may be simplified by memorizing the previous
-registration (which obviously is of same name and family and higher
-revision).
-
-As a side-effect, fix for unsupported old extension revisions lingering
-in pending extension list forever and being retried with every use of
-the given extension. Any revision being rejected by the kernel may
-safely be dropped iff a previous (read: higher) revision was accepted
-already.
-
-Yet another side-effect of this change is the removal of an unwanted
-recursion by xtables_fully_register_pending_*() into itself via
-xtables_find_*().
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit a1eaaceb0460b338294e40bdd5bc5186320a478c)
----
- libxtables/xtables.c | 128 +++++++++++--------------------------------
- 1 file changed, 33 insertions(+), 95 deletions(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index de52e3e2bbc15..10d4e70328500 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -203,8 +203,10 @@ struct xtables_match *xtables_matches;
- struct xtables_target *xtables_targets;
- 
- /* Fully register a match/target which was previously partially registered. */
--static bool xtables_fully_register_pending_match(struct xtables_match *me);
--static bool xtables_fully_register_pending_target(struct xtables_target *me);
-+static bool xtables_fully_register_pending_match(struct xtables_match *me,
-+						 struct xtables_match *prev);
-+static bool xtables_fully_register_pending_target(struct xtables_target *me,
-+						  struct xtables_target *prev);
- 
- #ifndef NO_SHARED_LIBS
- /* registry for loaded shared objects to close later */
-@@ -662,6 +664,7 @@ struct xtables_match *
- xtables_find_match(const char *name, enum xtables_tryload tryload,
- 		   struct xtables_rule_match **matches)
- {
-+	struct xtables_match *prev = NULL;
- 	struct xtables_match **dptr;
- 	struct xtables_match *ptr;
- 	const char *icmp6 = "icmp6";
-@@ -683,8 +686,12 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
- 		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
- 			ptr = *dptr;
- 			*dptr = (*dptr)->next;
--			if (xtables_fully_register_pending_match(ptr))
-+			if (xtables_fully_register_pending_match(ptr, prev)) {
-+				prev = ptr;
- 				continue;
-+			} else if (prev) {
-+				continue;
-+			}
- 			*dptr = ptr;
- 		}
- 		dptr = &((*dptr)->next);
-@@ -778,6 +785,7 @@ xtables_find_match_revision(const char *name, enum xtables_tryload tryload,
- struct xtables_target *
- xtables_find_target(const char *name, enum xtables_tryload tryload)
- {
-+	struct xtables_target *prev = NULL;
- 	struct xtables_target **dptr;
- 	struct xtables_target *ptr;
- 
-@@ -794,8 +802,12 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
- 			ptr = *dptr;
- 			*dptr = (*dptr)->next;
--			if (xtables_fully_register_pending_target(ptr))
-+			if (xtables_fully_register_pending_target(ptr, prev)) {
-+				prev = ptr;
- 				continue;
-+			} else if (prev) {
-+				continue;
-+			}
- 			*dptr = ptr;
- 		}
- 		dptr = &((*dptr)->next);
-@@ -1098,64 +1110,27 @@ static int xtables_target_prefer(const struct xtables_target *a,
- 				 b->revision, b->family);
- }
- 
--static bool xtables_fully_register_pending_match(struct xtables_match *me)
-+static bool xtables_fully_register_pending_match(struct xtables_match *me,
-+						 struct xtables_match *prev)
- {
--	struct xtables_match **i, *old, *pos = NULL;
-+	struct xtables_match **i;
- 	const char *rn;
--	int compare;
- 
- 	/* See if new match can be used. */
- 	rn = (me->real_name != NULL) ? me->real_name : me->name;
- 	if (!compatible_match_revision(rn, me->revision))
- 		return false;
- 
--	old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL);
--	while (old) {
--		compare = xtables_match_prefer(old, me);
--		if (compare == 0) {
--			fprintf(stderr,
--				"%s: match `%s' already registered.\n",
--				xt_params->program_name, me->name);
--			exit(1);
--		}
--
--		/* Now we have two (or more) options, check compatibility. */
--		rn = (old->real_name != NULL) ? old->real_name : old->name;
--		if (compare > 0) {
--			/* Kernel tells old isn't compatible anymore??? */
--			if (!compatible_match_revision(rn, old->revision)) {
--				/* Delete old one. */
--				for (i = &xtables_matches; *i != old;)
--				     i = &(*i)->next;
--				*i = old->next;
--			}
--			pos = old;
--			old = old->next;
--			if (!old)
--				break;
--			if (!extension_cmp(me->name, old->name, old->family))
--				break;
--			continue;
--		}
--
--		/* Found right old */
--		pos = old;
--		break;
--	}
--
--	if (!pos) {
-+	if (!prev) {
- 		/* Append to list. */
- 		for (i = &xtables_matches; *i; i = &(*i)->next);
--	} else if (compare < 0) {
--		/* Prepend it */
--		for (i = &xtables_matches; *i != pos; i = &(*i)->next);
--	} else if (compare > 0) {
-+	} else {
- 		/* Append it */
--		i = &pos->next;
--		pos = pos->next;
-+		i = &prev->next;
-+		prev = prev->next;
- 	}
- 
--	me->next = pos;
-+	me->next = prev;
- 	*i = me;
- 
- 	me->m = NULL;
-@@ -1260,11 +1235,11 @@ void xtables_register_target(struct xtables_target *me)
- #endif
- }
- 
--static bool xtables_fully_register_pending_target(struct xtables_target *me)
-+static bool xtables_fully_register_pending_target(struct xtables_target *me,
-+						  struct xtables_target *prev)
- {
--	struct xtables_target **i, *old, *pos = NULL;
-+	struct xtables_target **i;
- 	const char *rn;
--	int compare;
- 
- 	if (strcmp(me->name, "standard") != 0) {
- 		/* See if new target can be used. */
-@@ -1273,54 +1248,17 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me)
- 			return false;
- 	}
- 
--	old = xtables_find_target(me->name, XTF_DURING_LOAD);
--	while (old) {
--		compare = xtables_target_prefer(old, me);
--		if (compare == 0) {
--			fprintf(stderr,
--				"%s: target `%s' already registered.\n",
--				xt_params->program_name, me->name);
--			exit(1);
--		}
--
--		/* Now we have two (or more) options, check compatibility. */
--		rn = (old->real_name != NULL) ? old->real_name : old->name;
--		if (compare > 0) {
--			/* Kernel tells old isn't compatible anymore??? */
--			if (!compatible_target_revision(rn, old->revision)) {
--				/* Delete old one. */
--				for (i = &xtables_targets; *i != old;)
--				     i = &(*i)->next;
--				*i = old->next;
--			}
--			pos = old;
--			old = old->next;
--			if (!old)
--				break;
--			if (!extension_cmp(me->name, old->name, old->family))
--				break;
--			continue;
--		}
--
--		/* Found right old */
--		pos = old;
--		break;
--	}
--
--	if (!pos) {
-+	if (!prev) {
- 		/* Prepend to list. */
- 		i = &xtables_targets;
--		pos = xtables_targets;
--	} else if (compare < 0) {
--		/* Prepend it */
--		for (i = &xtables_targets; *i != pos; i = &(*i)->next);
--	} else if (compare > 0) {
-+		prev = xtables_targets;
-+	} else {
- 		/* Append it */
--		i = &pos->next;
--		pos = pos->next;
-+		i = &prev->next;
-+		prev = prev->next;
- 	}
- 
--	me->next = pos;
-+	me->next = prev;
- 	*i = me;
- 
- 	me->t = NULL;
--- 
-2.40.0
-

SOURCES/0014-xtables-monitor-Fix-for-ebtables-rule-events.patch

@@ -0,0 +1,102 @@
+From 08754c9274e81f2fcb96ce0e2169e0333d2a8dcf Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:11 +0200
+Subject: [PATCH] xtables-monitor: Fix for ebtables rule events
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit 56217d37aa38938ec3e118ae761481522155ff21
+
+commit 56217d37aa38938ec3e118ae761481522155ff21
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 14:01:45 2024 +0200
+
+    xtables-monitor: Fix for ebtables rule events
+
+    Bridge family wasn't recognized in rule_cb(), so merely an empty
+    "EVENT:" line was printed for ebtables rule changes. For lack of a
+    well-known family modifier flag for bridge family, simply prefix rules
+    by "ebtables".
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ .../testcases/nft-only/0012-xtables-monitor_0     | 15 ++++++---------
+ iptables/xtables-monitor.c                        |  3 +++
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0 b/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+index 7b028ba..0f0295b 100755
+--- a/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
++++ b/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+@@ -55,7 +55,7 @@ monitorcheck ip6tables -A FORWARD -j ACCEPT
+ EXP="\
+  EVENT: nft: NEW table: table filter bridge flags 0 use 1 handle 0
+  EVENT: nft: NEW chain: bridge filter FORWARD use 1 type filter hook forward prio -200 policy accept packets 0 bytes 0 flags 1
+- EVENT: "
++ EVENT: ebtables -t filter -A FORWARD -j ACCEPT"
+ monitorcheck ebtables -A FORWARD -j ACCEPT
+ 
+ EXP="\
+@@ -73,7 +73,7 @@ monitorcheck ip6tables -N foo
+ # FIXME
+ EXP="\
+  EVENT: nft: NEW chain: bridge filter foo use 1
+- EVENT: "
++ EVENT: ebtables -t filter -A foo -j ACCEPT"
+ monitorcheck ebtables -N foo
+ 
+ EXP=" EVENT: -0 -t filter -N foo"
+@@ -86,8 +86,7 @@ monitorcheck iptables -A FORWARD -i eth1 -o eth2 -p tcp --dport 22 -j ACCEPT
+ EXP=" EVENT: -6 -t filter -A FORWARD -i eth1 -o eth2 -p udp -m udp --sport 1337 -j ACCEPT"
+ monitorcheck ip6tables -A FORWARD -i eth1 -o eth2 -p udp --sport 1337 -j ACCEPT
+ 
+-# FIXME
+-EXP=" EVENT: "
++EXP=" EVENT: ebtables -t filter -A FORWARD -p IPv4 -i eth1 -o eth2 --ip-proto udp --ip-sport 1337 -j ACCEPT"
+ monitorcheck ebtables -A FORWARD -i eth1 -o eth2 -p ip --ip-protocol udp --ip-source-port 1337 -j ACCEPT
+ 
+ EXP=" EVENT: -0 -t filter -A INPUT -j ACCEPT -i eth1 -s 1.2.3.4 --src-mac 01:02:03:04:05:06"
+@@ -99,8 +98,7 @@ monitorcheck iptables -D FORWARD -i eth1 -o eth2 -p tcp --dport 22 -j ACCEPT
+ EXP=" EVENT: -6 -t filter -D FORWARD -i eth1 -o eth2 -p udp -m udp --sport 1337 -j ACCEPT"
+ monitorcheck ip6tables -D FORWARD -i eth1 -o eth2 -p udp --sport 1337 -j ACCEPT
+ 
+-# FIXME
+-EXP=" EVENT: "
++EXP=" EVENT: ebtables -t filter -D FORWARD -p IPv4 -i eth1 -o eth2 --ip-proto udp --ip-sport 1337 -j ACCEPT"
+ monitorcheck ebtables -D FORWARD -i eth1 -o eth2 -p ip --ip-protocol udp --ip-source-port 1337 -j ACCEPT
+ 
+ EXP=" EVENT: -0 -t filter -D INPUT -j ACCEPT -i eth1 -s 1.2.3.4 --src-mac 01:02:03:04:05:06"
+@@ -114,7 +112,7 @@ monitorcheck ip6tables -X foo
+ 
+ # FIXME
+ EXP="\
+- EVENT: 
++ EVENT: ebtables -t filter -D foo -j ACCEPT
+  EVENT: nft: DEL chain: bridge filter foo use 0"
+ monitorcheck ebtables -X foo
+ 
+@@ -127,8 +125,7 @@ monitorcheck iptables -F FORWARD
+ EXP=" EVENT: -6 -t filter -D FORWARD -j ACCEPT"
+ monitorcheck ip6tables -F FORWARD
+ 
+-# FIXME
+-EXP=" EVENT: "
++EXP=" EVENT: ebtables -t filter -D FORWARD -j ACCEPT"
+ monitorcheck ebtables -F FORWARD
+ 
+ EXP=" EVENT: -0 -t filter -D INPUT -j ACCEPT"
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index 714a2df..7079a03 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -106,6 +106,9 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
+ 	case NFPROTO_ARP:
+ 		printf("-0 ");
+ 		break;
++	case NFPROTO_BRIDGE:
++		printf("ebtables ");
++		break;
+ 	default:
+ 		puts("");
+ 		goto err_free;

SOURCES/0015-libxtables-Register-multiple-extensions-in-ascending.patch

@@ -1,51 +0,0 @@
-From 1ae06e3a2da1c21a75b55609b99d1ab3ef6cf709 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 22 Sep 2020 20:01:15 +0200
-Subject: [PATCH] libxtables: Register multiple extensions in ascending order
-
-The newly introduced ordered insert algorithm in
-xtables_register_{match,target}() works best if extensions of same name
-are passed in ascending revisions. Since this is the case in about all
-extensions' arrays, iterate over them from beginning to end.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit b5f1a3beac1d1f2b96c8be8ebec450f5ea758090)
----
- libxtables/xtables.c | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 10d4e70328500..7152c6576cd63 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -1141,9 +1141,10 @@ static bool xtables_fully_register_pending_match(struct xtables_match *me,
- 
- void xtables_register_matches(struct xtables_match *match, unsigned int n)
- {
--	do {
--		xtables_register_match(&match[--n]);
--	} while (n > 0);
-+	int i;
-+
-+	for (i = 0; i < n; i++)
-+		xtables_register_match(&match[i]);
- }
- 
- void xtables_register_target(struct xtables_target *me)
-@@ -1269,9 +1270,10 @@ static bool xtables_fully_register_pending_target(struct xtables_target *me,
- 
- void xtables_register_targets(struct xtables_target *target, unsigned int n)
- {
--	do {
--		xtables_register_target(&target[--n]);
--	} while (n > 0);
-+	int i;
-+
-+	for (i = 0; i < n; i++)
-+		xtables_register_target(&target[i]);
- }
- 
- /* receives a list of xtables_rule_match, release them */
--- 
-2.40.0
-

SOURCES/0015-xtables-monitor-Ignore-ebtables-policy-rules-unless-.patch

@@ -0,0 +1,109 @@
+From 4a0811c0db13ccc7217123be907d6946ded384a1 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Wed, 14 Aug 2024 14:30:12 +0200
+Subject: [PATCH] xtables-monitor: Ignore ebtables policy rules unless tracing
+
+JIRA: https://issues.redhat.com/browse/RHEL-47264
+Upstream Status: iptables commit 5aa4935bc88fd8acf90cce4535e58fc3be85f055
+
+commit 5aa4935bc88fd8acf90cce4535e58fc3be85f055
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Fri Jul 12 18:07:16 2024 +0200
+
+    xtables-monitor: Ignore ebtables policy rules unless tracing
+
+    Do not expose this implementation detail to users, otherwise new
+    user-defined chains are followed by a new rule event.
+
+    When tracing, they are useful as they potentially terminate rule
+    traversal.
+
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ iptables/nft.c                                        |  2 +-
+ iptables/nft.h                                        |  1 +
+ .../shell/testcases/nft-only/0012-xtables-monitor_0   | 11 ++---------
+ iptables/xtables-monitor.c                            |  7 +++++++
+ 4 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/iptables/nft.c b/iptables/nft.c
+index ad4c866..81e8f76 100644
+--- a/iptables/nft.c
++++ b/iptables/nft.c
+@@ -1823,7 +1823,7 @@ nft_rule_print_save(struct nft_handle *h, const struct nftnl_rule *r,
+ 	return ret;
+ }
+ 
+-static bool nft_rule_is_policy_rule(struct nftnl_rule *r)
++bool nft_rule_is_policy_rule(struct nftnl_rule *r)
+ {
+ 	const struct nftnl_udata *tb[UDATA_TYPE_MAX + 1] = {};
+ 	const void *data;
+diff --git a/iptables/nft.h b/iptables/nft.h
+index 5acbbf8..8b173d1 100644
+--- a/iptables/nft.h
++++ b/iptables/nft.h
+@@ -184,6 +184,7 @@ int nft_rule_list_save(struct nft_handle *h, const char *chain, const char *tabl
+ int nft_rule_save(struct nft_handle *h, const char *table, unsigned int format);
+ int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table, bool verbose);
+ int nft_rule_zero_counters(struct nft_handle *h, const char *chain, const char *table, int rulenum);
++bool nft_rule_is_policy_rule(struct nftnl_rule *r);
+ 
+ /*
+  * Operations used in userspace tools
+diff --git a/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0 b/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+index 0f0295b..ef1ec3c 100755
+--- a/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
++++ b/iptables/tests/shell/testcases/nft-only/0012-xtables-monitor_0
+@@ -51,7 +51,6 @@ EXP="\
+  EVENT: -6 -t filter -A FORWARD -j ACCEPT"
+ monitorcheck ip6tables -A FORWARD -j ACCEPT
+ 
+-# FIXME
+ EXP="\
+  EVENT: nft: NEW table: table filter bridge flags 0 use 1 handle 0
+  EVENT: nft: NEW chain: bridge filter FORWARD use 1 type filter hook forward prio -200 policy accept packets 0 bytes 0 flags 1
+@@ -70,10 +69,7 @@ monitorcheck iptables -N foo
+ EXP=" EVENT: -6 -t filter -N foo"
+ monitorcheck ip6tables -N foo
+ 
+-# FIXME
+-EXP="\
+- EVENT: nft: NEW chain: bridge filter foo use 1
+- EVENT: ebtables -t filter -A foo -j ACCEPT"
++EXP=" EVENT: nft: NEW chain: bridge filter foo use 1"
+ monitorcheck ebtables -N foo
+ 
+ EXP=" EVENT: -0 -t filter -N foo"
+@@ -110,10 +106,7 @@ monitorcheck iptables -X foo
+ EXP=" EVENT: -6 -t filter -X foo"
+ monitorcheck ip6tables -X foo
+ 
+-# FIXME
+-EXP="\
+- EVENT: ebtables -t filter -D foo -j ACCEPT
+- EVENT: nft: DEL chain: bridge filter foo use 0"
++EXP=" EVENT: nft: DEL chain: bridge filter foo use 0"
+ monitorcheck ebtables -X foo
+ 
+ EXP=" EVENT: -0 -t filter -X foo"
+diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
+index 7079a03..b54a704 100644
+--- a/iptables/xtables-monitor.c
++++ b/iptables/xtables-monitor.c
+@@ -96,6 +96,13 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
+ 	arg->h->ops = nft_family_ops_lookup(family);
+ 	arg->h->family = family;
+ 
++	/* ignore policy rules unless tracing,
++	 * they are reported when deleting user-defined chains */
++	if (family == NFPROTO_BRIDGE &&
++	    arg->is_event &&
++	    nft_rule_is_policy_rule(r))
++		goto err_free;
++
+ 	if (arg->is_event)
+ 		printf(" EVENT: ");
+ 	switch (family) {

SOURCES/0016-nft-Make-batch_add_chain-return-the-added-batch-obje.patch

@@ -1,161 +0,0 @@
-From 99bf566bfcabce101940b28a12f61c637ccfb489 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sat, 3 Oct 2020 17:46:09 +0200
-Subject: [PATCH] nft: Make batch_add_chain() return the added batch object
-
-Do this so in a later patch the 'skip' field can be adjusted.
-
-While being at it, simplify a few callers and eliminate the need for a
-'ret' variable.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Reviewed-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 0d77e64e8d9b8a3984b01a4951524dc40f61f4b6)
----
- iptables/nft.c | 35 +++++++++++++++++------------------
- 1 file changed, 17 insertions(+), 18 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index e795d4ae6d241..ec5f7457e4784 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -389,10 +389,11 @@ batch_set_add(struct nft_handle *h, enum obj_update_type type,
- 	return batch_add(h, type, s);
- }
- 
--static int batch_chain_add(struct nft_handle *h, enum obj_update_type type,
-+static struct obj_update *
-+batch_chain_add(struct nft_handle *h, enum obj_update_type type,
- 			   struct nftnl_chain *c)
- {
--	return batch_add(h, type, c) ? 0 : -1;
-+	return batch_add(h, type, c);
- }
- 
- static struct obj_update *
-@@ -920,7 +921,6 @@ int nft_chain_set(struct nft_handle *h, const char *table,
- 		  const struct xt_counters *counters)
- {
- 	struct nftnl_chain *c = NULL;
--	int ret;
- 
- 	nft_fn = nft_chain_set;
- 
-@@ -934,10 +934,11 @@ int nft_chain_set(struct nft_handle *h, const char *table,
- 	if (c == NULL)
- 		return 0;
- 
--	ret = batch_chain_add(h, NFT_COMPAT_CHAIN_UPDATE, c);
-+	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_UPDATE, c))
-+		return 0;
- 
- 	/* the core expects 1 for success and 0 for error */
--	return ret == 0 ? 1 : 0;
-+	return 1;
- }
- 
- static int __add_match(struct nftnl_expr *e, struct xt_entry_match *m)
-@@ -1752,7 +1753,6 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
- {
- 	struct nftnl_chain_list *list;
- 	struct nftnl_chain *c;
--	int ret;
- 
- 	nft_fn = nft_chain_user_add;
- 
-@@ -1772,14 +1772,15 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
- 	if (h->family == NFPROTO_BRIDGE)
- 		nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
- 
--	ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
-+	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
-+		return 0;
- 
- 	list = nft_chain_list_get(h, table, chain);
- 	if (list)
- 		nftnl_chain_list_add(c, list);
- 
- 	/* the core expects 1 for success and 0 for error */
--	return ret == 0 ? 1 : 0;
-+	return 1;
- }
- 
- int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
-@@ -1787,7 +1788,6 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
- 	struct nftnl_chain_list *list;
- 	struct nftnl_chain *c;
- 	bool created = false;
--	int ret;
- 
- 	c = nft_chain_find(h, table, chain);
- 	if (c) {
-@@ -1812,14 +1812,15 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
- 	if (!created)
- 		return 1;
- 
--	ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
-+	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
-+		return 0;
- 
- 	list = nft_chain_list_get(h, table, chain);
- 	if (list)
- 		nftnl_chain_list_add(c, list);
- 
- 	/* the core expects 1 for success and 0 for error */
--	return ret == 0 ? 1 : 0;
-+	return 1;
- }
- 
- /* From linux/netlink.h */
-@@ -1837,7 +1838,6 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
- {
- 	struct chain_user_del_data *d = data;
- 	struct nft_handle *h = d->handle;
--	int ret;
- 
- 	/* don't delete built-in chain */
- 	if (nft_chain_builtin(c))
-@@ -1849,8 +1849,7 @@ static int __nft_chain_user_del(struct nftnl_chain *c, void *data)
- 
- 	/* XXX This triggers a fast lookup from the kernel. */
- 	nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
--	ret = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c);
--	if (ret)
-+	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_DEL, c))
- 		return -1;
- 
- 	nftnl_chain_list_del(c);
-@@ -1925,7 +1924,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
- {
- 	struct nftnl_chain *c;
- 	uint64_t handle;
--	int ret;
- 
- 	nft_fn = nft_chain_user_rename;
- 
-@@ -1954,10 +1952,11 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
- 	nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, newname);
- 	nftnl_chain_set_u64(c, NFTNL_CHAIN_HANDLE, handle);
- 
--	ret = batch_chain_add(h, NFT_COMPAT_CHAIN_RENAME, c);
-+	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_RENAME, c))
-+		return 0;
- 
- 	/* the core expects 1 for success and 0 for error */
--	return ret == 0 ? 1 : 0;
-+	return 1;
- }
- 
- bool nft_table_find(struct nft_handle *h, const char *tablename)
-@@ -3404,7 +3403,7 @@ static int __nft_chain_zero_counters(struct nftnl_chain *c, void *data)
- 		nftnl_chain_set_u64(c, NFTNL_CHAIN_PACKETS, 0);
- 		nftnl_chain_set_u64(c, NFTNL_CHAIN_BYTES, 0);
- 		nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
--		if (batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c))
-+		if (!batch_chain_add(h, NFT_COMPAT_CHAIN_ZERO, c))
- 			return -1;
- 	}
- 
--- 
-2.40.0
-

SOURCES/0017-nft-Fix-error-reporting-for-refreshed-transactions.patch

@@ -1,41 +0,0 @@
-From 8ab5e29f192187bc12a2064036cf406de60b2cd5 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 5 Oct 2020 15:54:35 +0200
-Subject: [PATCH] nft: Fix error reporting for refreshed transactions
-
-When preparing a batch from the list of batch objects in nft_action(),
-the sequence number used for each object is stored within that object
-for later matching against returned error messages. Though if the
-transaction has to be refreshed, some of those objects may be skipped,
-other objects take over their sequence number and errors are matched to
-skipped objects. Avoid this by resetting the skipped object's sequence
-number to zero.
-
-Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Reviewed-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit e98b825a037807bf6c918eb66ee9682cc4c46183)
----
- iptables/nft.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index ec5f7457e4784..d3eb0840a9fc0 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -2832,9 +2832,10 @@ static int nft_action(struct nft_handle *h, int action)
- 	h->nft_genid++;
- 
- 	list_for_each_entry(n, &h->obj_list, head) {
--
--		if (n->skip)
-+		if (n->skip) {
-+			n->seq = 0;
- 			continue;
-+		}
- 
- 		n->seq = seq++;
- 		switch (n->type) {
--- 
-2.40.0
-

SOURCES/0018-nft-Fix-for-concurrent-noflush-restore-calls.patch

@@ -1,235 +0,0 @@
-From 412c52e9ab9d5d1d1a1e5e09a122cca43895451a Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 5 Oct 2020 16:06:49 +0200
-Subject: [PATCH] nft: Fix for concurrent noflush restore calls
-
-Transaction refresh was broken with regards to nft_chain_restore(): It
-created a rule flush batch object only if the chain was found in cache
-and a chain add object only if the chain was not found. Yet with
-concurrent ruleset updates, one has to expect both situations:
-
-* If a chain vanishes, the rule flush job must be skipped and instead
-  the chain add job become active.
-
-* If a chain appears, the chain add job must be skipped and instead
-  rules flushed.
-
-Change the code accordingly: Create both batch objects and set their
-'skip' field depending on the situation in cache and adjust both in
-nft_refresh_transaction().
-
-As a side-effect, the implicit rule flush becomes explicit and all
-handling of implicit batch jobs is dropped along with the related field
-indicating such.
-
-Reuse the 'implicit' parameter of __nft_rule_flush() to control the
-initial 'skip' field value instead.
-
-A subtle caveat is vanishing of existing chains: Creating the chain add
-job based on the chain in cache causes a netlink message containing that
-chain's handle which the kernel dislikes. Therefore unset the chain's
-handle in that case.
-
-Fixes: 58d7de0181f61 ("xtables: handle concurrent ruleset modifications")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit dac904bdcd9a18aabafee7275ccf0c2bd53800f3)
----
- iptables/nft.c                                | 58 ++++++++++---------
- .../ipt-restore/0016-concurrent-restores_0    | 53 +++++++++++++++++
- 2 files changed, 83 insertions(+), 28 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index d3eb0840a9fc0..bdb633a82a655 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -265,7 +265,6 @@ struct obj_update {
- 	struct list_head	head;
- 	enum obj_update_type	type:8;
- 	uint8_t			skip:1;
--	uint8_t			implicit:1;
- 	unsigned int		seq;
- 	union {
- 		struct nftnl_table	*table;
-@@ -1668,7 +1667,7 @@ struct nftnl_set *nft_set_batch_lookup_byid(struct nft_handle *h,
- 
- static void
- __nft_rule_flush(struct nft_handle *h, const char *table,
--		 const char *chain, bool verbose, bool implicit)
-+		 const char *chain, bool verbose, bool skip)
- {
- 	struct obj_update *obj;
- 	struct nftnl_rule *r;
-@@ -1690,7 +1689,7 @@ __nft_rule_flush(struct nft_handle *h, const char *table,
- 		return;
- 	}
- 
--	obj->implicit = implicit;
-+	obj->skip = skip;
- }
- 
- int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
-@@ -1786,17 +1785,12 @@ int nft_chain_user_add(struct nft_handle *h, const char *chain, const char *tabl
- int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table)
- {
- 	struct nftnl_chain_list *list;
-+	struct obj_update *obj;
- 	struct nftnl_chain *c;
- 	bool created = false;
- 
- 	c = nft_chain_find(h, table, chain);
--	if (c) {
--		/* Apparently -n still flushes existing user defined
--		 * chains that are redefined.
--		 */
--		if (h->noflush)
--			__nft_rule_flush(h, table, chain, false, true);
--	} else {
-+	if (!c) {
- 		c = nftnl_chain_alloc();
- 		if (!c)
- 			return 0;
-@@ -1804,20 +1798,26 @@ int nft_chain_restore(struct nft_handle *h, const char *chain, const char *table
- 		nftnl_chain_set_str(c, NFTNL_CHAIN_TABLE, table);
- 		nftnl_chain_set_str(c, NFTNL_CHAIN_NAME, chain);
- 		created = true;
--	}
- 
--	if (h->family == NFPROTO_BRIDGE)
--		nftnl_chain_set_u32(c, NFTNL_CHAIN_POLICY, NF_ACCEPT);
-+		list = nft_chain_list_get(h, table, chain);
-+		if (list)
-+			nftnl_chain_list_add(c, list);
-+	} else {
-+		/* If the chain should vanish meanwhile, kernel genid changes
-+		 * and the transaction is refreshed enabling the chain add
-+		 * object. With the handle still set, kernel interprets it as a
-+		 * chain replace job and errors since it is not found anymore.
-+		 */
-+		nftnl_chain_unset(c, NFTNL_CHAIN_HANDLE);
-+	}
- 
--	if (!created)
--		return 1;
-+	__nft_rule_flush(h, table, chain, false, created);
- 
--	if (!batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c))
-+	obj = batch_chain_add(h, NFT_COMPAT_CHAIN_USER_ADD, c);
-+	if (!obj)
- 		return 0;
- 
--	list = nft_chain_list_get(h, table, chain);
--	if (list)
--		nftnl_chain_list_add(c, list);
-+	obj->skip = !created;
- 
- 	/* the core expects 1 for success and 0 for error */
- 	return 1;
-@@ -2751,11 +2751,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
- 	h->error.lineno = 0;
- 
- 	list_for_each_entry_safe(n, tmp, &h->obj_list, head) {
--		if (n->implicit) {
--			batch_obj_del(h, n);
--			continue;
--		}
--
- 		switch (n->type) {
- 		case NFT_COMPAT_TABLE_FLUSH:
- 			tablename = nftnl_table_get_str(n->table, NFTNL_TABLE_NAME);
-@@ -2781,14 +2776,22 @@ static void nft_refresh_transaction(struct nft_handle *h)
- 
- 			c = nft_chain_find(h, tablename, chainname);
- 			if (c) {
--				/* -restore -n flushes existing rules from redefined user-chain */
--				__nft_rule_flush(h, tablename,
--						 chainname, false, true);
- 				n->skip = 1;
- 			} else if (!c) {
- 				n->skip = 0;
- 			}
- 			break;
-+		case NFT_COMPAT_RULE_FLUSH:
-+			tablename = nftnl_rule_get_str(n->rule, NFTNL_RULE_TABLE);
-+			if (!tablename)
-+				continue;
-+
-+			chainname = nftnl_rule_get_str(n->rule, NFTNL_RULE_CHAIN);
-+			if (!chainname)
-+				continue;
-+
-+			n->skip = !nft_chain_find(h, tablename, chainname);
-+			break;
- 		case NFT_COMPAT_TABLE_ADD:
- 		case NFT_COMPAT_CHAIN_ADD:
- 		case NFT_COMPAT_CHAIN_ZERO:
-@@ -2800,7 +2803,6 @@ static void nft_refresh_transaction(struct nft_handle *h)
- 		case NFT_COMPAT_RULE_INSERT:
- 		case NFT_COMPAT_RULE_REPLACE:
- 		case NFT_COMPAT_RULE_DELETE:
--		case NFT_COMPAT_RULE_FLUSH:
- 		case NFT_COMPAT_SET_ADD:
- 		case NFT_COMPAT_RULE_LIST:
- 		case NFT_COMPAT_RULE_CHECK:
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0 b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
-new file mode 100755
-index 0000000000000..53ec12fa368af
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
-@@ -0,0 +1,53 @@
-+#!/bin/bash
-+
-+set -e
-+
-+RS="*filter
-+:INPUT ACCEPT [12024:3123388]
-+:FORWARD ACCEPT [0:0]
-+:OUTPUT ACCEPT [12840:2144421]
-+:FOO - [0:0]
-+:BAR0 - [0:0]
-+:BAR1 - [0:0]
-+:BAR2 - [0:0]
-+:BAR3 - [0:0]
-+:BAR4 - [0:0]
-+:BAR5 - [0:0]
-+:BAR6 - [0:0]
-+:BAR7 - [0:0]
-+:BAR8 - [0:0]
-+:BAR9 - [0:0]
-+"
-+
-+RS1="$RS
-+-X BAR3
-+-X BAR6
-+-X BAR9
-+-A FOO -s 9.9.0.1/32 -j BAR1
-+-A FOO -s 9.9.0.2/32 -j BAR2
-+-A FOO -s 9.9.0.4/32 -j BAR4
-+-A FOO -s 9.9.0.5/32 -j BAR5
-+-A FOO -s 9.9.0.7/32 -j BAR7
-+-A FOO -s 9.9.0.8/32 -j BAR8
-+COMMIT
-+"
-+
-+RS2="$RS
-+-X BAR2
-+-X BAR5
-+-X BAR7
-+-A FOO -s 9.9.0.1/32 -j BAR1
-+-A FOO -s 9.9.0.3/32 -j BAR3
-+-A FOO -s 9.9.0.4/32 -j BAR4
-+-A FOO -s 9.9.0.6/32 -j BAR6
-+-A FOO -s 9.9.0.8/32 -j BAR8
-+-A FOO -s 9.9.0.9/32 -j BAR9
-+COMMIT
-+"
-+
-+for n in $(seq 1 10); do
-+	$XT_MULTI iptables-restore --noflush -w <<< "$RS1" &
-+	$XT_MULTI iptables-restore --noflush -w <<< "$RS2" &
-+	wait -n
-+	wait -n
-+done
--- 
-2.40.0
-

SOURCES/0019-tests-shell-Improve-concurrent-noflush-restore-test-.patch

@@ -1,54 +0,0 @@
-From bb80a77e8b0b2b557c4a2afd88446853e19236da Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 26 Oct 2020 17:25:03 +0100
-Subject: [PATCH] tests: shell: Improve concurrent noflush restore test a bit
-
-The described issue happens only if chain FOO does not exist at program
-start so flush the ruleset after each iteration to make sure this is the
-case. Sadly the bug is still not 100% reproducible on my testing VM.
-
-While being at it, add a paragraph describing what exact situation the
-test is trying to provoke.
-
-Fixes: dac904bdcd9a1 ("nft: Fix for concurrent noflush restore calls")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit ed8c8b9316451a4499eeb592d2cf7d782bbe4e9a)
----
- .../ipt-restore/0016-concurrent-restores_0         | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0 b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
-index 53ec12fa368af..aa746ab458a3c 100755
---- a/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
-+++ b/iptables/tests/shell/testcases/ipt-restore/0016-concurrent-restores_0
-@@ -1,5 +1,14 @@
- #!/bin/bash
- 
-+# test for iptables-restore --noflush skipping an explicitly requested chain
-+# flush because the chain did not exist when cache was fetched. In order to
-+# expect for that chain to appear when refreshing the transaction (due to a
-+# concurrent ruleset change), the chain flush job has to be present in batch
-+# job list (although disabled at first).
-+# The input line requesting chain flush is ':FOO - [0:0]'. RS1 and RS2 contents
-+# are crafted to cause EBUSY when deleting the BAR* chains if FOO is not
-+# flushed in the same transaction.
-+
- set -e
- 
- RS="*filter
-@@ -45,7 +54,12 @@ RS2="$RS
- COMMIT
- "
- 
-+NORS="*filter
-+COMMIT
-+"
-+
- for n in $(seq 1 10); do
-+	$XT_MULTI iptables-restore <<< "$NORS"
- 	$XT_MULTI iptables-restore --noflush -w <<< "$RS1" &
- 	$XT_MULTI iptables-restore --noflush -w <<< "$RS2" &
- 	wait -n
--- 
-2.40.0
-

SOURCES/0020-nft-Optimize-class-based-IP-prefix-matches.patch

@@ -1,149 +0,0 @@
-From a48e8c5a7433c8f7d0f28ed321081b25f3b63a4a Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 2 Oct 2020 09:44:38 +0200
-Subject: [PATCH] nft: Optimize class-based IP prefix matches
-
-Payload expression works on byte-boundaries, leverage this with suitable
-prefix lengths.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 323259001d617ae359430a03ee3d3e7f107684e0)
----
- iptables/nft-arp.c    | 11 ++++++++---
- iptables/nft-ipv4.c   |  6 ++++--
- iptables/nft-ipv6.c   |  6 ++++--
- iptables/nft-shared.c | 14 ++++++++++----
- iptables/nft-shared.h |  4 ++++
- 5 files changed, 30 insertions(+), 11 deletions(-)
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 67f4529d93652..952f0c6916e59 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -303,7 +303,8 @@ static bool nft_arp_parse_devaddr(struct nft_xt_ctx *ctx,
- 		memcpy(info->mask, ctx->bitwise.mask, ETH_ALEN);
- 		ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 	} else {
--		memset(info->mask, 0xff, ETH_ALEN);
-+		memset(info->mask, 0xff,
-+		       min(ctx->payload.len, ETH_ALEN));
- 	}
- 
- 	return inv;
-@@ -360,7 +361,9 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
- 				parse_mask_ipv4(ctx, &fw->arp.smsk);
- 				ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 			} else {
--				fw->arp.smsk.s_addr = 0xffffffff;
-+				memset(&fw->arp.smsk, 0xff,
-+				       min(ctx->payload.len,
-+					   sizeof(struct in_addr)));
- 			}
- 
- 			if (inv)
-@@ -380,7 +383,9 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
- 				parse_mask_ipv4(ctx, &fw->arp.tmsk);
- 				ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 			} else {
--				fw->arp.tmsk.s_addr = 0xffffffff;
-+				memset(&fw->arp.tmsk, 0xff,
-+				       min(ctx->payload.len,
-+					   sizeof(struct in_addr)));
- 			}
- 
- 			if (inv)
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index afdecf9711e64..ce702041af0f4 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -199,7 +199,8 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
- 			parse_mask_ipv4(ctx, &cs->fw.ip.smsk);
- 			ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 		} else {
--			cs->fw.ip.smsk.s_addr = 0xffffffff;
-+			memset(&cs->fw.ip.smsk, 0xff,
-+			       min(ctx->payload.len, sizeof(struct in_addr)));
- 		}
- 
- 		if (inv)
-@@ -212,7 +213,8 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
- 			parse_mask_ipv4(ctx, &cs->fw.ip.dmsk);
- 			ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 		} else {
--			cs->fw.ip.dmsk.s_addr = 0xffffffff;
-+			memset(&cs->fw.ip.dmsk, 0xff,
-+			       min(ctx->payload.len, sizeof(struct in_addr)));
- 		}
- 
- 		if (inv)
-diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index 4008b7eab4f2a..c877ec6d10887 100644
---- a/iptables/nft-ipv6.c
-+++ b/iptables/nft-ipv6.c
-@@ -146,7 +146,8 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
- 			parse_mask_ipv6(ctx, &cs->fw6.ipv6.smsk);
- 			ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 		} else {
--			memset(&cs->fw6.ipv6.smsk, 0xff, sizeof(struct in6_addr));
-+			memset(&cs->fw6.ipv6.smsk, 0xff,
-+			       min(ctx->payload.len, sizeof(struct in6_addr)));
- 		}
- 
- 		if (inv)
-@@ -159,7 +160,8 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
- 			parse_mask_ipv6(ctx, &cs->fw6.ipv6.dmsk);
- 			ctx->flags &= ~NFT_XT_CTX_BITWISE;
- 		} else {
--			memset(&cs->fw6.ipv6.dmsk, 0xff, sizeof(struct in6_addr));
-+			memset(&cs->fw6.ipv6.dmsk, 0xff,
-+			       min(ctx->payload.len, sizeof(struct in6_addr)));
- 		}
- 
- 		if (inv)
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 7741d23befc5a..545e9c60fa015 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -166,16 +166,22 @@ void add_addr(struct nftnl_rule *r, int offset,
- 	      void *data, void *mask, size_t len, uint32_t op)
- {
- 	const unsigned char *m = mask;
-+	bool bitwise = false;
- 	int i;
- 
--	add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
--
- 	for (i = 0; i < len; i++) {
--		if (m[i] != 0xff)
-+		if (m[i] != 0xff) {
-+			bitwise = m[i] != 0;
- 			break;
-+		}
- 	}
- 
--	if (i != len)
-+	if (!bitwise)
-+		len = i;
-+
-+	add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
-+
-+	if (bitwise)
- 		add_bitwise(r, mask, len);
- 
- 	add_cmp_ptr(r, op, data, len);
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 94437ffe7990c..811fb9a1ebe76 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -246,4 +246,8 @@ void xtables_restore_parse(struct nft_handle *h,
- 			   const struct nft_xt_restore_parse *p);
- 
- void nft_check_xt_legacy(int family, bool is_ipt_save);
-+
-+#define min(x, y) ((x) < (y) ? (x) : (y))
-+#define max(x, y) ((x) > (y) ? (x) : (y))
-+
- #endif
--- 
-2.40.0
-

SOURCES/0021-ebtables-Optimize-masked-MAC-address-matches.patch

@@ -1,217 +0,0 @@
-From 06f53a3a19c829417c4083fdbbbeba14c92c7b04 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 30 Oct 2020 14:08:33 +0100
-Subject: [PATCH] ebtables: Optimize masked MAC address matches
-
-Just like with class-based prefix matches in iptables-nft, optimize
-masked MAC address matches if the mask is on a byte-boundary.
-
-To reuse the logic in add_addr(), extend it to accept the payload base
-value via parameter.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 274cb05edc58d6fa982a34c84b2f4cf6acc3e335)
----
- iptables/nft-arp.c    | 12 ++++++++----
- iptables/nft-bridge.c | 22 ++++++++++------------
- iptables/nft-ipv4.c   |  6 ++++--
- iptables/nft-ipv6.c   |  6 ++++--
- iptables/nft-shared.c |  5 ++---
- iptables/nft-shared.h |  3 ++-
- 6 files changed, 30 insertions(+), 24 deletions(-)
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 952f0c6916e59..5dc38da831aa0 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -178,7 +178,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 
- 	if (need_devaddr(&fw->arp.src_devaddr)) {
- 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCDEVADDR);
--		add_addr(r, sizeof(struct arphdr),
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 sizeof(struct arphdr),
- 			 &fw->arp.src_devaddr.addr,
- 			 &fw->arp.src_devaddr.mask,
- 			 fw->arp.arhln, op);
-@@ -189,7 +190,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	    fw->arp.smsk.s_addr != 0 ||
- 	    fw->arp.invflags & ARPT_INV_SRCIP) {
- 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCIP);
--		add_addr(r, sizeof(struct arphdr) + fw->arp.arhln,
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 sizeof(struct arphdr) + fw->arp.arhln,
- 			 &fw->arp.src.s_addr, &fw->arp.smsk.s_addr,
- 			 sizeof(struct in_addr), op);
- 	}
-@@ -197,7 +199,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 
- 	if (need_devaddr(&fw->arp.tgt_devaddr)) {
- 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTDEVADDR);
--		add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
- 			 &fw->arp.tgt_devaddr.addr,
- 			 &fw->arp.tgt_devaddr.mask,
- 			 fw->arp.arhln, op);
-@@ -207,7 +210,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	    fw->arp.tmsk.s_addr != 0 ||
- 	    fw->arp.invflags & ARPT_INV_TGTIP) {
- 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP);
--		add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr) + fw->arp.arhln,
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr) + fw->arp.arhln,
- 			 &fw->arp.tgt.s_addr, &fw->arp.tmsk.s_addr,
- 			 sizeof(struct in_addr), op);
- 	}
-diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index dbf11eb5e1fa8..c1a2c209cc1aa 100644
---- a/iptables/nft-bridge.c
-+++ b/iptables/nft-bridge.c
-@@ -159,20 +159,16 @@ static int nft_bridge_add(struct nft_handle *h,
- 
- 	if (fw->bitmask & EBT_ISOURCE) {
- 		op = nft_invflags2cmp(fw->invflags, EBT_ISOURCE);
--		add_payload(r, offsetof(struct ethhdr, h_source), 6,
--			    NFT_PAYLOAD_LL_HEADER);
--		if (!mac_all_ones(fw->sourcemsk))
--			add_bitwise(r, fw->sourcemsk, 6);
--		add_cmp_ptr(r, op, fw->sourcemac, 6);
-+		add_addr(r, NFT_PAYLOAD_LL_HEADER,
-+			 offsetof(struct ethhdr, h_source),
-+			 fw->sourcemac, fw->sourcemsk, ETH_ALEN, op);
- 	}
- 
- 	if (fw->bitmask & EBT_IDEST) {
- 		op = nft_invflags2cmp(fw->invflags, EBT_IDEST);
--		add_payload(r, offsetof(struct ethhdr, h_dest), 6,
--			    NFT_PAYLOAD_LL_HEADER);
--		if (!mac_all_ones(fw->destmsk))
--			add_bitwise(r, fw->destmsk, 6);
--		add_cmp_ptr(r, op, fw->destmac, 6);
-+		add_addr(r, NFT_PAYLOAD_LL_HEADER,
-+			 offsetof(struct ethhdr, h_dest),
-+			 fw->destmac, fw->destmsk, ETH_ALEN, op);
- 	}
- 
- 	if ((fw->bitmask & EBT_NOPROTO) == 0) {
-@@ -258,7 +254,8 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
-                         memcpy(fw->destmsk, ctx->bitwise.mask, ETH_ALEN);
-                         ctx->flags &= ~NFT_XT_CTX_BITWISE;
-                 } else {
--                        memset(&fw->destmsk, 0xff, ETH_ALEN);
-+			memset(&fw->destmsk, 0xff,
-+			       min(ctx->payload.len, ETH_ALEN));
-                 }
- 		fw->bitmask |= EBT_IDEST;
- 		break;
-@@ -272,7 +269,8 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
-                         memcpy(fw->sourcemsk, ctx->bitwise.mask, ETH_ALEN);
-                         ctx->flags &= ~NFT_XT_CTX_BITWISE;
-                 } else {
--                        memset(&fw->sourcemsk, 0xff, ETH_ALEN);
-+			memset(&fw->sourcemsk, 0xff,
-+			       min(ctx->payload.len, ETH_ALEN));
-                 }
- 		fw->bitmask |= EBT_ISOURCE;
- 		break;
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index ce702041af0f4..fdc15c6f04066 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -50,13 +50,15 @@ static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 
- 	if (cs->fw.ip.src.s_addr || cs->fw.ip.smsk.s_addr || cs->fw.ip.invflags & IPT_INV_SRCIP) {
- 		op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_SRCIP);
--		add_addr(r, offsetof(struct iphdr, saddr),
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 offsetof(struct iphdr, saddr),
- 			 &cs->fw.ip.src.s_addr, &cs->fw.ip.smsk.s_addr,
- 			 sizeof(struct in_addr), op);
- 	}
- 	if (cs->fw.ip.dst.s_addr || cs->fw.ip.dmsk.s_addr || cs->fw.ip.invflags & IPT_INV_DSTIP) {
- 		op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_DSTIP);
--		add_addr(r, offsetof(struct iphdr, daddr),
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 offsetof(struct iphdr, daddr),
- 			 &cs->fw.ip.dst.s_addr, &cs->fw.ip.dmsk.s_addr,
- 			 sizeof(struct in_addr), op);
- 	}
-diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index c877ec6d10887..130ad3e6e7c44 100644
---- a/iptables/nft-ipv6.c
-+++ b/iptables/nft-ipv6.c
-@@ -51,7 +51,8 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	    !IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.smsk) ||
- 	    (cs->fw6.ipv6.invflags & IPT_INV_SRCIP)) {
- 		op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_SRCIP);
--		add_addr(r, offsetof(struct ip6_hdr, ip6_src),
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 offsetof(struct ip6_hdr, ip6_src),
- 			 &cs->fw6.ipv6.src, &cs->fw6.ipv6.smsk,
- 			 sizeof(struct in6_addr), op);
- 	}
-@@ -59,7 +60,8 @@ static int nft_ipv6_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	    !IN6_IS_ADDR_UNSPECIFIED(&cs->fw6.ipv6.dmsk) ||
- 	    (cs->fw6.ipv6.invflags & IPT_INV_DSTIP)) {
- 		op = nft_invflags2cmp(cs->fw6.ipv6.invflags, IPT_INV_DSTIP);
--		add_addr(r, offsetof(struct ip6_hdr, ip6_dst),
-+		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
-+			 offsetof(struct ip6_hdr, ip6_dst),
- 			 &cs->fw6.ipv6.dst, &cs->fw6.ipv6.dmsk,
- 			 sizeof(struct in6_addr), op);
- 	}
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 545e9c60fa015..10553ab26823b 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -20,7 +20,6 @@
- 
- #include <xtables.h>
- 
--#include <linux/netfilter/nf_tables.h>
- #include <linux/netfilter/xt_comment.h>
- #include <linux/netfilter/xt_limit.h>
- 
-@@ -162,7 +161,7 @@ void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op)
- 		add_cmp_ptr(r, op, iface, iface_len + 1);
- }
- 
--void add_addr(struct nftnl_rule *r, int offset,
-+void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
- 	      void *data, void *mask, size_t len, uint32_t op)
- {
- 	const unsigned char *m = mask;
-@@ -179,7 +178,7 @@ void add_addr(struct nftnl_rule *r, int offset,
- 	if (!bitwise)
- 		len = i;
- 
--	add_payload(r, offset, len, NFT_PAYLOAD_NETWORK_HEADER);
-+	add_payload(r, offset, len, base);
- 
- 	if (bitwise)
- 		add_bitwise(r, mask, len);
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 811fb9a1ebe76..6fc81d9ce08ef 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -8,6 +8,7 @@
- #include <libnftnl/chain.h>
- 
- #include <linux/netfilter_arp/arp_tables.h>
-+#include <linux/netfilter/nf_tables.h>
- 
- #include "xshared.h"
- 
-@@ -121,7 +122,7 @@ void add_cmp_u16(struct nftnl_rule *r, uint16_t val, uint32_t op);
- void add_cmp_u32(struct nftnl_rule *r, uint32_t val, uint32_t op);
- void add_iniface(struct nftnl_rule *r, char *iface, uint32_t op);
- void add_outiface(struct nftnl_rule *r, char *iface, uint32_t op);
--void add_addr(struct nftnl_rule *r, int offset,
-+void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
- 	      void *data, void *mask, size_t len, uint32_t op);
- void add_proto(struct nftnl_rule *r, int offset, size_t len,
- 	       uint8_t proto, uint32_t op);
--- 
-2.40.0
-

SOURCES/0022-tests-shell-Add-test-for-bitwise-avoidance-fixes.patch

@@ -1,365 +0,0 @@
-From f07a5fdd6c2a5ffe962ba77b8bfa08673f3b9408 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 10 Nov 2020 14:50:46 +0100
-Subject: [PATCH] tests/shell: Add test for bitwise avoidance fixes
-
-Masked address matching was recently improved to avoid bitwise
-expression if the given mask covers full bytes. Make use of nft netlink
-debug output to assert iptables-nft generates the right bytecode for
-each situation.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 81a2e128512837b53e5b9ea501b6c8dc64eeca78)
----
- .../nft-only/0009-needless-bitwise_0          | 339 ++++++++++++++++++
- 1 file changed, 339 insertions(+)
- create mode 100755 iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
-
-diff --git a/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0 b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
-new file mode 100755
-index 0000000000000..c5c6e706a1029
---- /dev/null
-+++ b/iptables/tests/shell/testcases/nft-only/0009-needless-bitwise_0
-@@ -0,0 +1,339 @@
-+#!/bin/bash -x
-+
-+[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }
-+set -e
-+
-+nft flush ruleset
-+
-+(
-+	echo "*filter"
-+	for plen in "" 32 30 24 16 8 0; do
-+		addr="10.1.2.3${plen:+/}$plen"
-+		echo "-A OUTPUT -d $addr"
-+	done
-+	echo "COMMIT"
-+) | $XT_MULTI iptables-restore
-+
-+(
-+	echo "*filter"
-+	for plen in "" 128 124 120 112 88 80 64 48 16 8 0; do
-+		addr="feed:c0ff:ee00:0102:0304:0506:0708:090A${plen:+/}$plen"
-+		echo "-A OUTPUT -d $addr"
-+	done
-+	echo "COMMIT"
-+) | $XT_MULTI ip6tables-restore
-+
-+masks="
-+ff:ff:ff:ff:ff:ff
-+ff:ff:ff:ff:ff:f0
-+ff:ff:ff:ff:ff:00
-+ff:ff:ff:ff:00:00
-+ff:ff:ff:00:00:00
-+ff:ff:00:00:00:00
-+ff:00:00:00:00:00
-+"
-+(
-+	echo "*filter"
-+	for plen in "" 32 30 24 16 8 0; do
-+		addr="10.1.2.3${plen:+/}$plen"
-+		echo "-A OUTPUT -d $addr"
-+	done
-+	for mask in $masks; do
-+		echo "-A OUTPUT --destination-mac fe:ed:00:c0:ff:ee/$mask"
-+	done
-+	echo "COMMIT"
-+) | $XT_MULTI arptables-restore
-+
-+(
-+	echo "*filter"
-+	for mask in $masks; do
-+		echo "-A OUTPUT -d fe:ed:00:c0:ff:ee/$mask"
-+	done
-+	echo "COMMIT"
-+) | $XT_MULTI ebtables-restore
-+
-+EXPECT="ip filter OUTPUT 4
-+  [ payload load 4b @ network header + 16 => reg 1 ]
-+  [ cmp eq reg 1 0x0302010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip filter OUTPUT 5 4
-+  [ payload load 4b @ network header + 16 => reg 1 ]
-+  [ cmp eq reg 1 0x0302010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip filter OUTPUT 6 5
-+  [ payload load 4b @ network header + 16 => reg 1 ]
-+  [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]
-+  [ cmp eq reg 1 0x0002010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip filter OUTPUT 7 6
-+  [ payload load 3b @ network header + 16 => reg 1 ]
-+  [ cmp eq reg 1 0x0002010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip filter OUTPUT 8 7
-+  [ payload load 2b @ network header + 16 => reg 1 ]
-+  [ cmp eq reg 1 0x0000010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip filter OUTPUT 9 8
-+  [ payload load 1b @ network header + 16 => reg 1 ]
-+  [ cmp eq reg 1 0x0000000a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip filter OUTPUT 10 9
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 4
-+  [ payload load 16b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x0a090807 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 5 4
-+  [ payload load 16b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x0a090807 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 6 5
-+  [ payload load 16b @ network header + 24 => reg 1 ]
-+  [ bitwise reg 1 = (reg=1 & 0xffffffff 0xffffffff 0xffffffff 0xf0ffffff ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 7 6
-+  [ payload load 15b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 8 7
-+  [ payload load 14b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00000807 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 9 8
-+  [ payload load 11b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x00050403 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 10 9
-+  [ payload load 10b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x00000403 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 11 10
-+  [ payload load 8b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x020100ee ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 12 11
-+  [ payload load 6b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0xffc0edfe 0x000000ee ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 13 12
-+  [ payload load 2b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x0000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 14 13
-+  [ payload load 1b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x000000fe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+ip6 filter OUTPUT 15 14
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 3
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 4b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x0302010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 4 3
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 4b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x0302010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 5 4
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 4b @ network header + 24 => reg 1 ]
-+  [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]
-+  [ cmp eq reg 1 0x0002010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 6 5
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 3b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x0002010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 7 6
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 2b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x0000010a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 8 7
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 1b @ network header + 24 => reg 1 ]
-+  [ cmp eq reg 1 0x0000000a ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 9 8
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 10 9
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 6b @ network header + 18 => reg 1 ]
-+  [ cmp eq reg 1 0xc000edfe 0x0000eeff ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 11 10
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 6b @ network header + 18 => reg 1 ]
-+  [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
-+  [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 12 11
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 5b @ network header + 18 => reg 1 ]
-+  [ cmp eq reg 1 0xc000edfe 0x000000ff ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 13 12
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 4b @ network header + 18 => reg 1 ]
-+  [ cmp eq reg 1 0xc000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 14 13
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 3b @ network header + 18 => reg 1 ]
-+  [ cmp eq reg 1 0x0000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 15 14
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 2b @ network header + 18 => reg 1 ]
-+  [ cmp eq reg 1 0x0000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+arp filter OUTPUT 16 15
-+  [ payload load 2b @ network header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000100 ]
-+  [ payload load 1b @ network header + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ payload load 1b @ network header + 5 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+  [ payload load 1b @ network header + 18 => reg 1 ]
-+  [ cmp eq reg 1 0x000000fe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 4
-+  [ payload load 6b @ link header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0xc000edfe 0x0000eeff ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 5 4
-+  [ payload load 6b @ link header + 0 => reg 1 ]
-+  [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]
-+  [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 6 5
-+  [ payload load 5b @ link header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0xc000edfe 0x000000ff ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 7 6
-+  [ payload load 4b @ link header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0xc000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 8 7
-+  [ payload load 3b @ link header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x0000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 9 8
-+  [ payload load 2b @ link header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x0000edfe ]
-+  [ counter pkts 0 bytes 0 ]
-+
-+bridge filter OUTPUT 10 9
-+  [ payload load 1b @ link header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x000000fe ]
-+  [ counter pkts 0 bytes 0 ]
-+"
-+
-+diff -u -Z <(echo "$EXPECT") <(nft --debug=netlink list ruleset | awk '/^table/{exit} {print}')
--- 
-2.40.0
-

SOURCES/0023-ebtables-Fix-for-broken-chain-renaming.patch

@@ -1,61 +0,0 @@
-From d4e535422a9f4908b6d4b331b9e9cffe7ef161f3 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 17 Nov 2020 11:38:27 +0100
-Subject: [PATCH] ebtables: Fix for broken chain renaming
-
-Loading extensions pollutes 'errno' value, hence before using it to
-indicate failure it should be sanitized. This was done by the called
-function before the parsing/netlink split and not migrated by accident.
-Move it into calling code to clarify the connection.
-
-Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 55b7c71dce7144f4dc0297c17abf0f04879ee247)
----
- iptables/nft.c                                                | 3 ---
- iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 | 4 ++++
- iptables/xtables-eb.c                                         | 1 +
- 3 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index bdb633a82a655..bdf252198f155 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -1932,9 +1932,6 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
- 		return 0;
- 	}
- 
--	/* Config load changed errno. Ensure genuine info for our callers. */
--	errno = 0;
--
- 	/* Find the old chain to be renamed */
- 	c = nft_chain_find(h, table, chain);
- 	if (c == NULL) {
-diff --git a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0 b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-index 0c1eb4ca66f52..6f11bd12593dd 100755
---- a/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-+++ b/iptables/tests/shell/testcases/ebtables/0001-ebtables-basic_0
-@@ -86,4 +86,8 @@ if [ $? -eq 0 ]; then
- 	exit 1
- fi
- 
-+$XT_MULTI ebtables -t filter -E FOO BAZ || exit 1
-+$XT_MULTI ebtables -t filter -L | grep -q FOO && exit 1
-+$XT_MULTI ebtables -t filter -L | grep -q BAZ || exit 1
-+
- $XT_MULTI ebtables -t $t -F || exit 0
-diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index 375a95d1d5c75..6df5839f07436 100644
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -853,6 +853,7 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
- 				else if (strchr(argv[optind], ' ') != NULL)
- 					xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
- 
-+				errno = 0;
- 				ret = nft_cmd_chain_user_rename(h, chain, *table,
- 							    argv[optind]);
- 				if (ret != 0 && errno == ENOENT)
--- 
-2.40.0
-

SOURCES/0024-xtables-arp-Don-t-use-ARPT_INV_.patch

@@ -1,374 +0,0 @@
-From 38e8df1b4409387145c79fc358419d59b5ec3800 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 3 Nov 2020 12:21:29 +0100
-Subject: [PATCH] xtables-arp: Don't use ARPT_INV_*
-
-Arptables invflags are partly identical to IPT_INV_* ones but the bits
-are differently assigned. Eliminate this incompatibility by definition
-of the unique invflags in nft-arp.h on bits that don't collide with
-IPT_INV_* ones, then use those in combination with IPT_INV_* ones in
-arptables-specific code.
-
-Note that ARPT_INV_ARPPRO is replaced by IPT_INV_PROTO although these
-are in fact different options - yet since '-p' option is not supported
-by arptables, this does not lead to a collision.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 44457c0805905ea22b4ecf9156648e774dd29155)
----
- iptables/nft-arp.c     | 92 ++++++++++++++++--------------------------
- iptables/nft-arp.h     |  7 ++++
- iptables/xtables-arp.c | 22 +++++-----
- 3 files changed, 53 insertions(+), 68 deletions(-)
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 5dc38da831aa0..c82ffdc95e300 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -134,34 +134,34 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	int ret = 0;
- 
- 	if (fw->arp.iniface[0] != '\0') {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_IN);
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_IN);
- 		add_iniface(r, fw->arp.iniface, op);
- 	}
- 
- 	if (fw->arp.outiface[0] != '\0') {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_OUT);
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_VIA_OUT);
- 		add_outiface(r, fw->arp.outiface, op);
- 	}
- 
- 	if (fw->arp.arhrd != 0 ||
--	    fw->arp.invflags & ARPT_INV_ARPHRD) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHRD);
-+	    fw->arp.invflags & IPT_INV_ARPHRD) {
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_ARPHRD);
- 		add_payload(r, offsetof(struct arphdr, ar_hrd), 2,
- 			    NFT_PAYLOAD_NETWORK_HEADER);
- 		add_cmp_u16(r, fw->arp.arhrd, op);
- 	}
- 
- 	if (fw->arp.arpro != 0 ||
--	    fw->arp.invflags & ARPT_INV_ARPPRO) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPPRO);
-+	    fw->arp.invflags & IPT_INV_PROTO) {
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_PROTO);
- 	        add_payload(r, offsetof(struct arphdr, ar_pro), 2,
- 			    NFT_PAYLOAD_NETWORK_HEADER);
- 		add_cmp_u16(r, fw->arp.arpro, op);
- 	}
- 
- 	if (fw->arp.arhln != 0 ||
--	    fw->arp.invflags & ARPT_INV_ARPHLN) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHLN);
-+	    fw->arp.invflags & IPT_INV_ARPHLN) {
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_ARPHLN);
- 		add_proto(r, offsetof(struct arphdr, ar_hln), 1,
- 			  fw->arp.arhln, op);
- 	}
-@@ -169,15 +169,15 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	add_proto(r, offsetof(struct arphdr, ar_pln), 1, 4, NFT_CMP_EQ);
- 
- 	if (fw->arp.arpop != 0 ||
--	    fw->arp.invflags & ARPT_INV_ARPOP) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPOP);
-+	    fw->arp.invflags & IPT_INV_ARPOP) {
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_ARPOP);
- 		add_payload(r, offsetof(struct arphdr, ar_op), 2,
- 			    NFT_PAYLOAD_NETWORK_HEADER);
- 		add_cmp_u16(r, fw->arp.arpop, op);
- 	}
- 
- 	if (need_devaddr(&fw->arp.src_devaddr)) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCDEVADDR);
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_SRCDEVADDR);
- 		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
- 			 sizeof(struct arphdr),
- 			 &fw->arp.src_devaddr.addr,
-@@ -188,8 +188,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 
- 	if (fw->arp.src.s_addr != 0 ||
- 	    fw->arp.smsk.s_addr != 0 ||
--	    fw->arp.invflags & ARPT_INV_SRCIP) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCIP);
-+	    fw->arp.invflags & IPT_INV_SRCIP) {
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_SRCIP);
- 		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
- 			 sizeof(struct arphdr) + fw->arp.arhln,
- 			 &fw->arp.src.s_addr, &fw->arp.smsk.s_addr,
-@@ -198,7 +198,7 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 
- 
- 	if (need_devaddr(&fw->arp.tgt_devaddr)) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTDEVADDR);
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_TGTDEVADDR);
- 		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
- 			 sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
- 			 &fw->arp.tgt_devaddr.addr,
-@@ -208,8 +208,8 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 
- 	if (fw->arp.tgt.s_addr != 0 ||
- 	    fw->arp.tmsk.s_addr != 0 ||
--	    fw->arp.invflags & ARPT_INV_TGTIP) {
--		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP);
-+	    fw->arp.invflags & IPT_INV_DSTIP) {
-+		op = nft_invflags2cmp(fw->arp.invflags, IPT_INV_DSTIP);
- 		add_addr(r, NFT_PAYLOAD_NETWORK_HEADER,
- 			 sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr) + fw->arp.arhln,
- 			 &fw->arp.tgt.s_addr, &fw->arp.tmsk.s_addr,
-@@ -240,28 +240,6 @@ static int nft_arp_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
- 	return ret;
- }
- 
--static uint16_t ipt_to_arpt_flags(uint8_t invflags)
--{
--	uint16_t result = 0;
--
--	if (invflags & IPT_INV_VIA_IN)
--		result |= ARPT_INV_VIA_IN;
--
--	if (invflags & IPT_INV_VIA_OUT)
--		result |= ARPT_INV_VIA_OUT;
--
--	if (invflags & IPT_INV_SRCIP)
--		result |= ARPT_INV_SRCIP;
--
--	if (invflags & IPT_INV_DSTIP)
--		result |= ARPT_INV_TGTIP;
--
--	if (invflags & IPT_INV_PROTO)
--		result |= ARPT_INV_ARPPRO;
--
--	return result;
--}
--
- static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
- 			       void *data)
- {
-@@ -273,7 +251,7 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
- 		   fw->arp.outiface, fw->arp.outiface_mask,
- 		   &flags);
- 
--	fw->arp.invflags |= ipt_to_arpt_flags(flags);
-+	fw->arp.invflags |= flags;
- }
- 
- static void nft_arp_parse_immediate(const char *jumpto, bool nft_goto,
-@@ -330,33 +308,33 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
- 		fw->arp.arhrd = ar_hrd;
- 		fw->arp.arhrd_mask = 0xffff;
- 		if (inv)
--			fw->arp.invflags |= ARPT_INV_ARPHRD;
-+			fw->arp.invflags |= IPT_INV_ARPHRD;
- 		break;
- 	case offsetof(struct arphdr, ar_pro):
- 		get_cmp_data(e, &ar_pro, sizeof(ar_pro), &inv);
- 		fw->arp.arpro = ar_pro;
- 		fw->arp.arpro_mask = 0xffff;
- 		if (inv)
--			fw->arp.invflags |= ARPT_INV_ARPPRO;
-+			fw->arp.invflags |= IPT_INV_PROTO;
- 		break;
- 	case offsetof(struct arphdr, ar_op):
- 		get_cmp_data(e, &ar_op, sizeof(ar_op), &inv);
- 		fw->arp.arpop = ar_op;
- 		fw->arp.arpop_mask = 0xffff;
- 		if (inv)
--			fw->arp.invflags |= ARPT_INV_ARPOP;
-+			fw->arp.invflags |= IPT_INV_ARPOP;
- 		break;
- 	case offsetof(struct arphdr, ar_hln):
- 		get_cmp_data(e, &ar_hln, sizeof(ar_hln), &inv);
- 		fw->arp.arhln = ar_hln;
- 		fw->arp.arhln_mask = 0xff;
- 		if (inv)
--			fw->arp.invflags |= ARPT_INV_ARPOP;
-+			fw->arp.invflags |= IPT_INV_ARPOP;
- 		break;
- 	default:
- 		if (ctx->payload.offset == sizeof(struct arphdr)) {
- 			if (nft_arp_parse_devaddr(ctx, e, &fw->arp.src_devaddr))
--				fw->arp.invflags |= ARPT_INV_SRCDEVADDR;
-+				fw->arp.invflags |= IPT_INV_SRCDEVADDR;
- 		} else if (ctx->payload.offset == sizeof(struct arphdr) +
- 					   fw->arp.arhln) {
- 			get_cmp_data(e, &addr, sizeof(addr), &inv);
-@@ -371,12 +349,12 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
- 			}
- 
- 			if (inv)
--				fw->arp.invflags |= ARPT_INV_SRCIP;
-+				fw->arp.invflags |= IPT_INV_SRCIP;
- 		} else if (ctx->payload.offset == sizeof(struct arphdr) +
- 						  fw->arp.arhln +
- 						  sizeof(struct in_addr)) {
- 			if (nft_arp_parse_devaddr(ctx, e, &fw->arp.tgt_devaddr))
--				fw->arp.invflags |= ARPT_INV_TGTDEVADDR;
-+				fw->arp.invflags |= IPT_INV_TGTDEVADDR;
- 		} else if (ctx->payload.offset == sizeof(struct arphdr) +
- 						  fw->arp.arhln +
- 						  sizeof(struct in_addr) +
-@@ -393,7 +371,7 @@ static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
- 			}
- 
- 			if (inv)
--				fw->arp.invflags |= ARPT_INV_TGTIP;
-+				fw->arp.invflags |= IPT_INV_DSTIP;
- 		}
- 		break;
- 	}
-@@ -448,7 +426,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 		else strcat(iface, "any");
- 	}
- 	if (print_iface) {
--		printf("%s%s-i %s", sep, fw->arp.invflags & ARPT_INV_VIA_IN ?
-+		printf("%s%s-i %s", sep, fw->arp.invflags & IPT_INV_VIA_IN ?
- 				   "! " : "", iface);
- 		sep = " ";
- 	}
-@@ -466,13 +444,13 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 		else strcat(iface, "any");
- 	}
- 	if (print_iface) {
--		printf("%s%s-o %s", sep, fw->arp.invflags & ARPT_INV_VIA_OUT ?
-+		printf("%s%s-o %s", sep, fw->arp.invflags & IPT_INV_VIA_OUT ?
- 				   "! " : "", iface);
- 		sep = " ";
- 	}
- 
- 	if (fw->arp.smsk.s_addr != 0L) {
--		printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCIP
-+		printf("%s%s", sep, fw->arp.invflags & IPT_INV_SRCIP
- 			? "! " : "");
- 		if (format & FMT_NUMERIC)
- 			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
-@@ -489,7 +467,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 			break;
- 	if (i == ARPT_DEV_ADDR_LEN_MAX)
- 		goto after_devsrc;
--	printf("%s%s", sep, fw->arp.invflags & ARPT_INV_SRCDEVADDR
-+	printf("%s%s", sep, fw->arp.invflags & IPT_INV_SRCDEVADDR
- 		? "! " : "");
- 	printf("--src-mac ");
- 	xtables_print_mac_and_mask((unsigned char *)fw->arp.src_devaddr.addr,
-@@ -498,7 +476,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- after_devsrc:
- 
- 	if (fw->arp.tmsk.s_addr != 0L) {
--		printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTIP
-+		printf("%s%s", sep, fw->arp.invflags & IPT_INV_DSTIP
- 			? "! " : "");
- 		if (format & FMT_NUMERIC)
- 			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
-@@ -515,7 +493,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 			break;
- 	if (i == ARPT_DEV_ADDR_LEN_MAX)
- 		goto after_devdst;
--	printf("%s%s", sep, fw->arp.invflags & ARPT_INV_TGTDEVADDR
-+	printf("%s%s", sep, fw->arp.invflags & IPT_INV_TGTDEVADDR
- 		? "! " : "");
- 	printf("--dst-mac ");
- 	xtables_print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
-@@ -525,7 +503,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- after_devdst:
- 
- 	if (fw->arp.arhln_mask != 255 || fw->arp.arhln != 6) {
--		printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHLN
-+		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHLN
- 			? "! " : "");
- 		printf("--h-length %d", fw->arp.arhln);
- 		if (fw->arp.arhln_mask != 255)
-@@ -536,7 +514,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 	if (fw->arp.arpop_mask != 0) {
- 		int tmp = ntohs(fw->arp.arpop);
- 
--		printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPOP
-+		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPOP
- 			? "! " : "");
- 		if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
- 			printf("--opcode %s", arp_opcodes[tmp-1]);
-@@ -551,7 +529,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 	if (fw->arp.arhrd_mask != 65535 || fw->arp.arhrd != htons(1)) {
- 		uint16_t tmp = ntohs(fw->arp.arhrd);
- 
--		printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPHRD
-+		printf("%s%s", sep, fw->arp.invflags & IPT_INV_ARPHRD
- 			? "! " : "");
- 		if (tmp == 1 && !(format & FMT_NUMERIC))
- 			printf("--h-type %s", "Ethernet");
-@@ -565,7 +543,7 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 	if (fw->arp.arpro_mask != 0) {
- 		int tmp = ntohs(fw->arp.arpro);
- 
--		printf("%s%s", sep, fw->arp.invflags & ARPT_INV_ARPPRO
-+		printf("%s%s", sep, fw->arp.invflags & IPT_INV_PROTO
- 			? "! " : "");
- 		if (tmp == 0x0800 && !(format & FMT_NUMERIC))
- 			printf("--proto-type %s", "IPv4");
-diff --git a/iptables/nft-arp.h b/iptables/nft-arp.h
-index 3411fc3d7c7b3..0d93a31f563b1 100644
---- a/iptables/nft-arp.h
-+++ b/iptables/nft-arp.h
-@@ -4,4 +4,11 @@
- extern char *arp_opcodes[];
- #define NUMOPCODES 9
- 
-+/* define invflags which won't collide with IPT ones */
-+#define IPT_INV_SRCDEVADDR	0x0080
-+#define IPT_INV_TGTDEVADDR	0x0100
-+#define IPT_INV_ARPHLN		0x0200
-+#define IPT_INV_ARPOP		0x0400
-+#define IPT_INV_ARPHRD		0x0800
-+
- #endif
-diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
-index 8632774dfb705..3a35dcd107e19 100644
---- a/iptables/xtables-arp.c
-+++ b/iptables/xtables-arp.c
-@@ -113,22 +113,22 @@ struct xtables_globals arptables_globals = {
- static int inverse_for_options[] =
- {
- /* -n */ 0,
--/* -s */ ARPT_INV_SRCIP,
--/* -d */ ARPT_INV_TGTIP,
-+/* -s */ IPT_INV_SRCIP,
-+/* -d */ IPT_INV_DSTIP,
- /* -p */ 0,
- /* -j */ 0,
- /* -v */ 0,
- /* -x */ 0,
--/* -i */ ARPT_INV_VIA_IN,
--/* -o */ ARPT_INV_VIA_OUT,
-+/* -i */ IPT_INV_VIA_IN,
-+/* -o */ IPT_INV_VIA_OUT,
- /*--line*/ 0,
- /* -c */ 0,
--/* 2 */ ARPT_INV_SRCDEVADDR,
--/* 3 */ ARPT_INV_TGTDEVADDR,
--/* -l */ ARPT_INV_ARPHLN,
--/* 4 */ ARPT_INV_ARPOP,
--/* 5 */ ARPT_INV_ARPHRD,
--/* 6 */ ARPT_INV_ARPPRO,
-+/* 2 */ IPT_INV_SRCDEVADDR,
-+/* 3 */ IPT_INV_TGTDEVADDR,
-+/* -l */ IPT_INV_ARPHLN,
-+/* 4 */ IPT_INV_ARPOP,
-+/* 5 */ IPT_INV_ARPHRD,
-+/* 6 */ IPT_INV_PROTO,
- };
- 
- /***********************************************/
-@@ -901,7 +901,7 @@ int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
- 					 &dmasks, &ndaddrs);
- 
- 	if ((nsaddrs > 1 || ndaddrs > 1) &&
--	    (cs.arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP)))
-+	    (cs.arp.arp.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP)))
- 		xtables_error(PARAMETER_PROBLEM, "! not allowed with multiple"
- 				" source or destination IP addresses");
- 
--- 
-2.40.0
-

SOURCES/0025-xshared-Merge-some-command-option-related-code.patch

@@ -1,517 +0,0 @@
-From 003b063b1b40503bc996a4f88c1941c91a0c550b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 30 Oct 2020 12:42:57 +0100
-Subject: [PATCH] xshared: Merge some command option-related code
-
-Add OPT_FRAGMENT define into the enum of other OPT_* defines at the
-right position and adjust the arptables-specific ones that follow
-accordingly. Appropriately adjust inverse_for_options array in
-xtables-arp.c.
-
-Extend optflags from iptables.c by the arptables values for the sake of
-completeness, then move it to xshared.h along with NUMBER_OF_OPT
-definition. As a side-effect, this fixes for wrong ordering of entries
-in arptables' 'optflags' copy.
-
-Add arptables-specific bits to commands_v_options table (the speicific
-options are matches on ARP header fields, just treat them like '-s'
-option. This is also just a cosmetic change, arptables doesn't have a
-generic_opt_check() implementation and hence doesn't use such a table.
-
-With things potentially ready for common use, move commands_v_options
-table along with generic_opt_check() and opt2char() into xshared.c and
-drop the local (identical) implementations from iptables.c, ip6tables.c
-xtables.c and xtables-arp.c. While doing so, fix ordering of entries in
-that table: the row for CMD_ZERO_NUM was in the wrong position. Since
-all moved rows though are identical, this had no effect in practice.
-
-Fixes: d960a991350ca ("xtables-arp: Integrate OPT_* defines into xshared.h")
-Fixes: 384958620abab ("use nf_tables and nf_tables compatibility interface")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 8bd4b4f79b5de483353a8c0d0962e71934b7bdd2)
----
- iptables/ip6tables.c   | 79 -----------------------------------------
- iptables/iptables.c    | 80 ------------------------------------------
- iptables/xshared.c     | 74 ++++++++++++++++++++++++++++++++++++++
- iptables/xshared.h     | 20 +++++++----
- iptables/xtables-arp.c | 14 +-------
- iptables/xtables.c     | 80 ------------------------------------------
- 6 files changed, 89 insertions(+), 258 deletions(-)
-
-diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index 576c2cf8b0d9f..c95355b091568 100644
---- a/iptables/ip6tables.c
-+++ b/iptables/ip6tables.c
-@@ -45,10 +45,6 @@
- #include "ip6tables-multi.h"
- #include "xshared.h"
- 
--#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
--static const char optflags[]
--= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c'};
--
- static const char unsupported_rev[] = " [unsupported revision]";
- 
- static struct option original_opts[] = {
-@@ -100,36 +96,6 @@ struct xtables_globals ip6tables_globals = {
- 	.compat_rev = xtables_compatible_revision,
- };
- 
--/* Table of legal combinations of commands and options.  If any of the
-- * given commands make an option legal, that option is legal (applies to
-- * CMD_LIST and CMD_ZERO only).
-- * Key:
-- *  +  compulsory
-- *  x  illegal
-- *     optional
-- */
--
--static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
--/* Well, it's better than "Re: Linux vs FreeBSD" */
--{
--	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c */
--/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
--/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
--/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x'},
--/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
--/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
--/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x'},
--/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x'},
--/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x'},
--/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
--/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
--/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' '},
--/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x'},
--/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x'},
--/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x'},
--/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
--};
--
- static const unsigned int inverse_for_options[NUMBER_OF_OPT] =
- {
- /* -n */ 0,
-@@ -264,51 +230,6 @@ ip6tables_exit_error(enum xtables_exittype status, const char *msg, ...)
- 	exit(status);
- }
- 
--static void
--generic_opt_check(int command, int options)
--{
--	int i, j, legal = 0;
--
--	/* Check that commands are valid with options.  Complicated by the
--	 * fact that if an option is legal with *any* command given, it is
--	 * legal overall (ie. -z and -l).
--	 */
--	for (i = 0; i < NUMBER_OF_OPT; i++) {
--		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
--
--		for (j = 0; j < NUMBER_OF_CMD; j++) {
--			if (!(command & (1<<j)))
--				continue;
--
--			if (!(options & (1<<i))) {
--				if (commands_v_options[j][i] == '+')
--					xtables_error(PARAMETER_PROBLEM,
--						   "You need to supply the `-%c' "
--						   "option for this command\n",
--						   optflags[i]);
--			} else {
--				if (commands_v_options[j][i] != 'x')
--					legal = 1;
--				else if (legal == 0)
--					legal = -1;
--			}
--		}
--		if (legal == -1)
--			xtables_error(PARAMETER_PROBLEM,
--				   "Illegal option `-%c' with this command\n",
--				   optflags[i]);
--	}
--}
--
--static char
--opt2char(int option)
--{
--	const char *ptr;
--	for (ptr = optflags; option > 1; option >>= 1, ptr++);
--
--	return *ptr;
--}
--
- /*
-  *	All functions starting with "parse" should succeed, otherwise
-  *	the program fails.
-diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 88ef6cf666d4b..7d6183116d265 100644
---- a/iptables/iptables.c
-+++ b/iptables/iptables.c
-@@ -41,11 +41,6 @@
- #include <fcntl.h>
- #include "xshared.h"
- 
--#define OPT_FRAGMENT    0x00800U
--#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
--static const char optflags[]
--= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};
--
- static const char unsupported_rev[] = " [unsupported revision]";
- 
- static struct option original_opts[] = {
-@@ -99,36 +94,6 @@ struct xtables_globals iptables_globals = {
- 	.compat_rev = xtables_compatible_revision,
- };
- 
--/* Table of legal combinations of commands and options.  If any of the
-- * given commands make an option legal, that option is legal (applies to
-- * CMD_LIST and CMD_ZERO only).
-- * Key:
-- *  +  compulsory
-- *  x  illegal
-- *     optional
-- */
--
--static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
--/* Well, it's better than "Re: Linux vs FreeBSD" */
--{
--	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f */
--/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
--/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
--/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
--/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
--/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},
--/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},
--/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
--};
--
- static const int inverse_for_options[NUMBER_OF_OPT] =
- {
- /* -n */ 0,
-@@ -263,51 +228,6 @@ iptables_exit_error(enum xtables_exittype status, const char *msg, ...)
- 	exit(status);
- }
- 
--static void
--generic_opt_check(int command, int options)
--{
--	int i, j, legal = 0;
--
--	/* Check that commands are valid with options.  Complicated by the
--	 * fact that if an option is legal with *any* command given, it is
--	 * legal overall (ie. -z and -l).
--	 */
--	for (i = 0; i < NUMBER_OF_OPT; i++) {
--		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
--
--		for (j = 0; j < NUMBER_OF_CMD; j++) {
--			if (!(command & (1<<j)))
--				continue;
--
--			if (!(options & (1<<i))) {
--				if (commands_v_options[j][i] == '+')
--					xtables_error(PARAMETER_PROBLEM,
--						   "You need to supply the `-%c' "
--						   "option for this command\n",
--						   optflags[i]);
--			} else {
--				if (commands_v_options[j][i] != 'x')
--					legal = 1;
--				else if (legal == 0)
--					legal = -1;
--			}
--		}
--		if (legal == -1)
--			xtables_error(PARAMETER_PROBLEM,
--				   "Illegal option `-%c' with this command\n",
--				   optflags[i]);
--	}
--}
--
--static char
--opt2char(int option)
--{
--	const char *ptr;
--	for (ptr = optflags; option > 1; option >>= 1, ptr++);
--
--	return *ptr;
--}
--
- /*
-  *	All functions starting with "parse" should succeed, otherwise
-  *	the program fails.
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index c1d1371a6d54a..fe37c30a085d6 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -774,3 +774,77 @@ int parse_rulenumber(const char *rule)
- 
- 	return rulenum;
- }
-+
-+/* Table of legal combinations of commands and options.  If any of the
-+ * given commands make an option legal, that option is legal (applies to
-+ * CMD_LIST and CMD_ZERO only).
-+ * Key:
-+ *  +  compulsory
-+ *  x  illegal
-+ *     optional
-+ */
-+static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
-+/* Well, it's better than "Re: Linux vs FreeBSD" */
-+{
-+	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f 2 3 l 4 5 6 */
-+/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
-+/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' ',' ',' ',' ',' ',' ',' '},
-+/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
-+/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' ',' ',' ',' ',' ',' ',' '},
-+/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x','x','x','x','x','x','x'},
-+/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x','x','x','x','x','x','x'},
-+/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x','x','x','x','x','x','x'},
-+/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' ',' ',' ',' ',' ',' ',' '},
-+};
-+
-+void generic_opt_check(int command, int options)
-+{
-+	int i, j, legal = 0;
-+
-+	/* Check that commands are valid with options. Complicated by the
-+	 * fact that if an option is legal with *any* command given, it is
-+	 * legal overall (ie. -z and -l).
-+	 */
-+	for (i = 0; i < NUMBER_OF_OPT; i++) {
-+		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
-+
-+		for (j = 0; j < NUMBER_OF_CMD; j++) {
-+			if (!(command & (1<<j)))
-+				continue;
-+
-+			if (!(options & (1<<i))) {
-+				if (commands_v_options[j][i] == '+')
-+					xtables_error(PARAMETER_PROBLEM,
-+						   "You need to supply the `-%c' "
-+						   "option for this command\n",
-+						   optflags[i]);
-+			} else {
-+				if (commands_v_options[j][i] != 'x')
-+					legal = 1;
-+				else if (legal == 0)
-+					legal = -1;
-+			}
-+		}
-+		if (legal == -1)
-+			xtables_error(PARAMETER_PROBLEM,
-+				   "Illegal option `-%c' with this command\n",
-+				   optflags[i]);
-+	}
-+}
-+
-+char opt2char(int option)
-+{
-+	const char *ptr;
-+
-+	for (ptr = optflags; option > 1; option >>= 1, ptr++)
-+		;
-+
-+	return *ptr;
-+}
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index c41bd054bf36f..9159b2b1f3768 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -30,15 +30,20 @@ enum {
- 	OPT_VIANAMEOUT  = 1 << 8,
- 	OPT_LINENUMBERS = 1 << 9,
- 	OPT_COUNTERS    = 1 << 10,
-+	OPT_FRAGMENT	= 1 << 11,
- 	/* below are for arptables only */
--	OPT_S_MAC	= 1 << 11,
--	OPT_D_MAC	= 1 << 12,
--	OPT_H_LENGTH	= 1 << 13,
--	OPT_OPCODE	= 1 << 14,
--	OPT_H_TYPE	= 1 << 15,
--	OPT_P_TYPE	= 1 << 16,
-+	OPT_S_MAC	= 1 << 12,
-+	OPT_D_MAC	= 1 << 13,
-+	OPT_H_LENGTH	= 1 << 14,
-+	OPT_OPCODE	= 1 << 15,
-+	OPT_H_TYPE	= 1 << 16,
-+	OPT_P_TYPE	= 1 << 17,
- };
- 
-+#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
-+static const char optflags[]
-+= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f', 2, 3, 'l', 4, 5, 6 };
-+
- enum {
- 	CMD_NONE		= 0,
- 	CMD_INSERT		= 1 << 0,
-@@ -216,4 +221,7 @@ void add_command(unsigned int *cmd, const int newcmd,
- 		 const int othercmds, int invert);
- int parse_rulenumber(const char *rule);
- 
-+void generic_opt_check(int command, int options);
-+char opt2char(int option);
-+
- #endif /* IPTABLES_XSHARED_H */
-diff --git a/iptables/xtables-arp.c b/iptables/xtables-arp.c
-index 3a35dcd107e19..0695504892b74 100644
---- a/iptables/xtables-arp.c
-+++ b/iptables/xtables-arp.c
-@@ -53,10 +53,6 @@
- #include "nft-arp.h"
- #include <linux/netfilter_arp/arp_tables.h>
- 
--#define NUMBER_OF_OPT	16
--static const char optflags[NUMBER_OF_OPT]
--= { 'n', 's', 'd', 2, 3, 7, 8, 4, 5, 6, 'j', 'v', 'i', 'o', '0', 'c'};
--
- static struct option original_opts[] = {
- 	{ "append", 1, 0, 'A' },
- 	{ "delete", 1, 0,  'D' },
-@@ -123,6 +119,7 @@ static int inverse_for_options[] =
- /* -o */ IPT_INV_VIA_OUT,
- /*--line*/ 0,
- /* -c */ 0,
-+/* -f */ 0,
- /* 2 */ IPT_INV_SRCDEVADDR,
- /* 3 */ IPT_INV_TGTDEVADDR,
- /* -l */ IPT_INV_ARPHLN,
-@@ -327,15 +324,6 @@ printhelp(void)
- 	}
- }
- 
--static char
--opt2char(int option)
--{
--	const char *ptr;
--	for (ptr = optflags; option > 1; option >>= 1, ptr++);
--
--	return *ptr;
--}
--
- static int
- check_inverse(const char option[], int *invert, int *optidx, int argc)
- {
-diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 9d2e441e0b773..9779bd83d53b3 100644
---- a/iptables/xtables.c
-+++ b/iptables/xtables.c
-@@ -43,11 +43,6 @@
- #include "nft-shared.h"
- #include "nft.h"
- 
--#define OPT_FRAGMENT	0x00800U
--#define NUMBER_OF_OPT	ARRAY_SIZE(optflags)
--static const char optflags[]
--= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'};
--
- static struct option original_opts[] = {
- 	{.name = "append",	  .has_arg = 1, .val = 'A'},
- 	{.name = "delete",	  .has_arg = 1, .val = 'D'},
-@@ -99,36 +94,6 @@ struct xtables_globals xtables_globals = {
- 	.compat_rev = nft_compatible_revision,
- };
- 
--/* Table of legal combinations of commands and options.  If any of the
-- * given commands make an option legal, that option is legal (applies to
-- * CMD_LIST and CMD_ZERO only).
-- * Key:
-- *  +  compulsory
-- *  x  illegal
-- *     optional
-- */
--
--static const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
--/* Well, it's better than "Re: Linux vs FreeBSD" */
--{
--	/*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c -f */
--/*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
--/*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
--/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
--/*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '},
--/*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x','x'},
--/*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'},
--/*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'},
--/*CHECK*/     {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '},
--};
--
- static const int inverse_for_options[NUMBER_OF_OPT] =
- {
- /* -n */ 0,
-@@ -262,51 +227,6 @@ xtables_exit_error(enum xtables_exittype status, const char *msg, ...)
- 	exit(status);
- }
- 
--static void
--generic_opt_check(int command, int options)
--{
--	int i, j, legal = 0;
--
--	/* Check that commands are valid with options.	Complicated by the
--	 * fact that if an option is legal with *any* command given, it is
--	 * legal overall (ie. -z and -l).
--	 */
--	for (i = 0; i < NUMBER_OF_OPT; i++) {
--		legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
--
--		for (j = 0; j < NUMBER_OF_CMD; j++) {
--			if (!(command & (1<<j)))
--				continue;
--
--			if (!(options & (1<<i))) {
--				if (commands_v_options[j][i] == '+')
--					xtables_error(PARAMETER_PROBLEM,
--						   "You need to supply the `-%c' "
--						   "option for this command\n",
--						   optflags[i]);
--			} else {
--				if (commands_v_options[j][i] != 'x')
--					legal = 1;
--				else if (legal == 0)
--					legal = -1;
--			}
--		}
--		if (legal == -1)
--			xtables_error(PARAMETER_PROBLEM,
--				   "Illegal option `-%c' with this command\n",
--				   optflags[i]);
--	}
--}
--
--static char
--opt2char(int option)
--{
--	const char *ptr;
--	for (ptr = optflags; option > 1; option >>= 1, ptr++);
--
--	return *ptr;
--}
--
- /*
-  *	All functions starting with "parse" should succeed, otherwise
-  *	the program fails.
--- 
-2.40.0
-

SOURCES/0026-tests-shell-Test-for-fixed-extension-registration.patch

@@ -1,52 +0,0 @@
-From 8d0f11ea353caa254b65b4fde240e5d3a8fe12a7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 4 Dec 2020 17:44:51 +0100
-Subject: [PATCH] tests/shell: Test for fixed extension registration
-
-Use strace to look at iptables-restore behaviour with typically
-problematic input (conntrack revision 0 is no longer supported by
-current kernels) to make sure the fix in commit a1eaaceb0460b
-("libxtables: Simplify pending extension registration") is still
-effective.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 93d0c97e8b6713f51ba679e01a1338d4f9076e7c)
----
- .../0017-pointless-compat-checks_0            | 25 +++++++++++++++++++
- 1 file changed, 25 insertions(+)
- create mode 100755 iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
-
-diff --git a/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0 b/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
-new file mode 100755
-index 0000000000000..cf73de32df409
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ipt-restore/0017-pointless-compat-checks_0
-@@ -0,0 +1,25 @@
-+#!/bin/bash
-+
-+# A bug in extension registration would leave unsupported older extension
-+# revisions in pending list and get compatibility checked again for each rule
-+# using them. With SELinux enabled, the resulting socket() call per rule leads
-+# to significant slowdown (~50% performance in worst cases).
-+
-+set -e
-+
-+strace --version >/dev/null || { echo "skip for missing strace"; exit 0; }
-+
-+RULESET="$(
-+	echo "*filter"
-+	for ((i = 0; i < 100; i++)); do
-+		echo "-A FORWARD -m conntrack --ctstate NEW"
-+	done
-+	echo "COMMIT"
-+)"
-+
-+cmd="$XT_MULTI iptables-restore"
-+socketcount=$(strace -esocket $cmd <<< "$RULESET" 2>&1 | wc -l)
-+
-+# unpatched iptables-restore would open 111 sockets,
-+# patched only 12 but keep a certain margin for future changes
-+[[ $socketcount -lt 20 ]]
--- 
-2.40.0
-

SOURCES/0027-extensions-dccp-Fix-for-DCCP-type-INVALID.patch

@@ -1,176 +0,0 @@
-From 8a10ad0e149cf1c6d0c34bd554a8e0a35cdf3e8d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 2 Dec 2020 13:37:06 +0100
-Subject: [PATCH] extensions: dccp: Fix for DCCP type 'INVALID'
-
-Support for matching on invalid DCCP type field values was pretty
-broken: While RFC4340 declares any type value from 10 to 15 invalid, the
-extension's type name 'INVALID' mapped to type value 10 only. Fix this
-by introduction of INVALID_OTHER_TYPE_MASK which has the remaining
-invalid type's bits set and apply it if bit 10 is set after parsing the
-type list. When printing, stop searching type names after printing
-'INVALID' - unless numeric output was requested. The latter prints all
-actual type values. Since parsing types in numeric form is not
-supported, changing the output should not break existing scripts.
-
-When translating into nftables syntax, the code returned prematurely if
-'INVALID' was among the list of types - thereby emitting invalid syntax.
-Instead print a real match for invalid types by use of a range
-expression.
-
-While being at it, fix syntax of translator output: If only
-'--dccp-types' was translated, the output contained an extra 'dccp'. On
-the other hand, if '--sport' and '--dport' was present, a required
-'dccp' between the translations of both was missing.
-
-Fixes: e40b11d7ef827 ("add support for new 'dccp' protocol match")
-Fixes: c94a998724143 ("extensions: libxt_dccp: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 4bcbc8e11a2764f4537dc405962f83cd072cccfe)
----
- extensions/libxt_dccp.c      | 58 ++++++++++++++++++++++--------------
- extensions/libxt_dccp.txlate | 12 ++++++--
- 2 files changed, 45 insertions(+), 25 deletions(-)
-
-diff --git a/extensions/libxt_dccp.c b/extensions/libxt_dccp.c
-index 5e67c264db2a9..aea3e20be4818 100644
---- a/extensions/libxt_dccp.c
-+++ b/extensions/libxt_dccp.c
-@@ -76,6 +76,9 @@ static const char *const dccp_pkt_types[] = {
- 	[DCCP_PKT_INVALID]	= "INVALID",
- };
- 
-+/* Bits for type values 11-15 */
-+#define INVALID_OTHER_TYPE_MASK		0xf800
-+
- static uint16_t
- parse_dccp_types(const char *typestring)
- {
-@@ -95,6 +98,9 @@ parse_dccp_types(const char *typestring)
- 			xtables_error(PARAMETER_PROBLEM,
- 				   "Unknown DCCP type `%s'", ptr);
- 	}
-+	if (typemask & (1 << DCCP_PKT_INVALID))
-+		typemask |= INVALID_OTHER_TYPE_MASK;
-+
- 
- 	free(buffer);
- 	return typemask;
-@@ -193,9 +199,13 @@ print_types(uint16_t types, int inverted, int numeric)
- 
- 		if (numeric)
- 			printf("%u", i);
--		else
-+		else {
- 			printf("%s", dccp_pkt_types[i]);
- 
-+			if (i == DCCP_PKT_INVALID)
-+				break;
-+		}
-+
- 		types &= ~(1 << i);
- 	}
- }
-@@ -288,6 +298,7 @@ static const char *const dccp_pkt_types_xlate[] = {
- 	[DCCP_PKT_RESET]        = "reset",
- 	[DCCP_PKT_SYNC]         = "sync",
- 	[DCCP_PKT_SYNCACK]      = "syncack",
-+	[DCCP_PKT_INVALID]	= "10-15",
- };
- 
- static int dccp_type_xlate(const struct xt_dccp_info *einfo,
-@@ -296,10 +307,10 @@ static int dccp_type_xlate(const struct xt_dccp_info *einfo,
- 	bool have_type = false, set_need = false;
- 	uint16_t types = einfo->typemask;
- 
--	if (types & (1 << DCCP_PKT_INVALID))
--		return 0;
--
--	xt_xlate_add(xl, " dccp type%s ", einfo->invflags ? " !=" : "");
-+	if (types & INVALID_OTHER_TYPE_MASK) {
-+		types &= ~INVALID_OTHER_TYPE_MASK;
-+		types |= 1 << DCCP_PKT_INVALID;
-+	}
- 
- 	if ((types != 0) && !(types == (types & -types))) {
- 		xt_xlate_add(xl, "{");
-@@ -335,34 +346,37 @@ static int dccp_xlate(struct xt_xlate *xl,
- 	char *space = "";
- 	int ret = 1;
- 
--	xt_xlate_add(xl, "dccp ");
--
- 	if (einfo->flags & XT_DCCP_SRC_PORTS) {
-+		xt_xlate_add(xl, "dccp sport%s %u",
-+			     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
-+			     einfo->spts[0]);
-+
- 		if (einfo->spts[0] != einfo->spts[1])
--			xt_xlate_add(xl, "sport%s %u-%u",
--				     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
--				     einfo->spts[0], einfo->spts[1]);
--		else
--			xt_xlate_add(xl, "sport%s %u",
--				     einfo->invflags & XT_DCCP_SRC_PORTS ? " !=" : "",
--				     einfo->spts[0]);
-+			xt_xlate_add(xl, "-%u", einfo->spts[1]);
-+
- 		space = " ";
- 	}
- 
- 	if (einfo->flags & XT_DCCP_DEST_PORTS) {
-+		xt_xlate_add(xl, "%sdccp dport%s %u", space,
-+			     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
-+			     einfo->dpts[0]);
-+
- 		if (einfo->dpts[0] != einfo->dpts[1])
--			xt_xlate_add(xl, "%sdport%s %u-%u", space,
--				     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
--				     einfo->dpts[0], einfo->dpts[1]);
--		else
--			xt_xlate_add(xl, "%sdport%s %u", space,
--				     einfo->invflags & XT_DCCP_DEST_PORTS ? " !=" : "",
--				     einfo->dpts[0]);
-+			xt_xlate_add(xl, "-%u", einfo->dpts[1]);
-+
-+		space = " ";
- 	}
- 
--	if (einfo->flags & XT_DCCP_TYPE)
-+	if (einfo->flags & XT_DCCP_TYPE && einfo->typemask) {
-+		xt_xlate_add(xl, "%sdccp type%s ", space,
-+			     einfo->invflags & XT_DCCP_TYPE ? " !=" : "");
- 		ret = dccp_type_xlate(einfo, xl);
- 
-+		space = " ";
-+	}
-+
-+	/* FIXME: no dccp option support in nftables yet */
- 	if (einfo->flags & XT_DCCP_OPTION)
- 		ret = 0;
- 
-diff --git a/extensions/libxt_dccp.txlate b/extensions/libxt_dccp.txlate
-index b47dc65f5bc4f..ea853f6acf627 100644
---- a/extensions/libxt_dccp.txlate
-+++ b/extensions/libxt_dccp.txlate
-@@ -7,8 +7,14 @@ nft add rule ip filter INPUT dccp dport 100-200 counter
- iptables-translate -A INPUT -p dccp -m dccp ! --dport 100
- nft add rule ip filter INPUT dccp dport != 100 counter
- 
--iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK
--nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack} counter
-+iptables-translate -A INPUT -p dccp -m dccp --dccp-types CLOSE
-+nft add rule ip filter INPUT dccp type close counter
-+
-+iptables-translate -A INPUT -p dccp -m dccp --dccp-types INVALID
-+nft add rule ip filter INPUT dccp type 10-15 counter
-+
-+iptables-translate -A INPUT -p dccp -m dccp --dport 100 --dccp-types REQUEST,RESPONSE,DATA,ACK,DATAACK,CLOSEREQ,CLOSE,SYNC,SYNCACK,INVALID
-+nft add rule ip filter INPUT dccp dport 100 dccp type {request, response, data, ack, dataack, closereq, close, sync, syncack, 10-15} counter
- 
- iptables-translate -A INPUT -p dccp -m dccp --sport 200 --dport 100
--nft add rule ip filter INPUT dccp sport 200 dport 100 counter
-+nft add rule ip filter INPUT dccp sport 200 dccp dport 100 counter
--- 
-2.40.0
-

SOURCES/0028-xtables-monitor-fix-rule-printing.patch

@@ -1,85 +0,0 @@
-From 524f17b1027cb3b6bd5484c644d4dc226d137d91 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Sat, 12 Dec 2020 16:15:32 +0100
-Subject: [PATCH] xtables-monitor: fix rule printing
-
-trace_print_rule does a rule dump.  This prints unrelated rules
-in the same chain.  Instead the function should only request the
-specific handle.
-
-Furthermore, flush output buffer afterwards so this plays nice when
-output isn't a terminal.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 07af4da52ab3002c9cb510863b4eb7aaca4fb43b)
----
- iptables/xtables-monitor.c | 32 +++++++++++++++-----------------
- 1 file changed, 15 insertions(+), 17 deletions(-)
-
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 4008cc00d4694..364e600e1b38a 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -227,12 +227,12 @@ static void trace_print_rule(const struct nftnl_trace *nlt, struct cb_arg *args)
- 		exit(EXIT_FAILURE);
- 	}
- 
--	nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, family, NLM_F_DUMP, 0);
-+	nlh = nftnl_chain_nlmsg_build_hdr(buf, NFT_MSG_GETRULE, family, 0, 0);
- 
-         nftnl_rule_set_u32(r, NFTNL_RULE_FAMILY, family);
- 	nftnl_rule_set_str(r, NFTNL_RULE_CHAIN, chain);
- 	nftnl_rule_set_str(r, NFTNL_RULE_TABLE, table);
--	nftnl_rule_set_u64(r, NFTNL_RULE_POSITION, handle);
-+	nftnl_rule_set_u64(r, NFTNL_RULE_HANDLE, handle);
- 	nftnl_rule_nlmsg_build_payload(nlh, r);
- 	nftnl_rule_free(r);
- 
-@@ -248,24 +248,21 @@ static void trace_print_rule(const struct nftnl_trace *nlt, struct cb_arg *args)
- 	}
- 
- 	portid = mnl_socket_get_portid(nl);
--        if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
--                perror("mnl_socket_send");
--                exit(EXIT_FAILURE);
--        }
-+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-+		perror("mnl_socket_send");
-+		exit(EXIT_FAILURE);
-+	}
- 
- 	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
--        while (ret > 0) {
-+	if (ret > 0) {
- 		args->is_event = false;
--                ret = mnl_cb_run(buf, ret, 0, portid, rule_cb, args);
--                if (ret <= 0)
--                        break;
--                ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
--        }
--        if (ret == -1) {
--                perror("error");
--                exit(EXIT_FAILURE);
--        }
--        mnl_socket_close(nl);
-+		ret = mnl_cb_run(buf, ret, 0, portid, rule_cb, args);
-+	}
-+	if (ret == -1) {
-+		perror("error");
-+		exit(EXIT_FAILURE);
-+	}
-+	mnl_socket_close(nl);
- }
- 
- static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *args)
-@@ -531,6 +528,7 @@ static int trace_cb(const struct nlmsghdr *nlh, struct cb_arg *arg)
- err_free:
- 	nftnl_trace_free(nlt);
- err:
-+	fflush(stdout);
- 	return MNL_CB_OK;
- }
- 
--- 
-2.40.0
-

SOURCES/0029-xtables-monitor-fix-packet-family-protocol.patch

@@ -1,38 +0,0 @@
-From 7de2651bdbbabfc08ef040d2cb9867c8375e3984 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Sat, 12 Dec 2020 16:15:33 +0100
-Subject: [PATCH] xtables-monitor: fix packet family protocol
-
-This prints the family passed on the command line (which might be 0).
-Print the table family instead.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 946923b640afc2249cf98743ff60a97291108701)
----
- iptables/xtables-monitor.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 364e600e1b38a..8850a12032d26 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -273,14 +273,14 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
- 	uint32_t mark;
- 	char name[IFNAMSIZ];
- 
--	printf("PACKET: %d %08x ", args->nfproto, nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID));
-+	family = nftnl_trace_get_u32(nlt, NFTNL_TRACE_FAMILY);
-+	printf("PACKET: %d %08x ", family, nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID));
- 
- 	if (nftnl_trace_is_set(nlt, NFTNL_TRACE_IIF))
- 		printf("IN=%s ", if_indextoname(nftnl_trace_get_u32(nlt, NFTNL_TRACE_IIF), name));
- 	if (nftnl_trace_is_set(nlt, NFTNL_TRACE_OIF))
- 		printf("OUT=%s ", if_indextoname(nftnl_trace_get_u32(nlt, NFTNL_TRACE_OIF), name));
- 
--	family = nftnl_trace_get_u32(nlt, NFTNL_TRACE_FAMILY);
- 	nfproto = family;
- 	if (nftnl_trace_is_set(nlt, NFTNL_TRACE_NFPROTO)) {
- 		nfproto = nftnl_trace_get_u32(nlt, NFTNL_TRACE_NFPROTO);
--- 
-2.40.0
-

SOURCES/0030-xtables-monitor-print-packet-first.patch

@@ -1,101 +0,0 @@
-From 46fffddb8ae11d3e46f55ca0bb356a2549671652 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Sat, 12 Dec 2020 16:15:34 +0100
-Subject: [PATCH] xtables-monitor: print packet first
-
-The trace mode should first print the packet that was received and
-then the rule/verdict.
-
-Furthermore, the monitor did sometimes print an extra newline.
-
-After this patch, output is more consistent with nft monitor.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 180ba723d0b305fab9287d3bc5f845a43d9eb793)
----
- iptables/xtables-monitor.c | 34 +++++++++++++++++++++++-----------
- 1 file changed, 23 insertions(+), 11 deletions(-)
-
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 8850a12032d26..e6b6e76b9fdc9 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -106,6 +106,7 @@ static int rule_cb(const struct nlmsghdr *nlh, void *data)
- 		printf("-0 ");
- 		break;
- 	default:
-+		puts("");
- 		goto err_free;
- 	}
- 
-@@ -433,9 +434,18 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
- 	mark = nftnl_trace_get_u32(nlt, NFTNL_TRACE_MARK);
- 	if (mark)
- 		printf("MARK=0x%x ", mark);
-+	puts("");
-+}
-+
-+static void trace_print_hdr(const struct nftnl_trace *nlt)
-+{
-+	printf(" TRACE: %d %08x %s:%s", nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY),
-+					nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID),
-+					nftnl_trace_get_str(nlt, NFTNL_TRACE_TABLE),
-+					nftnl_trace_get_str(nlt, NFTNL_TRACE_CHAIN));
- }
- 
--static void print_verdict(struct nftnl_trace *nlt, uint32_t verdict)
-+static void print_verdict(const struct nftnl_trace *nlt, uint32_t verdict)
- {
- 	const char *chain;
- 
-@@ -496,35 +506,37 @@ static int trace_cb(const struct nlmsghdr *nlh, struct cb_arg *arg)
- 	    arg->nfproto != nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY))
- 		goto err_free;
- 
--	printf(" TRACE: %d %08x %s:%s", nftnl_trace_get_u32(nlt, NFTNL_TABLE_FAMILY),
--					nftnl_trace_get_u32(nlt, NFTNL_TRACE_ID),
--					nftnl_trace_get_str(nlt, NFTNL_TRACE_TABLE),
--					nftnl_trace_get_str(nlt, NFTNL_TRACE_CHAIN));
--
- 	switch (nftnl_trace_get_u32(nlt, NFTNL_TRACE_TYPE)) {
- 	case NFT_TRACETYPE_RULE:
- 		verdict = nftnl_trace_get_u32(nlt, NFTNL_TRACE_VERDICT);
--		printf(":rule:0x%llx:", (unsigned long long)nftnl_trace_get_u64(nlt, NFTNL_TRACE_RULE_HANDLE));
--		print_verdict(nlt, verdict);
- 
--		if (nftnl_trace_is_set(nlt, NFTNL_TRACE_RULE_HANDLE))
--			trace_print_rule(nlt, arg);
- 		if (nftnl_trace_is_set(nlt, NFTNL_TRACE_LL_HEADER) ||
- 		    nftnl_trace_is_set(nlt, NFTNL_TRACE_NETWORK_HEADER))
- 			trace_print_packet(nlt, arg);
-+
-+		if (nftnl_trace_is_set(nlt, NFTNL_TRACE_RULE_HANDLE)) {
-+			trace_print_hdr(nlt);
-+			printf(":rule:0x%" PRIx64":", nftnl_trace_get_u64(nlt, NFTNL_TRACE_RULE_HANDLE));
-+			print_verdict(nlt, verdict);
-+			printf(" ");
-+			trace_print_rule(nlt, arg);
-+		}
- 		break;
- 	case NFT_TRACETYPE_POLICY:
-+		trace_print_hdr(nlt);
- 		printf(":policy:");
- 		verdict = nftnl_trace_get_u32(nlt, NFTNL_TRACE_POLICY);
- 
- 		print_verdict(nlt, verdict);
-+		puts("");
- 		break;
- 	case NFT_TRACETYPE_RETURN:
-+		trace_print_hdr(nlt);
- 		printf(":return:");
- 		trace_print_return(nlt);
-+		puts("");
- 		break;
- 	}
--	puts("");
- err_free:
- 	nftnl_trace_free(nlt);
- err:
--- 
-2.40.0
-

SOURCES/0031-xtables-monitor.patch

@@ -1,30 +0,0 @@
-From bc9b418dc22fb7d81bfded431c74ea84f62340bd Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Mon, 14 Dec 2020 17:11:23 +0100
-Subject: [PATCH] xtables-monitor:
-
-'LL=0x304' is not very convenient, print LOOPBACK instead.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 98ed6f6fc6d97663a33de67afff60196052880b1)
----
- iptables/xtables-monitor.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index e6b6e76b9fdc9..4b9809805fb5b 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -306,6 +306,9 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
- 			printf("MACDST=%s ", ether_ntoa((const void *)eh->h_dest));
- 			printf("MACPROTO=%04x ", ntohs(eh->h_proto));
- 			break;
-+		case ARPHRD_LOOPBACK:
-+			printf("LOOPBACK ");
-+			break;
- 		default:
- 			printf("LL=0x%x ", type);
- 			for (i = 0 ; i < len; i++)
--- 
-2.40.0
-

SOURCES/0032-nft-Fix-selective-chain-compatibility-checks.patch

@@ -1,41 +0,0 @@
-From 06bf588263f81b0d254d49b584b26445a788638d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 23 Sep 2020 19:13:45 +0200
-Subject: [PATCH] nft: Fix selective chain compatibility checks
-
-Since commit 80251bc2a56ed ("nft: remove cache build calls"), 'chain'
-parameter passed to nft_chain_list_get() is no longer effective.
-Before, it was used to fetch only that single chain from kernel when
-populating the cache. So the returned list of chains for which
-compatibility checks are done would contain only that single chain.
-
-Re-establish the single chain compat checking by introducing a dedicated
-code path to nft_is_chain_compatible() doing so.
-
-Fixes: 80251bc2a56ed ("nft: remove cache build calls")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 694612adf87fb614f16a2b678f32745d5c9d7876)
----
- iptables/nft.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index bdf252198f155..7f87d46dcc44c 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -3575,6 +3575,12 @@ bool nft_is_table_compatible(struct nft_handle *h,
- {
- 	struct nftnl_chain_list *clist;
- 
-+	if (chain) {
-+		struct nftnl_chain *c = nft_chain_find(h, table, chain);
-+
-+		return c && !nft_is_chain_compatible(c, h);
-+	}
-+
- 	clist = nft_chain_list_get(h, table, chain);
- 	if (clist == NULL)
- 		return false;
--- 
-2.40.0
-

SOURCES/0033-iptables-nft-fix-Z-option.patch

@@ -1,104 +0,0 @@
-From 4f52c310cf3854a64ef9a518c223e0581ec9a308 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Wed, 24 Feb 2021 11:08:02 +0100
-Subject: [PATCH] iptables-nft: fix -Z option
-
-it zeroes the rule counters, so it needs fully populated cache.
-Add a test case to cover this.
-
-Fixes: 9d07514ac5c7a ("nft: calculate cache requirements from list of commands")
-Signed-off-by: Florian Westphal <fw@strlen.de>
-Acked-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 5f1fcacebf9b4529950b6e3f88327049a0ea7cd2)
----
- iptables/nft-cmd.c                            |  2 +-
- .../testcases/iptables/0007-zero-counters_0   | 64 +++++++++++++++++++
- 2 files changed, 65 insertions(+), 1 deletion(-)
- create mode 100755 iptables/tests/shell/testcases/iptables/0007-zero-counters_0
-
-diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
-index 9c0901e78703a..ed53c061edc6f 100644
---- a/iptables/nft-cmd.c
-+++ b/iptables/nft-cmd.c
-@@ -185,7 +185,7 @@ int nft_cmd_chain_zero_counters(struct nft_handle *h, const char *chain,
- 	if (!cmd)
- 		return 0;
- 
--	nft_cache_level_set(h, NFT_CL_CHAINS, cmd);
-+	nft_cache_level_set(h, NFT_CL_RULES, cmd);
- 
- 	return 1;
- }
-diff --git a/iptables/tests/shell/testcases/iptables/0007-zero-counters_0 b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
-new file mode 100755
-index 0000000000000..36da1907e3b22
---- /dev/null
-+++ b/iptables/tests/shell/testcases/iptables/0007-zero-counters_0
-@@ -0,0 +1,64 @@
-+#!/bin/bash
-+
-+RC=0
-+COUNTR=$RANDOM$RANDOM
-+
-+$XT_MULTI iptables-restore -c <<EOF
-+*filter
-+:INPUT ACCEPT [1:23]
-+:FOO - [0:0]
-+[12:345] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
-+[22:123] -A FOO -m comment --comment one
-+[44:123] -A FOO -m comment --comment two
-+COMMIT
-+EOF
-+EXPECT="*filter
-+:INPUT ACCEPT [0:0]
-+:FORWARD ACCEPT [0:0]
-+:OUTPUT ACCEPT [0:0]
-+:FOO - [0:0]
-+[0:0] -A INPUT -i lo -p icmp -m comment --comment "$COUNTR"
-+[0:0] -A FOO -m comment --comment one
-+[0:0] -A FOO -m comment --comment two
-+COMMIT"
-+
-+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
-+if [ $COUNTER != "[12:345]" ]; then
-+	echo "Counter $COUNTER is wrong, expected 12:345"
-+	RC=1
-+fi
-+
-+$XT_MULTI iptables -Z FOO
-+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
-+if [ $COUNTER = "[0:0]" ]; then
-+	echo "Counter $COUNTER is wrong, should not have been zeroed"
-+	RC=1
-+fi
-+
-+for c in one two; do
-+	COUNTER=$($XT_MULTI iptables-save -c |grep "comment $c"| cut -f 1 -d " ")
-+	if [ $COUNTER != "[0:0]" ]; then
-+		echo "Counter $COUNTER is wrong, should have been zeroed at rule $c"
-+		RC=1
-+	fi
-+done
-+
-+$XT_MULTI iptables -Z
-+COUNTER=$($XT_MULTI iptables-save -c |grep "comment $COUNTR"| cut -f 1 -d " ")
-+
-+if [ $COUNTER != "[0:0]" ]; then
-+	echo "Counter $COUNTER is wrong, expected 0:0 after -Z"
-+	RC=1
-+fi
-+
-+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI iptables-save -c | grep -v '^#')
-+if [ $? -ne 0 ]; then
-+	echo "Diff error: counters were not zeroed"
-+	RC=1
-+fi
-+
-+$XT_MULTI iptables -D INPUT -i lo -p icmp -m comment --comment "$COUNTR"
-+$XT_MULTI iptables -D FOO -m comment --comment one
-+$XT_MULTI iptables -D FOO -m comment --comment two
-+$XT_MULTI iptables -X FOO
-+exit $RC
--- 
-2.40.0
-

SOURCES/0034-nft-Fix-bitwise-expression-avoidance-detection.patch

@@ -1,73 +0,0 @@
-From 7b60fadf23fd4b712dd7522c06b6e7b4f3190fc6 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 19 Feb 2021 16:54:57 +0100
-Subject: [PATCH] nft: Fix bitwise expression avoidance detection
-
-Byte-boundary prefix detection was too sloppy: Any data following the
-first zero-byte was ignored. Add a follow-up loop making sure there are
-no stray bits in the designated host part.
-
-Fixes: 323259001d617 ("nft: Optimize class-based IP prefix matches")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 330f5df03ad589b46865ceedf2a54cf10a4225ba)
----
- iptables/nft-shared.c                         |  4 +++-
- .../testcases/ip6tables/0004-address-masks_0  | 24 +++++++++++++++++++
- 2 files changed, 27 insertions(+), 1 deletion(-)
- create mode 100755 iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
-
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 10553ab26823b..c1664b50f9383 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -166,7 +166,7 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
- {
- 	const unsigned char *m = mask;
- 	bool bitwise = false;
--	int i;
-+	int i, j;
- 
- 	for (i = 0; i < len; i++) {
- 		if (m[i] != 0xff) {
-@@ -174,6 +174,8 @@ void add_addr(struct nftnl_rule *r, enum nft_payload_bases base, int offset,
- 			break;
- 		}
- 	}
-+	for (j = i + 1; !bitwise && j < len; j++)
-+		bitwise = !!m[j];
- 
- 	if (!bitwise)
- 		len = i;
-diff --git a/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0 b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
-new file mode 100755
-index 0000000000000..7eb42f08da975
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ip6tables/0004-address-masks_0
-@@ -0,0 +1,24 @@
-+#!/bin/bash
-+
-+set -e
-+
-+$XT_MULTI ip6tables-restore <<EOF
-+*filter
-+-A FORWARD -s feed:babe::/ffff::0
-+-A FORWARD -s feed:babe::/ffff:ff00::0
-+-A FORWARD -s feed:babe::/ffff:fff0::0
-+-A FORWARD -s feed:babe::/ffff:ffff::0
-+-A FORWARD -s feed:babe::/0:ffff::0
-+-A FORWARD -s feed:c0ff::babe:f00/ffff::ffff:0
-+COMMIT
-+EOF
-+
-+EXPECT='-P FORWARD ACCEPT
-+-A FORWARD -s feed::/16
-+-A FORWARD -s feed:ba00::/24
-+-A FORWARD -s feed:bab0::/28
-+-A FORWARD -s feed:babe::/32
-+-A FORWARD -s 0:babe::/0:ffff::
-+-A FORWARD -s feed::babe:0/ffff::ffff:0'
-+
-+diff -u -Z <(echo -e "$EXPECT") <($XT_MULTI ip6tables -S FORWARD)
--- 
-2.40.0
-

SOURCES/0035-xtables-translate-Fix-translation-of-odd-netmasks.patch

@@ -1,196 +0,0 @@
-From 810da6ff3a0a0b9bdb608edc0b68fc5cedac97e0 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 2 Mar 2021 14:50:07 +0100
-Subject: [PATCH] xtables-translate: Fix translation of odd netmasks
-
-Iptables supports netmasks which are not prefixes to match on (or
-ignore) arbitrary bits in an address. Yet nftables' prefix notation is
-available for real prefixes only, so translation is not as trivial -
-print bitmask syntax for those cases.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 46f9d3a9a61ee80fa94b7fa7b3b36045c92606ae)
----
- extensions/generic.txlate   | 48 +++++++++++++++++++++++++++++++++++++
- extensions/libxt_standard.t | 12 ++++++++++
- iptables/nft-ipv4.c         | 42 ++++++++++++++++++++++----------
- iptables/nft-ipv6.c         | 19 ++++++++++++---
- 4 files changed, 106 insertions(+), 15 deletions(-)
-
-diff --git a/extensions/generic.txlate b/extensions/generic.txlate
-index 0e256c3727559..9ae9a5b54c1b9 100644
---- a/extensions/generic.txlate
-+++ b/extensions/generic.txlate
-@@ -10,6 +10,54 @@ nft insert rule ip filter INPUT iifname "iifname" ip saddr 10.0.0.0/8 counter
- iptables-translate -A INPUT -i iif+ ! -d 10.0.0.0/8
- nft add rule ip filter INPUT iifname "iif*" ip daddr != 10.0.0.0/8 counter
- 
-+iptables-translate -I INPUT -s 10.11.12.13/255.255.0.0
-+nft insert rule ip filter INPUT ip saddr 10.11.0.0/16 counter
-+
-+iptables-translate -I INPUT -s 10.11.12.13/255.0.255.0
-+nft insert rule ip filter INPUT ip saddr & 255.0.255.0 == 10.0.12.0 counter
-+
-+iptables-translate -I INPUT -s 10.11.12.13/0.255.0.255
-+nft insert rule ip filter INPUT ip saddr & 0.255.0.255 == 0.11.0.13 counter
-+
-+iptables-translate -I INPUT ! -s 10.11.12.13/0.255.0.255
-+nft insert rule ip filter INPUT ip saddr & 0.255.0.255 != 0.11.0.13 counter
-+
-+iptables-translate -I INPUT -s 0.0.0.0/16
-+nft insert rule ip filter INPUT ip saddr 0.0.0.0/16 counter
-+
-+iptables-translate -I INPUT -s 0.0.0.0/0
-+nft insert rule ip filter INPUT counter
-+
-+iptables-translate -I INPUT ! -s 0.0.0.0/0
-+nft insert rule ip filter INPUT ip saddr != 0.0.0.0/0 counter
-+
-+ip6tables-translate -I INPUT -i iifname -s feed::/16
-+nft insert rule ip6 filter INPUT iifname "iifname" ip6 saddr feed::/16 counter
-+
-+ip6tables-translate -A INPUT -i iif+ ! -d feed::/16
-+nft add rule ip6 filter INPUT iifname "iif*" ip6 daddr != feed::/16 counter
-+
-+ip6tables-translate -I INPUT -s feed:babe::1/ffff:ff00::
-+nft insert rule ip6 filter INPUT ip6 saddr feed:ba00::/24 counter
-+
-+ip6tables-translate -I INPUT -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/ffff:0:ffff:0:ffff:0:ffff:0
-+nft insert rule ip6 filter INPUT ip6 saddr & ffff:0:ffff:0:ffff:0:ffff:0 == feed:0:c0ff:0:c0be:0:5678:0 counter
-+
-+ip6tables-translate -I INPUT -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/0:ffff:0:ffff:0:ffff:0:ffff
-+nft insert rule ip6 filter INPUT ip6 saddr & 0:ffff:0:ffff:0:ffff:0:ffff == 0:babe:0:ee00:0:1234:0:90ab counter
-+
-+ip6tables-translate -I INPUT ! -s feed:babe:c0ff:ee00:c0be:1234:5678:90ab/0:ffff:0:ffff:0:ffff:0:ffff
-+nft insert rule ip6 filter INPUT ip6 saddr & 0:ffff:0:ffff:0:ffff:0:ffff != 0:babe:0:ee00:0:1234:0:90ab counter
-+
-+ip6tables-translate -I INPUT -s ::/16
-+nft insert rule ip6 filter INPUT ip6 saddr ::/16 counter
-+
-+ip6tables-translate -I INPUT -s ::/0
-+nft insert rule ip6 filter INPUT counter
-+
-+ip6tables-translate -I INPUT ! -s ::/0
-+nft insert rule ip6 filter INPUT ip6 saddr != ::/0 counter
-+
- ebtables-translate -I INPUT -i iname --logical-in ilogname -s 0:0:0:0:0:0
- nft insert rule bridge filter INPUT iifname "iname" meta ibrname "ilogname" ether saddr 00:00:00:00:00:00 counter
- 
-diff --git a/extensions/libxt_standard.t b/extensions/libxt_standard.t
-index 4313f7b7bac9d..56d6da2e5884e 100644
---- a/extensions/libxt_standard.t
-+++ b/extensions/libxt_standard.t
-@@ -9,3 +9,15 @@
- -j ACCEPT;=;OK
- -j RETURN;=;OK
- ! -p 0 -j ACCEPT;=;FAIL
-+-s 10.11.12.13/8;-s 10.0.0.0/8;OK
-+-s 10.11.12.13/9;-s 10.0.0.0/9;OK
-+-s 10.11.12.13/10;-s 10.0.0.0/10;OK
-+-s 10.11.12.13/11;-s 10.0.0.0/11;OK
-+-s 10.11.12.13/12;-s 10.0.0.0/12;OK
-+-s 10.11.12.13/30;-s 10.11.12.12/30;OK
-+-s 10.11.12.13/31;-s 10.11.12.12/31;OK
-+-s 10.11.12.13/32;-s 10.11.12.13/32;OK
-+-s 10.11.12.13/255.0.0.0;-s 10.0.0.0/8;OK
-+-s 10.11.12.13/255.128.0.0;-s 10.0.0.0/9;OK
-+-s 10.11.12.13/255.0.255.0;-s 10.0.12.0/255.0.255.0;OK
-+-s 10.11.12.13/255.0.12.0;-s 10.0.12.0/255.0.12.0;OK
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index fdc15c6f04066..0d32a30010519 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -383,6 +383,32 @@ static void nft_ipv4_post_parse(int command,
- 			      " source or destination IP addresses");
- }
- 
-+static void xlate_ipv4_addr(const char *selector, const struct in_addr *addr,
-+			    const struct in_addr *mask,
-+			    bool inv, struct xt_xlate *xl)
-+{
-+	const char *op = inv ? "!= " : "";
-+	int cidr;
-+
-+	if (!inv && !addr->s_addr && !mask->s_addr)
-+		return;
-+
-+	cidr = xtables_ipmask_to_cidr(mask);
-+	switch (cidr) {
-+	case -1:
-+		/* inet_ntoa() is not reentrant */
-+		xt_xlate_add(xl, "%s & %s ", selector, inet_ntoa(*mask));
-+		xt_xlate_add(xl, "%s %s ", inv ? "!=" : "==", inet_ntoa(*addr));
-+		break;
-+	case 32:
-+		xt_xlate_add(xl, "%s %s%s ", selector, op, inet_ntoa(*addr));
-+		break;
-+	default:
-+		xt_xlate_add(xl, "%s %s%s/%d ", selector, op, inet_ntoa(*addr),
-+			     cidr);
-+	}
-+}
-+
- static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
- {
- 	const struct iptables_command_state *cs = data;
-@@ -417,18 +443,10 @@ static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
- 		}
- 	}
- 
--	if (cs->fw.ip.src.s_addr != 0) {
--		xt_xlate_add(xl, "ip saddr %s%s%s ",
--			   cs->fw.ip.invflags & IPT_INV_SRCIP ? "!= " : "",
--			   inet_ntoa(cs->fw.ip.src),
--			   xtables_ipmask_to_numeric(&cs->fw.ip.smsk));
--	}
--	if (cs->fw.ip.dst.s_addr != 0) {
--		xt_xlate_add(xl, "ip daddr %s%s%s ",
--			   cs->fw.ip.invflags & IPT_INV_DSTIP ? "!= " : "",
--			   inet_ntoa(cs->fw.ip.dst),
--			   xtables_ipmask_to_numeric(&cs->fw.ip.dmsk));
--	}
-+	xlate_ipv4_addr("ip saddr", &cs->fw.ip.src, &cs->fw.ip.smsk,
-+			cs->fw.ip.invflags & IPT_INV_SRCIP, xl);
-+	xlate_ipv4_addr("ip daddr", &cs->fw.ip.dst, &cs->fw.ip.dmsk,
-+			cs->fw.ip.invflags & IPT_INV_DSTIP, xl);
- 
- 	ret = xlate_matches(cs, xl);
- 	if (!ret)
-diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index 130ad3e6e7c44..46008fc5e762a 100644
---- a/iptables/nft-ipv6.c
-+++ b/iptables/nft-ipv6.c
-@@ -337,14 +337,27 @@ static void xlate_ipv6_addr(const char *selector, const struct in6_addr *addr,
- 			    const struct in6_addr *mask,
- 			    int invert, struct xt_xlate *xl)
- {
-+	const char *op = invert ? "!= " : "";
- 	char addr_str[INET6_ADDRSTRLEN];
-+	int cidr;
- 
--	if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr))
-+	if (!invert && IN6_IS_ADDR_UNSPECIFIED(addr) && IN6_IS_ADDR_UNSPECIFIED(mask))
- 		return;
- 
- 	inet_ntop(AF_INET6, addr, addr_str, INET6_ADDRSTRLEN);
--	xt_xlate_add(xl, "%s %s%s%s ", selector, invert ? "!= " : "", addr_str,
--			xtables_ip6mask_to_numeric(mask));
-+	cidr = xtables_ip6mask_to_cidr(mask);
-+	switch (cidr) {
-+	case -1:
-+		xt_xlate_add(xl, "%s & %s %s %s ", selector,
-+			     xtables_ip6addr_to_numeric(mask),
-+			     invert ? "!=" : "==", addr_str);
-+		break;
-+	case 128:
-+		xt_xlate_add(xl, "%s %s%s ", selector, op, addr_str);
-+		break;
-+	default:
-+		xt_xlate_add(xl, "%s %s%s/%d ", selector, op, addr_str, cidr);
-+	}
- }
- 
- static int nft_ipv6_xlate(const void *data, struct xt_xlate *xl)
--- 
-2.40.0
-

SOURCES/0036-extensions-libxt_conntrack-use-bitops-for-state-nega.patch

@@ -1,129 +0,0 @@
-From db7d25c14b8db7f7ea514e1f81acb82fafb3c9d7 Mon Sep 17 00:00:00 2001
-From: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
-Date: Thu, 1 Apr 2021 16:47:07 +0300
-Subject: [PATCH] extensions: libxt_conntrack: use bitops for state negation
-
-Currently, state_xlate_print function prints statemask as comma-separated sequence of enabled
-statemask flags. But if we have inverted conntrack ctstate condition then we have to use more
-complex expression because nft not supports syntax like "ct state != related,established".
-
-Reproducer:
-$ iptables -A INPUT -d 127.0.0.1/32 -p tcp -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP
-$ nft list ruleset
-...
-meta l4proto tcp ip daddr 127.0.0.1 ct state != related,established counter packets 0 bytes 0 drop
-...
-
-it will fail if we try to load this rule:
-$ nft -f nft_test
-../nft_test:6:97-97: Error: syntax error, unexpected comma, expecting newline or semicolon
-
-Cc: Florian Westphal <fw@strlen.de>
-Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 18e334da7363ba186edb1700056e26ded27ca5ba)
----
- extensions/libxt_conntrack.c      | 38 ++++++++++++++++++++-----------
- extensions/libxt_conntrack.txlate |  5 +++-
- 2 files changed, 29 insertions(+), 14 deletions(-)
-
-diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
-index 7734509c9af84..91f9e4aa994f8 100644
---- a/extensions/libxt_conntrack.c
-+++ b/extensions/libxt_conntrack.c
-@@ -1148,30 +1148,43 @@ static void state_save(const void *ip, const struct xt_entry_match *match)
- 	state_print_state(sinfo->statemask);
- }
- 
--static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask)
-+static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask, int inverted)
- {
- 	const char *sep = "";
-+	int one_flag_set;
-+
-+	one_flag_set = !(statemask & (statemask - 1));
-+
-+	if (inverted && !one_flag_set)
-+		xt_xlate_add(xl, "& (");
-+	else if (inverted)
-+		xt_xlate_add(xl, "& ");
- 
- 	if (statemask & XT_CONNTRACK_STATE_INVALID) {
- 		xt_xlate_add(xl, "%s%s", sep, "invalid");
--		sep = ",";
-+		sep = inverted && !one_flag_set ? "|" : ",";
- 	}
- 	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_NEW)) {
- 		xt_xlate_add(xl, "%s%s", sep, "new");
--		sep = ",";
-+		sep = inverted && !one_flag_set ? "|" : ",";
- 	}
- 	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_RELATED)) {
- 		xt_xlate_add(xl, "%s%s", sep, "related");
--		sep = ",";
-+		sep = inverted && !one_flag_set ? "|" : ",";
- 	}
- 	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED)) {
- 		xt_xlate_add(xl, "%s%s", sep, "established");
--		sep = ",";
-+		sep = inverted && !one_flag_set ? "|" : ",";
- 	}
- 	if (statemask & XT_CONNTRACK_STATE_UNTRACKED) {
- 		xt_xlate_add(xl, "%s%s", sep, "untracked");
--		sep = ",";
-+		sep = inverted && !one_flag_set ? "|" : ",";
- 	}
-+
-+	if (inverted && !one_flag_set)
-+		xt_xlate_add(xl, ") == 0");
-+	else if (inverted)
-+		xt_xlate_add(xl, " == 0");
- }
- 
- static int state_xlate(struct xt_xlate *xl,
-@@ -1180,9 +1193,9 @@ static int state_xlate(struct xt_xlate *xl,
- 	const struct xt_conntrack_mtinfo3 *sinfo =
- 		(const void *)params->match->data;
- 
--	xt_xlate_add(xl, "ct state %s", sinfo->invert_flags & XT_CONNTRACK_STATE ?
--					"!= " : "");
--	state_xlate_print(xl, sinfo->state_mask);
-+	xt_xlate_add(xl, "ct state ");
-+	state_xlate_print(xl, sinfo->state_mask,
-+			  sinfo->invert_flags & XT_CONNTRACK_STATE);
- 	xt_xlate_add(xl, " ");
- 	return 1;
- }
-@@ -1256,10 +1269,9 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
- 				     sinfo->state_mask & XT_CONNTRACK_STATE_SNAT ? "snat" : "dnat");
- 			space = " ";
- 		} else {
--			xt_xlate_add(xl, "%sct state %s", space,
--				     sinfo->invert_flags & XT_CONNTRACK_STATE ?
--				     "!= " : "");
--			state_xlate_print(xl, sinfo->state_mask);
-+			xt_xlate_add(xl, "%sct state ", space);
-+			state_xlate_print(xl, sinfo->state_mask,
-+					  sinfo->invert_flags & XT_CONNTRACK_STATE);
- 			space = " ";
- 		}
- 	}
-diff --git a/extensions/libxt_conntrack.txlate b/extensions/libxt_conntrack.txlate
-index d374f8a035f00..5ab85b177c396 100644
---- a/extensions/libxt_conntrack.txlate
-+++ b/extensions/libxt_conntrack.txlate
-@@ -2,7 +2,10 @@ iptables-translate -t filter -A INPUT -m conntrack --ctstate NEW,RELATED -j ACCE
- nft add rule ip filter INPUT ct state new,related counter accept
- 
- ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW,RELATED -j ACCEPT
--nft add rule ip6 filter INPUT ct state != new,related counter accept
-+nft add rule ip6 filter INPUT ct state & (new|related) == 0 counter accept
-+
-+ip6tables-translate -t filter -A INPUT -m conntrack ! --ctstate NEW -j ACCEPT
-+nft add rule ip6 filter INPUT ct state & new == 0 counter accept
- 
- iptables-translate -t filter -A INPUT -m conntrack --ctproto UDP -j ACCEPT
- nft add rule ip filter INPUT ct original protocol 17 counter accept
--- 
-2.40.0
-

SOURCES/0037-Eliminate-inet_aton-and-inet_ntoa.patch

@@ -1,120 +0,0 @@
-From ca4b90e5fc460fe522ceff2206ae5d32d32d2b40 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 27 Apr 2021 09:12:53 +0200
-Subject: [PATCH] Eliminate inet_aton() and inet_ntoa()
-
-Both functions are obsolete, replace them by equivalent calls to
-inet_pton() and inet_ntop().
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit acac2dbe64e5120394fa715bb5fe95c42d08b8b3)
----
- extensions/libebt_among.c |  6 ++++--
- iptables/nft-ipv4.c       | 23 ++++++++++++++---------
- 2 files changed, 18 insertions(+), 11 deletions(-)
-
-diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
-index 2b9a1b6566684..7eb898f984bba 100644
---- a/extensions/libebt_among.c
-+++ b/extensions/libebt_among.c
-@@ -66,7 +66,7 @@ parse_nft_among_pair(char *buf, struct nft_among_pair *pair, bool have_ip)
- 	if (sep) {
- 		*sep = '\0';
- 
--		if (!inet_aton(sep + 1, &pair->in))
-+		if (!inet_pton(AF_INET, sep + 1, &pair->in))
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "Invalid IP address '%s'\n", sep + 1);
- 	}
-@@ -194,6 +194,7 @@ static void __bramong_print(struct nft_among_pair *pairs,
- 			    int cnt, bool inv, bool have_ip)
- {
- 	const char *isep = inv ? "! " : "";
-+	char abuf[INET_ADDRSTRLEN];
- 	int i;
- 
- 	for (i = 0; i < cnt; i++) {
-@@ -202,7 +203,8 @@ static void __bramong_print(struct nft_among_pair *pairs,
- 
- 		printf("%s", ether_ntoa(&pairs[i].ether));
- 		if (pairs[i].in.s_addr != INADDR_ANY)
--			printf("=%s", inet_ntoa(pairs[i].in));
-+			printf("=%s", inet_ntop(AF_INET, &pairs[i].in,
-+						abuf, sizeof(abuf)));
- 	}
- 	printf(" ");
- }
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index 0d32a30010519..a5b835b1f681d 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -136,7 +136,7 @@ static void get_frag(struct nft_xt_ctx *ctx, struct nftnl_expr *e, bool *inv)
- 
- static const char *mask_to_str(uint32_t mask)
- {
--	static char mask_str[sizeof("255.255.255.255")];
-+	static char mask_str[INET_ADDRSTRLEN];
- 	uint32_t bits, hmask = ntohl(mask);
- 	struct in_addr mask_addr = {
- 		.s_addr = mask,
-@@ -155,7 +155,7 @@ static const char *mask_to_str(uint32_t mask)
- 	if (i >= 0)
- 		sprintf(mask_str, "%u", i);
- 	else
--		sprintf(mask_str, "%s", inet_ntoa(mask_addr));
-+		inet_ntop(AF_INET, &mask_addr, mask_str, sizeof(mask_str));
- 
- 	return mask_str;
- }
-@@ -298,10 +298,13 @@ static void nft_ipv4_print_rule(struct nft_handle *h, struct nftnl_rule *r,
- static void save_ipv4_addr(char letter, const struct in_addr *addr,
- 			   uint32_t mask, int invert)
- {
-+	char addrbuf[INET_ADDRSTRLEN];
-+
- 	if (!mask && !invert && !addr->s_addr)
- 		return;
- 
--	printf("%s-%c %s/%s ", invert ? "! " : "", letter, inet_ntoa(*addr),
-+	printf("%s-%c %s/%s ", invert ? "! " : "", letter,
-+	       inet_ntop(AF_INET, addr, addrbuf, sizeof(addrbuf)),
- 	       mask_to_str(mask));
- }
- 
-@@ -387,25 +390,27 @@ static void xlate_ipv4_addr(const char *selector, const struct in_addr *addr,
- 			    const struct in_addr *mask,
- 			    bool inv, struct xt_xlate *xl)
- {
-+	char mbuf[INET_ADDRSTRLEN], abuf[INET_ADDRSTRLEN];
- 	const char *op = inv ? "!= " : "";
- 	int cidr;
- 
- 	if (!inv && !addr->s_addr && !mask->s_addr)
- 		return;
- 
-+	inet_ntop(AF_INET, addr, abuf, sizeof(abuf));
-+
- 	cidr = xtables_ipmask_to_cidr(mask);
- 	switch (cidr) {
- 	case -1:
--		/* inet_ntoa() is not reentrant */
--		xt_xlate_add(xl, "%s & %s ", selector, inet_ntoa(*mask));
--		xt_xlate_add(xl, "%s %s ", inv ? "!=" : "==", inet_ntoa(*addr));
-+		xt_xlate_add(xl, "%s & %s %s %s ", selector,
-+			     inet_ntop(AF_INET, mask, mbuf, sizeof(mbuf)),
-+			     inv ? "!=" : "==", abuf);
- 		break;
- 	case 32:
--		xt_xlate_add(xl, "%s %s%s ", selector, op, inet_ntoa(*addr));
-+		xt_xlate_add(xl, "%s %s%s ", selector, op, abuf);
- 		break;
- 	default:
--		xt_xlate_add(xl, "%s %s%s/%d ", selector, op, inet_ntoa(*addr),
--			     cidr);
-+		xt_xlate_add(xl, "%s %s%s/%d ", selector, op, abuf, cidr);
- 	}
- }
- 
--- 
-2.40.0
-

SOURCES/0038-nft-arp-Make-use-of-ipv4_addr_to_string.patch

@@ -1,181 +0,0 @@
-From ab2ec9ca900843d6cb9fa839a9afe0ea968ce263 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 27 Apr 2021 10:02:34 +0200
-Subject: [PATCH] nft-arp: Make use of ipv4_addr_to_string()
-
-This eliminates quite a bit of redundant code apart from also dropping
-use of obsolete function gethostbyaddr().
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 1e984079817a3c804eae25dea937d63d18c57a6c)
----
- iptables/nft-arp.c | 99 ++++------------------------------------------
- iptables/xshared.c |  6 +--
- iptables/xshared.h |  3 ++
- 3 files changed, 14 insertions(+), 94 deletions(-)
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index c82ffdc95e300..2a9387a18dffe 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -42,78 +42,6 @@ char *arp_opcodes[] =
- 	"ARP_NAK",
- };
- 
--static char *
--addr_to_dotted(const struct in_addr *addrp)
--{
--	static char buf[20];
--	const unsigned char *bytep;
--
--	bytep = (const unsigned char *) &(addrp->s_addr);
--	sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
--	return buf;
--}
--
--static char *
--addr_to_host(const struct in_addr *addr)
--{
--	struct hostent *host;
--
--	if ((host = gethostbyaddr((char *) addr,
--					sizeof(struct in_addr), AF_INET)) != NULL)
--		return (char *) host->h_name;
--
--	return (char *) NULL;
--}
--
--static char *
--addr_to_network(const struct in_addr *addr)
--{
--	struct netent *net;
--
--	if ((net = getnetbyaddr((long) ntohl(addr->s_addr), AF_INET)) != NULL)
--		return (char *) net->n_name;
--
--	return (char *) NULL;
--}
--
--static char *
--addr_to_anyname(const struct in_addr *addr)
--{
--	char *name;
--
--	if ((name = addr_to_host(addr)) != NULL ||
--		(name = addr_to_network(addr)) != NULL)
--		return name;
--
--	return addr_to_dotted(addr);
--}
--
--static char *
--mask_to_dotted(const struct in_addr *mask)
--{
--	int i;
--	static char buf[22];
--	u_int32_t maskaddr, bits;
--
--	maskaddr = ntohl(mask->s_addr);
--
--	if (maskaddr == 0xFFFFFFFFL)
--		/* we don't want to see "/32" */
--		return "";
--
--	i = 32;
--	bits = 0xFFFFFFFEL;
--	while (--i >= 0 && maskaddr != bits)
--		bits <<= 1;
--	if (i >= 0)
--		sprintf(buf, "/%d", i);
--	else
--		/* mask was not a decent combination of 1's and 0's */
--		snprintf(buf, sizeof(buf), "/%s", addr_to_dotted(mask));
--
--	return buf;
--}
--
- static bool need_devaddr(struct arpt_devaddr_info *info)
- {
- 	int i;
-@@ -403,7 +331,6 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 				       unsigned int format)
- {
- 	const struct arpt_entry *fw = &cs->arp;
--	char buf[BUFSIZ];
- 	char iface[IFNAMSIZ+2];
- 	const char *sep = "";
- 	int print_iface = 0;
-@@ -450,15 +377,10 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- 	}
- 
- 	if (fw->arp.smsk.s_addr != 0L) {
--		printf("%s%s", sep, fw->arp.invflags & IPT_INV_SRCIP
--			? "! " : "");
--		if (format & FMT_NUMERIC)
--			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
--		else
--			sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
--		strncat(buf, mask_to_dotted(&(fw->arp.smsk)),
--			sizeof(buf) - strlen(buf) - 1);
--		printf("-s %s", buf);
-+		printf("%s%s-s %s", sep,
-+		       fw->arp.invflags & IPT_INV_SRCIP ? "! " : "",
-+		       ipv4_addr_to_string(&fw->arp.src,
-+					   &fw->arp.smsk, format));
- 		sep = " ";
- 	}
- 
-@@ -476,15 +398,10 @@ static void nft_arp_print_rule_details(const struct iptables_command_state *cs,
- after_devsrc:
- 
- 	if (fw->arp.tmsk.s_addr != 0L) {
--		printf("%s%s", sep, fw->arp.invflags & IPT_INV_DSTIP
--			? "! " : "");
--		if (format & FMT_NUMERIC)
--			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
--		else
--			sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
--		strncat(buf, mask_to_dotted(&(fw->arp.tmsk)),
--			sizeof(buf) - strlen(buf) - 1);
--		printf("-d %s", buf);
-+		printf("%s%s-d %s", sep,
-+		       fw->arp.invflags & IPT_INV_DSTIP ? "! " : "",
-+		       ipv4_addr_to_string(&fw->arp.tgt,
-+					   &fw->arp.tmsk, format));
- 		sep = " ";
- 	}
- 
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index fe37c30a085d6..3bcf24735c8fb 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -545,9 +545,9 @@ void debug_print_argv(struct argv_store *store)
- }
- #endif
- 
--static const char *ipv4_addr_to_string(const struct in_addr *addr,
--				       const struct in_addr *mask,
--				       unsigned int format)
-+const char *ipv4_addr_to_string(const struct in_addr *addr,
-+				const struct in_addr *mask,
-+				unsigned int format)
- {
- 	static char buf[BUFSIZ];
- 
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 9159b2b1f3768..1e86aba8b2375 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -206,6 +206,9 @@ void debug_print_argv(struct argv_store *store);
- #  define debug_print_argv(...) /* nothing */
- #endif
- 
-+const char *ipv4_addr_to_string(const struct in_addr *addr,
-+				const struct in_addr *mask,
-+				unsigned int format);
- void print_ipv4_addresses(const struct ipt_entry *fw, unsigned int format);
- void print_ipv6_addresses(const struct ip6t_entry *fw6, unsigned int format);
- 
--- 
-2.40.0
-

SOURCES/0039-extensions-SECMARK-Implement-revision-1.patch

@@ -1,177 +0,0 @@
-From b16a9bc7fa224139763686d3ecc1741b891ac6ce Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 29 Apr 2021 15:28:59 +0200
-Subject: [PATCH] extensions: SECMARK: Implement revision 1
-
-The changed data structure for communication with kernel allows to
-exclude the field 'secid' which is populated on kernel side. Thus
-this fixes the formerly always failing extension comparison breaking
-rule check and rule delete by content.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 616800af0da86d151cb695f1376d5ec6ede6fa72)
----
- extensions/libxt_SECMARK.c           | 90 +++++++++++++++++++++-------
- extensions/libxt_SECMARK.t           |  4 ++
- include/linux/netfilter/xt_SECMARK.h |  6 ++
- 3 files changed, 80 insertions(+), 20 deletions(-)
- create mode 100644 extensions/libxt_SECMARK.t
-
-diff --git a/extensions/libxt_SECMARK.c b/extensions/libxt_SECMARK.c
-index 6ba8606355daa..24249bd618ffe 100644
---- a/extensions/libxt_SECMARK.c
-+++ b/extensions/libxt_SECMARK.c
-@@ -29,6 +29,13 @@ static const struct xt_option_entry SECMARK_opts[] = {
- 	XTOPT_TABLEEND,
- };
- 
-+static const struct xt_option_entry SECMARK_opts_v1[] = {
-+	{.name = "selctx", .id = O_SELCTX, .type = XTTYPE_STRING,
-+	 .flags = XTOPT_MAND | XTOPT_PUT,
-+	 XTOPT_POINTER(struct xt_secmark_target_info_v1, secctx)},
-+	XTOPT_TABLEEND,
-+};
-+
- static void SECMARK_parse(struct xt_option_call *cb)
- {
- 	struct xt_secmark_target_info *info = cb->data;
-@@ -37,15 +44,23 @@ static void SECMARK_parse(struct xt_option_call *cb)
- 	info->mode = SECMARK_MODE_SEL;
- }
- 
--static void print_secmark(const struct xt_secmark_target_info *info)
-+static void SECMARK_parse_v1(struct xt_option_call *cb)
-+{
-+	struct xt_secmark_target_info_v1 *info = cb->data;
-+
-+	xtables_option_parse(cb);
-+	info->mode = SECMARK_MODE_SEL;
-+}
-+
-+static void print_secmark(__u8 mode, const char *secctx)
- {
--	switch (info->mode) {
-+	switch (mode) {
- 	case SECMARK_MODE_SEL:
--		printf("selctx %s", info->secctx);
-+		printf("selctx %s", secctx);
- 		break;
--	
-+
- 	default:
--		xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
-+		xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", mode);
- 	}
- }
- 
-@@ -56,7 +71,17 @@ static void SECMARK_print(const void *ip, const struct xt_entry_target *target,
- 		(struct xt_secmark_target_info*)(target)->data;
- 
- 	printf(" SECMARK ");
--	print_secmark(info);
-+	print_secmark(info->mode, info->secctx);
-+}
-+
-+static void SECMARK_print_v1(const void *ip,
-+			     const struct xt_entry_target *target, int numeric)
-+{
-+	const struct xt_secmark_target_info_v1 *info =
-+		(struct xt_secmark_target_info_v1 *)(target)->data;
-+
-+	printf(" SECMARK ");
-+	print_secmark(info->mode, info->secctx);
- }
- 
- static void SECMARK_save(const void *ip, const struct xt_entry_target *target)
-@@ -65,24 +90,49 @@ static void SECMARK_save(const void *ip, const struct xt_entry_target *target)
- 		(struct xt_secmark_target_info*)target->data;
- 
- 	printf(" --");
--	print_secmark(info);
-+	print_secmark(info->mode, info->secctx);
- }
- 
--static struct xtables_target secmark_target = {
--	.family		= NFPROTO_UNSPEC,
--	.name		= "SECMARK",
--	.version	= XTABLES_VERSION,
--	.revision	= 0,
--	.size		= XT_ALIGN(sizeof(struct xt_secmark_target_info)),
--	.userspacesize	= XT_ALIGN(sizeof(struct xt_secmark_target_info)),
--	.help		= SECMARK_help,
--	.print		= SECMARK_print,
--	.save		= SECMARK_save,
--	.x6_parse	= SECMARK_parse,
--	.x6_options	= SECMARK_opts,
-+static void SECMARK_save_v1(const void *ip,
-+			    const struct xt_entry_target *target)
-+{
-+	const struct xt_secmark_target_info_v1 *info =
-+		(struct xt_secmark_target_info_v1 *)target->data;
-+
-+	printf(" --");
-+	print_secmark(info->mode, info->secctx);
-+}
-+
-+static struct xtables_target secmark_tg_reg[] = {
-+	{
-+		.family		= NFPROTO_UNSPEC,
-+		.name		= "SECMARK",
-+		.version	= XTABLES_VERSION,
-+		.revision	= 0,
-+		.size		= XT_ALIGN(sizeof(struct xt_secmark_target_info)),
-+		.userspacesize	= XT_ALIGN(sizeof(struct xt_secmark_target_info)),
-+		.help		= SECMARK_help,
-+		.print		= SECMARK_print,
-+		.save		= SECMARK_save,
-+		.x6_parse	= SECMARK_parse,
-+		.x6_options	= SECMARK_opts,
-+	},
-+	{
-+		.family		= NFPROTO_UNSPEC,
-+		.name		= "SECMARK",
-+		.version	= XTABLES_VERSION,
-+		.revision	= 1,
-+		.size		= XT_ALIGN(sizeof(struct xt_secmark_target_info_v1)),
-+		.userspacesize	= XT_ALIGN(offsetof(struct xt_secmark_target_info_v1, secid)),
-+		.help		= SECMARK_help,
-+		.print		= SECMARK_print_v1,
-+		.save		= SECMARK_save_v1,
-+		.x6_parse	= SECMARK_parse_v1,
-+		.x6_options	= SECMARK_opts_v1,
-+	}
- };
- 
- void _init(void)
- {
--	xtables_register_target(&secmark_target);
-+	xtables_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
- }
-diff --git a/extensions/libxt_SECMARK.t b/extensions/libxt_SECMARK.t
-new file mode 100644
-index 0000000000000..39d4c09348bf4
---- /dev/null
-+++ b/extensions/libxt_SECMARK.t
-@@ -0,0 +1,4 @@
-+:INPUT,FORWARD,OUTPUT
-+*security
-+-j SECMARK --selctx system_u:object_r:firewalld_exec_t:s0;=;OK
-+-j SECMARK;;FAIL
-diff --git a/include/linux/netfilter/xt_SECMARK.h b/include/linux/netfilter/xt_SECMARK.h
-index 989092bd6274b..31760a286a854 100644
---- a/include/linux/netfilter/xt_SECMARK.h
-+++ b/include/linux/netfilter/xt_SECMARK.h
-@@ -19,4 +19,10 @@ struct xt_secmark_target_info {
- 	char secctx[SECMARK_SECCTX_MAX];
- };
- 
-+struct xt_secmark_target_info_v1 {
-+	__u8 mode;
-+	char secctx[SECMARK_SECCTX_MAX];
-+	__u32 secid;
-+};
-+
- #endif /*_XT_SECMARK_H_target */
--- 
-2.40.0
-

SOURCES/0040-Use-proto_to_name-from-xshared-in-more-places.patch

@@ -1,156 +0,0 @@
-From adc559b69fc2b8d95a7c3bae96ca12faa0ba5d1d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 17 Nov 2020 00:57:10 +0100
-Subject: [PATCH] Use proto_to_name() from xshared in more places
-
-Share the common proto name lookup code. While being at it, make proto
-number variable 16bit, values may exceed 256.
-
-This aligns iptables-nft '-p' argument printing with legacy iptables. In
-practice, this should make a difference only in corner cases.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 556f704458cdb509d395ddb7d2629987d60e762e)
----
- include/xtables.h     |  2 +-
- iptables/ip6tables.c  | 22 +++++-----------------
- iptables/iptables.c   | 20 +++++---------------
- iptables/nft-shared.c |  6 +++---
- iptables/xshared.c    |  2 +-
- iptables/xshared.h    |  2 +-
- 6 files changed, 16 insertions(+), 38 deletions(-)
-
-diff --git a/include/xtables.h b/include/xtables.h
-index 5044dd08e86d3..a7b36979398ba 100644
---- a/include/xtables.h
-+++ b/include/xtables.h
-@@ -395,7 +395,7 @@ struct xtables_rule_match {
-  */
- struct xtables_pprot {
- 	const char *name;
--	uint8_t num;
-+	uint16_t num;
- };
- 
- enum xtables_tryload {
-diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index c95355b091568..ce01ce8c04af6 100644
---- a/iptables/ip6tables.c
-+++ b/iptables/ip6tables.c
-@@ -796,28 +796,16 @@ print_iface(char letter, const char *iface, const unsigned char *mask,
- 	}
- }
- 
--/* The ip6tables looks up the /etc/protocols. */
- static void print_proto(uint16_t proto, int invert)
- {
- 	if (proto) {
--		unsigned int i;
-+		const char *pname = proto_to_name(proto, 0);
- 		const char *invertstr = invert ? " !" : "";
- 
--		const struct protoent *pent = getprotobynumber(proto);
--		if (pent) {
--			printf("%s -p %s",
--			       invertstr, pent->p_name);
--			return;
--		}
--
--		for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
--			if (xtables_chain_protos[i].num == proto) {
--				printf("%s -p %s",
--				       invertstr, xtables_chain_protos[i].name);
--				return;
--			}
--
--		printf("%s -p %u", invertstr, proto);
-+		if (pname)
-+			printf("%s -p %s", invertstr, pname);
-+		else
-+			printf("%s -p %u", invertstr, proto);
- 	}
- }
- 
-diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 7d6183116d265..514238d924780 100644
---- a/iptables/iptables.c
-+++ b/iptables/iptables.c
-@@ -764,23 +764,13 @@ list_entries(const xt_chainlabel chain, int rulenum, int verbose, int numeric,
- static void print_proto(uint16_t proto, int invert)
- {
- 	if (proto) {
--		unsigned int i;
-+		const char *pname = proto_to_name(proto, 0);
- 		const char *invertstr = invert ? " !" : "";
- 
--		const struct protoent *pent = getprotobynumber(proto);
--		if (pent) {
--			printf("%s -p %s", invertstr, pent->p_name);
--			return;
--		}
--
--		for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
--			if (xtables_chain_protos[i].num == proto) {
--				printf("%s -p %s",
--				       invertstr, xtables_chain_protos[i].name);
--				return;
--			}
--
--		printf("%s -p %u", invertstr, proto);
-+		if (pname)
-+			printf("%s -p %s", invertstr, pname);
-+		else
-+			printf("%s -p %u", invertstr, proto);
- 	}
- }
- 
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index c1664b50f9383..4253b08196d29 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -826,13 +826,13 @@ void save_rule_details(const struct iptables_command_state *cs,
- 	}
- 
- 	if (proto > 0) {
--		const struct protoent *pent = getprotobynumber(proto);
-+		const char *pname = proto_to_name(proto, 0);
- 
- 		if (invflags & XT_INV_PROTO)
- 			printf("! ");
- 
--		if (pent)
--			printf("-p %s ", pent->p_name);
-+		if (pname)
-+			printf("-p %s ", pname);
- 		else
- 			printf("-p %u ", proto);
- 	}
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 3bcf24735c8fb..9a17a8fdf11cd 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -48,7 +48,7 @@ void print_extension_helps(const struct xtables_target *t,
- }
- 
- const char *
--proto_to_name(uint8_t proto, int nolookup)
-+proto_to_name(uint16_t proto, int nolookup)
- {
- 	unsigned int i;
- 
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 1e86aba8b2375..7c881c56a25da 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -152,7 +152,7 @@ enum {
- 
- extern void print_extension_helps(const struct xtables_target *,
- 	const struct xtables_rule_match *);
--extern const char *proto_to_name(uint8_t, int);
-+extern const char *proto_to_name(uint16_t, int);
- extern int command_default(struct iptables_command_state *,
- 	struct xtables_globals *);
- extern struct xtables_match *load_proto(struct iptables_command_state *);
--- 
-2.40.0
-

SOURCES/0041-extensions-sctp-Fix-nftables-translation.patch

@@ -1,80 +0,0 @@
-From 867ccfc5a9394b8a0957db9f2828befb7efabd7c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 4 May 2021 16:03:24 +0200
-Subject: [PATCH] extensions: sctp: Fix nftables translation
-
-If both sport and dport was present, incorrect nft syntax was generated.
-
-Fixes: defc7bd2bac89 ("extensions: libxt_sctp: Add translation to nft")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit a61282ec6a1697bfb40f19d13a28a74559050167)
----
- extensions/libxt_sctp.c      | 10 ++++------
- extensions/libxt_sctp.txlate | 10 +++++-----
- 2 files changed, 9 insertions(+), 11 deletions(-)
-
-diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
-index 140de2653b1ef..ee4e99ebf11bf 100644
---- a/extensions/libxt_sctp.c
-+++ b/extensions/libxt_sctp.c
-@@ -495,15 +495,13 @@ static int sctp_xlate(struct xt_xlate *xl,
- 	if (!einfo->flags)
- 		return 0;
- 
--	xt_xlate_add(xl, "sctp ");
--
- 	if (einfo->flags & XT_SCTP_SRC_PORTS) {
- 		if (einfo->spts[0] != einfo->spts[1])
--			xt_xlate_add(xl, "sport%s %u-%u",
-+			xt_xlate_add(xl, "sctp sport%s %u-%u",
- 				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
- 				     einfo->spts[0], einfo->spts[1]);
- 		else
--			xt_xlate_add(xl, "sport%s %u",
-+			xt_xlate_add(xl, "sctp sport%s %u",
- 				     einfo->invflags & XT_SCTP_SRC_PORTS ? " !=" : "",
- 				     einfo->spts[0]);
- 		space = " ";
-@@ -511,11 +509,11 @@ static int sctp_xlate(struct xt_xlate *xl,
- 
- 	if (einfo->flags & XT_SCTP_DEST_PORTS) {
- 		if (einfo->dpts[0] != einfo->dpts[1])
--			xt_xlate_add(xl, "%sdport%s %u-%u", space,
-+			xt_xlate_add(xl, "%ssctp dport%s %u-%u", space,
- 				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
- 				     einfo->dpts[0], einfo->dpts[1]);
- 		else
--			xt_xlate_add(xl, "%sdport%s %u", space,
-+			xt_xlate_add(xl, "%ssctp dport%s %u", space,
- 				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
- 				     einfo->dpts[0]);
- 	}
-diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate
-index 72f4641ab021c..0d6c59e183675 100644
---- a/extensions/libxt_sctp.txlate
-+++ b/extensions/libxt_sctp.txlate
-@@ -23,16 +23,16 @@ iptables-translate -A INPUT -p sctp ! --dport 50:56 -j ACCEPT
- nft add rule ip filter INPUT sctp dport != 50-56 counter accept
- 
- iptables-translate -A INPUT -p sctp --dport 80 --sport 50 -j ACCEPT
--nft add rule ip filter INPUT sctp sport 50 dport 80 counter accept
-+nft add rule ip filter INPUT sctp sport 50 sctp dport 80 counter accept
- 
- iptables-translate -A INPUT -p sctp --dport 80:100 --sport 50 -j ACCEPT
--nft add rule ip filter INPUT sctp sport 50 dport 80-100 counter accept
-+nft add rule ip filter INPUT sctp sport 50 sctp dport 80-100 counter accept
- 
- iptables-translate -A INPUT -p sctp --dport 80 --sport 50:55 -j ACCEPT
--nft add rule ip filter INPUT sctp sport 50-55 dport 80 counter accept
-+nft add rule ip filter INPUT sctp sport 50-55 sctp dport 80 counter accept
- 
- iptables-translate -A INPUT -p sctp ! --dport 80:100 --sport 50 -j ACCEPT
--nft add rule ip filter INPUT sctp sport 50 dport != 80-100 counter accept
-+nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept
- 
- iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT
--nft add rule ip filter INPUT sctp sport != 50-55 dport 80 counter accept
-+nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept
--- 
-2.40.0
-

SOURCES/0042-extensions-sctp-Translate-chunk-types-option.patch

@@ -1,159 +0,0 @@
-From 448d1ff5807a52ec34759a6dddd348c5f3e96704 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 4 May 2021 16:26:42 +0200
-Subject: [PATCH] extensions: sctp: Translate --chunk-types option
-
-The translation is not fully complete as it is not possible to map 'any'
-match type into nft syntax with a single rule. Also, 'only' match type
-translation is a bit poor as it explicitly lists all chunk types that
-are supposed to be missing.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 5818be177110a09120dd8fe4bd2533acbf8da301)
----
- extensions/libxt_sctp.c      | 91 ++++++++++++++++++++++++++++--------
- extensions/libxt_sctp.txlate |  6 +++
- 2 files changed, 78 insertions(+), 19 deletions(-)
-
-diff --git a/extensions/libxt_sctp.c b/extensions/libxt_sctp.c
-index ee4e99ebf11bf..5d8ab85cacf42 100644
---- a/extensions/libxt_sctp.c
-+++ b/extensions/libxt_sctp.c
-@@ -92,28 +92,29 @@ struct sctp_chunk_names {
- 	const char *name;
- 	unsigned int chunk_type;
- 	const char *valid_flags;
-+	const char *nftname;
- };
- 
- /*'ALL' and 'NONE' will be treated specially. */
- static const struct sctp_chunk_names sctp_chunk_names[]
--= { { .name = "DATA", 		.chunk_type = 0,   .valid_flags = "----IUBE"},
--    { .name = "INIT", 		.chunk_type = 1,   .valid_flags = "--------"},
--    { .name = "INIT_ACK", 	.chunk_type = 2,   .valid_flags = "--------"},
--    { .name = "SACK",		.chunk_type = 3,   .valid_flags = "--------"},
--    { .name = "HEARTBEAT",	.chunk_type = 4,   .valid_flags = "--------"},
--    { .name = "HEARTBEAT_ACK",	.chunk_type = 5,   .valid_flags = "--------"},
--    { .name = "ABORT",		.chunk_type = 6,   .valid_flags = "-------T"},
--    { .name = "SHUTDOWN",	.chunk_type = 7,   .valid_flags = "--------"},
--    { .name = "SHUTDOWN_ACK",	.chunk_type = 8,   .valid_flags = "--------"},
--    { .name = "ERROR",		.chunk_type = 9,   .valid_flags = "--------"},
--    { .name = "COOKIE_ECHO",	.chunk_type = 10,  .valid_flags = "--------"},
--    { .name = "COOKIE_ACK",	.chunk_type = 11,  .valid_flags = "--------"},
--    { .name = "ECN_ECNE",	.chunk_type = 12,  .valid_flags = "--------"},
--    { .name = "ECN_CWR",	.chunk_type = 13,  .valid_flags = "--------"},
--    { .name = "SHUTDOWN_COMPLETE", .chunk_type = 14,  .valid_flags = "-------T"},
--    { .name = "ASCONF",		.chunk_type = 193,  .valid_flags = "--------"},
--    { .name = "ASCONF_ACK",	.chunk_type = 128,  .valid_flags = "--------"},
--    { .name = "FORWARD_TSN",	.chunk_type = 192,  .valid_flags = "--------"},
-+= { { .name = "DATA", 		.chunk_type = 0,   .valid_flags = "----IUBE", .nftname = "data" },
-+    { .name = "INIT", 		.chunk_type = 1,   .valid_flags = "--------", .nftname = "init" },
-+    { .name = "INIT_ACK", 	.chunk_type = 2,   .valid_flags = "--------", .nftname = "init-ack" },
-+    { .name = "SACK",		.chunk_type = 3,   .valid_flags = "--------", .nftname = "sack" },
-+    { .name = "HEARTBEAT",	.chunk_type = 4,   .valid_flags = "--------", .nftname = "heartbeat" },
-+    { .name = "HEARTBEAT_ACK",	.chunk_type = 5,   .valid_flags = "--------", .nftname = "heartbeat-ack" },
-+    { .name = "ABORT",		.chunk_type = 6,   .valid_flags = "-------T", .nftname = "abort" },
-+    { .name = "SHUTDOWN",	.chunk_type = 7,   .valid_flags = "--------", .nftname = "shutdown" },
-+    { .name = "SHUTDOWN_ACK",	.chunk_type = 8,   .valid_flags = "--------", .nftname = "shutdown-ack" },
-+    { .name = "ERROR",		.chunk_type = 9,   .valid_flags = "--------", .nftname = "error" },
-+    { .name = "COOKIE_ECHO",	.chunk_type = 10,  .valid_flags = "--------", .nftname = "cookie-echo" },
-+    { .name = "COOKIE_ACK",	.chunk_type = 11,  .valid_flags = "--------", .nftname = "cookie-ack" },
-+    { .name = "ECN_ECNE",	.chunk_type = 12,  .valid_flags = "--------", .nftname = "ecne" },
-+    { .name = "ECN_CWR",	.chunk_type = 13,  .valid_flags = "--------", .nftname = "cwr" },
-+    { .name = "SHUTDOWN_COMPLETE", .chunk_type = 14,  .valid_flags = "-------T", .nftname = "shutdown-complete" },
-+    { .name = "ASCONF",		.chunk_type = 193,  .valid_flags = "--------", .nftname = "asconf" },
-+    { .name = "ASCONF_ACK",	.chunk_type = 128,  .valid_flags = "--------", .nftname = "asconf-ack" },
-+    { .name = "FORWARD_TSN",	.chunk_type = 192,  .valid_flags = "--------", .nftname = "forward-tsn" },
- };
- 
- static void
-@@ -485,12 +486,52 @@ static void sctp_save(const void *ip, const struct xt_entry_match *match)
- 	}
- }
- 
-+static const char *sctp_xlate_chunk(struct xt_xlate *xl, const char *space,
-+				    const struct xt_sctp_info *einfo,
-+				    const struct sctp_chunk_names *scn)
-+{
-+	bool inv = einfo->invflags & XT_SCTP_CHUNK_TYPES;
-+	const struct xt_sctp_flag_info *flag_info = NULL;
-+	int i;
-+
-+	if (!scn->nftname)
-+		return space;
-+
-+	if (!SCTP_CHUNKMAP_IS_SET(einfo->chunkmap, scn->chunk_type)) {
-+		if (einfo->chunk_match_type != SCTP_CHUNK_MATCH_ONLY)
-+			return space;
-+
-+		xt_xlate_add(xl, "%ssctp chunk %s %s", space,
-+			     scn->nftname, inv ? "exists" : "missing");
-+		return " ";
-+	}
-+
-+	for (i = 0; i < einfo->flag_count; i++) {
-+		if (einfo->flag_info[i].chunktype == scn->chunk_type) {
-+			flag_info = &einfo->flag_info[i];
-+			break;
-+		}
-+	}
-+
-+	if (!flag_info) {
-+		xt_xlate_add(xl, "%ssctp chunk %s %s", space,
-+			     scn->nftname, inv ? "missing" : "exists");
-+		return " ";
-+	}
-+
-+	xt_xlate_add(xl, "%ssctp chunk %s flags & 0x%x %s 0x%x", space,
-+		     scn->nftname, flag_info->flag_mask,
-+		     inv ? "!=" : "==", flag_info->flag);
-+
-+	return " ";
-+}
-+
- static int sctp_xlate(struct xt_xlate *xl,
- 		      const struct xt_xlate_mt_params *params)
- {
- 	const struct xt_sctp_info *einfo =
- 		(const struct xt_sctp_info *)params->match->data;
--	char *space = "";
-+	const char *space = "";
- 
- 	if (!einfo->flags)
- 		return 0;
-@@ -516,6 +557,18 @@ static int sctp_xlate(struct xt_xlate *xl,
- 			xt_xlate_add(xl, "%ssctp dport%s %u", space,
- 				     einfo->invflags & XT_SCTP_DEST_PORTS ? " !=" : "",
- 				     einfo->dpts[0]);
-+		space = " ";
-+	}
-+
-+	if (einfo->flags & XT_SCTP_CHUNK_TYPES) {
-+		int i;
-+
-+		if (einfo->chunk_match_type == SCTP_CHUNK_MATCH_ANY)
-+			return 0;
-+
-+		for (i = 0; i < ARRAY_SIZE(sctp_chunk_names); i++)
-+			space = sctp_xlate_chunk(xl, space, einfo,
-+						 &sctp_chunk_names[i]);
- 	}
- 
- 	return 1;
-diff --git a/extensions/libxt_sctp.txlate b/extensions/libxt_sctp.txlate
-index 0d6c59e183675..bb817525db8d8 100644
---- a/extensions/libxt_sctp.txlate
-+++ b/extensions/libxt_sctp.txlate
-@@ -36,3 +36,9 @@ nft add rule ip filter INPUT sctp sport 50 sctp dport != 80-100 counter accept
- 
- iptables-translate -A INPUT -p sctp --dport 80 ! --sport 50:55 -j ACCEPT
- nft add rule ip filter INPUT sctp sport != 50-55 sctp dport 80 counter accept
-+
-+iptables-translate -A INPUT -p sctp --chunk-types all INIT,DATA:iUbE,SACK,ABORT:T -j ACCEPT
-+nft add rule ip filter INPUT sctp chunk data flags & 0xf == 0x5 sctp chunk init exists sctp chunk sack exists sctp chunk abort flags & 0x1 == 0x1 counter accept
-+
-+iptables-translate -A INPUT -p sctp --chunk-types only SHUTDOWN_COMPLETE -j ACCEPT
-+nft add rule ip filter INPUT sctp chunk data missing sctp chunk init missing sctp chunk init-ack missing sctp chunk sack missing sctp chunk heartbeat missing sctp chunk heartbeat-ack missing sctp chunk abort missing sctp chunk shutdown missing sctp chunk shutdown-ack missing sctp chunk error missing sctp chunk cookie-echo missing sctp chunk cookie-ack missing sctp chunk ecne missing sctp chunk cwr missing sctp chunk shutdown-complete exists sctp chunk asconf missing sctp chunk asconf-ack missing sctp chunk forward-tsn missing counter accept
--- 
-2.40.0
-

SOURCES/0043-libxtables-Drop-leftover-variable-in-xtables_numeric.patch

@@ -1,33 +0,0 @@
-From e9dd197e783556dcb514ec624c4f6efeb782e7c7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 13 Nov 2020 21:04:39 +0100
-Subject: [PATCH] libxtables: Drop leftover variable in
- xtables_numeric_to_ip6addr()
-
-Variable 'err' was only used in removed debug code, so drop it as well.
-
-Fixes: 7f526c9373c17 ("libxtables: xtables: remove unnecessary debug code")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 97fabae738a74bd04a7793e1199cd2b8a69122bc)
----
- libxtables/xtables.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 7152c6576cd63..7f40b6f1b327b 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -1812,9 +1812,8 @@ const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp)
- struct in6_addr *xtables_numeric_to_ip6addr(const char *num)
- {
- 	static struct in6_addr ap;
--	int err;
- 
--	if ((err = inet_pton(AF_INET6, num, &ap)) == 1)
-+	if (inet_pton(AF_INET6, num, &ap) == 1)
- 		return &ap;
- 
- 	return NULL;
--- 
-2.40.0
-

SOURCES/0044-extensions-libebt_ip6-Drop-unused-variables.patch

@@ -1,49 +0,0 @@
-From 89bd91cfdf6f81971324dca1b0df7c6c5537a2ab Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 13 Nov 2020 21:13:50 +0100
-Subject: [PATCH] extensions: libebt_ip6: Drop unused variables
-
-They are being assigned to but never read.
-
-Fixes: 5c8ce9c6aede0 ("ebtables-compat: add 'ip6' match extension")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 8bb5bcae57c83066c224efa5fd29ed4822a766fc)
----
- extensions/libebt_ip6.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/extensions/libebt_ip6.c b/extensions/libebt_ip6.c
-index b8a5a5d8c3a92..301bed9aadefd 100644
---- a/extensions/libebt_ip6.c
-+++ b/extensions/libebt_ip6.c
-@@ -250,9 +250,8 @@ static void brip6_init(struct xt_entry_match *match)
- static struct in6_addr *numeric_to_addr(const char *num)
- {
- 	static struct in6_addr ap;
--	int err;
- 
--	if ((err=inet_pton(AF_INET6, num, &ap)) == 1)
-+	if (inet_pton(AF_INET6, num, &ap) == 1)
- 		return &ap;
- 	return (struct in6_addr *)NULL;
- }
-@@ -292,7 +291,6 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i
- 	char buf[256];
- 	char *p;
- 	int i;
--	int err;
- 
- 	strncpy(buf, address, sizeof(buf) - 1);
- 	/* first the mask */
-@@ -309,7 +307,7 @@ static void ebt_parse_ip6_address(char *address, struct in6_addr *addr, struct i
- 	if (!memcmp(msk, &in6addr_any, sizeof(in6addr_any)))
- 		strcpy(buf, "::");
- 
--	if ((err=inet_pton(AF_INET6, buf, addr)) < 1) {
-+	if (inet_pton(AF_INET6, buf, addr) < 1) {
- 		xtables_error(PARAMETER_PROBLEM, "Invalid IPv6 Address '%s' specified", buf);
- 		return;
- 	}
--- 
-2.40.0
-

SOURCES/0045-libxtables-Fix-memleak-in-xtopt_parse_hostmask.patch

@@ -1,29 +0,0 @@
-From e672c567d978bf99652a8c3681e105d5a212552f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 2 Jun 2021 11:04:30 +0200
-Subject: [PATCH] libxtables: Fix memleak in xtopt_parse_hostmask()
-
-The allocated hostmask duplicate needs to be freed again.
-
-Fixes: 66266abd17adc ("libxtables: XTTYPE_HOSTMASK support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit ffe88f8f01263687e82ef4d3d2bdc0cb5444711e)
----
- libxtables/xtoptions.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c
-index d329f2ff7979e..0dcdf607f4678 100644
---- a/libxtables/xtoptions.c
-+++ b/libxtables/xtoptions.c
-@@ -763,6 +763,7 @@ static void xtopt_parse_hostmask(struct xt_option_call *cb)
- 	cb->arg = p;
- 	xtopt_parse_plenmask(cb);
- 	cb->arg = orig_arg;
-+	free(work);
- }
- 
- static void xtopt_parse_ethermac(struct xt_option_call *cb)
--- 
-2.40.0
-

SOURCES/0046-nft-Avoid-memleak-in-error-path-of-nft_cmd_new.patch

@@ -1,34 +0,0 @@
-From bee29f2820cafde1e04ebef049bc4c40c4dbbe18 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 2 Jun 2021 11:55:20 +0200
-Subject: [PATCH] nft: Avoid memleak in error path of nft_cmd_new()
-
-If rule allocation fails, free the allocated 'cmd' before returning to
-caller.
-
-Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit eab75ed36a4f204ddab0c40ba42c5a300634d5c3)
----
- iptables/nft-cmd.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/iptables/nft-cmd.c b/iptables/nft-cmd.c
-index ed53c061edc6f..fd038503d87e1 100644
---- a/iptables/nft-cmd.c
-+++ b/iptables/nft-cmd.c
-@@ -35,8 +35,10 @@ struct nft_cmd *nft_cmd_new(struct nft_handle *h, int command,
- 
- 	if (state) {
- 		rule = nft_rule_new(h, chain, table, state);
--		if (!rule)
-+		if (!rule) {
-+			nft_cmd_free(cmd);
- 			return NULL;
-+		}
- 
- 		cmd->obj.rule = rule;
- 
--- 
-2.40.0
-

SOURCES/0047-iptables-apply-Drop-unused-variable.patch

@@ -1,29 +0,0 @@
-From 2f80e6d896590f42c932de32ae8c3d597cbf940b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 2 Jun 2021 12:50:57 +0200
-Subject: [PATCH] iptables-apply: Drop unused variable
-
-It was assigned to but never read.
-
-Fixes: b45b4e3903414 ("iptables-apply: script and manpage update")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 084671d5acaaf749648e828c2ed3b319de651764)
----
- iptables/iptables-apply | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/iptables/iptables-apply b/iptables/iptables-apply
-index 4683b1b402d08..3a7df5e3cbc1f 100755
---- a/iptables/iptables-apply
-+++ b/iptables/iptables-apply
-@@ -231,7 +231,6 @@ case "$MODE" in
- 		"$RUNCMD" &
- 		CMD_PID=$!
- 		( sleep "$TIMEOUT"; kill "$CMD_PID" 2>/dev/null; exit 0 ) &
--		CMDTIMEOUT_PID=$!
- 		if ! wait "$CMD_PID"; then
- 			echo "failed."
- 			echo "Error: unknown error running command: $RUNCMD" >&2
--- 
-2.40.0
-

SOURCES/0048-doc-ebtables-nft.8-Adjust-for-missing-atomic-options.patch

@@ -1,130 +0,0 @@
-From 9a617399d5e0776b43f093b9d63d10f72e882fee Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 28 Jul 2021 17:53:53 +0200
-Subject: [PATCH] doc: ebtables-nft.8: Adjust for missing atomic-options
-
-Drop any reference to them (and the environment variable) but list them
-in BUGS section hinting at ebtables-save and -restore tools.
-
-Fixes: 1939cbc25e6f5 ("doc: Adjust ebtables man page")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 765bf04ecc228783cb88c810c85bc0c769579c39)
----
- iptables/ebtables-nft.8 | 64 ++++++-----------------------------------
- 1 file changed, 8 insertions(+), 56 deletions(-)
-
-diff --git a/iptables/ebtables-nft.8 b/iptables/ebtables-nft.8
-index 1fa5ad9388cc0..08e9766f2cc74 100644
---- a/iptables/ebtables-nft.8
-+++ b/iptables/ebtables-nft.8
-@@ -44,12 +44,6 @@ ebtables \- Ethernet bridge frame table administration (nft-based)
- .br
- .BR "ebtables " [ -t " table ] " --init-table
- .br
--.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-commit
--.br
--.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-init
--.br
--.BR "ebtables " [ -t " table ] [" --atomic-file " file] " --atomic-save
--.br
- 
- .SH DESCRIPTION
- .B ebtables
-@@ -149,11 +143,9 @@ a table, the commands apply to the default filter table.
- Only one command may be used on the command line at a time, except when
- the commands
- .BR -L " and " -Z
--are combined, the commands
-+are combined or the commands
- .BR -N " and " -P
--are combined, or when
--.B --atomic-file
--is used.
-+are combined.
- .TP
- .B "-A, --append"
- Append a rule to the end of the selected chain.
-@@ -313,39 +305,6 @@ of the ebtables kernel table.
- .TP
- .B "--init-table"
- Replace the current table data by the initial table data.
--.TP
--.B "--atomic-init"
--Copy the kernel's initial data of the table to the specified
--file. This can be used as the first action, after which rules are added
--to the file. The file can be specified using the
--.B --atomic-file
--command or through the
--.IR EBTABLES_ATOMIC_FILE " environment variable."
--.TP
--.B "--atomic-save"
--Copy the kernel's current data of the table to the specified
--file. This can be used as the first action, after which rules are added
--to the file. The file can be specified using the
--.B --atomic-file
--command or through the
--.IR EBTABLES_ATOMIC_FILE " environment variable."
--.TP
--.B "--atomic-commit"
--Replace the kernel table data with the data contained in the specified
--file. This is a useful command that allows you to load all your rules of a
--certain table into the kernel at once, saving the kernel a lot of precious
--time and allowing atomic updates of the tables. The file which contains
--the table data is constructed by using either the
--.B "--atomic-init"
--or the
--.B "--atomic-save"
--command to generate a starting file. After that, using the
--.B "--atomic-file"
--command when constructing rules or setting the
--.IR EBTABLES_ATOMIC_FILE " environment variable"
--allows you to extend the file and build the complete table before
--committing it to the kernel. This command can be very useful in boot scripts
--to populate the ebtables tables in a fast way.
- .SS MISCELLANOUS COMMANDS
- .TP
- .B "-V, --version"
-@@ -371,16 +330,6 @@ a target extension (see
- .BR "TARGET EXTENSIONS" ")"
- or a user-defined chain name.
- .TP
--.B --atomic-file "\fIfile\fP"
--Let the command operate on the specified
--.IR file .
--The data of the table to
--operate on will be extracted from the file and the result of the operation
--will be saved back into the file. If specified, this option should come
--before the command specification. An alternative that should be preferred,
--is setting the
--.IR EBTABLES_ATOMIC_FILE " environment variable."
--.TP
- .B -M, --modprobe "\fIprogram\fP"
- When talking to the kernel, use this
- .I program
-@@ -1100,8 +1049,6 @@ arp message and the hardware address length in the arp header is 6 bytes.
- .br
- .SH FILES
- .I /etc/ethertypes
--.SH ENVIRONMENT VARIABLES
--.I EBTABLES_ATOMIC_FILE
- .SH MAILINGLISTS
- .BR "" "See " http://netfilter.org/mailinglists.html
- .SH BUGS
-@@ -1109,7 +1056,12 @@ The version of ebtables this man page ships with does not support the
- .B broute
- table. Also there is no support for
- .B string
--match. And finally, this list is probably not complete.
-+match. Further, support for atomic-options
-+.RB ( --atomic-file ", " --atomic-init ", " --atomic-save ", " --atomic-commit )
-+has not been implemented, although
-+.BR ebtables-save " and " ebtables-restore
-+might replace them entirely given the inherent atomicity of nftables.
-+Finally, this list is probably not complete.
- .SH SEE ALSO
- .BR xtables-nft "(8), " iptables "(8), " ip (8)
- .PP
--- 
-2.40.0
-

SOURCES/0049-ebtables-Dump-atomic-waste.patch

@@ -1,102 +0,0 @@
-From ec0a69df9ac073b1a6e951c08c049fec47a12b5c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 30 Jul 2021 12:25:10 +0200
-Subject: [PATCH] ebtables: Dump atomic waste
-
-With ebtables-nft.8 now educating people about the missing
-functionality, get rid of atomic remains in source code. This eliminates
-mostly comments except for --atomic-commit which was treated as alias of
---init-table. People not using the latter are probably trying to
-atomic-commit from an atomic-file which in turn is not supported, so no
-point keeping it.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 263186372dc4ae6a54a29bea644bcf1fc8dc3fc0)
----
- iptables/xtables-eb.c | 53 -------------------------------------------
- 1 file changed, 53 deletions(-)
-
-diff --git a/iptables/xtables-eb.c b/iptables/xtables-eb.c
-index 6df5839f07436..d07adad2d73c3 100644
---- a/iptables/xtables-eb.c
-+++ b/iptables/xtables-eb.c
-@@ -262,10 +262,6 @@ struct option ebt_original_options[] =
- 	{ "new-chain"      , required_argument, 0, 'N' },
- 	{ "rename-chain"   , required_argument, 0, 'E' },
- 	{ "delete-chain"   , optional_argument, 0, 'X' },
--	{ "atomic-init"    , no_argument      , 0, 7   },
--	{ "atomic-commit"  , no_argument      , 0, 8   },
--	{ "atomic-file"    , required_argument, 0, 9   },
--	{ "atomic-save"    , no_argument      , 0, 10  },
- 	{ "init-table"     , no_argument      , 0, 11  },
- 	{ "concurrent"     , no_argument      , 0, 13  },
- 	{ 0 }
-@@ -371,10 +367,6 @@ static void print_help(const struct xtables_target *t,
- "--new-chain -N chain          : create a user defined chain\n"
- "--rename-chain -E old new     : rename a chain\n"
- "--delete-chain -X [chain]     : delete a user defined chain\n"
--"--atomic-commit               : update the kernel w/t table contained in <FILE>\n"
--"--atomic-init                 : put the initial kernel table into <FILE>\n"
--"--atomic-save                 : put the current kernel table into <FILE>\n"
--"--atomic-file file            : set <FILE> to file\n\n"
- "Options:\n"
- "--proto  -p [!] proto         : protocol hexadecimal, by name or LENGTH\n"
- "--src    -s [!] address[/mask]: source mac address\n"
-@@ -1135,54 +1127,9 @@ int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
- 					       "Use --Lmac2 with -L");
- 			flags |= LIST_MAC2;
- 			break;
--		case 8 : /* atomic-commit */
--/*
--			replace->command = c;
--			if (OPT_COMMANDS)
--				ebt_print_error2("Multiple commands are not allowed");
--			replace->flags |= OPT_COMMAND;
--			if (!replace->filename)
--				ebt_print_error2("No atomic file specified");*/
--			/* Get the information from the file */
--			/*ebt_get_table(replace, 0);*/
--			/* We don't want the kernel giving us its counters,
--			 * they would overwrite the counters extracted from
--			 * the file */
--			/*replace->num_counters = 0;*/
--			/* Make sure the table will be written to the kernel */
--			/*free(replace->filename);
--			replace->filename = NULL;
--			break;*/
--		/*case 7 :*/ /* atomic-init */
--		/*case 10:*/ /* atomic-save */
- 		case 11: /* init-table */
- 			nft_cmd_table_flush(h, *table);
- 			return 1;
--		/*
--			replace->command = c;
--			if (OPT_COMMANDS)
--				ebt_print_error2("Multiple commands are not allowed");
--			if (c != 11 && !replace->filename)
--				ebt_print_error2("No atomic file specified");
--			replace->flags |= OPT_COMMAND;
--			{
--				char *tmp = replace->filename;*/
--
--				/* Get the kernel table */
--				/*replace->filename = NULL;
--				ebt_get_kernel_table(replace, c == 10 ? 0 : 1);
--				replace->filename = tmp;
--			}
--			break;
--		case 9 :*/ /* atomic */
--			/*
--			if (OPT_COMMANDS)
--				ebt_print_error2("--atomic has to come before the command");*/
--			/* A possible memory leak here, but this is not
--			 * executed in daemon mode */
--			/*replace->filename = (char *)malloc(strlen(optarg) + 1);
--			strcpy(replace->filename, optarg);
--			break; */
- 		case 13 :
- 			break;
- 		case 1 :
--- 
-2.40.0
-

SOURCES/0050-nft-Fix-for-non-verbose-check-command.patch

@@ -1,31 +0,0 @@
-From 59c41217b2acc9409ba50a76a40aaa994c83f454 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 3 Aug 2021 10:55:20 +0200
-Subject: [PATCH] nft: Fix for non-verbose check command
-
-Check command was unconditionally verbose since v1.8.5. Make it respect
---verbose option again.
-
-Fixes: a7f1e208cdf9c ("nft: split parsing from netlink commands")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 57d1422dbbc41c36ed2e9f6c67aa040c65a429a0)
----
- iptables/nft.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 7f87d46dcc44c..f8534c6cd56fb 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -3160,7 +3160,7 @@ static int nft_prepare(struct nft_handle *h)
- 		case NFT_COMPAT_RULE_CHECK:
- 			assert_chain_exists(h, cmd->table, cmd->jumpto);
- 			ret = nft_rule_check(h, cmd->chain, cmd->table,
--					     cmd->obj.rule, cmd->rulenum);
-+					     cmd->obj.rule, cmd->verbose);
- 			break;
- 		case NFT_COMPAT_RULE_ZERO:
- 			ret = nft_rule_zero_counters(h, cmd->chain, cmd->table,
--- 
-2.40.0
-

SOURCES/0051-extensions-hashlimit-Fix-tests-with-HZ-100.patch

@@ -1,41 +0,0 @@
-From 07cfafd077bbd247bf75c0a3399569af58a63915 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 9 Aug 2021 18:48:58 +0200
-Subject: [PATCH] extensions: hashlimit: Fix tests with HZ=100
-
-With the kernel ticking at 100Hz, a limit of 1/day with burst 5 does not
-overflow in kernel, making the test unstable depending on kernel config.
-Change it to not overflow with 1000Hz either by increasing the burst
-value by a factor of 100.
-
-Fixes: fcf9f6f25db11 ("extensions: libxt_hashlimit: add unit test")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit bef9dc575625a98a5e6ed8ca37e49031cdba5937)
----
- extensions/libxt_hashlimit.t | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/extensions/libxt_hashlimit.t b/extensions/libxt_hashlimit.t
-index ccd0d1e6a2a1a..8369933786f68 100644
---- a/extensions/libxt_hashlimit.t
-+++ b/extensions/libxt_hashlimit.t
-@@ -3,14 +3,12 @@
- -m hashlimit --hashlimit-above 1000000/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-above 1/min --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-above 1/hour --hashlimit-burst 5 --hashlimit-name mini1;=;OK
--# kernel says "xt_hashlimit: overflow, try lower: 864000000/5"
---m hashlimit --hashlimit-above 1/day --hashlimit-burst 5 --hashlimit-name mini1;;FAIL
-+-m hashlimit --hashlimit-above 1/day --hashlimit-burst 500 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1000000/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/min --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 5 --hashlimit-name mini1;=;OK
--# kernel says "xt_hashlimit: overflow, try lower: 864000000/5"
---m hashlimit --hashlimit-upto 1/day --hashlimit-burst 5 --hashlimit-name mini1;;FAIL
-+-m hashlimit --hashlimit-upto 1/day --hashlimit-burst 500 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode dstip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
--- 
-2.40.0
-

SOURCES/0052-nft-Use-xtables_malloc-in-mnl_err_list_node_add.patch

@@ -1,31 +0,0 @@
-From 71f9eda379a3d70b5b2cd9327e41ba5446c618e1 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 31 Aug 2021 12:26:20 +0200
-Subject: [PATCH] nft: Use xtables_malloc() in mnl_err_list_node_add()
-
-The function called malloc() without checking for memory allocation
-failure. Simply replace the call by xtables_malloc() to fix that.
-
-Fixes: 4e2020952d6f9 ("xtables: use libnftnl batch API")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit ca11c7b7036b5821c17b8d08dc2a29f55b461a93)
----
- iptables/nft.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index f8534c6cd56fb..ba59cfb8c47af 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -143,7 +143,7 @@ struct mnl_err {
- static void mnl_err_list_node_add(struct list_head *err_list, int error,
- 				  int seqnum)
- {
--	struct mnl_err *err = malloc(sizeof(struct mnl_err));
-+	struct mnl_err *err = xtables_malloc(sizeof(struct mnl_err));
- 
- 	err->seqnum = seqnum;
- 	err->err = error;
--- 
-2.40.0
-

SOURCES/0053-extensions-hashlimit-Fix-tests-with-HZ-1000.patch

@@ -1,47 +0,0 @@
-From c51304d536c3f91b58dc24b14131de157d741a9f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Mon, 8 Nov 2021 17:03:21 +0100
-Subject: [PATCH] extensions: hashlimit: Fix tests with HZ=1000
-
-In an attempt to fix for failing hashlimit tests with HZ=100, the
-expected failures were changed so they are expected to pass and the
-parameters changed to seemingly fix them. Yet while the new parameters
-worked on HZ=100 systems, with higher tick rates they didn't so the
-observed problem moved from the test failing on HZ=100 to failing on
-HZ=1000 instead.
-
-Kernel's error message "try lower: 864000000/5" turned out to be a red
-herring: The burst value does not act as a dividor but a multiplier
-instead, so in order to lower the overflow-checked value, a lower burst
-value must be chosen. Inded, using a burst value of 1 makes the kernel
-accept the rule in both HZ=100 and HZ=1000 configurations.
-
-Fixes: bef9dc575625a ("extensions: hashlimit: Fix tests with HZ=100")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 1eab8e83aec0e6965f11f8cad460add1caeae629)
----
- extensions/libxt_hashlimit.t | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/extensions/libxt_hashlimit.t b/extensions/libxt_hashlimit.t
-index 8369933786f68..206d92935f2e2 100644
---- a/extensions/libxt_hashlimit.t
-+++ b/extensions/libxt_hashlimit.t
-@@ -3,12 +3,12 @@
- -m hashlimit --hashlimit-above 1000000/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-above 1/min --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-above 1/hour --hashlimit-burst 5 --hashlimit-name mini1;=;OK
---m hashlimit --hashlimit-above 1/day --hashlimit-burst 500 --hashlimit-name mini1;=;OK
-+-m hashlimit --hashlimit-above 1/day --hashlimit-burst 1 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1000000/sec --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/min --hashlimit-burst 5 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 5 --hashlimit-name mini1;=;OK
---m hashlimit --hashlimit-upto 1/day --hashlimit-burst 500 --hashlimit-name mini1;=;OK
-+-m hashlimit --hashlimit-upto 1/day --hashlimit-burst 1 --hashlimit-name mini1;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
- -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-mode dstip --hashlimit-name mini1 --hashlimit-htable-expire 2000;=;OK
--- 
-2.40.0
-

SOURCES/0054-xshared-Merge-and-share-parse_chain.patch

@@ -1,164 +0,0 @@
-From 655e919be08b6ca9b5529f16c659ee93572b867d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 5 Apr 2019 13:21:19 +0200
-Subject: [PATCH] xshared: Merge and share parse_chain()
-
-Have a common routine to perform chain name checks, combining all
-variants' requirements.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 1189d830ea4fd269da87761d400ebabca02e1ef3)
-
-Conflicts:
-	iptables/ip6tables.c
-	iptables/xshared.c
--> Context change due to missing commit 9dc50b5b8e441
-   ("xshared: Merge invflags handling code").
----
- iptables/ip6tables.c | 26 --------------------------
- iptables/iptables.c  | 25 -------------------------
- iptables/xshared.c   | 24 ++++++++++++++++++++++++
- iptables/xshared.h   |  1 +
- iptables/xtables.c   |  9 +--------
- 5 files changed, 26 insertions(+), 59 deletions(-)
-
-diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index ce01ce8c04af6..6db91c807bcea 100644
---- a/iptables/ip6tables.c
-+++ b/iptables/ip6tables.c
-@@ -248,32 +248,6 @@ static int is_exthdr(uint16_t proto)
- 		proto == IPPROTO_DSTOPTS);
- }
- 
--static void
--parse_chain(const char *chainname)
--{
--	const char *ptr;
--
--	if (strlen(chainname) >= XT_EXTENSION_MAXNAMELEN)
--		xtables_error(PARAMETER_PROBLEM,
--			   "chain name `%s' too long (must be under %u chars)",
--			   chainname, XT_EXTENSION_MAXNAMELEN);
--
--	if (*chainname == '-' || *chainname == '!')
--		xtables_error(PARAMETER_PROBLEM,
--			   "chain name not allowed to start "
--			   "with `%c'\n", *chainname);
--
--	if (xtables_find_target(chainname, XTF_TRY_LOAD))
--		xtables_error(PARAMETER_PROBLEM,
--			   "chain name may not clash "
--			   "with target name\n");
--
--	for (ptr = chainname; *ptr; ptr++)
--		if (isspace(*ptr))
--			xtables_error(PARAMETER_PROBLEM,
--				   "Invalid chain name `%s'", chainname);
--}
--
- static void
- set_option(unsigned int *options, unsigned int option, uint8_t *invflg,
- 	   int invert)
-diff --git a/iptables/iptables.c b/iptables/iptables.c
-index 514238d924780..a33416a887ed4 100644
---- a/iptables/iptables.c
-+++ b/iptables/iptables.c
-@@ -239,31 +239,6 @@ iptables_exit_error(enum xtables_exittype status, const char *msg, ...)
- 
- /* Christophe Burki wants `-p 6' to imply `-m tcp'.  */
- 
--static void
--parse_chain(const char *chainname)
--{
--	const char *ptr;
--
--	if (strlen(chainname) >= XT_EXTENSION_MAXNAMELEN)
--		xtables_error(PARAMETER_PROBLEM,
--			   "chain name `%s' too long (must be under %u chars)",
--			   chainname, XT_EXTENSION_MAXNAMELEN);
--
--	if (*chainname == '-' || *chainname == '!')
--		xtables_error(PARAMETER_PROBLEM,
--			   "chain name not allowed to start "
--			   "with `%c'\n", *chainname);
--
--	if (xtables_find_target(chainname, XTF_TRY_LOAD))
--		xtables_error(PARAMETER_PROBLEM,
--			   "chain name may not clash "
--			   "with target name\n");
--
--	for (ptr = chainname; *ptr; ptr++)
--		if (isspace(*ptr))
--			xtables_error(PARAMETER_PROBLEM,
--				   "Invalid chain name `%s'", chainname);
--}
- 
- static void
- set_option(unsigned int *options, unsigned int option, uint8_t *invflg,
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 9a17a8fdf11cd..5ae158908b109 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -848,3 +848,27 @@ char opt2char(int option)
- 
- 	return *ptr;
- }
-+
-+void parse_chain(const char *chainname)
-+{
-+	const char *ptr;
-+
-+	if (strlen(chainname) >= XT_EXTENSION_MAXNAMELEN)
-+		xtables_error(PARAMETER_PROBLEM,
-+			      "chain name `%s' too long (must be under %u chars)",
-+			      chainname, XT_EXTENSION_MAXNAMELEN);
-+
-+	if (*chainname == '-' || *chainname == '!')
-+		xtables_error(PARAMETER_PROBLEM,
-+			      "chain name not allowed to start with `%c'\n",
-+			      *chainname);
-+
-+	if (xtables_find_target(chainname, XTF_TRY_LOAD))
-+		xtables_error(PARAMETER_PROBLEM,
-+			      "chain name may not clash with target name\n");
-+
-+	for (ptr = chainname; *ptr; ptr++)
-+		if (isspace(*ptr))
-+			xtables_error(PARAMETER_PROBLEM,
-+				      "Invalid chain name `%s'", chainname);
-+}
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 7c881c56a25da..10f6e0b5a0e98 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -223,6 +223,7 @@ char cmd2char(int option);
- void add_command(unsigned int *cmd, const int newcmd,
- 		 const int othercmds, int invert);
- int parse_rulenumber(const char *rule);
-+void parse_chain(const char *chainname);
- 
- void generic_opt_check(int command, int options);
- char opt2char(int option);
-diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 9779bd83d53b3..54f887f80497e 100644
---- a/iptables/xtables.c
-+++ b/iptables/xtables.c
-@@ -587,14 +587,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
- 			break;
- 
- 		case 'N':
--			if (optarg && (*optarg == '-' || *optarg == '!'))
--				xtables_error(PARAMETER_PROBLEM,
--					   "chain name not allowed to start "
--					   "with `%c'\n", *optarg);
--			if (xtables_find_target(optarg, XTF_TRY_LOAD))
--				xtables_error(PARAMETER_PROBLEM,
--					   "chain name may not clash "
--					   "with target name\n");
-+			parse_chain(optarg);
- 			add_command(&p->command, CMD_NEW_CHAIN, CMD_NONE,
- 				    cs->invert);
- 			p->chain = optarg;
--- 
-2.40.0
-

SOURCES/0055-nft-shared-Drop-unused-function-print_proto.patch

@@ -1,58 +0,0 @@
-From e004e9e1d0e7ef4d9756d9f01feef8efef02300b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sat, 6 Nov 2021 01:09:37 +0100
-Subject: [PATCH] nft-shared: Drop unused function print_proto()
-
-The last users vanished back in 2013. There is identical code in
-save_rule_details(), but with only a single user there's not much point
-in keeping the function.
-
-Fixes: cdc78b1d6bd7b ("nft: convert rule into a command state structure")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit cf14b92bc1a3f5040437234dffe5cf6aa59711a5)
----
- iptables/nft-shared.c | 15 ---------------
- iptables/nft-shared.h |  1 -
- 2 files changed, 16 deletions(-)
-
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 4253b08196d29..f270f610a8f67 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -373,21 +373,6 @@ static void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- 		ctx->h->ops->parse_match(match, ctx->cs);
- }
- 
--void print_proto(uint16_t proto, int invert)
--{
--	const struct protoent *pent = getprotobynumber(proto);
--
--	if (invert)
--		printf("! ");
--
--	if (pent) {
--		printf("-p %s ", pent->p_name);
--		return;
--	}
--
--	printf("-p %u ", proto);
--}
--
- void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv)
- {
- 	uint32_t len;
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 6fc81d9ce08ef..519118a2daf6c 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -139,7 +139,6 @@ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
- int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
- 		unsigned char *iniface_mask, char *outiface,
- 		unsigned char *outiface_mask, uint8_t *invflags);
--void print_proto(uint16_t proto, int invert);
- void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
- void nft_rule_to_iptables_command_state(struct nft_handle *h,
- 					const struct nftnl_rule *r,
--- 
-2.40.0
-

SOURCES/0056-xshared-Make-load_proto-static.patch

@@ -1,48 +0,0 @@
-From 9b1dc489369e19ffd78a69de31f4ac653070eaf8 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Sat, 6 Nov 2021 01:32:47 +0100
-Subject: [PATCH] xshared: Make load_proto() static
-
-The last outside users vanished ten years ago.
-
-Fixes: 449cdd6bcc8d1 ("src: combine default_command functions")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 7213561d9d7a17c4db29c867b2607241941dae5a)
-
-Conflicts:
-	iptables/xshared.h
--> Context change due to missing commit 3664249f52030
-   ("xshared: Eliminate iptables_command_state->invert").
----
- iptables/xshared.c | 2 +-
- iptables/xshared.h | 1 -
- 2 files changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 5ae158908b109..26e938309eab3 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -106,7 +106,7 @@ static bool should_load_proto(struct iptables_command_state *cs)
- 	return !cs->proto_used;
- }
- 
--struct xtables_match *load_proto(struct iptables_command_state *cs)
-+static struct xtables_match *load_proto(struct iptables_command_state *cs)
- {
- 	if (!should_load_proto(cs))
- 		return NULL;
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index 10f6e0b5a0e98..d80c8beee1894 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -155,7 +155,6 @@ extern void print_extension_helps(const struct xtables_target *,
- extern const char *proto_to_name(uint16_t, int);
- extern int command_default(struct iptables_command_state *,
- 	struct xtables_globals *);
--extern struct xtables_match *load_proto(struct iptables_command_state *);
- extern int subcmd_main(int, char **, const struct subcommand *);
- extern void xs_init_target(struct xtables_target *);
- extern void xs_init_match(struct xtables_match *);
--- 
-2.40.0
-

SOURCES/0057-extensions-libxt_NFLOG-fix-nflog-prefix-Python-test-.patch

@@ -1,40 +0,0 @@
-From 4572ecb1f222ec63f0d5669d0924d2cf1e879290 Mon Sep 17 00:00:00 2001
-From: Jeremy Sowden <jeremy@azazel.net>
-Date: Fri, 1 Oct 2021 18:41:39 +0100
-Subject: [PATCH] extensions: libxt_NFLOG: fix `--nflog-prefix` Python
- test-cases
-
-The `iptables-save` includes an extra space between `--nflog-prefix` and
-the prefix.
-
-The maximum length of prefixes includes the trailing NUL character.
-
-NFLOG silently truncates prefixes which exceed the maximum length.
-
-Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit f0d02998883d2efcb316cd6f524e2f7b3c4d055b)
----
- extensions/libxt_NFLOG.t | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/extensions/libxt_NFLOG.t b/extensions/libxt_NFLOG.t
-index 933fa22160e59..69b0255a891b1 100644
---- a/extensions/libxt_NFLOG.t
-+++ b/extensions/libxt_NFLOG.t
-@@ -12,10 +12,8 @@
- -j NFLOG --nflog-size 4294967295;=;OK
- -j NFLOG --nflog-size 4294967296;;FAIL
- -j NFLOG --nflog-size -1;;FAIL
--# ERROR: cannot find: iptables -I INPUT -j NFLOG --nflog-prefix  xxxxxx [...]
--# -j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
--# ERROR: should fail: iptables -A INPUT -j NFLOG --nflog-prefix  xxxxxxx [...]
--#  -j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;;FAIL
-+-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
-+-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;OK
- -j NFLOG --nflog-threshold 1;=;OK
- # ERROR: line 13 (should fail: iptables -A INPUT -j NFLOG --nflog-threshold 0
- # -j NFLOG --nflog-threshold 0;;FAIL
--- 
-2.40.0
-

SOURCES/0058-extensions-libxt_NFLOG-remove-extra-space-when-savin.patch

@@ -1,53 +0,0 @@
-From c83d8cec2a2c70776ca569699983f0cf3e11fb99 Mon Sep 17 00:00:00 2001
-From: Jeremy Sowden <jeremy@azazel.net>
-Date: Fri, 1 Oct 2021 18:41:40 +0100
-Subject: [PATCH] extensions: libxt_NFLOG: remove extra space when saving
- targets with prefixes
-
-When printing out NFLOG targets an extra space was inserted between
-`--nflog-prefix` and the prefix itself:
-
-  $ sudo /usr/sbin/iptables -A INPUT -j NFLOG --nflog-prefix test
-  $ sudo /usr/sbin/iptables-save | grep NFLOG
-  -A INPUT -j NFLOG --nflog-prefix  test
-                                  ^^
-Fixes: 73866357e4a7 ("iptables: do not print trailing whitespaces")
-Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 05286bab77a6e0f9502e8fb99e1c53ed15663f3f)
----
- extensions/libxt_NFLOG.c | 2 +-
- extensions/libxt_NFLOG.t | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libxt_NFLOG.c b/extensions/libxt_NFLOG.c
-index 02a1b4aa35a3b..80c0263510f1e 100644
---- a/extensions/libxt_NFLOG.c
-+++ b/extensions/libxt_NFLOG.c
-@@ -78,7 +78,7 @@ static void NFLOG_check(struct xt_fcheck_call *cb)
- static void nflog_print(const struct xt_nflog_info *info, char *prefix)
- {
- 	if (info->prefix[0] != '\0') {
--		printf(" %snflog-prefix ", prefix);
-+		printf(" %snflog-prefix", prefix);
- 		xtables_save_string(info->prefix);
- 	}
- 	if (info->group)
-diff --git a/extensions/libxt_NFLOG.t b/extensions/libxt_NFLOG.t
-index 69b0255a891b1..bc529b19fc3ff 100644
---- a/extensions/libxt_NFLOG.t
-+++ b/extensions/libxt_NFLOG.t
-@@ -12,8 +12,8 @@
- -j NFLOG --nflog-size 4294967295;=;OK
- -j NFLOG --nflog-size 4294967296;;FAIL
- -j NFLOG --nflog-size -1;;FAIL
---j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
---j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;-j NFLOG --nflog-prefix  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;OK
-+-j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;=;OK
-+-j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;-j NFLOG --nflog-prefix xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx;OK
- -j NFLOG --nflog-threshold 1;=;OK
- # ERROR: line 13 (should fail: iptables -A INPUT -j NFLOG --nflog-threshold 0
- # -j NFLOG --nflog-threshold 0;;FAIL
--- 
-2.40.0
-

SOURCES/0059-xshared-Fix-response-to-unprivileged-users.patch

@@ -1,135 +0,0 @@
-From 84d19c668db246556fac766cff8652ea6f3a4076 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 18 Jan 2022 22:39:08 +0100
-Subject: [PATCH] xshared: Fix response to unprivileged users
-
-Expected behaviour in both variants is:
-
-* Print help without error, append extension help if -m and/or -j
-  options are present
-* Indicate lack of permissions in an error message for anything else
-
-With iptables-nft, this was broken basically from day 1. Shared use of
-do_parse() then somewhat broke legacy: it started complaining about
-inability to create a lock file.
-
-Fix this by making iptables-nft assume extension revision 0 is present
-if permissions don't allow to verify. This is consistent with legacy.
-
-Second part is to exit directly after printing help - this avoids having
-to make the following code "nop-aware" to prevent privileged actions.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Reviewed-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 26ecdf53960658771c0fc582f72a4025e2887f75)
-
-Conflicts:
-	iptables/xshared.c
--> Adjusted to missing commit 62c3c93d4b0f5
-   ("xshared: Move do_parse to shared space").
----
- iptables/nft.c                                |  5 ++
- .../testcases/iptables/0008-unprivileged_0    | 60 +++++++++++++++++++
- iptables/xtables.c                            |  3 +-
- 3 files changed, 66 insertions(+), 2 deletions(-)
- create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index ba59cfb8c47af..da9d24f5c86e2 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -3294,6 +3294,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
- err:
- 	mnl_socket_close(nl);
- 
-+	/* pretend revision 0 is valid if not permitted to check -
-+	 * this is required for printing extension help texts as user */
-+	if (ret < 0 && errno == EPERM && rev == 0)
-+		return 1;
-+
- 	return ret < 0 ? 0 : 1;
- }
- 
-diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
-new file mode 100755
-index 0000000000000..43e3bc8721dbd
---- /dev/null
-+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
-@@ -0,0 +1,60 @@
-+#!/bin/bash
-+
-+# iptables may print match/target specific help texts
-+# help output should work for unprivileged users
-+
-+run() {
-+	echo "running: $*" >&2
-+	runuser -u nobody -- "$@"
-+}
-+
-+grep_or_rc() {
-+	declare -g rc
-+	grep -q "$*" && return 0
-+	echo "missing in output: $*" >&2
-+	return 1
-+}
-+
-+out=$(run $XT_MULTI iptables --help)
-+let "rc+=$?"
-+grep_or_rc "iptables -h (print this help information)" <<< "$out"
-+let "rc+=$?"
-+
-+out=$(run $XT_MULTI iptables -m limit --help)
-+let "rc+=$?"
-+grep_or_rc "limit match options:" <<< "$out"
-+let "rc+=$?"
-+
-+out=$(run $XT_MULTI iptables -p tcp --help)
-+let "rc+=$?"
-+grep_or_rc "tcp match options:" <<< "$out"
-+let "rc+=$?"
-+
-+out=$(run $XT_MULTI iptables -j DNAT --help)
-+let "rc+=$?"
-+grep_or_rc "DNAT target options:" <<< "$out"
-+let "rc+=$?"
-+
-+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
-+let "rc+=$?"
-+grep_or_rc "tcp match options:" <<< "$out"
-+let "rc+=$?"
-+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
-+let "rc+=$?"
-+grep_or_rc "DNAT target options:" <<< "$out"
-+let "rc+=$?"
-+
-+
-+run $XT_MULTI iptables -L 2>&1 | \
-+	grep_or_rc "Permission denied"
-+let "rc+=$?"
-+
-+run $XT_MULTI iptables -A FORWARD -p tcp --dport 123 2>&1 | \
-+	grep_or_rc "Permission denied"
-+let "rc+=$?"
-+
-+run $XT_MULTI iptables -A FORWARD -j DNAT --to-destination 1.2.3.4 2>&1 | \
-+	grep_or_rc "Permission denied"
-+let "rc+=$?"
-+
-+exit $rc
-diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 54f887f80497e..7ef1702a0cd50 100644
---- a/iptables/xtables.c
-+++ b/iptables/xtables.c
-@@ -637,8 +637,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
- 					XTF_TRY_LOAD, &cs->matches);
- 
- 			printhelp(cs->matches);
--			p->command = CMD_NONE;
--			return;
-+			exit(0);
- 
- 			/*
- 			 * Option selection
--- 
-2.40.0
-

SOURCES/0060-libxtables-Register-only-the-highest-revision-extens.patch

@@ -1,64 +0,0 @@
-From da4e3255df89367a3fcf0625df2f161724ef591c Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Feb 2022 17:39:24 +0100
-Subject: [PATCH] libxtables: Register only the highest revision extension
-
-When fully registering extensions, ignore all consecutive ones with same
-name and family value. Since commit b3ac87038f4e4 ("libxtables: Make
-sure extensions register in revision order"), one may safely assume the
-list of pending extensions has highest revision numbers first. Since
-iptables is only interested in the highest revision the kernel supports,
-registration and compatibility checks may be skipped once the first
-matching extension in pending list has validated.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 2dbb49d15fb44ddd521a734eca3be3f940b7c1ba)
----
- libxtables/xtables.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 7f40b6f1b327b..3f7b9768897ac 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -668,6 +668,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
- 	struct xtables_match **dptr;
- 	struct xtables_match *ptr;
- 	const char *icmp6 = "icmp6";
-+	bool found = false;
- 
- 	if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)
- 		xtables_error(PARAMETER_PROBLEM,
-@@ -686,7 +687,9 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
- 		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
- 			ptr = *dptr;
- 			*dptr = (*dptr)->next;
--			if (xtables_fully_register_pending_match(ptr, prev)) {
-+			if (!found &&
-+			    xtables_fully_register_pending_match(ptr, prev)) {
-+				found = true;
- 				prev = ptr;
- 				continue;
- 			} else if (prev) {
-@@ -788,6 +791,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 	struct xtables_target *prev = NULL;
- 	struct xtables_target **dptr;
- 	struct xtables_target *ptr;
-+	bool found = false;
- 
- 	/* Standard target? */
- 	if (strcmp(name, "") == 0
-@@ -802,7 +806,9 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
- 			ptr = *dptr;
- 			*dptr = (*dptr)->next;
--			if (xtables_fully_register_pending_target(ptr, prev)) {
-+			if (!found &&
-+			    xtables_fully_register_pending_target(ptr, prev)) {
-+				found = true;
- 				prev = ptr;
- 				continue;
- 			} else if (prev) {
--- 
-2.40.0
-

SOURCES/0061-Improve-error-messages-for-unsupported-extensions.patch

@@ -1,84 +0,0 @@
-From 8da52ae6b1eabcbce070e25342c9b5b6f84cbf7f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Feb 2022 17:47:22 +0100
-Subject: [PATCH] Improve error messages for unsupported extensions
-
-If a given extension was not supported by the kernel, iptables would
-print a rather confusing error message if extension parameters were
-given:
-
-| # rm /lib/modules/$(uname -r)/kernel/net/netfilter/xt_LOG.ko
-| # iptables -A FORWARD -j LOG --log-prefix foo
-| iptables v1.8.7 (legacy): unknown option "--log-prefix"
-
-Avoid this by pretending extension revision 0 is always supported. It is
-the same hack as used to successfully print extension help texts as
-unprivileged user, extended to all error codes to serve privileged ones
-as well.
-
-In addition, print a warning if kernel rejected revision 0 and it's not
-a permissions problem. This helps users find out which extension in a
-rule the kernel didn't like.
-
-Finally, the above commands result in these messages:
-
-| Warning: Extension LOG revision 0 not supported, missing kernel module?
-| iptables: No chain/target/match by that name.
-
-Or, for iptables-nft:
-
-| Warning: Extension LOG revision 0 not supported, missing kernel module?
-| iptables v1.8.7 (nf_tables):  RULE_APPEND failed (No such file or directory): rule in chain FORWARD
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 17534cb18ed0a5052dc45c117401251359dba6aa)
----
- iptables/nft.c       | 12 +++++++++---
- libxtables/xtables.c |  7 ++++++-
- 2 files changed, 15 insertions(+), 4 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index da9d24f5c86e2..2393940d7f64a 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -3294,10 +3294,16 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
- err:
- 	mnl_socket_close(nl);
- 
--	/* pretend revision 0 is valid if not permitted to check -
--	 * this is required for printing extension help texts as user */
--	if (ret < 0 && errno == EPERM && rev == 0)
-+	/* pretend revision 0 is valid -
-+	 * this is required for printing extension help texts as user, also
-+	 * helps error messaging on unavailable kernel extension */
-+	if (ret < 0 && rev == 0) {
-+		if (errno != EPERM)
-+			fprintf(stderr,
-+				"Warning: Extension %s revision 0 not supported, missing kernel module?\n",
-+				name);
- 		return 1;
-+	}
- 
- 	return ret < 0 ? 0 : 1;
- }
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 3f7b9768897ac..6ded6cc720ea8 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -929,7 +929,12 @@ int xtables_compatible_revision(const char *name, uint8_t revision, int opt)
- 		/* Definitely don't support this? */
- 		if (errno == ENOENT || errno == EPROTONOSUPPORT) {
- 			close(sockfd);
--			return 0;
-+			/* Pretend revision 0 support for better error messaging */
-+			if (revision == 0)
-+				fprintf(stderr,
-+					"Warning: Extension %s revision 0 not supported, missing kernel module?\n",
-+					name);
-+			return (revision == 0);
- 		} else if (errno == ENOPROTOOPT) {
- 			close(sockfd);
- 			/* Assume only revision 0 support (old kernel) */
--- 
-2.40.0
-

SOURCES/0062-nft-Simplify-immediate-parsing.patch

@@ -1,199 +0,0 @@
-From 4f6e933bd26243e2e3c644544d609ada04d46873 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 1 Mar 2022 18:59:31 +0100
-Subject: [PATCH] nft: Simplify immediate parsing
-
-Implementations of parse_immediate callback are mostly trivial, the only
-relevant part is access to family-specific parts of struct
-iptables_command_state when setting goto flag for iptables and
-ip6tables. Refactor them into simple set_goto_flag callbacks.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit b5f2faea325a315bfb932ebc634f3298d4824cae)
----
- iptables/nft-arp.c    |  9 ---------
- iptables/nft-bridge.c |  9 ---------
- iptables/nft-ipv4.c   | 12 +++---------
- iptables/nft-ipv6.c   | 12 +++---------
- iptables/nft-shared.c | 17 +++++++----------
- iptables/nft-shared.h |  2 +-
- 6 files changed, 14 insertions(+), 47 deletions(-)
-
-diff --git a/iptables/nft-arp.c b/iptables/nft-arp.c
-index 2a9387a18dffe..d55e06572b283 100644
---- a/iptables/nft-arp.c
-+++ b/iptables/nft-arp.c
-@@ -182,14 +182,6 @@ static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
- 	fw->arp.invflags |= flags;
- }
- 
--static void nft_arp_parse_immediate(const char *jumpto, bool nft_goto,
--				    void *data)
--{
--	struct iptables_command_state *cs = data;
--
--	cs->jumpto = jumpto;
--}
--
- static void parse_mask_ipv4(struct nft_xt_ctx *ctx, struct in_addr *mask)
- {
- 	mask->s_addr = ctx->bitwise.mask[0];
-@@ -552,7 +544,6 @@ struct nft_family_ops nft_family_ops_arp = {
- 	.print_payload		= NULL,
- 	.parse_meta		= nft_arp_parse_meta,
- 	.parse_payload		= nft_arp_parse_payload,
--	.parse_immediate	= nft_arp_parse_immediate,
- 	.print_header		= nft_arp_print_header,
- 	.print_rule		= nft_arp_print_rule,
- 	.save_rule		= nft_arp_save_rule,
-diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index c1a2c209cc1aa..94febc9890674 100644
---- a/iptables/nft-bridge.c
-+++ b/iptables/nft-bridge.c
-@@ -284,14 +284,6 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
- 	}
- }
- 
--static void nft_bridge_parse_immediate(const char *jumpto, bool nft_goto,
--				       void *data)
--{
--	struct iptables_command_state *cs = data;
--
--	cs->jumpto = jumpto;
--}
--
- /* return 0 if saddr, 1 if daddr, -1 on error */
- static int
- lookup_check_ether_payload(uint32_t base, uint32_t offset, uint32_t len)
-@@ -922,7 +914,6 @@ struct nft_family_ops nft_family_ops_bridge = {
- 	.print_payload		= NULL,
- 	.parse_meta		= nft_bridge_parse_meta,
- 	.parse_payload		= nft_bridge_parse_payload,
--	.parse_immediate	= nft_bridge_parse_immediate,
- 	.parse_lookup		= nft_bridge_parse_lookup,
- 	.parse_match		= nft_bridge_parse_match,
- 	.parse_target		= nft_bridge_parse_target,
-diff --git a/iptables/nft-ipv4.c b/iptables/nft-ipv4.c
-index a5b835b1f681d..76c76b67100ca 100644
---- a/iptables/nft-ipv4.c
-+++ b/iptables/nft-ipv4.c
-@@ -241,15 +241,9 @@ static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
- 	}
- }
- 
--static void nft_ipv4_parse_immediate(const char *jumpto, bool nft_goto,
--				     void *data)
-+static void nft_ipv4_set_goto_flag(struct iptables_command_state *cs)
- {
--	struct iptables_command_state *cs = data;
--
--	cs->jumpto = jumpto;
--
--	if (nft_goto)
--		cs->fw.ip.flags |= IPT_F_GOTO;
-+	cs->fw.ip.flags |= IPT_F_GOTO;
- }
- 
- static void print_fragment(unsigned int flags, unsigned int invflags,
-@@ -473,7 +467,7 @@ struct nft_family_ops nft_family_ops_ipv4 = {
- 	.is_same		= nft_ipv4_is_same,
- 	.parse_meta		= nft_ipv4_parse_meta,
- 	.parse_payload		= nft_ipv4_parse_payload,
--	.parse_immediate	= nft_ipv4_parse_immediate,
-+	.set_goto_flag		= nft_ipv4_set_goto_flag,
- 	.print_header		= print_header,
- 	.print_rule		= nft_ipv4_print_rule,
- 	.save_rule		= nft_ipv4_save_rule,
-diff --git a/iptables/nft-ipv6.c b/iptables/nft-ipv6.c
-index 46008fc5e762a..fac0f16cfe815 100644
---- a/iptables/nft-ipv6.c
-+++ b/iptables/nft-ipv6.c
-@@ -180,15 +180,9 @@ static void nft_ipv6_parse_payload(struct nft_xt_ctx *ctx,
- 	}
- }
- 
--static void nft_ipv6_parse_immediate(const char *jumpto, bool nft_goto,
--				     void *data)
-+static void nft_ipv6_set_goto_flag(struct iptables_command_state *cs)
- {
--	struct iptables_command_state *cs = data;
--
--	cs->jumpto = jumpto;
--
--	if (nft_goto)
--		cs->fw6.ipv6.flags |= IP6T_F_GOTO;
-+	cs->fw6.ipv6.flags |= IP6T_F_GOTO;
- }
- 
- static void nft_ipv6_print_rule(struct nft_handle *h, struct nftnl_rule *r,
-@@ -415,7 +409,7 @@ struct nft_family_ops nft_family_ops_ipv6 = {
- 	.is_same		= nft_ipv6_is_same,
- 	.parse_meta		= nft_ipv6_parse_meta,
- 	.parse_payload		= nft_ipv6_parse_payload,
--	.parse_immediate	= nft_ipv6_parse_immediate,
-+	.set_goto_flag		= nft_ipv6_set_goto_flag,
- 	.print_header		= print_header,
- 	.print_rule		= nft_ipv6_print_rule,
- 	.save_rule		= nft_ipv6_save_rule,
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index f270f610a8f67..894407f7d9b57 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -495,9 +495,7 @@ static void nft_parse_counter(struct nftnl_expr *e, struct xt_counters *counters
- static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- {
- 	const char *chain = nftnl_expr_get_str(e, NFTNL_EXPR_IMM_CHAIN);
--	const char *jumpto = NULL;
--	bool nft_goto = false;
--	void *data = ctx->cs;
-+	struct iptables_command_state *cs = ctx->cs;
- 	int verdict;
- 
- 	if (nftnl_expr_is_set(e, NFTNL_EXPR_IMM_DATA)) {
-@@ -520,23 +518,22 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- 	/* Standard target? */
- 	switch(verdict) {
- 	case NF_ACCEPT:
--		jumpto = "ACCEPT";
-+		cs->jumpto = "ACCEPT";
- 		break;
- 	case NF_DROP:
--		jumpto = "DROP";
-+		cs->jumpto = "DROP";
- 		break;
- 	case NFT_RETURN:
--		jumpto = "RETURN";
-+		cs->jumpto = "RETURN";
- 		break;;
- 	case NFT_GOTO:
--		nft_goto = true;
-+		if (ctx->h->ops->set_goto_flag)
-+			ctx->h->ops->set_goto_flag(cs);
- 		/* fall through */
- 	case NFT_JUMP:
--		jumpto = chain;
-+		cs->jumpto = chain;
- 		break;
- 	}
--
--	ctx->h->ops->parse_immediate(jumpto, nft_goto, data);
- }
- 
- static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 519118a2daf6c..2c5f2cfc012d5 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -89,7 +89,7 @@ struct nft_family_ops {
- 			  void *data);
- 	void (*parse_lookup)(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
- 			     void *data);
--	void (*parse_immediate)(const char *jumpto, bool nft_goto, void *data);
-+	void (*set_goto_flag)(struct iptables_command_state *cs);
- 
- 	void (*print_table_header)(const char *tablename);
- 	void (*print_header)(unsigned int format, const char *chain,
--- 
-2.40.0
-

SOURCES/0063-nft-Speed-up-immediate-parsing.patch

@@ -1,119 +0,0 @@
-From 1a3d13b637e71f1f207eda17f816c58a9425971e Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 1 Mar 2022 19:46:21 +0100
-Subject: [PATCH] nft: Speed up immediate parsing
-
-Parsing of rules which jump to a chain pointlessly causes a call to
-xtables_find_target() despite the code already knowing the outcome.
-
-Avoid the significant delay for rulesets with many chain jumps by
-performing the (standard) target lookup only for accept/drop/return
-verdicts.
-
-From a biased test-case on my VM:
-
-| # iptables-nft-save | grep -c -- '-j'
-| 133943
-| # time ./old/iptables-nft-save >/dev/null
-| real	0m45.566s
-| user	0m1.308s
-| sys	0m8.430s
-| # time ./new/iptables-nft-save >/dev/null
-| real	0m3.547s
-| user	0m0.762s
-| sys	0m2.476s
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 07ee529f5a62838d68be59683be99bf6a7cda0f2)
----
- iptables/nft-bridge.c |  1 +
- iptables/nft-shared.c | 37 ++++++++++++++++++-------------------
- 2 files changed, 19 insertions(+), 19 deletions(-)
-
-diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index 94febc9890674..9cc6f87b28fe0 100644
---- a/iptables/nft-bridge.c
-+++ b/iptables/nft-bridge.c
-@@ -539,6 +539,7 @@ static void nft_bridge_parse_target(struct xtables_target *t, void *data)
- 	}
- 
- 	cs->target = t;
-+	cs->jumpto = t->name;
- }
- 
- static void nft_rule_to_ebtables_command_state(struct nft_handle *h,
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 894407f7d9b57..6c643a8c06aaa 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -496,6 +496,8 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- {
- 	const char *chain = nftnl_expr_get_str(e, NFTNL_EXPR_IMM_CHAIN);
- 	struct iptables_command_state *cs = ctx->cs;
-+	struct xt_entry_target *t;
-+	uint32_t size;
- 	int verdict;
- 
- 	if (nftnl_expr_is_set(e, NFTNL_EXPR_IMM_DATA)) {
-@@ -532,8 +534,21 @@ static void nft_parse_immediate(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- 		/* fall through */
- 	case NFT_JUMP:
- 		cs->jumpto = chain;
--		break;
-+		/* fall through */
-+	default:
-+		return;
- 	}
-+
-+	cs->target = xtables_find_target(cs->jumpto, XTF_TRY_LOAD);
-+	if (!cs->target)
-+		return;
-+
-+	size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;
-+	t = xtables_calloc(1, size);
-+	t->u.target_size = size;
-+	t->u.user.revision = cs->target->revision;
-+	strcpy(t->u.user.name, cs->jumpto);
-+	cs->target->t = t;
- }
- 
- static void nft_parse_limit(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
-@@ -661,25 +676,8 @@ void nft_rule_to_iptables_command_state(struct nft_handle *h,
- 		}
- 	}
- 
--	if (cs->target != NULL) {
--		cs->jumpto = cs->target->name;
--	} else if (cs->jumpto != NULL) {
--		struct xt_entry_target *t;
--		uint32_t size;
--
--		cs->target = xtables_find_target(cs->jumpto, XTF_TRY_LOAD);
--		if (!cs->target)
--			return;
--
--		size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;
--		t = xtables_calloc(1, size);
--		t->u.target_size = size;
--		t->u.user.revision = cs->target->revision;
--		strcpy(t->u.user.name, cs->jumpto);
--		cs->target->t = t;
--	} else {
-+	if (!cs->jumpto)
- 		cs->jumpto = "";
--	}
- }
- 
- void nft_clear_iptables_command_state(struct iptables_command_state *cs)
-@@ -968,6 +966,7 @@ void nft_ipv46_parse_target(struct xtables_target *t, void *data)
- 	struct iptables_command_state *cs = data;
- 
- 	cs->target = t;
-+	cs->jumpto = t->name;
- }
- 
- void nft_check_xt_legacy(int family, bool is_ipt_save)
--- 
-2.40.0
-

SOURCES/0064-xshared-Prefer-xtables_chain_protos-lookup-over-getp.patch

@@ -1,104 +0,0 @@
-From 38ddff6cd616cf9d6869bcf8fa3c01e186446cb4 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 1 Mar 2022 23:05:29 +0100
-Subject: [PATCH] xshared: Prefer xtables_chain_protos lookup over getprotoent
-
-When dumping a large ruleset, common protocol matches such as for TCP
-port number significantly slow down rule printing due to repeated calls
-for getprotobynumber(). The latter does not involve any caching, so
-/etc/protocols is consulted over and over again.
-
-As a simple countermeasure, make functions converting between proto
-number and name prefer the built-in list of "well-known" protocols. This
-is not a perfect solution, repeated rules for protocol names libxtables
-does not cache (e.g. igmp or dccp) will still be slow. Implementing
-getprotoent() result caching could solve this.
-
-As a side-effect, explicit check for pseudo-protocol "all" may be
-dropped as it is contained in the built-in list and therefore immutable.
-
-Also update xtables_chain_protos entries a bit to align with typical
-/etc/protocols contents. The testsuite assumes those names, so the
-preferred ones prior to this patch are indeed uncommon nowadays.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit b6196c7504d4d41827cea86c167926125cdbf1f3)
----
- iptables/xshared.c   |  8 ++++----
- libxtables/xtables.c | 19 ++++++-------------
- 2 files changed, 10 insertions(+), 17 deletions(-)
-
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index 26e938309eab3..f7581967efc28 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -52,16 +52,16 @@ proto_to_name(uint16_t proto, int nolookup)
- {
- 	unsigned int i;
- 
-+	for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
-+		if (xtables_chain_protos[i].num == proto)
-+			return xtables_chain_protos[i].name;
-+
- 	if (proto && !nolookup) {
- 		struct protoent *pent = getprotobynumber(proto);
- 		if (pent)
- 			return pent->p_name;
- 	}
- 
--	for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
--		if (xtables_chain_protos[i].num == proto)
--			return xtables_chain_protos[i].name;
--
- 	return NULL;
- }
- 
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 6ded6cc720ea8..cb380ad61ccb5 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -2077,10 +2077,11 @@ const struct xtables_pprot xtables_chain_protos[] = {
- 	{"udp",       IPPROTO_UDP},
- 	{"udplite",   IPPROTO_UDPLITE},
- 	{"icmp",      IPPROTO_ICMP},
--	{"icmpv6",    IPPROTO_ICMPV6},
- 	{"ipv6-icmp", IPPROTO_ICMPV6},
-+	{"icmpv6",    IPPROTO_ICMPV6},
- 	{"esp",       IPPROTO_ESP},
- 	{"ah",        IPPROTO_AH},
-+	{"mobility-header", IPPROTO_MH},
- 	{"ipv6-mh",   IPPROTO_MH},
- 	{"mh",        IPPROTO_MH},
- 	{"all",       0},
-@@ -2096,23 +2097,15 @@ xtables_parse_protocol(const char *s)
- 	if (xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX))
- 		return proto;
- 
--	/* first deal with the special case of 'all' to prevent
--	 * people from being able to redefine 'all' in nsswitch
--	 * and/or provoke expensive [not working] ldap/nis/...
--	 * lookups */
--	if (strcmp(s, "all") == 0)
--		return 0;
-+	for (i = 0; xtables_chain_protos[i].name != NULL; ++i) {
-+		if (strcmp(s, xtables_chain_protos[i].name) == 0)
-+			return xtables_chain_protos[i].num;
-+	}
- 
- 	pent = getprotobyname(s);
- 	if (pent != NULL)
- 		return pent->p_proto;
- 
--	for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) {
--		if (xtables_chain_protos[i].name == NULL)
--			continue;
--		if (strcmp(s, xtables_chain_protos[i].name) == 0)
--			return xtables_chain_protos[i].num;
--	}
- 	xt_params->exit_err(PARAMETER_PROBLEM,
- 		"unknown protocol \"%s\" specified", s);
- 	return -1;
--- 
-2.40.0
-

SOURCES/0065-libxtables-Fix-for-warning-in-xtables_ipmask_to_nume.patch

@@ -1,41 +0,0 @@
-From f6915482a365373c5892752f87086740b84fe2d3 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 15 Mar 2022 12:17:25 +0100
-Subject: [PATCH] libxtables: Fix for warning in xtables_ipmask_to_numeric
-
-Gcc complains:
-
-| xtables.c: In function 'xtables_ipmask_to_numeric':
-| xtables.c:1491:34: warning: '__builtin___sprintf_chk' may write a terminating nul past the end of the destination [-Wformat-overflow=]
-|  1491 |                 sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask));
-|       |                                  ^
-
-Indeed, xtables_ipaddr_to_numeric() returns a pointer to a 20 byte
-buffer and xtables_ipmask_to_numeric() writes its content into a buffer
-of same size at offset 1. Yet length of returned string is deterministic
-as it is an IPv4 address. So shrink it to the minimum of 16 bytes which
-eliminates the warning as well.
-
-Fixes: a96166c24eaac ("libxtables: add xtables_ip[6]mask_to_cidr")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 0c8e253595bd80e4ddd73230d079e33cd5420b32)
----
- libxtables/xtables.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index cb380ad61ccb5..2e6c68292f16a 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -1389,7 +1389,7 @@ void xtables_param_act(unsigned int status, const char *p1, ...)
- 
- const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp)
- {
--	static char buf[20];
-+	static char buf[16];
- 	const unsigned char *bytep = (const void *)&addrp->s_addr;
- 
- 	sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]);
--- 
-2.40.0
-

SOURCES/0066-nft-Reject-standard-targets-as-chain-names-when-rest.patch

@@ -1,118 +0,0 @@
-From 0a2bf490dde3b55fd2607976aa07a853a18e15f7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 16 Mar 2022 17:14:07 +0100
-Subject: [PATCH] nft: Reject standard targets as chain names when restoring
-
-Reuse parse_chain() called from do_parse() for '-N' and rename it for a
-better description of what it does.
-
-Note that by itself, this patch will likely kill iptables-restore
-performance for big rulesets due to the extra extension lookup for chain
-lines. A following patch announcing those chains to libxtables will
-alleviate that.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Reviewed-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit b1aee6b2238794446feba41778f88703784560f7)
-
-Conflicts:
-	iptables/xshared.c
--> Context change due to missing commit 9dc50b5b8e441
-   ("xshared: Merge invflags handling code").
--> Adjust to missing commits 62c3c93d4b0f5
-   ("xshared: Move do_parse to shared space"), 9baf3bf0e77da
-   ("iptables: Use xtables' do_parse() function") and 5c2c2eea2fff3
-   ("ip6tables: Use the shared do_parse, too").
----
- iptables/ip6tables.c       | 2 +-
- iptables/iptables.c        | 2 +-
- iptables/xshared.c         | 2 +-
- iptables/xshared.h         | 2 +-
- iptables/xtables-restore.c | 5 +----
- iptables/xtables.c         | 2 +-
- 6 files changed, 6 insertions(+), 9 deletions(-)
-
-diff --git a/iptables/ip6tables.c b/iptables/ip6tables.c
-index 6db91c807bcea..897f30d5ef4b0 100644
---- a/iptables/ip6tables.c
-+++ b/iptables/ip6tables.c
-@@ -1156,7 +1156,7 @@ int do_command6(int argc, char *argv[], char **table,
- 			break;
- 
- 		case 'N':
--			parse_chain(optarg);
-+			assert_valid_chain_name(optarg);
- 			add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
- 				    cs.invert);
- 			chain = optarg;
-diff --git a/iptables/iptables.c b/iptables/iptables.c
-index a33416a887ed4..9964d14ed8195 100644
---- a/iptables/iptables.c
-+++ b/iptables/iptables.c
-@@ -1153,7 +1153,7 @@ int do_command4(int argc, char *argv[], char **table,
- 			break;
- 
- 		case 'N':
--			parse_chain(optarg);
-+			assert_valid_chain_name(optarg);
- 			add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
- 				    cs.invert);
- 			chain = optarg;
-diff --git a/iptables/xshared.c b/iptables/xshared.c
-index f7581967efc28..b052b849b2069 100644
---- a/iptables/xshared.c
-+++ b/iptables/xshared.c
-@@ -849,7 +849,7 @@ char opt2char(int option)
- 	return *ptr;
- }
- 
--void parse_chain(const char *chainname)
-+void assert_valid_chain_name(const char *chainname)
- {
- 	const char *ptr;
- 
-diff --git a/iptables/xshared.h b/iptables/xshared.h
-index d80c8beee1894..c512f20afd33a 100644
---- a/iptables/xshared.h
-+++ b/iptables/xshared.h
-@@ -222,7 +222,7 @@ char cmd2char(int option);
- void add_command(unsigned int *cmd, const int newcmd,
- 		 const int othercmds, int invert);
- int parse_rulenumber(const char *rule);
--void parse_chain(const char *chainname);
-+void assert_valid_chain_name(const char *chainname);
- 
- void generic_opt_check(int command, int options);
- char opt2char(int option);
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index a3bb4f00e79c6..5d0e44843b285 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -156,10 +156,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
- 				   "%s: line %u chain name invalid\n",
- 				   xt_params->program_name, line);
- 
--		if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
--			xtables_error(PARAMETER_PROBLEM,
--				   "Invalid chain name `%s' (%u chars max)",
--				   chain, XT_EXTENSION_MAXNAMELEN - 1);
-+		assert_valid_chain_name(chain);
- 
- 		policy = strtok(NULL, " \t\n");
- 		DEBUGP("line %u, policy '%s'\n", line, policy);
-diff --git a/iptables/xtables.c b/iptables/xtables.c
-index 7ef1702a0cd50..3c7b3fc45b6f6 100644
---- a/iptables/xtables.c
-+++ b/iptables/xtables.c
-@@ -587,7 +587,7 @@ void do_parse(struct nft_handle *h, int argc, char *argv[],
- 			break;
- 
- 		case 'N':
--			parse_chain(optarg);
-+			assert_valid_chain_name(optarg);
- 			add_command(&p->command, CMD_NEW_CHAIN, CMD_NONE,
- 				    cs->invert);
- 			p->chain = optarg;
--- 
-2.40.0
-

SOURCES/0067-libxtables-Implement-notargets-hash-table.patch

@@ -1,140 +0,0 @@
-From 064d7af6927b7b47d13d7fa7ad815f99d83d5006 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 15 Dec 2020 15:40:56 +0100
-Subject: [PATCH] libxtables: Implement notargets hash table
-
-Target lookup is relatively costly due to the filesystem access. Avoid
-this overhead in huge rulesets which contain many chain jumps by caching
-the failed lookups into a hashtable for later.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit f58b0d7406451afbb4b9b6c7888990c964fa7c79)
----
- libxtables/xtables.c | 75 ++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 75 insertions(+)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 2e6c68292f16a..b2b3eddf78dbc 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -48,6 +48,7 @@
- #include <linux/netfilter_ipv4/ip_tables.h>
- #include <linux/netfilter_ipv6/ip6_tables.h>
- #include <libiptc/libxtc.h>
-+#include <libiptc/linux_list.h>
- 
- #ifndef NO_SHARED_LIBS
- #include <dlfcn.h>
-@@ -242,6 +243,71 @@ static void dlreg_free(void)
- }
- #endif
- 
-+struct notarget {
-+	struct hlist_node node;
-+	char name[];
-+};
-+
-+#define NOTARGET_HSIZE	512
-+static struct hlist_head notargets[NOTARGET_HSIZE];
-+
-+static void notargets_hlist_init(void)
-+{
-+	int i;
-+
-+	for (i = 0; i < NOTARGET_HSIZE; i++)
-+		INIT_HLIST_HEAD(&notargets[i]);
-+}
-+
-+static void notargets_hlist_free(void)
-+{
-+	struct hlist_node *pos, *n;
-+	struct notarget *cur;
-+	int i;
-+
-+	for (i = 0; i < NOTARGET_HSIZE; i++) {
-+		hlist_for_each_entry_safe(cur, pos, n, &notargets[i], node) {
-+			hlist_del(&cur->node);
-+			free(cur);
-+		}
-+	}
-+}
-+
-+static uint32_t djb_hash(const char *key)
-+{
-+	uint32_t i, hash = 5381;
-+
-+	for (i = 0; i < strlen(key); i++)
-+		hash = ((hash << 5) + hash) + key[i];
-+
-+	return hash;
-+}
-+
-+static struct notarget *notargets_hlist_lookup(const char *name)
-+{
-+	uint32_t key = djb_hash(name) % NOTARGET_HSIZE;
-+	struct hlist_node *node;
-+	struct notarget *cur;
-+
-+	hlist_for_each_entry(cur, node, &notargets[key], node) {
-+		if (!strcmp(name, cur->name))
-+			return cur;
-+	}
-+	return NULL;
-+}
-+
-+static void notargets_hlist_insert(const char *name)
-+{
-+	struct notarget *cur;
-+
-+	if (!name)
-+		return;
-+
-+	cur = xtables_malloc(sizeof(*cur) + strlen(name) + 1);
-+	strcpy(cur->name, name);
-+	hlist_add_head(&cur->node, &notargets[djb_hash(name) % NOTARGET_HSIZE]);
-+}
-+
- void xtables_init(void)
- {
- 	xtables_libdir = getenv("XTABLES_LIBDIR");
-@@ -267,6 +333,8 @@ void xtables_init(void)
- 		return;
- 	}
- 	xtables_libdir = XTABLES_LIBDIR;
-+
-+	notargets_hlist_init();
- }
- 
- void xtables_fini(void)
-@@ -274,6 +342,7 @@ void xtables_fini(void)
- #ifndef NO_SHARED_LIBS
- 	dlreg_free();
- #endif
-+	notargets_hlist_free();
- }
- 
- void xtables_set_nfproto(uint8_t nfproto)
-@@ -800,6 +869,10 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 	    || strcmp(name, XTC_LABEL_QUEUE) == 0
- 	    || strcmp(name, XTC_LABEL_RETURN) == 0)
- 		name = "standard";
-+	/* known non-target? */
-+	else if (notargets_hlist_lookup(name) &&
-+		 tryload != XTF_LOAD_MUST_SUCCEED)
-+		return NULL;
- 
- 	/* Trigger delayed initialization */
- 	for (dptr = &xtables_pending_targets; *dptr; ) {
-@@ -865,6 +938,8 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 
- 	if (ptr)
- 		ptr->used = 1;
-+	else
-+		notargets_hlist_insert(name);
- 
- 	return ptr;
- }
--- 
-2.40.0
-

SOURCES/0068-libxtables-Boost-rule-target-checks-by-announcing-ch.patch

@@ -1,86 +0,0 @@
-From 2fb92babbf460de158cc435f66c46f0642763193 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 4 Mar 2022 12:50:01 +0100
-Subject: [PATCH] libxtables: Boost rule target checks by announcing chain
- names
-
-When restoring a ruleset, feed libxtables with chain names from
-respective lines to avoid an extension search.
-
-While the user's intention is clear, this effectively disables the
-sanity check for clashes with target extensions. But:
-
-* The check yielded only a warning and the clashing chain was finally
-  accepted.
-
-* Users crafting iptables dumps for feeding into iptables-restore likely
-  know what they're doing.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit ac4c84cc63d3cc021ca532692885a644fcde4518)
----
- include/xtables.h           | 3 +++
- iptables/iptables-restore.c | 1 +
- iptables/xtables-restore.c  | 1 +
- libxtables/xtables.c        | 6 ++++++
- 4 files changed, 11 insertions(+)
-
-diff --git a/include/xtables.h b/include/xtables.h
-index a7b36979398ba..3c0d0f78e8d1a 100644
---- a/include/xtables.h
-+++ b/include/xtables.h
-@@ -633,6 +633,9 @@ void xt_xlate_add_comment(struct xt_xlate *xl, const char *comment);
- const char *xt_xlate_get_comment(struct xt_xlate *xl);
- const char *xt_xlate_get(struct xt_xlate *xl);
- 
-+/* informed target lookups */
-+void xtables_announce_chain(const char *name);
-+
- #ifdef XTABLES_INTERNAL
- 
- /* Shipped modules rely on this... */
-diff --git a/iptables/iptables-restore.c b/iptables/iptables-restore.c
-index cc2c2b8b10086..a34d95015c93c 100644
---- a/iptables/iptables-restore.c
-+++ b/iptables/iptables-restore.c
-@@ -311,6 +311,7 @@ ip46tables_restore_main(const struct iptables_restore_cb *cb,
- 						cb->ops->strerror(errno));
- 			}
- 
-+			xtables_announce_chain(chain);
- 			ret = 1;
- 
- 		} else if (in_table) {
-diff --git a/iptables/xtables-restore.c b/iptables/xtables-restore.c
-index 5d0e44843b285..b3c8dbaa7e2cc 100644
---- a/iptables/xtables-restore.c
-+++ b/iptables/xtables-restore.c
-@@ -156,6 +156,7 @@ static void xtables_restore_parse_line(struct nft_handle *h,
- 				   "%s: line %u chain name invalid\n",
- 				   xt_params->program_name, line);
- 
-+		xtables_announce_chain(chain);
- 		assert_valid_chain_name(chain);
- 
- 		policy = strtok(NULL, " \t\n");
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index b2b3eddf78dbc..803551053c15f 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -308,6 +308,12 @@ static void notargets_hlist_insert(const char *name)
- 	hlist_add_head(&cur->node, &notargets[djb_hash(name) % NOTARGET_HSIZE]);
- }
- 
-+void xtables_announce_chain(const char *name)
-+{
-+	if (!notargets_hlist_lookup(name))
-+		notargets_hlist_insert(name);
-+}
-+
- void xtables_init(void)
- {
- 	xtables_libdir = getenv("XTABLES_LIBDIR");
--- 
-2.40.0
-

SOURCES/0069-nft-shared-update-context-register-for-bitwise-expre.patch

@@ -1,31 +0,0 @@
-From ef0405f9267dc23f51bb2b84e63e31ba484f3196 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Thu, 21 Apr 2022 16:53:33 +0200
-Subject: [PATCH] nft-shared: update context register for bitwise expression
-
-Update the destination register, otherwise nft_parse_cmp() gives up on
-interpreting the cmp expression when bitwise sreg != dreg.
-
-Fixes: 2c4a34c30cb4 ("iptables-compat: fix address prefix")
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 4c70c42fe8d937a2ca2709daa9efe96275d194da)
----
- iptables/nft-shared.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 6c643a8c06aaa..2b934ffc17756 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -459,6 +459,8 @@ static void nft_parse_bitwise(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- 	if (ctx->reg && reg != ctx->reg)
- 		return;
- 
-+	reg = nftnl_expr_get_u32(e, NFTNL_EXPR_BITWISE_DREG);
-+	ctx->reg = reg;
- 	data = nftnl_expr_get(e, NFTNL_EXPR_BITWISE_XOR, &len);
- 	memcpy(ctx->bitwise.xor, data, len);
- 	data = nftnl_expr_get(e, NFTNL_EXPR_BITWISE_MASK, &len);
--- 
-2.40.0
-

SOURCES/0070-extensions-MARK-Drop-extra-newline-at-end-of-help.patch

@@ -1,29 +0,0 @@
-From 1f7fa039057778f229c5190d816551bf75955d5a Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 5 May 2022 18:00:14 +0200
-Subject: [PATCH] extensions: MARK: Drop extra newline at end of help
-
-Fixes: f4b737fb0c52a ("libxt_MARK r2")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit adbfec0b3e3275ea5e7c933b630756cf01a4f8c6)
----
- extensions/libxt_MARK.c | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/extensions/libxt_MARK.c b/extensions/libxt_MARK.c
-index b765af6c35304..1536563d0f4c7 100644
---- a/extensions/libxt_MARK.c
-+++ b/extensions/libxt_MARK.c
-@@ -77,8 +77,7 @@ static void mark_tg_help(void)
- "  --set-mark value[/mask]   Clear bits in mask and OR value into nfmark\n"
- "  --and-mark bits           Binary AND the nfmark with bits\n"
- "  --or-mark bits            Binary OR the nfmark with bits\n"
--"  --xor-mark bits           Binary XOR the nfmark with bits\n"
--"\n");
-+"  --xor-mark bits           Binary XOR the nfmark with bits\n");
- }
- 
- static void MARK_parse_v0(struct xt_option_call *cb)
--- 
-2.40.0
-

SOURCES/0071-extensions-LOG-Document-log-macdecode-in-man-page.patch

@@ -1,28 +0,0 @@
-From 32ae030336b73b57ebe0f5e74ea17e09834f3870 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 24 Mar 2022 11:06:24 +0100
-Subject: [PATCH] extensions: LOG: Document --log-macdecode in man page
-
-Help text already contains it, so no update needed there.
-
-Fixes: 127647892c7ca ("extensions: libipt_LOG/libip6t_LOG: support macdecode option")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit ce9195c6e2fa6c6daa3c34b94353a539237b3809)
----
- extensions/libxt_LOG.man | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/extensions/libxt_LOG.man b/extensions/libxt_LOG.man
-index 354edf4cc2916..1d5071ba720b9 100644
---- a/extensions/libxt_LOG.man
-+++ b/extensions/libxt_LOG.man
-@@ -30,3 +30,6 @@ Log options from the IP/IPv6 packet header.
- .TP
- \fB\-\-log\-uid\fP
- Log the userid of the process which generated the packet.
-+.TP
-+\fB\-\-log\-macdecode\fP
-+Log MAC addresses and protocol.
--- 
-2.40.0
-

SOURCES/0072-nft-Fix-EPERM-handling-for-extensions-without-rev-0.patch

@@ -1,65 +0,0 @@
-From 26dc3496694dc71c95164b6885c7422196802c6d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 4 May 2022 11:19:16 +0200
-Subject: [PATCH] nft: Fix EPERM handling for extensions without rev 0
-
-Treating revision 0 as compatible in EPERM case works fine as long as
-there is a revision 0 of that extension defined in DSO. Fix the code for
-others: Extend the EPERM handling to all revisions and keep the existing
-warning for revision 0.
-
-Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 8468fd4f7c85c21ab375402bc80d0188412b6cbf)
----
- iptables/nft.c                                        | 11 +++++++----
- .../shell/testcases/iptables/0008-unprivileged_0      |  6 ++++++
- 2 files changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/iptables/nft.c b/iptables/nft.c
-index 2393940d7f64a..c130369f78348 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -3294,15 +3294,18 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
- err:
- 	mnl_socket_close(nl);
- 
--	/* pretend revision 0 is valid -
-+	/* ignore EPERM and errors for revision 0 -
- 	 * this is required for printing extension help texts as user, also
- 	 * helps error messaging on unavailable kernel extension */
--	if (ret < 0 && rev == 0) {
--		if (errno != EPERM)
-+	if (ret < 0) {
-+		if (errno == EPERM)
-+			return 1;
-+		if (rev == 0) {
- 			fprintf(stderr,
- 				"Warning: Extension %s revision 0 not supported, missing kernel module?\n",
- 				name);
--		return 1;
-+			return 1;
-+		}
- 	}
- 
- 	return ret < 0 ? 0 : 1;
-diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
-index 43e3bc8721dbd..983531fef4720 100755
---- a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
-+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
-@@ -35,6 +35,12 @@ let "rc+=$?"
- grep_or_rc "DNAT target options:" <<< "$out"
- let "rc+=$?"
- 
-+# TEE has no revision 0
-+out=$(run $XT_MULTI iptables -j TEE --help)
-+let "rc+=$?"
-+grep_or_rc "TEE target options:" <<< "$out"
-+let "rc+=$?"
-+
- out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
- let "rc+=$?"
- grep_or_rc "tcp match options:" <<< "$out"
--- 
-2.40.0
-

SOURCES/0073-tests-shell-Check-overhead-in-iptables-save-and-rest.patch

@@ -1,61 +0,0 @@
-From a40839b6c6d5d9742a5316ed3b4bd13516537ee1 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 2 Jun 2022 13:44:45 +0200
-Subject: [PATCH] tests: shell: Check overhead in iptables-save and -restore
-
-Some repeated calls have been reduced recently, assert this in a test
-evaluating strace output.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 0416ae5dea134b33e22c97e68b64010d679debe1)
----
- .../shell/testcases/ipt-save/0007-overhead_0  | 37 +++++++++++++++++++
- 1 file changed, 37 insertions(+)
- create mode 100755 iptables/tests/shell/testcases/ipt-save/0007-overhead_0
-
-diff --git a/iptables/tests/shell/testcases/ipt-save/0007-overhead_0 b/iptables/tests/shell/testcases/ipt-save/0007-overhead_0
-new file mode 100755
-index 0000000000000..b86d71f209471
---- /dev/null
-+++ b/iptables/tests/shell/testcases/ipt-save/0007-overhead_0
-@@ -0,0 +1,37 @@
-+#!/bin/bash
-+
-+# Test recent performance improvements in iptables-save due to reduced
-+# overhead.
-+
-+strace --version >/dev/null || { echo "skip for missing strace"; exit 0; }
-+
-+RULESET=$(
-+	echo "*filter"
-+	for ((i = 0; i < 100; i++)); do
-+		echo ":mychain$i -"
-+		echo "-A FORWARD -p tcp --dport 22 -j mychain$i"
-+	done
-+	echo "COMMIT"
-+)
-+
-+RESTORE_STRACE=$(strace $XT_MULTI iptables-restore <<< "$RULESET" 2>&1 >/dev/null)
-+SAVE_STRACE=$(strace $XT_MULTI iptables-save 2>&1 >/dev/null)
-+
-+do_grep() { # (name, threshold, pattern)
-+	local cnt=$(grep -c "$3")
-+	[[ $cnt -le $2 ]] && return 0
-+	echo "ERROR: Too many $3 lookups for $1: $cnt > $2"
-+	exit 1
-+}
-+
-+# iptables prefers hard-coded protocol names instead of looking them up first
-+
-+do_grep "$XT_MULTI iptables-restore" 0 /etc/protocols <<< "$RESTORE_STRACE"
-+do_grep "$XT_MULTI iptables-save" 0 /etc/protocols <<< "$SAVE_STRACE"
-+
-+# iptables-nft-save pointlessly checked whether chain jumps are targets
-+
-+do_grep "$XT_MULTI iptables-restore" 10 libxt_ <<< "$RESTORE_STRACE"
-+do_grep "$XT_MULTI iptables-save" 10 libxt_ <<< "$SAVE_STRACE"
-+
-+exit 0
--- 
-2.40.0
-

SOURCES/0074-iptables-legacy-Drop-redundant-include-of-xtables-mu.patch

@@ -1,33 +0,0 @@
-From 88416b4ac4fabde5098f2ff22dc634e5e6f6da51 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 1 Jun 2022 19:29:28 +0200
-Subject: [PATCH] iptables-legacy: Drop redundant include of xtables-multi.h
-
-The header is included unconditionally first, so no point in doing it a
-second time of ENABLE_NFTABLES is defined.
-
-Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit ef5d0c68261611d72ccecb3ae05c24448fbc91f5)
----
- iptables/xtables-legacy-multi.c | 4 ----
- 1 file changed, 4 deletions(-)
-
-diff --git a/iptables/xtables-legacy-multi.c b/iptables/xtables-legacy-multi.c
-index 3b7905ff76b13..2c71931551b5c 100644
---- a/iptables/xtables-legacy-multi.c
-+++ b/iptables/xtables-legacy-multi.c
-@@ -14,10 +14,6 @@
- #include "ip6tables-multi.h"
- #endif
- 
--#ifdef ENABLE_NFTABLES
--#include "xtables-multi.h"
--#endif
--
- static const struct subcommand multi_subcommands[] = {
- #ifdef ENABLE_IPV4
- 	{"iptables",            iptables_main},
--- 
-2.40.0
-

SOURCES/0075-tests-shell-Add-some-more-rules-to-0002-verbose-outp.patch

@@ -1,55 +0,0 @@
-From 9fb89d10d071076c3178749b4237c669db93aa39 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 20 May 2021 11:40:18 +0200
-Subject: [PATCH] tests: shell: Add some more rules to 0002-verbose-output_0
-
-This increases coverage of function print_match() from 0 to 86.6%.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit a219f8d407ee22d69bf74478b6c7331c602b28c6)
----
- .../testcases/ip6tables/0002-verbose-output_0     | 15 +++++++++++++++
- 1 file changed, 15 insertions(+)
-
-diff --git a/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0 b/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
-index 7b0e64686c6b6..7624cbab655ad 100755
---- a/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
-+++ b/iptables/tests/shell/testcases/ip6tables/0002-verbose-output_0
-@@ -9,12 +9,24 @@ RULE1='-i eth2 -o eth3 -s feed:babe::1 -d feed:babe::2 -j ACCEPT'
- VOUT1='ACCEPT  all opt    in eth2 out eth3  feed:babe::1  -> feed:babe::2'
- RULE2='-i eth2 -o eth3 -s feed:babe::4 -d feed:babe::5 -j ACCEPT'
- VOUT2='ACCEPT  all opt    in eth2 out eth3  feed:babe::4  -> feed:babe::5'
-+RULE3='-p icmpv6 -m icmp6 --icmpv6-type no-route'
-+VOUT3='  ipv6-icmp opt    in * out *  ::/0  -> ::/0   ipv6-icmptype 1 code 0'
-+RULE4='-m dst --dst-len 42 -m rt --rt-type 23'
-+VOUT4='  all opt    in * out *  ::/0  -> ::/0   dst length:42  rt type:23'
-+RULE5='-m frag --fragid 1337 -j LOG'
-+VOUT5='LOG  all opt    in * out *  ::/0  -> ::/0   frag id:1337 LOG flags 0 level 4'
- 
- diff -u -Z <(echo -e "$VOUT1") <($XT_MULTI ip6tables -v -A FORWARD $RULE1)
- diff -u -Z <(echo -e "$VOUT2") <($XT_MULTI ip6tables -v -I FORWARD 2 $RULE2)
-+diff -u -Z <(echo -e "$VOUT3") <($XT_MULTI ip6tables -v -A FORWARD $RULE3)
-+diff -u -Z <(echo -e "$VOUT4") <($XT_MULTI ip6tables -v -A FORWARD $RULE4)
-+diff -u -Z <(echo -e "$VOUT5") <($XT_MULTI ip6tables -v -A FORWARD $RULE5)
- 
- diff -u -Z <(echo -e "$VOUT1") <($XT_MULTI ip6tables -v -C FORWARD $RULE1)
- diff -u -Z <(echo -e "$VOUT2") <($XT_MULTI ip6tables -v -C FORWARD $RULE2)
-+diff -u -Z <(echo -e "$VOUT3") <($XT_MULTI ip6tables -v -C FORWARD $RULE3)
-+diff -u -Z <(echo -e "$VOUT4") <($XT_MULTI ip6tables -v -C FORWARD $RULE4)
-+diff -u -Z <(echo -e "$VOUT5") <($XT_MULTI ip6tables -v -C FORWARD $RULE5)
- 
- EXPECT='Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
-  pkts bytes target     prot opt in     out     source               destination
-@@ -23,6 +35,9 @@ Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
-  pkts bytes target     prot opt in     out     source               destination
-     0     0 ACCEPT     all      eth2   eth3    feed:babe::1         feed:babe::2
-     0     0 ACCEPT     all      eth2   eth3    feed:babe::4         feed:babe::5
-+    0     0            ipv6-icmp    *      *       ::/0                 ::/0                 ipv6-icmptype 1 code 0
-+    0     0            all      *      *       ::/0                 ::/0                 dst length:42  rt type:23
-+    0     0 LOG        all      *      *       ::/0                 ::/0                 frag id:1337 LOG flags 0 level 4
- 
- Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
-  pkts bytes target     prot opt in     out     source               destination'
--- 
-2.40.0
-

SOURCES/0076-extensions-string-Do-not-print-default-to-value.patch

@@ -1,39 +0,0 @@
-From 30c3d8d215c63b7d9244f853c94958a6194153b7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 8 Jun 2022 13:28:10 +0200
-Subject: [PATCH] extensions: string: Do not print default --to value
-
-Default value is UINT16_MAX, not 0. Fix the conditional printing.
-
-Fixes: c6fbf41cdd157 ("update string match to reflect new kernel implementation (Pablo Neira)")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 1bfb1d916e467e2bcbc44ce1a50a2be5c12b7ef8)
----
- extensions/libxt_string.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/extensions/libxt_string.c b/extensions/libxt_string.c
-index 7c6366cbbf1b3..f6496f6403498 100644
---- a/extensions/libxt_string.c
-+++ b/extensions/libxt_string.c
-@@ -269,7 +269,7 @@ string_print(const void *ip, const struct xt_entry_match *match, int numeric)
- 	printf(" ALGO name %s", info->algo);
- 	if (info->from_offset != 0)
- 		printf(" FROM %u", info->from_offset);
--	if (info->to_offset != 0)
-+	if (info->to_offset != UINT16_MAX)
- 		printf(" TO %u", info->to_offset);
- 	if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
- 		printf(" ICASE");
-@@ -293,7 +293,7 @@ static void string_save(const void *ip, const struct xt_entry_match *match)
- 	printf(" --algo %s", info->algo);
- 	if (info->from_offset != 0)
- 		printf(" --from %u", info->from_offset);
--	if (info->to_offset != 0)
-+	if (info->to_offset != UINT16_MAX)
- 		printf(" --to %u", info->to_offset);
- 	if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
- 		printf(" --icase");
--- 
-2.40.0
-

SOURCES/0077-xtables-monitor-add-missing-spaces-in-printed-str.patch

@@ -1,45 +0,0 @@
-From 40096cbbdd59f0bd431395f69bd30ade35ec1427 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Anton=20Luka=20=C5=A0ijanec?= <anton@sijanec.eu>
-Date: Wed, 22 Jun 2022 21:56:47 +0200
-Subject: [PATCH] xtables-monitor: add missing spaces in printed str
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-when printing the ID and OPTs in iptables/xtables-monitor.c, a space is
-missing after the string, thereby concatenating the number with the next
-item in the printed PACKET line.
-
-Fixes: d26c538b9a549 ("xtables: add xtables-monitor")
-Signed-off-by: Anton Luka Šijanec <anton@sijanec.eu>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 6c12201b5ff08d9e1524477ff63bb8810198d638)
----
- iptables/xtables-monitor.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/iptables/xtables-monitor.c b/iptables/xtables-monitor.c
-index 4b9809805fb5b..89c739d5aacd1 100644
---- a/iptables/xtables-monitor.c
-+++ b/iptables/xtables-monitor.c
-@@ -340,7 +340,7 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
- 			inet_ntop(AF_INET, &iph->daddr, addrbuf, sizeof(addrbuf));
- 			printf("DST=%s ", addrbuf);
- 
--			printf("LEN=%d TOS=0x%x TTL=%d ID=%d", ntohs(iph->tot_len), iph->tos, iph->ttl, ntohs(iph->id));
-+			printf("LEN=%d TOS=0x%x TTL=%d ID=%d ", ntohs(iph->tot_len), iph->tos, iph->ttl, ntohs(iph->id));
- 			if (iph->frag_off & htons(0x8000))
- 				printf("CE ");
- 			if (iph->frag_off & htons(IP_DF))
-@@ -363,7 +363,7 @@ static void trace_print_packet(const struct nftnl_trace *nlt, struct cb_arg *arg
- 				printf("OPT (");
- 				for (i = 0; i < optsize; i++)
- 					printf("%02X", op[i]);
--				printf(")");
-+				printf(") ");
- 			}
- 			break;
- 		}
--- 
-2.40.0
-

SOURCES/0078-libxtables-Fix-unsupported-extension-warning-corner-.patch

@@ -1,91 +0,0 @@
-From a9527fc387066ed774bdce38598d21eb8e52d899 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 30 Jun 2022 18:04:39 +0200
-Subject: [PATCH] libxtables: Fix unsupported extension warning corner case
-
-Some extensions are not supported in revision 0 by user space anymore,
-for those the warning in xtables_compatible_revision() does not print as
-no revision 0 is tried.
-
-To fix this, one has to track if none of the user space supported
-revisions were accepted by the kernel. Therefore add respective logic to
-xtables_find_{target,match}().
-
-Note that this does not lead to duplicated warnings for unsupported
-extensions that have a revision 0 because xtables_compatible_revision()
-returns true for them to allow for extension's help output.
-
-For the record, these ip6tables extensions are affected: set/SET,
-socket, tos/TOS, TPROXY and SNAT. In addition to that, TEE is affected
-for both families.
-
-Fixes: 17534cb18ed0a ("Improve error messages for unsupported extensions")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 552c4a2f9e5706fef5f7abb27d1492a78bbb2a37)
----
- libxtables/xtables.c | 14 ++++++++++++++
- 1 file changed, 14 insertions(+)
-
-diff --git a/libxtables/xtables.c b/libxtables/xtables.c
-index 803551053c15f..598e43988e1a3 100644
---- a/libxtables/xtables.c
-+++ b/libxtables/xtables.c
-@@ -744,6 +744,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
- 	struct xtables_match *ptr;
- 	const char *icmp6 = "icmp6";
- 	bool found = false;
-+	bool seen = false;
- 
- 	if (strlen(name) >= XT_EXTENSION_MAXNAMELEN)
- 		xtables_error(PARAMETER_PROBLEM,
-@@ -762,6 +763,7 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
- 		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
- 			ptr = *dptr;
- 			*dptr = (*dptr)->next;
-+			seen = true;
- 			if (!found &&
- 			    xtables_fully_register_pending_match(ptr, prev)) {
- 				found = true;
-@@ -775,6 +777,11 @@ xtables_find_match(const char *name, enum xtables_tryload tryload,
- 		dptr = &((*dptr)->next);
- 	}
- 
-+	if (seen && !found)
-+		fprintf(stderr,
-+			"Warning: Extension %s is not supported, missing kernel module?\n",
-+			name);
-+
- 	for (ptr = xtables_matches; ptr; ptr = ptr->next) {
- 		if (extension_cmp(name, ptr->name, ptr->family)) {
- 			struct xtables_match *clone;
-@@ -867,6 +874,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 	struct xtables_target **dptr;
- 	struct xtables_target *ptr;
- 	bool found = false;
-+	bool seen = false;
- 
- 	/* Standard target? */
- 	if (strcmp(name, "") == 0
-@@ -885,6 +893,7 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 		if (extension_cmp(name, (*dptr)->name, (*dptr)->family)) {
- 			ptr = *dptr;
- 			*dptr = (*dptr)->next;
-+			seen = true;
- 			if (!found &&
- 			    xtables_fully_register_pending_target(ptr, prev)) {
- 				found = true;
-@@ -898,6 +907,11 @@ xtables_find_target(const char *name, enum xtables_tryload tryload)
- 		dptr = &((*dptr)->next);
- 	}
- 
-+	if (seen && !found)
-+		fprintf(stderr,
-+			"Warning: Extension %s is not supported, missing kernel module?\n",
-+			name);
-+
- 	for (ptr = xtables_targets; ptr; ptr = ptr->next) {
- 		if (extension_cmp(name, ptr->name, ptr->family)) {
- 			struct xtables_target *clone;
--- 
-2.40.0
-

SOURCES/0079-extensions-libxt_conntrack-remove-always-false-condi.patch

@@ -1,61 +0,0 @@
-From f41e10de4d82377b01e0db057bde3e68159f7531 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Sat, 23 Jul 2022 20:25:49 +0200
-Subject: [PATCH] extensions: libxt_conntrack: remove always-false conditionals
-
-libxt_conntrack.c:1292: warning: the comparison will always evaluate as
-false for the address of origsrc_addr will never be NULL [-Waddress]
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit e88085ac41b4c962e1d85dcc8dc6fa0d1f80dc12)
----
- extensions/libxt_conntrack.c | 12 ------------
- 1 file changed, 12 deletions(-)
-
-diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
-index 91f9e4aa994f8..6ab5c99133d3c 100644
---- a/extensions/libxt_conntrack.c
-+++ b/extensions/libxt_conntrack.c
-@@ -1297,9 +1297,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
- 	}
- 
- 	if (sinfo->match_flags & XT_CONNTRACK_ORIGSRC) {
--		if (&sinfo->origsrc_addr == 0L)
--			return 0;
--
- 		xt_xlate_add(xl, "%sct original saddr %s", space,
- 			     sinfo->invert_flags & XT_CONNTRACK_ORIGSRC ?
- 			     "!= " : "");
-@@ -1309,9 +1306,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
- 	}
- 
- 	if (sinfo->match_flags & XT_CONNTRACK_ORIGDST) {
--		if (&sinfo->origdst_addr == 0L)
--			return 0;
--
- 		xt_xlate_add(xl, "%sct original daddr %s", space,
- 			     sinfo->invert_flags & XT_CONNTRACK_ORIGDST ?
- 			     "!= " : "");
-@@ -1321,9 +1315,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
- 	}
- 
- 	if (sinfo->match_flags & XT_CONNTRACK_REPLSRC) {
--		if (&sinfo->replsrc_addr == 0L)
--			return 0;
--
- 		xt_xlate_add(xl, "%sct reply saddr %s", space,
- 			     sinfo->invert_flags & XT_CONNTRACK_REPLSRC ?
- 			     "!= " : "");
-@@ -1333,9 +1324,6 @@ static int _conntrack3_mt_xlate(struct xt_xlate *xl,
- 	}
- 
- 	if (sinfo->match_flags & XT_CONNTRACK_REPLDST) {
--		if (&sinfo->repldst_addr == 0L)
--			return 0;
--
- 		xt_xlate_add(xl, "%sct reply daddr %s", space,
- 			     sinfo->invert_flags & XT_CONNTRACK_REPLDST ?
- 			     "!= " : "");
--- 
-2.40.0
-

SOURCES/0080-nft-un-break-among-match-with-concatenation.patch

@@ -1,958 +0,0 @@
-From 2fd494ffd99924931206c93d5c6d2806df1718ef Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Thu, 22 Sep 2022 13:33:50 +0200
-Subject: [PATCH] nft: un-break among match with concatenation
-
-The kernel commit 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags")
-breaks ebtables-nft 'among' emulation, it sets NFTA_SET_ELEM_KEY_END but
-doesn't set the CONCAT flag.
-
-Update uapi header and also set CONCAT.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 32efb4ffc33ae874b3f26f3380e2184ad6ceb26f)
----
- include/linux/netfilter/nf_tables.h | 483 +++++++++++++++++++++++++++-
- iptables/nft.c                      |   2 +-
- 2 files changed, 476 insertions(+), 9 deletions(-)
-
-diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
-index 66dceee0ae307..e94d1fa554cb2 100644
---- a/include/linux/netfilter/nf_tables.h
-+++ b/include/linux/netfilter/nf_tables.h
-@@ -8,6 +8,7 @@
- #define NFT_SET_MAXNAMELEN	NFT_NAME_MAXLEN
- #define NFT_OBJ_MAXNAMELEN	NFT_NAME_MAXLEN
- #define NFT_USERDATA_MAXLEN	256
-+#define NFT_OSF_MAXGENRELEN	16
- 
- /**
-  * enum nft_registers - nf_tables registers
-@@ -47,6 +48,7 @@ enum nft_registers {
- 
- #define NFT_REG_SIZE	16
- #define NFT_REG32_SIZE	4
-+#define NFT_REG32_COUNT	(NFT_REG32_15 - NFT_REG32_00 + 1)
- 
- /**
-  * enum nft_verdicts - nf_tables internal verdicts
-@@ -131,7 +133,7 @@ enum nf_tables_msg_types {
-  * @NFTA_LIST_ELEM: list element (NLA_NESTED)
-  */
- enum nft_list_attributes {
--	NFTA_LIST_UNPEC,
-+	NFTA_LIST_UNSPEC,
- 	NFTA_LIST_ELEM,
- 	__NFTA_LIST_MAX
- };
-@@ -143,12 +145,14 @@ enum nft_list_attributes {
-  * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
-  * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
-  * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
-+ * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
-  */
- enum nft_hook_attributes {
- 	NFTA_HOOK_UNSPEC,
- 	NFTA_HOOK_HOOKNUM,
- 	NFTA_HOOK_PRIORITY,
- 	NFTA_HOOK_DEV,
-+	NFTA_HOOK_DEVS,
- 	__NFTA_HOOK_MAX
- };
- #define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)
-@@ -160,7 +164,10 @@ enum nft_hook_attributes {
-  */
- enum nft_table_flags {
- 	NFT_TABLE_F_DORMANT	= 0x1,
-+	NFT_TABLE_F_OWNER	= 0x2,
- };
-+#define NFT_TABLE_F_MASK	(NFT_TABLE_F_DORMANT | \
-+				 NFT_TABLE_F_OWNER)
- 
- /**
-  * enum nft_table_attributes - nf_tables table netlink attributes
-@@ -168,6 +175,8 @@ enum nft_table_flags {
-  * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
-  * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
-  * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
-+ * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
-+ * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
-  */
- enum nft_table_attributes {
- 	NFTA_TABLE_UNSPEC,
-@@ -176,10 +185,21 @@ enum nft_table_attributes {
- 	NFTA_TABLE_USE,
- 	NFTA_TABLE_HANDLE,
- 	NFTA_TABLE_PAD,
-+	NFTA_TABLE_USERDATA,
-+	NFTA_TABLE_OWNER,
- 	__NFTA_TABLE_MAX
- };
- #define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
- 
-+enum nft_chain_flags {
-+	NFT_CHAIN_BASE		= (1 << 0),
-+	NFT_CHAIN_HW_OFFLOAD	= (1 << 1),
-+	NFT_CHAIN_BINDING	= (1 << 2),
-+};
-+#define NFT_CHAIN_FLAGS		(NFT_CHAIN_BASE		| \
-+				 NFT_CHAIN_HW_OFFLOAD	| \
-+				 NFT_CHAIN_BINDING)
-+
- /**
-  * enum nft_chain_attributes - nf_tables chain netlink attributes
-  *
-@@ -191,6 +211,9 @@ enum nft_table_attributes {
-  * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
-  * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
-  * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
-+ * @NFTA_CHAIN_FLAGS: chain flags
-+ * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
-+ * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
-  */
- enum nft_chain_attributes {
- 	NFTA_CHAIN_UNSPEC,
-@@ -203,6 +226,9 @@ enum nft_chain_attributes {
- 	NFTA_CHAIN_TYPE,
- 	NFTA_CHAIN_COUNTERS,
- 	NFTA_CHAIN_PAD,
-+	NFTA_CHAIN_FLAGS,
-+	NFTA_CHAIN_ID,
-+	NFTA_CHAIN_USERDATA,
- 	__NFTA_CHAIN_MAX
- };
- #define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)
-@@ -218,6 +244,7 @@ enum nft_chain_attributes {
-  * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
-  * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
-  * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
-+ * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
-  */
- enum nft_rule_attributes {
- 	NFTA_RULE_UNSPEC,
-@@ -230,6 +257,8 @@ enum nft_rule_attributes {
- 	NFTA_RULE_USERDATA,
- 	NFTA_RULE_PAD,
- 	NFTA_RULE_ID,
-+	NFTA_RULE_POSITION_ID,
-+	NFTA_RULE_CHAIN_ID,
- 	__NFTA_RULE_MAX
- };
- #define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)
-@@ -266,8 +295,10 @@ enum nft_rule_compat_attributes {
-  * @NFT_SET_INTERVAL: set contains intervals
-  * @NFT_SET_MAP: set is used as a dictionary
-  * @NFT_SET_TIMEOUT: set uses timeouts
-- * @NFT_SET_EVAL: set contains expressions for evaluation
-+ * @NFT_SET_EVAL: set can be updated from the evaluation path
-  * @NFT_SET_OBJECT: set contains stateful objects
-+ * @NFT_SET_CONCAT: set contains a concatenation
-+ * @NFT_SET_EXPR: set contains expressions
-  */
- enum nft_set_flags {
- 	NFT_SET_ANONYMOUS		= 0x1,
-@@ -277,6 +308,8 @@ enum nft_set_flags {
- 	NFT_SET_TIMEOUT			= 0x10,
- 	NFT_SET_EVAL			= 0x20,
- 	NFT_SET_OBJECT			= 0x40,
-+	NFT_SET_CONCAT			= 0x80,
-+	NFT_SET_EXPR			= 0x100,
- };
- 
- /**
-@@ -294,14 +327,28 @@ enum nft_set_policies {
-  * enum nft_set_desc_attributes - set element description
-  *
-  * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
-+ * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
-  */
- enum nft_set_desc_attributes {
- 	NFTA_SET_DESC_UNSPEC,
- 	NFTA_SET_DESC_SIZE,
-+	NFTA_SET_DESC_CONCAT,
- 	__NFTA_SET_DESC_MAX
- };
- #define NFTA_SET_DESC_MAX	(__NFTA_SET_DESC_MAX - 1)
- 
-+/**
-+ * enum nft_set_field_attributes - attributes of concatenated fields
-+ *
-+ * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
-+ */
-+enum nft_set_field_attributes {
-+	NFTA_SET_FIELD_UNSPEC,
-+	NFTA_SET_FIELD_LEN,
-+	__NFTA_SET_FIELD_MAX
-+};
-+#define NFTA_SET_FIELD_MAX	(__NFTA_SET_FIELD_MAX - 1)
-+
- /**
-  * enum nft_set_attributes - nf_tables set netlink attributes
-  *
-@@ -320,6 +367,8 @@ enum nft_set_desc_attributes {
-  * @NFTA_SET_USERDATA: user data (NLA_BINARY)
-  * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
-  * @NFTA_SET_HANDLE: set handle (NLA_U64)
-+ * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
-+ * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
-  */
- enum nft_set_attributes {
- 	NFTA_SET_UNSPEC,
-@@ -339,6 +388,8 @@ enum nft_set_attributes {
- 	NFTA_SET_PAD,
- 	NFTA_SET_OBJ_TYPE,
- 	NFTA_SET_HANDLE,
-+	NFTA_SET_EXPR,
-+	NFTA_SET_EXPRESSIONS,
- 	__NFTA_SET_MAX
- };
- #define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
-@@ -347,9 +398,11 @@ enum nft_set_attributes {
-  * enum nft_set_elem_flags - nf_tables set element flags
-  *
-  * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
-+ * @NFT_SET_ELEM_CATCHALL: special catch-all element
-  */
- enum nft_set_elem_flags {
- 	NFT_SET_ELEM_INTERVAL_END	= 0x1,
-+	NFT_SET_ELEM_CATCHALL		= 0x2,
- };
- 
- /**
-@@ -363,6 +416,8 @@ enum nft_set_elem_flags {
-  * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
-  * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
-  * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
-+ * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
-+ * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
-  */
- enum nft_set_elem_attributes {
- 	NFTA_SET_ELEM_UNSPEC,
-@@ -375,6 +430,8 @@ enum nft_set_elem_attributes {
- 	NFTA_SET_ELEM_EXPR,
- 	NFTA_SET_ELEM_PAD,
- 	NFTA_SET_ELEM_OBJREF,
-+	NFTA_SET_ELEM_KEY_END,
-+	NFTA_SET_ELEM_EXPRESSIONS,
- 	__NFTA_SET_ELEM_MAX
- };
- #define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)
-@@ -440,11 +497,13 @@ enum nft_data_attributes {
-  *
-  * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
-  * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
-+ * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
-  */
- enum nft_verdict_attributes {
- 	NFTA_VERDICT_UNSPEC,
- 	NFTA_VERDICT_CODE,
- 	NFTA_VERDICT_CHAIN,
-+	NFTA_VERDICT_CHAIN_ID,
- 	__NFTA_VERDICT_MAX
- };
- #define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)
-@@ -477,6 +536,20 @@ enum nft_immediate_attributes {
- };
- #define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)
- 
-+/**
-+ * enum nft_bitwise_ops - nf_tables bitwise operations
-+ *
-+ * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
-+ *                    XOR boolean operations
-+ * @NFT_BITWISE_LSHIFT: left-shift operation
-+ * @NFT_BITWISE_RSHIFT: right-shift operation
-+ */
-+enum nft_bitwise_ops {
-+	NFT_BITWISE_BOOL,
-+	NFT_BITWISE_LSHIFT,
-+	NFT_BITWISE_RSHIFT,
-+};
-+
- /**
-  * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
-  *
-@@ -485,16 +558,20 @@ enum nft_immediate_attributes {
-  * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
-  * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
-  * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
-+ * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
-+ * @NFTA_BITWISE_DATA: argument for non-boolean operations
-+ *                     (NLA_NESTED: nft_data_attributes)
-  *
-- * The bitwise expression performs the following operation:
-+ * The bitwise expression supports boolean and shift operations.  It implements
-+ * the boolean operations by performing the following operation:
-  *
-  * dreg = (sreg & mask) ^ xor
-  *
-- * which allow to express all bitwise operations:
-+ * with these mask and xor values:
-  *
-  * 		mask	xor
-  * NOT:		1	1
-- * OR:		0	x
-+ * OR:		~x	x
-  * XOR:		1	x
-  * AND:		x	0
-  */
-@@ -505,6 +582,8 @@ enum nft_bitwise_attributes {
- 	NFTA_BITWISE_LEN,
- 	NFTA_BITWISE_MASK,
- 	NFTA_BITWISE_XOR,
-+	NFTA_BITWISE_OP,
-+	NFTA_BITWISE_DATA,
- 	__NFTA_BITWISE_MAX
- };
- #define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
-@@ -631,10 +710,12 @@ enum nft_lookup_attributes {
- enum nft_dynset_ops {
- 	NFT_DYNSET_OP_ADD,
- 	NFT_DYNSET_OP_UPDATE,
-+	NFT_DYNSET_OP_DELETE,
- };
- 
- enum nft_dynset_flags {
- 	NFT_DYNSET_F_INV	= (1 << 0),
-+	NFT_DYNSET_F_EXPR	= (1 << 1),
- };
- 
- /**
-@@ -648,6 +729,7 @@ enum nft_dynset_flags {
-  * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
-  * @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
-  * @NFTA_DYNSET_FLAGS: flags (NLA_U32)
-+ * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
-  */
- enum nft_dynset_attributes {
- 	NFTA_DYNSET_UNSPEC,
-@@ -660,6 +742,7 @@ enum nft_dynset_attributes {
- 	NFTA_DYNSET_EXPR,
- 	NFTA_DYNSET_PAD,
- 	NFTA_DYNSET_FLAGS,
-+	NFTA_DYNSET_EXPRESSIONS,
- 	__NFTA_DYNSET_MAX,
- };
- #define NFTA_DYNSET_MAX		(__NFTA_DYNSET_MAX - 1)
-@@ -682,10 +765,12 @@ enum nft_payload_bases {
-  *
-  * @NFT_PAYLOAD_CSUM_NONE: no checksumming
-  * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
-+ * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
-  */
- enum nft_payload_csum_types {
- 	NFT_PAYLOAD_CSUM_NONE,
- 	NFT_PAYLOAD_CSUM_INET,
-+	NFT_PAYLOAD_CSUM_SCTP,
- };
- 
- enum nft_payload_csum_flags {
-@@ -727,10 +812,14 @@ enum nft_exthdr_flags {
-  *
-  * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
-  * @NFT_EXTHDR_OP_TCP: match against tcp options
-+ * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
-+ * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
-  */
- enum nft_exthdr_op {
- 	NFT_EXTHDR_OP_IPV6,
- 	NFT_EXTHDR_OP_TCPOPT,
-+	NFT_EXTHDR_OP_IPV4,
-+	NFT_EXTHDR_OP_SCTP,
- 	__NFT_EXTHDR_OP_MAX
- };
- #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
-@@ -788,6 +877,15 @@ enum nft_exthdr_attributes {
-  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
-  * @NFT_META_PRANDOM: a 32bit pseudo-random number
-  * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
-+ * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
-+ * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
-+ * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
-+ * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
-+ * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
-+ * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
-+ * @NFT_META_TIME_HOUR: hour of day (in seconds)
-+ * @NFT_META_SDIF: slave device interface index
-+ * @NFT_META_SDIFNAME: slave device interface name
-  */
- enum nft_meta_keys {
- 	NFT_META_LEN,
-@@ -816,6 +914,15 @@ enum nft_meta_keys {
- 	NFT_META_CGROUP,
- 	NFT_META_PRANDOM,
- 	NFT_META_SECPATH,
-+	NFT_META_IIFKIND,
-+	NFT_META_OIFKIND,
-+	NFT_META_BRI_IIFPVID,
-+	NFT_META_BRI_IIFVPROTO,
-+	NFT_META_TIME_NS,
-+	NFT_META_TIME_DAY,
-+	NFT_META_TIME_HOUR,
-+	NFT_META_SDIF,
-+	NFT_META_SDIFNAME,
- };
- 
- /**
-@@ -825,13 +932,17 @@ enum nft_meta_keys {
-  * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
-  * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
-  * @NFT_RT_TCPMSS: fetch current path tcp mss
-+ * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
-  */
- enum nft_rt_keys {
- 	NFT_RT_CLASSID,
- 	NFT_RT_NEXTHOP4,
- 	NFT_RT_NEXTHOP6,
- 	NFT_RT_TCPMSS,
-+	NFT_RT_XFRM,
-+	__NFT_RT_MAX
- };
-+#define NFT_RT_MAX		(__NFT_RT_MAX - 1)
- 
- /**
-  * enum nft_hash_types - nf_tables hash expression types
-@@ -854,6 +965,8 @@ enum nft_hash_types {
-  * @NFTA_HASH_SEED: seed value (NLA_U32)
-  * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
-  * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
-+ * @NFTA_HASH_SET_NAME: name of the map to lookup (NLA_STRING)
-+ * @NFTA_HASH_SET_ID: id of the map (NLA_U32)
-  */
- enum nft_hash_attributes {
- 	NFTA_HASH_UNSPEC,
-@@ -864,6 +977,8 @@ enum nft_hash_attributes {
- 	NFTA_HASH_SEED,
- 	NFTA_HASH_OFFSET,
- 	NFTA_HASH_TYPE,
-+	NFTA_HASH_SET_NAME,	/* deprecated */
-+	NFTA_HASH_SET_ID,	/* deprecated */
- 	__NFTA_HASH_MAX,
- };
- #define NFTA_HASH_MAX	(__NFTA_HASH_MAX - 1)
-@@ -898,6 +1013,39 @@ enum nft_rt_attributes {
- };
- #define NFTA_RT_MAX		(__NFTA_RT_MAX - 1)
- 
-+/**
-+ * enum nft_socket_attributes - nf_tables socket expression netlink attributes
-+ *
-+ * @NFTA_SOCKET_KEY: socket key to match
-+ * @NFTA_SOCKET_DREG: destination register
-+ * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
-+ */
-+enum nft_socket_attributes {
-+	NFTA_SOCKET_UNSPEC,
-+	NFTA_SOCKET_KEY,
-+	NFTA_SOCKET_DREG,
-+	NFTA_SOCKET_LEVEL,
-+	__NFTA_SOCKET_MAX
-+};
-+#define NFTA_SOCKET_MAX		(__NFTA_SOCKET_MAX - 1)
-+
-+/*
-+ * enum nft_socket_keys - nf_tables socket expression keys
-+ *
-+ * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
-+ * @NFT_SOCKET_MARK: Value of the socket mark
-+ * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
-+ * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
-+ */
-+enum nft_socket_keys {
-+	NFT_SOCKET_TRANSPARENT,
-+	NFT_SOCKET_MARK,
-+	NFT_SOCKET_WILDCARD,
-+	NFT_SOCKET_CGROUPV2,
-+	__NFT_SOCKET_MAX
-+};
-+#define NFT_SOCKET_MAX	(__NFT_SOCKET_MAX - 1)
-+
- /**
-  * enum nft_ct_keys - nf_tables ct expression keys
-  *
-@@ -909,8 +1057,8 @@ enum nft_rt_attributes {
-  * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
-  * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
-  * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
-- * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
-- * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
-+ * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address, deprecated)
-+ * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address, deprecated)
-  * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
-  * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
-  * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
-@@ -920,6 +1068,11 @@ enum nft_rt_attributes {
-  * @NFT_CT_AVGPKT: conntrack average bytes per packet
-  * @NFT_CT_ZONE: conntrack zone
-  * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
-+ * @NFT_CT_SRC_IP: conntrack layer 3 protocol source (IPv4 address)
-+ * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address)
-+ * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)
-+ * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)
-+ * @NFT_CT_ID: conntrack id
-  */
- enum nft_ct_keys {
- 	NFT_CT_STATE,
-@@ -941,7 +1094,14 @@ enum nft_ct_keys {
- 	NFT_CT_AVGPKT,
- 	NFT_CT_ZONE,
- 	NFT_CT_EVENTMASK,
-+	NFT_CT_SRC_IP,
-+	NFT_CT_DST_IP,
-+	NFT_CT_SRC_IP6,
-+	NFT_CT_DST_IP6,
-+	NFT_CT_ID,
-+	__NFT_CT_MAX
- };
-+#define NFT_CT_MAX		(__NFT_CT_MAX - 1)
- 
- /**
-  * enum nft_ct_attributes - nf_tables ct expression netlink attributes
-@@ -1002,6 +1162,24 @@ enum nft_limit_attributes {
- };
- #define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)
- 
-+enum nft_connlimit_flags {
-+	NFT_CONNLIMIT_F_INV	= (1 << 0),
-+};
-+
-+/**
-+ * enum nft_connlimit_attributes - nf_tables connlimit expression netlink attributes
-+ *
-+ * @NFTA_CONNLIMIT_COUNT: number of connections (NLA_U32)
-+ * @NFTA_CONNLIMIT_FLAGS: flags (NLA_U32: enum nft_connlimit_flags)
-+ */
-+enum nft_connlimit_attributes {
-+	NFTA_CONNLIMIT_UNSPEC,
-+	NFTA_CONNLIMIT_COUNT,
-+	NFTA_CONNLIMIT_FLAGS,
-+	__NFTA_CONNLIMIT_MAX
-+};
-+#define NFTA_CONNLIMIT_MAX	(__NFTA_CONNLIMIT_MAX - 1)
-+
- /**
-  * enum nft_counter_attributes - nf_tables counter expression netlink attributes
-  *
-@@ -1017,6 +1195,21 @@ enum nft_counter_attributes {
- };
- #define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)
- 
-+/**
-+ * enum nft_last_attributes - nf_tables last expression netlink attributes
-+ *
-+ * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
-+ * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
-+ */
-+enum nft_last_attributes {
-+	NFTA_LAST_UNSPEC,
-+	NFTA_LAST_SET,
-+	NFTA_LAST_MSECS,
-+	NFTA_LAST_PAD,
-+	__NFTA_LAST_MAX
-+};
-+#define NFTA_LAST_MAX	(__NFTA_LAST_MAX - 1)
-+
- /**
-  * enum nft_log_attributes - nf_tables log expression netlink attributes
-  *
-@@ -1039,6 +1232,33 @@ enum nft_log_attributes {
- };
- #define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)
- 
-+/**
-+ * enum nft_log_level - nf_tables log levels
-+ *
-+ * @NFT_LOGLEVEL_EMERG: system is unusable
-+ * @NFT_LOGLEVEL_ALERT: action must be taken immediately
-+ * @NFT_LOGLEVEL_CRIT: critical conditions
-+ * @NFT_LOGLEVEL_ERR: error conditions
-+ * @NFT_LOGLEVEL_WARNING: warning conditions
-+ * @NFT_LOGLEVEL_NOTICE: normal but significant condition
-+ * @NFT_LOGLEVEL_INFO: informational
-+ * @NFT_LOGLEVEL_DEBUG: debug-level messages
-+ * @NFT_LOGLEVEL_AUDIT: enabling audit logging
-+ */
-+enum nft_log_level {
-+	NFT_LOGLEVEL_EMERG,
-+	NFT_LOGLEVEL_ALERT,
-+	NFT_LOGLEVEL_CRIT,
-+	NFT_LOGLEVEL_ERR,
-+	NFT_LOGLEVEL_WARNING,
-+	NFT_LOGLEVEL_NOTICE,
-+	NFT_LOGLEVEL_INFO,
-+	NFT_LOGLEVEL_DEBUG,
-+	NFT_LOGLEVEL_AUDIT,
-+	__NFT_LOGLEVEL_MAX
-+};
-+#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
-+
- /**
-  * enum nft_queue_attributes - nf_tables queue expression netlink attributes
-  *
-@@ -1083,6 +1303,21 @@ enum nft_quota_attributes {
- };
- #define NFTA_QUOTA_MAX		(__NFTA_QUOTA_MAX - 1)
- 
-+/**
-+ * enum nft_secmark_attributes - nf_tables secmark object netlink attributes
-+ *
-+ * @NFTA_SECMARK_CTX: security context (NLA_STRING)
-+ */
-+enum nft_secmark_attributes {
-+	NFTA_SECMARK_UNSPEC,
-+	NFTA_SECMARK_CTX,
-+	__NFTA_SECMARK_MAX,
-+};
-+#define NFTA_SECMARK_MAX	(__NFTA_SECMARK_MAX - 1)
-+
-+/* Max security context length */
-+#define NFT_SECMARK_CTX_MAXLEN		256
-+
- /**
-  * enum nft_reject_types - nf_tables reject expression reject types
-  *
-@@ -1164,6 +1399,22 @@ enum nft_nat_attributes {
- };
- #define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)
- 
-+/**
-+ * enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
-+ *
-+ * NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
-+ * NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
-+ * NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
-+ */
-+enum nft_tproxy_attributes {
-+	NFTA_TPROXY_UNSPEC,
-+	NFTA_TPROXY_FAMILY,
-+	NFTA_TPROXY_REG_ADDR,
-+	NFTA_TPROXY_REG_PORT,
-+	__NFTA_TPROXY_MAX
-+};
-+#define NFTA_TPROXY_MAX		(__NFTA_TPROXY_MAX - 1)
-+
- /**
-  * enum nft_masq_attributes - nf_tables masquerade expression attributes
-  *
-@@ -1214,10 +1465,14 @@ enum nft_dup_attributes {
-  * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
-  *
-  * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
-+ * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register)
-+ * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto)
-  */
- enum nft_fwd_attributes {
- 	NFTA_FWD_UNSPEC,
- 	NFTA_FWD_SREG_DEV,
-+	NFTA_FWD_SREG_ADDR,
-+	NFTA_FWD_NFPROTO,
- 	__NFTA_FWD_MAX
- };
- #define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)
-@@ -1302,12 +1557,38 @@ enum nft_ct_helper_attributes {
- };
- #define NFTA_CT_HELPER_MAX	(__NFTA_CT_HELPER_MAX - 1)
- 
-+enum nft_ct_timeout_timeout_attributes {
-+	NFTA_CT_TIMEOUT_UNSPEC,
-+	NFTA_CT_TIMEOUT_L3PROTO,
-+	NFTA_CT_TIMEOUT_L4PROTO,
-+	NFTA_CT_TIMEOUT_DATA,
-+	__NFTA_CT_TIMEOUT_MAX,
-+};
-+#define NFTA_CT_TIMEOUT_MAX	(__NFTA_CT_TIMEOUT_MAX - 1)
-+
-+enum nft_ct_expectation_attributes {
-+	NFTA_CT_EXPECT_UNSPEC,
-+	NFTA_CT_EXPECT_L3PROTO,
-+	NFTA_CT_EXPECT_L4PROTO,
-+	NFTA_CT_EXPECT_DPORT,
-+	NFTA_CT_EXPECT_TIMEOUT,
-+	NFTA_CT_EXPECT_SIZE,
-+	__NFTA_CT_EXPECT_MAX,
-+};
-+#define NFTA_CT_EXPECT_MAX	(__NFTA_CT_EXPECT_MAX - 1)
-+
- #define NFT_OBJECT_UNSPEC	0
- #define NFT_OBJECT_COUNTER	1
- #define NFT_OBJECT_QUOTA	2
- #define NFT_OBJECT_CT_HELPER	3
- #define NFT_OBJECT_LIMIT	4
--#define __NFT_OBJECT_MAX	5
-+#define NFT_OBJECT_CONNLIMIT	5
-+#define NFT_OBJECT_TUNNEL	6
-+#define NFT_OBJECT_CT_TIMEOUT	7
-+#define NFT_OBJECT_SECMARK	8
-+#define NFT_OBJECT_CT_EXPECT	9
-+#define NFT_OBJECT_SYNPROXY	10
-+#define __NFT_OBJECT_MAX	11
- #define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
- 
- /**
-@@ -1319,6 +1600,7 @@ enum nft_ct_helper_attributes {
-  * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
-  * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
-  * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
-+ * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
-  */
- enum nft_object_attributes {
- 	NFTA_OBJ_UNSPEC,
-@@ -1329,10 +1611,24 @@ enum nft_object_attributes {
- 	NFTA_OBJ_USE,
- 	NFTA_OBJ_HANDLE,
- 	NFTA_OBJ_PAD,
-+	NFTA_OBJ_USERDATA,
- 	__NFTA_OBJ_MAX
- };
- #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
- 
-+/**
-+ * enum nft_flowtable_flags - nf_tables flowtable flags
-+ *
-+ * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
-+ * @NFT_FLOWTABLE_COUNTER: enable flow counters
-+ */
-+enum nft_flowtable_flags {
-+	NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
-+	NFT_FLOWTABLE_COUNTER		= 0x2,
-+	NFT_FLOWTABLE_MASK		= (NFT_FLOWTABLE_HW_OFFLOAD |
-+					   NFT_FLOWTABLE_COUNTER)
-+};
-+
- /**
-  * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
-  *
-@@ -1341,6 +1637,7 @@ enum nft_object_attributes {
-  * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
-  * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
-  * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
-+ * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
-  */
- enum nft_flowtable_attributes {
- 	NFTA_FLOWTABLE_UNSPEC,
-@@ -1350,6 +1647,7 @@ enum nft_flowtable_attributes {
- 	NFTA_FLOWTABLE_USE,
- 	NFTA_FLOWTABLE_HANDLE,
- 	NFTA_FLOWTABLE_PAD,
-+	NFTA_FLOWTABLE_FLAGS,
- 	__NFTA_FLOWTABLE_MAX
- };
- #define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
-@@ -1370,6 +1668,42 @@ enum nft_flowtable_hook_attributes {
- };
- #define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
- 
-+/**
-+ * enum nft_osf_attributes - nftables osf expression netlink attributes
-+ *
-+ * @NFTA_OSF_DREG: destination register (NLA_U32: nft_registers)
-+ * @NFTA_OSF_TTL: Value of the TTL osf option (NLA_U8)
-+ * @NFTA_OSF_FLAGS: flags (NLA_U32)
-+ */
-+enum nft_osf_attributes {
-+	NFTA_OSF_UNSPEC,
-+	NFTA_OSF_DREG,
-+	NFTA_OSF_TTL,
-+	NFTA_OSF_FLAGS,
-+	__NFTA_OSF_MAX,
-+};
-+#define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1)
-+
-+enum nft_osf_flags {
-+	NFT_OSF_F_VERSION = (1 << 0),
-+};
-+
-+/**
-+ * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
-+ *
-+ * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
-+ * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
-+ * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
-+ */
-+enum nft_synproxy_attributes {
-+	NFTA_SYNPROXY_UNSPEC,
-+	NFTA_SYNPROXY_MSS,
-+	NFTA_SYNPROXY_WSCALE,
-+	NFTA_SYNPROXY_FLAGS,
-+	__NFTA_SYNPROXY_MAX,
-+};
-+#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
-+
- /**
-  * enum nft_device_attributes - nf_tables device netlink attributes
-  *
-@@ -1382,6 +1716,35 @@ enum nft_devices_attributes {
- };
- #define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)
- 
-+/*
-+ * enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
-+ *
-+ * @NFTA_XFRM_DREG: destination register (NLA_U32)
-+ * @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
-+ * @NFTA_XFRM_DIR: direction (NLA_U8)
-+ * @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
-+ */
-+enum nft_xfrm_attributes {
-+	NFTA_XFRM_UNSPEC,
-+	NFTA_XFRM_DREG,
-+	NFTA_XFRM_KEY,
-+	NFTA_XFRM_DIR,
-+	NFTA_XFRM_SPNUM,
-+	__NFTA_XFRM_MAX
-+};
-+#define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
-+
-+enum nft_xfrm_keys {
-+	NFT_XFRM_KEY_UNSPEC,
-+	NFT_XFRM_KEY_DADDR_IP4,
-+	NFT_XFRM_KEY_DADDR_IP6,
-+	NFT_XFRM_KEY_SADDR_IP4,
-+	NFT_XFRM_KEY_SADDR_IP6,
-+	NFT_XFRM_KEY_REQID,
-+	NFT_XFRM_KEY_SPI,
-+	__NFT_XFRM_KEY_MAX,
-+};
-+#define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
- 
- /**
-  * enum nft_trace_attributes - nf_tables trace netlink attributes
-@@ -1442,6 +1805,8 @@ enum nft_trace_types {
-  * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
-  * @NFTA_NG_TYPE: operation type (NLA_U32)
-  * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
-+ * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
-+ * @NFTA_NG_SET_ID: id of the map (NLA_U32)
-  */
- enum nft_ng_attributes {
- 	NFTA_NG_UNSPEC,
-@@ -1449,6 +1814,8 @@ enum nft_ng_attributes {
- 	NFTA_NG_MODULUS,
- 	NFTA_NG_TYPE,
- 	NFTA_NG_OFFSET,
-+	NFTA_NG_SET_NAME,	/* deprecated */
-+	NFTA_NG_SET_ID,		/* deprecated */
- 	__NFTA_NG_MAX
- };
- #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
-@@ -1460,4 +1827,104 @@ enum nft_ng_types {
- };
- #define NFT_NG_MAX	(__NFT_NG_MAX - 1)
- 
-+enum nft_tunnel_key_ip_attributes {
-+	NFTA_TUNNEL_KEY_IP_UNSPEC,
-+	NFTA_TUNNEL_KEY_IP_SRC,
-+	NFTA_TUNNEL_KEY_IP_DST,
-+	__NFTA_TUNNEL_KEY_IP_MAX
-+};
-+#define NFTA_TUNNEL_KEY_IP_MAX	(__NFTA_TUNNEL_KEY_IP_MAX - 1)
-+
-+enum nft_tunnel_ip6_attributes {
-+	NFTA_TUNNEL_KEY_IP6_UNSPEC,
-+	NFTA_TUNNEL_KEY_IP6_SRC,
-+	NFTA_TUNNEL_KEY_IP6_DST,
-+	NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
-+	__NFTA_TUNNEL_KEY_IP6_MAX
-+};
-+#define NFTA_TUNNEL_KEY_IP6_MAX	(__NFTA_TUNNEL_KEY_IP6_MAX - 1)
-+
-+enum nft_tunnel_opts_attributes {
-+	NFTA_TUNNEL_KEY_OPTS_UNSPEC,
-+	NFTA_TUNNEL_KEY_OPTS_VXLAN,
-+	NFTA_TUNNEL_KEY_OPTS_ERSPAN,
-+	NFTA_TUNNEL_KEY_OPTS_GENEVE,
-+	__NFTA_TUNNEL_KEY_OPTS_MAX
-+};
-+#define NFTA_TUNNEL_KEY_OPTS_MAX	(__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
-+
-+enum nft_tunnel_opts_vxlan_attributes {
-+	NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
-+	NFTA_TUNNEL_KEY_VXLAN_GBP,
-+	__NFTA_TUNNEL_KEY_VXLAN_MAX
-+};
-+#define NFTA_TUNNEL_KEY_VXLAN_MAX	(__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
-+
-+enum nft_tunnel_opts_erspan_attributes {
-+	NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
-+	NFTA_TUNNEL_KEY_ERSPAN_VERSION,
-+	NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
-+	NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
-+	NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
-+	__NFTA_TUNNEL_KEY_ERSPAN_MAX
-+};
-+#define NFTA_TUNNEL_KEY_ERSPAN_MAX	(__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
-+
-+enum nft_tunnel_opts_geneve_attributes {
-+	NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
-+	NFTA_TUNNEL_KEY_GENEVE_CLASS,
-+	NFTA_TUNNEL_KEY_GENEVE_TYPE,
-+	NFTA_TUNNEL_KEY_GENEVE_DATA,
-+	__NFTA_TUNNEL_KEY_GENEVE_MAX
-+};
-+#define NFTA_TUNNEL_KEY_GENEVE_MAX	(__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
-+
-+enum nft_tunnel_flags {
-+	NFT_TUNNEL_F_ZERO_CSUM_TX	= (1 << 0),
-+	NFT_TUNNEL_F_DONT_FRAGMENT	= (1 << 1),
-+	NFT_TUNNEL_F_SEQ_NUMBER		= (1 << 2),
-+};
-+#define NFT_TUNNEL_F_MASK	(NFT_TUNNEL_F_ZERO_CSUM_TX | \
-+				 NFT_TUNNEL_F_DONT_FRAGMENT | \
-+				 NFT_TUNNEL_F_SEQ_NUMBER)
-+
-+enum nft_tunnel_key_attributes {
-+	NFTA_TUNNEL_KEY_UNSPEC,
-+	NFTA_TUNNEL_KEY_ID,
-+	NFTA_TUNNEL_KEY_IP,
-+	NFTA_TUNNEL_KEY_IP6,
-+	NFTA_TUNNEL_KEY_FLAGS,
-+	NFTA_TUNNEL_KEY_TOS,
-+	NFTA_TUNNEL_KEY_TTL,
-+	NFTA_TUNNEL_KEY_SPORT,
-+	NFTA_TUNNEL_KEY_DPORT,
-+	NFTA_TUNNEL_KEY_OPTS,
-+	__NFTA_TUNNEL_KEY_MAX
-+};
-+#define NFTA_TUNNEL_KEY_MAX	(__NFTA_TUNNEL_KEY_MAX - 1)
-+
-+enum nft_tunnel_keys {
-+	NFT_TUNNEL_PATH,
-+	NFT_TUNNEL_ID,
-+	__NFT_TUNNEL_MAX
-+};
-+#define NFT_TUNNEL_MAX	(__NFT_TUNNEL_MAX - 1)
-+
-+enum nft_tunnel_mode {
-+	NFT_TUNNEL_MODE_NONE,
-+	NFT_TUNNEL_MODE_RX,
-+	NFT_TUNNEL_MODE_TX,
-+	__NFT_TUNNEL_MODE_MAX
-+};
-+#define NFT_TUNNEL_MODE_MAX	(__NFT_TUNNEL_MODE_MAX - 1)
-+
-+enum nft_tunnel_attributes {
-+	NFTA_TUNNEL_UNSPEC,
-+	NFTA_TUNNEL_KEY,
-+	NFTA_TUNNEL_DREG,
-+	NFTA_TUNNEL_MODE,
-+	__NFTA_TUNNEL_MAX
-+};
-+#define NFTA_TUNNEL_MAX	(__NFTA_TUNNEL_MAX - 1)
-+
- #endif /* _LINUX_NF_TABLES_H */
-diff --git a/iptables/nft.c b/iptables/nft.c
-index c130369f78348..0ec7679d25289 100644
---- a/iptables/nft.c
-+++ b/iptables/nft.c
-@@ -1086,7 +1086,7 @@ static int __add_nft_among(struct nft_handle *h, const char *table,
- 		type = type << CONCAT_TYPE_BITS | NFT_DATATYPE_IPADDR;
- 		len += sizeof(struct in_addr) + NETLINK_ALIGN - 1;
- 		len &= ~(NETLINK_ALIGN - 1);
--		flags = NFT_SET_INTERVAL;
-+		flags = NFT_SET_INTERVAL | NFT_SET_CONCAT;
- 	}
- 
- 	s = add_anon_set(h, table, flags, type, len, cnt);
--- 
-2.40.0
-

SOURCES/0081-nft-shared-Introduce-__get_cmp_data.patch

@@ -1,67 +0,0 @@
-From 116427bbf1365e2d284e7410a125205a983c0b1b Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 27 Sep 2022 23:15:37 +0200
-Subject: [PATCH] nft-shared: Introduce __get_cmp_data()
-
-This is an inner function to get_cmp_data() returning the op value as-is
-for caller examination.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 8dc22798bf813ce92aaac58a6fe8749fe3fc18dc)
-
-Conflicts:
-	iptables/nft-shared.h
--> Context change due to missing commit aa92ec96078d0
-   ("nft: pass struct nft_xt_ctx to parse_meta()").
----
- iptables/nft-shared.c | 17 ++++++++++-------
- iptables/nft-shared.h |  1 +
- 2 files changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/iptables/nft-shared.c b/iptables/nft-shared.c
-index 2b934ffc17756..cb1c2d61f52c1 100644
---- a/iptables/nft-shared.c
-+++ b/iptables/nft-shared.c
-@@ -373,17 +373,20 @@ static void nft_parse_match(struct nft_xt_ctx *ctx, struct nftnl_expr *e)
- 		ctx->h->ops->parse_match(match, ctx->cs);
- }
- 
--void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv)
-+void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op)
- {
- 	uint32_t len;
--	uint8_t op;
- 
- 	memcpy(data, nftnl_expr_get(e, NFTNL_EXPR_CMP_DATA, &len), dlen);
--	op = nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP);
--	if (op == NFT_CMP_NEQ)
--		*inv = true;
--	else
--		*inv = false;
-+	*op = nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP);
-+}
-+
-+void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv)
-+{
-+	uint8_t op;
-+
-+	__get_cmp_data(e, data, dlen, &op);
-+	*inv = (op == NFT_CMP_NEQ);
- }
- 
- static void nft_meta_set_to_target(struct nft_xt_ctx *ctx)
-diff --git a/iptables/nft-shared.h b/iptables/nft-shared.h
-index 2c5f2cfc012d5..3531631bd8acd 100644
---- a/iptables/nft-shared.h
-+++ b/iptables/nft-shared.h
-@@ -139,6 +139,7 @@ bool is_same_interfaces(const char *a_iniface, const char *a_outiface,
- int parse_meta(struct nftnl_expr *e, uint8_t key, char *iniface,
- 		unsigned char *iniface_mask, char *outiface,
- 		unsigned char *outiface_mask, uint8_t *invflags);
-+void __get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, uint8_t *op);
- void get_cmp_data(struct nftnl_expr *e, void *data, size_t dlen, bool *inv);
- void nft_rule_to_iptables_command_state(struct nft_handle *h,
- 					const struct nftnl_rule *r,
--- 
-2.40.0
-

SOURCES/0082-ebtables-Support-p-Length.patch

@@ -1,228 +0,0 @@
-From 07007c27ceebffcb6e3223768fa876c907b0d55d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 27 Sep 2022 23:19:34 +0200
-Subject: [PATCH] ebtables: Support '-p Length'
-
-To match on Ethernet frames using the etherproto field as length value,
-ebtables accepts the special protocol name "LENGTH". Implement this in
-ebtables-nft using a native match for 'ether type < 0x0600'.
-
-Since extension 802_3 matches are valid only with such Ethernet frames,
-add a local add_match() wrapper which complains if the extension is used
-without '-p Length' parameter. Legacy ebtables does this within the
-extension's final_check callback, but it's not possible here due for lack of
-fw->bitmask field access.
-
-While being at it, add xlate support, adjust tests and make ebtables-nft
-print the case-insensitive argument with capital 'L' like legacy
-ebtables does.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit aa0b8b03f7c7e741ccd96360bd64d90ea8c3c3aa)
-
-Conflicts:
-	iptables/nft-bridge.c
--> Adjusted to missing commit 7e38890c6b4fb
-   ("nft: prepare for dynamic register allocation").
--> Context change due to missing commits 0c0cd4340ed88
-   ("nft: Don't pass command state opaque to family ops callbacks") and
-   b5881e7f22d42 ("nft: Change whitespace printing in save_rule callback").
----
- extensions/generic.txlate                     |  6 +++
- extensions/libebt_802_3.t                     |  6 ++-
- iptables/nft-bridge.c                         | 47 +++++++++++++++----
- .../ebtables/0002-ebtables-save-restore_0     | 12 ++---
- 4 files changed, 53 insertions(+), 18 deletions(-)
-
-diff --git a/extensions/generic.txlate b/extensions/generic.txlate
-index 9ae9a5b54c1b9..6779d6f86dec8 100644
---- a/extensions/generic.txlate
-+++ b/extensions/generic.txlate
-@@ -67,6 +67,12 @@ nft add rule bridge filter FORWARD iifname != "iname" meta ibrname "ilogname" oi
- ebtables-translate -I INPUT -p ip -d 1:2:3:4:5:6/ff:ff:ff:ff:00:00
- nft insert rule bridge filter INPUT ether type 0x800 ether daddr 01:02:03:04:00:00 and ff:ff:ff:ff:00:00 == 01:02:03:04:00:00 counter
- 
-+ebtables-translate -I INPUT -p Length
-+nft insert rule bridge filter INPUT ether type < 0x0600 counter
-+
-+ebtables-translate -I INPUT -p ! Length
-+nft insert rule bridge filter INPUT ether type >= 0x0600 counter
-+
- # asterisk is not special in iptables and it is even a valid interface name
- iptables-translate -A FORWARD -i '*' -o 'eth*foo'
- nft add rule ip filter FORWARD iifname "\*" oifname "eth\*foo" counter
-diff --git a/extensions/libebt_802_3.t b/extensions/libebt_802_3.t
-index ddfb2f0a72baf..a138f35d2c756 100644
---- a/extensions/libebt_802_3.t
-+++ b/extensions/libebt_802_3.t
-@@ -1,3 +1,5 @@
- :INPUT,FORWARD,OUTPUT
----802_3-sap ! 0x0a -j CONTINUE;=;OK
----802_3-type 0x000a -j RETURN;=;OK
-+--802_3-sap ! 0x0a -j CONTINUE;=;FAIL
-+--802_3-type 0x000a -j RETURN;=;FAIL
-+-p Length --802_3-sap ! 0x0a -j CONTINUE;=;OK
-+-p Length --802_3-type 0x000a -j RETURN;=;OK
-diff --git a/iptables/nft-bridge.c b/iptables/nft-bridge.c
-index 9cc6f87b28fe0..fbed1616253a6 100644
---- a/iptables/nft-bridge.c
-+++ b/iptables/nft-bridge.c
-@@ -129,6 +129,18 @@ static int _add_action(struct nftnl_rule *r, struct iptables_command_state *cs)
- 	return add_action(r, cs, false);
- }
- 
-+static int
-+nft_bridge_add_match(struct nft_handle *h, const struct ebt_entry *fw,
-+		     struct nftnl_rule *r, struct xt_entry_match *m)
-+{
-+	if (!strcmp(m->u.user.name, "802_3") &&
-+	    !(fw->bitmask & EBT_802_3))
-+		xtables_error(PARAMETER_PROBLEM,
-+			      "For 802.3 DSAP/SSAP filtering the protocol must be LENGTH");
-+
-+	return add_match(h, r, m);
-+}
-+
- static int nft_bridge_add(struct nft_handle *h,
- 			  struct nftnl_rule *r, void *data)
- {
-@@ -172,17 +184,25 @@ static int nft_bridge_add(struct nft_handle *h,
- 	}
- 
- 	if ((fw->bitmask & EBT_NOPROTO) == 0) {
-+		uint16_t ethproto = fw->ethproto;
-+
- 		op = nft_invflags2cmp(fw->invflags, EBT_IPROTO);
- 		add_payload(r, offsetof(struct ethhdr, h_proto), 2,
- 			    NFT_PAYLOAD_LL_HEADER);
--		add_cmp_u16(r, fw->ethproto, op);
-+
-+		if (fw->bitmask & EBT_802_3) {
-+			op = (op == NFT_CMP_EQ ? NFT_CMP_LT : NFT_CMP_GTE);
-+			ethproto = htons(0x0600);
-+		}
-+
-+		add_cmp_u16(r, ethproto, op);
- 	}
- 
- 	add_compat(r, fw->ethproto, fw->invflags & EBT_IPROTO);
- 
- 	for (iter = cs->match_list; iter; iter = iter->next) {
- 		if (iter->ismatch) {
--			if (add_match(h, r, iter->u.match->m))
-+			if (nft_bridge_add_match(h, fw, r, iter->u.match->m))
- 				break;
- 		} else {
- 			if (add_target(r, iter->u.watcher->t))
-@@ -239,6 +259,7 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
- 	struct ebt_entry *fw = &cs->eb;
- 	unsigned char addr[ETH_ALEN];
- 	unsigned short int ethproto;
-+	uint8_t op;
- 	bool inv;
- 	int i;
- 
-@@ -275,8 +296,14 @@ static void nft_bridge_parse_payload(struct nft_xt_ctx *ctx,
- 		fw->bitmask |= EBT_ISOURCE;
- 		break;
- 	case offsetof(struct ethhdr, h_proto):
--		get_cmp_data(e, &ethproto, sizeof(ethproto), &inv);
--		fw->ethproto = ethproto;
-+		__get_cmp_data(e, &ethproto, sizeof(ethproto), &op);
-+		if (ethproto == htons(0x0600)) {
-+			fw->bitmask |= EBT_802_3;
-+			inv = (op == NFT_CMP_GTE);
-+		} else {
-+			fw->ethproto = ethproto;
-+			inv = (op == NFT_CMP_NEQ);
-+		}
- 		if (inv)
- 			fw->invflags |= EBT_IPROTO;
- 		fw->bitmask &= ~EBT_NOPROTO;
-@@ -620,7 +647,7 @@ static void print_protocol(uint16_t ethproto, bool invert, unsigned int bitmask)
- 		printf("! ");
- 
- 	if (bitmask & EBT_802_3) {
--		printf("length ");
-+		printf("Length ");
- 		return;
- 	}
- 
-@@ -635,7 +662,7 @@ static void nft_bridge_save_rule(const void *data, unsigned int format)
- {
- 	const struct iptables_command_state *cs = data;
- 
--	if (cs->eb.ethproto)
-+	if (!(cs->eb.bitmask & EBT_NOPROTO))
- 		print_protocol(cs->eb.ethproto, cs->eb.invflags & EBT_IPROTO,
- 			       cs->eb.bitmask);
- 	if (cs->eb.bitmask & EBT_ISOURCE)
-@@ -866,7 +893,10 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
- 	xlate_ifname(xl, "meta obrname", cs->eb.logical_out,
- 		     cs->eb.invflags & EBT_ILOGICALOUT);
- 
--	if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {
-+	if (cs->eb.bitmask & EBT_802_3) {
-+		xt_xlate_add(xl, "ether type %s 0x0600 ",
-+			     cs->eb.invflags & EBT_IPROTO ? ">=" : "<");
-+	} else if ((cs->eb.bitmask & EBT_NOPROTO) == 0) {
- 		const char *implicit = NULL;
- 
- 		switch (ntohs(cs->eb.ethproto)) {
-@@ -889,9 +919,6 @@ static int nft_bridge_xlate(const void *data, struct xt_xlate *xl)
- 				     ntohs(cs->eb.ethproto));
- 	}
- 
--	if (cs->eb.bitmask & EBT_802_3)
--		return 0;
--
- 	if (cs->eb.bitmask & EBT_ISOURCE)
- 		nft_bridge_xlate_mac(xl, "saddr", cs->eb.invflags & EBT_ISOURCE,
- 				     cs->eb.sourcemac, cs->eb.sourcemsk);
-diff --git a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0 b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
-index b84f63a7c3672..a4fc31548e323 100755
---- a/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
-+++ b/iptables/tests/shell/testcases/ebtables/0002-ebtables-save-restore_0
-@@ -13,8 +13,8 @@ $XT_MULTI ebtables -A INPUT -p IPv4 -i lo -j ACCEPT
- $XT_MULTI ebtables -P FORWARD DROP
- $XT_MULTI ebtables -A OUTPUT -s ff:ff:ff:ff:ff:ff/ff:ff:ff:ff:ff:ff -j DROP
- $XT_MULTI ebtables -N foo
--$XT_MULTI ebtables -A foo --802_3-sap 0x23 -j ACCEPT
--$XT_MULTI ebtables -A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
-+$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 -j ACCEPT
-+$XT_MULTI ebtables -A foo -p length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
- #$XT_MULTI ebtables -A foo --among-dst fe:ed:ba:be:00:01,fe:ed:ba:be:00:02,fe:ed:ba:be:00:03 -j ACCEPT
- $XT_MULTI ebtables -A foo -p ARP --arp-gratuitous -j ACCEPT
- $XT_MULTI ebtables -A foo -p ARP --arp-opcode Request -j ACCEPT
-@@ -44,7 +44,7 @@ $XT_MULTI ebtables -A foo --pkttype-type multicast -j ACCEPT
- $XT_MULTI ebtables -A foo --stp-type config -j ACCEPT
- #$XT_MULTI ebtables -A foo --vlan-id 42 -j ACCEPT
- 
--$XT_MULTI ebtables -A foo --802_3-sap 0x23 --limit 100 -j ACCEPT
-+$XT_MULTI ebtables -A foo -p length --802_3-sap 0x23 --limit 100 -j ACCEPT
- $XT_MULTI ebtables -A foo --pkttype-type multicast --log
- $XT_MULTI ebtables -A foo --pkttype-type multicast --limit 100 -j ACCEPT
- 
-@@ -75,8 +75,8 @@ DUMP='*filter
- -A INPUT -p IPv4 -i lo -j ACCEPT
- -A FORWARD -j foo
- -A OUTPUT -s Broadcast -j DROP
---A foo --802_3-sap 0x23 -j ACCEPT
---A foo --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
-+-A foo -p Length --802_3-sap 0x23 -j ACCEPT
-+-A foo -p Length --802_3-sap 0xaa --802_3-type 0x1337 -j ACCEPT
- -A foo -p ARP --arp-gratuitous -j ACCEPT
- -A foo -p ARP --arp-op Request -j ACCEPT
- -A foo -p ARP --arp-ip-src 10.0.0.1 -j ACCEPT
-@@ -96,7 +96,7 @@ DUMP='*filter
- -A foo --nflog-group 1 -j CONTINUE
- -A foo --pkttype-type multicast -j ACCEPT
- -A foo --stp-type config -j ACCEPT
---A foo --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT
-+-A foo -p Length --802_3-sap 0x23 --limit 100/sec --limit-burst 5 -j ACCEPT
- -A foo --pkttype-type multicast --log-level notice --log-prefix "" -j CONTINUE
- -A foo --pkttype-type multicast --limit 100/sec --limit-burst 5 -j ACCEPT
- *nat
--- 
-2.40.0
-

SOURCES/0083-extensions-among-Remove-pointless-fall-through.patch

@@ -1,36 +0,0 @@
-From bf73dcb492c75cc03aeb945b749a49a529090ae3 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Thu, 29 Sep 2022 19:11:55 +0200
-Subject: [PATCH] extensions: among: Remove pointless fall through
-
-This seems to be a leftover from an earlier version of the switch().
-This fall through is never effective as the next case's code will never
-apply. So just break instead.
-
-Fixes: 26753888720d8 ("nft: bridge: Rudimental among extension support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit eafe731a50058ed59305ee4ab1ea2d63d6c4e86e)
----
- extensions/libebt_among.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/extensions/libebt_among.c b/extensions/libebt_among.c
-index 7eb898f984bba..c607a775539d3 100644
---- a/extensions/libebt_among.c
-+++ b/extensions/libebt_among.c
-@@ -152,10 +152,9 @@ static int bramong_parse(int c, char **argv, int invert,
- 			xtables_error(PARAMETER_PROBLEM,
- 				      "File should only contain one line");
- 		optarg[flen-1] = '\0';
--		/* fall through */
-+		break;
- 	case AMONG_DST:
--		if (c == AMONG_DST)
--			dst = true;
-+		dst = true;
- 		/* fall through */
- 	case AMONG_SRC:
- 		break;
--- 
-2.40.0
-