diff --git a/.gitignore b/.gitignore
index f8f5b8b..c9b6c1e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/nftables-0.9.8.tar.bz2
+SOURCES/nftables-1.0.4.tar.bz2
diff --git a/.nftables.metadata b/.nftables.metadata
index 55ded3f..b9af18b 100644
--- a/.nftables.metadata
+++ b/.nftables.metadata
@@ -1 +1 @@
-c15ac5552959c8358975f6b3e15757841c6904c8 SOURCES/nftables-0.9.8.tar.bz2
+e2e8b324cece1409a311284ff4fe26c3a5554809 SOURCES/nftables-1.0.4.tar.bz2
diff --git a/SOURCES/0001-payload-check-icmp-dependency-before-removing-previo.patch b/SOURCES/0001-payload-check-icmp-dependency-before-removing-previo.patch
deleted file mode 100644
index 7c234c4..0000000
--- a/SOURCES/0001-payload-check-icmp-dependency-before-removing-previo.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From 9230899c6d2be8913646ff1a3b560865c330de7b Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Mon, 1 Feb 2021 22:08:54 +0100
-Subject: [PATCH] payload: check icmp dependency before removing previous icmp
- expression
-
-nft is too greedy when removing icmp dependencies.
-'icmp code 1 type 2' did remove the type when printing.
-
-Be more careful and check that the icmp type dependency of the
-candidate expression (earlier icmp payload expression) has the same
-type dependency as the new expression.
-
-Reported-by: Eric Garver <eric@garver.life>
-Reported-by: Michael Biebl <biebl@debian.org>
-Tested-by: Eric Garver <eric@garver.life>
-Fixes: d0f3b9eaab8d77e ("payload: auto-remove simple icmp/icmpv6 dependency expressions")
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 533565244d88a818d8828ebabd7625e5a8a4c374)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/payload.c | 63 ++++++++++++++++++++++++++++++++++-----------------
- 1 file changed, 42 insertions(+), 21 deletions(-)
-
-diff --git a/src/payload.c b/src/payload.c
-index 48529bcf5c514..a77ca55005509 100644
---- a/src/payload.c
-+++ b/src/payload.c
-@@ -627,6 +627,40 @@ void payload_dependency_release(struct payload_dep_ctx *ctx)
- 	ctx->pdep  = NULL;
- }
- 
-+static uint8_t icmp_dep_to_type(enum icmp_hdr_field_type t)
-+{
-+	switch (t) {
-+	case PROTO_ICMP_ANY:
-+		BUG("Invalid map for simple dependency");
-+	case PROTO_ICMP_ECHO: return ICMP_ECHO;
-+	case PROTO_ICMP6_ECHO: return ICMP6_ECHO_REQUEST;
-+	case PROTO_ICMP_MTU: return ICMP_DEST_UNREACH;
-+	case PROTO_ICMP_ADDRESS: return ICMP_REDIRECT;
-+	case PROTO_ICMP6_MTU: return ICMP6_PACKET_TOO_BIG;
-+	case PROTO_ICMP6_MGMQ: return MLD_LISTENER_QUERY;
-+	case PROTO_ICMP6_PPTR: return ICMP6_PARAM_PROB;
-+	}
-+
-+	BUG("Missing icmp type mapping");
-+}
-+
-+static bool payload_may_dependency_kill_icmp(struct payload_dep_ctx *ctx, struct expr *expr)
-+{
-+	const struct expr *dep = ctx->pdep->expr;
-+	uint8_t icmp_type;
-+
-+	icmp_type = expr->payload.tmpl->icmp_dep;
-+	if (icmp_type == PROTO_ICMP_ANY)
-+		return false;
-+
-+	if (dep->left->payload.desc != expr->payload.desc)
-+		return false;
-+
-+	icmp_type = icmp_dep_to_type(expr->payload.tmpl->icmp_dep);
-+
-+	return ctx->icmp_type == icmp_type;
-+}
-+
- static bool payload_may_dependency_kill(struct payload_dep_ctx *ctx,
- 					unsigned int family, struct expr *expr)
- {
-@@ -661,6 +695,14 @@ static bool payload_may_dependency_kill(struct payload_dep_ctx *ctx,
- 		break;
- 	}
- 
-+	if (expr->payload.base == PROTO_BASE_TRANSPORT_HDR &&
-+	    dep->left->payload.base == PROTO_BASE_TRANSPORT_HDR) {
-+		if (dep->left->payload.desc == &proto_icmp)
-+			return payload_may_dependency_kill_icmp(ctx, expr);
-+		if (dep->left->payload.desc == &proto_icmp6)
-+			return payload_may_dependency_kill_icmp(ctx, expr);
-+	}
-+
- 	return true;
- }
- 
-@@ -680,10 +722,6 @@ void payload_dependency_kill(struct payload_dep_ctx *ctx, struct expr *expr,
- 	if (payload_dependency_exists(ctx, expr->payload.base) &&
- 	    payload_may_dependency_kill(ctx, family, expr))
- 		payload_dependency_release(ctx);
--	else if (ctx->icmp_type && ctx->pdep) {
--		fprintf(stderr, "Did not kill \n");
--		payload_dependency_release(ctx);
--	}
- }
- 
- void exthdr_dependency_kill(struct payload_dep_ctx *ctx, struct expr *expr,
-@@ -707,23 +745,6 @@ void exthdr_dependency_kill(struct payload_dep_ctx *ctx, struct expr *expr,
- 	}
- }
- 
--static uint8_t icmp_dep_to_type(enum icmp_hdr_field_type t)
--{
--	switch (t) {
--	case PROTO_ICMP_ANY:
--		BUG("Invalid map for simple dependency");
--	case PROTO_ICMP_ECHO: return ICMP_ECHO;
--	case PROTO_ICMP6_ECHO: return ICMP6_ECHO_REQUEST;
--	case PROTO_ICMP_MTU: return ICMP_DEST_UNREACH;
--	case PROTO_ICMP_ADDRESS: return ICMP_REDIRECT;
--	case PROTO_ICMP6_MTU: return ICMP6_PACKET_TOO_BIG;
--	case PROTO_ICMP6_MGMQ: return MLD_LISTENER_QUERY;
--	case PROTO_ICMP6_PPTR: return ICMP6_PARAM_PROB;
--	}
--
--	BUG("Missing icmp type mapping");
--}
--
- /**
-  * payload_expr_complete - fill in type information of a raw payload expr
-  *
--- 
-2.31.1
-
diff --git a/SOURCES/0001-tests-shell-runtime-set-element-automerge.patch b/SOURCES/0001-tests-shell-runtime-set-element-automerge.patch
new file mode 100644
index 0000000..12386d2
--- /dev/null
+++ b/SOURCES/0001-tests-shell-runtime-set-element-automerge.patch
@@ -0,0 +1,97 @@
+From 2a4f76ff5d5cc8d26a663ef8f8cd79c06560ca24 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 24 Jun 2022 16:02:59 +0200
+Subject: [PATCH] tests: shell: runtime set element automerge
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1917398
+Upstream Status: nftables commit 8fafe4e6b5b30
+
+commit 8fafe4e6b5b30f2539f16403da8d5c5f819e523b
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Mon Jun 13 17:05:22 2022 +0200
+
+    tests: shell: runtime set element automerge
+
+    Add a test to cover runtime set element automerge.
+
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ tests/shell/testcases/sets/automerge_0 | 64 ++++++++++++++++++++++++++
+ 1 file changed, 64 insertions(+)
+ create mode 100755 tests/shell/testcases/sets/automerge_0
+
+diff --git a/tests/shell/testcases/sets/automerge_0 b/tests/shell/testcases/sets/automerge_0
+new file mode 100755
+index 0000000..c9fb609
+--- /dev/null
++++ b/tests/shell/testcases/sets/automerge_0
+@@ -0,0 +1,64 @@
++#!/bin/bash
++
++set -e
++
++RULESET="table inet x {
++	set y {
++		type inet_service
++		flags interval
++		auto-merge
++	}
++}"
++
++$NFT -f - <<< $RULESET
++
++tmpfile=$(mktemp)
++echo -n "add element inet x y { " > $tmpfile
++for ((i=0;i<65535;i+=2))
++do
++	echo -n "$i, " >> $tmpfile
++	if [ $i -eq 65534 ]
++	then
++		echo -n "$i" >> $tmpfile
++	fi
++done
++echo "}" >> $tmpfile
++
++$NFT -f $tmpfile
++
++tmpfile2=$(mktemp)
++for ((i=1;i<65535;i+=2))
++do
++	echo "$i" >> $tmpfile2
++done
++
++tmpfile3=$(mktemp)
++shuf $tmpfile2 > $tmpfile3
++i=0
++cat $tmpfile3 | while read line && [ $i -lt 10 ]
++do
++	$NFT add element inet x y { $line }
++	i=$((i+1))
++done
++
++for ((i=0;i<10;i++))
++do
++	from=$(($RANDOM%65535))
++	to=$(($from+100))
++	$NFT add element inet x y { $from-$to }
++	if [ $? -ne 0 ]
++	then
++		echo "failed to add $from-$to"
++		exit 1
++	fi
++	$NFT get element inet x y { $from-$to }
++	if [ $? -ne 0 ]
++	then
++		echo "failed to get $from-$to"
++		exit 1
++	fi
++done
++
++rm -f $tmpfile
++rm -f $tmpfile2
++rm -f $tmpfile3
+-- 
+2.36.1
+
diff --git a/SOURCES/0002-rule-collapse-set-element-commands.patch b/SOURCES/0002-rule-collapse-set-element-commands.patch
new file mode 100644
index 0000000..abc1374
--- /dev/null
+++ b/SOURCES/0002-rule-collapse-set-element-commands.patch
@@ -0,0 +1,236 @@
+From 0fb0e506d01f99548dbb9cabfef713bea7e447b5 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 24 Jun 2022 16:02:59 +0200
+Subject: [PATCH] rule: collapse set element commands
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1917398
+Upstream Status: nftables commit 498a5f0c219d8
+
+commit 498a5f0c219d8a118af4f172f248647d9b077101
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Mon Jun 13 17:22:44 2022 +0200
+
+    rule: collapse set element commands
+
+    Robots might generate a long list of singleton element commands such as:
+
+      add element t s { 1.0.1.0/24 }
+      ...
+      add element t s { 1.0.2.0/23 }
+
+    collapse them into one single command before the evaluation step, ie.
+
+      add element t s { 1.0.1.0/24, ..., 1.0.2.0/23 }
+
+    this speeds up overlap detection and set element automerge operations in
+    this worst case scenario.
+
+    Since 3da9643fb9ff9 ("intervals: add support to automerge with kernel
+    elements"), the new interval tracking relies on mergesort. The pattern
+    above triggers the set sorting for each element.
+
+    This patch adds a list to cmd objects that store collapsed commands.
+    Moreover, expressions also contain a reference to the original command,
+    to uncollapse the commands after the evaluation step.
+
+    These commands are uncollapsed after the evaluation step to ensure error
+    reporting works as expected (command and netlink message are mapped
+    1:1).
+
+    For the record:
+
+    - nftables versions <= 1.0.2 did not perform any kind of overlap
+      check for the described scenario above (because set cache only contained
+      elements in the kernel in this case). This is a problem for kernels < 5.7
+      which rely on userspace to detect overlaps.
+
+    - the overlap detection could be skipped for kernels >= 5.7.
+
+    - The extended netlink error reporting available for set elements
+      since 5.19-rc might allow to remove the uncollapse step, in this case,
+      error reporting does not rely on the netlink sequence to refer to the
+      command triggering the problem.
+
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ include/expression.h |  1 +
+ include/rule.h       |  3 ++
+ src/libnftables.c    | 17 ++++++++--
+ src/rule.c           | 75 ++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 93 insertions(+), 3 deletions(-)
+
+diff --git a/include/expression.h b/include/expression.h
+index 2c3818e..53194c9 100644
+--- a/include/expression.h
++++ b/include/expression.h
+@@ -243,6 +243,7 @@ struct expr {
+ 	enum expr_types		etype:8;
+ 	enum ops		op:8;
+ 	unsigned int		len;
++	struct cmd		*cmd;
+ 
+ 	union {
+ 		struct {
+diff --git a/include/rule.h b/include/rule.h
+index e232b97..9081225 100644
+--- a/include/rule.h
++++ b/include/rule.h
+@@ -700,6 +700,7 @@ struct cmd {
+ 	enum cmd_obj		obj;
+ 	struct handle		handle;
+ 	uint32_t		seqnum;
++	struct list_head	collapse_list;
+ 	union {
+ 		void		*data;
+ 		struct expr	*expr;
+@@ -728,6 +729,8 @@ extern struct cmd *cmd_alloc(enum cmd_ops op, enum cmd_obj obj,
+ 			     const struct handle *h, const struct location *loc,
+ 			     void *data);
+ extern void nft_cmd_expand(struct cmd *cmd);
++extern bool nft_cmd_collapse(struct list_head *cmds);
++extern void nft_cmd_uncollapse(struct list_head *cmds);
+ extern struct cmd *cmd_alloc_obj_ct(enum cmd_ops op, int type,
+ 				    const struct handle *h,
+ 				    const struct location *loc, struct obj *obj);
+diff --git a/src/libnftables.c b/src/libnftables.c
+index 6a22ea0..aac682b 100644
+--- a/src/libnftables.c
++++ b/src/libnftables.c
+@@ -501,7 +501,9 @@ static int nft_evaluate(struct nft_ctx *nft, struct list_head *msgs,
+ {
+ 	struct nft_cache_filter *filter;
+ 	struct cmd *cmd, *next;
++	bool collapsed = false;
+ 	unsigned int flags;
++	int err = 0;
+ 
+ 	filter = nft_cache_filter_init();
+ 	flags = nft_cache_evaluate(nft, cmds, filter);
+@@ -512,17 +514,26 @@ static int nft_evaluate(struct nft_ctx *nft, struct list_head *msgs,
+ 
+ 	nft_cache_filter_fini(filter);
+ 
++	if (nft_cmd_collapse(cmds))
++		collapsed = true;
++
+ 	list_for_each_entry_safe(cmd, next, cmds, list) {
+ 		struct eval_ctx ectx = {
+ 			.nft	= nft,
+ 			.msgs	= msgs,
+ 		};
++
+ 		if (cmd_evaluate(&ectx, cmd) < 0 &&
+-		    ++nft->state->nerrs == nft->parser_max_errors)
+-			return -1;
++		    ++nft->state->nerrs == nft->parser_max_errors) {
++			err = -1;
++			break;
++		}
+ 	}
+ 
+-	if (nft->state->nerrs)
++	if (collapsed)
++		nft_cmd_uncollapse(cmds);
++
++	if (err < 0 || nft->state->nerrs)
+ 		return -1;
+ 
+ 	list_for_each_entry(cmd, cmds, list) {
+diff --git a/src/rule.c b/src/rule.c
+index 7f61bdc..0526a14 100644
+--- a/src/rule.c
++++ b/src/rule.c
+@@ -1279,6 +1279,8 @@ struct cmd *cmd_alloc(enum cmd_ops op, enum cmd_obj obj,
+ 	cmd->handle   = *h;
+ 	cmd->location = *loc;
+ 	cmd->data     = data;
++	init_list_head(&cmd->collapse_list);
++
+ 	return cmd;
+ }
+ 
+@@ -1379,6 +1381,79 @@ void nft_cmd_expand(struct cmd *cmd)
+ 	}
+ }
+ 
++bool nft_cmd_collapse(struct list_head *cmds)
++{
++	struct cmd *cmd, *next, *elems = NULL;
++	struct expr *expr, *enext;
++	bool collapse = false;
++
++	list_for_each_entry_safe(cmd, next, cmds, list) {
++		if (cmd->op != CMD_ADD &&
++		    cmd->op != CMD_CREATE) {
++			elems = NULL;
++			continue;
++		}
++
++		if (cmd->obj != CMD_OBJ_ELEMENTS) {
++			elems = NULL;
++			continue;
++		}
++
++		if (!elems) {
++			elems = cmd;
++			continue;
++		}
++
++		if (cmd->op != elems->op) {
++			elems = cmd;
++			continue;
++		}
++
++		if (strcmp(elems->handle.table.name, cmd->handle.table.name) ||
++		    strcmp(elems->handle.set.name, cmd->handle.set.name)) {
++			elems = cmd;
++			continue;
++		}
++
++		collapse = true;
++		list_for_each_entry_safe(expr, enext, &cmd->expr->expressions, list) {
++			expr->cmd = cmd;
++			list_move_tail(&expr->list, &elems->expr->expressions);
++		}
++		elems->expr->size += cmd->expr->size;
++		list_move_tail(&cmd->list, &elems->collapse_list);
++	}
++
++	return collapse;
++}
++
++void nft_cmd_uncollapse(struct list_head *cmds)
++{
++	struct cmd *cmd, *cmd_next, *collapse_cmd, *collapse_cmd_next;
++	struct expr *expr, *next;
++
++	list_for_each_entry_safe(cmd, cmd_next, cmds, list) {
++		if (list_empty(&cmd->collapse_list))
++			continue;
++
++		assert(cmd->obj == CMD_OBJ_ELEMENTS);
++
++		list_for_each_entry_safe(expr, next, &cmd->expr->expressions, list) {
++			if (!expr->cmd)
++				continue;
++
++			list_move_tail(&expr->list, &expr->cmd->expr->expressions);
++			cmd->expr->size--;
++			expr->cmd = NULL;
++		}
++
++		list_for_each_entry_safe(collapse_cmd, collapse_cmd_next, &cmd->collapse_list, list) {
++			collapse_cmd->elem.set = set_get(cmd->elem.set);
++			list_add(&collapse_cmd->list, &cmd->list);
++		}
++	}
++}
++
+ struct markup *markup_alloc(uint32_t format)
+ {
+ 	struct markup *markup;
+-- 
+2.36.1
+
diff --git a/SOURCES/0002-tests-add-icmp-6-test-where-dependency-should-be-lef.patch b/SOURCES/0002-tests-add-icmp-6-test-where-dependency-should-be-lef.patch
deleted file mode 100644
index f412459..0000000
--- a/SOURCES/0002-tests-add-icmp-6-test-where-dependency-should-be-lef.patch
+++ /dev/null
@@ -1,165 +0,0 @@
-From bcd7ef679ca12700970e84fdd8ed38d8f58557ea Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Mon, 1 Feb 2021 22:44:25 +0100
-Subject: [PATCH] tests: add icmp/6 test where dependency should be left alone
-
-These tests fail: nft should leave the type as-is.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 3eb14fd93093c5e084d3ac1c4b0171cf80fb264f)
-
-Conflicts:
-	tests/py/ip/icmp.t.json
-	tests/py/ip6/icmpv6.t.json
--> Context change it seems.
-
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- tests/py/ip/icmp.t                |  2 ++
- tests/py/ip/icmp.t.json           | 28 ++++++++++++++++++++
- tests/py/ip/icmp.t.payload.ip     |  6 +++++
- tests/py/ip6/icmpv6.t             |  2 ++
- tests/py/ip6/icmpv6.t.json        | 44 +++++++++++++++++++++++++++++++
- tests/py/ip6/icmpv6.t.payload.ip6 |  7 +++++
- 6 files changed, 89 insertions(+)
-
-diff --git a/tests/py/ip/icmp.t b/tests/py/ip/icmp.t
-index c22b55eb1e3f4..11f3662e2b027 100644
---- a/tests/py/ip/icmp.t
-+++ b/tests/py/ip/icmp.t
-@@ -86,3 +86,5 @@ icmp gateway != { 33-55};ok
- icmp gateway != 34;ok
- icmp gateway != { 333, 334};ok
- 
-+icmp code 1 icmp type 2;ok;icmp type 2 icmp code host-unreachable
-+icmp code != 1 icmp type 2 icmp mtu 5;fail
-diff --git a/tests/py/ip/icmp.t.json b/tests/py/ip/icmp.t.json
-index 965eb10be9edf..2ea5b1a3e5e02 100644
---- a/tests/py/ip/icmp.t.json
-+++ b/tests/py/ip/icmp.t.json
-@@ -1424,3 +1424,31 @@
-     }
- ]
- 
-+# icmp code 1 icmp type 2
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "payload": {
-+                    "field": "type",
-+                    "protocol": "icmp"
-+                }
-+            },
-+            "op": "==",
-+            "right": 2
-+        }
-+    },
-+    {
-+        "match": {
-+            "left": {
-+                "payload": {
-+                    "field": "code",
-+                    "protocol": "icmp"
-+                }
-+            },
-+            "op": "==",
-+            "right": "host-unreachable"
-+        }
-+    }
-+]
-+
-diff --git a/tests/py/ip/icmp.t.payload.ip b/tests/py/ip/icmp.t.payload.ip
-index d75d12a061252..97464a08379e3 100644
---- a/tests/py/ip/icmp.t.payload.ip
-+++ b/tests/py/ip/icmp.t.payload.ip
-@@ -787,3 +787,9 @@ ip test-ip4 input
-   [ lookup reg 1 set __set%d ]
-   [ immediate reg 0 accept ]
- 
-+# icmp code 1 icmp type 2
-+ip 
-+  [ meta load l4proto => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+  [ payload load 2b @ transport header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000102 ]
-diff --git a/tests/py/ip6/icmpv6.t b/tests/py/ip6/icmpv6.t
-index 8b411a8bf4392..d07c34bd939dc 100644
---- a/tests/py/ip6/icmpv6.t
-+++ b/tests/py/ip6/icmpv6.t
-@@ -92,3 +92,5 @@ icmpv6 max-delay {33, 55, 67, 88};ok
- icmpv6 max-delay != {33, 55, 67, 88};ok
- icmpv6 max-delay {33-55};ok
- icmpv6 max-delay != {33-55};ok
-+
-+icmpv6 type parameter-problem icmpv6 code no-route;ok
-diff --git a/tests/py/ip6/icmpv6.t.json b/tests/py/ip6/icmpv6.t.json
-index f6cfbf172f562..be2f1b462bb18 100644
---- a/tests/py/ip6/icmpv6.t.json
-+++ b/tests/py/ip6/icmpv6.t.json
-@@ -1300,3 +1300,47 @@
-     }
- ]
- 
-+# icmpv6 type packet-too-big icmpv6 mtu 1280
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "payload": {
-+                    "field": "mtu",
-+                    "protocol": "icmpv6"
-+                }
-+            },
-+            "op": "==",
-+            "right": 1280
-+        }
-+    }
-+]
-+
-+# icmpv6 type parameter-problem icmpv6 code no-route
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "payload": {
-+                    "field": "type",
-+                    "protocol": "icmpv6"
-+                }
-+            },
-+            "op": "==",
-+            "right": "parameter-problem"
-+        }
-+    },
-+    {
-+        "match": {
-+            "left": {
-+                "payload": {
-+                    "field": "code",
-+                    "protocol": "icmpv6"
-+                }
-+            },
-+            "op": "==",
-+            "right": "no-route"
-+        }
-+    }
-+]
-+
-diff --git a/tests/py/ip6/icmpv6.t.payload.ip6 b/tests/py/ip6/icmpv6.t.payload.ip6
-index 171b7eade6d3e..448779d16922c 100644
---- a/tests/py/ip6/icmpv6.t.payload.ip6
-+++ b/tests/py/ip6/icmpv6.t.payload.ip6
-@@ -682,3 +682,10 @@ ip6 test-ip6 input
-   [ payload load 2b @ transport header + 4 => reg 1 ]
-   [ lookup reg 1 set __set%d 0x1 ]
- 
-+# icmpv6 type parameter-problem icmpv6 code no-route
-+ip6 
-+  [ meta load l4proto => reg 1 ]
-+  [ cmp eq reg 1 0x0000003a ]
-+  [ payload load 2b @ transport header + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000004 ]
-+
--- 
-2.31.1
-
diff --git a/SOURCES/0003-intervals-do-not-report-exact-overlaps-for-new-eleme.patch b/SOURCES/0003-intervals-do-not-report-exact-overlaps-for-new-eleme.patch
new file mode 100644
index 0000000..4be2549
--- /dev/null
+++ b/SOURCES/0003-intervals-do-not-report-exact-overlaps-for-new-eleme.patch
@@ -0,0 +1,84 @@
+From afd566b56629bac4c8ca622413c8c001e2e7edfa Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 24 Jun 2022 16:02:59 +0200
+Subject: [PATCH] intervals: do not report exact overlaps for new elements
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1917398
+Upstream Status: nftables commit 87ba510fc704f
+
+commit 87ba510fc704f766b5417d3bfc326e8ab9378c2a
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Mon Jun 13 17:22:47 2022 +0200
+
+    intervals: do not report exact overlaps for new elements
+
+    Two new elements that represent an exact overlap should not trigger an error.
+
+       add table t
+       add set t s { type ipv4_addr; flags interval; }
+       add element t s { 1.0.1.0/24 }
+       ...
+       add element t s { 1.0.1.0/24 }
+
+    result in a bogus error.
+
+     # nft -f set.nft
+     set.nft:1002:19-28: Error: conflicting intervals specified
+     add element t s { 1.0.1.0/24 }
+                       ^^^^^^^^^^
+
+    Fixes: 3da9643fb9ff ("intervals: add support to automerge with kernel elements")
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ src/intervals.c                            |  3 +--
+ tests/shell/testcases/sets/exact_overlap_0 | 22 ++++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+ create mode 100755 tests/shell/testcases/sets/exact_overlap_0
+
+diff --git a/src/intervals.c b/src/intervals.c
+index bc414d6..89f5c33 100644
+--- a/src/intervals.c
++++ b/src/intervals.c
+@@ -540,8 +540,7 @@ static int setelem_overlap(struct list_head *msgs, struct set *set,
+ 		}
+ 
+ 		if (mpz_cmp(prev_range.low, range.low) == 0 &&
+-		    mpz_cmp(prev_range.high, range.high) == 0 &&
+-		    (elem->flags & EXPR_F_KERNEL || prev->flags & EXPR_F_KERNEL))
++		    mpz_cmp(prev_range.high, range.high) == 0)
+ 			goto next;
+ 
+ 		if (mpz_cmp(prev_range.low, range.low) <= 0 &&
+diff --git a/tests/shell/testcases/sets/exact_overlap_0 b/tests/shell/testcases/sets/exact_overlap_0
+new file mode 100755
+index 0000000..1ce9304
+--- /dev/null
++++ b/tests/shell/testcases/sets/exact_overlap_0
+@@ -0,0 +1,22 @@
++#!/bin/bash
++
++RULESET="add table t
++add set t s { type ipv4_addr; flags interval; }
++add element t s { 1.0.1.0/24 }
++add element t s { 1.0.2.0/23 }
++add element t s { 1.0.8.0/21 }
++add element t s { 1.0.32.0/19 }
++add element t s { 1.1.0.0/24 }
++add element t s { 1.1.2.0/23 }
++add element t s { 1.1.4.0/22 }
++add element t s { 1.1.8.0/24 }
++add element t s { 1.1.9.0/24 }
++add element t s { 1.1.10.0/23 }
++add element t s { 1.1.12.0/22 }
++add element t s { 1.1.16.0/20 }
++add element t s { 1.1.32.0/19 }
++add element t s { 1.0.1.0/24 }"
++
++$NFT -f - <<< $RULESET || exit 1
++
++$NFT add element t s { 1.0.1.0/24 }
+-- 
+2.36.1
+
diff --git a/SOURCES/0003-main-fix-nft-help-output-fallout-from-719e4427.patch b/SOURCES/0003-main-fix-nft-help-output-fallout-from-719e4427.patch
deleted file mode 100644
index a9293bc..0000000
--- a/SOURCES/0003-main-fix-nft-help-output-fallout-from-719e4427.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 5f91359f1bbcd73346e4469f0b5a30e04f107a06 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20N=C4=9Bmec?= <snemec@redhat.com>
-Date: Mon, 22 Feb 2021 13:03:19 +0100
-Subject: [PATCH] main: fix nft --help output fallout from 719e4427
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Long options were missing the double dash.
-
-Fixes: 719e44277f8e ("main: use one data-structure to initialize getopt_long(3) arguments and help.")
-Cc: Jeremy Sowden <jeremy@azazel.net>
-Signed-off-by: Štěpán Němec <snemec@redhat.com>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit b8c6dd1a9c0c6e937febc113e7ea89079aa945be)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/main.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/src/main.c b/src/main.c
-index 80cf1acf0f7f4..8c47064459ecb 100644
---- a/src/main.c
-+++ b/src/main.c
-@@ -175,16 +175,17 @@ static const struct option *get_options(void)
- 
- static void print_option(const struct nft_opt *opt)
- {
--	char optbuf[33] = "";
-+	char optbuf[35] = "";
- 	int i;
- 
- 	i = snprintf(optbuf, sizeof(optbuf), "  -%c", opt->val);
- 	if (opt->name)
--		i += snprintf(optbuf + i, sizeof(optbuf) - i, ", %s", opt->name);
-+		i += snprintf(optbuf + i, sizeof(optbuf) - i, ", --%s",
-+			      opt->name);
- 	if (opt->arg)
- 		i += snprintf(optbuf + i, sizeof(optbuf) - i, " %s", opt->arg);
- 
--	printf("%-32s%s\n", optbuf, opt->help);
-+	printf("%-34s%s\n", optbuf, opt->help);
- }
- 
- static void show_help(const char *name)
--- 
-2.31.1
-
diff --git a/SOURCES/0004-intervals-do-not-empty-cache-for-maps.patch b/SOURCES/0004-intervals-do-not-empty-cache-for-maps.patch
new file mode 100644
index 0000000..684d2a1
--- /dev/null
+++ b/SOURCES/0004-intervals-do-not-empty-cache-for-maps.patch
@@ -0,0 +1,55 @@
+From 5a1d00b37a06bdf37bf392af05236469b6636fb9 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 24 Jun 2022 16:02:59 +0200
+Subject: [PATCH] intervals: do not empty cache for maps
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1917398
+Upstream Status: nftables commit d434de8b50dcf
+
+commit d434de8b50dcf3f5f4ca027e122a7df9d4e5d8e1
+Author: Pablo Neira Ayuso <pablo@netfilter.org>
+Date:   Thu Jun 16 10:53:56 2022 +0200
+
+    intervals: do not empty cache for maps
+
+    Translate set element to range and sort in maps for the NFT_SET_MAP
+    case, which does not support for automerge yet.
+
+    Fixes: 81e36530fcac ("src: replace interval segment tree overlap and automerge")
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ src/intervals.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/intervals.c b/src/intervals.c
+index 89f5c33..e203413 100644
+--- a/src/intervals.c
++++ b/src/intervals.c
+@@ -216,6 +216,12 @@ int set_automerge(struct list_head *msgs, struct cmd *cmd, struct set *set,
+ 	struct cmd *purge_cmd;
+ 	struct handle h = {};
+ 
++	if (set->flags & NFT_SET_MAP) {
++		set_to_range(init);
++		list_expr_sort(&init->expressions);
++		return 0;
++	}
++
+ 	if (existing_set) {
+ 		if (existing_set->init) {
+ 			list_splice_init(&existing_set->init->expressions,
+@@ -229,9 +235,6 @@ int set_automerge(struct list_head *msgs, struct cmd *cmd, struct set *set,
+ 	set_to_range(init);
+ 	list_expr_sort(&init->expressions);
+ 
+-	if (set->flags & NFT_SET_MAP)
+-		return 0;
+-
+ 	ctx.purge = set_expr_alloc(&internal_location, set);
+ 
+ 	setelem_automerge(&ctx);
+-- 
+2.36.1
+
diff --git a/SOURCES/0004-parser_bison-Fix-for-implicit-declaration-of-isalnum.patch b/SOURCES/0004-parser_bison-Fix-for-implicit-declaration-of-isalnum.patch
deleted file mode 100644
index 6573573..0000000
--- a/SOURCES/0004-parser_bison-Fix-for-implicit-declaration-of-isalnum.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From f09f39704d8bfa15d236b6891aabef270ec43d73 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 16:03:32 +0200
-Subject: [PATCH] parser_bison: Fix for implicit declaration of isalnum
-
-Have to include ctype.h to make it known.
-
-Fixes: e76bb37940181 ("src: allow for variables in the log prefix string")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 7c3b2a7acbdc793b822a230ec0c28086c7d0365d)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/parser_bison.y | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/parser_bison.y b/src/parser_bison.y
-index 519e8efe5ab7e..8644f66106496 100644
---- a/src/parser_bison.y
-+++ b/src/parser_bison.y
-@@ -10,6 +10,7 @@
- 
- %{
- 
-+#include <ctype.h>
- #include <stddef.h>
- #include <stdio.h>
- #include <inttypes.h>
--- 
-2.31.1
-
diff --git a/SOURCES/0005-intervals-Do-not-sort-cached-set-elements-over-and-o.patch b/SOURCES/0005-intervals-Do-not-sort-cached-set-elements-over-and-o.patch
new file mode 100644
index 0000000..6a4122f
--- /dev/null
+++ b/SOURCES/0005-intervals-Do-not-sort-cached-set-elements-over-and-o.patch
@@ -0,0 +1,139 @@
+From 013a3b226a0fa5f7a8469bae736150cbf2d092c4 Mon Sep 17 00:00:00 2001
+From: Phil Sutter <psutter@redhat.com>
+Date: Fri, 24 Jun 2022 16:02:59 +0200
+Subject: [PATCH] intervals: Do not sort cached set elements over and over
+ again
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1917398
+Upstream Status: nftables commit 59e3a59221fb8
+
+commit 59e3a59221fb81c289a0868a85140dd452fb1c30
+Author: Phil Sutter <phil@nwl.cc>
+Date:   Thu Jun 16 10:56:12 2022 +0200
+
+    intervals: Do not sort cached set elements over and over again
+
+    When adding element(s) to a non-empty set, code merged the two lists and
+    sorted the result. With many individual 'add element' commands this
+    causes substantial overhead. Make use of the fact that
+    existing_set->init is sorted already, sort only the list of new elements
+    and use list_splice_sorted() to merge the two sorted lists.
+
+    Add set_sort_splice() and use it for set element overlap detection and
+    automerge.
+
+    A test case adding ~25k elements in individual commands completes in
+    about 1/4th of the time with this patch applied.
+
+    Joint work with Pablo.
+
+    Fixes: 3da9643fb9ff9 ("intervals: add support to automerge with kernel elements")
+    Signed-off-by: Phil Sutter <phil@nwl.cc>
+    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+
+Signed-off-by: Phil Sutter <psutter@redhat.com>
+---
+ include/expression.h |  1 +
+ src/intervals.c      | 46 +++++++++++++++++++++-----------------------
+ src/mergesort.c      |  2 +-
+ 3 files changed, 24 insertions(+), 25 deletions(-)
+
+diff --git a/include/expression.h b/include/expression.h
+index 53194c9..cf7319b 100644
+--- a/include/expression.h
++++ b/include/expression.h
+@@ -481,6 +481,7 @@ extern struct expr *compound_expr_alloc(const struct location *loc,
+ extern void compound_expr_add(struct expr *compound, struct expr *expr);
+ extern void compound_expr_remove(struct expr *compound, struct expr *expr);
+ extern void list_expr_sort(struct list_head *head);
++extern void list_splice_sorted(struct list_head *list, struct list_head *head);
+ 
+ extern struct expr *concat_expr_alloc(const struct location *loc);
+ 
+diff --git a/src/intervals.c b/src/intervals.c
+index e203413..dcc06d1 100644
+--- a/src/intervals.c
++++ b/src/intervals.c
+@@ -118,6 +118,26 @@ static bool merge_ranges(struct set_automerge_ctx *ctx,
+ 	return false;
+ }
+ 
++static void set_sort_splice(struct expr *init, struct set *set)
++{
++	struct set *existing_set = set->existing_set;
++
++	set_to_range(init);
++	list_expr_sort(&init->expressions);
++
++	if (!existing_set)
++		return;
++
++	if (existing_set->init) {
++		set_to_range(existing_set->init);
++		list_splice_sorted(&existing_set->init->expressions,
++				   &init->expressions);
++		init_list_head(&existing_set->init->expressions);
++	} else {
++		existing_set->init = set_expr_alloc(&internal_location, set);
++	}
++}
++
+ static void setelem_automerge(struct set_automerge_ctx *ctx)
+ {
+ 	struct expr *i, *next, *prev = NULL;
+@@ -222,18 +242,7 @@ int set_automerge(struct list_head *msgs, struct cmd *cmd, struct set *set,
+ 		return 0;
+ 	}
+ 
+-	if (existing_set) {
+-		if (existing_set->init) {
+-			list_splice_init(&existing_set->init->expressions,
+-					 &init->expressions);
+-		} else {
+-			existing_set->init = set_expr_alloc(&internal_location,
+-							    set);
+-		}
+-	}
+-
+-	set_to_range(init);
+-	list_expr_sort(&init->expressions);
++	set_sort_splice(init, set);
+ 
+ 	ctx.purge = set_expr_alloc(&internal_location, set);
+ 
+@@ -591,18 +600,7 @@ int set_overlap(struct list_head *msgs, struct set *set, struct expr *init)
+ 	struct expr *i, *n, *clone;
+ 	int err;
+ 
+-	if (existing_set) {
+-		if (existing_set->init) {
+-			list_splice_init(&existing_set->init->expressions,
+-					 &init->expressions);
+-		} else {
+-			existing_set->init = set_expr_alloc(&internal_location,
+-							    set);
+-		}
+-	}
+-
+-	set_to_range(init);
+-	list_expr_sort(&init->expressions);
++	set_sort_splice(init, set);
+ 
+ 	err = setelem_overlap(msgs, set, init);
+ 
+diff --git a/src/mergesort.c b/src/mergesort.c
+index 8e6aac5..dca7142 100644
+--- a/src/mergesort.c
++++ b/src/mergesort.c
+@@ -70,7 +70,7 @@ static int expr_msort_cmp(const struct expr *e1, const struct expr *e2)
+ 	return ret;
+ }
+ 
+-static void list_splice_sorted(struct list_head *list, struct list_head *head)
++void list_splice_sorted(struct list_head *list, struct list_head *head)
+ {
+ 	struct list_head *h = head->next;
+ 	struct list_head *l = list->next;
+-- 
+2.36.1
+
diff --git a/SOURCES/0005-parser_json-Fix-for-memleak-in-tcp-option-error-path.patch b/SOURCES/0005-parser_json-Fix-for-memleak-in-tcp-option-error-path.patch
deleted file mode 100644
index 5a4a726..0000000
--- a/SOURCES/0005-parser_json-Fix-for-memleak-in-tcp-option-error-path.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From a79e92c0f6761a748ef3cbffd26a4f1db82b4b3e Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 16:07:02 +0200
-Subject: [PATCH] parser_json: Fix for memleak in tcp option error path
-
-If 'kind' value is invalid, the function returned without freeing 'expr'
-first. Fix this by performing the check before allocation.
-
-Fixes: cb21869649208 ("json: tcp: add raw tcp option match support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit f7b0eef8391ae7f89a3a82f6eeecaebe199224d7)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/parser_json.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/parser_json.c b/src/parser_json.c
-index f0486b77a225a..85d05ce27eef3 100644
---- a/src/parser_json.c
-+++ b/src/parser_json.c
-@@ -611,12 +611,12 @@ static struct expr *json_parse_tcp_option_expr(struct json_ctx *ctx,
- 			"base", &kind, "offset", &offset, "len", &len)) {
- 		uint32_t flag = 0;
- 
--		expr = tcpopt_expr_alloc(int_loc, kind,
--					 TCPOPT_COMMON_KIND);
--
- 		if (kind < 0 || kind > 255)
- 			return NULL;
- 
-+		expr = tcpopt_expr_alloc(int_loc, kind,
-+					 TCPOPT_COMMON_KIND);
-+
- 		if (offset == TCPOPT_COMMON_KIND && len == 8)
- 			flag = NFT_EXTHDR_F_PRESENT;
- 
--- 
-2.31.1
-
diff --git a/SOURCES/0006-evaluate-Mark-fall-through-case-in-str2hooknum.patch b/SOURCES/0006-evaluate-Mark-fall-through-case-in-str2hooknum.patch
deleted file mode 100644
index 04180b5..0000000
--- a/SOURCES/0006-evaluate-Mark-fall-through-case-in-str2hooknum.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 07ebd0fa9300176f818789fde2498422fa421090 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 16:19:18 +0200
-Subject: [PATCH] evaluate: Mark fall through case in str2hooknum()
-
-It is certainly intentional, so just mark it as such.
-
-Fixes: b4775dec9f80b ("src: ingress inet support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c2e06beef3390867901080c0d789e3b6257e2b98)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/evaluate.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/evaluate.c b/src/evaluate.c
-index c830dcdbd9651..2a897f469434a 100644
---- a/src/evaluate.c
-+++ b/src/evaluate.c
-@@ -4030,6 +4030,7 @@ static uint32_t str2hooknum(uint32_t family, const char *hook)
- 	case NFPROTO_INET:
- 		if (!strcmp(hook, "ingress"))
- 			return NF_INET_INGRESS;
-+		/* fall through */
- 	case NFPROTO_IPV4:
- 	case NFPROTO_BRIDGE:
- 	case NFPROTO_IPV6:
--- 
-2.31.1
-
diff --git a/SOURCES/0007-json-Drop-pointless-assignment-in-exthdr_expr_json.patch b/SOURCES/0007-json-Drop-pointless-assignment-in-exthdr_expr_json.patch
deleted file mode 100644
index 2a97351..0000000
--- a/SOURCES/0007-json-Drop-pointless-assignment-in-exthdr_expr_json.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From a7da4f45cc1c8419b38e3e9adf0e15bedb8b0257 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 16:23:22 +0200
-Subject: [PATCH] json: Drop pointless assignment in exthdr_expr_json()
-
-The updated value of 'is_exists' is no longer read at this point.
-
-Fixes: cb21869649208 ("json: tcp: add raw tcp option match support")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c1616dfd1ce40bac197924c8947e1c646e915dca)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/json.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/src/json.c b/src/json.c
-index 585d35326ac01..1fb5015124e16 100644
---- a/src/json.c
-+++ b/src/json.c
-@@ -692,7 +692,6 @@ json_t *exthdr_expr_json(const struct expr *expr, struct output_ctx *octx)
- 					 "base", expr->exthdr.raw_type,
- 					 "offset", expr->exthdr.offset,
- 					 "len", expr->len);
--			is_exists = false;
- 		}
- 
- 		return json_pack("{s:o}", "tcp option", root);
--- 
-2.31.1
-
diff --git a/SOURCES/0008-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch b/SOURCES/0008-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
deleted file mode 100644
index 253acbf..0000000
--- a/SOURCES/0008-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 2344a35f90ef4a467b6bb9779fc687b17f4a4b51 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 16:43:21 +0200
-Subject: [PATCH] netlink: Avoid memleak in error path of
- netlink_delinearize_set()
-
-Duplicate string 'comment' later when the function does not fail
-anymore.
-
-Fixes: 0864c2d49ee8a ("src: add comment support for set declarations")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit accd7a346fd19f1ffc503b3f681323abf1157c1a)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/netlink.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/netlink.c b/src/netlink.c
-index ec2dad29ace1c..5c38a9f157d38 100644
---- a/src/netlink.c
-+++ b/src/netlink.c
-@@ -840,7 +840,7 @@ struct set *netlink_delinearize_set(struct netlink_ctx *ctx,
- 		if (ud[NFTNL_UDATA_SET_DATA_TYPEOF])
- 			typeof_expr_data = set_make_key(ud[NFTNL_UDATA_SET_DATA_TYPEOF]);
- 		if (ud[NFTNL_UDATA_SET_COMMENT])
--			comment = xstrdup(nftnl_udata_get(ud[NFTNL_UDATA_SET_COMMENT]));
-+			comment = nftnl_udata_get(ud[NFTNL_UDATA_SET_COMMENT]);
- 	}
- 
- 	key = nftnl_set_get_u32(nls, NFTNL_SET_KEY_TYPE);
-@@ -878,7 +878,7 @@ struct set *netlink_delinearize_set(struct netlink_ctx *ctx,
- 	set->handle.set.name = xstrdup(nftnl_set_get_str(nls, NFTNL_SET_NAME));
- 	set->automerge	   = automerge;
- 	if (comment)
--		set->comment = comment;
-+		set->comment = xstrdup(comment);
- 
- 	init_list_head(&set_parse_ctx.stmt_list);
- 
--- 
-2.31.1
-
diff --git a/SOURCES/0009-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch b/SOURCES/0009-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
deleted file mode 100644
index d8539ab..0000000
--- a/SOURCES/0009-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 6cbc04136a91eca237476827b57e78ac29e00aeb Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 18:32:13 +0200
-Subject: [PATCH] netlink: Avoid memleak in error path of
- netlink_delinearize_chain()
-
-If parsing udata fails, 'chain' has to be freed before returning to
-caller.
-
-Fixes: 702ac2b72c0e8 ("src: add comment support for chains")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 04f7af9dd66d3a0f627f43bc4bf55bae9856efc8)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/netlink.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/netlink.c b/src/netlink.c
-index 5c38a9f157d38..22140afc3fd7e 100644
---- a/src/netlink.c
-+++ b/src/netlink.c
-@@ -573,6 +573,7 @@ struct chain *netlink_delinearize_chain(struct netlink_ctx *ctx,
- 		udata = nftnl_chain_get_data(nlc, NFTNL_CHAIN_USERDATA, &ulen);
- 		if (nftnl_udata_parse(udata, ulen, chain_parse_udata_cb, ud) < 0) {
- 			netlink_io_error(ctx, NULL, "Cannot parse userdata");
-+			chain_free(chain);
- 			return NULL;
- 		}
- 		if (ud[NFTNL_UDATA_CHAIN_COMMENT])
--- 
-2.31.1
-
diff --git a/SOURCES/0010-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch b/SOURCES/0010-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
deleted file mode 100644
index 67fad59..0000000
--- a/SOURCES/0010-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From c47e6d3b1ccb166b807d19fd585d6b5b3cd0b7f7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 18:33:44 +0200
-Subject: [PATCH] netlink: Avoid memleak in error path of
- netlink_delinearize_table()
-
-If parsing udata fails, 'table' has to be freed before returning to
-caller.
-
-Fixes: c156232a530b3 ("src: add comment support when adding tables")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 47640634cff9932784a1a96836d6c5809cc8264d)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/netlink.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/netlink.c b/src/netlink.c
-index 22140afc3fd7e..fd82b16cb9f6e 100644
---- a/src/netlink.c
-+++ b/src/netlink.c
-@@ -620,6 +620,7 @@ struct table *netlink_delinearize_table(struct netlink_ctx *ctx,
- 		udata = nftnl_table_get_data(nlt, NFTNL_TABLE_USERDATA, &ulen);
- 		if (nftnl_udata_parse(udata, ulen, table_parse_udata_cb, ud) < 0) {
- 			netlink_io_error(ctx, NULL, "Cannot parse userdata");
-+			table_free(table);
- 			return NULL;
- 		}
- 		if (ud[NFTNL_UDATA_TABLE_COMMENT])
--- 
-2.31.1
-
diff --git a/SOURCES/0011-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch b/SOURCES/0011-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
deleted file mode 100644
index 9b4e889..0000000
--- a/SOURCES/0011-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 3ec01f287b0b61c0e6d885a7e96dcfa5afa800b8 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 16:46:48 +0200
-Subject: [PATCH] netlink: Avoid memleak in error path of
- netlink_delinearize_obj()
-
-If parsing udata fails, 'obj' has to be freed before returning to
-caller.
-
-Fixes: 293c9b114faef ("src: add comment support for objects")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 97b5d4bbcac4d3237f114c1c6a57c37968ebe0fc)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/netlink.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/netlink.c b/src/netlink.c
-index fd82b16cb9f6e..4c03baeff5d66 100644
---- a/src/netlink.c
-+++ b/src/netlink.c
-@@ -1445,6 +1445,7 @@ struct obj *netlink_delinearize_obj(struct netlink_ctx *ctx,
- 		udata = nftnl_obj_get_data(nlo, NFTNL_OBJ_USERDATA, &ulen);
- 		if (nftnl_udata_parse(udata, ulen, obj_parse_udata_cb, ud) < 0) {
- 			netlink_io_error(ctx, NULL, "Cannot parse userdata");
-+			obj_free(obj);
- 			return NULL;
- 		}
- 		if (ud[NFTNL_UDATA_OBJ_COMMENT])
--- 
-2.31.1
-
diff --git a/SOURCES/0012-netlink_delinearize-Fix-suspicious-calloc-call.patch b/SOURCES/0012-netlink_delinearize-Fix-suspicious-calloc-call.patch
deleted file mode 100644
index ac21f56..0000000
--- a/SOURCES/0012-netlink_delinearize-Fix-suspicious-calloc-call.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From d8322b08998a6945b659078b5cc4bd7423194f70 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 17:02:01 +0200
-Subject: [PATCH] netlink_delinearize: Fix suspicious calloc() call
-
-Parameter passed to sizeof() was wrong. While being at it, replace the
-whole call with xmalloc_array() which takes care of error checking.
-
-Fixes: 913979f882d13 ("src: add expression handler hashtable")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit c4058f96c6a55e4fcd49d4380ac07b5466ec01c0)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/netlink_delinearize.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
-diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
-index 7315072284119..152b3e6cf8c65 100644
---- a/src/netlink_delinearize.c
-+++ b/src/netlink_delinearize.c
-@@ -1732,9 +1732,8 @@ void expr_handler_init(void)
- 	unsigned int i;
- 	uint32_t hash;
- 
--	expr_handle_ht = calloc(NFT_EXPR_HSIZE, sizeof(expr_handle_ht));
--	if (!expr_handle_ht)
--		memory_allocation_error();
-+	expr_handle_ht = xmalloc_array(NFT_EXPR_HSIZE,
-+				       sizeof(expr_handle_ht[0]));
- 
- 	for (i = 0; i < array_size(netlink_parsers); i++) {
- 		hash = djb_hash(netlink_parsers[i].name) % NFT_EXPR_HSIZE;
--- 
-2.31.1
-
diff --git a/SOURCES/0013-rule-Fix-for-potential-off-by-one-in-cmd_add_loc.patch b/SOURCES/0013-rule-Fix-for-potential-off-by-one-in-cmd_add_loc.patch
deleted file mode 100644
index ae87cde..0000000
--- a/SOURCES/0013-rule-Fix-for-potential-off-by-one-in-cmd_add_loc.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 5fbf4169fba1dfef0f461c4fe31bed70610ebce2 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Fri, 11 Jun 2021 17:08:34 +0200
-Subject: [PATCH] rule: Fix for potential off-by-one in cmd_add_loc()
-
-Using num_attrs as index means it must be at max one less than the
-array's size at function start.
-
-Fixes: 27362a5bfa433 ("rule: larger number of error locations")
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 2d0a7a9adeb30708d6fbbee57476c0d4b9214dbd)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- src/rule.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/rule.c b/src/rule.c
-index e4bb6bae276a0..03422da3a7560 100644
---- a/src/rule.c
-+++ b/src/rule.c
-@@ -1491,7 +1491,7 @@ struct cmd *cmd_alloc(enum cmd_ops op, enum cmd_obj obj,
- 
- void cmd_add_loc(struct cmd *cmd, uint16_t offset, const struct location *loc)
- {
--	if (cmd->num_attrs > NFT_NLATTR_LOC_MAX)
-+	if (cmd->num_attrs >= NFT_NLATTR_LOC_MAX)
- 		return;
- 
- 	cmd->attr[cmd->num_attrs].offset = offset;
--- 
-2.31.1
-
diff --git a/SOURCES/0014-src-add-xzalloc_array-and-use-it-to-allocate-the-exp.patch b/SOURCES/0014-src-add-xzalloc_array-and-use-it-to-allocate-the-exp.patch
deleted file mode 100644
index 0845e96..0000000
--- a/SOURCES/0014-src-add-xzalloc_array-and-use-it-to-allocate-the-exp.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 6509f63cb68ea2dd737f9b52c146803402efcd7a Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Mon, 14 Jun 2021 14:47:47 +0200
-Subject: [PATCH] src: add xzalloc_array() and use it to allocate the
- expression hashtable
-
-Otherwise, assertion to ensure that no colission occur is hit due to
-uninitialized hashtable memory area:
-
-nft: netlink_delinearize.c:1741: expr_handler_init: Assertion `expr_handle_ht[hash] == NULL' failed.
-
-Fixes: c4058f96c6a5 ("netlink_delinearize: Fix suspicious calloc() call")
-Acked-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit b0e7b294224030abc534c396fffcab9fbce12b11)
-Signed-off-by: Phil Sutter <psutter@redhat.com>
----
- include/utils.h           |  1 +
- src/netlink_delinearize.c |  2 +-
- src/utils.c               | 10 ++++++++++
- 3 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/include/utils.h b/include/utils.h
-index f45f25132d18d..ffbe2cbb75be5 100644
---- a/include/utils.h
-+++ b/include/utils.h
-@@ -133,6 +133,7 @@ extern void *xmalloc(size_t size);
- extern void *xmalloc_array(size_t nmemb, size_t size);
- extern void *xrealloc(void *ptr, size_t size);
- extern void *xzalloc(size_t size);
-+extern void *xzalloc_array(size_t nmemb, size_t size);
- extern char *xstrdup(const char *s);
- extern void xstrunescape(const char *in, char *out);
- 
-diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
-index 152b3e6cf8c65..7665d6f29c602 100644
---- a/src/netlink_delinearize.c
-+++ b/src/netlink_delinearize.c
-@@ -1732,7 +1732,7 @@ void expr_handler_init(void)
- 	unsigned int i;
- 	uint32_t hash;
- 
--	expr_handle_ht = xmalloc_array(NFT_EXPR_HSIZE,
-+	expr_handle_ht = xzalloc_array(NFT_EXPR_HSIZE,
- 				       sizeof(expr_handle_ht[0]));
- 
- 	for (i = 0; i < array_size(netlink_parsers); i++) {
-diff --git a/src/utils.c b/src/utils.c
-index 47f5b791547b1..925841c571f5d 100644
---- a/src/utils.c
-+++ b/src/utils.c
-@@ -50,6 +50,16 @@ void *xmalloc_array(size_t nmemb, size_t size)
- 	return xmalloc(nmemb * size);
- }
- 
-+void *xzalloc_array(size_t nmemb, size_t size)
-+{
-+	void *ptr;
-+
-+	ptr = xmalloc_array(nmemb, size);
-+	memset(ptr, 0, nmemb * size);
-+
-+	return ptr;
-+}
-+
- void *xrealloc(void *ptr, size_t size)
- {
- 	ptr = realloc(ptr, size);
--- 
-2.31.1
-
diff --git a/SOURCES/0015-json-init-parser-state-for-every-new-buffer-file.patch b/SOURCES/0015-json-init-parser-state-for-every-new-buffer-file.patch
deleted file mode 100644
index 16a0630..0000000
--- a/SOURCES/0015-json-init-parser-state-for-every-new-buffer-file.patch
+++ /dev/null
@@ -1,38 +0,0 @@
-From 27f931c935f27a00fe0ecbe8c4bcb3be6ba41096 Mon Sep 17 00:00:00 2001
-From: Eric Garver <eric@garver.life>
-Date: Fri, 19 Feb 2021 10:11:26 -0500
-Subject: [PATCH] json: init parser state for every new buffer/file
-
-Otherwise invalid error states cause subsequent json parsing to fail
-when it should not.
-
-Signed-off-by: Eric Garver <eric@garver.life>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 267338ec392346ef55ed51509e5f8e8354d6c19a)
----
- src/parser_json.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/parser_json.c b/src/parser_json.c
-index 85d05ce27eef3..9bba77dad5f0d 100644
---- a/src/parser_json.c
-+++ b/src/parser_json.c
-@@ -3893,6 +3893,7 @@ int nft_parse_json_buffer(struct nft_ctx *nft, const char *buf,
- 	};
- 	int ret;
- 
-+	parser_init(nft, nft->state, msgs, cmds, nft->top_scope);
- 	nft->json_root = json_loads(buf, 0, NULL);
- 	if (!nft->json_root)
- 		return -EINVAL;
-@@ -3921,6 +3922,7 @@ int nft_parse_json_filename(struct nft_ctx *nft, const char *filename,
- 	json_error_t err;
- 	int ret;
- 
-+	parser_init(nft, nft->state, msgs, cmds, nft->top_scope);
- 	nft->json_root = json_load_file(filename, 0, &err);
- 	if (!nft->json_root)
- 		return -EINVAL;
--- 
-2.31.1
-
diff --git a/SOURCES/0016-segtree-Fix-segfault-when-restoring-a-huge-interval-.patch b/SOURCES/0016-segtree-Fix-segfault-when-restoring-a-huge-interval-.patch
deleted file mode 100644
index 5051a9e..0000000
--- a/SOURCES/0016-segtree-Fix-segfault-when-restoring-a-huge-interval-.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 24d7383ca9e7f056153cc305ee16fa9fd8580909 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 9 Jun 2021 15:49:52 +0200
-Subject: [PATCH] segtree: Fix segfault when restoring a huge interval set
-
-Restoring a set of IPv4 prefixes with about 1.1M elements crashes nft as
-set_to_segtree() exhausts the stack. Prevent this by allocating the
-pointer array on heap and make sure it is freed before returning to
-caller.
-
-With this patch in place, restoring said set succeeds with allocation of
-about 3GB of memory, according to valgrind.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit baecd1cf26851a4c5b7d469206a488f14fe5b147)
----
- src/segtree.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/src/segtree.c b/src/segtree.c
-index 9aa39e52d8a09..163a7bb755f9c 100644
---- a/src/segtree.c
-+++ b/src/segtree.c
-@@ -429,10 +429,10 @@ static int set_to_segtree(struct list_head *msgs, struct set *set,
- 			  struct expr *init, struct seg_tree *tree,
- 			  bool add, bool merge)
- {
--	struct elementary_interval *intervals[init->size];
-+	struct elementary_interval **intervals;
- 	struct expr *i, *next;
- 	unsigned int n;
--	int err;
-+	int err = 0;
- 
- 	/* We are updating an existing set with new elements, check if the new
- 	 * interval overlaps with any of the existing ones.
-@@ -443,6 +443,7 @@ static int set_to_segtree(struct list_head *msgs, struct set *set,
- 			return err;
- 	}
- 
-+	intervals = xmalloc_array(init->size, sizeof(intervals[0]));
- 	n = expr_to_intervals(init, tree->keylen, intervals);
- 
- 	list_for_each_entry_safe(i, next, &init->expressions, list) {
-@@ -461,10 +462,11 @@ static int set_to_segtree(struct list_head *msgs, struct set *set,
- 	for (n = 0; n < init->size; n++) {
- 		err = ei_insert(msgs, tree, intervals[n], merge);
- 		if (err < 0)
--			return err;
-+			break;
- 	}
- 
--	return 0;
-+	xfree(intervals);
-+	return err;
- }
- 
- static bool segtree_needs_first_segment(const struct set *set,
--- 
-2.33.0
-
diff --git a/SOURCES/0017-tests-cover-baecd1cf2685-segtree-Fix-segfault-when-r.patch b/SOURCES/0017-tests-cover-baecd1cf2685-segtree-Fix-segfault-when-r.patch
deleted file mode 100644
index a0d7945..0000000
--- a/SOURCES/0017-tests-cover-baecd1cf2685-segtree-Fix-segfault-when-r.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 2c4a6a4f1d51358a196a7039c41b7d50df656985 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20N=C4=9Bmec?= <snemec@redhat.com>
-Date: Wed, 20 Oct 2021 14:42:20 +0200
-Subject: [PATCH] tests: cover baecd1cf2685 ("segtree: Fix segfault when
- restoring a huge interval set")
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Test inspired by [1] with both the set and stack size reduced by the
-same power of 2, to preserve the (pre-baecd1cf2685) segfault on one
-hand, and make the test successfully complete (post-baecd1cf2685) in a
-few seconds even on weaker hardware on the other.
-
-(The reason I stopped at 128kB stack size is that with 64kB I was
-getting segfaults even with baecd1cf2685 applied.)
-
-[1] https://bugzilla.redhat.com/show_bug.cgi?id=1908127
-
-Signed-off-by: Štěpán Němec <snemec@redhat.com>
-Helped-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit d8ccad2a2b73c4189934eb5fd0e3d096699b5043)
----
- .../sets/0068interval_stack_overflow_0        | 29 +++++++++++++++++++
- 1 file changed, 29 insertions(+)
- create mode 100755 tests/shell/testcases/sets/0068interval_stack_overflow_0
-
-diff --git a/tests/shell/testcases/sets/0068interval_stack_overflow_0 b/tests/shell/testcases/sets/0068interval_stack_overflow_0
-new file mode 100755
-index 0000000000000..134282de28268
---- /dev/null
-+++ b/tests/shell/testcases/sets/0068interval_stack_overflow_0
-@@ -0,0 +1,29 @@
-+#!/bin/bash
-+
-+set -e
-+
-+ruleset_file=$(mktemp)
-+
-+trap 'rm -f "$ruleset_file"' EXIT
-+
-+{
-+	echo 'define big_set = {'
-+	for ((i = 1; i < 255; i++)); do
-+		for ((j = 1; j < 80; j++)); do
-+			echo "10.0.$i.$j,"
-+		done
-+	done
-+	echo '10.1.0.0/24 }'
-+} >"$ruleset_file"
-+
-+cat >>"$ruleset_file" <<\EOF
-+table inet test68_table {
-+	set test68_set {
-+		type ipv4_addr
-+		flags interval
-+		elements = { $big_set }
-+	}
-+}
-+EOF
-+
-+( ulimit -s 128 && "$NFT" -f "$ruleset_file" )
--- 
-2.33.0
-
diff --git a/SOURCES/0018-doc-nft.8-Extend-monitor-description-by-trace.patch b/SOURCES/0018-doc-nft.8-Extend-monitor-description-by-trace.patch
deleted file mode 100644
index b58ed8a..0000000
--- a/SOURCES/0018-doc-nft.8-Extend-monitor-description-by-trace.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From 7f5707d93a62cf7474d94e038188a0a8ae2924e7 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Wed, 19 May 2021 13:12:48 +0200
-Subject: [PATCH] doc: nft.8: Extend monitor description by trace
-
-Briefly describe 'nft monitor trace' command functionality.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 2acf8b2caea19d8abd46d475a908f8d6afb33aa0)
----
- doc/nft.txt | 25 ++++++++++++++++++++++---
- 1 file changed, 22 insertions(+), 3 deletions(-)
-
-diff --git a/doc/nft.txt b/doc/nft.txt
-index 2642d8903787f..7b3c70d82a127 100644
---- a/doc/nft.txt
-+++ b/doc/nft.txt
-@@ -805,13 +805,26 @@ These are some additional commands included in nft.
- MONITOR
- ~~~~~~~~
- The monitor command allows you to listen to Netlink events produced by the
--nf_tables subsystem, related to creation and deletion of objects. When they
-+nf_tables subsystem. These are either related to creation and deletion of
-+objects or to packets for which *meta nftrace* was enabled. When they
- occur, nft will print to stdout the monitored events in either JSON or
- native nft format. +
- 
--To filter events related to a concrete object, use one of the keywords 'tables', 'chains', 'sets', 'rules', 'elements', 'ruleset'. +
-+[verse]
-+____
-+*monitor* [*new* | *destroy*] 'MONITOR_OBJECT'
-+*monitor* *trace*
-+
-+'MONITOR_OBJECT' := *tables* | *chains* | *sets* | *rules* | *elements* | *ruleset*
-+____
- 
--To filter events related to a concrete action, use keyword 'new' or 'destroy'.
-+To filter events related to a concrete object, use one of the keywords in
-+'MONITOR_OBJECT'.
-+
-+To filter events related to a concrete action, use keyword *new* or *destroy*.
-+
-+The second form of invocation takes no further options and exclusively prints
-+events generated for packets with *nftrace* enabled.
- 
- Hit ^C to finish the monitor operation.
- 
-@@ -835,6 +848,12 @@ Hit ^C to finish the monitor operation.
- % nft monitor ruleset
- ---------------------
- 
-+.Trace incoming packets from host 10.0.0.1
-+------------------------------------------
-+% nft add rule filter input ip saddr 10.0.0.1 meta nftrace set 1
-+% nft monitor trace
-+------------------------------------------
-+
- ERROR REPORTING
- ---------------
- When an error is detected, nft shows the line(s) containing the error, the
--- 
-2.33.0
-
diff --git a/SOURCES/0019-tests-shell-NFT-needs-to-be-invoked-unquoted.patch b/SOURCES/0019-tests-shell-NFT-needs-to-be-invoked-unquoted.patch
deleted file mode 100644
index 5290318..0000000
--- a/SOURCES/0019-tests-shell-NFT-needs-to-be-invoked-unquoted.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 4bd60613ea60da4bf9da226be352dd47f585e8d0 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20N=C4=9Bmec?= <snemec@redhat.com>
-Date: Fri, 5 Nov 2021 12:39:11 +0100
-Subject: [PATCH] tests: shell: $NFT needs to be invoked unquoted
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The variable has to undergo word splitting, otherwise the shell tries
-to find the variable value as an executable, which breaks in cases that
-7c8a44b25c22 ("tests: shell: Allow wrappers to be passed as nft command")
-intends to support.
-
-Mention this in the shell tests README.
-
-Fixes: d8ccad2a2b73 ("tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set")")
-Signed-off-by: Štěpán Němec <snemec@redhat.com>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit dad3338f1f76a4a5bd782bae9c6b48941dfb1e31)
-
-Conflicts:
-	tests/shell/README
--> Context change due to missing other patches.
----
- tests/shell/README                                       | 3 +++
- tests/shell/testcases/sets/0068interval_stack_overflow_0 | 2 +-
- 2 files changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/tests/shell/README b/tests/shell/README
-index e0279bbdc30c3..aee50e3d668b1 100644
---- a/tests/shell/README
-+++ b/tests/shell/README
-@@ -25,4 +25,7 @@ path to the nftables binary being tested.
- You can pass an arbitrary $NFT value as well:
-  # NFT=/usr/local/sbin/nft ./run-tests.sh
- 
-+Note that, to support usage such as NFT='valgrind nft', tests must
-+invoke $NFT unquoted.
-+
- By default the tests are run with the nft binary at '../../src/nft'
-diff --git a/tests/shell/testcases/sets/0068interval_stack_overflow_0 b/tests/shell/testcases/sets/0068interval_stack_overflow_0
-index 134282de28268..6620572449c3c 100755
---- a/tests/shell/testcases/sets/0068interval_stack_overflow_0
-+++ b/tests/shell/testcases/sets/0068interval_stack_overflow_0
-@@ -26,4 +26,4 @@ table inet test68_table {
- }
- EOF
- 
--( ulimit -s 128 && "$NFT" -f "$ruleset_file" )
-+( ulimit -s 128 && $NFT -f "$ruleset_file" )
--- 
-2.33.0
-
diff --git a/SOURCES/0020-tests-shell-better-parameters-for-the-interval-stack.patch b/SOURCES/0020-tests-shell-better-parameters-for-the-interval-stack.patch
deleted file mode 100644
index 39a6426..0000000
--- a/SOURCES/0020-tests-shell-better-parameters-for-the-interval-stack.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 0c34164a245bdd03085e906bc9b3327d559535a4 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C5=A0t=C4=9Bp=C3=A1n=20N=C4=9Bmec?= <snemec@redhat.com>
-Date: Wed, 1 Dec 2021 12:12:00 +0100
-Subject: [PATCH] tests: shell: better parameters for the interval stack
- overflow test
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Wider testing has shown that 128 kB stack is too low (e.g. for systems
-with 64 kB page size), leading to false failures in some environments.
-
-Based on results from a matrix of RHEL 8 and RHEL 9 systems across
-x86_64, aarch64, ppc64le and s390x architectures as well as some
-anecdotal testing of other Linux distros on x86_64 machines, 400 kB
-seems safe: the normal nft stack (which should stay constant during
-this test) on all tested systems doesn't exceed 200 kB (stays around
-100 kB on typical systems with 4 kB page size), while always growing
-beyond 500 kB in the failing case (nftables before baecd1cf2685) with
-the increased set size.
-
-Fixes: d8ccad2a2b73 ("tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set")")
-Signed-off-by: Štěpán Němec <snemec@redhat.com>
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit 7b81d9cb094ffa96ad821528cf19269dc348f617)
----
- tests/shell/testcases/sets/0068interval_stack_overflow_0 | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/tests/shell/testcases/sets/0068interval_stack_overflow_0 b/tests/shell/testcases/sets/0068interval_stack_overflow_0
-index 6620572449c3c..2cbc986802644 100755
---- a/tests/shell/testcases/sets/0068interval_stack_overflow_0
-+++ b/tests/shell/testcases/sets/0068interval_stack_overflow_0
-@@ -9,7 +9,7 @@ trap 'rm -f "$ruleset_file"' EXIT
- {
- 	echo 'define big_set = {'
- 	for ((i = 1; i < 255; i++)); do
--		for ((j = 1; j < 80; j++)); do
-+		for ((j = 1; j < 255; j++)); do
- 			echo "10.0.$i.$j,"
- 		done
- 	done
-@@ -26,4 +26,4 @@ table inet test68_table {
- }
- EOF
- 
--( ulimit -s 128 && $NFT -f "$ruleset_file" )
-+( ulimit -s 400 && $NFT -f "$ruleset_file" )
--- 
-2.33.0
-
diff --git a/SOURCES/0021-json-Simplify-non-tcpopt-exthdr-printing-a-bit.patch b/SOURCES/0021-json-Simplify-non-tcpopt-exthdr-printing-a-bit.patch
deleted file mode 100644
index 000a191..0000000
--- a/SOURCES/0021-json-Simplify-non-tcpopt-exthdr-printing-a-bit.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 92f73f85dbd6559905679133cdf61e70004c805d Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 4 May 2021 13:18:11 +0200
-Subject: [PATCH] json: Simplify non-tcpopt exthdr printing a bit
-
-This was just duplicate code apart from the object's name.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-(cherry picked from commit fd81d3ec3ae8b8d1d54a708d63b2dab2c8508c90)
----
- src/json.c | 18 +++++++-----------
- 1 file changed, 7 insertions(+), 11 deletions(-)
-
-diff --git a/src/json.c b/src/json.c
-index 1fb5015124e16..6607d83f4e8f8 100644
---- a/src/json.c
-+++ b/src/json.c
-@@ -696,21 +696,17 @@ json_t *exthdr_expr_json(const struct expr *expr, struct output_ctx *octx)
- 
- 		return json_pack("{s:o}", "tcp option", root);
- 	}
--	if (expr->exthdr.op == NFT_EXTHDR_OP_IPV4) {
--		root = json_pack("{s:s}", "name", desc);
- 
--		if (!is_exists)
--			json_object_set_new(root, "field", json_string(field));
--
--		return json_pack("{s:o}", "ip option", root);
--	}
--
--	root = json_pack("{s:s}",
--			 "name", desc);
-+	root = json_pack("{s:s}", "name", desc);
- 	if (!is_exists)
- 		json_object_set_new(root, "field", json_string(field));
- 
--	return json_pack("{s:o}", "exthdr", root);
-+	switch (expr->exthdr.op) {
-+	case NFT_EXTHDR_OP_IPV4:
-+		return json_pack("{s:o}", "ip option", root);
-+	default:
-+		return json_pack("{s:o}", "exthdr", root);
-+	}
- }
- 
- json_t *verdict_expr_json(const struct expr *expr, struct output_ctx *octx)
--- 
-2.33.0
-
diff --git a/SOURCES/0022-scanner-introduce-start-condition-stack.patch b/SOURCES/0022-scanner-introduce-start-condition-stack.patch
deleted file mode 100644
index 1bc0e4e..0000000
--- a/SOURCES/0022-scanner-introduce-start-condition-stack.patch
+++ /dev/null
@@ -1,167 +0,0 @@
-From 80f3c19bc1b989ab7ba2b917193e8bd3f998ba39 Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Mon, 8 Mar 2021 18:18:33 +0100
-Subject: [PATCH] scanner: introduce start condition stack
-
-Add a small initial chunk of flex start conditionals.
-
-This starts with two low-hanging fruits, numgen and j/symhash.
-
-NUMGEN and HASH start conditions are entered from flex when
-the corresponding expression token is encountered.
-
-Flex returns to the INIT condition when the bison parser
-has seen a complete numgen/hash statement.
-
-This intentionally uses a stack rather than BEGIN()
-to eventually support nested states.
-
-The scanner_pop_start_cond() function argument is not used yet, but
-will need to be used later to deal with nesting.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 5896772fe3c5f01696188ea04957a825ee601b12)
----
- include/parser.h   |  8 ++++++++
- src/parser_bison.y | 11 +++++++----
- src/scanner.l      | 36 +++++++++++++++++++++++++++++-------
- 3 files changed, 44 insertions(+), 11 deletions(-)
-
-diff --git a/include/parser.h b/include/parser.h
-index 9baa3a4db789f..b2ebd7aa226c5 100644
---- a/include/parser.h
-+++ b/include/parser.h
-@@ -26,6 +26,12 @@ struct parser_state {
- 	struct list_head		*cmds;
- };
- 
-+enum startcond_type {
-+	PARSER_SC_BEGIN,
-+	PARSER_SC_EXPR_HASH,
-+	PARSER_SC_EXPR_NUMGEN,
-+};
-+
- struct mnl_socket;
- 
- extern void parser_init(struct nft_ctx *nft, struct parser_state *state,
-@@ -45,4 +51,6 @@ extern void scanner_push_buffer(void *scanner,
- 				const struct input_descriptor *indesc,
- 				const char *buffer);
- 
-+extern void scanner_pop_start_cond(void *scanner, enum startcond_type sc);
-+
- #endif /* NFTABLES_PARSER_H */
-diff --git a/src/parser_bison.y b/src/parser_bison.y
-index 8644f66106496..da3fafcd1eeb1 100644
---- a/src/parser_bison.y
-+++ b/src/parser_bison.y
-@@ -857,6 +857,9 @@ opt_newline		:	NEWLINE
- 		 	|	/* empty */
- 			;
- 
-+close_scope_hash	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_HASH); };
-+close_scope_numgen	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_NUMGEN); };
-+
- common_block		:	INCLUDE		QUOTED_STRING	stmt_separator
- 			{
- 				if (scanner_include_file(nft, scanner, $2, &@$) < 0) {
-@@ -4811,7 +4814,7 @@ numgen_type		:	INC		{ $$ = NFT_NG_INCREMENTAL; }
- 			|	RANDOM		{ $$ = NFT_NG_RANDOM; }
- 			;
- 
--numgen_expr		:	NUMGEN	numgen_type	MOD	NUM	offset_opt
-+numgen_expr		:	NUMGEN	numgen_type	MOD	NUM	offset_opt	close_scope_numgen
- 			{
- 				$$ = numgen_expr_alloc(&@$, $2, $4, $5);
- 			}
-@@ -4868,17 +4871,17 @@ xfrm_expr		:	IPSEC	xfrm_dir	xfrm_spnum	xfrm_state_key
- 			}
- 			;
- 
--hash_expr		:	JHASH		expr	MOD	NUM	SEED	NUM	offset_opt
-+hash_expr		:	JHASH		expr	MOD	NUM	SEED	NUM	offset_opt	close_scope_hash
- 			{
- 				$$ = hash_expr_alloc(&@$, $4, true, $6, $7, NFT_HASH_JENKINS);
- 				$$->hash.expr = $2;
- 			}
--			|	JHASH		expr	MOD	NUM	offset_opt
-+			|	JHASH		expr	MOD	NUM	offset_opt	close_scope_hash
- 			{
- 				$$ = hash_expr_alloc(&@$, $4, false, 0, $5, NFT_HASH_JENKINS);
- 				$$->hash.expr = $2;
- 			}
--			|	SYMHASH		MOD	NUM	offset_opt
-+			|	SYMHASH		MOD	NUM	offset_opt	close_scope_hash
- 			{
- 				$$ = hash_expr_alloc(&@$, $3, false, 0, $4, NFT_HASH_SYM);
- 			}
-diff --git a/src/scanner.l b/src/scanner.l
-index 8bde1fbe912d8..ec8f252fbc8c8 100644
---- a/src/scanner.l
-+++ b/src/scanner.l
-@@ -98,6 +98,8 @@ static void reset_pos(struct parser_state *state, struct location *loc)
- 	state->indesc->column		= 1;
- }
- 
-+static void scanner_push_start_cond(void *scanner, enum startcond_type type);
-+
- #define YY_USER_ACTION {					\
- 	update_pos(yyget_extra(yyscanner), yylloc, yyleng);	\
- 	update_offset(yyget_extra(yyscanner), yylloc, yyleng);	\
-@@ -193,6 +195,9 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
- %option yylineno
- %option nodefault
- %option warn
-+%option stack
-+%s SCANSTATE_EXPR_HASH
-+%s SCANSTATE_EXPR_NUMGEN
- 
- %%
- 
-@@ -551,15 +556,21 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
- "state"			{ return STATE; }
- "status"		{ return STATUS; }
- 
--"numgen"		{ return NUMGEN; }
--"inc"			{ return INC; }
--"mod"			{ return MOD; }
--"offset"		{ return OFFSET; }
-+"numgen"		{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_NUMGEN); return NUMGEN; }
-+<SCANSTATE_EXPR_NUMGEN>{
-+	"inc"		{ return INC; }
-+}
- 
--"jhash"			{ return JHASH; }
--"symhash"		{ return SYMHASH; }
--"seed"			{ return SEED; }
-+"jhash"			{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_HASH); return JHASH; }
-+"symhash"		{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_HASH); return SYMHASH; }
- 
-+<SCANSTATE_EXPR_HASH>{
-+	"seed"		{ return SEED; }
-+}
-+<SCANSTATE_EXPR_HASH,SCANSTATE_EXPR_NUMGEN>{
-+	"mod"		{ return MOD; }
-+	"offset"	{ return OFFSET; }
-+}
- "dup"			{ return DUP; }
- "fwd"			{ return FWD; }
- 
-@@ -973,3 +984,14 @@ void scanner_destroy(struct nft_ctx *nft)
- 	input_descriptor_list_destroy(state);
- 	yylex_destroy(nft->scanner);
- }
-+
-+static void scanner_push_start_cond(void *scanner, enum startcond_type type)
-+{
-+	yy_push_state((int)type, scanner);
-+}
-+
-+void scanner_pop_start_cond(void *scanner, enum startcond_type t)
-+{
-+	yy_pop_state(scanner);
-+	(void)yy_top_state(scanner); /* suppress gcc warning wrt. unused function */
-+}
--- 
-2.33.0
-
diff --git a/SOURCES/0023-scanner-sctp-Move-to-own-scope.patch b/SOURCES/0023-scanner-sctp-Move-to-own-scope.patch
deleted file mode 100644
index 3aa28a6..0000000
--- a/SOURCES/0023-scanner-sctp-Move-to-own-scope.patch
+++ /dev/null
@@ -1,93 +0,0 @@
-From 5009b467a06a86f5dcc3218fb860cd81bc5e067f Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 4 May 2021 13:06:32 +0200
-Subject: [PATCH] scanner: sctp: Move to own scope
-
-This isolates only "vtag" token for now.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Reviewed-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 0925d7e214825628e7db4a86d5ebbad578ab0777)
-
- Conflicts:
-	include/parser.h
-	src/parser_bison.y
-	src/scanner.l
- -> Context changes due to missing other scopes.
----
- include/parser.h   | 1 +
- src/parser_bison.y | 5 +++--
- src/scanner.l      | 8 ++++++--
- 3 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/include/parser.h b/include/parser.h
-index b2ebd7aa226c5..4e7b4ef430966 100644
---- a/include/parser.h
-+++ b/include/parser.h
-@@ -28,6 +28,7 @@ struct parser_state {
- 
- enum startcond_type {
- 	PARSER_SC_BEGIN,
-+	PARSER_SC_SCTP,
- 	PARSER_SC_EXPR_HASH,
- 	PARSER_SC_EXPR_NUMGEN,
- };
-diff --git a/src/parser_bison.y b/src/parser_bison.y
-index da3fafcd1eeb1..383908fa3742f 100644
---- a/src/parser_bison.y
-+++ b/src/parser_bison.y
-@@ -859,6 +859,7 @@ opt_newline		:	NEWLINE
- 
- close_scope_hash	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_HASH); };
- close_scope_numgen	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_NUMGEN); };
-+close_scope_sctp	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_SCTP); };
- 
- common_block		:	INCLUDE		QUOTED_STRING	stmt_separator
- 			{
-@@ -4620,7 +4621,7 @@ primary_rhs_expr	:	symbol_expr		{ $$ = $1; }
- 							 BYTEORDER_HOST_ENDIAN,
- 							 sizeof(data) * BITS_PER_BYTE, &data);
- 			}
--			|	SCTP
-+			|	SCTP	close_scope_sctp
- 			{
- 				uint8_t data = IPPROTO_SCTP;
- 				$$ = constant_expr_alloc(&@$, &inet_protocol_type,
-@@ -5345,7 +5346,7 @@ dccp_hdr_field		:	SPORT		{ $$ = DCCPHDR_SPORT; }
- 			|	TYPE		{ $$ = DCCPHDR_TYPE; }
- 			;
- 
--sctp_hdr_expr		:	SCTP	sctp_hdr_field
-+sctp_hdr_expr		:	SCTP	sctp_hdr_field	close_scope_sctp
- 			{
- 				$$ = payload_expr_alloc(&@$, &proto_sctp, $2);
- 			}
-diff --git a/src/scanner.l b/src/scanner.l
-index ec8f252fbc8c8..c8e74e685f3d7 100644
---- a/src/scanner.l
-+++ b/src/scanner.l
-@@ -196,6 +196,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
- %option nodefault
- %option warn
- %option stack
-+%s SCANSTATE_SCTP
- %s SCANSTATE_EXPR_HASH
- %s SCANSTATE_EXPR_NUMGEN
- 
-@@ -491,8 +492,11 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
- 
- "dccp"			{ return DCCP; }
- 
--"sctp"			{ return SCTP; }
--"vtag"			{ return VTAG; }
-+"sctp"			{ scanner_push_start_cond(yyscanner, SCANSTATE_SCTP); return SCTP; }
-+
-+<SCANSTATE_SCTP>{
-+	"vtag"			{ return VTAG; }
-+}
- 
- "rt"			{ return RT; }
- "rt0"			{ return RT0; }
--- 
-2.33.0
-
diff --git a/SOURCES/0024-exthdr-Implement-SCTP-Chunk-matching.patch b/SOURCES/0024-exthdr-Implement-SCTP-Chunk-matching.patch
deleted file mode 100644
index e2b5ba2..0000000
--- a/SOURCES/0024-exthdr-Implement-SCTP-Chunk-matching.patch
+++ /dev/null
@@ -1,1622 +0,0 @@
-From 9a599d5fbc903271281f9d0b9a9b6da4300d7279 Mon Sep 17 00:00:00 2001
-From: Phil Sutter <phil@nwl.cc>
-Date: Tue, 4 May 2021 13:41:38 +0200
-Subject: [PATCH] exthdr: Implement SCTP Chunk matching
-
-Extend exthdr expression to support scanning through SCTP packet chunks
-and matching on fixed fields' values.
-
-Signed-off-by: Phil Sutter <phil@nwl.cc>
-Acked-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 0e3871cfd9a1e32a4ac041ce87a8057b11a89924)
-
- Conflicts:
-	include/parser.h
-	src/evaluate.c
-	src/parser_bison.y
-	src/scanner.l
- -> Context changes due to missing other scopes.
- -> Context change due to missing commit 6e6ef00028f1c
-       ("exthdr: remove tcp dependency for tcp option matching").
----
- doc/libnftables-json.adoc           |  13 +
- doc/payload-expression.txt          |  53 +++
- include/linux/netfilter/nf_tables.h |   2 +
- include/parser.h                    |   1 +
- include/sctp_chunk.h                |  87 +++++
- src/Makefile.am                     |   1 +
- src/evaluate.c                      |   2 +
- src/exthdr.c                        |   8 +
- src/json.c                          |   2 +
- src/parser_bison.y                  | 148 ++++++++-
- src/parser_json.c                   |  49 +++
- src/scanner.l                       |  38 +++
- src/sctp_chunk.c                    | 261 +++++++++++++++
- tests/py/inet/sctp.t                |  37 +++
- tests/py/inet/sctp.t.json           | 478 ++++++++++++++++++++++++++++
- tests/py/inet/sctp.t.payload        | 155 +++++++++
- 16 files changed, 1333 insertions(+), 2 deletions(-)
- create mode 100644 include/sctp_chunk.h
- create mode 100644 src/sctp_chunk.c
-
-diff --git a/doc/libnftables-json.adoc b/doc/libnftables-json.adoc
-index 858abbf73fbfc..fba4cb08ccb68 100644
---- a/doc/libnftables-json.adoc
-+++ b/doc/libnftables-json.adoc
-@@ -1200,6 +1200,19 @@ Create a reference to a field (*field*) of a TCP option header (*name*).
- If the *field* property is not given, the expression is to be used as a TCP option
- existence check in a *match* statement with a boolean on the right hand side.
- 
-+=== SCTP CHUNK
-+[verse]
-+*{ "sctp chunk": {
-+	"name":* 'STRING'*,
-+	"field":* 'STRING'
-+*}}*
-+
-+Create a reference to a field (*field*) of an SCTP chunk (*name*).
-+
-+If the *field* property is not given, the expression is to be used as an SCTP
-+chunk existence check in a *match* statement with a boolean on the right hand
-+side.
-+
- === META
- [verse]
- ____
-diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
-index a593e2e7b947d..a338dcf044505 100644
---- a/doc/payload-expression.txt
-+++ b/doc/payload-expression.txt
-@@ -369,7 +369,33 @@ integer (16 bit)
- SCTP HEADER EXPRESSION
- ~~~~~~~~~~~~~~~~~~~~~~~
- [verse]
-+____
- *sctp* {*sport* | *dport* | *vtag* | *checksum*}
-+*sctp chunk* 'CHUNK' [ 'FIELD' ]
-+
-+'CHUNK' := *data* | *init* | *init-ack* | *sack* | *heartbeat* |
-+	   *heartbeat-ack* | *abort* | *shutdown* | *shutdown-ack* | *error* |
-+	   *cookie-echo* | *cookie-ack* | *ecne* | *cwr* | *shutdown-complete*
-+	   | *asconf-ack* | *forward-tsn* | *asconf*
-+
-+'FIELD' := 'COMMON_FIELD' | 'DATA_FIELD' | 'INIT_FIELD' | 'INIT_ACK_FIELD' |
-+	   'SACK_FIELD' | 'SHUTDOWN_FIELD' | 'ECNE_FIELD' | 'CWR_FIELD' |
-+	   'ASCONF_ACK_FIELD' | 'FORWARD_TSN_FIELD' | 'ASCONF_FIELD'
-+
-+'COMMON_FIELD' := *type* | *flags* | *length*
-+'DATA_FIELD' := *tsn* | *stream* | *ssn* | *ppid*
-+'INIT_FIELD' := *init-tag* | *a-rwnd* | *num-outbound-streams* |
-+		*num-inbound-streams* | *initial-tsn*
-+'INIT_ACK_FIELD' := 'INIT_FIELD'
-+'SACK_FIELD' := *cum-tsn-ack* | *a-rwnd* | *num-gap-ack-blocks* |
-+		*num-dup-tsns*
-+'SHUTDOWN_FIELD' := *cum-tsn-ack*
-+'ECNE_FIELD' := *lowest-tsn*
-+'CWR_FIELD' := *lowest-tsn*
-+'ASCONF_ACK_FIELD' := *seqno*
-+'FORWARD_TSN_FIELD' := *new-cum-tsn*
-+'ASCONF_FIELD' := *seqno*
-+____
- 
- .SCTP header expression
- [options="header"]
-@@ -387,8 +413,35 @@ integer (32 bit)
- |checksum|
- Checksum|
- integer (32 bit)
-+|chunk|
-+Search chunk in packet|
-+without 'FIELD', boolean indicating existence
- |================
- 
-+.SCTP chunk fields
-+[options="header"]
-+|==================
-+|Name| Width in bits | Chunk | Notes
-+|type| 8 | all | not useful, defined by chunk type
-+|flags| 8 | all | semantics defined on per-chunk basis
-+|length| 16 | all | length of this chunk in bytes excluding padding
-+|tsn| 32 | data | transmission sequence number
-+|stream| 16 | data | stream identifier
-+|ssn| 16 | data | stream sequence number
-+|ppid| 32 | data | payload protocol identifier
-+|init-tag| 32 | init, init-ack | initiate tag
-+|a-rwnd| 32 | init, init-ack, sack | advertised receiver window credit
-+|num-outbound-streams| 16 | init, init-ack | number of outbound streams
-+|num-inbound-streams| 16 | init, init-ack | number of inbound streams
-+|initial-tsn| 32 | init, init-ack | initial transmit sequence number
-+|cum-tsn-ack| 32 | sack, shutdown | cumulative transmission sequence number acknowledged
-+|num-gap-ack-blocks| 16 | sack | number of Gap Ack Blocks included
-+|num-dup-tsns| 16 | sack | number of duplicate transmission sequence numbers received
-+|lowest-tsn| 32 | ecne, cwr | lowest transmission sequence number
-+|seqno| 32 | asconf-ack, asconf | sequence number
-+|new-cum-tsn| 32 | forward-tsn | new cumulative transmission sequence number
-+|==================
-+
- DCCP HEADER EXPRESSION
- ~~~~~~~~~~~~~~~~~~~~~~
- [verse]
-diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h
-index b1633e7ba5296..7f9fc203f6f82 100644
---- a/include/linux/netfilter/nf_tables.h
-+++ b/include/linux/netfilter/nf_tables.h
-@@ -806,11 +806,13 @@ enum nft_exthdr_flags {
-  * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
-  * @NFT_EXTHDR_OP_TCP: match against tcp options
-  * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
-+ * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
-  */
- enum nft_exthdr_op {
- 	NFT_EXTHDR_OP_IPV6,
- 	NFT_EXTHDR_OP_TCPOPT,
- 	NFT_EXTHDR_OP_IPV4,
-+	NFT_EXTHDR_OP_SCTP,
- 	__NFT_EXTHDR_OP_MAX
- };
- #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
-diff --git a/include/parser.h b/include/parser.h
-index 4e7b4ef430966..f0c5996dd3dd3 100644
---- a/include/parser.h
-+++ b/include/parser.h
-@@ -31,6 +31,7 @@ enum startcond_type {
- 	PARSER_SC_SCTP,
- 	PARSER_SC_EXPR_HASH,
- 	PARSER_SC_EXPR_NUMGEN,
-+	PARSER_SC_EXPR_SCTP_CHUNK,
- };
- 
- struct mnl_socket;
-diff --git a/include/sctp_chunk.h b/include/sctp_chunk.h
-new file mode 100644
-index 0000000000000..3819200f9f0a4
---- /dev/null
-+++ b/include/sctp_chunk.h
-@@ -0,0 +1,87 @@
-+/*
-+ * Copyright Red Hat
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 (or any
-+ * later) as published by the Free Software Foundation.
-+ */
-+
-+#ifndef NFTABLES_SCTP_CHUNK_H
-+#define NFTABLES_SCTP_CHUNK_H
-+
-+/* SCTP chunk types used on wire */
-+enum sctp_hdr_chunk_types {
-+	SCTP_CHUNK_TYPE_DATA			= 0,
-+	SCTP_CHUNK_TYPE_INIT			= 1,
-+	SCTP_CHUNK_TYPE_INIT_ACK		= 2,
-+	SCTP_CHUNK_TYPE_SACK			= 3,
-+	SCTP_CHUNK_TYPE_HEARTBEAT		= 4,
-+	SCTP_CHUNK_TYPE_HEARTBEAT_ACK		= 5,
-+	SCTP_CHUNK_TYPE_ABORT			= 6,
-+	SCTP_CHUNK_TYPE_SHUTDOWN		= 7,
-+	SCTP_CHUNK_TYPE_SHUTDOWN_ACK		= 8,
-+	SCTP_CHUNK_TYPE_ERROR			= 9,
-+	SCTP_CHUNK_TYPE_COOKIE_ECHO		= 10,
-+	SCTP_CHUNK_TYPE_COOKIE_ACK		= 11,
-+	SCTP_CHUNK_TYPE_ECNE			= 12,
-+	SCTP_CHUNK_TYPE_CWR			= 13,
-+	SCTP_CHUNK_TYPE_SHUTDOWN_COMPLETE	= 14,
-+	SCTP_CHUNK_TYPE_ASCONF_ACK		= 128,
-+	SCTP_CHUNK_TYPE_FORWARD_TSN		= 192,
-+	SCTP_CHUNK_TYPE_ASCONF			= 193,
-+};
-+
-+enum sctp_hdr_chunk_common_fields {
-+	SCTP_CHUNK_COMMON_TYPE,
-+	SCTP_CHUNK_COMMON_FLAGS,
-+	SCTP_CHUNK_COMMON_LENGTH,
-+	__SCTP_CHUNK_COMMON_MAX,
-+};
-+
-+#define SCTP_CHUNK_START_INDEX	__SCTP_CHUNK_COMMON_MAX
-+
-+enum sctp_hdr_chunk_data_fields {
-+	SCTP_CHUNK_DATA_TSN = SCTP_CHUNK_START_INDEX,
-+	SCTP_CHUNK_DATA_STREAM,
-+	SCTP_CHUNK_DATA_SSN,
-+	SCTP_CHUNK_DATA_PPID,
-+};
-+
-+enum sctp_hdr_chunk_init_fields {
-+	SCTP_CHUNK_INIT_TAG = SCTP_CHUNK_START_INDEX,
-+	SCTP_CHUNK_INIT_RWND,
-+	SCTP_CHUNK_INIT_OSTREAMS,
-+	SCTP_CHUNK_INIT_ISTREAMS,
-+	SCTP_CHUNK_INIT_TSN,
-+};
-+
-+enum sctp_hdr_chunk_sack_fields {
-+	SCTP_CHUNK_SACK_CTSN_ACK = SCTP_CHUNK_START_INDEX,
-+	SCTP_CHUNK_SACK_RWND,
-+	SCTP_CHUNK_SACK_GACK_BLOCKS,
-+	SCTP_CHUNK_SACK_DUP_TSNS,
-+};
-+
-+enum sctp_hdr_chunk_shutdown_fields {
-+	SCTP_CHUNK_SHUTDOWN_CTSN_ACK = SCTP_CHUNK_START_INDEX,
-+};
-+
-+enum sctp_hdr_chunk_ecne_cwr_fields {
-+	SCTP_CHUNK_ECNE_CWR_MIN_TSN = SCTP_CHUNK_START_INDEX,
-+};
-+
-+enum sctp_hdr_chunk_asconf_fields {
-+	SCTP_CHUNK_ASCONF_SEQNO = SCTP_CHUNK_START_INDEX,
-+};
-+
-+enum sctp_hdr_chunk_fwd_tsn_fields {
-+	SCTP_CHUNK_FORWARD_TSN_NCTSN = SCTP_CHUNK_START_INDEX,
-+};
-+
-+struct expr *sctp_chunk_expr_alloc(const struct location *loc,
-+				   unsigned int type, unsigned int field);
-+void sctp_chunk_init_raw(struct expr *expr, uint8_t type, unsigned int off,
-+			 unsigned int len, uint32_t flags);
-+const struct exthdr_desc *sctp_chunk_protocol_find(const char *name);
-+
-+#endif /* NFTABLES_SCTP_CHUNK_H */
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 3041a933bc067..253cb995a3f07 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -74,6 +74,7 @@ libnftables_la_SOURCES =			\
- 		tcpopt.c			\
- 		socket.c			\
- 		print.c				\
-+		sctp_chunk.c			\
- 		libnftables.c			\
- 		libnftables.map
- 
-diff --git a/src/evaluate.c b/src/evaluate.c
-index 2a897f469434a..bba685af720ed 100644
---- a/src/evaluate.c
-+++ b/src/evaluate.c
-@@ -583,6 +583,8 @@ static int expr_evaluate_exthdr(struct eval_ctx *ctx, struct expr **exprp)
- 		dependency = &proto_tcp;
- 		pb = PROTO_BASE_TRANSPORT_HDR;
- 		break;
-+	case NFT_EXTHDR_OP_SCTP:
-+		return __expr_evaluate_exthdr(ctx, exprp);
- 	case NFT_EXTHDR_OP_IPV4:
- 		dependency = &proto_ip;
- 		break;
-diff --git a/src/exthdr.c b/src/exthdr.c
-index b0243adad1da4..22a08b0c9c2bf 100644
---- a/src/exthdr.c
-+++ b/src/exthdr.c
-@@ -22,6 +22,7 @@
- #include <headers.h>
- #include <expression.h>
- #include <statement.h>
-+#include <sctp_chunk.h>
- 
- static const struct exthdr_desc *exthdr_definitions[PROTO_DESC_MAX + 1] = {
- 	[EXTHDR_DESC_HBH]	= &exthdr_hbh,
-@@ -75,6 +76,11 @@ static void exthdr_expr_print(const struct expr *expr, struct output_ctx *octx)
- 		if (expr->exthdr.flags & NFT_EXTHDR_F_PRESENT)
- 			return;
- 		nft_print(octx, " %s", expr->exthdr.tmpl->token);
-+	} else if (expr->exthdr.op == NFT_EXTHDR_OP_SCTP) {
-+		nft_print(octx, "sctp chunk %s", expr->exthdr.desc->name);
-+		if (expr->exthdr.flags & NFT_EXTHDR_F_PRESENT)
-+			return;
-+		nft_print(octx, " %s", expr->exthdr.tmpl->token);
- 	} else {
- 		if (expr->exthdr.flags & NFT_EXTHDR_F_PRESENT)
- 			nft_print(octx, "exthdr %s", expr->exthdr.desc->name);
-@@ -291,6 +297,8 @@ void exthdr_init_raw(struct expr *expr, uint8_t type,
- 		return tcpopt_init_raw(expr, type, offset, len, flags);
- 	if (op == NFT_EXTHDR_OP_IPV4)
- 		return ipopt_init_raw(expr, type, offset, len, flags, true);
-+	if (op == NFT_EXTHDR_OP_SCTP)
-+		return sctp_chunk_init_raw(expr, type, offset, len, flags);
- 
- 	expr->len = len;
- 	expr->exthdr.flags = flags;
-diff --git a/src/json.c b/src/json.c
-index 6607d83f4e8f8..9f345cb486389 100644
---- a/src/json.c
-+++ b/src/json.c
-@@ -704,6 +704,8 @@ json_t *exthdr_expr_json(const struct expr *expr, struct output_ctx *octx)
- 	switch (expr->exthdr.op) {
- 	case NFT_EXTHDR_OP_IPV4:
- 		return json_pack("{s:o}", "ip option", root);
-+	case NFT_EXTHDR_OP_SCTP:
-+		return json_pack("{s:o}", "sctp chunk", root);
- 	default:
- 		return json_pack("{s:o}", "exthdr", root);
- 	}
-diff --git a/src/parser_bison.y b/src/parser_bison.y
-index 383908fa3742f..44b9107e8a360 100644
---- a/src/parser_bison.y
-+++ b/src/parser_bison.y
-@@ -39,6 +39,7 @@
- #include <utils.h>
- #include <parser.h>
- #include <erec.h>
-+#include <sctp_chunk.h>
- 
- #include "parser_bison.h"
- 
-@@ -417,6 +418,40 @@ int nft_lex(void *, void *, void *);
- %token DCCP			"dccp"
- 
- %token SCTP			"sctp"
-+%token CHUNK			"chunk"
-+%token DATA			"data"
-+%token INIT			"init"
-+%token INIT_ACK			"init-ack"
-+%token HEARTBEAT		"heartbeat"
-+%token HEARTBEAT_ACK		"heartbeat-ack"
-+%token ABORT			"abort"
-+%token SHUTDOWN			"shutdown"
-+%token SHUTDOWN_ACK		"shutdown-ack"
-+%token ERROR			"error"
-+%token COOKIE_ECHO		"cookie-echo"
-+%token COOKIE_ACK		"cookie-ack"
-+%token ECNE			"ecne"
-+%token CWR			"cwr"
-+%token SHUTDOWN_COMPLETE	"shutdown-complete"
-+%token ASCONF_ACK		"asconf-ack"
-+%token FORWARD_TSN		"forward-tsn"
-+%token ASCONF			"asconf"
-+%token TSN			"tsn"
-+%token STREAM			"stream"
-+%token SSN			"ssn"
-+%token PPID			"ppid"
-+%token INIT_TAG			"init-tag"
-+%token A_RWND			"a-rwnd"
-+%token NUM_OSTREAMS		"num-outbound-streams"
-+%token NUM_ISTREAMS		"num-inbound-streams"
-+%token INIT_TSN			"initial-tsn"
-+%token CUM_TSN_ACK		"cum-tsn-ack"
-+%token NUM_GACK_BLOCKS		"num-gap-ack-blocks"
-+%token NUM_DUP_TSNS		"num-dup-tsns"
-+%token LOWEST_TSN		"lowest-tsn"
-+%token SEQNO			"seqno"
-+%token NEW_CUM_TSN		"new-cum-tsn"
-+
- %token VTAG			"vtag"
- 
- %token RT			"rt"
-@@ -763,9 +798,12 @@ int nft_lex(void *, void *, void *);
- %type <expr>			udp_hdr_expr	udplite_hdr_expr
- %destructor { expr_free($$); }	udp_hdr_expr	udplite_hdr_expr
- %type <val>			udp_hdr_field	udplite_hdr_field
--%type <expr>			dccp_hdr_expr	sctp_hdr_expr
--%destructor { expr_free($$); }	dccp_hdr_expr	sctp_hdr_expr
-+%type <expr>			dccp_hdr_expr	sctp_hdr_expr sctp_chunk_alloc
-+%destructor { expr_free($$); }	dccp_hdr_expr	sctp_hdr_expr sctp_chunk_alloc
- %type <val>			dccp_hdr_field	sctp_hdr_field
-+%type <val>			sctp_chunk_type sctp_chunk_common_field
-+%type <val>			sctp_chunk_data_field sctp_chunk_init_field
-+%type <val>			sctp_chunk_sack_field
- %type <expr>			th_hdr_expr
- %destructor { expr_free($$); }	th_hdr_expr
- %type <val>			th_hdr_field
-@@ -860,6 +898,7 @@ opt_newline		:	NEWLINE
- close_scope_hash	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_HASH); };
- close_scope_numgen	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_NUMGEN); };
- close_scope_sctp	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_SCTP); };
-+close_scope_sctp_chunk	: { scanner_pop_start_cond(nft->scanner, PARSER_SC_EXPR_SCTP_CHUNK); };
- 
- common_block		:	INCLUDE		QUOTED_STRING	stmt_separator
- 			{
-@@ -5346,10 +5385,115 @@ dccp_hdr_field		:	SPORT		{ $$ = DCCPHDR_SPORT; }
- 			|	TYPE		{ $$ = DCCPHDR_TYPE; }
- 			;
- 
-+sctp_chunk_type		:	DATA		{ $$ = SCTP_CHUNK_TYPE_DATA; }
-+			|	INIT		{ $$ = SCTP_CHUNK_TYPE_INIT; }
-+			|	INIT_ACK	{ $$ = SCTP_CHUNK_TYPE_INIT_ACK; }
-+			|	SACK		{ $$ = SCTP_CHUNK_TYPE_SACK; }
-+			|	HEARTBEAT	{ $$ = SCTP_CHUNK_TYPE_HEARTBEAT; }
-+			|	HEARTBEAT_ACK	{ $$ = SCTP_CHUNK_TYPE_HEARTBEAT_ACK; }
-+			|	ABORT		{ $$ = SCTP_CHUNK_TYPE_ABORT; }
-+			|	SHUTDOWN	{ $$ = SCTP_CHUNK_TYPE_SHUTDOWN; }
-+			|	SHUTDOWN_ACK	{ $$ = SCTP_CHUNK_TYPE_SHUTDOWN_ACK; }
-+			|	ERROR		{ $$ = SCTP_CHUNK_TYPE_ERROR; }
-+			|	COOKIE_ECHO	{ $$ = SCTP_CHUNK_TYPE_COOKIE_ECHO; }
-+			|	COOKIE_ACK	{ $$ = SCTP_CHUNK_TYPE_COOKIE_ACK; }
-+			|	ECNE		{ $$ = SCTP_CHUNK_TYPE_ECNE; }
-+			|	CWR		{ $$ = SCTP_CHUNK_TYPE_CWR; }
-+			|	SHUTDOWN_COMPLETE { $$ = SCTP_CHUNK_TYPE_SHUTDOWN_COMPLETE; }
-+			|	ASCONF_ACK	{ $$ = SCTP_CHUNK_TYPE_ASCONF_ACK; }
-+			|	FORWARD_TSN	{ $$ = SCTP_CHUNK_TYPE_FORWARD_TSN; }
-+			|	ASCONF		{ $$ = SCTP_CHUNK_TYPE_ASCONF; }
-+			;
-+
-+sctp_chunk_common_field	:	TYPE	{ $$ = SCTP_CHUNK_COMMON_TYPE; }
-+			|	FLAGS	{ $$ = SCTP_CHUNK_COMMON_FLAGS; }
-+			|	LENGTH	{ $$ = SCTP_CHUNK_COMMON_LENGTH; }
-+			;
-+
-+sctp_chunk_data_field	:	TSN	{ $$ = SCTP_CHUNK_DATA_TSN; }
-+			|	STREAM	{ $$ = SCTP_CHUNK_DATA_STREAM; }
-+			|	SSN	{ $$ = SCTP_CHUNK_DATA_SSN; }
-+			|	PPID	{ $$ = SCTP_CHUNK_DATA_PPID; }
-+			;
-+
-+sctp_chunk_init_field	:	INIT_TAG	{ $$ = SCTP_CHUNK_INIT_TAG; }
-+			|	A_RWND		{ $$ = SCTP_CHUNK_INIT_RWND; }
-+			|	NUM_OSTREAMS	{ $$ = SCTP_CHUNK_INIT_OSTREAMS; }
-+			|	NUM_ISTREAMS	{ $$ = SCTP_CHUNK_INIT_ISTREAMS; }
-+			|	INIT_TSN	{ $$ = SCTP_CHUNK_INIT_TSN; }
-+			;
-+
-+sctp_chunk_sack_field	:	CUM_TSN_ACK	{ $$ = SCTP_CHUNK_SACK_CTSN_ACK; }
-+			|	A_RWND		{ $$ = SCTP_CHUNK_SACK_RWND; }
-+			|	NUM_GACK_BLOCKS	{ $$ = SCTP_CHUNK_SACK_GACK_BLOCKS; }
-+			|	NUM_DUP_TSNS	{ $$ = SCTP_CHUNK_SACK_DUP_TSNS; }
-+			;
-+
-+sctp_chunk_alloc	:	sctp_chunk_type
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, $1, SCTP_CHUNK_COMMON_TYPE);
-+				$$->exthdr.flags = NFT_EXTHDR_F_PRESENT;
-+			}
-+			|	sctp_chunk_type	sctp_chunk_common_field
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, $1, $2);
-+			}
-+			|	DATA	sctp_chunk_data_field
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_DATA, $2);
-+			}
-+			|	INIT	sctp_chunk_init_field
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_INIT, $2);
-+			}
-+			|	INIT_ACK	sctp_chunk_init_field
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_INIT_ACK, $2);
-+			}
-+			|	SACK	sctp_chunk_sack_field
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_SACK, $2);
-+			}
-+			|	SHUTDOWN	CUM_TSN_ACK
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_SHUTDOWN,
-+							   SCTP_CHUNK_SHUTDOWN_CTSN_ACK);
-+			}
-+			|	ECNE	LOWEST_TSN
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_ECNE,
-+							   SCTP_CHUNK_ECNE_CWR_MIN_TSN);
-+			}
-+			|	CWR	LOWEST_TSN
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_CWR,
-+							   SCTP_CHUNK_ECNE_CWR_MIN_TSN);
-+			}
-+			|	ASCONF_ACK	SEQNO
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_ASCONF_ACK,
-+							   SCTP_CHUNK_ASCONF_SEQNO);
-+			}
-+			|	FORWARD_TSN	NEW_CUM_TSN
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_FORWARD_TSN,
-+							   SCTP_CHUNK_FORWARD_TSN_NCTSN);
-+			}
-+			|	ASCONF	SEQNO
-+			{
-+				$$ = sctp_chunk_expr_alloc(&@$, SCTP_CHUNK_TYPE_ASCONF,
-+							   SCTP_CHUNK_ASCONF_SEQNO);
-+			}
-+			;
-+
- sctp_hdr_expr		:	SCTP	sctp_hdr_field	close_scope_sctp
- 			{
- 				$$ = payload_expr_alloc(&@$, &proto_sctp, $2);
- 			}
-+			|	SCTP	CHUNK	sctp_chunk_alloc close_scope_sctp_chunk close_scope_sctp
-+			{
-+				$$ = $3;
-+			}
- 			;
- 
- sctp_hdr_field		:	SPORT		{ $$ = SCTPHDR_SPORT; }
-diff --git a/src/parser_json.c b/src/parser_json.c
-index 9bba77dad5f0d..0dce6ba57f634 100644
---- a/src/parser_json.c
-+++ b/src/parser_json.c
-@@ -11,6 +11,7 @@
- #include <netlink.h>
- #include <parser.h>
- #include <rule.h>
-+#include <sctp_chunk.h>
- #include <socket.h>
- 
- #include <netdb.h>
-@@ -707,6 +708,53 @@ static struct expr *json_parse_ip_option_expr(struct json_ctx *ctx,
- 	return ipopt_expr_alloc(int_loc, descval, fieldval, 0);
- }
- 
-+static int json_parse_sctp_chunk_field(const struct exthdr_desc *desc,
-+				       const char *name, int *val)
-+{
-+	unsigned int i;
-+
-+	for (i = 0; i < array_size(desc->templates); i++) {
-+		if (desc->templates[i].token &&
-+		    !strcmp(desc->templates[i].token, name)) {
-+			if (val)
-+				*val = i;
-+			return 0;
-+		}
-+	}
-+	return 1;
-+}
-+
-+static struct expr *json_parse_sctp_chunk_expr(struct json_ctx *ctx,
-+					       const char *type, json_t *root)
-+{
-+	const struct exthdr_desc *desc;
-+	const char *name, *field;
-+	struct expr *expr;
-+	int fieldval;
-+
-+	if (json_unpack_err(ctx, root, "{s:s}", "name", &name))
-+		return NULL;
-+
-+	desc = sctp_chunk_protocol_find(name);
-+	if (!desc) {
-+		json_error(ctx, "Unknown sctp chunk name '%s'.", name);
-+		return NULL;
-+	}
-+
-+	if (json_unpack(root, "{s:s}", "field", &field)) {
-+		expr = sctp_chunk_expr_alloc(int_loc, desc->type,
-+					     SCTP_CHUNK_COMMON_TYPE);
-+		expr->exthdr.flags = NFT_EXTHDR_F_PRESENT;
-+
-+		return expr;
-+	}
-+	if (json_parse_sctp_chunk_field(desc, field, &fieldval)) {
-+		json_error(ctx, "Unknown sctp chunk field '%s'.", field);
-+		return NULL;
-+	}
-+	return sctp_chunk_expr_alloc(int_loc, desc->type, fieldval);
-+}
-+
- static const struct exthdr_desc *exthdr_lookup_byname(const char *name)
- {
- 	const struct exthdr_desc *exthdr_tbl[] = {
-@@ -1412,6 +1460,7 @@ static struct expr *json_parse_expr(struct json_ctx *ctx, json_t *root)
- 		{ "exthdr", json_parse_exthdr_expr, CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
- 		{ "tcp option", json_parse_tcp_option_expr, CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_CONCAT },
- 		{ "ip option", json_parse_ip_option_expr, CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_CONCAT },
-+		{ "sctp chunk", json_parse_sctp_chunk_expr, CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_CONCAT },
- 		{ "meta", json_parse_meta_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_SET_RHS | CTX_F_MANGLE | CTX_F_SES | CTX_F_MAP | CTX_F_CONCAT },
- 		{ "osf", json_parse_osf_expr, CTX_F_STMT | CTX_F_PRIMARY | CTX_F_MAP | CTX_F_CONCAT },
- 		{ "ipsec", json_parse_xfrm_expr, CTX_F_PRIMARY | CTX_F_MAP | CTX_F_CONCAT },
-diff --git a/src/scanner.l b/src/scanner.l
-index c8e74e685f3d7..1bf07ec2d44c4 100644
---- a/src/scanner.l
-+++ b/src/scanner.l
-@@ -199,6 +199,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
- %s SCANSTATE_SCTP
- %s SCANSTATE_EXPR_HASH
- %s SCANSTATE_EXPR_NUMGEN
-+%s SCANSTATE_EXPR_SCTP_CHUNK
- 
- %%
- 
-@@ -495,9 +496,46 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
- "sctp"			{ scanner_push_start_cond(yyscanner, SCANSTATE_SCTP); return SCTP; }
- 
- <SCANSTATE_SCTP>{
-+	"chunk"			{ scanner_push_start_cond(yyscanner, SCANSTATE_EXPR_SCTP_CHUNK); return CHUNK; }
- 	"vtag"			{ return VTAG; }
- }
- 
-+<SCANSTATE_EXPR_SCTP_CHUNK>{
-+	"data"			{ return DATA; }
-+	"init"			{ return INIT; }
-+	"init-ack"		{ return INIT_ACK; }
-+	"heartbeat"		{ return HEARTBEAT; }
-+	"heartbeat-ack"		{ return HEARTBEAT_ACK; }
-+	"abort"			{ return ABORT; }
-+	"shutdown"		{ return SHUTDOWN; }
-+	"shutdown-ack"		{ return SHUTDOWN_ACK; }
-+	"error"			{ return ERROR; }
-+	"cookie-echo"		{ return COOKIE_ECHO; }
-+	"cookie-ack"		{ return COOKIE_ACK; }
-+	"ecne"			{ return ECNE; }
-+	"cwr"			{ return CWR; }
-+	"shutdown-complete"	{ return SHUTDOWN_COMPLETE; }
-+	"asconf-ack"		{ return ASCONF_ACK; }
-+	"forward-tsn"		{ return FORWARD_TSN; }
-+	"asconf"		{ return ASCONF; }
-+
-+	"tsn"			{ return TSN; }
-+	"stream"		{ return STREAM; }
-+	"ssn"			{ return SSN; }
-+	"ppid"			{ return PPID; }
-+	"init-tag"		{ return INIT_TAG; }
-+	"a-rwnd"		{ return A_RWND; }
-+	"num-outbound-streams"	{ return NUM_OSTREAMS; }
-+	"num-inbound-streams"	{ return NUM_ISTREAMS; }
-+	"initial-tsn"		{ return INIT_TSN; }
-+	"cum-tsn-ack"		{ return CUM_TSN_ACK; }
-+	"num-gap-ack-blocks"	{ return NUM_GACK_BLOCKS; }
-+	"num-dup-tsns"		{ return NUM_DUP_TSNS; }
-+	"lowest-tsn"		{ return LOWEST_TSN; }
-+	"seqno"			{ return SEQNO; }
-+	"new-cum-tsn"		{ return NEW_CUM_TSN; }
-+}
-+
- "rt"			{ return RT; }
- "rt0"			{ return RT0; }
- "rt2"			{ return RT2; }
-diff --git a/src/sctp_chunk.c b/src/sctp_chunk.c
-new file mode 100644
-index 0000000000000..6e73e72f8308b
---- /dev/null
-+++ b/src/sctp_chunk.c
-@@ -0,0 +1,261 @@
-+/*
-+ * Copyright Red Hat
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 (or any
-+ * later) as published by the Free Software Foundation.
-+ */
-+
-+#include <exthdr.h>
-+#include <sctp_chunk.h>
-+
-+#include <string.h>
-+
-+#define PHT(__token, __offset, __len) \
-+	PROTO_HDR_TEMPLATE(__token, &integer_type, BYTEORDER_BIG_ENDIAN, \
-+			   __offset, __len)
-+
-+static const struct exthdr_desc sctp_chunk_data = {
-+	.name	= "data",
-+	.type	= SCTP_CHUNK_TYPE_DATA,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_DATA_TSN]		= PHT("tsn", 32, 32),
-+		[SCTP_CHUNK_DATA_STREAM]	= PHT("stream", 64, 16),
-+		[SCTP_CHUNK_DATA_SSN]		= PHT("ssn", 80, 16),
-+		[SCTP_CHUNK_DATA_PPID]		= PHT("ppid", 96, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_init = {
-+	.name	= "init",
-+	.type	= SCTP_CHUNK_TYPE_INIT,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_INIT_TAG]		= PHT("init-tag", 32, 32),
-+		[SCTP_CHUNK_INIT_RWND]		= PHT("a-rwnd", 64, 32),
-+		[SCTP_CHUNK_INIT_OSTREAMS]	= PHT("num-outbound-streams", 96, 16),
-+		[SCTP_CHUNK_INIT_ISTREAMS]	= PHT("num-inbound-streams", 112, 16),
-+		[SCTP_CHUNK_INIT_TSN]		= PHT("initial-tsn", 128, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_init_ack = {
-+	.name	= "init-ack",
-+	.type	= SCTP_CHUNK_TYPE_INIT_ACK,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_INIT_TAG]		= PHT("init-tag", 32, 32),
-+		[SCTP_CHUNK_INIT_RWND]		= PHT("a-rwnd", 64, 32),
-+		[SCTP_CHUNK_INIT_OSTREAMS]	= PHT("num-outbound-streams", 96, 16),
-+		[SCTP_CHUNK_INIT_ISTREAMS]	= PHT("num-inbound-streams", 112, 16),
-+		[SCTP_CHUNK_INIT_TSN]		= PHT("initial-tsn", 128, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_sack = {
-+	.name	= "sack",
-+	.type	= SCTP_CHUNK_TYPE_SACK,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_SACK_CTSN_ACK]	= PHT("cum-tsn-ack", 32, 32),
-+		[SCTP_CHUNK_SACK_RWND]		= PHT("a-rwnd", 64, 32),
-+		[SCTP_CHUNK_SACK_GACK_BLOCKS]	= PHT("num-gap-ack-blocks", 96, 16),
-+		[SCTP_CHUNK_SACK_DUP_TSNS]	= PHT("num-dup-tsns", 112, 16),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_shutdown = {
-+	.name	= "shutdown",
-+	.type	= SCTP_CHUNK_TYPE_SHUTDOWN,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_SHUTDOWN_CTSN_ACK]	= PHT("cum-tsn-ack", 32, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_ecne = {
-+	.name	= "ecne",
-+	.type	= SCTP_CHUNK_TYPE_ECNE,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_ECNE_CWR_MIN_TSN]	= PHT("lowest-tsn", 32, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_cwr = {
-+	.name	= "cwr",
-+	.type	= SCTP_CHUNK_TYPE_CWR,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_ECNE_CWR_MIN_TSN]	= PHT("lowest-tsn", 32, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_asconf_ack = {
-+	.name	= "asconf-ack",
-+	.type	= SCTP_CHUNK_TYPE_ASCONF_ACK,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_ASCONF_SEQNO]	= PHT("seqno", 32, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_forward_tsn = {
-+	.name	= "forward-tsn",
-+	.type	= SCTP_CHUNK_TYPE_FORWARD_TSN,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_FORWARD_TSN_NCTSN]	= PHT("new-cum-tsn", 32, 32),
-+	},
-+};
-+
-+static const struct exthdr_desc sctp_chunk_asconf = {
-+	.name	= "asconf",
-+	.type	= SCTP_CHUNK_TYPE_ASCONF,
-+	.templates = {
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),
-+		[SCTP_CHUNK_ASCONF_SEQNO]	= PHT("seqno", 32, 32),
-+	},
-+};
-+
-+#define SCTP_CHUNK_DESC_GENERATOR(descname, hname, desctype)		\
-+static const struct exthdr_desc sctp_chunk_##descname = {		\
-+	.name	= #hname,						\
-+	.type	= SCTP_CHUNK_TYPE_##desctype,				\
-+	.templates = {							\
-+		[SCTP_CHUNK_COMMON_TYPE]	= PHT("type", 0, 8),	\
-+		[SCTP_CHUNK_COMMON_FLAGS]	= PHT("flags", 8, 8),	\
-+		[SCTP_CHUNK_COMMON_LENGTH]	= PHT("length", 16, 16),\
-+	},								\
-+};
-+
-+SCTP_CHUNK_DESC_GENERATOR(heartbeat, heartbeat, HEARTBEAT)
-+SCTP_CHUNK_DESC_GENERATOR(heartbeat_ack, heartbeat-ack, HEARTBEAT_ACK)
-+SCTP_CHUNK_DESC_GENERATOR(abort, abort, ABORT)
-+SCTP_CHUNK_DESC_GENERATOR(shutdown_ack, shutdown-ack, SHUTDOWN_ACK)
-+SCTP_CHUNK_DESC_GENERATOR(error, error, ERROR)
-+SCTP_CHUNK_DESC_GENERATOR(cookie_echo, cookie-echo, COOKIE_ECHO)
-+SCTP_CHUNK_DESC_GENERATOR(cookie_ack, cookie-ack, COOKIE_ACK)
-+SCTP_CHUNK_DESC_GENERATOR(shutdown_complete, shutdown-complete, SHUTDOWN_COMPLETE)
-+
-+#undef SCTP_CHUNK_DESC_GENERATOR
-+
-+static const struct exthdr_desc *sctp_chunk_protocols[] = {
-+	[SCTP_CHUNK_TYPE_DATA]			= &sctp_chunk_data,
-+	[SCTP_CHUNK_TYPE_INIT]			= &sctp_chunk_init,
-+	[SCTP_CHUNK_TYPE_INIT_ACK]		= &sctp_chunk_init_ack,
-+	[SCTP_CHUNK_TYPE_SACK]			= &sctp_chunk_sack,
-+	[SCTP_CHUNK_TYPE_HEARTBEAT]		= &sctp_chunk_heartbeat,
-+	[SCTP_CHUNK_TYPE_HEARTBEAT_ACK]		= &sctp_chunk_heartbeat_ack,
-+	[SCTP_CHUNK_TYPE_ABORT]			= &sctp_chunk_abort,
-+	[SCTP_CHUNK_TYPE_SHUTDOWN]		= &sctp_chunk_shutdown,
-+	[SCTP_CHUNK_TYPE_SHUTDOWN_ACK]		= &sctp_chunk_shutdown_ack,
-+	[SCTP_CHUNK_TYPE_ERROR]			= &sctp_chunk_error,
-+	[SCTP_CHUNK_TYPE_COOKIE_ECHO]		= &sctp_chunk_cookie_echo,
-+	[SCTP_CHUNK_TYPE_COOKIE_ACK]		= &sctp_chunk_cookie_ack,
-+	[SCTP_CHUNK_TYPE_ECNE]			= &sctp_chunk_ecne,
-+	[SCTP_CHUNK_TYPE_CWR]			= &sctp_chunk_cwr,
-+	[SCTP_CHUNK_TYPE_SHUTDOWN_COMPLETE]	= &sctp_chunk_shutdown_complete,
-+	[SCTP_CHUNK_TYPE_ASCONF_ACK]		= &sctp_chunk_asconf_ack,
-+	[SCTP_CHUNK_TYPE_FORWARD_TSN]		= &sctp_chunk_forward_tsn,
-+	[SCTP_CHUNK_TYPE_ASCONF]		= &sctp_chunk_asconf,
-+};
-+
-+const struct exthdr_desc *sctp_chunk_protocol_find(const char *name)
-+{
-+	unsigned int i;
-+
-+	for (i = 0; i < array_size(sctp_chunk_protocols); i++) {
-+		if (sctp_chunk_protocols[i] &&
-+		    !strcmp(sctp_chunk_protocols[i]->name, name))
-+			return sctp_chunk_protocols[i];
-+	}
-+	return NULL;
-+}
-+
-+struct expr *sctp_chunk_expr_alloc(const struct location *loc,
-+				   unsigned int type, unsigned int field)
-+{
-+	const struct proto_hdr_template *tmpl;
-+	const struct exthdr_desc *desc = NULL;
-+	struct expr *expr;
-+
-+	if (type < array_size(sctp_chunk_protocols))
-+		desc = sctp_chunk_protocols[type];
-+
-+	if (!desc)
-+		return NULL;
-+
-+	tmpl = &desc->templates[field];
-+	if (!tmpl)
-+		return NULL;
-+
-+	expr = expr_alloc(loc, EXPR_EXTHDR, tmpl->dtype,
-+			  BYTEORDER_BIG_ENDIAN, tmpl->len);
-+	expr->exthdr.desc	= desc;
-+	expr->exthdr.tmpl	= tmpl;
-+	expr->exthdr.op		= NFT_EXTHDR_OP_SCTP;
-+	expr->exthdr.raw_type	= desc->type;
-+	expr->exthdr.offset	= tmpl->offset;
-+
-+	return expr;
-+}
-+
-+void sctp_chunk_init_raw(struct expr *expr, uint8_t type, unsigned int off,
-+			 unsigned int len, uint32_t flags)
-+{
-+	const struct proto_hdr_template *tmpl;
-+	unsigned int i;
-+
-+	assert(expr->etype == EXPR_EXTHDR);
-+
-+	expr->len = len;
-+	expr->exthdr.flags = flags;
-+	expr->exthdr.offset = off;
-+	expr->exthdr.op = NFT_EXTHDR_OP_SCTP;
-+
-+	if (flags & NFT_EXTHDR_F_PRESENT)
-+		datatype_set(expr, &boolean_type);
-+	else
-+		datatype_set(expr, &integer_type);
-+
-+	if (type >= array_size(sctp_chunk_protocols))
-+		return;
-+
-+	expr->exthdr.desc = sctp_chunk_protocols[type];
-+	expr->exthdr.flags = flags;
-+	assert(expr->exthdr.desc != NULL);
-+
-+	for (i = 0; i < array_size(expr->exthdr.desc->templates); ++i) {
-+		tmpl = &expr->exthdr.desc->templates[i];
-+		if (tmpl->offset != off || tmpl->len != len)
-+			continue;
-+
-+		if ((flags & NFT_EXTHDR_F_PRESENT) == 0)
-+			datatype_set(expr, tmpl->dtype);
-+
-+		expr->exthdr.tmpl = tmpl;
-+		break;
-+	}
-+}
-diff --git a/tests/py/inet/sctp.t b/tests/py/inet/sctp.t
-index 5188b57e65085..3d1c2fd6cd2f7 100644
---- a/tests/py/inet/sctp.t
-+++ b/tests/py/inet/sctp.t
-@@ -41,3 +41,40 @@ sctp vtag {33, 55, 67, 88};ok
- sctp vtag != {33, 55, 67, 88};ok
- sctp vtag { 33-55};ok
- sctp vtag != { 33-55};ok
-+
-+# assert all chunk types are recognized
-+sctp chunk data exists;ok
-+sctp chunk init exists;ok
-+sctp chunk init-ack exists;ok
-+sctp chunk sack exists;ok
-+sctp chunk heartbeat exists;ok
-+sctp chunk heartbeat-ack exists;ok
-+sctp chunk abort exists;ok
-+sctp chunk shutdown exists;ok
-+sctp chunk shutdown-ack exists;ok
-+sctp chunk error exists;ok
-+sctp chunk cookie-echo exists;ok
-+sctp chunk cookie-ack exists;ok
-+sctp chunk ecne exists;ok
-+sctp chunk cwr exists;ok
-+sctp chunk shutdown-complete exists;ok
-+sctp chunk asconf-ack exists;ok
-+sctp chunk forward-tsn exists;ok
-+sctp chunk asconf exists;ok
-+
-+# test common header fields in random chunk types
-+sctp chunk data type 0;ok
-+sctp chunk init flags 23;ok
-+sctp chunk init-ack length 42;ok
-+
-+# test one custom field in every applicable chunk type
-+sctp chunk data stream 1337;ok
-+sctp chunk init initial-tsn 5;ok
-+sctp chunk init-ack num-outbound-streams 3;ok
-+sctp chunk sack a-rwnd 1;ok
-+sctp chunk shutdown cum-tsn-ack 65535;ok
-+sctp chunk ecne lowest-tsn 5;ok
-+sctp chunk cwr lowest-tsn 8;ok
-+sctp chunk asconf-ack seqno 12345;ok
-+sctp chunk forward-tsn new-cum-tsn 31337;ok
-+sctp chunk asconf seqno 12345;ok
-diff --git a/tests/py/inet/sctp.t.json b/tests/py/inet/sctp.t.json
-index 2684b0349a71b..8135686230129 100644
---- a/tests/py/inet/sctp.t.json
-+++ b/tests/py/inet/sctp.t.json
-@@ -608,3 +608,481 @@
-     }
- ]
- 
-+# sctp chunk data exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "data"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk init exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "init"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk init-ack exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "init-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk sack exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "sack"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk heartbeat exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "heartbeat"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk heartbeat-ack exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "heartbeat-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk abort exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "abort"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk shutdown exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "shutdown"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk shutdown-ack exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "shutdown-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk error exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "error"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk cookie-echo exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "cookie-echo"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk cookie-ack exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "cookie-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk ecne exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "ecne"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk cwr exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "cwr"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk shutdown-complete exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "shutdown-complete"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk asconf-ack exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "asconf-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk forward-tsn exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "forward-tsn"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk asconf exists
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "name": "asconf"
-+                }
-+            },
-+            "op": "==",
-+            "right": true
-+        }
-+    }
-+]
-+
-+# sctp chunk data type 0
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "type",
-+                    "name": "data"
-+                }
-+            },
-+            "op": "==",
-+            "right": 0
-+        }
-+    }
-+]
-+
-+# sctp chunk init flags 23
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "flags",
-+                    "name": "init"
-+                }
-+            },
-+            "op": "==",
-+            "right": 23
-+        }
-+    }
-+]
-+
-+# sctp chunk init-ack length 42
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "length",
-+                    "name": "init-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": 42
-+        }
-+    }
-+]
-+
-+# sctp chunk data stream 1337
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "stream",
-+                    "name": "data"
-+                }
-+            },
-+            "op": "==",
-+            "right": 1337
-+        }
-+    }
-+]
-+
-+# sctp chunk init initial-tsn 5
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "initial-tsn",
-+                    "name": "init"
-+                }
-+            },
-+            "op": "==",
-+            "right": 5
-+        }
-+    }
-+]
-+
-+# sctp chunk init-ack num-outbound-streams 3
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "num-outbound-streams",
-+                    "name": "init-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": 3
-+        }
-+    }
-+]
-+
-+# sctp chunk sack a-rwnd 1
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "a-rwnd",
-+                    "name": "sack"
-+                }
-+            },
-+            "op": "==",
-+            "right": 1
-+        }
-+    }
-+]
-+
-+# sctp chunk shutdown cum-tsn-ack 65535
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "cum-tsn-ack",
-+                    "name": "shutdown"
-+                }
-+            },
-+            "op": "==",
-+            "right": 65535
-+        }
-+    }
-+]
-+
-+# sctp chunk ecne lowest-tsn 5
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "lowest-tsn",
-+                    "name": "ecne"
-+                }
-+            },
-+            "op": "==",
-+            "right": 5
-+        }
-+    }
-+]
-+
-+# sctp chunk cwr lowest-tsn 8
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "lowest-tsn",
-+                    "name": "cwr"
-+                }
-+            },
-+            "op": "==",
-+            "right": 8
-+        }
-+    }
-+]
-+
-+# sctp chunk asconf-ack seqno 12345
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "seqno",
-+                    "name": "asconf-ack"
-+                }
-+            },
-+            "op": "==",
-+            "right": 12345
-+        }
-+    }
-+]
-+
-+# sctp chunk forward-tsn new-cum-tsn 31337
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "new-cum-tsn",
-+                    "name": "forward-tsn"
-+                }
-+            },
-+            "op": "==",
-+            "right": 31337
-+        }
-+    }
-+]
-+
-+# sctp chunk asconf seqno 12345
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "sctp chunk": {
-+                    "field": "seqno",
-+                    "name": "asconf"
-+                }
-+            },
-+            "op": "==",
-+            "right": 12345
-+        }
-+    }
-+]
-+
-diff --git a/tests/py/inet/sctp.t.payload b/tests/py/inet/sctp.t.payload
-index ecfcc7252a066..9c4854cfe71c3 100644
---- a/tests/py/inet/sctp.t.payload
-+++ b/tests/py/inet/sctp.t.payload
-@@ -274,3 +274,158 @@ inet test-inet input
-   [ payload load 4b @ transport header + 4 => reg 1 ]
-   [ lookup reg 1 set __set%d 0x1 ]
- 
-+# sctp chunk data exists
-+ip
-+  [ exthdr load 1b @ 0 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk init exists
-+ip
-+  [ exthdr load 1b @ 1 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk init-ack exists
-+ip
-+  [ exthdr load 1b @ 2 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk sack exists
-+ip
-+  [ exthdr load 1b @ 3 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk heartbeat exists
-+ip
-+  [ exthdr load 1b @ 4 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk heartbeat-ack exists
-+ip
-+  [ exthdr load 1b @ 5 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk abort exists
-+ip
-+  [ exthdr load 1b @ 6 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk shutdown exists
-+ip
-+  [ exthdr load 1b @ 7 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk shutdown-ack exists
-+ip
-+  [ exthdr load 1b @ 8 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk error exists
-+ip
-+  [ exthdr load 1b @ 9 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk cookie-echo exists
-+ip
-+  [ exthdr load 1b @ 10 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk cookie-ack exists
-+ip
-+  [ exthdr load 1b @ 11 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk ecne exists
-+ip
-+  [ exthdr load 1b @ 12 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk cwr exists
-+ip
-+  [ exthdr load 1b @ 13 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk shutdown-complete exists
-+ip
-+  [ exthdr load 1b @ 14 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk asconf-ack exists
-+ip
-+  [ exthdr load 1b @ 128 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk forward-tsn exists
-+ip
-+  [ exthdr load 1b @ 192 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk asconf exists
-+ip
-+  [ exthdr load 1b @ 193 + 0 present => reg 1 ]
-+  [ cmp eq reg 1 0x00000001 ]
-+
-+# sctp chunk data type 0
-+ip
-+  [ exthdr load 1b @ 0 + 0 => reg 1 ]
-+  [ cmp eq reg 1 0x00000000 ]
-+
-+# sctp chunk init flags 23
-+ip
-+  [ exthdr load 1b @ 1 + 1 => reg 1 ]
-+  [ cmp eq reg 1 0x00000017 ]
-+
-+# sctp chunk init-ack length 42
-+ip
-+  [ exthdr load 2b @ 2 + 2 => reg 1 ]
-+  [ cmp eq reg 1 0x00002a00 ]
-+
-+# sctp chunk data stream 1337
-+ip
-+  [ exthdr load 2b @ 0 + 8 => reg 1 ]
-+  [ cmp eq reg 1 0x00003905 ]
-+
-+# sctp chunk init initial-tsn 5
-+ip
-+  [ exthdr load 4b @ 1 + 16 => reg 1 ]
-+  [ cmp eq reg 1 0x05000000 ]
-+
-+# sctp chunk init-ack num-outbound-streams 3
-+ip
-+  [ exthdr load 2b @ 2 + 12 => reg 1 ]
-+  [ cmp eq reg 1 0x00000300 ]
-+
-+# sctp chunk sack a-rwnd 1
-+ip
-+  [ exthdr load 4b @ 3 + 8 => reg 1 ]
-+  [ cmp eq reg 1 0x01000000 ]
-+
-+# sctp chunk shutdown cum-tsn-ack 65535
-+ip
-+  [ exthdr load 4b @ 7 + 4 => reg 1 ]
-+  [ cmp eq reg 1 0xffff0000 ]
-+
-+# sctp chunk ecne lowest-tsn 5
-+ip
-+  [ exthdr load 4b @ 12 + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x05000000 ]
-+
-+# sctp chunk cwr lowest-tsn 8
-+ip
-+  [ exthdr load 4b @ 13 + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x08000000 ]
-+
-+# sctp chunk asconf-ack seqno 12345
-+ip
-+  [ exthdr load 4b @ 128 + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x39300000 ]
-+
-+# sctp chunk forward-tsn new-cum-tsn 31337
-+ip
-+  [ exthdr load 4b @ 192 + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x697a0000 ]
-+
-+# sctp chunk asconf seqno 12345
-+ip
-+  [ exthdr load 4b @ 193 + 4 => reg 1 ]
-+  [ cmp eq reg 1 0x39300000 ]
-+
--- 
-2.33.0
-
diff --git a/SOURCES/0025-include-missing-sctp_chunk.h-in-Makefile.am.patch b/SOURCES/0025-include-missing-sctp_chunk.h-in-Makefile.am.patch
deleted file mode 100644
index 7279044..0000000
--- a/SOURCES/0025-include-missing-sctp_chunk.h-in-Makefile.am.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From fe19063ce09d40ea94bf57c4af8b6c121aaf89e8 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Tue, 25 May 2021 14:04:36 +0200
-Subject: [PATCH] include: missing sctp_chunk.h in Makefile.am
-
-Fix make distcheck.
-
-Fixes: 0e3871cfd9a1 ("exthdr: Implement SCTP Chunk matching")
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 117ceb4f527119a6d44bf5e23f2ff7a8d116658a)
----
- include/Makefile.am | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/include/Makefile.am b/include/Makefile.am
-index 42f24f35ce7a5..4cd907380ebaa 100644
---- a/include/Makefile.am
-+++ b/include/Makefile.am
-@@ -31,6 +31,7 @@ noinst_HEADERS = 	cli.h		\
- 			osf.h		\
- 			parser.h	\
- 			proto.h		\
-+			sctp_chunk.h	\
- 			socket.h	\
- 			rule.h		\
- 			rt.h		\
--- 
-2.33.0
-
diff --git a/SOURCES/0026-evaluate-fix-inet-nat-with-no-layer-3-info.patch b/SOURCES/0026-evaluate-fix-inet-nat-with-no-layer-3-info.patch
deleted file mode 100644
index 271c271..0000000
--- a/SOURCES/0026-evaluate-fix-inet-nat-with-no-layer-3-info.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 0c371aeab906b6e65c4c86174cbe2fbca02891d1 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Tue, 20 Jul 2021 18:59:44 +0200
-Subject: [PATCH] evaluate: fix inet nat with no layer 3 info
-
-nft currently reports:
-
- Error: Could not process rule: Protocol error
- add rule inet x y meta l4proto tcp dnat to :80
-                                    ^^^^
-
-default to NFPROTO_INET family, otherwise kernel bails out EPROTO when
-trying to load the conntrack helper.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 9a36033ce50638a403d1421935cdd1287ee5de6b)
----
- src/evaluate.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/src/evaluate.c b/src/evaluate.c
-index bba685af720ed..73d6fd0e89bc2 100644
---- a/src/evaluate.c
-+++ b/src/evaluate.c
-@@ -2896,9 +2896,10 @@ static int nat_evaluate_family(struct eval_ctx *ctx, struct stmt *stmt)
- 			stmt->nat.family = ctx->pctx.family;
- 		return 0;
- 	case NFPROTO_INET:
--		if (!stmt->nat.addr)
-+		if (!stmt->nat.addr) {
-+			stmt->nat.family = NFPROTO_INET;
- 			return 0;
--
-+		}
- 		if (stmt->nat.family != NFPROTO_UNSPEC)
- 			return 0;
- 
--- 
-2.34.1
-
diff --git a/SOURCES/0027-tests-py-add-dnat-to-port-without-defining-destinati.patch b/SOURCES/0027-tests-py-add-dnat-to-port-without-defining-destinati.patch
deleted file mode 100644
index 5659ece..0000000
--- a/SOURCES/0027-tests-py-add-dnat-to-port-without-defining-destinati.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-From 00d3745306aa87eeb2466dbb5e6958225de3354f Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Thu, 22 Jul 2021 17:43:56 +0200
-Subject: [PATCH] tests: py: add dnat to port without defining destination
- address
-
-Add a test to cover dnat to port without destination address.
-
-Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1428
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-(cherry picked from commit 0f27e258b37a592233d6ad5381cd1fae65e57514)
----
- tests/py/inet/dnat.t         |  1 +
- tests/py/inet/dnat.t.json    | 20 ++++++++++++++++++++
- tests/py/inet/dnat.t.payload |  7 +++++++
- 3 files changed, 28 insertions(+)
-
-diff --git a/tests/py/inet/dnat.t b/tests/py/inet/dnat.t
-index b460af3925570..e4e169f2bc3ec 100644
---- a/tests/py/inet/dnat.t
-+++ b/tests/py/inet/dnat.t
-@@ -6,6 +6,7 @@ iifname "foo" tcp dport 80 redirect to :8080;ok
- 
- iifname "eth0" tcp dport 443 dnat ip to 192.168.3.2;ok
- iifname "eth0" tcp dport 443 dnat ip6 to [dead::beef]:4443;ok
-+meta l4proto tcp dnat to :80;ok;meta l4proto 6 dnat to :80
- 
- dnat ip to ct mark map { 0x00000014 : 1.2.3.4};ok
- dnat ip to ct mark . ip daddr map { 0x00000014 . 1.1.1.1 : 1.2.3.4};ok
-diff --git a/tests/py/inet/dnat.t.json b/tests/py/inet/dnat.t.json
-index 1b8aba6297d36..c341a0455fea1 100644
---- a/tests/py/inet/dnat.t.json
-+++ b/tests/py/inet/dnat.t.json
-@@ -219,3 +219,23 @@
-     }
- ]
- 
-+# meta l4proto tcp dnat to :80
-+[
-+    {
-+        "match": {
-+            "left": {
-+                "meta": {
-+                    "key": "l4proto"
-+                }
-+            },
-+            "op": "==",
-+            "right": 6
-+        }
-+    },
-+    {
-+        "dnat": {
-+            "port": 80
-+        }
-+    }
-+]
-+
-diff --git a/tests/py/inet/dnat.t.payload b/tests/py/inet/dnat.t.payload
-index a741b9cbdb8d7..be5baf8fd4b47 100644
---- a/tests/py/inet/dnat.t.payload
-+++ b/tests/py/inet/dnat.t.payload
-@@ -77,3 +77,10 @@ inet
-   [ immediate reg 2 0x00005000 ]
-   [ nat dnat ip addr_min reg 1 addr_max reg 0 proto_min reg 2 proto_max reg 0 flags 0x2 ]
- 
-+# meta l4proto tcp dnat to :80
-+inet
-+  [ meta load l4proto => reg 1 ]
-+  [ cmp eq reg 1 0x00000006 ]
-+  [ immediate reg 1 0x00005000 ]
-+  [ nat dnat inet proto_min reg 1 flags 0x2 ]
-+
--- 
-2.34.1
-
diff --git a/SOURCES/0028-evaluate-pick-data-element-byte-order-not-dtype-one.patch b/SOURCES/0028-evaluate-pick-data-element-byte-order-not-dtype-one.patch
deleted file mode 100644
index c3ce4f0..0000000
--- a/SOURCES/0028-evaluate-pick-data-element-byte-order-not-dtype-one.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From d5525024223f324c71edb9135f1938745d45acee Mon Sep 17 00:00:00 2001
-From: Florian Westphal <fw@strlen.de>
-Date: Wed, 3 Feb 2021 17:57:06 +0100
-Subject: [PATCH] evaluate: pick data element byte order, not dtype one
-
-Some expressions have integer base type, not a specific one, e.g. 'ct zone'.
-In that case nft used the wrong byte order.
-
-Without this, nft adds
-elements = { "eth0" : 256, "eth1" : 512, "veth4" : 256 }
-instead of 1, 2, 3.
-
-This is not a 'display bug', the added elements have wrong byte order.
-
-Signed-off-by: Florian Westphal <fw@strlen.de>
-(cherry picked from commit 84b1d078e86dea25c93e15c3e5a3160bbf77e4e7)
----
- src/evaluate.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/evaluate.c b/src/evaluate.c
-index 73d6fd0e89bc2..0543190fe777a 100644
---- a/src/evaluate.c
-+++ b/src/evaluate.c
-@@ -1583,7 +1583,7 @@ static int expr_evaluate_mapping(struct eval_ctx *ctx, struct expr **expr)
- 		else
- 			datalen = set->data->len;
- 
--		expr_set_context(&ctx->ectx, set->data->dtype, datalen);
-+		__expr_set_context(&ctx->ectx, set->data->dtype, set->data->byteorder, datalen, 0);
- 	} else {
- 		assert((set->flags & NFT_SET_MAP) == 0);
- 	}
--- 
-2.34.1
-
diff --git a/SPECS/nftables.spec b/SPECS/nftables.spec
index 75b771a..7d2de70 100644
--- a/SPECS/nftables.spec
+++ b/SPECS/nftables.spec
@@ -1,6 +1,9 @@
+%define rpmversion 1.0.4
+%define specrelease 2
+
 Name:           nftables
-Version:        0.9.8
-Release:        12%{?dist}
+Version:        %{rpmversion}
+Release:        %{specrelease}%{?dist}%{?buildid}
 # Upstream released a 0.100 version, then 0.4. Need Epoch to get back on track.
 Epoch:          1
 Summary:        Netfilter Tables userspace utillites
@@ -14,49 +17,26 @@ Source3:        main.nft
 Source4:        router.nft
 Source5:        nat.nft
 
-Patch01: 0001-payload-check-icmp-dependency-before-removing-previo.patch
-Patch02: 0002-tests-add-icmp-6-test-where-dependency-should-be-lef.patch
-Patch03: 0003-main-fix-nft-help-output-fallout-from-719e4427.patch
-Patch04: 0004-parser_bison-Fix-for-implicit-declaration-of-isalnum.patch
-Patch05: 0005-parser_json-Fix-for-memleak-in-tcp-option-error-path.patch
-Patch06: 0006-evaluate-Mark-fall-through-case-in-str2hooknum.patch
-Patch07: 0007-json-Drop-pointless-assignment-in-exthdr_expr_json.patch
-Patch08: 0008-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
-Patch09: 0009-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
-Patch10: 0010-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
-Patch11: 0011-netlink-Avoid-memleak-in-error-path-of-netlink_delin.patch
-Patch12: 0012-netlink_delinearize-Fix-suspicious-calloc-call.patch
-Patch13: 0013-rule-Fix-for-potential-off-by-one-in-cmd_add_loc.patch
-Patch14: 0014-src-add-xzalloc_array-and-use-it-to-allocate-the-exp.patch
-Patch15: 0015-json-init-parser-state-for-every-new-buffer-file.patch
-Patch16: 0016-segtree-Fix-segfault-when-restoring-a-huge-interval-.patch
-Patch17: 0017-tests-cover-baecd1cf2685-segtree-Fix-segfault-when-r.patch
-Patch18: 0018-doc-nft.8-Extend-monitor-description-by-trace.patch
-Patch19: 0019-tests-shell-NFT-needs-to-be-invoked-unquoted.patch
-Patch20: 0020-tests-shell-better-parameters-for-the-interval-stack.patch
-Patch21: 0021-json-Simplify-non-tcpopt-exthdr-printing-a-bit.patch
-Patch22: 0022-scanner-introduce-start-condition-stack.patch
-Patch23: 0023-scanner-sctp-Move-to-own-scope.patch
-Patch24: 0024-exthdr-Implement-SCTP-Chunk-matching.patch
-Patch25: 0025-include-missing-sctp_chunk.h-in-Makefile.am.patch
-Patch26: 0026-evaluate-fix-inet-nat-with-no-layer-3-info.patch
-Patch27: 0027-tests-py-add-dnat-to-port-without-defining-destinati.patch
-Patch28: 0028-evaluate-pick-data-element-byte-order-not-dtype-one.patch
+Patch1:             0001-tests-shell-runtime-set-element-automerge.patch
+Patch2:             0002-rule-collapse-set-element-commands.patch
+Patch3:             0003-intervals-do-not-report-exact-overlaps-for-new-eleme.patch
+Patch4:             0004-intervals-do-not-empty-cache-for-maps.patch
+Patch5:             0005-intervals-Do-not-sort-cached-set-elements-over-and-o.patch
 
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
 BuildRequires: make
-BuildRequires:  gcc
+BuildRequires: gcc
 BuildRequires: flex
 BuildRequires: bison
-BuildRequires: libmnl-devel
+BuildRequires: pkgconfig(libmnl) >= 1.0.4
 BuildRequires: gmp-devel
 BuildRequires: readline-devel
-BuildRequires: libnftnl-devel
+BuildRequires: pkgconfig(libnftnl) >= 1.2.2
 BuildRequires: systemd
 BuildRequires: asciidoc
-BuildRequires: iptables-devel
+BuildRequires: pkgconfig(xtables) >= 1.6.1
 BuildRequires: jansson-devel
 BuildRequires: python3-devel
 
@@ -86,7 +66,7 @@ The nftables python module provides an interface to libnftables via ctypes.
 autoreconf -fi
 rm -Rf autom4te*.cache config.h.in~
 %configure --disable-silent-rules --with-xtables --with-json \
-	--enable-python --with-python-bin=%{__python3}
+	--enable-python --with-python-bin=%{__python3} --with-cli=readline
 %make_build
 
 %install
@@ -104,7 +84,7 @@ cp -a %{SOURCE1} $RPM_BUILD_ROOT/%{_unitdir}/
 mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/sysconfig
 cp -a %{SOURCE2} $RPM_BUILD_ROOT/%{_sysconfdir}/sysconfig/
 
-rm $RPM_BUILD_ROOT/%{_sysconfdir}/nftables/*.nft
+rm $RPM_BUILD_ROOT/%{_datadir}/nftables/*.nft
 cp %{SOURCE3} %{SOURCE4} %{SOURCE5} \
 	$RPM_BUILD_ROOT/%{_sysconfdir}/nftables/
 
@@ -151,6 +131,21 @@ sed -i -e 's/\(sofile=\)".*"/\1"'$sofile'"/' \
 %{python3_sitelib}/nftables/
 
 %changelog
+* Fri Jun 24 2022 Phil Sutter <psutter@redhat.com> [1.0.4-2.el9]
+- intervals: Do not sort cached set elements over and over again (Phil Sutter) [1917398]
+- intervals: do not empty cache for maps (Phil Sutter) [1917398]
+- intervals: do not report exact overlaps for new elements (Phil Sutter) [1917398]
+- rule: collapse set element commands (Phil Sutter) [1917398]
+- tests: shell: runtime set element automerge (Phil Sutter) [1917398]
+
+* Thu Jun 09 2022 Phil Sutter <psutter@redhat.com> - 1:1.0.4-1
+- Review package dependencies
+- new version 1.0.4
+
+* Tue Mar 01 2022 Phil Sutter <psutter@redhat.com> - 1:0.9.8-13
+- tests: extend dtype test case to cover expression with integer type
+- evaluate: set evaluation context for set elements
+
 * Fri Jan 14 2022 Phil Sutter <psutter@redhat.com> - 1:0.9.8-12
 - evaluate: pick data element byte order, not dtype one