This rule fails on recent kernels because of bogus mask
check added in kernel commit
8df772afc9d0 ("netfilter: x_physdev: reject empty or not-nul terminated device names").

Signed-off-by: Florian Westphal <fw@strlen.de>

Check that basic functionality is there, 2 connections -> ok, 3rd
connect -> fail, connect to different port -> ok, reconnect after
earlier ones have terminated -> ok.

Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>

A few matches/targets reject based on the calling hook mask
from their checkentry functions.  Some are cosmetic (reject
nonsensical rule that would not work, but others are mandatory
rejects, in particular TCPMSS which may need skb_dst()
depending on the requested mode of operation.

For -legacy this yields:
xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks
xt_addrtype: output interface limitation not valid in PREROUTING and INPUT
xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT
xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic
xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic
xt_policy: input policy not valid in POSTROUTING and OUTPUT
xt_policy: output policy not valid in PREROUTING and INPUT

... in dmesg.  -j SET is currently missing, could be added
later (needs an existing ipset).

Signed-off-by: Florian Westphal <fw@strlen.de>

The IPT_ICMP_ADMIN_PROHIBITED fallback define and associated
compatibility notes were relevant for 2.4 kernels. The INCOMPATIBILITIES
file referencing these was already dropped in commit 92ce78d04677
("Drop INCOMPATIBILITIES file"), so clean up the remaining leftovers in
the REJECT extension source and man page.

Signed-off-by: Tommi Rantala <tommi.rantala@cujo.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

Legacy arptables has been silently ignoring this flag (plus mandatory
argument) since day 1. Retain compatibility to that behaviour but inform
users that a part of their rule does nothing.

Since arp is the only family which didn't provide a proto_parse
callback, implement one for the sole purpose of printing the warning. As
a side-effect, caller no longer has to check callback's existence.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>

Untranslated parts in output are easily overlooked and also don't disrupt
piping into nft (which is a bad idea to begin with), so make a little
noise if things go sideways:

| # iptables-translate -A FORWARD -m recent --set
| nft # -A FORWARD -m recent --set
| Translation not (fully) implemented

| # cat /tmp/input.ipt
| *filter
| -A FORWARD -s 1.2.3.4
| -A FORWARD -m recent --set
| COMMIT
| # iptables-restore-translate -f /tmp/input.ipt
| # Translated by iptables-restore-translate v1.8.13 on Tue Mar 10 17:29:17 2026
| add table ip filter
| add rule ip filter FORWARD ip saddr 1.2.3.4 counter
| # -t filter -A FORWARD -m recent --set
| iptables-translate-restore: line 3 failed

Signed-off-by: Phil Sutter <phil@nwl.cc>
Acked-by: Florian Westphal <fw@strlen.de>

Since refreshing nf_tables.h, the new name is available.

Signed-off-by: Phil Sutter <phil@nwl.cc>

We want NFT_BITWISE_MASK_XOR, use the occasion to sync it entirely.

Signed-off-by: Phil Sutter <phil@nwl.cc>

Since Python 3.12 the standard library has included an `os.unshare` function.
Use it if it is available.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Phil Sutter <phil@nwl.cc>

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>