Merge upstream v1.4.14

This merges upstream's iptables version 1.4.14.

The merge incorporates the following commits:

commit 9eaa87401ce5ac64cc6baa55775f58f59ca26f34
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Sat May 26 18:44:33 2012 +0200

    Bump version to 1.4.14

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit c022454ff5ad39c5e37fa6cd29b85159ad16ed0f
Author: Florian Westphal <fw@strlen.de>
Date:   Thu May 17 01:03:09 2012 +0000

    tests: add rateest match rules

    also, -p mobility gets us EINVAL from kernel, use -p ipv6-mh instead.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit a05910364fa0f2f919dbe0b01bcaba9c3cb127ca
Author: Florian Westphal <fw@strlen.de>
Date:   Thu May 17 01:03:08 2012 +0000

    extensions: libxt_rateest: output all options in save hook

    ipt-restore fails to parse the ipt-save output:
    zmatches -m rateest --rateest RE1 --rateest-pps --rateest-lt 5
    (should be "--rateest-pps 5 --rateest-lt").  Also, the "delta" option
    was never shown in -save output, but twice in some cases when using
    "iptables -L".

    Also, the "b/pps1" option must be shown when "delta" option is used with
    relative mode.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit cb999dfdaf25d5a774d2ee84cb99355438d57c93
Author: Florian Westphal <fw@strlen.de>
Date:   Thu May 10 05:42:47 2012 +0000

    ip(6)tables-restore: make sure argv is NULL terminated

    Else, argv[argc] may point to free'd memory.

    Some extensions, e.g. rateest, may fail to parse valid input
    because argv[optind] (with optind == argc) is not NULL.

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 6111382a6c27e73c1cef1777c1253be0453a9dbb
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed May 9 00:28:41 2012 +0200

    libipt_ULOG: fix --ulog-cprange

    In 1f2474a libipt_ULOG: use guided option parser.

    A bug has been accidentally introduced in --ulog-cprange, limiting
    possible values from 1 to 50. However, that limit should be applied
    to --ulog-qthreshold.

    Reported-by: Gaurav Sinha <vgsinha@gmail.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 8db1044ba608a78035bbf89007aab6b6d8ff6f68
Author: Miguel GAIO <miguel.gaio@efixo.com>
Date:   Thu Apr 19 00:14:33 2012 +0000

    libiptc: fix retry path in TC_INIT

    There is an issue on TC_INIT retry path:
    In error case, TC_FREE is called and close sockfd.
    The retry does not reopen then always fail.

    The proposing patch reopens sockfd in retry patch.

    Signed-off-by: Miguel GAIO <miguel.gaio@efixo.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit e8f32983048d6aa4a908b6a92da55fa71c859623
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Feb 29 13:48:36 2012 +0100

    libxt_CT: add --timeout option

    This patch adds the --timeout option to allow to attach timeout
    policy objects to flows, eg.

     iptables -I PREROUTING -t raw -s 1.1.1.1 -p tcp \
    	  -j CT --timeout custom-tcp-policy

    You need the nfct(8) tool which is available at:
    http://git.netfilter.org/cgi-bin/gitweb.cgi?p=nfct.git
    To define the cttimeout policies.

    Example of usage:
     nfct timeout add custom-tcp-policy inet tcp established 1000

    The new nfct tool also requires libnetfilter_cttimeout:
    http://git.netfilter.org/cgi-bin/gitweb.cgi?p=libnetfilter_cttimeout.git

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Change-Id: I9d2d82f957b5778ddf35de7b601e7a072e94b1a1