build: support for automake-1.12

automake-1.12 wants that AM_PROG_AR be used when LT_INIT is.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
build: separate AC variable replacements from xtables.h

It was/is a bit annoying that modifying xtables.h.in causes configure
to rerun. Split the @foo@ things into a separate file to bypass this.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
build: have `make clean` remove dep files too

While changing branches, one can hit errors like:

make[2]: ***   CC       libipt_CLUSTERIP.oo
No hay ninguna regla para construir el objetivo
`../include/net/netfilter/nf_nat.h', necesario para
`libipt_DNAT.oo'. Alto.

Pablo thinks dep files should be removed on `make clean`, and I
concur. (JFI, Note that native automake would not clear its ".deps"
directory.) Keep the "distclean: clean" line to keep invocations by
automake from the parent directory working.

Reported-by: Pablo Neira Ayuso <pablo@netfilter.org>
New set match revision with --return-nomatch flag support
libxtables: consolidate preference logic

Alias support will require testing for more conditions, so move the
revision comparison code into a separate function where it can be
shared between matches and targets.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
iptables: support for target aliases

This patch allows for target names listed on the command line to be
rewritten to new names and revisions.

As before, we will pick a revision that is supported by the kernel - now
including real_name in the search. This gives us the possibility to test
for many action names.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_NOTRACK: replace as an alias to CT --notrack

Note that we do not need any print/save functions for the alias entries,
since the real CT entry will handle this.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
iptables: support for match aliases

This patch allows for match names listed on the command line to be
rewritten to new names and revisions, like we did for targets before.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_state: replace as an alias to xt_conntrack

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Merge branch 'master' of git://git.inai.de/iptables
doc: clean up interpunction in state list for xt_conntrack

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: deduplicate extension descriptions into a new manpage

iptables.8 and ip6tables.8 had pretty much the same content, with a few
protocol-specific deviations here and there. Not only did that bloat the
manpages, but it also made it harder to spot differences. Separate out
the extension descriptions into a new manpage, which conveniently
features differences next to one another (cf. REJECT).

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: trim "state" manpage and reference conntrack instead

The module is practically obsolete, so just pinpoint to the replacement
in short order.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: have NOTRACK manpage point to CT instead

The module is obsolete, so point to CT --notrack instead.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: mention iptables-apply in the SEE ALSO sections

References: http://bugs.debian.org/660748
Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Merge branch 'master' of git://git.inai.de/iptables

Conflicts:
	extensions/GNUmakefile.in

Resolution: trivial, since this was a fuzz 3.

Reason: Line added from v1.4.15-16-g33710a5 was in vincinity of changes
from v1.4.15-22-g4496801.
bump version to 1.4.16

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: fix standard target

This regression was added by:

commit cd2f9bdbb7f9b737e5d640aafeb78bcd8e3a7adf
Author: Jan Engelhardt <jengelh@inai.de>
Date:   Tue Sep 4 05:24:47 2012 +0200

    iptables: support for target aliase

The result is that:

 iptables -I INPUT -j ACCEPT

says:

 iptables: No chain/target/match by that name.

This also breaks iptables-restore, of course. Jan, you'll have to explain me
how you have tested this.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
bump version to 1.4.16.1

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables: restore NOTRACK functionality, target aliasing

Commit v1.4.16-1-g2aaa7ec is testing for real_name (not) being NULL
which was always false (true). real_name was never NULL, so cs->jumpto
would always be used, which rendered -j NOTRACK unusable, since the
chosen real name.revision is for example NOTRACK.1, which does not exist
at the kernel side.

	# ./iptables/xtables-multi main4 -t raw -A foo -j NOTRACK
	dbg: Using NOTRACK.1
	WARNING: The NOTRACK target is obsolete. Use CT instead.
	iptables: Protocol wrong type for socket.

To reasonably support the extra-special verdict names, make it so that
real_name remains NULL when an extension defined no alias, which we can
then use to determine whether the user entered an alias name (which
needs to be followed) or not.

[ I have mangled this patch to remove a comment unnecessarily large.
  BTW, this patch gets this very close to the initial target aliasing
  proposal --pablo ]

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>