Merge upstream v1.4.13

This merges upstream's iptables version 1.4.13. Note that the build
triggers a bug in bionic's headers; apply I3ca45b43 before building.

The merge incorporates the following commits:

commit c4a6b0d437b02458fb3cb827b694fd94b3fbe044
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Mar 27 13:33:02 2012 +0200

    Bump version to 1.4.13

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit f233df44196f568075a5d70fc29f31b72b512783
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Mar 27 10:23:49 2012 +0200

    extensions: add nfacct match

    This patch provides the user-space iptables support for the nfacct match.
    This can be used as it follows:

     nfacct add http-traffic
     iptables -I INPUT -p tcp --sport 80 -m nfacct --nfacct-name http-traffic
     iptables -I OUTPUT -p tcp --dport 80 -m nfacct --nfacct-name http-traffic
     nfacct get http-traffic

    See also man nfacct(8) for more information.

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit c0aa38e22e8a09fcb1898ad0e042eaf6314d2d42
Author: Maciej Żenczykowski <maze@google.com>
Date:   Wed Mar 21 00:52:00 2012 +0000

    src: mark newly opened fds as FD_CLOEXEC (close on exec)

    By default, Unix-like systems leak file descriptors after fork/exec
    call. I think this seem to result in SELinux spotting a strange AVC
    log messages according to what I can find on the web.

    Fedora 18 iptables source includes this change.

    Maciej says:
    "iptables does potentially fork/exec modprobe to load modules.
    That can cause a selinux 'domain'/'role'/whatever-it-is-called crossing.
    You can do automated inspection of what gets carried across such
    privilege changes and any unexpected open file descriptors flag
    problems, patches like this cut down on the noise."

    Signed-off-by: Maciej  enczykowski <maze@google.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 61b8f7ecb64b3b6fe04d2a6ad9598f66e42ceea8
Author: Franz Flasch <franz.flasch@frequentis.com>
Date:   Thu Mar 8 04:20:41 2012 +0000

    iptables: missing free() in function delete_entry()

    Fixed a memory leak in the dry run path of function delete_entry().

    Signed-off-by: Franz Flasch <franz.flasch@frequentis.com>
    Signed-off-by: Christian Engelmayer <christian.engelmayer@frequentis.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 1a7732f965c2b09e526eeca8a551538fbdc099ef
Author: Franz Flasch <franz.flasch@frequentis.com>
Date:   Thu Mar 8 04:20:37 2012 +0000

    iptables: missing free() in function cache_add_entry()

    Fixed a memory leak in the error path of function cache_add_entry().

    Signed-off-by: Franz Flasch <franz.flasch@frequentis.com>
    Signed-off-by: Christian Engelmayer <christian.engelmayer@frequentis.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 7c1b69b97571ddeb8c624b0a1da366a456895a6d
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Mar 1 00:27:50 2012 +0100

    Revert "libiptc: Returns the position the entry was inserted"

    This reverts commit d65702c5c5bbab0ef12298386fa4098c72584e6c.

    This is breaking my iptables scripts:

    iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    iptables: Incompatible with this kernel.

commit d65702c5c5bbab0ef12298386fa4098c72584e6c
Author: Jonh Wendell <jonh.wendell@vexcorp.com>
Date:   Wed Jan 4 15:44:01 2012 -0200

    libiptc: Returns the position the entry was inserted

    Jan Engelhardt showed no objections to this patch.

commit 98e1769b65b71989e3f16b25529b40f374aef323
Author: Patrick McHardy <kaber@trash.net>
Date:   Wed Dec 28 14:27:47 2011 +0100

    extensions: add IPv6 capable ECN match extension

    Patrick submitted this patch by 9th Jun 2011, I'm recovering
    and applying it to iptables.

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 166b92d3fb2a7fc008df1b59332ef528a9a573ea
Author: Florian Westphal <fw@strlen.de>
Date:   Thu Jul 14 23:56:47 2011 +0200

    extensions: add rpfilter module

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 2117f2b4519a027c8e8ccdb2c99f2025c8af898b
Merge: 79cefab 3852ebc
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Jan 2 19:09:12 2012 +0100

    Merge branch 'stable'

commit 3852ebcd25f65a42b552a0c705126c4b22da437e
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Mon Jan 2 18:19:09 2012 +0100

    Bump version to 1.4.12.2

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 79cefabaac7a0ecf864db7da2a665845c0789f10
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Dec 30 02:14:00 2011 +0100

    extensions: link on libxtables and check symbols

    Have each extension link against libxtables.so; with this, all home
    symbols are known at link time and we can use ld's --no-undefined to
    run the check, dropping the homebrew solution.

    By having libxtables.so required by extensions, package managers'
    automatic dependency discovery will become effective so that manual
    dependencies for distros with split extension packages (e.g. OpenWRT)
    will not be necessary anymore.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 32d8532a37004e11e5994d93df5e249c43197930
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 04:04:37 2011 +0100

    build: use delayed expansion on the user-settable variables

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f63d056f0c1ac122973a0859445c9cb5747e7213
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 20:22:26 2011 +0100

    Update .gitignore

    Split off extensions/.gitignore.

commit de26cd21f367d929a1aff41e268ce250ad49b04b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 20:21:27 2011 +0100

    build: use AC_CONFIG_AUX_DIR and stash away tools

commit 9e1bb81c7e9d2c402ac62e3955af144e49f96ad8
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 20:20:33 2011 +0100

    Update .gitignore

    Only ignore these paths if they are a directory.

commit 20a776cbd45368256601e4e38761ce5b44b35205
Merge: 4c15dcc 1fda094
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Dec 31 21:53:54 2011 +0100

    Merge branch 'stable'

commit 1fda09431938321b1aed6b9cf0e4cbcefae39b11
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Dec 30 02:14:51 2011 +0100

    nfnl_osf: add missing libnfnetlink_CFLAGS to compile process

commit 4c15dcc6ec505d26649be8a8a9c8eb19134bfd5a
Merge: 32a4b7d 08628f2
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Fri Dec 23 14:56:44 2011 +0100

    Merge branch 'stable'

commit 08628f20f492a1f9178f6df2a276f9a108ac0022
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Dec 16 18:34:06 2011 +0100

    libxt_connbytes: fix handling of --connbytes FROM

    quoting man page:

    match packets  from  a  connection  whose packets/bytes/average
    packet size is more than FROM and less than TO bytes/packets. if
    TO is omitted only FROM check is done.

    But, when TO was omitted, we did treat it like "x:x" which is not
    the same at all.

    Before commit 09631dc60ce41bc484a42fcf4d4ddf7036820bd1
    (libxt_connbytes: use guided option parser), we failed to parse
    "--connbytes x" ('Bad range "x"'), but treated "x:" like "x:0xffffffff".

    Also, restore the "from must be smaller than to" check.

    Signed-off-by: Florian Westphal <fw@strlen.de>

commit 32a4b7dcaf252348732362cd6d853bf0005b2bdd
Merge: b8c42ec 79ddbf2
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 03:10:56 2011 +0100

    Merge branch 'stable'

commit b8c42eca0f224a00bf55b60ded81af14a1e07da1
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 02:52:15 2011 +0100

    libiptc: provide separate pkgconfig files

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 70af559db7732b6e06a57fca3611c86c6fa5dc00
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Dec 18 02:44:05 2011 +0100

    doc: clarification on the meaning of -p 0

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 79ddbf202a06e6f018e087a328c2ca91e65a8463
Author: Tim Gardner <tim.gardner@canonical.com>
Date:   Wed Nov 30 08:16:53 2011 -0700

    libxt_recent: Add support for --reap option

    Support for the reap option was merged in the kernel as of 2.6.35.

    Cc: Pablo Neira Ayuso <pablo@netfilter.org>
    Cc: Jan Engelhardt <jengelh@medozas.de>
    Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

commit 3964023f8640b60456373825b326b91badd7a058
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Nov 25 15:36:56 2011 +0100

    libipt_SAME: set PROTO_RANDOM on all ranges

    Resolve the (justified) WTF remark to a clearer version of when/why
    PROTO_RANDOM needs to be set.

    Especially when --random is used before --to in SAME, it would have
    not been appleid.

commit ba525eb3d3a77a5465e4e8a24970d8f15ba59ee3
Merge: 5cf4ec2 3c461ce
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Tue Nov 1 13:39:06 2011 +0100

    Merge branch 'stable'

commit 3c461ceeed5f55599930051f6feaec014b08f730
Author: Florian Westphal <fw@strlen.de>
Date:   Mon Oct 31 16:10:57 2011 +0100

    libxt_NFQUEUE: fix --queue-bypass ipt-save output

    else, this will print "--queue-num 0--queue-bypass ".

    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 5cf4ec29ddaccb6a39a71f07b70188cf46b79ff9
Merge: 8fe22aa e5152bf
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Sep 28 20:53:48 2011 +0200

    Merge branch 'stable'

commit 8fe22aa0a242314349f6cd7219b56a60a9d75276
Author: Thomas Jarosch <thomas.jarosch@intra2net.com>
Date:   Mon Sep 5 22:25:39 2011 +0200

    Improve readability of bitwise operation

    CLUSTERIP: improve readability of bitwise operation

    Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit e5152bf4ebd4f573ae1d0770044e2bff7ab66d5e
Author: Thomas Jarosch <thomas.jarosch@intra2net.com>
Date:   Wed Sep 28 20:45:24 2011 +0200

    libxtables: Fix file descriptor leak in xtables_lmap_init on error

    Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit 134280881a3c99f313da669117de71bc236f1f77
Merge: 0ab10b1 d2b0eaa
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Sep 19 13:44:18 2011 +0200

    Merge branch 'stable'

commit d2b0eaa297dfa87f54b3fbcaa292f14d793e3f3c
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Sep 18 15:38:20 2011 +0200

    build: make check stage not fail when building statically

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 8816e91cddef785c78b3598c7c41a1f88be08f5a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Sep 18 15:06:05 2011 +0200

    build: restore build order of modules

    iptables(exe) requires libext.a, but extensions/ require libxtables.la
    (in iptables/). This circular dependency does not work out, so
    separate libxtables into its own directory and put it in front.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 0ab10b11093ec250b404e3bead1d39177d1cbfa0
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 10:34:01 2011 +0200

    ip6tables-restore: make code look alike with iptables-restore

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit de4d2d3b716d83a6d3831aaf902c5adb5d1d14c9
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 12:50:32 2011 +0200

    libiptc: use a family-invariant xtc_ops struct for code reduction

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 14da56743c6cdf25da35b7b5ca7a5d201771990d
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 09:56:16 2011 +0200

    src: resolve old macro names that are indirections

    Command used:

    	git grep -f <(pcregrep -hior
    	'(?<=#define\s)IP6?(T_\w+)(?=\s+X\1)' include/)

    and then fix all occurrences.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 1639fe86579f86f5f6a954a9b0adde2e16ad1980
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 11:39:52 2011 +0200

    libiptc: combine common types: _handle

    No real API/ABI change incurred, since the definition of the structs'
    types is not visible anyhow.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 7e5e866a36a76c153e5903b8251f90cfe07a1d34
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 11:16:16 2011 +0200

    libiptc: replace ipt_chainlabel by xt_chainlabel

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 2325c0fedf7507f94aa3bb11cc65a70d33836f8f
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 11:12:49 2011 +0200

    libiptc: combine common types

    Make an xt_chainlabel type out of ipt_chainlabel and ip6t_chainlabel,
    and add backward-API #defines. The ABI naturally does not change
    either, so no soversion bump.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 160f25b09fc5695a65a8aaf485ebece85e1f853c
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 10:59:31 2011 +0200

    libiptc: remove unused HOOK_DROPPING thing

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 296dca39be1166c4b7c6367c1b97ee95aebddfc3
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 13:06:37 2011 +0200

    iptables-save: remove binary dumping dead code

    Was never implemented, kill it.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 9cf67deb62f127902e686c48b951861bf848d0ab
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Sep 11 17:24:26 2011 +0200

    libiptc: resolve compile failure

      CC     libip4tc.lo
    In file included from libip4tc.c:118:0:
    libiptc.c:70:8: error: redefinition of "struct xt_error_target"
    ../include/linux/netfilter/x_tables.h:69:8: note: originally defined here

    Remove libiptc's duplicate definition and substitute names.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 34d23bd14002aeeae0374d2561ad329e5cdc96e2
Merge: 62fc25f 1e49652
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Sep 11 17:14:04 2011 +0200

    Merge branch 'stable'

commit 1e4965232d77ab752c9c781afcf854f4b173c7b1
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 09:31:35 2011 +0200

    doc: document iptables-restore's -T option

    Commit v1.4.0-rc1-12-ge8665f8 completely forgot this.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit b171b546cb529e2996df05fe91cba058fae9fd99
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 09:29:30 2011 +0200

    ip6tables-restore: implement missing -T option

    Commit v1.4.0-rc1-12-ge8665f8 forgot to port the change to the
    ip6tables part.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 5fa68e820a641039e48045a82560ed13471ecff4
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 09:21:46 2011 +0200

    doc: fix undesired newline in ip6tables-restore(8)

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 5e5ea1ccf61d96879531929874109c17c1894908
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Sep 8 17:08:37 2011 +0200

    build: sort file list before build

    Manpage subsections are already sorted for obvious reasons. Since
    $(wildcard) can actually return results unordered (just what the OS
    can do) do the sorting with the .o file list too, for developer
    comfort.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 62fc25fd1625f0f65b9eed3e15fe929dd0aff2c5
Merge: 891d579 dbe77cc
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Sep 8 17:00:49 2011 +0200

    Merge branch 'master' of git://dev.medozas.de/iptables

commit 891d5790b3f4caeed80f1449d280617c54df8837
Merge: bf42cf9 153c23d
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Sep 8 16:07:16 2011 +0200

    Merge branch 'stable'

commit 153c23d9b14285b24aae3e96da0b547dcc7ee051
Author: Tom Eastep <teastep@shorewall.net>
Date:   Fri Sep 2 17:45:51 2011 -0700

    libxt_CONNSECMARK: fix spacing in output

    ~# iptables -t mangle -A foo -j CONNSECMARK --save
    ~# iptables -t mangle -S
    [...]
    -A foo -j CONNSECMARK--save

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit bf42cf92ea0c53e5470a20d62d00e5e83379f4d5
Merge: 5df067f 2ca6273
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Sep 5 20:15:10 2011 +0200

    Merge branch 'stable' of git://dev.medozas.de/iptables

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f56b8a8bf4b1041cb875fd8439778f35276bdb30
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Sep 3 14:27:55 2011 +0200

    iptables: move kernel version find routing into libxtables

    That way, the remaining unreferenced symbols that do appear in
    libipt_DNAT and libipt_SNAT as part of the new check can be resolved,
    and the ugly -rdynamic hack can finally be removed.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 751da923262746bf8fd3195e178504fb18c37dc5
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Sep 3 14:11:53 2011 +0200

    build: scan for unreferenced symbols

    To be notified of occurrences where we are missing any libraries, run
    some ldd checks post building.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 9249ad37b2342eb48009e18f3982362e1018ea5a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Sep 3 13:35:53 2011 +0200

    libxt_RATEEST: link with -lm

    $ ldd -r libxt_RATEEST.so
    undefined symbol: log   (./libxt_RATEEST.so)

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit d4e72dc1c684c2f8361d87e6bde2902cd2ee8efb
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Sep 3 13:34:40 2011 +0200

    libxt_statistic: link with -lm

    $ ldd -r libxt_statistic.so
    undefined symbol: lround        (./libxt_statistic.so)

    References: https://bugs.archlinux.org/task/25358
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 5df067f91b8ffa7801d09e6dd13fe9bf4b7b490b
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Thu Sep 1 18:30:42 2011 +0200

    Bump version to 1.4.12.1

    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

commit dbe77cc974cee656eae37e75039dd1a410a4535b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 28 14:19:43 2011 +0200

    include: refresh include files from kernel 3.1-rc3

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3775fb69f63b76191bc3571bfa8538c18173d90f
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 28 14:16:14 2011 +0200

    libxt_addrtype: add support for revision 1

    Rev 1 was added to the kernel in commit v2.6.39-rc1~468^2~10^2~1 but
    there was no corresponding iptables patch so far.

    Cc: Florian Westphal <fw@strlen.de>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit a49002efbdc5813ee193aa8fde3da3e35ff0d38f
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 28 14:10:19 2011 +0200

    libxt_addrtype: rename from libipt_addrtype

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 2ca6273c73b42e8c74afd5f8b1fe10c5c93ce363
Author: Richard Weinberger <richard@nod.at>
Date:   Sat Aug 27 15:32:31 2011 +0200

    xtoptions: simplify xtables_parse_interface

    mask is already filled with zeros, there is no need to zero it again.

    References: http://marc.info/?l=netfilter-devel&m=131445196526269&w=2
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3412bd0bfb8b8bac9834cbfd3392b3d5487133bf
Author: Tom Eastep <teastep@shorewall.net>
Date:   Thu Aug 18 15:11:16 2011 -0700

    libxt_conntrack: improve error message on parsing violation

    Tom Eastep noted:

    $ iptables -A foo -m conntrack --ctorigdstport 22
    iptables v1.4.12: conntrack rev 2 does not support port ranges
    Try `iptables -h' or 'iptables --help' for more information.

    Commit v1.4.12-41-g1ad6407 takes care of the actual cause of the bug,
    but let's include Tom's patch nevertheless for the better error
    message in case one actually does specify a range with rev 2.

    References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit fdb2a27825e558393fb715374c07873830d4d149
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 27 17:59:52 2011 +0200

    xtoptions: fill in fallback value for nvals

    Parsing for libxt_conntrack rev 2 is done by using rev 2's option
    structure, which specifies XTTYPE_PORT, and using rev 3's parser
    skeleton, which uses cb->nvals. Reading cb->nvals when not using
    XTTYPE_PORTRC (or any other multi-value type) is undefined behavior.

    Make it defined. Since XTTYPE_NONE is the only type that can take
    void, nvals logically ought to be 1.

    References: http://marc.info/?l=netfilter-devel&m=131370592105298&w=2
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit debcf48f6a72914a9c06e99b175ad64ef1f6f1cb
Author: Fernando Luis Vázquez Cao <fernando@oss.ntt.co.jp>
Date:   Tue Aug 2 10:00:40 2011 +0900

    libxt_TOS: update linux kernel version list for backported fix

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit d51a97bc52ee81a962b761c7e58a5eb9f07a2c8a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Aug 26 14:46:40 2011 +0200

    libxt_string: escape the escaping char too

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=740
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f643eb37e49a212d40eb060bcdfafbc366c0d616
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Aug 26 12:45:02 2011 +0200

    src: remove unused IPTABLES_MULTI define

    This dead code has been lingering around since commit v1.4.5~7.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f4daf54e5c184680559de33eb08f2a0fb701dbe9
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Aug 25 12:11:20 2011 +0200

    libxt_string: replace hex codes by char equivalents

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 131d4fb53b45be85b1315f72f958cadf7b24a63f
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 13:16:16 2011 +0200

    libxt_string: simplify hex output routine

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 4a56bcbd49ef20a0203017c15ab1cec9bb140d1a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 13:04:38 2011 +0200

    libxt_hashlimit: observe new default gc-expire time when saving

    Since a while, --htable-gc-expire defaults to the chosen time quantum
    instead of 10 fixed seconds, which leads the expiry value to be always
    printed, which is redundant.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 7e42bda9330afe717561c47a02a3f58c8ee1a246
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 12:46:08 2011 +0200

    tests: add negation tests for libxt_statistic

    Note: it is valid to check cb->invert before calling
    xtables_option_parse.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 03deef5241330db418652c42af4d517527743f22
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 12:39:04 2011 +0200

    libxt_policy: remove superfluous inversion

    --dir cannot be inverted.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit c2a47ead16fc488fbf7fd8aa12d306cedf4da441
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 12:27:06 2011 +0200

    libxt_physdev: restore inversion support

    Bug origin is in commit v1.4.11~26^2~4.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit c4e1c0992937bce3ac72987aa43f4f3c219cf3e3
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 12:25:06 2011 +0200

    libxt_owner: restore inversion support

    Bug origin is in commit v1.4.11~16^2~7.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit c96e524e98de81b333d772aa9a4f9b93275525dd
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 12:11:15 2011 +0200

    libipt_ttl: document that negation is available

    Glitch since commit v1.2.1~75.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 0859fdf5d0ae24c88e64246164c4959ad3b0d098
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 11:59:58 2011 +0200

    libip6t_dst: restore setting IP6T_OPTS_LEN flag

    Bug origin is in commit v1.4.11~26^2~18.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 975aeec7d34419fece8710997b6ec88cc0abb580
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 11:54:01 2011 +0200

    libip6t_hbh: restore setting IP6T_OPTS_LEN flag

    Bug origin is in commit v1.4.11~26^2~17.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit de1f06dca906bfcb82d7c7c2d555fbf3229d12b6
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 11:49:21 2011 +0200

    libxt_hashlimit: remove inversion from hashlimit rev 0

    Revision 0 indeed did not have inversion support, nor presence of
    --hashlimit-above. This glitch was added in v1.4.11~16^2~10.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 97dac48e7dfd3e2f35e33fdad72bda5b3dfc2241
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 11:41:13 2011 +0200

    libip6t_frag: restore inversion support

    --fraglen also was not printed since v1.4.11~26^2~22.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 735f3d76ccd3a7deab13703d7c227c87c666a97b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 10:14:28 2011 +0200

    xtoptions: flag use of XTOPT_POINTER without XTOPT_PUT

    When XTOPT_POINTER is used (and yields a non-zero offsetof), we can
    flag the absence of XTOPT_PUT.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit bca5b9afbe4b3823989f1e78f178203eb3bfa37d
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 10:06:18 2011 +0200

    libxt_conntrack: fix --ctproto 0 output

    First, we are missing XTOPT_PUT when trying to use XTOPT_POINTER.
    (Next commit will flag this.) Furthermore, l4proto is of type
    uint16_t, while XTTYPE_PROTOCOL wants a uint8_t so the idea would not
    work => revert v1.4.12~1^2.

    Bug goes back to v1.4.12~1^2.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit c148c4ad2e28b94125c0c9954a887f0a473d598b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 09:46:12 2011 +0200

    libxt_hashlimit: default htable-expire must be in milliseconds

    Bug goes back to v1.4.12~3^2~11.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 83c342b36a7048ab86827e09a4916064837293d3
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 08:52:56 2011 +0200

    libxt_dscp: restore inversion support

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f17fd48448aafdc762a3b439864bcb1127b0da6c
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 09:39:21 2011 +0200

    libxt_dccp: fix random output of ! on --dccp-option

    dccp-option tests info->typemask, but it really should look at
    info->invflags instead.

    This bug goes back to commit v1.3.4~11.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit ca48066aaa8179025c0b4e17ed40a4bc12487190
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 09:15:20 2011 +0200

    libxt_dccp: provide man pages options in short help too

    This omission goes back to commit v1.3.4~11.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f677e7b10c72bd3007c89d51eea13a0c2c3d262b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 09:12:27 2011 +0200

    libxt_dccp: spell out option name on save

    This glitch goes back to commit v1.3.4~11.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 7e66a657d0fbb8a3f27fd78c7bb27859d44002aa
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 09:08:04 2011 +0200

    libxt_dccp: fix deprecated intrapositional ordering of !

    This bug goes back to v1.4.3~63.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit d152d6acd6751884621e0b760fecc0d652aea479
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 09:05:31 2011 +0200

    libxt_dccp: restore missing XTOPT_INVERT tags for options

    This regression goes back to v1.4.11~19^2.

    References: Dave Täht via netfilter-devel on 2011-08-20 14:40:11 -0700
    References: <CAA93jw6mpDL6rLXM+9SpAhafkDdKoSfhAxU8UM87vUqjuzjYJw@mail.gmail.com>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 107dca41800f7aeb6600438ea3aaf0fd66019417
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 08:46:49 2011 +0200

    libxt_conntrack: remove one misleading comment

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 79e1f97a966e82155ebc00b30e3b60c48d060448
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Aug 21 08:43:15 2011 +0200

    doc: clarify libxt_connlimit defaults

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3716dfd7eac3afa7fb3098952550e510c8df0220
Author: Dwight Davis <sivad_thgiwd@yahoo.ca>
Date:   Fri Aug 12 17:02:09 2011 -0400

    libxt_string: fix space around arguments

    Fix oversight from commit v1.4.11~80.

    References: http://bugs.debian.org/637499
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 886a89bf378e079e807cda2eb43573ca6c886d0a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 20 21:00:45 2011 +0200

    libxt_set: put differing variable names in directly

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit b6ad32fe050126e5557c19ab970547d1472e4728
Author: Bernard Massot <bernard@massot.ath.cx>
Date:   Wed Aug 10 14:56:00 2011 +0200

    doc: fix typo in libxt_TRACE

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=736
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3dafef40228c372976eb714836ea097115d8fd03
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 20 18:26:48 2011 +0200

    libxt_tcp: always print the mask parts

    0xFF is unlikely to happen (given that ALL translates to 0x3F at
    most), but assuming that through magic, 0xFF was put into memory,
    iptables -S/iptables-save would ignore printing it, practically
    outputting just one argument to --tcp-flags which currently wants two.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 085b233bd85173082cc872563505ad3755ac5455
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Aug 20 18:26:34 2011 +0200

    libxt_set: update man page about kernel support on the feature

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit bc3aeaafcf33e3e6a51948568f4f7a16304f619b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Aug 15 17:06:20 2011 +0200

    libxt_u32: fix missing allowance for inversion

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 91ca4603f649a9b9fed4f2e31a8c005cdbdacd1e
Merge: 47b5855 4982fe4
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue Aug 9 13:23:17 2011 +0200

    Merge branch 'master' of git://dev.medozas.de/iptables

commit 4982fe43cf247cda6ddb946a8f1fd58177124735
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Aug 8 02:38:41 2011 +0200

    libipq: add pkgconfig file

    This is just to make sure that projects (still) using it do so with
    the right cflags, e.g. for when the include file ends up in a
    non-standard location due to ./configure having been called with
    --include=/somewhere/else.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit fa2ce1ca2a3448350dee30c153dafe65abe7135d
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Aug 1 21:26:01 2011 +0200

    build: abort autogen on subcommand failure

    Needed to stop an automated build process when automake requirements
    are not fulfilled.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 43896add0eb9c6bc94b7323e76f137d402e0f7fe
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Aug 1 20:22:04 2011 +0200

    build: strengthen check for overlong lladdr components

    ethermac[i] > UINT8_MAX is quite pointless, because ethermac[i] is
    just uint8_t. To catch values that are not in the range "00"-"ff", use
    a string length check (end-arg>2). I am willingly using 2 there,
    because no one is going to specify an Ethernet LL address as
    "0x00:0x24:0xbe:0xc2:0x7f:0x16" -- because it is always interpreted as
    hexadecimal anyway even without the 0x prefix.

    xtoptions.c: In function "xtopt_parse_ethermac":
    xtoptions.c:760:3: warning: comparison is always false due to limited range of data type
    xtoptions.c:766:2: warning: comparison is always false due to limited range of data type

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 41a9b481693b4c43c16d0588cc558dd455168af0
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Aug 1 20:14:57 2011 +0200

    build: workaround broken linux-headers on RHEL-5

    maigc.h was not invented yet, but they do not
    ship proc_fs.h either, duh.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 67156c0b9a3d35f5e7836e5683d8ca0b46ac36ca
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Aug 1 20:08:42 2011 +0200

    libxt_string: define _GNU_SOURCE for strnlen

    On RHEL-5.6 and clones with its gcc-4.1.2 and glibc-2.5:

    libxt_string.c: In function "parse_string":
    libxt_string.c:84: warning: implicit declaration of function "strnlen"

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 47b5855bc396876295c6432e553351123a62534b
Author: Patrick McHardy <kaber@trash.net>
Date:   Fri Jul 22 14:37:34 2011 +0200

    Bump version to 1.4.12

    Signed-off-by: Patrick McHardy <kaber@trash.net>

commit 4d8656ad9d0afd04820f125a85a7b673c7e74fe6
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Jul 22 12:25:43 2011 +0200

    libxt_TCPMSS: restore build with IPv6-less libcs

    Commit v1.4.10-149-gea2a02f added an netinet/ip6.h include, which is
    not available on systems without IPv6 header files.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 1757ec846419c76da4e104f9675b40e05ac3eee6
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Jul 22 12:11:03 2011 +0200

    extensions: use multi-target registration

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 88e0a097c3f23dadf041b60445c6c9802c502f15
Merge: 795ea2e d22ceae
Author: Patrick McHardy <kaber@trash.net>
Date:   Mon Jul 11 10:41:10 2011 +0200

    Merge branch 'master' of git://dev.medozas.de/iptables

commit d22ceae71eaae9f641e002074fb49cd7925a7c2f
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Jul 10 13:13:49 2011 +0200

    libxt_conntrack: move more data into the xt_option_entry

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 34d9ce1b80618eebcf63e933cf4a15cc5482c0d2
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Jul 10 12:48:42 2011 +0200

    libxt_conntrack: restore network-byte order for v1,v2

    References: http://bugs.debian.org/632804
    References: http://marc.info/?l=netfilter-devel&m=130999299016674&w=2
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3eab786d6a687187556c92b3dc0f0664d8352471
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sun Jul 10 11:47:46 2011 +0200

    libxtables: set clone's initial data to NULL

    Avoid a crash in xs_init_match when a clone's m->udata points at the
    parent.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit fbe9f1ecccb5ac02858fa7eee2979e0e4d97bb5f
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Jul 9 19:37:31 2011 +0200

    option: remove last traces of intrapositional negation

    Intrapositional negation was deprecated in 1.4.3.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 0c384449ae9511157cd9b34d73f8f4cb71123a45
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Jul 9 16:19:09 2011 +0200

    libxtables: ignore whitespace in the multiaddress argument parser

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=727
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit c0e69db337540b22a3b3f739b1143341e7b759b7
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Jul 9 16:01:18 2011 +0200

    libxtables: properly reject empty hostnames

    An empty hostname in the address list of an -s/-d argument, which may
    be the result of a typo, is interpreted as 0/0, which, when combined
    with -j ACCEPT, leads to an undesired opening of the firewall.

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=727
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 795ea2e8d4d9f01a606d0d7aac22572801e06989
Merge: 411b390 32cea83
Author: Patrick McHardy <kaber@trash.net>
Date:   Tue Jul 5 15:16:05 2011 +0200

    Merge branch 'master' of git://dev.medozas.de/iptables

commit 32cea83f26a2c342b9410e6dfb0530b33f8af928
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Tue Jul 5 15:08:37 2011 +0200

    iptables: restore negation for -f

    This move was missed in commit v1.4.11~77^2~6.

    References: http://bugs.debian.org/632695
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit d532d7663fd82984023a871aa953419ad1e905cb
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Jul 4 13:04:16 2011 +0200

    doc: the -m option cannot be inverted

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 9cf0c00c226db02f8f3d129225844920704b97c1
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Jul 4 13:02:51 2011 +0200

    doc: fix version string in ip6tables.8

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 411a4e50ec1030f2dc51c5b0156e0c7255c81905
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Mon Jul 4 12:44:43 2011 +0200

    build: install modules in arch-dependent location

    Make it possible to have multiple types of ELF classes for the
    extension modules by putting them in an arch-dependent path.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 411b390f3ffcd4708a0dfc0f2824a637de511cea
Merge: 3b7a22b 1c9508e
Author: Patrick McHardy <kaber@trash.net>
Date:   Thu Jun 30 13:35:56 2011 +0200

    Merge branch 'master' of git://dev.medozas.de/iptables

commit 1c9508e1f3f853f33683eb7118e19b193a6c80b7
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Jun 30 13:19:15 2011 +0200

    doc: mention multiple verbosity flags

    "-vv" can be used to further increase the verbosity level. Document
    this.

    References: http://bugs.debian.org/616037
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 358650c0e280dad8c1292efbf856ac310004a52b
Author: Martin F. Krafft <madduck@debian.org>
Date:   Tue Sep 22 21:07:13 2009 +0200

    iptables-apply: select default rule file depending on call name

    ip6tables-apply points to iptables-apply (which is good). Since
    iptables/ip6tables rule files are different, the reporter suggests
    that the DEFAULT_FILE variable should depend on whether iptables-apply
    or ip6tables-apply is run.

    References: http://bugs.debian.org/547734
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3c871010888e1479ef8fca2048485b979ec2661a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Jun 24 20:16:48 2011 +0200

    build: attempt to fix building under Linux 2.4

    iptables no longer compiles for Linux 2.4 because it uses
    linux/magic.h. This header and the PROC_SUPER_MAGIC macro are only for
    Linux 2.6.

    xtables.c:35:52: error: linux/magic.h: No such file or directory
    xtables.c: In function 'proc_file_exists':
    xtables.c:389: error: 'PROC_SUPER_MAGIC' undeclared (first use in
    this function)
    xtables.c:389: error: (Each undeclared identifier is reported only
    once for each function it appears in.)

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=720
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 447ddfbfb3ed16ad0059f4559334670e9b9806ec
Author: Jakub Zawadzki <darkjames@darkjames.ath.cx>
Date:   Mon Jun 13 13:54:33 2011 +0200

    doc: fix group range in libxt_NFLOG's man

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=723
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 622abc73b097e7e778b432e422fd3c1f035bcfd3
Author: Massimo Maggi <massimo@mmmm.it>
Date:   Wed Jun 15 02:52:00 2011 +0200

    libxt_RATEEST: fix userspacesize field

    I cannot delete a rule by matching it if the target of the rule is
    RATEEST.

    Copy-paste from terminal:

    	# iptables -t mangle -A PREROUTING -j RATEEST
    	--rateest-name somename --rateest-interval 250ms
    	--rateest-ewmalog 4s
    	# iptables -t mangle -D PREROUTING -j RATEEST
    	--rateest-name somename --rateest-interval 250ms
    	--rateest-ewmalog 4s
    	iptables: No chain/target/match by that name.

    I saw in comments of the kernel code that the last part of the struct
    xt_rateest_target_info is used only by kernel:

    	struct xt_rateest_target_info {
    		char name[IFNAMSIZ];
    		__s8 interval;
    		__u8 ewma_log;

    		/* Used internally by the kernel */
    		struct xt_rateest *est __attribute__((aligned(8)));
    	};

    but in struct xtables_target, .size and .userspacesize are equal.
    Simply correcting this solved the problem.

    References: http://bugzilla.netfilter.org/show_bug.cgi?id=724
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f53710b16c2bae1843c3f5fee390f496dfa82526
Author: Jiri Popelka <jpopelka@redhat.com>
Date:   Fri Jun 10 15:26:02 2011 +0200

    iptables: Coverity: RESOURCE_LEAK

    xtables.c:320: alloc_fn: Calling allocation function "get_modprobe".
    xtables.c:294: alloc_fn: Storage is returned from allocation function "malloc".
    xtables.c:294: var_assign: Assigning: "ret" = "malloc(1024UL)".
    xtables.c:304: return_alloc: Returning allocated memory "ret".
    xtables.c:320: var_assign: Assigning: "buf" =  storage returned from "get_modprobe()".
    xtables.c:323: var_assign: Assigning: "modprobe" = "buf".
    xtables.c:348: leaked_storage: Variable "buf" going out of scope
                   leaks the storage it points to.
    xtables.c:348: leaked_storage: Returning without freeing "modprobe"
                   leaks the storage that it points to.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit d0101690d9ae347d8a8ee9e340c5db72480046a3
Author: Jiri Popelka <jpopelka@redhat.com>
Date:   Fri Jun 10 15:26:00 2011 +0200

    iptables: Coverity: VARARGS

    xtables.c:931: va_init: Initializing va_list "args".
    xtables.c:938: missing_va_end: va_end was not called for "args".
    xtables.c:947: missing_va_end: va_end was not called for "args".
    xtables.c:961: missing_va_end: va_end was not called for "args".

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit ee80faf4438102395bc4034894b6468453181be9
Author: Jiri Popelka <jpopelka@redhat.com>
Date:   Fri Jun 10 15:25:58 2011 +0200

    iptables: Coverity: REVERSE_INULL

    ip6tables-restore.c:186: deref_ptr_in_call: Dereferencing pointer "in".
    ip6tables-restore.c:463: check_after_deref: Dereferencing "in"
    before a null check.
    iptables-restore.c:192: deref_ptr_in_call: Dereferencing pointer "in".
    iptables-restore.c:468: check_after_deref: Dereferencing "in" before a
    null check.
    iptables-xml.c:671: deref_ptr_in_call: Dereferencing pointer "in".
    iptables-xml.c:873: check_after_deref: Dereferencing "in" before a
    null check.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 474c18d7982407246dd724c6fa3939f78466620a
Author: Jiri Popelka <jpopelka@redhat.com>
Date:   Fri Jun 10 15:25:57 2011 +0200

    iptables: Coverity: NEGATIVE_RETURNS

    libipq.c:232: var_tested_neg: Variable "h->fd" tests negative.
    libipq.c:234: negative_returns: "h->fd" is passed to a parameter that
    cannot be negative.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 96d0d0130a9a08803406c5c18681903446088ebf
Author: Jiri Popelka <jpopelka@redhat.com>
Date:   Fri Jun 10 15:25:55 2011 +0200

    iptables: Coverity: DEADCODE

    libiptc.c:407: dead_error_condition: On this path, the condition
    "res > 0" cannot be false.
    libiptc.c:396: at_least: After this line, the value of "res" is at
    least 1.
    libiptc.c:393: equality_cond: Condition "res == 0" is evaluated as
    false.
    libiptc.c:396: new_values: Noticing condition "res < 0".
    libiptc.c:425: new_values: Noticing condition "res < 0".
    libiptc.c:407: new_values: Noticing condition "res > 0".
    libiptc.c:435: dead_error_line: Execution cannot reach this statement
    "return list_pos;".

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit f6677b5bcae125af28d227b9073426bddbd9190e
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Wed Jun 22 15:42:48 2011 +0200

    build: bump soversion for recent data structure change

    Cf. commit v1.4.11.1-5-g2dba676.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 68146dad91611bd8d6d12c8ba27219130d99607b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Wed Jun 22 11:18:19 2011 +0200

    libxt_hashlimit: use a more obvious expiry value by default

    Due to the previous default expiry of 10 sec, "--hashlimit 1/min"
    would allow matching up to 6/min if a properly timed. To do what the
    user expects, the minimum expiry must equal the selected time quantum
    however.

    Cc: Jan Rovner <jan.rovner@diadema.cz>
    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 70cb0a6d3e09f64f9a05870d694ac0160319de9a
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Wed Jun 22 11:15:34 2011 +0200

    libxt_state: fix regression about inversion of main option

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 017e7b7e1cf4fb63208e46592d06cc030f6d552d
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Wed Jun 22 10:15:07 2011 +0200

    libip6t_HL: fix option names from ttl -> hl

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 12bc22a9d3e4ae4a3276dbae1cf3bd50ef5dbe9d
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Tue Jun 21 14:22:20 2011 +0200

    libxt_RATEEST: abolish global variables

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 4a96d2e2c9d8c43b58d9490cd1d2ae2d1b3e0bef
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Tue Jun 21 09:54:31 2011 +0200

    libxt_rateest: abolish global variables

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 2dba676b68ef842025f3afecba26cb0b2ae4c09b
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Jun 18 21:34:25 2011 +0200

    extensions: support for per-extension instance "global" variable space

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 14190986f87301b18bcc473c842bd82d778d87a2
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Sat Jun 18 21:18:29 2011 +0200

    iptables: consolidate target/match init call

    This is useful for the upcoming patch about per-instance auxiliary
    data.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 68818f746bf9c68de04a75fbe756bf2c73e0fb32
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Tue Jun 21 14:20:15 2011 +0200

    libxt_RATEEST: use guided option parser

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 4e98e81ecdcc321d232edc42fac168d257e712ff
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Tue Jun 21 17:00:45 2011 +0200

    libipt_LOG: fix ignoring all but last flags

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 931d388ff33dee589bc00e4f9033be5ca7c43786
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Thu Jun 9 15:24:49 2011 +0200

    doc: include matches/targets in manpage again

    Evil sed did not throw any warning whatsoever when it cannot find the
    file.

    Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

commit 3b7a22b44d74b9b05d5e4b0529ebf72c49dcbff5
Author: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp>
Date:   Fri Jun 17 05:46:22 2011 +0200

    doc: document IPv6 TOS mangling bug in old Linux kernels

    In Linux kernels up to and including 2.6.38, with the exception of longterm
    releases 2.6.32.42 (or later) and 2.6.33.15 (or later), there is a bug (*) whereby
    IPv6 TOS mangling does not behave as documented and differs from the IPv4
    version. The TOS mask indicates the bits one wants to zero out, so it needs to
    be inverted before applying it to the original TOS field. However, the
    aformentioned kernels forgo the inversion which breaks --set-tos and its
    mnemonics.

    (*) Fixed by upstream commit:
        1ed2f73d90fb49bcf5704aee7e9084adb882bfc5 (netfilter: IPv6: fix DSCP mangle code)

    Signed-off-by: Fernando Luis Vazquez Cao <fernando@oss.ntt.co.jp>
    Signed-off-by: Patrick McHardy <kaber@trash.net>

Change-Id: I237080f58e3c43b94408883fe1ad8232a08a03bc