build: support for automake-1.12

automake-1.12 wants that AM_PROG_AR be used when LT_INIT is.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
build: separate AC variable replacements from xtables.h

It was/is a bit annoying that modifying xtables.h.in causes configure
to rerun. Split the @foo@ things into a separate file to bypass this.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Convert the NAT targets to use the kernel supplied nf_nat.h header

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add IPv6 MASQUERADE extension

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add IPv6 SNAT extension

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add IPv6 DNAT target

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add IPv6 REDIRECT extension

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add IPv6 NETMAP extension

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: add NPT extension

Add extensions for the SNPT and DNPT stateless IPv6-to-IPv6 Network Prefix
Translation targets.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
New set match revision with --return-nomatch flag support
libxtables: consolidate preference logic

Alias support will require testing for more conditions, so move the
revision comparison code into a separate function where it can be
shared between matches and targets.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
iptables: support for target aliases

This patch allows for target names listed on the command line to be
rewritten to new names and revisions.

As before, we will pick a revision that is supported by the kernel - now
including real_name in the search. This gives us the possibility to test
for many action names.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_NOTRACK: replace as an alias to CT --notrack

Note that we do not need any print/save functions for the alias entries,
since the real CT entry will handle this.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
iptables: support for match aliases

This patch allows for match names listed on the command line to be
rewritten to new names and revisions, like we did for targets before.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
libxt_state: replace as an alias to xt_conntrack

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
Merge branch 'master' of git://git.inai.de/iptables
doc: clean up interpunction in state list for xt_conntrack

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: deduplicate extension descriptions into a new manpage

iptables.8 and ip6tables.8 had pretty much the same content, with a few
protocol-specific deviations here and there. Not only did that bloat the
manpages, but it also made it harder to spot differences. Separate out
the extension descriptions into a new manpage, which conveniently
features differences next to one another (cf. REJECT).

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: trim "state" manpage and reference conntrack instead

The module is practically obsolete, so just pinpoint to the replacement
in short order.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>
doc: have NOTRACK manpage point to CT instead

The module is obsolete, so point to CT --notrack instead.

Signed-off-by: Jan Engelhardt <jengelh@inai.de>