iptables: link against libnetfilter_conntrack

Linking currently fails in --enable-static case:

../extensions/libext.a(libxt_connlabel.o): In function `connlabel_get_name':
iptables/extensions/libxt_connlabel.c:57: undefined reference to `nfct_labelmap_get_name'
[..]
It's libxtables.la(libxt_connlabel.o) using libnetfilter_conntrack.

If libnetfilter_conntrack is not found, @libnetfilter_conntrack_CFLAGS@
and @libnetfilter_conntrack_LIBS@ (and their ${} ones) should be empty,
therefore producing no harm to include unconditionally.

Reported-and-tested-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Florian Westphal <fw@strlen.de>
extensions: add SYNPROXY extension

Signed-off-by: Patrick McHardy <kaber@trash.net>
utils: add nfsynproxy tool

[ Originally synconf, but Jesper D. Brouer suggested to change
  the name to avoid a possible filename clash. I also include
  nfsynproxy in the final configure report --pablo ]

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
extensions: libxt_set, libxt_SET: check the set family too

Do not accept silently sets with wrong protocol family but reject
them with an error message. It makes straightforward to catch user
errors.

[ Use afinfo instead to avoid a binary interface update --pablo ]

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
utils: nfsynproxy: fix error while compiling the BPF filter

Fix the following error while running nfsynproxy here:

 pcap_compile: not-yet-activated pcap_t passed to pcap_compile

According to what I have read, we have to compile the filter
once the pcap_t handle has been activated.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
iptables 1.4.21 release

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Merge branch 'stable-1.4.20'

... to get 76e230e ('iptables: link against libnetfilter_conntrack'),
else static build doesn't work.

Conflicts:
	extensions/GNUmakefile.in

[ CPPFLAGS was added in master, so keep it ]

Reported-By: Gustavo Zacarias <gustavo@zacarias.com.ar>