Fixes build error of conntrack match because of missing ip_conntrack_tuple.h
in linux 2.6.22. It is not needed because nf_conntrack headers can be used
instead.
bump version
Add Jozsef's TRACE target.

Changed to be built unconditionally by myself since it doesn't need any
headerfiles anyways.
Fix "iptables getsockopt failed strangely" when querying revisions for non-existant matches and targets

Reported by Joseph Jezak <josejx@gentoo.org>.
Removes some KERNEL_64_USERSPACE_32 because linux 2.6 has compat layer
Removes KERNEL_64_USERSPACE_32

The recent kernel has compat layer for iptables. It doesn't have
compat layer for libipq and ip6tables, but ip6tables with
KERNEL_64_USERSPACE_32 is still broken. We should fix kernel instead of
fixing them if and when we want use their 32bit binary with 64bit kernel.
libipt_statistic: add a few missing validity checks

Signed-off-by: Nicolas Bouliane
PATCH: Add connlimit to iptables.

Signed-off-by: Jan Engelhardt <jengelh@gmx.de>
Fixes compile error of connlimit where NO_SHARED_LIBS=1 is specified
Change default KERNEL_DIR location and add KBUILD_OUTPUT (Sven Wegener <sven.wegener@stealer.net>)
Adds missing FIN to mask part generated by '--syn' of libip6t_tcp
Adds missing explanations about FIN in mask part of '--syn' in libip[6]_tcp.c
and libip6t_tcp.man.
Ignore generated files
iptables-xml

Attached are:
1. A man page for iptables-xml

2. A fix for iptables.xslt allowing for an arbitrary depth of arguments
or modifiers.

Although iptables-xml cannot generate more than two levels deep, xml
generated by other systems may prefer to generate

<action>
  <restore-mark>
    <mask>0xff00</mask>
  </restore-mark>
</action>

than

<action>
  <restore-mark/>
   <mask>0xff00</mask>
</action>

(which is what iptables-xml generates)
even though the same iptables is re-generated on conversion.

3. A fix for iptables-xml.c so that combining of consecutive targets of
rules with the same match into one XML rule, will not combine over a
terminating action; i.e. there is no point in converting

-A table -p tcp -j DROP
-A table -p tcp -j MARK --set-mark 25
-A table -p tcp -j RETURN

into one XML rule with multiple actions as they are probably not
logically combined in the mind of the author.


Signed-off by: Sam Liddicott <azez@ufomechanic.net>
Adds xtables.[ch] and change Makefile to compile it
Moves common fw_malloc() and fw_calloc() to xtables.c
Moves ip[6]tables_insmod() to xtables.c as xtables_insmod()
Introduces xtables match/target registration

- moves lib_dir to xtables.c
- introduces struct pfinfo which has protocol family dependent infomations.
- unifies load_ip[6]tables_ko() and moves them as load_xtables_ko()
- introduces xt_{match,match_rule,target,tryload} and replaces
  ip[6]t_* with them
- unifies following functions and move them to xtables.c
        - find_{match,find_target}
        - compatible_revision, compatible_{match,target}_revision
- introduces xtables_register_{match,target} and make
  register_{match,target}[6] call them. xtables_register_* register ONLY
  matches/targets matched protocol family

Some concepts:
- source compatibility for libip[6]t_xxx.c with warning on compilation
  not binary compatibility.
- binary compatibility between 2.4/2.6 kernel and iptables/ip6tables,
  of cause.
- xtables is enough to support only one address family at runtime.
  Then xtables keeps infomations of only the focused address famiy
  in struct afinfo.
Moves some duplicated functions in ip[6]tables.c to xtables.c

string_to_number_ll, string_to_number_l, string_to_number,
service_to_port, parse_port, parse_interface, are moved.
Moves IPPROTO_* and IP[6]T_LIB_DIR definitions to xtables.h